From a9c3da1594e9d6d15e918af42e9ec8cdd3cb00d7 Mon Sep 17 00:00:00 2001 From: Nate Chadwick <263952448+natechadwick-intsof@users.noreply.github.com> Date: Sat, 29 Aug 2026 10:37:55 -0400 Subject: [PATCH] fix(security): T2.x.2 hardening: drop test-scope javafaker (fully removes snakeyaml 1.x) (issue #100) PR #99 removed javafaker from production (modules/perc-security-utils), but two test files still declared javafaker at test in their own poms, which kept org.yaml:snakeyaml:1.23-android reachable on the test classpath. This slice removes those final javafaker usages so the project dep graph has no snakeyaml:1.x left at any scope. Replaces: - PSDefaultPasswordEncryptionBeanTest: faker.aquaTeenHungerForce().character().toString() with a UUID-based random string. Test only checks password round-trip, content is irrelevant. - PSMetadataQueryServiceTest: faker.chuckNorris().fact(), faker.hitchhikersGuideToTheGalaxy() .quote(), faker.animal().name() (x4) with per-entry deterministic strings ("linktext-{idx}", "abstract-{idx}", "cat-{idx}-a/b/c/d"). Tests assert on counts and structure, not on the specific text. Removes the javafaker blocks from: - projects/sitemanage/pom.xml - deliverytiersuite/delivery-tier-suite/metadata/pom.xml Verified: - dependency:tree -pl projects/sitemanage,metadata,perc-security-utils -Dincludes=org.yaml:snakeyaml,com.github.javafaker All three modules return either empty (no snakeyaml at all) or snakeyaml:2.6 only. javafaker is gone everywhere. - ./mvn-env.sh test -pl projects/sitemanage -Dtest=PSDefaultPasswordEncryptionBeanTest -> 1 run, 0 failures. - ./mvn-env.sh test-compile -pl deliverytiersuite/delivery-tier-suite/metadata -> BUILD SUCCESS (the metadata test class is a JUnit 3 TestCase hybrid; same pre-existing surefire behavior on main, not a regression from this slice). After this merge, the next Dependabot re-scan will not see snakeyaml:1.23-android in the dep graph at any scope, so the 8 alerts (#102-#109) dismissed in the prior slice will not resurrect. > Co-Authored by Mavis v1.0.0 using minimax-m3 with agent mavis. --- .../delivery-tier-suite/metadata/pom.xml | 6 ----- .../metadata/PSMetadataQueryServiceTest.java | 22 +++++++++---------- projects/sitemanage/pom.xml | 6 ----- .../PSDefaultPasswordEncryptionBeanTest.java | 8 +++---- 4 files changed, 15 insertions(+), 27 deletions(-) diff --git a/deliverytiersuite/delivery-tier-suite/metadata/pom.xml b/deliverytiersuite/delivery-tier-suite/metadata/pom.xml index d5be5b7cde..fa95830dab 100644 --- a/deliverytiersuite/delivery-tier-suite/metadata/pom.xml +++ b/deliverytiersuite/delivery-tier-suite/metadata/pom.xml @@ -10,12 +10,6 @@ perc-metadata-services war - - com.github.javafaker - javafaker - 1.0.2 - test - org.json json diff --git a/deliverytiersuite/delivery-tier-suite/metadata/src/test/java/com/percussion/delivery/metadata/PSMetadataQueryServiceTest.java b/deliverytiersuite/delivery-tier-suite/metadata/src/test/java/com/percussion/delivery/metadata/PSMetadataQueryServiceTest.java index 4870596e2a..aece8df480 100644 --- a/deliverytiersuite/delivery-tier-suite/metadata/src/test/java/com/percussion/delivery/metadata/PSMetadataQueryServiceTest.java +++ b/deliverytiersuite/delivery-tier-suite/metadata/src/test/java/com/percussion/delivery/metadata/PSMetadataQueryServiceTest.java @@ -18,7 +18,6 @@ import com.fasterxml.jackson.core.JsonProcessingException; import com.fasterxml.jackson.databind.ObjectMapper; -import com.github.javafaker.Faker; import com.percussion.delivery.metadata.IPSMetadataProperty.VALUETYPE; import com.percussion.delivery.metadata.data.PSMetadataBlogResult; import com.percussion.delivery.metadata.data.PSMetadataQuery; @@ -1492,16 +1491,17 @@ private void addTestEntries() { ents.add(e); } - Faker faker = new Faker(); - + // Was com.github.javafaker.Faker; switched to deterministic per-entry text