From 91c560bdb3e4ffb5401ea6f957b2edf1a3167a76 Mon Sep 17 00:00:00 2001
From: Michael Suzuki <michael.suzuki@alfresco.com>
Date: Thu, 9 Feb 2017 13:16:29 +0000
Subject: [PATCH] Search-298, updated the build to replace vulnerable jar with
 safe ones

---
 packaging/pom.xml                            | 173 ++++++++++---------
 packaging/src/assembly/solr-distribution.xml |   3 +-
 2 files changed, 98 insertions(+), 78 deletions(-)

diff --git a/packaging/pom.xml b/packaging/pom.xml
index 39edfeb93..811cc4ffd 100644
--- a/packaging/pom.xml
+++ b/packaging/pom.xml
@@ -52,6 +52,7 @@
                 </execution>
             </executions>
           </plugin>
+          
           <plugin>
               <groupId>org.apache.maven.plugins</groupId>
               <artifactId>maven-dependency-plugin</artifactId>
@@ -131,85 +132,103 @@
                           <overWriteSnapshots>true</overWriteSnapshots>
                       </configuration>
                   </execution>
+                  <execution>
+                      <id>replace</id>
+                      <phase>validate</phase>
+                      <goals>
+                          <goal>copy</goal>
+                      </goals>
+                      <configuration>
+                          <artifactItems>
+                              <artifactItem>
+                                  <groupId>commons-fileupload</groupId>
+                                  <artifactId>commons-fileupload</artifactId>
+                                  <version>1.3.2</version>
+                                  <outputDirectory>${project.build.directory}/solr-libs/libs</outputDirectory>
+                              </artifactItem>
+                          </artifactItems>
+                      </configuration>
+                  </execution>
               </executions>
           </plugin>
-            <plugin>
-                <!-- Set the default solr home directory to solrhome -->
-                <artifactId>maven-antrun-plugin</artifactId>
-                <executions>
-                    <execution>
-                        <phase>prepare-package</phase>
-                        <configuration>
-                            <target>
-                                <replace token= "SOLR_SERVER_DIR/solr" value="SOLR_TIP/../solrhome" dir="target/solr-${solr.version}">
-                                    <include name="**/bin/solr"/>
-                                </replace>
-                                <replace token= "%SOLR_SERVER_DIR%\solr" value="%SOLR_TIP%\..\solrhome" dir="target/solr-${solr.version}">
-                                    <include name="**/bin/solr.cmd"/>
-                                </replace>
-                                <replace token= "HOME/.solr.in.sh" value="SOLR_TIP/../solr.in.sh" dir="target/solr-${solr.version}">
-                                    <include name="**/bin/solr"/>
-                                </replace>
-                                <replace token= "\bin\solr.in.cmd" value="\..\solr.in.cmd" dir="target/solr-${solr.version}">
-                                    <include name="**/bin/solr.cmd"/>
-                                </replace>
-                                <replace token= "SOLR_SSL_OPTS=%SOLR_SSL_OPTS%" value="SOLR_SSL_OPTS=!SOLR_SSL_OPTS!" dir="target/solr-${solr.version}">
-                                    <include name="**/bin/solr.cmd"/>
-                                </replace>
-                                <replace token= "#SOLR_LOGS_DIR=logs" value="${alfresco.search.logs}" dir="target/solr-${solr.version}">
-                                    <include name="**/bin/solr.in.sh"/>
-                                </replace>
-                                <replace token= "REM set SOLR_LOGS_DIR=logs" value="${alfresco.search.logs.win}" dir="target/solr-${solr.version}">
-                                    <include name="**/bin/solr.in.cmd"/>
-                                </replace>
-                                <replace token= "GC logging" value="GC logging${line.separator}${alfresco.gc.logs}" dir="target/solr-${solr.version}">
-                                    <include name="**/bin/solr.in.sh"/>
-                                </replace>
-                                <replace token= "GC logging" value="GC logging${line.separator}${alfresco.gc.logs.win}" dir="target/solr-${solr.version}">
