Skip to content

MODINV-1321: Vert.x 4.5.23 fixing CVE-2025-67735 Netty CRLF injection #879

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
julianladisch wants to merge 1 commit into
base: master
Choose a base branch
from
Draft

MODINV-1321: Vert.x 4.5.23 fixing CVE-2025-67735 Netty CRLF injection #879

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 10 additions & 1 deletion pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -235,6 +235,10 @@
<groupId>xerces</groupId>
<artifactId>xmlParserAPIs</artifactId>
</exclusion>
<exclusion>
<groupId>com.ongres.scram</groupId>
<artifactId>client</artifactId>
</exclusion>
</exclusions>
</dependency>

Expand Down Expand Up @@ -284,6 +288,11 @@
<groupId>io.vertx</groupId>
<artifactId>vertx-pg-client</artifactId>
</dependency>
<dependency>
<groupId>com.ongres.scram</groupId>
<artifactId>scram-client</artifactId>
<version>3.2</version>
</dependency>
<dependency>
<groupId>org.postgresql</groupId>
<artifactId>postgresql</artifactId>
Expand All @@ -299,7 +308,7 @@
<properties>
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
<project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
<vertx.version>4.5.13</vertx.version>
<vertx.version>4.5.23</vertx.version>
<jsonschema2pojo_output_dir>${project.build.directory}/generated-sources/jsonschema2pojo</jsonschema2pojo_output_dir>
<httpcomponents.version>4.5.14</httpcomponents.version>
<lombok.version>1.18.30</lombok.version>
Expand Down
44 changes: 10 additions & 34 deletions src/test/java/org/folio/inventory/dao/EntityIdStorageDaoImplTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,6 @@

import io.vertx.core.Future;
import io.vertx.core.Vertx;
import io.vertx.ext.unit.Async;
import io.vertx.ext.unit.TestContext;
import io.vertx.ext.unit.junit.VertxUnitRunner;
import org.folio.inventory.common.dao.EntityIdStorageDao;
Expand Down Expand Up @@ -57,74 +56,51 @@ public void before() {

@Test
public void shouldReturnSavedRecordToInstance(TestContext context) {
Async async = context.async();

RecordToEntity expectedRecordToInstance = RecordToEntity.builder().table(EntityTable.INSTANCE).recordId(RECORD_ID).entityId(INSTANCE_ID).build();

Future<RecordToEntity> future = entityIdStorageDao.saveRecordToEntityRelationship(expectedRecordToInstance, TENANT_ID);

future.onComplete(ar -> {
context.assertTrue(ar.succeeded());
RecordToEntity actualRecordToEntity = ar.result();
future.onComplete(context.asyncAssertSuccess(actualRecordToEntity -> {
context.assertEquals(expectedRecordToInstance.getRecordId(), actualRecordToEntity.getRecordId());
context.assertEquals(expectedRecordToInstance.getEntityId(), actualRecordToEntity.getEntityId());
context.assertEquals(expectedRecordToInstance.getTable(), actualRecordToEntity.getTable());
async.complete();
});
}));
}

@Test
public void shouldReturnSavedRecordToItem(TestContext context) {
Async async = context.async();

String recordId = "567859ad-505a-400d-a699-0028a1fdbf84";
String itemId = "4d4545df-b5ba-4031-a031-70b1c1b2fc5d";
RecordToEntity expectedRecordToItem = RecordToEntity.builder().table(EntityTable.ITEM).recordId(recordId).entityId(itemId).build();

Future<RecordToEntity> optionalFuture = entityIdStorageDao.saveRecordToEntityRelationship(expectedRecordToItem, TENANT_ID);
optionalFuture.onComplete(ar -> {
context.assertTrue(ar.succeeded());
RecordToEntity actualRecordToEntity = ar.result();
optionalFuture.onComplete(context.asyncAssertSuccess(actualRecordToEntity -> {
context.assertEquals(expectedRecordToItem.getRecordId(), actualRecordToEntity.getRecordId());
context.assertEquals(expectedRecordToItem.getEntityId(), actualRecordToEntity.getEntityId());
context.assertEquals(expectedRecordToItem.getTable(), actualRecordToEntity.getTable());

async.complete();
});
}));
}

@Test
public void shouldReturnFailedFuture(TestContext context) {
Async async = context.async();

RecordToEntity expectedRecordToInstance = RecordToEntity.builder().table(EntityTable.INSTANCE).recordId(RECORD_ID).entityId(INSTANCE_ID).build();

PostgresConnectionOptions.setSystemProperties(new HashMap<>());
Future<RecordToEntity> future = entityIdStorageDao.saveRecordToEntityRelationship(expectedRecordToInstance, TENANT_ID);

future.onComplete(ar -> {
context.assertTrue(ar.failed());
async.complete();
});
entityIdStorageDao.saveRecordToEntityRelationship(expectedRecordToInstance, TENANT_ID)
.onComplete(context.asyncAssertSuccess());
}

