JCRVLT-702 Get rid of default locale/timezone/charset specific methods

Enable forbiddenapis in Maven build
apache · Jan 3, 2025 · 3720483 · 3720483
1 parent a2629fd
commit 3720483
Show file tree

Hide file tree

Showing 66 changed files with 318 additions and 141 deletions.
diff --git a/parent/pom.xml b/parent/pom.xml
@@ -59,6 +59,7 @@ Apache Jackrabbit FileVault is a project of the Apache Software Foundation.
         <!-- for embedded dependencies the newest version should be used -->
         <oak.max.version>1.52.0</oak.max.version>
         <slf4j.version>1.7.25</slf4j.version>
+        <commons-io.version>2.7</commons-io.version>
         <test.oak>true</test.oak> <!-- passed to integration test as property "oak", set to true to test with Oak, false means test with Jackrabbit 2 -->
         <bnd.version>6.4.0</bnd.version>
         <minimalMavenBuildVersion>3.6.1</minimalMavenBuildVersion><!-- due to https://issues.apache.org/jira/browse/MNG-6059 -->
@@ -365,6 +366,39 @@ Bundle-Category: jackrabbit
                     </execution>
                 </executions>
             </plugin>
+            <plugin>
+                <groupId>de.thetaphi</groupId>
+                <artifactId>forbiddenapis</artifactId>
+                <version>3.8</version>
+                <configuration>
+                    <!--
+                      if the used Java version is too new,
+                      don't fail, just do nothing:
+                    -->
+                    <failOnUnsupportedJava>false</failOnUnsupportedJava>
+                    <bundledSignatures>
+                        <!--
+                          This will automatically choose the right
+                          signatures based on 'maven.compiler.target':
+                        -->
+                        <bundledSignature>jdk-unsafe</bundledSignature>
+                        <bundledSignature>jdk-deprecated</bundledSignature>
+                        <!-- disallow undocumented classes like sun.misc.Unsafe: -->
+                        <bundledSignature>jdk-non-portable</bundledSignature>
+                        <!-- don't allow unsafe reflective access: -->
+                        <bundledSignature>jdk-reflection</bundledSignature>
+                        <bundledSignature>commons-io-unsafe-${commons-io.version}</bundledSignature>
+                    </bundledSignatures>
+                    <ignoreSignaturesOfMissingClasses>true</ignoreSignaturesOfMissingClasses>
+                </configuration>
+                <executions>
+                    <execution>
+                        <goals>
+                            <goal>check</goal>
+                        </goals>
+                    </execution>
+                </executions>
+            </plugin>
         </plugins>
 
     </build>
@@ -512,7 +546,7 @@ Bundle-Category: jackrabbit
             <dependency>
                 <groupId>commons-io</groupId>
                 <artifactId>commons-io</artifactId>
-                <version>2.7</version>
+                <version>${commons-io.version}</version>
             </dependency>
             <dependency>
                 <groupId>org.apache.commons</groupId>

diff --git a/vault-cli/src/main/java/org/apache/jackrabbit/vault/cli/AbstractCmdLs.java b/vault-cli/src/main/java/org/apache/jackrabbit/vault/cli/AbstractCmdLs.java
@@ -20,6 +20,7 @@
 import java.io.IOException;
 import java.text.SimpleDateFormat;
 import java.util.Date;
+import java.util.Locale;
 
 import org.apache.commons.cli2.CommandLine;
 import org.apache.commons.cli2.Option;
@@ -97,7 +98,7 @@ public static String formatSize(long size) {
     }
 
     public static String formatDate(long date) {
-        final SimpleDateFormat fmt = new SimpleDateFormat("yyyy-MM-dd HH:mm");
+        final SimpleDateFormat fmt = new SimpleDateFormat("yyyy-MM-dd HH:mm", Locale.ENGLISH);
         return date == 0 ? "" : fmt.format(new Date(date));
     }
 }
diff --git a/vault-cli/src/main/java/org/apache/jackrabbit/vault/cli/CmdCat.java b/vault-cli/src/main/java/org/apache/jackrabbit/vault/cli/CmdCat.java
@@ -18,6 +18,7 @@
 package org.apache.jackrabbit.vault.cli;
 
 import java.io.IOException;
+import java.util.Locale;
 
 import javax.jcr.RepositoryException;
 
