From d1c4a7af8fe0923553bf66a0bf57930284ad3e60 Mon Sep 17 00:00:00 2001
From: xueshuai <xues13@chinaunicom.cn>
Date: Tue, 16 Apr 2024 14:20:41 +0800
Subject: [PATCH] =?UTF-8?q?Revert=20"CVE=E6=BC=8F=E6=B4=9E=E4=BF=AE?=
 =?UTF-8?q?=E5=A4=8D=EF=BC=9A=E6=B6=89=E5=8F=8A=E6=BC=8F=E6=B4=9E=E7=BC=96?=
 =?UTF-8?q?=E5=8F=B7"?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This reverts commit eb6460780eba3f055e7c3ec8a810ca660b334000.
---
 yudao-dependencies/pom.xml                    | 104 +-----------------
 .../yudao-spring-boot-starter-env/pom.xml     |  38 -------
 .../yudao-spring-boot-starter-rpc/pom.xml     |  11 --
 .../yudao-spring-boot-starter-web/pom.xml     |   5 -
 .../yudao-module-report-biz/pom.xml           |   6 -
 5 files changed, 1 insertion(+), 163 deletions(-)

diff --git a/yudao-dependencies/pom.xml b/yudao-dependencies/pom.xml
index a94850af4..ed4e39457 100644
--- a/yudao-dependencies/pom.xml
+++ b/yudao-dependencies/pom.xml
@@ -83,16 +83,6 @@
         <jimureport.version>1.6.6</jimureport.version>
         <xercesImpl.version>2.12.2</xercesImpl.version>
         <weixin-java.version>4.6.0</weixin-java.version>
-        <!--安全漏洞cve修复-->
-        <thymeleaf.version>3.1.2.RELEASE</thymeleaf.version>
-        <snappy.version>1.1.10.5</snappy.version>
-        <poi.version>5.2.5</poi.version>
-        <autopoi.version>1.4.7</autopoi.version>
-        <jettison.version>1.5.3</jettison.version>
-        <jeecg.version>3.6.2</jeecg.version>
-        <bcpkix.version>1.77</bcpkix.version>
-        <snakeyaml.version>2.2</snakeyaml.version>
-        <commons-compress.verion>1.26.0</commons-compress.verion>
     </properties>
 
     <dependencyManagement>
@@ -118,16 +108,8 @@
                 <version>${spring.cloud.alibaba.version}</version>
                 <type>pom</type>
                 <scope>import</scope>
-                <exclusions>
-                    <exclusion>
-                        <artifactId>snakeyaml</artifactId>
-                        <groupId>org.yaml</groupId>
-                    </exclusion>
-                </exclusions>
             </dependency>
 