@Test
public void shouldReturnSameInstanceIdWithDuplicateRecordId(TestContext context) {
Async async = context.async();

RecordToEntity expectedRecordToInstance1 = RecordToEntity.builder().table(EntityTable.INSTANCE).recordId(RECORD_ID).entityId(INSTANCE_ID).build();
RecordToEntity expectedRecordToInstance2 = RecordToEntity.builder().table(EntityTable.INSTANCE).recordId(RECORD_ID).entityId(DUPLICATE_INSTANCE_ID).build();

Future<RecordToEntity> future = entityIdStorageDao.saveRecordToEntityRelationship(expectedRecordToInstance1, TENANT_ID)
.compose(ar -> entityIdStorageDao.saveRecordToEntityRelationship(expectedRecordToInstance2, TENANT_ID));

future.onComplete(ar -> {
context.assertTrue(ar.succeeded());
RecordToEntity actualRecordToEntity = ar.result();
entityIdStorageDao.saveRecordToEntityRelationship(expectedRecordToInstance1, TENANT_ID)
.compose(ar -> entityIdStorageDao.saveRecordToEntityRelationship(expectedRecordToInstance2, TENANT_ID))
.onComplete(context.asyncAssertSuccess(actualRecordToEntity -> {
context.assertEquals(expectedRecordToInstance1.getRecordId(), actualRecordToEntity.getRecordId());
context.assertEquals(expectedRecordToInstance1.getEntityId(), actualRecordToEntity.getEntityId());
context.assertEquals(expectedRecordToInstance1.getTable(), actualRecordToEntity.getTable());
async.complete();
});
}));
}
}
39 changes: 10 additions & 29 deletions src/test/java/org/folio/inventory/dao/EventIdStorageDaoImplTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,6 @@
package org.folio.inventory.dao;

import io.vertx.core.Future;
import io.vertx.core.Vertx;
import io.vertx.ext.unit.Async;
import io.vertx.ext.unit.TestContext;
import io.vertx.ext.unit.junit.VertxUnitRunner;
import org.folio.inventory.common.dao.EventIdStorageDao;
Expand Down Expand Up @@ -59,50 +57,33 @@ public void before() {

@Test
public void shouldReturnSavedEventId(TestContext context) {
Async async = context.async();

EventToEntity eventToEntity = EventToEntity.builder().table(EventTable.SHARED_INSTANCE).eventId(EVENT_ID).build();
Future<String> future = eventIdStorageDao.storeEvent(eventToEntity, TENANT_ID);

future.onComplete(ar -> {
context.assertTrue(ar.succeeded());
String savedEventId = ar.result();
eventIdStorageDao.storeEvent(eventToEntity, TENANT_ID)
.onComplete(context.asyncAssertSuccess(savedEventId -> {
context.assertEquals(eventToEntity.getEventId(), savedEventId);
async.complete();
});
}));
}

@Test
public void shouldReturnFailedFuture(TestContext context) {
Async async = context.async();

EventToEntity eventToEntity = EventToEntity.builder().table(EventTable.SHARED_INSTANCE).eventId(EVENT_ID).build();

PostgresConnectionOptions.setSystemProperties(new HashMap<>());
Future<String> future = eventIdStorageDao.storeEvent(eventToEntity, TENANT_ID);

future.onComplete(ar -> {
context.assertTrue(ar.failed());
async.complete();
});
eventIdStorageDao.storeEvent(eventToEntity, TENANT_ID)
.onComplete(context.asyncAssertSuccess());
}

@Test
public void shouldReturnSameInstanceIdWithDuplicateRecordId(TestContext context) {
Async async = context.async();

String SECOND_EVENT_ID = UUID.randomUUID().toString();

EventToEntity eventToEntity1 = EventToEntity.builder().table(EventTable.SHARED_INSTANCE).eventId(SECOND_EVENT_ID).build();
EventToEntity eventToEntity2 = EventToEntity.builder().table(EventTable.SHARED_INSTANCE).eventId(SECOND_EVENT_ID).build();

Future<String> future = eventIdStorageDao.storeEvent(eventToEntity1, TENANT_ID)
.compose(ar -> eventIdStorageDao.storeEvent(eventToEntity2, TENANT_ID));

future.onComplete(ar -> {
context.assertTrue(ar.failed());
context.assertTrue(ar.cause().getMessage().contains(UNIQUE_VIOLATION_SQL_STATE));
async.complete();
});
eventIdStorageDao.storeEvent(eventToEntity1, TENANT_ID)
.compose(ar -> eventIdStorageDao.storeEvent(eventToEntity2, TENANT_ID))
.onComplete(context.asyncAssertFailure(e -> {
context.assertTrue(e.getMessage().contains(UNIQUE_VIOLATION_SQL_STATE));
}));
}
}