Merge pull request #125 from thingsboard/versions-update

[1.3.1] Major versions update and vulnerabilities fixes
thingsboard · Jun 17, 2024 · af7f7f1 · af7f7f1
2 parents eff45b1 + d6392ee
commit af7f7f1
Show file tree

Hide file tree

Showing 157 changed files with 983 additions and 1,270 deletions.
diff --git a/application/pom.xml b/application/pom.xml
@@ -137,7 +137,7 @@
  </dependency>
  <dependency>
  <groupId>com.sun.mail</groupId>
- <artifactId>javax.mail</artifactId>
+ <artifactId>jakarta.mail</artifactId>
  </dependency>
  <dependency>
  <groupId>com.google.protobuf</groupId>
@@ -149,19 +149,19 @@
  </dependency>
  <dependency>
  <groupId>org.thingsboard</groupId>
- <artifactId>springfox-boot-starter</artifactId>
+ <artifactId>springdoc-openapi-starter-webmvc-ui</artifactId>
  </dependency>
  <dependency>
  <groupId>org.bouncycastle</groupId>
- <artifactId>bcprov-jdk15on</artifactId>
+ <artifactId>bcprov-jdk18on</artifactId>
  </dependency>
  <dependency>
  <groupId>org.freemarker</groupId>
  <artifactId>freemarker</artifactId>
  </dependency>
  <dependency>
  <groupId>org.bouncycastle</groupId>
- <artifactId>bcpkix-jdk15on</artifactId>
+ <artifactId>bcpkix-jdk18on</artifactId>
  </dependency>
 
  <dependency>
@@ -175,12 +175,6 @@
  <groupId>org.springframework.boot</groupId>
  <artifactId>spring-boot-starter-test</artifactId>
  <scope>test</scope>
- <exclusions>
- <exclusion>
- <groupId>com.vaadin.external.google</groupId>
- <artifactId>android-json</artifactId>
- </exclusion>
- </exclusions>
  </dependency>
  <dependency>
  <groupId>org.springframework.security</groupId>
@@ -194,7 +188,7 @@
  </dependency>
  <dependency>
  <groupId>org.mockito</groupId>
- <artifactId>mockito-all</artifactId>
+ <artifactId>mockito-core</artifactId>
  <scope>test</scope>
  </dependency>
  <dependency>

diff --git a/...in/java/org/thingsboard/mqtt/broker/actors/client/service/connect/ConnectServiceImpl.java b/...in/java/org/thingsboard/mqtt/broker/actors/client/service/connect/ConnectServiceImpl.java
@@ -22,6 +22,8 @@
 import io.netty.handler.codec.mqtt.MqttConnectReturnCode;
 import io.netty.handler.codec.mqtt.MqttProperties;
 import io.netty.handler.codec.mqtt.MqttVersion;
+import jakarta.annotation.PostConstruct;
+import jakarta.annotation.PreDestroy;
 import lombok.RequiredArgsConstructor;
 import lombok.Setter;
 import lombok.extern.slf4j.Slf4j;
@@ -66,8 +68,6 @@
 import org.thingsboard.mqtt.broker.util.MqttPropertiesUtil;
 import org.thingsboard.mqtt.broker.util.MqttReasonCodeResolver;
 
-import javax.annotation.PostConstruct;
-import javax.annotation.PreDestroy;
 import java.util.Set;
 import java.util.UUID;
 import java.util.concurrent.ExecutorService;

diff --git a/...n/java/org/thingsboard/mqtt/broker/actors/client/service/handlers/MqttPublishHandler.java b/...n/java/org/thingsboard/mqtt/broker/actors/client/service/handlers/MqttPublishHandler.java
@@ -17,6 +17,8 @@
 
 import io.netty.handler.codec.mqtt.MqttReasonCodes;
 import io.netty.handler.codec.mqtt.MqttVersion;
+import jakarta.annotation.PostConstruct;
+import jakarta.annotation.PreDestroy;
 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
 import org.springframework.beans.factory.annotation.Value;
@@ -49,8 +51,6 @@
 import org.thingsboard.mqtt.broker.session.TopicAliasCtx;
 import org.thingsboard.mqtt.broker.util.MqttReasonCodeResolver;
 
-import javax.annotation.PostConstruct;
-import javax.annotation.PreDestroy;
 import java.util.List;
 import java.util.UUID;
 import java.util.concurrent.ExecutorService;

diff --git a/.../org/thingsboard/mqtt/broker/actors/client/service/session/SessionClusterManagerImpl.java b/.../org/thingsboard/mqtt/broker/actors/client/service/session/SessionClusterManagerImpl.java
@@ -15,6 +15,8 @@
  */
 package org.thingsboard.mqtt.broker.actors.client.service.session;
 
