From 9463570b71e4dc8b212eb8c258c9a5b9ebf280dc Mon Sep 17 00:00:00 2001
From: Jamal Kaabi-Mofrad <jamal.kaabimofrad@alfresco.com>
Date: Fri, 4 Mar 2022 18:36:59 +0000
Subject: [PATCH] Fix log4j security vulnerability reported in quay.io.

---
 pom.xml                                       |  5 ++++
 search-services/alfresco-search/pom.xml       | 30 ++++++++++++++++++-
 .../alfresco-solrclient-lib/pom.xml           | 12 ++++++--
 search-services/pom.xml                       |  2 +-
 4 files changed, 44 insertions(+), 5 deletions(-)

diff --git a/pom.xml b/pom.xml
index c1f5cd510..2e05d9a29 100644
--- a/pom.xml
+++ b/pom.xml
@@ -251,5 +251,10 @@
         <version>1.0.0</version>
         <scope>provided</scope>
       </dependency>
+       <dependency>
+           <groupId>ch.qos.reload4j</groupId>
+           <artifactId>reload4j</artifactId>
+           <version>1.2.18.3</version>
+       </dependency>
    </dependencies>
 </project>
diff --git a/search-services/alfresco-search/pom.xml b/search-services/alfresco-search/pom.xml
index bc80122af..8023ec0f5 100644
--- a/search-services/alfresco-search/pom.xml
+++ b/search-services/alfresco-search/pom.xml
@@ -21,6 +21,10 @@
                     <artifactId>servlet-api</artifactId>
                     <groupId>javax.servlet</groupId>
                 </exclusion>
+                <exclusion>
+                    <groupId>log4j</groupId>
+                    <artifactId>log4j</artifactId>
+                </exclusion>
             </exclusions>
         </dependency>
 
@@ -42,6 +46,10 @@
                     <groupId>jdk.tools</groupId>
                     <artifactId>jdk.tools</artifactId>
                 </exclusion>
+                <exclusion>
+                    <groupId>log4j</groupId>
+                    <artifactId>log4j</artifactId>
+                </exclusion>
             </exclusions>
         </dependency>
 
@@ -50,6 +58,12 @@
             <artifactId>solr-analysis-extras</artifactId>
             <version>${solr.version}</version>
             <scope>provided</scope>
+            <exclusions>
+                <exclusion>
+                    <groupId>log4j</groupId>
+                    <artifactId>log4j</artifactId>
+                </exclusion>
+            </exclusions>
         </dependency>
 
         <dependency>
@@ -74,6 +88,10 @@
                 	<groupId>org.bouncycastle</groupId>
                 	<artifactId>bcprov-jdk15on</artifactId>
                 </exclusion>
+                <exclusion>
+                    <groupId>log4j</groupId>
+                    <artifactId>log4j</artifactId>
+                </exclusion>
             </exclusions>
         </dependency>
 
@@ -87,6 +105,10 @@
                     <groupId>org.simpleframework</groupId>
                     <artifactId>simple-xml</artifactId>
                 </exclusion>
+                <exclusion>
+                    <groupId>log4j</groupId>
+                    <artifactId>log4j</artifactId>
+                </exclusion>
             </exclusions>
         </dependency>
         <!-- replace simple-xml from solr-clustering with simple-xml-safe -->
@@ -105,7 +127,7 @@
 
         <dependency>
             <groupId>org.slf4j</groupId>
-            <artifactId>slf4j-log4j12</artifactId>
+            <artifactId>slf4j-reload4j</artifactId>
             <version>${slf4j.version}</version>
         </dependency>
 
@@ -232,6 +254,12 @@
             <artifactId>solr-test-framework</artifactId>
             <version>${solr.version}</version>
             <scope>test</scope>
+            <exclusions>
+                <exclusion>
+                    <groupId>log4j</groupId>
+                    <artifactId>log4j</artifactId>
+                </exclusion>
+            </exclusions>
         </dependency>
         <dependency>
             <groupId>com.carrotsearch.randomizedtesting</groupId>
diff --git a/search-services/alfresco-solrclient-lib/pom.xml b/search-services/alfresco-solrclient-lib/pom.xml
index 26c11918d..e19c8a939 100644
--- a/search-services/alfresco-solrclient-lib/pom.xml
+++ b/search-services/alfresco-solrclient-lib/pom.xml
@@ -20,8 +20,14 @@
             <groupId>org.alfresco</groupId>
             <artifactId>alfresco-data-model</artifactId>
             <version>${dependency.alfresco-data-model.version}</version>
+            <exclusions>
+                <exclusion>
+                    <groupId>log4j</groupId>
+                    <artifactId>log4j</artifactId>
+                </exclusion>
+            </exclusions>
         </dependency>
-        
+
         <dependency>
             <groupId>com.fasterxml.jackson.core</groupId>
             <artifactId>jackson-core</artifactId>
@@ -66,8 +72,8 @@
         </dependency>
         <dependency>
             <groupId>org.slf4j</groupId>
-            <artifactId>slf4j-log4j12</artifactId>
-            <version>1.7.30</version>
+            <artifactId>slf4j-reload4j</artifactId>
+            <version>1.7.36</version>
         </dependency>
     </dependencies>
 
diff --git a/search-services/pom.xml b/search-services/pom.xml
index 8e73c50cb..dc761a974 100644
--- a/search-services/pom.xml
+++ b/search-services/pom.xml
@@ -14,7 +14,7 @@
     <packaging>pom</packaging>
     <name>Alfresco Solr Search parent</name>
     <properties>
-        <slf4j.version>1.7.30</slf4j.version>
+        <slf4j.version>1.7.36</slf4j.version>
         <cxf.version>3.2.14</cxf.version>
         <licenseName>community</licenseName>
     </properties>