漏洞修复

zrj

2024-06-13 aa02a3db013686ec375b2f582283732c8fd7f447

 pom.xml

@@ -18,7 +18,7 @@
        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
        <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>

        <spring.boot.version>2.7.1</spring.boot.version>
        <spring.boot.version>2.7.15</spring.boot.version>
        <spring.platform.version>Cairo-SR8</spring.platform.version>

        <!-- 推荐使用Harbor -->
@@ -220,7 +220,43 @@
            <version>5.5.4</version>
            <scope>compile</scope>
        </dependency>

        <!--漏洞覆盖之前 1.3.0 版本-->
        <!-- https://mvnrepository.com/artifact/org.yaml/snakeyaml -->
        <dependency>
            <groupId>org.yaml</groupId>
            <artifactId>snakeyaml</artifactId>
            <version>2.0</version>
        </dependency>
        <!-- FileUpload 依赖 升级 （漏洞版本 1.3.3）-->
        <dependency>
            <groupId>commons-fileupload</groupId>
            <artifactId>commons-fileupload</artifactId>
            <version>1.5</version>
        </dependency>
        <!-- IO 依赖，FileUpload 需要 Commons IO 库 -->
        <dependency>
            <groupId>commons-io</groupId>
            <artifactId>commons-io</artifactId>
            <version>2.8.0</version>
        </dependency>
        <!-- 排除 velocity 1.7 有漏洞-->
        <dependency>
            <groupId>com.bstek.ureport</groupId>
            <artifactId>ureport2-console</artifactId>
            <version>2.2.9</version>
            <exclusions>
                <exclusion>
                    <groupId>org.apache.velocity</groupId>
                    <artifactId>velocity</artifactId>
                </exclusion>
            </exclusions>
        </dependency>
        <!--覆盖原来的 8.0.22 有漏洞-->
        <dependency>
            <groupId>mysql</groupId>
            <artifactId>mysql-connector-java</artifactId>
            <version>8.0.27</version>
        </dependency>
    </dependencies>

    <build>