-
-
             <!-- 业务组件 -->
             <dependency>
                 <groupId>io.github.mouzt</groupId>
@@ -395,84 +377,11 @@
                 <artifactId>spring-boot-admin-starter-server</artifactId> <!-- 实现 Spring Boot Admin Server 服务端 -->
                 <version>${spring-boot-admin.version}</version>
             </dependency>
-            <!--CVE-2023-38286漏洞修复-->
-            <dependency>
-                <groupId>org.thymeleaf</groupId>
-                <artifactId>thymeleaf</artifactId>
-                <version>${thymeleaf.version}</version>
-            </dependency>
             <dependency>
                 <groupId>de.codecentric</groupId>
                 <artifactId>spring-boot-admin-starter-client</artifactId> <!-- 实现 Spring Boot Admin Server 服务端 -->
                 <version>${spring-boot-admin.version}</version>
             </dependency>
-            <!--安全漏洞CVE修复-->
-
-            <!--CVE-2023-42809 漏洞修复-->
-            <dependency>
-                <groupId>org.xerial.snappy</groupId>
-                <artifactId>snappy-java</artifactId>
-                <version>${snappy.version}</version>
-            </dependency>
-            <!--CVE-2022-26336 漏洞修复 待明确-->
-            <dependency>
-                <groupId>org.apache.poi</groupId>
-                <artifactId>poi-scratchpad</artifactId>
-                <version>${poi.version}</version>
-            </dependency>
-            <dependency>
-                <groupId>org.jeecgframework</groupId>
-                <artifactId>autopoi-parent</artifactId>
-                <version>${autopoi.version}</version>
-                <exclusions>
-                    <exclusion>
-                        <groupId>org.apache.poi</groupId>
-                        <artifactId>poi-scratchpad</artifactId>
-                    </exclusion>
-                </exclusions>
-            </dependency>
-
-            <!--CVE-2022-40149 漏洞修复 待明确-->
-            <dependency>
-                <groupId>org.codehaus.jettison</groupId>
-                <artifactId>jettison</artifactId>
-                <version>${jettison.version}</version>
-
-            </dependency>
-            <!--CVE-2023-1454 漏洞修复 待明确-->
-            <dependency>
-                <groupId>org.jeecgframework.boot</groupId>
-                <artifactId>jeecg-boot-common</artifactId>
-                <version>${jeecg.version}</version>
-                <type>pom</type>
-                <scope>import</scope>
-            </dependency>
-            <!--CVE 2023 33202漏洞修复不明确-->
-            <dependency>
-                <groupId>org.bouncycastle</groupId>
-                <artifactId>bcpkix-jdk18on</artifactId>
-                <version>${bcpkix.version}</version>
-            </dependency>
-            <dependency>
-                <groupId>com.h2database</groupId> <!-- 单元测试，我们采用 H2 作为数据库 -->
-                <artifactId>h2</artifactId>
-                <version>2.2.222</version>
-            </dependency>
-
-            <dependency>
-                <groupId>com.jayway.jsonpath</groupId>
-                <artifactId>json-path</artifactId>
-                <version>2.9.0</version>
-            </dependency>
-
-            <!--CVE-2023-24998漏洞修复 -->
-            <dependency>
-                <groupId>commons-fileupload</groupId>
-                <artifactId>commons-fileupload</artifactId>
-                <version>1.5</version>
-            </dependency>
-
-
 
             <!-- Test 测试相关 -->
             <dependency>
@@ -575,11 +484,7 @@
                 <artifactId>easyexcel</artifactId>
                 <version>${easyexcel.verion}</version>
             </dependency>
-            <dependency>
-                <groupId>org.apache.commons</groupId>
-                <artifactId>commons-compress</artifactId>
-                <version>${commons-compress.verion}</version>
-            </dependency>
+
             <dependency>
                 <groupId>commons-io</groupId>
                 <artifactId>commons-io</artifactId>
@@ -763,14 +668,7 @@
                 <artifactId>xercesImpl</artifactId>
                 <version>${xercesImpl.version}</version>
             </dependency>
-            <!--CVE-2022-38752 漏洞修复-->
-            <dependency>
-                <groupId>org.yaml</groupId>
-                <artifactId>snakeyaml</artifactId>
-                <version>${snakeyaml.version}</version>
 
-                <scope>compile</scope>
-            </dependency>
         </dependencies>
     </dependencyManagement>
 
diff --git a/yudao-framework/yudao-spring-boot-starter-env/pom.xml b/yudao-framework/yudao-spring-boot-starter-env/pom.xml
index 4594a6b06..3b5ca0771 100644
--- a/yudao-framework/yudao-spring-boot-starter-env/pom.xml
+++ b/yudao-framework/yudao-spring-boot-starter-env/pom.xml
@@ -33,34 +33,8 @@
         <dependency>
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-starter</artifactId>
-            <exclusions>
-                <exclusion>
-                    <groupId>org.yaml</groupId>
-                    <artifactId>snakeyaml</artifactId>
-                </exclusion>
-                <exclusion>
-                    <artifactId>logback-classic</artifactId>
-                    <groupId>ch.qos.logback</groupId>
-                </exclusion>
-            </exclusions>
-        </dependency>
-        <!--CVE-2022-38752 漏洞修复-->
-        <dependency>
-            <groupId>org.yaml</groupId>
-            <artifactId>snakeyaml</artifactId>
-            <scope>compile</scope>
         </dependency>
 
