Skip to content

Commit 11b9d9a

Browse files
dependabot[bot]maximthomas
dependabot[bot]
and
maximthomas
authored
CVE-2026-24400 Fix XXE vulnerability in isXmlEqualTo assertion in assertj-core (#162)
* Bump org.assertj:assertj-core from 1.6.1 to 3.27.7 Bumps [org.assertj:assertj-core](https://github.com/assertj/assertj) from 1.6.1 to 3.27.7. - [Release notes](https://github.com/assertj/assertj/releases) - [Commits](assertj/assertj@assertj-core-1.6.1...assertj-build-3.27.7) --- updated-dependencies: - dependency-name: org.assertj:assertj-core dependency-version: 3.27.7 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com> * CVE-2026-24400 Fix XXE vulnerability in isXmlEqualTo assertion * update copyright --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: maximthomas <maxim.thomas@gmail.com>
1 parent 89d7ca6 commit 11b9d9a

16 files changed

Lines changed: 91 additions & 79 deletions

File tree

‎commons/audit/core/src/test/java/org/forgerock/audit/AuditServiceImplTest.java‎

Lines changed: 21 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@
1212
* information: "Portions copyright [year] [name of copyright owner]".
1313
*
1414
* Copyright 2015-2016 ForgeRock AS.
15+
* Portions copyright 2020-2026 3A Systems LLC.
1516
*/
1617

1718
package org.forgerock.audit;
@@ -28,7 +29,6 @@
2829
import static org.forgerock.json.resource.Requests.newQueryRequest;
2930
import static org.forgerock.json.resource.Responses.newQueryResponse;
3031
import static org.forgerock.json.resource.Responses.newResourceResponse;
31-
import static org.forgerock.util.test.assertj.AssertJPromiseAssert.assertThat;
3232
import static org.mockito.BDDMockito.given;
3333
import static org.mockito.Mockito.any;
3434
import static org.mockito.Mockito.eq;
@@ -70,6 +70,7 @@
7070
import org.forgerock.services.context.Context;
7171
import org.forgerock.services.context.RootContext;
7272
import org.forgerock.util.promise.Promise;
73+
import org.forgerock.util.test.assertj.AssertJPromiseAssert;
7374
import org.testng.annotations.BeforeMethod;
7475
import org.testng.annotations.Test;
7576

@@ -108,7 +109,7 @@ public void shouldDelegateCreateRequestToRegisteredHandler() throws Exception {
108109

109110
//then
110111
assertThat(auditService.isAuditing("access")).isTrue();
111-
assertThat(promise)
112+
AssertJPromiseAssert.assertThat(promise)
112113
.succeeded()
113114
.withObject()
114115
.isInstanceOf(ResourceResponse.class);
@@ -133,7 +134,7 @@ public void shouldIgnoreCreateRequestIfAuditEventTopicNotMappedToHandler() throw
133134

134135
//then
135136
assertThat(auditService.isAuditing(topic)).isFalse();
136-
assertThat(promise)
137+
AssertJPromiseAssert.assertThat(promise)
137138
.succeeded()
138139
.withObject()
139140
.isInstanceOf(ResourceResponse.class);
@@ -158,7 +159,7 @@ public void shouldFailCreateRequestIfAuditEventTopicIsNotKnown() throws ServiceU
158159

159160
//then
160161
assertThat(auditService.isAuditing("unknownTopic")).isFalse();
161-
assertThat(promise)
162+
AssertJPromiseAssert.assertThat(promise)
162163
.failedWithException()
163164
.isInstanceOf(ResourceException.class);
164165
}
@@ -187,7 +188,7 @@ public void shouldFailCreateRequestIfHandlerConfiguredForQueriesThrowsException(
187188
//then
188189
verify(queryHandler, times(1)).publishEvent(any(Context.class), eq("access"), any(JsonValue.class));
189190
verify(otherHandler, times(1)).publishEvent(any(Context.class), eq("access"), any(JsonValue.class));
190-
assertThat(promise)
191+
AssertJPromiseAssert.assertThat(promise)
191192
.failedWithException()
192193
.isInstanceOf(InternalServerErrorException.class);
193194
}
@@ -244,7 +245,7 @@ public void shouldDelegateReadRequestToConfiguredHandlerForQueries() throws Exce
244245
auditService.handleRead(new RootContext(), readRequest);
245246

