From 9463570b71e4dc8b212eb8c258c9a5b9ebf280dc Mon Sep 17 00:00:00 2001
From: Jamal Kaabi-Mofrad <jamal.kaabimofrad@alfresco.com>
Date: Fri, 4 Mar 2022 18:36:59 +0000
Subject: [PATCH 1/2] Fix log4j security vulnerability reported in quay.io.

---
 pom.xml                                       |  5 ++++
 search-services/alfresco-search/pom.xml       | 30 ++++++++++++++++++-
 .../alfresco-solrclient-lib/pom.xml           | 12 ++++++--
 search-services/pom.xml                       |  2 +-
 4 files changed, 44 insertions(+), 5 deletions(-)

diff --git a/pom.xml b/pom.xml
index c1f5cd510..2e05d9a29 100644
--- a/pom.xml
+++ b/pom.xml
@@ -251,5 +251,10 @@
         <version>1.0.0</version>
         <scope>provided</scope>
       </dependency>
+       <dependency>
+           <groupId>ch.qos.reload4j</groupId>
+           <artifactId>reload4j</artifactId>
+           <version>1.2.18.3</version>
+       </dependency>
    </dependencies>
 </project>
diff --git a/search-services/alfresco-search/pom.xml b/search-services/alfresco-search/pom.xml
index bc80122af..8023ec0f5 100644
--- a/search-services/alfresco-search/pom.xml
+++ b/search-services/alfresco-search/pom.xml
@@ -21,6 +21,10 @@
                     <artifactId>servlet-api</artifactId>
                     <groupId>javax.servlet</groupId>
                 </exclusion>
+                <exclusion>
+                    <groupId>log4j</groupId>
+                    <artifactId>log4j</artifactId>
+                </exclusion>
             </exclusions>
         </dependency>
 
@@ -42,6 +46,10 @@
                     <groupId>jdk.tools</groupId>
                     <artifactId>jdk.tools</artifactId>
                 </exclusion>
+                <exclusion>
+                    <groupId>log4j</groupId>
+                    <artifactId>log4j</artifactId>
+                </exclusion>
             </exclusions>
         </dependency>
 
@@ -50,6 +58,12 @@
             <artifactId>solr-analysis-extras</artifactId>
             <version>${solr.version}</version>
             <scope>provided</scope>
+            <exclusions>
+                <exclusion>
+                    <groupId>log4j</groupId>
+                    <artifactId>log4j</artifactId>
+                </exclusion>
+            </exclusions>
         </dependency>
 
         <dependency>
@@ -74,6 +88,10 @@
                 	<groupId>org.bouncycastle</groupId>
                 	<artifactId>bcprov-jdk15on</artifactId>
                 </exclusion>
+                <exclusion>
+                    <groupId>log4j</groupId>
+                    <artifactId>log4j</artifactId>
+                </exclusion>
             </exclusions>
         </dependency>
 
@@ -87,6 +105,10 @@
                     <groupId>org.simpleframework</groupId>
                     <artifactId>simple-xml</artifactId>
                 </exclusion>
+                <exclusion>
+                    <groupId>log4j</groupId>
+                    <artifactId>log4j</artifactId>
+                </exclusion>
             </exclusions>
         </dependency>
         <!-- replace simple-xml from solr-clustering with simple-xml-safe -->
@@ -105,7 +127,7 @@
 
         <dependency>
             <groupId>org.slf4j</groupId>
-            <artifactId>slf4j-log4j12</artifactId>
+            <artifactId>slf4j-reload4j</artifactId>
             <version>${slf4j.version}</version>
         </dependency>
 
@@ -232,6 +254,12 @@
             <artifactId>solr-test-framework</artifactId>
             <version>${solr.version}</version>
             <scope>test</scope>
+            <exclusions>
+                <exclusion>
+                    <groupId>log4j</groupId>
+                    <artifactId>log4j</artifactId>
+                </exclusion>
+            </exclusions>
         </dependency>
         <dependency>
             <groupId>com.carrotsearch.randomizedtesting</groupId>
diff --git a/search-services/alfresco-solrclient-lib/pom.xml b/search-services/alfresco-solrclient-lib/pom.xml
index 26c11918d..e19c8a939 100644
--- a/search-services/alfresco-solrclient-lib/pom.xml
+++ b/search-services/alfresco-solrclient-lib/pom.xml
@@ -20,8 +20,14 @@
             <groupId>org.alfresco</groupId>
             <artifactId>alfresco-data-model</artifactId>
             <version>${dependency.alfresco-data-model.version}</version>
+            <exclusions>
+                <exclusion>
+                    <groupId>log4j</groupId>
+                    <artifactId>log4j</artifactId>
+                </exclusion>
+            </exclusions>
         </dependency>
-        
+
         <dependency>
             <groupId>com.fasterxml.jackson.core</groupId>
             <artifactId>jackson-core</artifactId>
@@ -66,8 +72,8 @@
         </dependency>
         <dependency>
             <groupId>org.slf4j</groupId>
-            <artifactId>slf4j-log4j12</artifactId>
-            <version>1.7.30</version>
+            <artifactId>slf4j-reload4j</artifactId>
+            <version>1.7.36</version>
         </dependency>
     </dependencies>
 
diff --git a/search-services/pom.xml b/search-services/pom.xml
index 8e73c50cb..dc761a974 100644
--- a/search-services/pom.xml
+++ b/search-services/pom.xml
@@ -14,7 +14,7 @@
     <packaging>pom</packaging>
     <name>Alfresco Solr Search parent</name>
     <properties>
-        <slf4j.version>1.7.30</slf4j.version>
+        <slf4j.version>1.7.36</slf4j.version>
         <cxf.version>3.2.14</cxf.version>
         <licenseName>community</licenseName>
     </properties>

From 9f7bcf67b10845bb16eb25dc539ca85a24713016 Mon Sep 17 00:00:00 2001
From: Jamal Kaabi-Mofrad <jamal.kaabimofrad@alfresco.com>
Date: Fri, 4 Mar 2022 20:58:08 +0000
Subject: [PATCH 2/2] Fix build failure

---
 search-services/packaging/src/main/resources/licenses/notice.txt | 1 +
 1 file changed, 1 insertion(+)

diff --git a/search-services/packaging/src/main/resources/licenses/notice.txt b/search-services/packaging/src/main/resources/licenses/notice.txt
index 27812ef08..b7160b60c 100644
--- a/search-services/packaging/src/main/resources/licenses/notice.txt
+++ b/search-services/packaging/src/main/resources/licenses/notice.txt
@@ -109,6 +109,7 @@ org.restlet.ext.servlet-2.3.12.jar https://github.com/restlet/restlet-framework-
 xercesImpl-2.11.0-alfresco-patched-20180402.jar http://www.apache.org/licenses/LICENSE-2.0.txt
 xml-apis-1.4.01.jar http://www.apache.org/licenses/LICENSE-2.0.txt
 simple-xml-safe-2.7.1.jar https://github.com/carrotsearch/simplexml-safe/blob/release/2.7.1/LICENSE.txt
+reload4j-1.2.18.3.jar http://www.apache.org/licenses/LICENSE-2.0.txt
 
 
 === Creative Commons Public Domain ===