-                                    <include name="**/bin/solr.in.cmd"/>
-                                </replace>
-                                <replace token= "# Anything you add to the SOLR_OPTS" value="${alfresco.search.config}${line.separator}${line.separator}# Anything you add to the SOLR_OPTS" dir="target/solr-${solr.version}">
-                                    <include name="**/bin/solr.in.sh"/>
-                                </replace>
-                                <replace token= "REM Anything you add to the SOLR_OPTS" value="${alfresco.search.config.win}${line.separator}${line.separator}REM Anything you add to the SOLR_OPTS" dir="target/solr-${solr.version}">
-                                    <include name="**/bin/solr.in.cmd"/>
-                                </replace>
-                                <replace token= "${alfresco.search.ssl.token}" value="${alfresco.search.ssl}${line.separator}  ${alfresco.search.ssl.token}" dir="target/solr-${solr.version}">
-                                    <include name="**/server/etc/jetty*.xml"/>
-                                </replace>
-                                <replace token= "${alfresco.search.ssl.need.token}" value="${alfresco.search.ssl.need}" dir="target/solr-${solr.version}">
-                                    <include name="**/server/etc/jetty-ssl.xml"/>
-                                </replace>
-                                <replace token= "wantClientAuth" value="wantclientauth" dir="target/solr-${solr.version}">
-                                    <include name="**/server/etc/jetty-ssl.xml"/>
-                                </replace>
-                                <chmod file="target/solr-${solr.version}/bin/solr" perm="755"/>
-                            </target>
-                        </configuration>
-                        <goals>
-                            <goal>run</goal>
-                        </goals>
-                    </execution>
-                </executions>
-            </plugin>
-            <plugin>
-                <artifactId>maven-assembly-plugin</artifactId>
-                <executions>
-                    <execution>
-                        <id>make-assembly</id>
-                        <phase>package</phase>
-                        <goals>
-                            <goal>single</goal>
-                        </goals>
-                    </execution>
-                </executions>
-                <configuration>
-                    <appendAssemblyId>false</appendAssemblyId>
-                    <descriptors>
-                        <descriptor>src/assembly/solr-distribution.xml</descriptor>
-                    </descriptors>
-                </configuration>
-            </plugin>
+
+          <plugin>
+              <!-- Set the default solr home directory to solrhome -->
+              <artifactId>maven-antrun-plugin</artifactId>
+              <executions>
+                  <execution>
+                      <phase>prepare-package</phase>
+                      <configuration>
+                          <target>
+                              <replace token= "SOLR_SERVER_DIR/solr" value="SOLR_TIP/../solrhome" dir="target/solr-${solr.version}">
+                                  <include name="**/bin/solr"/>
+                              </replace>
+                              <replace token= "%SOLR_SERVER_DIR%\solr" value="%SOLR_TIP%\..\solrhome" dir="target/solr-${solr.version}">
+                                  <include name="**/bin/solr.cmd"/>
+                              </replace>
+                              <replace token= "HOME/.solr.in.sh" value="SOLR_TIP/../solr.in.sh" dir="target/solr-${solr.version}">
+                                  <include name="**/bin/solr"/>
+                              </replace>
+                              <replace token= "\bin\solr.in.cmd" value="\..\solr.in.cmd" dir="target/solr-${solr.version}">
+                                  <include name="**/bin/solr.cmd"/>
+                              </replace>
+                              <replace token= "SOLR_SSL_OPTS=%SOLR_SSL_OPTS%" value="SOLR_SSL_OPTS=!SOLR_SSL_OPTS!" dir="target/solr-${solr.version}">
+                                  <include name="**/bin/solr.cmd"/>
+                              </replace>
+                              <replace token= "#SOLR_LOGS_DIR=logs" value="${alfresco.search.logs}" dir="target/solr-${solr.version}">