246247
//then
247-
assertThat(promise).isSameAs(dummyResponse);
248+
AssertJPromiseAssert.assertThat(promise).isSameAs(dummyResponse);
248249
verifyZeroInteractions(otherAuditEventHandler);
249250
}
250251

@@ -260,7 +261,7 @@ public void shouldNotSupportDeleteOfAuditEvents() throws ResourceException {
260261
Requests.newDeleteRequest("_id"));
261262

262263
//then
263-
assertThat(promise)
264+
AssertJPromiseAssert.assertThat(promise)
264265
.failedWithException()
265266
.isInstanceOf(NotSupportedException.class);
266267
}
@@ -278,7 +279,7 @@ public void shouldNotSupportPatchOfAuditEvents() throws ResourceException {
278279
Requests.newPatchRequest("_id"));
279280

280281
//then
281-
assertThat(promise)
282+
AssertJPromiseAssert.assertThat(promise)
282283
.failedWithException()
283284
.isInstanceOf(NotSupportedException.class);
284285
}
@@ -296,7 +297,7 @@ public void shouldNotSupportUpdateOfAuditEvents() throws ResourceException {
296297
Requests.newUpdateRequest("_id", new JsonValue(new HashMap<String, Object>())));
297298

298299
//then
299-
assertThat(promise)
300+
AssertJPromiseAssert.assertThat(promise)
300301
.failedWithException()
301302
.isInstanceOf(NotSupportedException.class);
302303
}
@@ -314,7 +315,7 @@ public void shouldNotSupportActions() throws ResourceException {
314315
Requests.newActionRequest("access", "unknownAction"));
315316

316317
//then
317-
assertThat(promise)
318+
AssertJPromiseAssert.assertThat(promise)
318319
.failedWithException()
319320
.isInstanceOf(BadRequestException.class);
320321
}
@@ -342,7 +343,7 @@ public void shouldDelegateQueryRequestToConfiguredHandlerForQueries() throws Exc
342343
//then
343344
verify(eventHandler).queryEvents(
344345
any(Context.class), any(String.class), any(QueryRequest.class), any(QueryResourceHandler.class));
345-
assertThat(promise).isSameAs(queryResponsePromise);
346+
AssertJPromiseAssert.assertThat(promise).isSameAs(queryResponsePromise);
346347
}
347348

348349
@Test
@@ -364,7 +365,7 @@ public void shouldFailCreateRequestIfAuditEventIsMissingTransactionId() throws R
364365
auditService.handleCreate(new RootContext(), createRequest);
365366

366367
//then
367-
assertThat(promise)
368+
AssertJPromiseAssert.assertThat(promise)
368369
.failedWithException()
369370
.isInstanceOf(BadRequestException.class);
370371
}
@@ -388,7 +389,7 @@ public void shouldFailCreateRequestIfAuditEventIsMissingTimestamp() throws Resou
388389
auditService.handleCreate(new RootContext(), createRequest);
389390

390391
//then
391-
assertThat(promise)
392+
AssertJPromiseAssert.assertThat(promise)
392393
.failedWithException()
393394
.isInstanceOf(BadRequestException.class);
394395
}
@@ -559,7 +560,7 @@ public void shouldFailCreateRequestIfAuditServiceIsShutdown() throws Exception {
559560
auditService.handleCreate(new RootContext(), createRequest);
560561

561562
//then
562-
assertThat(promise)
563+
AssertJPromiseAssert.assertThat(promise)
563564
.failedWithException()
564565
.isInstanceOf(ServiceUnavailableException.class)
565566
.hasMessage("AuditService not running");
@@ -576,7 +577,7 @@ public void shouldFailReadRequestIfAuditServiceIsShutdown() {
576577
auditService.handleRead(new RootContext(), readRequest);
577578

578579
//then
579-
assertThat(promise)
580+
AssertJPromiseAssert.assertThat(promise)
580581
.failedWithException()
581582
.isInstanceOf(ServiceUnavailableException.class)
582583
.hasMessage("AuditService not running");
@@ -594,7 +595,7 @@ public void shouldFailQueryRequestIfAuditServiceIsShutdown() {
594595
mock(QueryResourceHandler.class));
595596

