uberfire/uberfire — pull request #89 by mrietveld (2014-12-01 23:36:36+00:00)
Title: Removing references to commons-httpclient (3.x)

There are some security flaws with commons-httpclient, so we can't use it anymore in BxMS, and by extension, uberfire.

This pull request removes the use of commons-httpclient and adds a utility that does that, since the URIUtil class is no longer present in httpclient (4.x).

See
- https://bugzilla.redhat.com/show_bug.cgi?id=1155314
- https://access.redhat.com/security/cve/CVE-2014-3577
- https://access.redhat.com/security/cve/CVE-2012-6153

It looks like the URIUtil class from commons-httpclient was the only class being used from that artifact.

The EncodingUtil class in the uberfire-nio2-model module was made by copy-pasting and slightly modifying the code. Some of the tests do wacky things (i.e. false negatives. :( ), so I wasn't able to fully test the build, but from what I could tell everything works.