systelab / java-report-generator

PDF Generator library
MIT License
5 stars 0 forks source link

Upgrade jasperreports to fix security vulnerabilities of jfreechart component #30

Closed IvanWerfen closed 1 week ago

IvanWerfen commented 2 weeks ago

Describe the bug SBOM analysis of this library shows open vulnerabilities due to inclusion of jfreechart component. This component is introduced by jasperreports, the 3rd party library used to generate PDF documents. Moreover, these are the dependency paths for this jfreechart component:

To Reproduce Generate an SBOM analysis and check that the output report produces at least the following open vulnerabilities:

Expected behavior Upgrade of jasperreports to latest version, in the new SBOM analysis should not report anymore the before mentioned vulnerabilities.

Additional context The newest version of jasperreports (7.0.1) it does not include the classes of pdf in the principal library. So, we have to include the library jasperreports-pdf and change the paths of 3 imports ((JRPdfExporter, SimplePdfExporterConfiguration, SimplePdfReportConfiguration))

joaquimvila commented 1 week ago

Resolved in release 1.9.4 of this library