BEANUTILS-539/BEANUTILS-509: 1.X line, switch WeakFastHashMap for ConcurrentWeakHashMap

NOTICE.txt

@@ -1,5 +1,5 @@
 Apache Commons BeanUtils
-Copyright 2000-2016 The Apache Software Foundation
+Copyright 2000-2019 The Apache Software Foundation
 
 This product includes software developed at
 The Apache Software Foundation (http://www.apache.org/).

pom.xml

@@ -19,12 +19,12 @@
   <parent>
     <groupId>org.apache.commons</groupId>
     <artifactId>commons-parent</artifactId>
-    <version>41</version>
+    <version>47</version>
   </parent>
   <modelVersion>4.0.0</modelVersion>
   <groupId>commons-beanutils</groupId>
   <artifactId>commons-beanutils</artifactId>
-  <version>1.9.3</version>
+  <version>1.9.4</version>
   <name>Apache Commons BeanUtils</name>
 
   <inceptionYear>2000</inceptionYear>
@@ -35,12 +35,43 @@
       <maven.compiler.source>1.6</maven.compiler.source>
       <maven.compiler.target>1.6</maven.compiler.target>
       <commons.componentid>beanutils</commons.componentid>
-      <commons.release.version>1.9.3</commons.release.version>
+      <commons.release.version>1.9.4</commons.release.version>
+      <!-- use later build plugin to generate sha256 hash refs.  Can be removed when the pom moves to CP48 -->
+      <commons.build-plugin.version>1.10</commons.build-plugin.version>
+      <commons.release.hash>sha256</commons.release.hash>
       <commons.jira.id>BEANUTILS</commons.jira.id>
       <commons.jira.pid>12310460</commons.jira.pid>
       <!-- limit memory size see BEANUTILS-291; allow command-line override -->
       <!-- Originally 25M, increased to 50M to get round Continuum CI build failures -->
       <surefire.argLine>-Xmx50M</surefire.argLine>
+
+      <maven.javadoc.failOnError>false</maven.javadoc.failOnError>
+
+      <commons.scmPubUrl>https://svn.apache.org/repos/infra/websites/production/commons/content/proper/commons-beanutils</commons.scmPubUrl>
+      <commons.scmPubCheckoutDirectory>site-content</commons.scmPubCheckoutDirectory>
+
+      <checkstyle.plugin.version>3.0.0</checkstyle.plugin.version>
+      <checkstyle.version>8.21</checkstyle.version>
+
+      <commons.pmd-plugin.version>3.8</commons.pmd-plugin.version>
+
+      <spotbugs.plugin.version>3.1.10</spotbugs.plugin.version>
+
+      <commons.jacoco.version>0.8.2</commons.jacoco.version>
+
+      <!-- generate report even if there are binary incompatible changes -->
+      <commons.japicmp.breakBuildOnBinaryIncompatibleModifications>false</commons.japicmp.breakBuildOnBinaryIncompatibleModifications>
+      <!-- 0.12.0 dies with a NullPointerException -->
+      <commons.japicmp.version>0.13.0</commons.japicmp.version>
+      <japicmp.skip>false</japicmp.skip>
+
+      <!-- Commons Release Plugin -->
+      <commons.bc.version>1.9.3</commons.bc.version>
+      <commons.rc.version>RC2</commons.rc.version>
+      <commons.release.isDistModule>true</commons.release.isDistModule>
+      <commons.distSvnStagingUrl>scm:svn:https://dist.apache.org/repos/dist/dev/commons/${commons.componentid}</commons.distSvnStagingUrl>
+      <commons.releaseManagerName>Rob Tompkins</commons.releaseManagerName>
+      <commons.releaseManagerKey>B6E73D84EA4FCC47166087253FAAD2CD5ECBB314</commons.releaseManagerKey>
   </properties>
 
 
@@ -51,9 +82,9 @@
   </issueManagement>
 
   <scm>
-    <connection>scm:svn:http://svn.apache.org/repos/asf/commons/proper/beanutils/tags/BEANUTILS_1_9_3_RC3</connection>
-    <developerConnection>scm:svn:https://svn.apache.org/repos/asf/commons/proper/beanutils/tags/BEANUTILS_1_9_3_RC3</developerConnection>
-    <url>http://svn.apache.org/viewvc/commons/proper/beanutils/tags/BEANUTILS_1_9_3_RC3</url>
+    <connection>scm:git:https://gitbox.apache.org/repos/asf?p=commons-beanutils.git</connection>
+    <developerConnection>scm:git:https://gitbox.apache.org/repos/asf?p=commons-beanutils.git</developerConnection>
+    <url>https://gitbox.apache.org/repos/asf?p=commons-beanutils.git</url>
   </scm>
 
