I have a spring boot application. When I add this plugin
<plugin>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-maven-plugin</artifactId>
</plugin>
in the Build section, I am getting these vulnerabilities.
| CVE-2021-21345 | critical | 9.90 | com.thoughtworks.xstream_xstream | 1.4.7 | fixed in 1.4.16 | > 1 years | < 1 hour | XStream is a Java library to serialize objects |
| | | | | | > 1 years ago | | | to XML and back again. In XStream before version |
| | | | | | | | | 1.4.16, there is a vulnerability which may allow a |
| | | | | | | | | rem... |
+------------------+-----------+------+---------------------------------------------+----------------------+----------------------------------------------+-------------+------------+----------------------------------------------------+
| CVE-2021-21350 | critical | 9.80 | com.thoughtworks.xstream_xstream | 1.4.7 | fixed in 1.4.16 | > 1 years | < 1 hour | XStream is a Java library to serialize objects |
| | | | | | > 1 years ago | | | to XML and back again. In XStream before version |
| | | | | | | | | 1.4.16, there is a vulnerability which may allow a |
| | | | | | | | | rem... |
+------------------+-----------+------+---------------------------------------------+----------------------+----------------------------------------------+-------------+------------+----------------------------------------------------+
| CVE-2021-21347 | critical | 9.80 | com.thoughtworks.xstream_xstream | 1.4.7 | fixed in 1.4.16 | > 1 years | < 1 hour | XStream is a Java library to serialize objects |
| | | | | | > 1 years ago | | | to XML and back again. In XStream before version |
| | | | | | | | | 1.4.16, there is a vulnerability which may allow a |
| | | | | | | | | rem... |
+------------------+-----------+------+---------------------------------------------+----------------------+----------------------------------------------+-------------+------------+----------------------------------------------------+
| CVE-2021-21346 | critical | 9.80 | com.thoughtworks.xstream_xstream | 1.4.7 | fixed in 1.4.16 | > 1 years | < 1 hour | XStream is a Java library to serialize objects |
| | | | | | > 1 years ago | | | to XML and back again. In XStream before version |
| | | | | | | | | 1.4.16, there is a vulnerability which may allow a |
| | | | | | | | | rem... |
+------------------+-----------+------+---------------------------------------------+----------------------+----------------------------------------------+-------------+------------+----------------------------------------------------+
| CVE-2021-21344 | critical | 9.80 | com.thoughtworks.xstream_xstream | 1.4.7 | fixed in 1.4.16 | > 1 years | < 1 hour | XStream is a Java library to serialize objects |
| | | | | | > 1 years ago | | | to XML and back again. In XStream before version |
| | | | | | | | | 1.4.16, there is a vulnerability which may allow a |
| | | | | | | | | rem... |
+------------------+-----------+------+---------------------------------------------+----------------------+----------------------------------------------+-------------+------------+----------------------------------------------------+
| CVE-2021-21351 | critical | 9.10 | com.thoughtworks.xstream_xstream | 1.4.7 | fixed in 1.4.16 | > 1 years | < 1 hour | XStream is a Java library to serialize objects |
| | | | | | > 1 years ago | | | to XML and back again. In XStream before version |
| | | | | | | | | 1.4.16, there is a vulnerability may allow a |
| | | | | | | | | remote at... |
+------------------+-----------+------+---------------------------------------------+----------------------+----------------------------------------------+-------------+------------+----------------------------------------------------+
| CVE-2021-21342 | critical | 9.10 | com.thoughtworks.xstream_xstream | 1.4.7 | fixed in 1.4.16 | > 1 years | < 1 hour | XStream is a Java library to serialize objects |
| | | | | | > 1 years ago | | | to XML and back again. In XStream before version |
| | | | | | | | | 1.4.16, there is a vulnerability where the |
| | | | | | | | | processed s...
I also tried to add this in the dependencies section but still, it is giving the same.
<dependency>
<groupId>com.thoughtworks.xstream</groupId>
<artifactId>xstream</artifactId>
<version>1.4.18</version>
</dependency>
What should I change in my POM.xml to remove these Vulnerabilities?
You can check maven documentation for any known vulnerabilities associated with any nested dependency :
https://mvnrepository.com/artifact/org.springframework.boot/spring-boot-maven-plugin
seems that you are using specific old version of the plugin which has those vulnerabilities, try to update to the latest one.
