imsweb / algorithms

Java implementation of cancer-related algorithms (NHIA, NAPIIA, Survival Time, etc...)
Other
6 stars 6 forks source link

Replace openCSV dependency by FastCSV #187

Open depryf opened 7 months ago

depryf commented 7 months ago

openCSV has been flagged with a vulnerability for years. It doesn't look like they can fix it themselves, and at this point, it doesn't look it will ever going to be fixed. This creates small issues now that we used so much automation to check for vulnerabilities.

Need to look into this one:

https://github.com/osiegmar/FastCSV

No dependencies at all.

At the end, parsing CSV is not rocket science and I don' think it really matters which library is used.

For this Algorithms library, it's only used to load internal data, so it should be a very simple and safe switch.