   <distributionManagement>
@@ -195,6 +226,12 @@
       <timezone>+0</timezone>
       <organization>The Apache Software Foundation</organization>
     </developer>
+    <developer>
+      <id>chtompki</id>
+      <name>Rob Tompkins</name>
+      <email>chtompki@apache.org</email>
+      <organization>The Apache Software Foundation</organization>
+    </developer>
   </developers>
 
   <contributors>
@@ -298,6 +335,10 @@
       <name>Bernhard Seebass</name>
       <email />
     </contributor>
+    <contributor>
+      <name>Melloware</name>
+      <email />
+    </contributor>
   </contributors>
 
   <dependencies>
@@ -432,4 +473,48 @@
         </plugins>
     </reporting>
 
+
+    <profiles>
+      <profile>
+        <id>setup-checkout</id>
+        <activation>
+          <file>
+            <missing>site-content</missing>
+          </file>
+        </activation>
+        <build>
+          <plugins>
+            <plugin>
+              <groupId>org.apache.maven.plugins</groupId>
+              <artifactId>maven-antrun-plugin</artifactId>
+              <executions>
+                <execution>
+                  <id>prepare-checkout</id>
+                  <goals>
+                    <goal>run</goal>
+                  </goals>
+                  <phase>pre-site</phase>
+                  <configuration>
+                    <tasks>
+                      <exec executable="svn">
+                        <arg line="checkout --depth immediates ${commons.scmPubUrl} ${commons.scmPubCheckoutDirectory}"/>
+                      </exec>
+                      <exec executable="svn">
+                        <arg line="update --set-depth exclude ${commons.scmPubCheckoutDirectory}/javadocs"/>
+                      </exec>
+                      <pathconvert pathsep=" " property="dirs">
+                        <dirset dir="${commons.scmPubCheckoutDirectory}" includes="*"/>
+                      </pathconvert>
+                      <exec executable="svn">
+                        <arg line="update --set-depth infinity ${dirs}"/>
+                      </exec>
+                    </tasks>
+                  </configuration>
+                </execution>
+              </executions>
+            </plugin>
+          </plugins>
+        </build>
+      </profile>
+    </profiles>
 </project>

src/changes/changes.xml

@@ -29,6 +29,21 @@
   </properties>
   <body>
 
+    <release version="1.9.4" date="2019-06-12" description="The primary reason for this release is a bugfix for
+CVE-2014-0114. More specifically, our goal with BEANUTILS-520
+is to set the default behaviour of the BeanUtilsBean
+to not allow class level access. The goal in doing this now
+is to bring 1.9.X into alignment with the same behaviour
+of the 2.X version line in regards to security.
+
+If one would like to opt out of the default behaviour, one could follow the
+example set out in the test class available in
+src/test/java/org/apache/commons/beanutils/bugs/Jira520TestCase.java.">
+      <action issue="BEANUTILS-520" dev="chtompki" type="fix" due-to="Melloware">
+        BeanUtils mitigation of CVE-2014-0114. (CVE-2019-10086 for commons-beanutils).
+      </action>
+    </release>
+
     <release version="1.9.3" date="2016-09-21" description="Bug fix release, now builds with Java 8">
       <action issue="BEANUTILS-433" dev="ggregory" type="update" due-to="Benedikt Ritter, Gary Gregory">
         Update dependency from JUnit 3.8.1 to 4.12.

src/main/java/org/apache/commons/beanutils/BeanUtils.java

@@ -474,32 +474,6 @@ public static boolean initCause(final Throwable throwable, final Throwable cause
      * @since 1.8.0
      */
     public static <K, V> Map<K, V> createCache() {
-        return new WeakFastHashMap<K, V>();
-    }
-
-    /**
-     * Return whether a Map is fast
-     * @param map The map
-     * @return Whether it is fast or not.
-     * @since 1.8.0
-     */
-    public static boolean getCacheFast(final Map<?, ?> map) {
-        if (map instanceof WeakFastHashMap) {
-            return ((WeakFastHashMap<?, ?>) map).getFast();
-        } else {
-            return false;
-        }
-    }
-
-    /**
-     * Set whether fast on a Map
-     * @param map The map
-     * @param fast Whether it should be fast or not.
-     * @since 1.8.0
-     */
-    public static void setCacheFast(final Map<?, ?> map, final boolean fast) {
-        if (map instanceof WeakFastHashMap) {
-            ((WeakFastHashMap<?, ?>)map).setFast(fast);
-        }
+        return new ConcurrentWeakKeyHashMap<K, V>();
     }
 }