From 823b6e470696146558825c04cba4484ec585b2b5 Mon Sep 17 00:00:00 2001
From: mystarry-sky <zilan1986@163.com>
Date: Wed, 20 Mar 2024 14:36:25 +0800
Subject: [PATCH] =?UTF-8?q?CVE-2019-17571=20CVE-2023-24998=20CVE-2024-2630?=
 =?UTF-8?q?8=20CVE-2024-25710=20=E4=BF=AE=E5=A4=8D?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 datachecker-check/pom.xml   | 18 ++++++++++++++++--
 datachecker-common/pom.xml  | 18 ++++++++++++++++++
 datachecker-extract/pom.xml | 29 ++++++++++++++++++++++++++---
 pom.xml                     | 34 ++++++++++++++++++++++++++++++++--
 4 files changed, 92 insertions(+), 7 deletions(-)

diff --git a/datachecker-check/pom.xml b/datachecker-check/pom.xml
index 09866af..07873bf 100644
--- a/datachecker-check/pom.xml
+++ b/datachecker-check/pom.xml
@@ -56,8 +56,12 @@
             <version>${gs.datacheck.version}</version>
         </dependency>
         <dependency>
-            <groupId>org.springframework.boot</groupId>
-            <artifactId>spring-boot-starter-log4j2</artifactId>
+            <groupId>org.apache.logging.log4j</groupId>
+            <artifactId>log4j-slf4j-impl</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.apache.logging.log4j</groupId>
+            <artifactId>log4j-core</artifactId>
         </dependency>
         <dependency>
             <groupId>com.lmax</groupId>
@@ -79,6 +83,16 @@
         <dependency>
             <groupId>org.springframework.cloud</groupId>
             <artifactId>spring-cloud-starter-openfeign</artifactId>
+            <exclusions>
+                <exclusion>
+                    <groupId>commons-fileupload</groupId>
+                    <artifactId>commons-fileupload</artifactId>
+                </exclusion>
+            </exclusions>
+        </dependency>
+        <dependency>
+            <groupId>commons-fileupload</groupId>
+            <artifactId>commons-fileupload</artifactId>
         </dependency>
         <dependency>
             <groupId>org.springdoc</groupId>
diff --git a/datachecker-common/pom.xml b/datachecker-common/pom.xml
index a972df0..b2727b3 100644
--- a/datachecker-common/pom.xml
+++ b/datachecker-common/pom.xml
@@ -38,6 +38,10 @@
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-starter-web</artifactId>
             <exclusions>
+                <exclusion>
+                    <groupId>org.springframework.boot</groupId>
+                    <artifactId>spring-boot-starter-logging</artifactId>
+                </exclusion>
                 <exclusion>
                     <groupId>ch.qos.logback</groupId>
                     <artifactId>logback-classic</artifactId>
@@ -48,9 +52,23 @@
                 </exclusion>
             </exclusions>
         </dependency>
+        <dependency>
+            <groupId>org.apache.logging.log4j</groupId>
+            <artifactId>log4j-slf4j-impl</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.apache.logging.log4j</groupId>
+            <artifactId>log4j-core</artifactId>
+        </dependency>
         <dependency>
             <groupId>org.springdoc</groupId>
             <artifactId>springdoc-openapi-ui</artifactId>
+            <exclusions>
+                <exclusion>
+                    <groupId>org.slf4j</groupId>
+                    <artifactId>slf4j-api</artifactId>
+                </exclusion>
+            </exclusions>
         </dependency>
         <dependency>
             <groupId>com.github.oshi</groupId>
diff --git a/datachecker-extract/pom.xml b/datachecker-extract/pom.xml
index 1f24bad..58fe928 100644
--- a/datachecker-extract/pom.xml
+++ b/datachecker-extract/pom.xml
@@ -57,8 +57,12 @@
             <version>${gs.datacheck.version}</version>
         </dependency>
         <dependency>
-            <groupId>org.springframework.boot</groupId>
-            <artifactId>spring-boot-starter-log4j2</artifactId>
+            <groupId>org.apache.logging.log4j</groupId>
+            <artifactId>log4j-slf4j-impl</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.apache.logging.log4j</groupId>
+            <artifactId>log4j-core</artifactId>
         </dependency>
         <dependency>
             <groupId>com.lmax</groupId>
@@ -112,6 +116,12 @@
         <dependency>
