Skip to content

Commit 5b89711

Browse files
Bump tika from 2.9.2 to 3.2.2 (opensearch-project#19125)
* Fix tika CVE Signed-off-by: Prudhvi Godithi <pgodithi@amazon.com> * Update CHANGELOG.md Signed-off-by: Prudhvi Godithi <pgodithi@amazon.com> * fix html parser Signed-off-by: Prudhvi Godithi <pgodithi@amazon.com> * fix html parser Signed-off-by: Prudhvi Godithi <pgodithi@amazon.com> * fix html parser Signed-off-by: Prudhvi Godithi <pgodithi@amazon.com> * Add license Signed-off-by: Prudhvi Godithi <pgodithi@amazon.com> * Add license Signed-off-by: Prudhvi Godithi <pgodithi@amazon.com> * Update checksums Signed-off-by: Prudhvi Godithi <pgodithi@amazon.com> * Update shas Signed-off-by: Prudhvi Godithi <pgodithi@amazon.com> * Add pdf box license Signed-off-by: Prudhvi Godithi <pgodithi@amazon.com> * Fix tests Signed-off-by: Prudhvi Godithi <pgodithi@amazon.com> * Update security fonts permission Signed-off-by: Prudhvi Godithi <pgodithi@amazon.com> * Add dummy fonts Signed-off-by: Prudhvi Godithi <pgodithi@amazon.com> * Upstream fetch Signed-off-by: Prudhvi Godithi <pgodithi@amazon.com> * Fix license check error Signed-off-by: Prudhvi Godithi <pgodithi@amazon.com> * Fix license check error Signed-off-by: Prudhvi Godithi <pgodithi@amazon.com> --------- Signed-off-by: Prudhvi Godithi <pgodithi@amazon.com>
1 parent 8531924 commit 5b89711

File tree

51 files changed

+375
-35
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

51 files changed

+375
-35
lines changed

.gitattributes

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,5 +10,6 @@
1010
*.bcfks binary
1111
*.crt binary
1212
*.p12 binary
13+
*.ttf binary
1314
*.txt text=auto
1415
CHANGELOG.md merge=union

CHANGELOG.md

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,8 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
4444
- Bump `com.google.auth:google-auth-library-oauth2-http` from 1.37.1 to 1.38.0 ([#19144](https://github.com/opensearch-project/OpenSearch/pull/19144))
4545
- Bump `com.squareup.okio:okio` from 3.15.0 to 3.16.0 ([#19146](https://github.com/opensearch-project/OpenSearch/pull/19146))
4646
- Bump Slf4j from 1.7.36 to 2.0.17 ([#19136](https://github.com/opensearch-project/OpenSearch/pull/19136))
47+
- Bump `org.apache.tika` from 2.9.2 to 3.2.2 ([#19125](https://github.com/opensearch-project/OpenSearch/pull/19125))
48+
- Bump `org.apache.commons:commons-compress` from 1.26.1 to 1.28.0 ([#19125](https://github.com/opensearch-project/OpenSearch/pull/19125))
4749

4850
### Deprecated
4951

distribution/tools/plugin-cli/build.gradle

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -81,5 +81,10 @@ thirdPartyAudit.ignoreMissingClasses(
8181
'org.tukaani.xz.XZOutputStream',
8282
'org.apache.commons.codec.digest.PureJavaCrc32C',
8383
'org.apache.commons.codec.digest.XXHash32',
84-
'org.apache.commons.lang3.reflect.FieldUtils'
84+
'org.apache.commons.lang3.reflect.FieldUtils',
85+
'org.apache.commons.lang3.ArrayFill',
86+
'org.apache.commons.lang3.ArrayUtils',
87+
'org.apache.commons.lang3.StringUtils',
88+
'org.apache.commons.lang3.SystemProperties',
89+
'org.apache.commons.lang3.function.Suppliers'
8590
)

distribution/tools/plugin-cli/licenses/commons-compress-1.26.1.jar.sha1

Lines changed: 0 additions & 1 deletion
This file was deleted.
Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
e482f2c7a88dac3c497e96aa420b6a769f59c8d7

gradle/libs.versions.toml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,7 @@ httpasyncclient = "4.1.5"
5050
commonslogging = "1.2"
5151
commonscodec = "1.18.0"
5252
commonslang = "3.18.0"
53-
commonscompress = "1.26.1"
53+
commonscompress = "1.28.0"
5454
commonsio = "2.16.0"
5555
# plugin dependencies
5656
aws = "2.30.31"

plugins/ingest-attachment/build.gradle

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -38,8 +38,8 @@ opensearchplugin {
3838
}
3939

4040
versions << [
41-
'tika' : '2.9.2',
42-
'pdfbox': '2.0.31',
41+
'tika' : '3.2.2',
42+
'pdfbox': '3.0.5',
4343
'poi' : '5.4.1',
4444
'mime4j': '0.8.11'
4545
]
@@ -75,10 +75,11 @@ dependencies {
7575

