Upgrade to Jetty 10.0.10 (#2691)

yahoo · Jul 13, 2022 · 1c8cafb · 1c8cafb
1 parent 53fbf01
commit 1c8cafb
Show file tree

Hide file tree

Showing 5 changed files with 44 additions and 28 deletions.
diff --git a/elide-datastore/elide-datastore-jms/pom.xml b/elide-datastore/elide-datastore-jms/pom.xml
@@ -131,14 +131,14 @@
         <!-- dependencies for native jetty websocket -->
         <dependency>
             <groupId>org.eclipse.jetty.websocket</groupId>
-            <artifactId>websocket-server</artifactId>
+            <artifactId>websocket-jetty-server</artifactId>
             <version>${version.jetty}</version>
             <scope>test</scope>
         </dependency>
 
         <dependency>
             <groupId>org.eclipse.jetty.websocket</groupId>
-            <artifactId>websocket-client</artifactId>
+            <artifactId>websocket-jetty-client</artifactId>
             <version>${version.jetty}</version>
             <scope>test</scope>
         </dependency>
@@ -152,7 +152,7 @@
         <!-- dependencies for javax.websocket (JSR-356) websocket -->
         <dependency>
             <groupId>org.eclipse.jetty.websocket</groupId>
-            <artifactId>javax-websocket-server-impl</artifactId>
+            <artifactId>websocket-javax-server</artifactId>
             <version>${version.jetty}</version>
             <scope>test</scope>
         </dependency>

diff --git a/...tastore-jms/src/test/java/com/yahoo/elide/datastores/jms/JMSDataStoreIntegrationTest.java b/...tastore-jms/src/test/java/com/yahoo/elide/datastores/jms/JMSDataStoreIntegrationTest.java
@@ -35,7 +35,7 @@
 import org.eclipse.jetty.server.Server;
 import org.eclipse.jetty.servlet.ServletContextHandler;
 import org.eclipse.jetty.servlet.ServletHolder;
-import org.eclipse.jetty.websocket.jsr356.server.deploy.WebSocketServerContainerInitializer;
+import org.eclipse.jetty.websocket.javax.server.config.JavaxWebSocketServletContainerInitializer;
 import org.glassfish.jersey.servlet.ServletContainer;
 import org.junit.jupiter.api.AfterAll;
 import org.junit.jupiter.api.BeforeAll;
@@ -51,7 +51,6 @@
 import javax.websocket.ContainerProvider;
 import javax.websocket.Session;
 import javax.websocket.WebSocketContainer;
-import javax.websocket.server.ServerContainer;
 import javax.websocket.server.ServerEndpointConfig;
 
 @TestInstance(TestInstance.Lifecycle.PER_CLASS)
@@ -113,17 +112,17 @@ protected final Server setUpServer() throws Exception {
         graphqlServlet.setInitParameter("javax.ws.rs.Application", TestResourceConfig.class.getName());
 
         // GraphQL subscription endpoint
-        ServerContainer container  = WebSocketServerContainerInitializer.configureContext(servletContextHandler);
-
-        ServerEndpointConfig subscriptionEndpoint = ServerEndpointConfig.Builder
-                .create(SubscriptionWebSocket.class, "/subscription")
-                .configurator(SubscriptionWebSocketConfigurator.builder()
-                        .baseUrl("/subscription")
-                        .connectionFactory(new ActiveMQConnectionFactory(EMBEDDED_JMS_URL))
-                        .sendPingOnSubscribe(true)
-                        .build())
-                .build();
-        container.addEndpoint(subscriptionEndpoint);
+        JavaxWebSocketServletContainerInitializer.configure(servletContextHandler, (servletContext, serverContainer) ->
+        {
+            serverContainer.addEndpoint(ServerEndpointConfig.Builder
+                    .create(SubscriptionWebSocket.class, "/subscription")
+                    .configurator(SubscriptionWebSocketConfigurator.builder()
+                            .baseUrl("/subscription")
+                            .connectionFactory(new ActiveMQConnectionFactory(EMBEDDED_JMS_URL))
+                            .sendPingOnSubscribe(true)
+                            .build())
+                    .build());
+        });
 
         log.debug("...Starting Server...");
         server.start();