596597
//then
597-
assertThat(promise)
598+
AssertJPromiseAssert.assertThat(promise)
598599
.failedWithException()
599600
.isInstanceOf(ServiceUnavailableException.class)
600601
.hasMessage("AuditService not running");
@@ -654,7 +655,7 @@ public void shouldNotDelegateCreateRequestToADisabledHandler() throws Exception
654655

655656
//then
656657
assertThat(auditService.isAuditing(topic)).isFalse();
657-
assertThat(promise)
658+
AssertJPromiseAssert.assertThat(promise)
658659
.succeeded()
659660
.withObject()
660661
.isInstanceOf(ResourceResponse.class);
@@ -689,7 +690,7 @@ public void shouldDelegateFilteredCreateRequestToRegisteredHandler() throws Exce
689690

690691
//then
691692
assertThat(auditService.isAuditing(topic)).isTrue();
692-
assertThat(promise)
693+
AssertJPromiseAssert.assertThat(promise)
693694
.succeeded()
694695
.withObject()
695696
.isInstanceOf(ResourceResponse.class);
@@ -721,7 +722,7 @@ public void shouldNotDelegateReadRequestToConfiguredHandlerForQueriesWhenNoResou
721722
auditService.handleRead(new RootContext(), readRequest);
722723

723724
//then
724-
assertThat(promise).failedWithException().isInstanceOf(BadRequestException.class);
725+
AssertJPromiseAssert.assertThat(promise).failedWithException().isInstanceOf(BadRequestException.class);
725726
verifyZeroInteractions(otherAuditEventHandler);
726727
}
727728

@@ -747,7 +748,7 @@ public void shouldNotDelegateReadRequestToConfiguredHandlerForQueriesWhenInvalid
747748
auditService.handleRead(new RootContext(), readRequest);
748749

749750
//then
750-
assertThat(promise).failedWithException().isInstanceOf(BadRequestException.class);
751+
AssertJPromiseAssert.assertThat(promise).failedWithException().isInstanceOf(BadRequestException.class);
751752
verifyZeroInteractions(otherAuditEventHandler);
752753
}
753754

‎commons/audit/handler-csv/src/test/java/org/forgerock/audit/handlers/csv/CsvAuditEventHandlerTest.java‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@
1212
* information: "Portions copyright [year] [name of copyright owner]".
1313
*
1414
* Copyright 2015-2016 ForgeRock AS.
15+
* Portions copyright 2020-2026 3A Systems LLC.
1516
*/
1617

1718
package org.forgerock.audit.handlers.csv;
@@ -22,7 +23,6 @@
2223
import static org.forgerock.audit.AuditServiceProxy.*;
2324
import static org.forgerock.audit.handlers.csv.CsvAuditEventHandler.*;
2425
import static org.forgerock.json.JsonValue.*;
25-
import static org.forgerock.util.test.assertj.AssertJPromiseAssert.assertThat;
2626
import static org.mockito.Mockito.*;
2727

2828
import java.io.File;
@@ -61,6 +61,7 @@
6161
import org.forgerock.services.context.RootContext;
6262
import org.forgerock.util.promise.Promise;
6363
import org.forgerock.util.promise.ResultHandler;
64+
import org.forgerock.util.test.assertj.AssertJPromiseAssert;
6465
import org.mockito.ArgumentCaptor;
6566
import org.testng.annotations.DataProvider;
6667
import org.testng.annotations.Test;
@@ -154,7 +155,7 @@ public void testCreatingAuditLogEntry() throws Exception {
154155
csvHandler.publishEvent(context, "access", createRequest.getContent());
155156

156157
//then
157-
assertThat(promise)
158+
AssertJPromiseAssert.assertThat(promise)
158159
.succeeded()
159160
.withObject()
160161
.isInstanceOf(ResourceResponse.class);
@@ -182,7 +183,7 @@ public void testReadingAuditLogEntry() throws Exception {
182183
csvHandler.readEvent(context, "access", readRequest.getResourcePathObject().tail(1).toString());
183184