Related
The tree of my project is:
+---.mvn
| \---wrapper
+---.settings
+---src
| +---main
| | +---java
| | | \---com
| | | +---google
| | | | \---api
| | | | \---services
| | | | \---samples
| | | | \---youtube
| | | | \---cmdline
| | | | \---data
| | | \---musicnet
| | | \---springboot
| | | +---basicauth
| | | +---controller
| | | +---exception
| | | +---model
| | | +---repository
| | | \---service
| | \---resources
| | +---static
| | | +---css
| | | +---img
| | | \---js
| | +---templates
| | \---upload-dir
| \---test
| \---java
| \---com
| \---musicnet
| \---springboot
\---target
+---classes
| +---com
| | +---google
| | | \---api
| | | \---services
| | | \---samples
| | | \---youtube
| | | \---cmdline
| | | \---data
| | \---musicnet
| | \---springboot
| | +---basicauth
| | +---controller
| | +---exception
| | +---model
| | +---repository
| | \---service
| +---META-INF
| | \---maven
| | \---com.musicnet
| | \---musicnet
| +---static
| | +---css
| | \---js
| +---templates
| \---upload-dir
\---test-classes
\---com
\---musicnet
\---springboot
I am uploading videos which are under src/main/resources/upload-dir with UploadVideo.java which is in com.google.api.services.samples.youtube.cmdline.data.
Src/main/resources is configured on classpath:
<classpathentry excluding="**" kind="src" output="target/classes" path="src/main/resources">
<attributes>
<attribute name="maven.pomderived" value="true"/>
</attributes>
</classpathentry>
UploadVideo.java returns null in line:
InputStreamContent mediaContent = new InputStreamContent(VIDEO_FILE_FORMAT, UploadVideo.class.getResourceAsStream("/" + SAMPLE_VIDEO_FILENAME));
I was reading and trying several ways to introduce or configure the path in getResourceAsStream to my video but always return null. The only way it works is when my upload-dir is under package com.google.api.services.samples.youtube.cmdline.data. So can I put relative path from com.google.api.services.samples.youtube.cmdline.data until src/main/resources/upload-dir?
Regards
You can load files from resources dir with Spring easily.
Get or create an app context:
appContext=new ClassPathXmlApplicationContext()
Then obtain the resource you want:
res = appContext.getResource("classpath:upload-dir/targetvideo.mkv")
Then you can get the inputstream from the res variable.
Now I am checking that seems to be not synchronized when file is upload to file system server and appContext is created. In order to be more specific:
- First the file is upload from view to file system server.
- Then the youtube api is called in order to upload the video to youtube.
- Youtube api create the resource and upload it to youtube.
- But the first time that upload video, the resource is null. If I restard project from Eclipse (some times I have to close Eclipse and open again) and try the same process, the resource is ok and then video is uploaded to Youtube.
It's like video is saved on file system server but appContext doesn't find the video on file system. Restart the project is needed in order to appContext find the video.
I have tryied to fix that marking in Windows -> Preferences -> WorkSpace -> Refresh using native hooks or pooling and Project -> Build automatically but the problem still persist.
I have following architecture of my project:
There are two libs (imported as jar in POM.xml):
Component 1
Component 2
These libs are imported in the parent project to expose the public APIs.
Now the scenario is Component 2 also depends upon some of the services from Component 1. (e.g. Component 2 may call Service A or Serive B from Component 1).
How can I make those services accessible to Component 2? I'm using Java & Spring.
`
+---------------------------------------------------------------------+
| Component Imported as jars |
| +------------------------------+ |
| | Component 1 | |
| | | |
| | | |
| | +-------------------------+ | |
| | |Service A | | |
| | +-------------------------+ | |
| | | |
| | +-------------------------+ | |
| | |Service B | | |
| | +-------------------------+ | |
| +------------------------------+ |
| Parent Project |
| |
| +------------------------------+ |
| | Component 2 | |
| | | |
| | +-------------------------+ | |
| | |Service 1 | | |
| | +-------------------------+ | |
| | +-------------------------+ | |
| | |Service 2 | | |
| | +-------------------------+ | |
| | | |
| | | |
| | | |
| +------------------------------+ |
| |
+---------------------------------------------------------------------+
create a new project that contains only the interfaces for service 1, 2, A and B, then
import in Component1 and Component2 poms then
modify services to implements their respective interfaces
remember add #Service annotation in the implementations
#Service
public class ServiceA implements ServiceAInterface
and if you need use serviceA in component 2
add attribute with the interface as type and #Autowired annotation
#Autowired
private ServiceAInterface service;
in this way you can use serviceA functionality without move code
So I have the following table that I must map to Java Objects:
+---------+-----------+---------------------+---------------------+--------+
| task_id | attribute | lastModified | activity | row_id |
+---------+-----------+---------------------+---------------------+--------+
| 1 | 1 | 2016-08-23 21:05:09 | first activity | 1 |
| 1 | 3 | 2016-08-23 21:08:28 | connect to db | 2 |
| 1 | 3 | 2016-08-23 21:08:56 | create web services | 3 |
| 1 | 4 | 2016-08-23 21:08:56 | data dump | 4 |
| 1 | 5 | 2016-08-23 21:08:56 | test cases | 5 |
| 1 | 6 | 2016-08-23 21:08:57 | dao object | 6 |
| 1 | 7 | 2016-08-23 21:08:57 | buy streetfood | 7 |
| 2 | 6 | 2016-08-23 21:08:57 | drink coke | 8 |
| 2 | 6 | 2016-08-23 21:09:00 | drink tea | 9 |
| 2 | 1 | 2016-08-23 21:12:30 | make tea | 10 |
| 2 | 2 | 2016-08-23 21:13:32 | charge phone | 11 |
| 2 | 3 | 2016-08-23 21:13:32 | shower | 12 |
| 2 | 4 | 2016-08-23 21:13:32 | sleep | 13 |
+---------+-----------+---------------------+---------------------+--------+
Here, each Task object( identified by the task_id column) has multiple attribute objects. These attribute objects have the lastModified, and activity fields. So far my approach has been to create a Row object have each row of the table mapped to a Row object via myBatis. Then do some Java-side processing to sort everything out. Is there a way to directly map this table via myBatis annotations and/or xml so that the 2 Task objects are created with each of them having a list of populated Atttribute objects inside?