+                                  <include name="**/bin/solr.in.sh"/>
+                              </replace>
+                              <replace token= "REM set SOLR_LOGS_DIR=logs" value="${alfresco.search.logs.win}" dir="target/solr-${solr.version}">
+                                  <include name="**/bin/solr.in.cmd"/>
+                              </replace>
+                              <replace token= "GC logging" value="GC logging${line.separator}${alfresco.gc.logs}" dir="target/solr-${solr.version}">
+                                  <include name="**/bin/solr.in.sh"/>
+                              </replace>
+                              <replace token= "GC logging" value="GC logging${line.separator}${alfresco.gc.logs.win}" dir="target/solr-${solr.version}">
+                                  <include name="**/bin/solr.in.cmd"/>
+                              </replace>
+                              <replace token= "# Anything you add to the SOLR_OPTS" value="${alfresco.search.config}${line.separator}${line.separator}# Anything you add to the SOLR_OPTS" dir="target/solr-${solr.version}">
+                                  <include name="**/bin/solr.in.sh"/>
+                              </replace>
+                              <replace token= "REM Anything you add to the SOLR_OPTS" value="${alfresco.search.config.win}${line.separator}${line.separator}REM Anything you add to the SOLR_OPTS" dir="target/solr-${solr.version}">
+                                  <include name="**/bin/solr.in.cmd"/>
+                              </replace>
+                              <replace token= "${alfresco.search.ssl.token}" value="${alfresco.search.ssl}${line.separator}  ${alfresco.search.ssl.token}" dir="target/solr-${solr.version}">
+                                  <include name="**/server/etc/jetty*.xml"/>
+                              </replace>
+                              <replace token= "${alfresco.search.ssl.need.token}" value="${alfresco.search.ssl.need}" dir="target/solr-${solr.version}">
+                                  <include name="**/server/etc/jetty-ssl.xml"/>
+                              </replace>
+                              <replace token= "wantClientAuth" value="wantclientauth" dir="target/solr-${solr.version}">
+                                  <include name="**/server/etc/jetty-ssl.xml"/>
+                              </replace>
+                              <chmod file="target/solr-${solr.version}/bin/solr" perm="755"/>
+                          </target>
+                      </configuration>
+                      <goals>
+                          <goal>run</goal>
+                      </goals>
+                  </execution>
+              </executions>
+          </plugin>
+          <plugin>
+              <artifactId>maven-assembly-plugin</artifactId>
+              <executions>
+                  <execution>
+                      <id>make-assembly</id>
+                      <phase>package</phase>
+                      <goals>
+                          <goal>single</goal>
+                      </goals>
+                  </execution>
+              </executions>
+              <configuration>
+                  <appendAssemblyId>false</appendAssemblyId>
+                  <descriptors>
+                      <descriptor>src/assembly/solr-distribution.xml</descriptor>
+                  </descriptors>
+              </configuration>
+          </plugin>
         </plugins>
     </build>
 </project>
diff --git a/packaging/src/assembly/solr-distribution.xml b/packaging/src/assembly/solr-distribution.xml
index 55ef89f1b..8de3429d6 100644
--- a/packaging/src/assembly/solr-distribution.xml
+++ b/packaging/src/assembly/solr-distribution.xml
@@ -32,7 +32,7 @@
                 <exclude>**/example/**</exclude>
                 <exclude>**/bin/solr.in.sh</exclude>
                 <exclude>**/bin/solr.in.cmd</exclude>
-                
+                <exclude>**/commons-fileupload-1.3.1.jar</exclude>
             </excludes>
         </fileSet>
         <!-- Solr config -->
@@ -52,6 +52,7 @@
             <excludes>
                 <exclude>**/workspace-SpacesStore/**</exclude>
                 <exclude>**/archive-SpacesStore/**</exclude>
+                <exclude>**/commons-fileupload-1.3.1.jar</exclude>
                 <exclude>context.xml</exclude>
             </excludes>
         </fileSet>