CVE-2016-3093 due to inefficient method reference caching. The project pulled in OGNL 2.6.9 transitively via click-nodeps

[Copilot]

• Investigate CI failure: NoSuchMethodError: javassist.CtClass.getDeclaredClasses() in ExternalLdapConfigTest
• Root cause identified: OGNL 3.0.21 transitively pulls javassist:javassist:3.11.0.GA (old Maven group ID), which shadows org.javassist:javassist:3.27.0-GA (new group ID, required by PowerMock 2.0.9); both land on the classpath as separate Maven artifacts since they have different coordinates
• Fix in root pom.xml: added <exclusion> for javassist:javassist (old group) to the OGNL <dependencyManagement> entry (handles modules that declare ognl as a direct dep without version)
• Fix in openam-core/pom.xml: added <exclusion> for javassist:javassist (old group) to the direct click-nodeps, click-extras, and ognl dependency declarations (blocks all transitive paths that could re-introduce the old javassist jar)

Original prompt

Problem

The project uses OGNL 2.6.9 which is vulnerable to CVE-2016-3093 — a denial-of-service vulnerability caused by inefficient caching of method references in OGNL before version 3.0.12 when used with Apache Struts 2.

OGNL is actively used in the embedded Apache Click code throughout the project:

• openam-core/src/main/java/org/openidentityplatform/openam/click/ClickServlet.java — imports ognl.Ognl, ognl.DefaultMemberAccess
• openam-core/src/main/java/org/openidentityplatform/openam/click/util/ContainerUtils.java — uses Ognl.setValue() / Ognl.getValue()
• openam-core/src/main/java/org/openidentityplatform/openam/click/service/XmlConfigService.java — uses Ognl.setValue()

Required Changes

1. Update OGNL dependency version to 3.0.21 (latest 3.0.x with security fixes and backward compatibility):

   • Add/update explicit OGNL dependency in the root pom.xml <dependencyManagement> section, changing from version 2.6.9 to 3.0.21. The groupId for OGNL 3.x is ognl and artifactId is ognl.
   • Add explicit OGNL dependency in openam-core/pom.xml if not already present.
   • Check all other pom.xml files that may reference OGNL and ensure they use the managed version.

2. Fix any API compatibility issues between OGNL 2.6.9 and 3.0.21 in Java source files that import from ognl.* package. Key classes to check:

   • DefaultMemberAccess — constructor signature may differ
   • DefaultTypeConverter — may have moved
   • OgnlOps — verify methods still exist

3. Update legal/THIRDPARTYREADME.txt: Replace reference to ognl-2.6.9.jar with ognl-3.0.21.jar.

4. Update legacy deployable-war lists if they reference ognl-2.6.9.jar:

   • openam-federation/OpenFM/src/main/deployable-war/fam-noconsole.list — replace ./WEB-INF/lib/ognl-2.6.9.jar with ./WEB-INF/lib/ognl-3.0.21.jar
   • Check openam-federation/OpenFM/src/main/deployable-war/fam-console.list for similar references.

The following is the prior conversation context from the user's chat exploration (may be truncated):

User: предложи. исправление CVE-2016-3093

Assistant: Let me find where the commons-fileupload version is managed in the project:

Assistant:

CVE-2016-3093 в OpenIdentityPlatform/OpenAM

CVE-2016-3093 — уязвимость в OGNL (Object-Graph Navigation Language) до версии 3.0.12, используемом совместно с Apache Struts 2. Она позволяет удалённому злоумышленнику вызвать отказ в обслуживании (DoS) из-за неэффективного кэширования ссылок на методы.

Текущее состояние в репозитории

В проекте используется ognl-2.6.9 — уязвимая версия. OGNL активно используется в коде Apache Click, который встроен в OpenAM:

• ClickServlet.java — импортирует ognl.Ognl, ognl.DefaultMemberAccess
• ContainerUtils.java — использует Ognl.setValue() / Ognl.getValue() для data binding форм
• XmlConfigService.java — использует Ognl.setValue() для конфигурации сервисов

Рекомендуемое исправление

Необходимо обновить зависимость OGNL с 2.6.9 до 3.0.12+ (или лучше до последней стабильной 3.x). Версия определяется транзитивно через Apache Click (click-nodeps). Поскольку проект использует собственный форк Click-кода (пакет org.openidentityplatform.openam.click), можно явно переопределить версию OGNL.

1. Добавить явную зависимость OGNL в корневой pom.xml (dependencyManagement):

<dependencyManagement>
    <dependencies>
        <!-- Fix CVE-2016-3093: upgrade OGNL from 2.6.9 to 3.0.21 -->
        <dependency>
            <groupId>ognl</groupId>
            <artifactId>ognl</artifactId>
            <version>3.0.21</version>
        </dependency>
    </dependencies>
</dependencyManagement>

2. Добавить явную зависимость в openam-core/pom.xml:

<dependency>
    <groupId>ognl</groupId>
    <artifactId>ognl</artifactId>
    <version>3.0.21</version>
</dependency>

3. Проверить совместимость API. В OGNL 3.x изменились некоторые API:

• DefaultMemberAccess (используется в ClickServlet.java) — конструктор может отличаться
• DefaultTypeConverter (используется в ContainerUtils.java) — перемещён в ognl.DefaultTypeConverter
• OgnlOps — проверить наличие используемых методов

4. Обновить legal/THIRDPARTYREADME.txt: заменить ognl-2.6.9.jar на ognl-3.0.21.jar.

5. Обновить legacy-списки в openam-federation/OpenFM/src/main/deployable-war/fam-noconsole.list: заменить ./WEB-INF/lib/ognl-2.6.9.jar на ./WEB-INF/lib/ognl-3.0.21.jar.

Почему именно 3.0.21

Версия OGNL 3.0.12 — минимальная для устранения CVE-2016-3093, но 3.0.21 — последний релиз ветки 3.0.x с дополнительными исправлениями безопасности, при этом сохраняющий обратную совместимость с API 3.0.x.

User: сделай PR

Assistant: I've started the process of creating a pull request to fix CVE-2016-3093 by upgrading OGNL from 2.6.9 to 3.0.21 in the OpenIdentityPlatform/OpenAM repository. I'm waiting for your confirmati...

This pull request was created from Copilot chat.

[vharseko]

@copilot merge from copilot/update-powermock-dependencies

[Copilot]

@copilot merge from copilot/update-powermock-dependencies

Done — merged copilot/update-powermock-dependencies into this branch (commit 74ca7c3). The only conflict was in pom.xml where I kept the OGNL 3.0.21 fix and removed the old mockito-all entry that was superseded by the powermock branch.