From ed99a97b7efd5adcdcee6c32eea6e15a7d9e1cd2 Mon Sep 17 00:00:00 2001
From: luanwenfei <luanwenfei@outlook.com>
Date: Sat, 25 Nov 2023 16:26:12 +0800
Subject: [PATCH] =?UTF-8?q?=E5=BC=80=E6=BA=90=E7=89=88=E6=9C=AC=E6=BC=8F?=
 =?UTF-8?q?=E6=B4=9E=E4=BF=AE=E5=A4=8D?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: luanwenfei <luanwenfei@outlook.com>
---
 pom.xml                                          |  4 ++--
 .../sermant-router/spring-router-plugin/pom.xml  | 16 ++++++++++++++--
 .../spring-cloud-registry-plugin/pom.xml         | 12 ++++++++++++
 .../springboot-registry-plugin/pom.xml           |  4 ++--
 .../pom.xml                                      |  2 +-
 5 files changed, 31 insertions(+), 7 deletions(-)

diff --git a/pom.xml b/pom.xml
index a101259ca7..ececb3d133 100644
--- a/pom.xml
+++ b/pom.xml
@@ -51,7 +51,7 @@
         <zookeeper.version>3.6.3</zookeeper.version>
         <lombok.version>1.18.22</lombok.version>
         <asm.version>8.0.1</asm.version>
-        <common.io.version>1.3.2</common.io.version>
+        <common.io.version>2.7</common.io.version>
         <org.jacoco.version>0.8.8</org.jacoco.version>
         <simpleclient.version>0.16.0</simpleclient.version>
 
@@ -59,7 +59,7 @@
         <log4j2.version>2.17.2</log4j2.version>
         <logback.version>1.2.9</logback.version>
 
-        <junit.version>4.12</junit.version>
+        <junit.version>4.13.1</junit.version>
         <junit.jupiter.version>5.8.1</junit.jupiter.version>
         <mockito-core.version>3.9.0</mockito-core.version>
         <mockito-inline.version>3.9.0</mockito-inline.version>
diff --git a/sermant-plugins/sermant-router/spring-router-plugin/pom.xml b/sermant-plugins/sermant-router/spring-router-plugin/pom.xml
index 727a18cc02..5ec831122e 100644
--- a/sermant-plugins/sermant-router/spring-router-plugin/pom.xml
+++ b/sermant-plugins/sermant-router/spring-router-plugin/pom.xml
@@ -20,11 +20,12 @@
         <eureka.version>1.10.7</eureka.version>
         <hystrix.version>1.4.3</hystrix.version>
         <zuul.version>1.3.1</zuul.version>
+        <common-io.version>2.7</common-io.version>
         <spring.test.version>5.2.0.RELEASE</spring.test.version>
         <tomcat.version>9.0.43</tomcat.version>
-        <okhttp.version>4.1.0</okhttp.version>
+        <okhttp.version>4.11.0</okhttp.version>
         <okhttp.sq.version>2.7.5</okhttp.sq.version>
-        <apache-httpclient.version>4.3</apache-httpclient.version>
+        <apache-httpclient.version>4.5.13</apache-httpclient.version>
         <http.client.async.verion>4.1.5</http.client.async.verion>
     </properties>
 
@@ -98,8 +99,19 @@
                     <groupId>org.mockito</groupId>
                     <artifactId>mockito-all</artifactId>
                 </exclusion>
+                <exclusion>
+                    <groupId>commons-io</groupId>
+                    <artifactId>commons-io</artifactId>
+                </exclusion>
             </exclusions>
         </dependency>
+        <!--    zuul自身引入的commons-io有漏洞，排除后引入无漏洞版本    -->
+        <dependency>
+            <groupId>commons-io</groupId>
+            <artifactId>commons-io</artifactId>
+            <version>${common-io.version}</version>
+            <scope>provided</scope>
+        </dependency>
         <dependency>
             <groupId>com.squareup.okhttp3</groupId>
             <artifactId>okhttp</artifactId>
diff --git a/sermant-plugins/sermant-service-registry/spring-cloud-registry-plugin/pom.xml b/sermant-plugins/sermant-service-registry/spring-cloud-registry-plugin/pom.xml
index 25a6b688bd..1116397557 100644
--- a/sermant-plugins/sermant-service-registry/spring-cloud-registry-plugin/pom.xml
+++ b/sermant-plugins/sermant-service-registry/spring-cloud-registry-plugin/pom.xml
@@ -22,6 +22,7 @@
         <feigin.version>10.0.0</feigin.version>
         <zuul.version>1.3.0</zuul.version>
         <gson.version>2.8.9</gson.version>
+        <common-io.version>2.7</common-io.version>
     </properties>
 
     <dependencies>
@@ -101,8 +102,19 @@
                     <groupId>org.mockito</groupId>
                     <artifactId>mockito-all</artifactId>
                 </exclusion>
+                <exclusion>
+                    <groupId>commons-io</groupId>
+                    <artifactId>commons-io</artifactId>
+                </exclusion>
             </exclusions>
         </dependency>
+        <!--    zuul自身引入的commons-io有漏洞，排除后引入无漏洞版本    -->
+        <dependency>
+            <groupId>commons-io</groupId>
+            <artifactId>commons-io</artifactId>
+            <version>${common-io.version}</version>
+            <scope>provided</scope>
+        </dependency>
         <dependency>
             <groupId>com.huaweicloud.sermant</groupId>
             <artifactId>registry-common</artifactId>
diff --git a/sermant-plugins/sermant-springboot-registry/springboot-registry-plugin/pom.xml b/sermant-plugins/sermant-springboot-registry/springboot-registry-plugin/pom.xml
index 849847fa25..08c8d15e70 100644
--- a/sermant-plugins/sermant-springboot-registry/springboot-registry-plugin/pom.xml
+++ b/sermant-plugins/sermant-springboot-registry/springboot-registry-plugin/pom.xml
@@ -19,9 +19,9 @@
         <package.plugin.type>plugin</package.plugin.type>
         <spring.version>5.2.9.RELEASE</spring.version>
         <http.client.async.verion>4.1.5</http.client.async.verion>
-        <okhttp.version>4.1.0</okhttp.version>
+        <okhttp.version>4.11.0</okhttp.version>
         <okhttp.sq.version>2.7.5</okhttp.sq.version>
-        <httpclient.version>4.5.12</httpclient.version>
+        <httpclient.version>4.5.13</httpclient.version>
         <httpclient5.version>5.1.1</httpclient5.version>
         <jetty.client.version>9.4.11.v20180605</jetty.client.version>
         <feign.version>10.2.3</feign.version>
diff --git a/sermant-plugins/sermant-tag-transmission/tag-transmission-httpclient4.x-plugin/pom.xml b/sermant-plugins/sermant-tag-transmission/tag-transmission-httpclient4.x-plugin/pom.xml
index 23abdd6fbf..fc12e02ead 100644
--- a/sermant-plugins/sermant-tag-transmission/tag-transmission-httpclient4.x-plugin/pom.xml
+++ b/sermant-plugins/sermant-tag-transmission/tag-transmission-httpclient4.x-plugin/pom.xml
@@ -16,7 +16,7 @@
         <maven.compiler.target>8</maven.compiler.target>
         <config.skip.flag>false</config.skip.flag>
         <package.plugin.type>plugin</package.plugin.type>
-        <apache-httpclient.version>4.3</apache-httpclient.version>
+        <apache-httpclient.version>4.5.13</apache-httpclient.version>
     </properties>
 
     <dependencies>