From 881a42d228b7f4c45e1b94cf31f279165e64fdfd Mon Sep 17 00:00:00 2001
From: YoyoFx <zl.hxd@hotmail.com>
Date: Fri, 5 Aug 2022 08:17:03 +0800
Subject: [PATCH] Fix CVE-2022-24823 and CVE-2022-25647 Vulnerability (#288)

---
 CHANGES.md                         |  2 ++
 apm-protocol/apm-network/pom.xml   | 20 ++++++++++++++++++++
 apm-sniffer/apm-agent-core/pom.xml |  6 +++++-
 dist-material/LICENSE              |  4 ++--
 pom.xml                            |  3 ++-
 test/e2e/base/pom.xml              |  2 +-
 test/plugin/pom.xml                |  4 ++--
 7 files changed, 34 insertions(+), 7 deletions(-)

diff --git a/CHANGES.md b/CHANGES.md
index 479672343..c0cca7cc5 100644
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -12,6 +12,8 @@ Release Notes.
 * Add plugin to support Tomcat 10.x.
 * Save http status code regardless of it's status.
 * Upgrade byte-buddy to 1.12.13, and adopt byte-buddy APIs changes.
+* Upgrade gson to 2.8.9.
+* Upgrade netty-codec-http2 to 4.1.79.Final.
 
 #### Documentation
 
diff --git a/apm-protocol/apm-network/pom.xml b/apm-protocol/apm-network/pom.xml
index 2ad06f6b0..0c76eb621 100644
--- a/apm-protocol/apm-network/pom.xml
+++ b/apm-protocol/apm-network/pom.xml
@@ -32,10 +32,30 @@
     </properties>
 
     <dependencies>
+        <dependency>
+            <groupId>io.netty</groupId>
+            <artifactId>netty-handler-proxy</artifactId>
+            <version>${netty.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>io.netty</groupId>
+            <artifactId>netty-codec-http2</artifactId>
+            <version>${netty.version}</version>
+        </dependency>
         <dependency>
             <groupId>io.grpc</groupId>
             <artifactId>grpc-netty</artifactId>
             <version>${grpc.version}</version>
+            <exclusions>
+                <exclusion>
+                    <artifactId>netty-codec-http2</artifactId>
+                    <groupId>io.netty</groupId>
+                </exclusion>
+                <exclusion>
+                    <groupId>netty-handler-proxy</groupId>
+                    <artifactId>io.netty</artifactId>
+                </exclusion>
+            </exclusions>
         </dependency>
         <dependency>
             <groupId>io.grpc</groupId>
diff --git a/apm-sniffer/apm-agent-core/pom.xml b/apm-sniffer/apm-agent-core/pom.xml
index 134484613..d5db1d600 100644
--- a/apm-sniffer/apm-agent-core/pom.xml
+++ b/apm-sniffer/apm-agent-core/pom.xml
@@ -33,7 +33,7 @@
 
     <properties>
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
-        <guava.version>20.0</guava.version>
+        <guava.version>30.1.1-jre</guava.version>
         <wiremock.version>2.6.0</wiremock.version>
         <netty-tcnative-boringssl-static.version>2.0.7.Final</netty-tcnative-boringssl-static.version>
         <os-maven-plugin.version>1.4.1.Final</os-maven-plugin.version>
@@ -109,6 +109,10 @@
                     <artifactId>mockito-core</artifactId>
                     <groupId>org.mockito</groupId>
                 </exclusion>
+                <exclusion>
+                    <artifactId>netty-codec-http2</artifactId>
+                    <groupId>io.netty</groupId>
+                </exclusion>
             </exclusions>
             <scope>test</scope>
         </dependency>
diff --git a/dist-material/LICENSE b/dist-material/LICENSE
index 8eb4b6b11..f84d20b7d 100755
--- a/dist-material/LICENSE
+++ b/dist-material/LICENSE
@@ -217,10 +217,10 @@ The text of each license is the standard Apache 2.0 license.
 
     raphw (byte-buddy) 1.12.13: http://bytebuddy.net/ , Apache 2.0
     Google: grpc-java 1.44.0: https://github.com/grpc/grpc-java, Apache 2.0
-    Google: gson 2.8.6: https://github.com/google/gson , Apache 2.0
+    Google: gson 2.8.9: https://github.com/google/gson , Apache 2.0
     Google: proto-google-common-protos 2.0.1: https://github.com/googleapis/googleapis , Apache 2.0
     Google: jsr305 3.0.2: http://central.maven.org/maven2/com/google/code/findbugs/jsr305/3.0.0/jsr305-3.0.0.pom , Apache 2.0
-    netty 4.1.72: https://github.com/netty/netty/blob/4.1/LICENSE.txt, Apache 2.0
+    netty 4.1.79: https://github.com/netty/netty/blob/4.1/LICENSE.txt, Apache 2.0
 
 ========================================================================
 BSD licenses
diff --git a/pom.xml b/pom.xml
index 87d384cf8..3273392e3 100755
--- a/pom.xml
+++ b/pom.xml
@@ -88,7 +88,8 @@
         <!-- core lib dependency -->
         <bytebuddy.version>1.12.13</bytebuddy.version>
         <grpc.version>1.44.0</grpc.version>
-        <gson.version>2.8.6</gson.version>
+        <netty.version>4.1.79.Final</netty.version>
+        <gson.version>2.8.9</gson.version>
         <os-maven-plugin.version>1.6.2</os-maven-plugin.version>
         <protobuf-maven-plugin.version>0.6.1</protobuf-maven-plugin.version>
         <com.google.protobuf.protoc.version>3.17.3</com.google.protobuf.protoc.version>
diff --git a/test/e2e/base/pom.xml b/test/e2e/base/pom.xml
index 9581d8aed..9ae8d9e70 100644
--- a/test/e2e/base/pom.xml
+++ b/test/e2e/base/pom.xml
@@ -52,7 +52,7 @@
         <maven.compiler.target>${java.version}</maven.compiler.target>
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
         <spring.boot.version>2.2.5.RELEASE</spring.boot.version>
-        <guava.version>28.2-jre</guava.version>
+        <guava.version>30.1.1-jre</guava.version>
         <lombok.version>1.18.20</lombok.version>
     </properties>
 
diff --git a/test/plugin/pom.xml b/test/plugin/pom.xml
index b9df3c6bf..f0c965beb 100644
--- a/test/plugin/pom.xml
+++ b/test/plugin/pom.xml
@@ -42,8 +42,8 @@
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
 
         <junit.version>4.11</junit.version>
-        <guava.version>20.0</guava.version>
-        <gson.version>2.8.5</gson.version>
+        <guava.version>30.1.1-jre</guava.version>
+        <gson.version>2.8.9</gson.version>
         <lombok.version>1.18.20</lombok.version>
         <snakeyaml.version>1.24</snakeyaml.version>