Here is mybatis document:http://www.mybatis.org/mybatis-3/sqlmap-xml.html .May be you can use mybatis collection to solve your problem.
I have the tables accounts and action. accounts needs to be modified according to the instruction stored in action.
In action each row contains an account-id, an action (i=insert, u=update, d=delete, x=invalid operation) and an amount by which to update the account.
On an insert, if the account already exists, an update should be done
instead
On an update, if the account does not exist, it is created by an
insert
On a delete, if the row does not exist, no action is taken
Input
accounts:
+---id----value--+
| 1 | 1000 |
| 2 | 2000 |
| 3 | 1500 |
| 4 | 6500 |
| 5 | 500 |
+----------------+
action:
+---account_id---o---new_value---status---+
| 3 | u | 599 | |
| 6 | i | 2099 | |
| 5 | d | | |
| 7 | u | 1599 | |
| 1 | i | 399 | |
| 9 | d | | |
| 10 | x | | |
+-----------------------------------------+
Output
accounts:
+---id----value--+
| 1 | 399 |
| 2 | 800 |
| 3 | 599 |
| 4 | 1400 |
| 6 | 20099 |
| 7 | 1599 |
+----------------+
action:
+---account_id---o---new_value-------------------status----------------+
| 3 | u | 599 | Update: Success |
| 6 | i | 20099 | Update: Success |
| 5 | d | | Delete: Success |
| 7 | u | 1599 | Update: ID not founds. Value inserted |
| 1 | i | 399 | Insert: Acc exists. Updated instead |
| 9 | d | | Delete: ID not found |
| 10 | x | | Invalid operation: No action taken |
+----------------------------------------------------------------------+
I am experienced with Java and JDBC, but unfortunately I just don't know, how to start here.
Do I need an additional table? Do I have to use triggers?
I've seen two techniques for an upsert. With the first technique, within a transaction, you test first to see if the row exists, and use the results to determine whether to perform an insert or an update. With the second technique, you try performing an update and verify the number of records updated (JDBC gives you this). If it's zero, then you do an insert, if one, then you're done.
I want to store millions of time series entries (long time, double value) with Java. (Our monitoring system is currently storing every entry in a large mySQL table but performance is very bad.)
Are there time series databases implemented in java out there?
checkout http://opentsdb.net/ as used by StumbleUpon?
checkout http://square.github.com/cube/ as used by square
I hope to see additional suggestions in this thread.
The performance was bad because of wrong database design. I am using mysql and the table had this layout:
+-------------+--------------------------------------+------+-----+-------------------+-----------------------------+
| Field | Type | Null | Key | Default | Extra |
+-------------+--------------------------------------+------+-----+-------------------+-----------------------------+
| fk_category | smallint(6) | NO | PRI | NULL | |
| method | enum('min','max','avg','sum','none') | NO | PRI | none | |
| time | timestamp | NO | PRI | CURRENT_TIMESTAMP | on update CURRENT_TIMESTAMP |
| value | float | NO | | NULL | |
| accuracy | tinyint(1) | NO | | 0 | |
+-------------+--------------------------------------+------+-----+-------------------+-----------------------------+
My fault was an inapproriate index. After adding a multi column primary key all my queries are lightning fast:
+-------+------------+----------+--------------+-------------+-----------+-------------+----------+--------+------+------------+---------+---------------+
| Table | Non_unique | Key_name | Seq_in_index | Column_name | Collation | Cardinality | Sub_part | Packed | Null | Index_type | Comment | Index_comment |
+-------+------------+----------+--------------+-------------+-----------+-------------+----------+--------+------+------------+---------+---------------+
| job | 0 | PRIMARY | 1 | fk_category | A | 18 | NULL | NULL | | BTREE | | |
| job | 0 | PRIMARY | 2 | method | A | 18 | NULL | NULL | | BTREE | | |
| job | 0 | PRIMARY | 3 | time | A | 452509710 | NULL | NULL | | BTREE | | |
+-------+------------+----------+--------------+-------------+-----------+-------------+----------+--------+------+------------+---------+---------------+
Thanks for all you answers!
You can take a look at KDB. It's primarily used by financial companies to fetch market time series data.
What do you need to do with the data and when?
If you are just saving the values for later, a plain text file might do nicely, and then later upload to a database.