From 0d9b3896ad594816b1eb7048949114e6a18c4bd4 Mon Sep 17 00:00:00 2001
From: "Lee, Tian (tl5884)" <TianL@amdocs.com>
Date: Mon, 1 Oct 2018 16:24:47 +0100
Subject: Fix NexusIQ security vulnerabilities

Remove Spring Boot Jackson dependencies and replace with Gson
implementation.

Fix potential source of NullPointerException.

Change-Id: I3a715a023223b596e8a0979f0e0d381511fca32d
Issue-ID: AAF-529
Signed-off-by: Lee, Tian (tl5884) <TianL@amdocs.com>
---
 sidecar/fproxy/pom.xml                                   | 14 +++++++++-----
 sidecar/fproxy/src/main/resources/application.properties |  4 +---
 2 files changed, 10 insertions(+), 8 deletions(-)

(limited to 'sidecar/fproxy')

diff --git a/sidecar/fproxy/pom.xml b/sidecar/fproxy/pom.xml
index 81014e6..55221b9 100644
--- a/sidecar/fproxy/pom.xml
+++ b/sidecar/fproxy/pom.xml
@@ -71,14 +71,13 @@
 					<artifactId>spring-boot-starter-tomcat</artifactId>
 					<groupId>org.springframework.boot</groupId>
 				</exclusion>
+				<exclusion>
+					<groupId>org.springframework.boot</groupId>
+					<artifactId>spring-boot-starter-json</artifactId>
+				</exclusion>
 			</exclusions>
 		</dependency>
 
-		<dependency>
-			<groupId>org.springframework.boot</groupId>
-			<artifactId>spring-boot-starter-actuator</artifactId>
-		</dependency>
-
 		<dependency>
 			<groupId>org.apache.commons</groupId>
 			<artifactId>commons-lang3</artifactId>
@@ -89,6 +88,11 @@
 			<artifactId>httpclient</artifactId>
 		</dependency>
 
+		<dependency>
+			<groupId>com.google.code.gson</groupId>
+			<artifactId>gson</artifactId>
+		</dependency>
+
 		<!-- Testing -->
 		<dependency>
 			<groupId>org.springframework.boot</groupId>
diff --git a/sidecar/fproxy/src/main/resources/application.properties b/sidecar/fproxy/src/main/resources/application.properties
index d269c54..5ed7510 100644
--- a/sidecar/fproxy/src/main/resources/application.properties
+++ b/sidecar/fproxy/src/main/resources/application.properties
@@ -9,6 +9,4 @@ server.contextPath=/
 
 logging.config=${CONFIG_HOME}/logback-spring.xml
 
-spring.profiles.active=secure
-
-management.endpoints.web.base-path=/fproxy
\ No newline at end of file
+spring.profiles.active=secure
\ No newline at end of file
-- 
cgit 1.2.3-korg