+import jakarta.annotation.PostConstruct;
+import jakarta.annotation.PreDestroy;
 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
 import org.springframework.beans.factory.annotation.Value;
@@ -50,8 +52,6 @@
 import org.thingsboard.mqtt.broker.service.mqtt.persistence.application.topic.ApplicationTopicService;
 import org.thingsboard.mqtt.broker.util.BytesUtil;
 
-import javax.annotation.PostConstruct;
-import javax.annotation.PreDestroy;
 import java.util.Set;
 import java.util.UUID;
 import java.util.concurrent.ExecutorService;

diff --git a/...ication/src/main/java/org/thingsboard/mqtt/broker/actors/config/ActorSystemLifecycle.java b/...ication/src/main/java/org/thingsboard/mqtt/broker/actors/config/ActorSystemLifecycle.java
@@ -15,6 +15,8 @@
  */
 package org.thingsboard.mqtt.broker.actors.config;
 
+import jakarta.annotation.PostConstruct;
+import jakarta.annotation.PreDestroy;
 import lombok.AllArgsConstructor;
 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
@@ -31,8 +33,6 @@
 import org.thingsboard.mqtt.broker.service.mqtt.client.session.ClientSessionCtxService;
 import org.thingsboard.mqtt.broker.session.ClientSessionCtx;
 
-import javax.annotation.PostConstruct;
-import javax.annotation.PreDestroy;
 import java.util.Collection;
 import java.util.concurrent.CountDownLatch;
 import java.util.concurrent.ExecutorService;

diff --git a/application/src/main/java/org/thingsboard/mqtt/broker/cluster/ServiceInfoProviderImpl.java b/application/src/main/java/org/thingsboard/mqtt/broker/cluster/ServiceInfoProviderImpl.java
@@ -15,14 +15,14 @@
  */
 package org.thingsboard.mqtt.broker.cluster;
 
+import jakarta.annotation.PostConstruct;
 import lombok.extern.slf4j.Slf4j;
 import org.apache.commons.lang3.RandomStringUtils;
 import org.springframework.beans.factory.annotation.Value;
 import org.springframework.stereotype.Service;
 import org.thingsboard.mqtt.broker.common.data.StringUtils;
 import org.thingsboard.mqtt.broker.gen.queue.QueueProtos;
 
-import javax.annotation.PostConstruct;
 import java.net.InetAddress;
 import java.net.UnknownHostException;
 

diff --git a/application/src/main/java/org/thingsboard/mqtt/broker/config/ApplicationStatusChecker.java b/application/src/main/java/org/thingsboard/mqtt/broker/config/ApplicationStatusChecker.java
@@ -16,11 +16,10 @@
 package org.thingsboard.mqtt.broker.config;
 
 import com.zaxxer.hikari.HikariDataSource;
+import jakarta.annotation.PostConstruct;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.context.annotation.Configuration;
 
-import javax.annotation.PostConstruct;
-
 @Configuration
 public class ApplicationStatusChecker {
 

diff --git a/application/src/main/java/org/thingsboard/mqtt/broker/config/SecurityConfiguration.java b/application/src/main/java/org/thingsboard/mqtt/broker/config/SecurityConfiguration.java
@@ -28,9 +28,10 @@
 import org.springframework.security.authentication.DefaultAuthenticationEventPublisher;
 import org.springframework.security.config.annotation.ObjectPostProcessor;
 import org.springframework.security.config.annotation.authentication.builders.AuthenticationManagerBuilder;
-import org.springframework.security.config.annotation.method.configuration.EnableGlobalMethodSecurity;
+import org.springframework.security.config.annotation.method.configuration.EnableMethodSecurity;
 import org.springframework.security.config.annotation.web.builders.HttpSecurity;
 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity;
+import org.springframework.security.config.annotation.web.configurers.AbstractHttpConfigurer;
 import org.springframework.security.config.http.SessionCreationPolicy;
 import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
 import org.springframework.security.web.SecurityFilterChain;
@@ -55,16 +56,15 @@
 
 @Configuration
 @EnableWebSecurity
-@EnableGlobalMethodSecurity(prePostEnabled = true)
+@EnableMethodSecurity
 @Order(SecurityProperties.BASIC_AUTH_ORDER)
 public class SecurityConfiguration {
 
  public static final String JWT_TOKEN_HEADER_PARAM = "X-Authorization";
  public static final String JWT_TOKEN_HEADER_PARAM_V2 = "Authorization";
  public static final String FORM_BASED_LOGIN_ENTRY_POINT = "/api/auth/login";
  public static final String TOKEN_REFRESH_ENTRY_POINT = "/api/auth/token";
- protected static final String[] NON_TOKEN_BASED_AUTH_ENTRY_POINTS = new String[]{"/index.html", "/static/**", "/api/noauth/**"};
- public static final String WEBJARS_ENTRY_POINT = "/webjars/**";
+ protected static final String[] NON_TOKEN_BASED_AUTH_ENTRY_POINTS = new String[]{"/index.html", "/static/**", "/api/noauth/**", "/webjars/**"};
  public static final String TOKEN_BASED_AUTH_ENTRY_POINT = "/api/**";
 
