Apache commons-text security issues

[Mirza Hadžič]

Hello,

note that commons-text 1.9 used in gwt-user is having security issues,
so please upgrade this library to newer version if possible. This jar is
used by net.sourceforge.htmlunit library.

Cheers,

Mirza

[Colin Alworth]

Thanks for calling this out - however, the gwt-user dependency should never be on your runtime classpath, but only used when you compile/test/debug code for your project, so the scope her is limited.

Oddly, the non-maven build of GWT doesn't appear to include commons-text, I wonder if that is an oversight of the ant build, or if the dependency can simply be excluded.

I've filed https://github.com/gwtproject/gwt/issues/10370 to track this.

[Leon Pennings]

Hi Mirza,

this is not a production jar as Colin pointed out. 

So if you are using the owasp plugin to find these, you can safely add this library to the owasp exclusions list - or setup you plugin/project so that you only scan libraries used in your deployable product. 

rg,

Leon.