             <groupId>org.springframework.cloud</groupId>
             <artifactId>spring-cloud-starter-openfeign</artifactId>
+            <exclusions>
+                <exclusion>
+                    <groupId>commons-fileupload</groupId>
+                    <artifactId>commons-fileupload</artifactId>
+                </exclusion>
+            </exclusions>
         </dependency>
         <dependency>
             <groupId>net.openhft</groupId>
@@ -135,10 +145,23 @@
                 </exclusion>
             </exclusions>
         </dependency>
-
         <dependency>
             <groupId>io.confluent</groupId>
             <artifactId>kafka-avro-serializer</artifactId>
+            <exclusions>
+                <exclusion>
+                    <groupId>org.apache.commons</groupId>
+                    <artifactId>commons-compress</artifactId>
+                </exclusion>
+            </exclusions>
+        </dependency>
+        <dependency>
+            <groupId>commons-fileupload</groupId>
+            <artifactId>commons-fileupload</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.apache.commons</groupId>
+            <artifactId>commons-compress</artifactId>
         </dependency>
         <dependency>
             <groupId>org.apache.commons</groupId>
diff --git a/pom.xml b/pom.xml
index 5670c5c..310ef76 100644
--- a/pom.xml
+++ b/pom.xml
@@ -38,7 +38,12 @@
         <snakeyaml.version>2.0</snakeyaml.version>
         <powermock.version>2.0.0</powermock.version>
         <commons.cli.version>1.4</commons.cli.version>
+        <commons.fileupload.version>1.5</commons.fileupload.version>
+        <commons.compress.version>1.26.1</commons.compress.version>
+        <commons.collection.version>4.4</commons.collection.version>
+        <log4j.version>2.23.1</log4j.version>
         <oshi.version>6.5.0</oshi.version>
+        <hutool-all.version>5.7.8</hutool-all.version>
         <opencsv.version>5.7.1</opencsv.version>
         <disruptor.version>3.4.4</disruptor.version>
     </properties>
@@ -74,7 +79,7 @@
             <dependency>
                 <groupId>cn.hutool</groupId>
                 <artifactId>hutool-all</artifactId>
-                <version>5.7.8</version>
+                <version>${hutool-all.version}</version>
             </dependency>
             <dependency>
                 <groupId>com.opencsv</groupId>
@@ -91,6 +96,31 @@
                 <artifactId>springdoc-openapi-ui</artifactId>
                 <version>${springdoc.openapi.ui.version}</version>
             </dependency>
+            <dependency>
+                <groupId>org.apache.logging.log4j</groupId>
+                <artifactId>log4j-slf4j-impl</artifactId>
+                <version>${log4j2.version}</version>
+            </dependency>
+            <dependency>
+                <groupId>org.apache.logging.log4j</groupId>
+                <artifactId>log4j-api</artifactId>
+                <version>${log4j2.version}</version>
+            </dependency>
+            <dependency>
+                <groupId>org.apache.logging.log4j</groupId>
+                <artifactId>log4j-core</artifactId>
+                <version>${log4j2.version}</version>
+            </dependency>
+            <dependency>
+                <groupId>org.apache.commons</groupId>
+                <artifactId>commons-compress</artifactId>
+                <version>${commons.compress.version}</version>
+            </dependency>
+            <dependency>
+                <groupId>commons-fileupload</groupId>
+                <artifactId>commons-fileupload</artifactId>
+                <version>${commons.fileupload.version}</version>
+            </dependency>
             <dependency>
                 <groupId>com.lmax</groupId>
                 <artifactId>disruptor</artifactId>
@@ -136,7 +166,7 @@
             <dependency>
                 <groupId>org.apache.commons</groupId>
                 <artifactId>commons-collections4</artifactId>
-                <version>4.4</version>
+                <version>${commons.collection.version}</version>
             </dependency>
             <dependency>
                 <groupId>com.google.guava</groupId>
-- 
Gitee