Merge pull request #6686 from YevhenBondarenko/fix/vulnerabilities

[3.4]  fix vulnerabilities

application/src/main/java/org/thingsboard/server/ThingsboardInstallApplication.java

@@ -32,7 +32,9 @@ import java.util.Arrays;
         "org.thingsboard.server.dao",
         "org.thingsboard.server.common.stats",
         "org.thingsboard.server.common.transport.config.ssl",
-        "org.thingsboard.server.cache"})
+        "org.thingsboard.server.cache",
+        "org.thingsboard.server.springfox"
+})
 public class ThingsboardInstallApplication {
 
     private static final String SPRING_CONFIG_NAME_KEY = "--spring.config.name";

application/src/main/java/org/thingsboard/server/config/ThingsboardSecurityConfiguration.java

@@ -181,13 +181,18 @@ public class ThingsboardSecurityConfiguration extends WebSecurityConfigurerAdapt
     @Autowired
     private OAuth2AuthorizationRequestResolver oAuth2AuthorizationRequestResolver;
 
+    @Override
+    public void configure(WebSecurity web) throws Exception {
+        web.ignoring().antMatchers("/*.js","/*.css","/*.ico","/assets/**","/static/**");
+    }
+
     @Override
     protected void configure(HttpSecurity http) throws Exception {
-        http.authorizeHttpRequests((authorizeHttpRequests) ->
+//        http.authorizeHttpRequests((authorizeHttpRequests) ->
-                authorizeHttpRequests
+//                authorizeHttpRequests
-                        .antMatchers("/*.js","/*.css","/*.ico","/assets/**","/static/**")
+//                        .antMatchers("/*.js","/*.css","/*.ico","/assets/**","/static/**")
-                        .permitAll()
+//                        .permitAll()
-        );
+//        );
         http.headers().cacheControl().and().frameOptions().disable()
                 .and()
                 .cors()

application/src/main/java/org/thingsboard/server/springfox/SpringfoxHandlerProviderBeanPostProcessor.java

@@ -0,0 +1,60 @@
+/**
+ * Copyright © 2016-2022 The Thingsboard Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.thingsboard.server.springfox;
+
+import org.springframework.beans.BeansException;
+import org.springframework.beans.factory.config.BeanPostProcessor;
+import org.springframework.stereotype.Component;
+import org.springframework.util.ReflectionUtils;
+import org.springframework.web.servlet.mvc.method.RequestMappingInfoHandlerMapping;
+import org.thingsboard.server.queue.util.TbCoreComponent;
+import springfox.documentation.spring.web.plugins.WebMvcRequestHandlerProvider;
+
+import java.lang.reflect.Field;
+import java.util.List;
+import java.util.stream.Collectors;
+
+@Component
+//TODO: remove after fixing issue https://github.com/springfox/springfox/issues/3462 or after migration from springfox to springdoc
+public class SpringfoxHandlerProviderBeanPostProcessor implements BeanPostProcessor {
+
+    @Override
+    public Object postProcessAfterInitialization(Object bean, String beanName) throws BeansException {
+        if (bean instanceof WebMvcRequestHandlerProvider) {
+            customizeSpringfoxHandlerMappings(getHandlerMappings(bean));
+        }
+        return bean;
+    }
+
+    private <T extends RequestMappingInfoHandlerMapping> void customizeSpringfoxHandlerMappings(List<T> mappings) {
+        List<T> copy = mappings.stream()
+                .filter(mapping -> mapping.getPatternParser() == null)
+                .collect(Collectors.toList());
+        mappings.clear();
+        mappings.addAll(copy);
+    }
+
+    @SuppressWarnings("unchecked")
+    private List<RequestMappingInfoHandlerMapping> getHandlerMappings(Object bean) {
+        try {
+            Field field = ReflectionUtils.findField(bean.getClass(), "handlerMappings");
+            field.setAccessible(true);
+            return (List<RequestMappingInfoHandlerMapping>) field.get(bean);
+        } catch (IllegalArgumentException | IllegalAccessException e) {
+            throw new IllegalStateException(e);
+        }
+    }
+}

application/src/test/resources/application-test.properties

@@ -55,3 +55,5 @@ queue.rule-engine.queues[2].partitions=2
 queue.rule-engine.queues[2].processing-strategy.retries=1
 queue.rule-engine.queues[2].processing-strategy.pause-between-retries=0
 queue.rule-engine.queues[2].processing-strategy.max-pause-between-retries=0
+
+usage.stats.report.enabled=false

