search

streamnative / bookkeeper-achieved

Apache Bookkeeper
https://bookkeeper.apache.org
Apache License 2.0
3 stars 2 forks source link

ISSUE-2732: [Security] org.inferred:freebuilder:1.14.9 dependency causes Bookkeeper to be flagged for jQuery vulnerabilities #378

Closed sijie closed 3 years ago

sijie commented 3 years ago

Original Issue: apache/bookkeeper#2732

BUG REPORT

The org.inferred:freebuilder:1.14.9 dependency causes Bookkeeper to be flagged for jQuery vulnerabilities. This happens in the Sonatype IQ vulnerability scanner which will also scan embedded js files. For example, it find jQuery in the path org/inferred/freebuilder/shaded/org/openjdk/tools/javadoc/internal/doclets/formats/html/resources/jquery/external/jquery jquery-1.10.2.js inside the freebuilder jar file.

Expected behavior

Bookkeeper shouldn't expose freebuilder as a dependency at all. It's an annotation processor which should be defined as optional dependency in maven and with compileOnly in gradle.