yarl-it-hub / yschool Goto Github PK

com.feeles artifact is missing in maven repositories thus maven could n't resolve it.

As a temporary solution we are running mvn install command before starting development works to place the jar dependency in local repository. (.m2/repository/com/feeles direcctory)
mvn install:install-file -Dfile=modules\lite_repo\hbnPojoGenResource\hbnpojogen-persistence-1.4.4.jar -DgroupId=com.felees -DartifactId=hbnpojogen-persistence -Dversion=1.4.4 -Dpackaging=jar

Find out a solution: preferably we should give a try on hosting the artifact in central repository.

Hi, In ySchool/modules/spreadSheetHandler，there is a dependency org.apache.poi:poi-ooxml:3.9 that calls the risk method.

CVE-2019-12415

The scope of this CVE affected version is [,4.1.0)

After further analysis, in this project, the main Api called is <org.apache.poi.xssf.streaming.SXSSFCell: java.lang.String getStringCellValue()>

Risk method repair link : GitHub

CVE Bug Invocation Path--

Path Length : 2

<org.apache.poi.xssf.streaming.SXSSFCell: java.lang.String getStringCellValue()>
at <org.yarlithub.yschool.spreadSheetHandler.XLSReader: java.lang.String getStringCellValue(int)> (org.yarlithub.yschool.spreadSheetHandler.XLSReader.java:[70]) in /detect/unzip/ySchool-master/modules/spreadSheetHandler/target/classes

Dependency tree--

[INFO] org.yarlithub.yschool:spreadSheetHandler:jar:1.0-SNAPSHOT
[INFO] +- log4j:log4j:jar:1.2.16:compile
[INFO] +- org.slf4j:slf4j-api:jar:1.6.0:compile
[INFO] +- org.apache.poi:poi:jar:3.9:compile
[INFO] |  \- commons-codec:commons-codec:jar:1.5:compile
[INFO] +- org.apache.poi:poi-ooxml:jar:3.9:compile
[INFO] |  +- org.apache.poi:poi-ooxml-schemas:jar:3.9:compile
[INFO] |  |  \- org.apache.xmlbeans:xmlbeans:jar:2.3.0:compile
[INFO] |  |     \- stax:stax-api:jar:1.0.1:compile
[INFO] |  \- dom4j:dom4j:jar:1.6.1:compile
[INFO] |     \- xml-apis:xml-apis:jar:1.0.b2:compile
[INFO] +- org.apache.myfaces.tomahawk:tomahawk:jar:1.1.10:compile
[INFO] |  +- commons-logging:commons-logging:jar:1.1.1:compile
[INFO] |  +- commons-validator:commons-validator:jar:1.3.1:compile
[INFO] |  |  +- commons-beanutils:commons-beanutils:jar:1.7.0:compile
[INFO] |  |  \- commons-digester:commons-digester:jar:1.6:compile
[INFO] |  +- commons-fileupload:commons-fileupload:jar:1.2.1:compile
[INFO] |  +- commons-collections:commons-collections:jar:3.2.1:compile
[INFO] |  +- commons-el:commons-el:jar:1.0:compile
[INFO] |  +- oro:oro:jar:2.0.8:compile
[INFO] |  +- commons-lang:commons-lang:jar:2.4:compile
[INFO] |  +- javax.servlet:jstl:jar:1.1.0:compile
[INFO] |  \- batik:batik-awt-util:jar:1.6-1:compile
[INFO] |     \- batik:batik-util:jar:1.6-1:compile
[INFO] |        \- batik:batik-gui-util:jar:1.6-1:compile
[INFO] |           \- batik:batik-ext:jar:1.6-1:compile
[INFO] |              \- xml-apis:xmlParserAPIs:jar:2.0.2:compile
[INFO] \- commons-io:commons-io:jar:1.3.2:compile

Suggested solutions:

Update dependency version

Thank you very much.

Contains Year and Date entries separately. why?

BUILD FAILURE
nested exception is java.lang.NoClassDefFoundError: com/felees/hbnpojogen/persistence/GenericDAO
at org.springframework.beans.factory.support.AbstractBeanFactory.resolveBeanClass(AbstractBeanFactory.java:1144)
at org.springframework.beans.factory.support.AbstractAutowireCapableBeanFactory.predictBeanType(AbstractAutowireCapableBeanFactory.java:524)
at org.springframework.beans.factory.support.AbstractBeanFactory.isFactoryBean(AbstractBeanFactory.java:1177)
at org.springframework.beans.factory.support.DefaultListableBeanFactory.getBeanNamesForType(DefaultListableBeanFactory.java:222)
at org.springframework.context.support.AbstractApplicationContext.invokeBeanFactoryPostProcessors(AbstractApplicationContext.java:505)
at org.springframework.context.support.AbstractApplicationContext.refresh(AbstractApplicationContext.java:362)
at org.springframework.web.context.ContextLoader.createWebApplicationContext(ContextLoader.java:255)
at org.springframework.web.context.ContextLoader.initWebApplicationContext(ContextLoader.java:199)
at org.springframework.web.context.ContextLoaderListener.contextInitialized(ContextLoaderListener.java:45)
at org.mortbay.jetty.handler.ContextHandler.startContext(ContextHandler.java:549)
.......
.....