pom.xml

@@ -39,12 +39,12 @@
         <javax-annotation.version>1.3.2</javax-annotation.version>
         <jakarta.xml.bind-api.version>2.3.2</jakarta.xml.bind-api.version>
         <jaxb-runtime.version>2.3.2</jaxb-runtime.version>
-        <spring-boot.version>2.5.12</spring-boot.version>
+        <spring-boot.version>2.7.0</spring-boot.version>
-        <spring-data.version>2.5.10</spring-data.version>
+        <spring-data.version>2.7.0</spring-data.version>
-        <spring.version>5.3.18</spring.version>
+        <spring.version>5.3.20</spring.version>
-        <spring-redis.version>5.5.10</spring-redis.version>
+        <spring-redis.version>5.5.12</spring-redis.version>
-        <spring-security.version>5.6.2</spring-security.version>
+        <spring-security.version>5.7.1</spring-security.version>
-        <spring-data-redis.version>2.5.10</spring-data-redis.version>
+        <spring-data-redis.version>2.7.0</spring-data-redis.version>
         <jedis.version>3.7.1</jedis.version>
         <jjwt.version>0.7.0</jjwt.version>
         <slf4j.version>1.7.32</slf4j.version>
@@ -70,7 +70,7 @@
         <json-schema-validator.version>2.2.6</json-schema-validator.version>
         <californium.version>3.0.0</californium.version>
         <leshan.version>2.0.0-M5</leshan.version>
-        <gson.version>2.6.2</gson.version>
+        <gson.version>2.9.0</gson.version>
         <freemarker.version>2.3.30</freemarker.version>
         <mail.version>1.6.2</mail.version>
         <curator.version>4.2.0</curator.version>
@@ -112,21 +112,21 @@
         <ua-parser.version>1.4.3</ua-parser.version>
         <commons-beanutils.version>1.9.4</commons-beanutils.version>
         <commons-collections.version>3.2.2</commons-collections.version>
-        <micrometer.version>1.8.3</micrometer.version>
+        <micrometer.version>1.9.0</micrometer.version>
         <protobuf-dynamic.version>1.0.3TB</protobuf-dynamic.version>
         <wire-schema.version>3.4.0</wire-schema.version>
         <twilio.version>8.17.0</twilio.version>
         <hibernate-validator.version>6.0.20.Final</hibernate-validator.version>
         <javax.el.version>3.0.0</javax.el.version>
         <javax.validation-api.version>2.0.1.Final</javax.validation-api.version>
-        <antisamy.version>1.6.4</antisamy.version>
+        <antisamy.version>1.6.8</antisamy.version>
         <snmp4j.version>2.8.5</snmp4j.version>
         <!--         TEST SCOPE         -->
         <awaitility.version>4.1.0</awaitility.version>
         <cassandra-unit.version>4.3.1.0</cassandra-unit.version>
         <dbunit.version>2.7.2</dbunit.version>
         <java-websocket.version>1.5.2</java-websocket.version>
-        <jupiter.version>5.7.2</jupiter.version> <!-- keep the same version as spring-boot-starter-test depend on jupiter-->
+        <jupiter.version>5.8.2</jupiter.version> <!-- keep the same version as spring-boot-starter-test depend on jupiter-->
         <json-path.version>2.6.0</json-path.version>
         <spring-test-dbunit.version>1.3.0</spring-test-dbunit.version> <!-- 2016 -->
         <takari-cpsuite.version>1.2.7</takari-cpsuite.version> <!-- 2015 -->

transport/coap/src/main/resources/tb-coap-transport.yml

@@ -19,6 +19,8 @@ spring.main.web-environment: "${WEB_APPLICATION_ENABLE:false}"
 # If you enabled process metrics you should set 'web-application-type' to 'servlet' value.
 spring.main.web-application-type: "${WEB_APPLICATION_TYPE:none}"
 
+spring.main.allow-circular-references: "true"
+
 server:
   # Server bind address (has no effect if web-environment is disabled).
   address: "${HTTP_BIND_ADDRESS:0.0.0.0}"

transport/http/src/main/resources/tb-http-transport.yml

@@ -14,6 +14,8 @@
 # limitations under the License.
 #
 
+spring.main.allow-circular-references: "true"
+
 server:
   # Server bind address
   address: "${HTTP_BIND_ADDRESS:0.0.0.0}"

transport/lwm2m/src/main/resources/tb-lwm2m-transport.yml

@@ -19,6 +19,8 @@ spring.main.web-environment: "${WEB_APPLICATION_ENABLE:false}"
 # If you enabled process metrics you should set 'web-application-type' to 'servlet' value.
 spring.main.web-application-type: "${WEB_APPLICATION_TYPE:none}"
 
+spring.main.allow-circular-references: "true"
+
 server:
   # Server bind address (has no effect if web-environment is disabled).
   address: "${HTTP_BIND_ADDRESS:0.0.0.0}"

transport/mqtt/src/main/resources/tb-mqtt-transport.yml

@@ -19,6 +19,8 @@ spring.main.web-environment: "${WEB_APPLICATION_ENABLE:false}"
 # If you enabled process metrics you should set 'web-application-type' to 'servlet' value.
 spring.main.web-application-type: "${WEB_APPLICATION_TYPE:none}"
 
+spring.main.allow-circular-references: "true"
+
 server:
   # Server bind address (has no effect if web-environment is disabled).
   address: "${HTTP_BIND_ADDRESS:0.0.0.0}"

transport/snmp/src/main/resources/tb-snmp-transport.yml

@@ -19,6 +19,8 @@ spring.main.web-environment: "${WEB_APPLICATION_ENABLE:false}"
 # If you enabled process metrics you should set 'web-application-type' to 'servlet' value.
 spring.main.web-application-type: "${WEB_APPLICATION_TYPE:none}"
 
+spring.main.allow-circular-references: "true"
+
 server:
   # Server bind address (has no effect if web-environment is disabled).
   address: "${HTTP_BIND_ADDRESS:0.0.0.0}"