184185
//then
185-
assertThat(promise)
186+
AssertJPromiseAssert.assertThat(promise)
186187
.succeeded()
187188
.withObject()
188189
.isInstanceOf(ResourceResponse.class);
@@ -230,7 +231,7 @@ public void testQueryOnAuditLogEntry() throws Exception {
230231
csvHandler.queryEvents(context, "access", queryRequest, queryResourceHandler);
231232

232233
//then
233-
assertThat(promise).succeeded();
234+
AssertJPromiseAssert.assertThat(promise).succeeded();
234235
verify(queryResourceHandler).handleResource(resourceCaptor.capture());
235236

236237
final ResourceResponse resource = resourceCaptor.getValue();
@@ -268,7 +269,7 @@ private ResourceResponse createAccessEvent(AuditEventHandler auditEventHandler)
268269
final Promise<ResourceResponse, ResourceException> promise =
269270
auditEventHandler.publishEvent(context, "access", createRequest.getContent());
270271

271-
assertThat(promise)
272+
AssertJPromiseAssert.assertThat(promise)
272273
.succeeded()
273274
.isInstanceOf(ResourceResponse.class);
274275

‎commons/audit/handler-elasticsearch/src/test/java/org/forgerock/audit/handlers/elasticsearch/ElasticsearchAuditEventHandlerTest.java‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@
1212
* information: "Portions copyright [year] [name of copyright owner]".
1313
*
1414
* Copyright 2016 ForgeRock AS.
15+
* Portions copyright 2020-2026 3A Systems LLC.
1516
*/
1617
package org.forgerock.audit.handlers.elasticsearch;
1718

@@ -22,7 +23,6 @@
2223
import static org.forgerock.json.JsonValue.json;
2324
import static org.forgerock.json.JsonValue.object;
2425
import static org.forgerock.util.promise.Promises.newResultPromise;
25-
import static org.forgerock.util.test.assertj.AssertJPromiseAssert.assertThat;
2626
import static org.mockito.Matchers.any;
2727
import static org.mockito.Mockito.mock;
2828
import static org.mockito.Mockito.when;
@@ -64,6 +64,7 @@
6464
import org.forgerock.util.promise.NeverThrowsException;
6565
import org.forgerock.util.promise.Promise;
6666
import org.forgerock.util.query.QueryFilter;
67+
import org.forgerock.util.test.assertj.AssertJPromiseAssert;
6768
import org.mockito.invocation.InvocationOnMock;
6869
import org.mockito.stubbing.Answer;
6970
import org.testng.annotations.BeforeTest;
@@ -170,7 +171,7 @@ public void testFailedQuery() throws Exception {
170171
handler.queryEvents(mock(Context.class), "access", queryRequest, queryResourceHandler);
171172

172173
// then
173-
assertThat(result).failedWithException().isInstanceOf(InternalServerErrorException.class);
174+
AssertJPromiseAssert.assertThat(result).failedWithException().isInstanceOf(InternalServerErrorException.class);
174175
}
175176

176177
@Test
@@ -213,7 +214,7 @@ public void testFailedRead() throws Exception {
213214
handler.readEvent(context, "authentication", "fake-id-that-does-not-exist");
214215

215216
// then
216-
assertThat(responsePromise).failedWithException().isInstanceOf(NotFoundException.class);
217+
AssertJPromiseAssert.assertThat(responsePromise).failedWithException().isInstanceOf(NotFoundException.class);
217218
}
218219

219220
@Test

‎commons/audit/handler-jms/src/test/java/org/forgerock/audit/handlers/jms/JmsAuditEventHandlerTest.java‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@
1212
* information: "Portions copyright [year] [name of copyright owner]".
1313
*
1414
* Copyright 2016 ForgeRock AS.
15-
* Portions copyright 2024 3A Systems LLC.
15+
* Portions copyright 2020-2026 3A Systems LLC.
1616
*/
1717

