search

Impetus / kundera

A JPA 2.1 compliant Polyglot Object-Datastore Mapping Library for NoSQL Datastores.Please subscribe to:
http://groups.google.com/group/kundera-discuss/subscribe
Apache License 2.0
903 stars 233 forks source link

Your project impetus-opensource Kundera is using buggy third-party libraries [WARNING] #1033

Open FDUSELAB2 opened 5 years ago

FDUSELAB2 commented 5 years ago

Hi, there!

We are a research team working on third-party library analysis. We have found that some widely-used third-party libraries in your project have major/critical bugs, which will degrade the quality of your project. We highly recommend you to update those libraries to new versions.

We have attached the buggy third-party libraries and corresponding jira issue links below for you to have more detailed information. We have analyzed the api call related to the following libraries and found one library that is using the API call that might invoke buggy methods in the library of the history.

  1. commons-lang commons-lang version: 2.4 API call in your project:org.apache.commons.lang.builder.HashCodeBuilder.toIdentityHashCodeInteger(Object)

Jira issues: StringEscapeUtils.escapeJava(String) escapes '/' characters version:2.4 Fix case-insensitive string handling version:2.4 StringEscapeUtils.escapeHTML() does not escape chars (0x00-0x20) version:2.4 DateUtils.round doesn't work correct for Calendar.AM_PM version:2.4 Lower Ascii Characters don't get encoded by Entities.java version:2.4 Issue in HashCodeBuilder which only shows up under high load multi-threaded usage. version:2.4 Ant build file does not include ReflectTestSuite version:2.4 EqualsBuilder and HashCodeBuilder treat java.math.BigDecimal inconsistantly and break general contract of hashCode version:2.4 JDK 1.5 build/runtime failure on LANG-393 (EqualsBuilder) version:2.4 ExtendedMessageFormat: OutOfMemory with custom format registry and a pattern containing single quotes version:2.4 parseDate cannot parse ISO8601 dates produced by FastDateFormat version:2.4 DateFormatUtils.format does not correctly change Calendar TimeZone in certain situations version:2.4 StringUtils replaceEach - Bug or Missing Documentation version:2.4 Javadoc wrong for StringUtils startsWith; startsWithIgnoreCase; endsWith and endsWithIgnoreCase version:2.4 HashCodeBuilder reflectionAppend creates unnecessary copy of excludeFields version:2.4 ExceptionUtils uses mutable lock target version:2.4 ClassUtils.toClass(Object[]) throws NPE on null array element version:2.4 StringUtils lastIndexOf(String str; char searchChar; int startPos) not working version:2.4

  1. org.apache.httpcomponents httpclient version: 4.2.6 Jira issues: ClientConnectionManager should honor context classloader version:4.2.6
  2. commons-logging commons-logging version: 1.1.1 Jira issues: Unit tests fail on linux with java16 version:1.1.1 deadlock on re-registration of logger version:1.1.1 Potential missing privileged block for class loader version:1.1.1 Log4JLogger uses deprecated static members of Priority such as INFO version:1.1.1 LogFactory/LogFactoryImpl ingore Throwable version:1.1.1 LogFactory.nullClassLoaderFactory is not properly synchronized version:1.1.1 SimpleLog.log - unsafe update of shortLogName version:1.1.1 BufferedReader is not closed properly version:1.1.1;1.2
  3. commons-io commons-io version: 2.4 Jira issues: IOUtils copyLarge() and skip() methods are performance hogs version:2.3;2.4 CharSequenceInputStream#reset() behaves incorrectly in case when buffer size is not dividable by data size version:2.4 [Tailer] InterruptedException while the thead is sleeping is silently ignored version:2.4 IOUtils.contentEquals* methods returns false if input1 == input2; should return true version:2.4 Apache Commons - standard links for documents are failing version:2.4 Links are broken on User Guide.... version:2.4 FileUtils.sizeOfDirectoryAsBigInteger can overflow version:2.4 Regression in FileUtils.readFileToString from 2.0.1 version:2.1;2.2;2.3;2.4 Correct exception message in FileUtils.getFile(File; String...) version:2.4 org.apache.commons.io.FileUtils#waitFor waits too long version:2.4 getPrefixLength return -1 if unix file contains colon version:2.4 FilenameUtils should handle embedded null bytes version:2.4 Exceptions are suppressed incorrectly when copying files. version:2.4;2.5
  4. commons-codec commons-codec version: 1.2 Jira issues: org.apache.commons.codec.net.URLCodec.ESCAPE_CHAR isn't final but should be version:1.2;1.3;1.4 Change name of urldecode and urlencode in URLCodec version:1.2 Provide a package.html for org/apache/commons/codec/net version:1.2 [codec] Alterations to Binary.java and its unit test for 1.3 release version:1.2 [Codec] Default URL encoding logic broken version:1.2 Base64 chunked encoding not compliant with RFC 2045 section 2.1 CRLF version:1.2 [codec] Hex converts illegal characters to 255 version:1.2 All links to fixed bugs in the "Changes Report" http://commons.apache.org/codec/changes-report.html point nowhere; e.g. http://issues.apache.org/jira/browse/34157. Looks as if all JIRA tickets were renumbered. version:1.1;1.2;1.3;1.4
  5. commons-codec commons-codec version: 1.8 Jira issues: Beider Morse does not close Scanners used to read config files. version:1.8

Sincerely~ FDU Software Engineering Lab Marth 14th,2019