  @Autowired
@@ -113,38 +113,35 @@ public AuthenticationManager authenticationManager(ObjectPostProcessor<Object> o
 
  @Bean
  SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
- http.headers().cacheControl().and().frameOptions().disable()
- .and()
- .cors()
- .and()
- .csrf().disable()
- .exceptionHandling()
- .and()
- .sessionManagement()
- .sessionCreationPolicy(SessionCreationPolicy.STATELESS)
- .and()
- .authorizeRequests()
- .antMatchers(WEBJARS_ENTRY_POINT).permitAll() // Webjars
- .antMatchers(FORM_BASED_LOGIN_ENTRY_POINT).permitAll() // Login end-point
- .antMatchers(TOKEN_REFRESH_ENTRY_POINT).permitAll() // Token refresh end-point
- .antMatchers(NON_TOKEN_BASED_AUTH_ENTRY_POINTS).permitAll() // static resources, user activation and password reset end-points
- .and()
- .authorizeRequests()
- .antMatchers(TOKEN_BASED_AUTH_ENTRY_POINT).authenticated() // Protected API End-points
- .and()
- .exceptionHandling().accessDeniedHandler(restAccessDeniedHandler)
- .and()
+ http.headers(headers -> headers
+ .cacheControl(config -> {
+ })
+ .frameOptions(config -> {
+ }).disable())
+ .cors(cors -> {
+ })
+ .csrf(AbstractHttpConfigurer::disable)
+ .exceptionHandling(config -> {
+ })
+ .sessionManagement(config -> config.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
+ .authorizeHttpRequests(config -> config
+ .requestMatchers(NON_TOKEN_BASED_AUTH_ENTRY_POINTS).permitAll() // static resources, user activation and password reset end-points (webjars included)
+ .requestMatchers(
+ FORM_BASED_LOGIN_ENTRY_POINT, // Login end-point
+ TOKEN_REFRESH_ENTRY_POINT).permitAll() // Token refresh end-point
+ .requestMatchers(TOKEN_BASED_AUTH_ENTRY_POINT).authenticated() // Protected API End-points
+ .anyRequest().permitAll())
+ .exceptionHandling(config -> config.accessDeniedHandler(restAccessDeniedHandler))
  .addFilterBefore(buildRestLoginProcessingFilter(), UsernamePasswordAuthenticationFilter.class)
  .addFilterBefore(buildJwtTokenAuthenticationProcessingFilter(), UsernamePasswordAuthenticationFilter.class)
- .addFilterBefore(buildRefreshTokenProcessingFilter(), UsernamePasswordAuthenticationFilter.class)
- ;
+ .addFilterBefore(buildRefreshTokenProcessingFilter(), UsernamePasswordAuthenticationFilter.class);
  return http.build();
  }
 
  @Bean
  @ConditionalOnMissingBean(CorsFilter.class)
  public CorsFilter corsFilter(@Autowired MvcCorsProperties mvcCorsProperties) {
- if (mvcCorsProperties.getMappings().size() == 0) {
+ if (mvcCorsProperties.getMappings().isEmpty()) {
  return new CorsFilter(new UrlBasedCorsConfigurationSource());
  } else {
  UrlBasedCorsConfigurationSource source = new UrlBasedCorsConfigurationSource();
@@ -163,7 +160,7 @@ protected RestLoginProcessingFilter buildRestLoginProcessingFilter() throws Exce
  @Bean
  protected JwtTokenAuthenticationProcessingFilter buildJwtTokenAuthenticationProcessingFilter() throws Exception {
  List<String> pathsToSkip = new ArrayList<>(Arrays.asList(NON_TOKEN_BASED_AUTH_ENTRY_POINTS));
- pathsToSkip.addAll(Arrays.asList(TOKEN_REFRESH_ENTRY_POINT, FORM_BASED_LOGIN_ENTRY_POINT, WEBJARS_ENTRY_POINT));
+ pathsToSkip.addAll(Arrays.asList(TOKEN_REFRESH_ENTRY_POINT, FORM_BASED_LOGIN_ENTRY_POINT));
  SkipPathRequestMatcher matcher = new SkipPathRequestMatcher(pathsToSkip, TOKEN_BASED_AUTH_ENTRY_POINT);
  JwtTokenAuthenticationProcessingFilter filter
  = new JwtTokenAuthenticationProcessingFilter(failureHandler, tokenExtractor, matcher);