7676
// external parser libraries
7777
// HTML
78-
api 'org.ccil.cowan.tagsoup:tagsoup:1.2.1'
78+
api 'org.jsoup:jsoup:1.20.1'
7979
// Adobe PDF
8080
api "org.apache.pdfbox:pdfbox:${versions.pdfbox}"
8181
api "org.apache.pdfbox:fontbox:${versions.pdfbox}"
82+
api "org.apache.pdfbox:pdfbox-io:${versions.pdfbox}"
8283
api "org.apache.pdfbox:jempbox:1.8.17"
8384
api "commons-logging:commons-logging:${versions.commonslogging}"
8485
// OpenOffice
@@ -121,6 +122,7 @@ forbiddenPatterns {
121122
exclude '**/*.pdf'
122123
exclude '**/*.epub'
123124
exclude '**/*.vsdx'
125+
exclude '**/*.ttf'
124126
}
125127

126128
thirdPartyAudit {
Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
Copyright 2011 The Roboto Project Authors (https://github.com/googlefonts/roboto-classic)
2+
3+
This Font Software is licensed under the SIL Open Font License, Version 1.1.
4+
This license is copied below, and is also available with a FAQ at:
5+
https://openfontlicense.org
6+
7+
8+
-----------------------------------------------------------
9+
SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007
10+
-----------------------------------------------------------
11+
12+
PREAMBLE
13+
The goals of the Open Font License (OFL) are to stimulate worldwide
14+
development of collaborative font projects, to support the font creation
15+
efforts of academic and linguistic communities, and to provide a free and
16+
open framework in which fonts may be shared and improved in partnership
17+
with others.
18+
19+
The OFL allows the licensed fonts to be used, studied, modified and
20+
redistributed freely as long as they are not sold by themselves. The
21+
fonts, including any derivative works, can be bundled, embedded,
22+
redistributed and/or sold with any software provided that any reserved
23+
names are not used by derivative works. The fonts and derivatives,
24+
however, cannot be released under any other type of license. The
25+
requirement for fonts to remain under this license does not apply
26+
to any document created using the fonts or their derivatives.
27+
28+
DEFINITIONS
29+
"Font Software" refers to the set of files released by the Copyright
30+
Holder(s) under this license and clearly marked as such. This may
31+
include source files, build scripts and documentation.
32+
33+
"Reserved Font Name" refers to any names specified as such after the
34+
copyright statement(s).
35+
36+
"Original Version" refers to the collection of Font Software components as
37+
distributed by the Copyright Holder(s).
38+
39+
"Modified Version" refers to any derivative made by adding to, deleting,
40+
or substituting -- in part or in whole -- any of the components of the
41+
Original Version, by changing formats or by porting the Font Software to a
42+
new environment.
43+
44+
"Author" refers to any designer, engineer, programmer, technical
45+
writer or other person who contributed to the Font Software.
46+
47+
PERMISSION & CONDITIONS
48+
Permission is hereby granted, free of charge, to any person obtaining
49+
a copy of the Font Software, to use, study, copy, merge, embed, modify,
50+
redistribute, and sell modified and unmodified copies of the Font
51+
Software, subject to the following conditions:
52+
53+
1) Neither the Font Software nor any of its individual components,
54+
in Original or Modified Versions, may be sold by itself.
55+
56+
2) Original or Modified Versions of the Font Software may be bundled,
57+
redistributed and/or sold with any software, provided that each copy
58+
contains the above copyright notice and this license. These can be
59+
included either as stand-alone text files, human-readable headers or
60+
in the appropriate machine-readable metadata fields within text or
61+
binary files as long as those fields can be easily viewed by the user.
62+
63+
3) No Modified Version of the Font Software may use the Reserved Font
64+
Name(s) unless explicit written permission is granted by the corresponding
65+
Copyright Holder. This restriction only applies to the primary font name as
66+
presented to the users.
67+
68+
4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font
69+
Software shall not be used to promote, endorse or advertise any
70+
Modified Version, except to acknowledge the contribution(s) of the
71+
Copyright Holder(s) and the Author(s) or with their explicit written
72+
permission.
73+
74+
5) The Font Software, modified or unmodified, in part or in whole,
75+
must be distributed entirely under this license, and must not be
76+
distributed under any other license. The requirement for fonts to
77+
remain under this license does not apply to any document created
78+
using the Font Software.
79+
80+
TERMINATION
81+
This license becomes null and void if any of the above conditions are
82+
not met.
83+
84+
DISCLAIMER
85+
THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
86+
EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF
87+
MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
88+
OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE
89+
COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
90+
INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL
91+
DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
92+
FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM
93+
OTHER DEALINGS IN THE FONT SOFTWARE.

plugins/ingest-attachment/licenses/commons-compress-1.26.1.jar.sha1

Lines changed: 0 additions & 1 deletion
This file was deleted.
Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
e482f2c7a88dac3c497e96aa420b6a769f59c8d7

0 commit comments

Comments
 (0)