1818
package org.forgerock.audit.handlers.jms;
@@ -22,7 +22,6 @@
2222
import static org.forgerock.audit.json.AuditJsonConfig.parseAuditEventHandlerConfiguration;
2323
import static org.forgerock.json.JsonValue.*;
2424
import static org.forgerock.json.test.assertj.AssertJJsonValueAssert.assertThat;
25-
import static org.forgerock.util.test.assertj.AssertJPromiseAssert.assertThat;
2625
import static org.mockito.Matchers.any;
2726
import static org.mockito.Matchers.anyInt;
2827
import static org.mockito.Mockito.anyBoolean;
@@ -59,6 +58,7 @@
5958
import org.forgerock.json.resource.ResourceException;
6059
import org.forgerock.json.resource.ResourceResponse;
6160
import org.forgerock.util.promise.Promise;
61+
import org.forgerock.util.test.assertj.AssertJPromiseAssert;
6262
import org.mockito.ArgumentCaptor;
6363
import org.mockito.invocation.InvocationOnMock;
6464
import org.mockito.stubbing.Answer;
@@ -299,7 +299,7 @@ public void testJmsAuditEventHandlerPublishWithFailedRetry() throws Exception {
299299
jmsAuditEventHandler.publishEvent(null, "TEST_AUDIT", json(object(field("name", "TestEvent"))));
300300

301301
// then
302-
assertThat(promise).failedWithException().isInstanceOf(InternalServerErrorException.class);
302+
AssertJPromiseAssert.assertThat(promise).failedWithException().isInstanceOf(InternalServerErrorException.class);
303303

304304
}
305305

@@ -323,7 +323,7 @@ public void testQueryNotSupported() throws Exception {
323323
Promise<QueryResponse, ResourceException> response =
324324
jmsAuditEventHandler.queryEvents(null, "TEST_AUDIT", Requests.newQueryRequest(""), null);
325325

326-
assertThat(response).failedWithException().isInstanceOf(NotSupportedException.class);
326+
AssertJPromiseAssert.assertThat(response).failedWithException().isInstanceOf(NotSupportedException.class);
327327
}
328328

329329
@Test
@@ -348,7 +348,7 @@ public void testReadNotSupported() throws Exception {
348348

349349

350350
// then
351-
assertThat(response).failedWithException().isInstanceOf(NotSupportedException.class);
351+
AssertJPromiseAssert.assertThat(response).failedWithException().isInstanceOf(NotSupportedException.class);
352352
}
353353

354354
private JmsAuditEventHandlerConfiguration getDefaultConfiguration() throws Exception {

‎commons/auth-filters/authn-filter/jaspi-functional-tests/src/test/java/org/forgerock/caf/authn/ModuleAuditingIT.java‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -12,12 +12,12 @@
1212
* information: "Portions copyright [year] [name of copyright owner]".
1313
*
1414
* Copyright 2014-2016 ForgeRock AS.
15+
* Portions copyright 2020-2026 3A Systems LLC.
1516
*/
1617

1718
package org.forgerock.caf.authn;
1819

1920
import static org.assertj.core.api.Assertions.assertThat;
20-
import static org.forgerock.util.test.assertj.AssertJPromiseAssert.assertThat;
2121
import static org.assertj.core.data.MapEntry.entry;
2222
import static org.forgerock.caf.authn.AuthModuleParameters.moduleArray;
2323
import static org.forgerock.caf.authn.AuthModuleParameters.moduleParams;
@@ -42,6 +42,7 @@
4242
import org.forgerock.services.context.RootContext;
4343
import org.forgerock.util.promise.NeverThrowsException;
4444
import org.forgerock.util.promise.Promise;
45+
import org.forgerock.util.test.assertj.AssertJPromiseAssert;
4546
import org.slf4j.Logger;
4647
import org.slf4j.LoggerFactory;
4748
import org.testng.annotations.DataProvider;
@@ -163,7 +164,7 @@ public void auditing(String dataName, AuthModuleParameters sessionModuleParams,
163164

164165
Promise<Response, NeverThrowsException> result = handler.handle(new AttributesContext(new RootContext()),
165166
request);
166-
assertThat(result).succeeded();
167+
AssertJPromiseAssert.assertThat(result).succeeded();
167168
assertThat(result.get().getStatus().getCode()).isEqualTo(expectedResponseStatus);
168169

169170
JsonValue auditRecords = getAuditRecords(handler);

0 commit comments

Comments
 (0)