diff --git a/elide-standalone/pom.xml b/elide-standalone/pom.xml
@@ -115,6 +115,13 @@
             <groupId>org.eclipse.jetty</groupId>
             <artifactId>jetty-server</artifactId>
             <scope>compile</scope>
+            <exclusions>
+                <exclusion>
+                    <!-- CVE-2017-7658(9.8), CVE-2017-7657(9.8), CVE-2017-7656(7.5), CVE-2017-9735(7.5), CVE-2020-27216(7.0), CVE-2009-5045(7.5) -->
+                    <groupId>org.eclipse.jetty.toolchain</groupId>
+                    <artifactId>jetty-servlet-api</artifactId>
+                </exclusion>
+            </exclusions>
         </dependency>
         <dependency>
             <groupId>org.eclipse.jetty</groupId>
@@ -180,8 +187,15 @@
         <!-- dependencies for native jetty websocket -->
         <dependency>
             <groupId>org.eclipse.jetty.websocket</groupId>
-            <artifactId>websocket-server</artifactId>
+            <artifactId>websocket-jetty-server</artifactId>
             <version>${version.jetty}</version>
+            <exclusions>
+                <exclusion>
+                    <!-- CVE-2017-7658(9.8), CVE-2017-7657(9.8), CVE-2017-7656(7.5), CVE-2017-9735(7.5), CVE-2020-27216(7.0), CVE-2009-5045(7.5) -->
+                    <groupId>org.eclipse.jetty.toolchain</groupId>
+                    <artifactId>jetty-servlet-api</artifactId>
+                </exclusion>
+            </exclusions>
         </dependency>
 
         <dependency>
@@ -192,8 +206,15 @@
         <!-- dependencies for javax.websocket (JSR-356) websocket -->
         <dependency>
             <groupId>org.eclipse.jetty.websocket</groupId>
-            <artifactId>javax-websocket-server-impl</artifactId>
+            <artifactId>websocket-javax-server</artifactId>
             <version>${version.jetty}</version>
+            <exclusions>
+            	<exclusion>
+            	    <!-- CVE-2017-7658(9.8), CVE-2017-7657(9.8), CVE-2017-7656(7.5), CVE-2017-9735(7.5), CVE-2020-27216(7.0), CVE-2009-5045(7.5) -->
+            		<groupId>org.eclipse.jetty.toolchain</groupId>
+            		<artifactId>jetty-javax-websocket-api</artifactId>
+            	</exclusion>
+            </exclusions>
         </dependency>
 
 
@@ -253,7 +274,7 @@
 
         <dependency>
             <groupId>org.eclipse.jetty.websocket</groupId>
-            <artifactId>websocket-client</artifactId>
+            <artifactId>websocket-jetty-client</artifactId>
             <version>${version.jetty}</version>
             <scope>test</scope>
         </dependency>

diff --git a/elide-standalone/src/main/java/com/yahoo/elide/standalone/ElideStandalone.java b/elide-standalone/src/main/java/com/yahoo/elide/standalone/ElideStandalone.java
@@ -21,16 +21,14 @@
 import org.eclipse.jetty.servlet.FilterHolder;
 import org.eclipse.jetty.servlet.ServletContextHandler;
 import org.eclipse.jetty.servlet.ServletHolder;
-import org.eclipse.jetty.websocket.jsr356.server.deploy.WebSocketServerContainerInitializer;
+import org.eclipse.jetty.websocket.javax.server.config.JavaxWebSocketServletContainerInitializer;
 import org.glassfish.jersey.servlet.ServletContainer;
 import lombok.extern.slf4j.Slf4j;
 
 import java.util.EnumSet;
 import java.util.Map;
 import java.util.concurrent.Executors;
 import javax.servlet.DispatcherType;
-import javax.websocket.server.ServerContainer;
-import javax.websocket.server.ServerEndpointConfig;
 
 /**
  * Elide Standalone.
@@ -115,12 +113,10 @@ public void start(boolean block) throws Exception {
         ElideStandaloneSubscriptionSettings subscriptionSettings = elideStandaloneSettings.getSubscriptionProperties();
         if (elideStandaloneSettings.enableGraphQL() && subscriptionSettings.enabled()) {
             // GraphQL subscription endpoint
-            ServerContainer container  = WebSocketServerContainerInitializer.configureContext(context);
+            JavaxWebSocketServletContainerInitializer.configure(context, (servletContext, serverContainer) -> {
+                        serverContainer.addEndpoint(subscriptionSettings.serverEndpointConfig(elideStandaloneSettings));
+            });
 
-            ServerEndpointConfig subscriptionEndpoint =
-                    subscriptionSettings.serverEndpointConfig(elideStandaloneSettings);
-
-            container.addEndpoint(subscriptionEndpoint);
         }
 
         if (elideStandaloneSettings.getAsyncProperties().enableExport()) {

diff --git a/pom.xml b/pom.xml
@@ -85,7 +85,7 @@
 
         <!-- dependency versions -->
         <version.antlr4>4.9.3</version.antlr4>
-        <version.jetty>9.4.46.v20220331</version.jetty>
+        <version.jetty>10.0.10</version.jetty>
         <version.logback>1.2.11</version.logback>
         <version.restassured>5.1.0</version.restassured>
         <version.jackson>2.13.3</version.jackson>