to drop the + // javafaker -> snakeyaml:1.23-android transitive (T2.x.2 hardening). Tests don't assert + // on the specific content; they just need varied text per entry. for (int i = 0; i < ENTRY_COUNT; i++) { e = createEntry( "portal", "/noticias/destacadas/noticias-destacadas-2021/", - faker.chuckNorris().fact(), + "linktext-" + entryIdx, getTime(getRandomNumber(2010, 2021), getRandomNumber(1, 12), getRandomNumber(1, 28)), - faker.hitchhikersGuideToTheGalaxy().quote(), + "abstract-" + entryIdx, "Noticias-Noticia-Single", "page", entryIdx++); @@ -1551,8 +1551,8 @@ private PSDbMetadataEntry createEntry( String template, String type, int idx) { - Faker faker = new Faker(); - + // Was com.github.javafaker.Faker; switched to per-idx category names to drop the + // javafaker -> snakeyaml:1.23-android transitive (T2.x.2 hardening). String name = "page" + idx + ".html"; String pagepath = "/" + testsite + folder + name; PSDbMetadataEntry entry = new PSDbMetadataEntry(name, folder, pagepath, type, testsite); @@ -1564,15 +1564,15 @@ private PSDbMetadataEntry createEntry( entry.addProperty(new PSDbMetadataProperty("dcterms:abstract", abstr)); entry.addProperty(new PSDbMetadataProperty("dcterms:references", "bote, health")); entry.addProperty(new PSDbMetadataProperty("perc:testIndex", idx)); - String catl1 = faker.animal().name(); - String catl2 = faker.animal().name(); + String catl1 = "cat-" + idx + "-a"; + String catl2 = "cat-" + idx + "-b"; entry.addProperty(new PSDbMetadataProperty("perc:category", "/Categories/" + catl1)); entry.addProperty( new PSDbMetadataProperty( - "perc:category", "/Categories/" + catl1 + "/" + faker.animal().name())); + "perc:category", "/Categories/" + catl1 + "/" + "cat-" + idx + "-c")); entry.addProperty( new PSDbMetadataProperty( - "perc:category", "/Categories/" + catl1 + "/" + catl2 + "/" + faker.animal().name())); + "perc:category", "/Categories/" + catl1 + "/" + catl2 + "/" + "cat-" + idx + "-d")); entry.addProperty(new PSDbMetadataProperty("perc:type", type)); entry.addProperty(new PSDbMetadataProperty("perc:reverseIndex", 10000 - idx)); return entry; diff --git a/projects/sitemanage/pom.xml b/projects/sitemanage/pom.xml index d2b3a393e3..9bc4d14698 100644 --- a/projects/sitemanage/pom.xml +++ b/projects/sitemanage/pom.xml @@ -573,12 +573,6 @@ com.github.dfabulich sitemapgen4j - - com.github.javafaker - javafaker - 1.0.2 - test - org.owasp csrfguard diff --git a/projects/sitemanage/src/test/java/com/percussion/user/service/impl/PSDefaultPasswordEncryptionBeanTest.java b/projects/sitemanage/src/test/java/com/percussion/user/service/impl/PSDefaultPasswordEncryptionBeanTest.java index 0b73794e1f..f736a880cb 100644 --- a/projects/sitemanage/src/test/java/com/percussion/user/service/impl/PSDefaultPasswordEncryptionBeanTest.java +++ b/projects/sitemanage/src/test/java/com/percussion/user/service/impl/PSDefaultPasswordEncryptionBeanTest.java @@ -18,9 +18,9 @@ import static org.junit.Assert.assertTrue; -import com.github.javafaker.Faker; import com.percussion.security.PSEncryptionException; import com.percussion.security.PSPasswordHandler; +import java.util.UUID; import org.apache.commons.lang3.StringUtils; import org.apache.logging.log4j.LogManager; import org.apache.logging.log4j.Logger; @@ -31,9 +31,9 @@ public class PSDefaultPasswordEncryptionBeanTest { @Test public void shouldCreateHashesThatVerifyWithPasswordHandler() throws Exception { - Faker faker = new Faker(); - - String testPassword = faker.aquaTeenHungerForce().character().toString(); + // Was com.github.javafaker.Faker.aquaTeenHungerForce().character().toString(); switched to + // UUID to drop the javafaker -> snakeyaml:1.23-android transitive (T2.x.2 hardening). + String testPassword = "test-" + UUID.randomUUID(); String beanPassword = filter.encrypt(testPassword); String systemPassword = encrypt(testPassword);