-        <dependency>
-            <groupId>ch.qos.logback</groupId>
-            <artifactId>logback-classic</artifactId>
-            <version>1.4.14</version>
-        </dependency>
-        <dependency>
-            <groupId>ch.qos.logback</groupId>
-            <artifactId>logback-core</artifactId>
-            <version>1.4.14</version>
-        </dependency>
         <!-- Web 相关 -->
         <dependency>
             <groupId>org.springframework</groupId>
@@ -76,19 +50,7 @@
         <dependency>
             <groupId>org.springframework.cloud</groupId>
             <artifactId>spring-cloud-loadbalancer</artifactId>
-            <exclusions>
-                <exclusion>
-                    <artifactId>bcpkix-jdk15on</artifactId>
-                    <groupId>org.bouncycastle</groupId>
-                </exclusion>
-            </exclusions>
         </dependency>
-        <!--CVE-2023-33201 CVE-2023-33202 漏洞修复-->
-        <dependency>
-            <groupId>org.bouncycastle</groupId>
-            <artifactId>bcpkix-jdk18on</artifactId>
-        </dependency>
-
         <dependency>
             <groupId>io.github.openfeign</groupId>
             <artifactId>feign-core</artifactId>
diff --git a/yudao-framework/yudao-spring-boot-starter-rpc/pom.xml b/yudao-framework/yudao-spring-boot-starter-rpc/pom.xml
index 0a8c7685e..767156231 100644
--- a/yudao-framework/yudao-spring-boot-starter-rpc/pom.xml
+++ b/yudao-framework/yudao-spring-boot-starter-rpc/pom.xml
@@ -27,17 +27,6 @@
         <dependency>
             <groupId>org.springframework.cloud</groupId>
             <artifactId>spring-cloud-starter-loadbalancer</artifactId>
-            <exclusions>
-                <exclusion>
-                    <artifactId>bcpkix-jdk15on</artifactId>
-                    <groupId>org.bouncycastle</groupId>
-                </exclusion>
-            </exclusions>
-        </dependency>
-        <!--CVE-2023-33201 CVE-2023-33202 漏洞修复-->
-        <dependency>
-            <groupId>org.bouncycastle</groupId>
-            <artifactId>bcpkix-jdk18on</artifactId>
         </dependency>
         <dependency>
             <groupId>org.springframework.cloud</groupId>
diff --git a/yudao-framework/yudao-spring-boot-starter-web/pom.xml b/yudao-framework/yudao-spring-boot-starter-web/pom.xml
index 3aa9975f9..8e8f74a30 100644
--- a/yudao-framework/yudao-spring-boot-starter-web/pom.xml
+++ b/yudao-framework/yudao-spring-boot-starter-web/pom.xml
@@ -44,11 +44,6 @@
             <artifactId>spring-security-core</artifactId>
             <scope>provided</scope> <!-- 设置为 provided，主要是 GlobalExceptionHandler 使用 -->
         </dependency>
-        <dependency>
-            <groupId>org.springframework.security</groupId>
-            <artifactId>spring-security-crypto</artifactId>
-            <version>6.2.1</version>
-        </dependency>
 
         <dependency>
             <groupId>com.github.xiaoymin</groupId> <!-- 接口文档 -->
diff --git a/yudao-module-report/yudao-module-report-biz/pom.xml b/yudao-module-report/yudao-module-report-biz/pom.xml
index 3d18366ef..3b0439d7f 100644
--- a/yudao-module-report/yudao-module-report-biz/pom.xml
+++ b/yudao-module-report/yudao-module-report-biz/pom.xml
@@ -105,12 +105,6 @@
             <groupId>org.jeecgframework.jimureport</groupId>
             <artifactId>jimureport-spring-boot-starter</artifactId>
         </dependency>
-        <!--CVE-2022-40150漏洞修复-->
-        <dependency>
-            <groupId>org.codehaus.jettison</groupId>
-            <artifactId>jettison</artifactId>
-            <version>1.5.4</version>
-        </dependency>
         <!-- 单独依赖升级版本，解决低版本validator失败问题 -->
         <dependency>
             <groupId>xerces</groupId>