@@ -52,7 +53,7 @@ protected void doExecute(VaultFsConsoleExecutionContext ctx, CommandLine cl) thr
                     file.getArtifact().spool(System.out);
                     System.out.flush();
                 } else {
-                    System.out.printf("Refusing to print contents of a '%s' file.%n", ct);
+                    System.out.printf(Locale.ENGLISH, "Refusing to print contents of a '%s' file.%n", ct);
                 }
             } catch (IOException e) {
                 throw new ExecutionException("Error while downloading file.",e);

diff --git a/vault-cli/src/main/java/org/apache/jackrabbit/vault/cli/CmdDebug.java b/vault-cli/src/main/java/org/apache/jackrabbit/vault/cli/CmdDebug.java
@@ -18,7 +18,9 @@
 package org.apache.jackrabbit.vault.cli;
 
 import java.io.File;
+import java.io.OutputStreamWriter;
 import java.io.PrintWriter;
+import java.nio.charset.StandardCharsets;
 import java.util.Collection;
 import java.util.List;
 
@@ -80,7 +82,7 @@ protected void doExecute(VaultFsConsoleExecutionContext ctx, CommandLine cl) thr
                 DefaultWorkspaceFilter r = new DefaultWorkspaceFilter();
                 try {
                     r.load(file);
-                    DumpContext dCtx = new DumpContext(new PrintWriter(System.out));
+                    DumpContext dCtx = new DumpContext(new PrintWriter(new OutputStreamWriter(System.out, StandardCharsets.US_ASCII)));
                     r.dump(dCtx, false);
                     dCtx.flush();
 

diff --git a/vault-cli/src/main/java/org/apache/jackrabbit/vault/cli/CmdDump.java b/vault-cli/src/main/java/org/apache/jackrabbit/vault/cli/CmdDump.java
@@ -19,7 +19,9 @@
 
 import java.io.File;
 import java.io.InputStream;
+import java.io.OutputStreamWriter;
 import java.io.PrintWriter;
+import java.nio.charset.StandardCharsets;
 import java.nio.file.Files;
 
 import org.apache.commons.cli2.Argument;
@@ -72,15 +74,15 @@ protected void doExecute(VaultFsConsoleExecutionContext ctx, CommandLine cl)
             } else {
                 Object f = ctx.getCurrentFile().getFile(path, false).unwrap();
                 if (f instanceof Dumpable) {
-                    DumpContext dCtx = new DumpContext(new PrintWriter(System.out));
+                    DumpContext dCtx = new DumpContext(new PrintWriter(new OutputStreamWriter(System.out, StandardCharsets.US_ASCII)));
                     ((Dumpable) f).dump(dCtx, true);
                     dCtx.flush();
                 } else {
                     VaultFsApp.log.info("Object not dumpable: {}", f);
                 }
             }
         } else {
-            fs.getAggregateManager().dumpConfig(new PrintWriter(System.out));
+            fs.getAggregateManager().dumpConfig(new PrintWriter(new OutputStreamWriter(System.out, StandardCharsets.US_ASCII)));
         }
     }
 

diff --git a/vault-cli/src/main/java/org/apache/jackrabbit/vault/cli/CmdExportCli.java b/vault-cli/src/main/java/org/apache/jackrabbit/vault/cli/CmdExportCli.java
@@ -20,6 +20,7 @@
 import java.io.File;
 import java.time.Instant;
 import java.time.format.DateTimeFormatter;
+import java.util.Locale;
 
 import org.apache.commons.cli2.Argument;
 import org.apache.commons.cli2.CommandLine;
@@ -44,7 +45,7 @@
  */
 public class CmdExportCli extends AbstractVaultCommand {
 
-    static final DateTimeFormatter FMT = DateTimeFormatter.ofPattern("yyyyMMddHHmmss");
+    static final DateTimeFormatter FMT = DateTimeFormatter.ofPattern("yyyyMMddHHmmss", Locale.ENGLISH);
 
     private Option optType;
     private Option optPrune;

diff --git a/vault-cli/src/main/java/org/apache/jackrabbit/vault/cli/CmdFormatCli.java b/vault-cli/src/main/java/org/apache/jackrabbit/vault/cli/CmdFormatCli.java
@@ -23,6 +23,7 @@
 import java.util.ArrayList;
 import java.util.LinkedList;
 import java.util.List;
+import java.util.Locale;
 import java.util.regex.Pattern;
 
 import org.apache.commons.cli2.CommandLine;
@@ -79,15 +80,15 @@ protected void doExecute(VaultFsApp app, CommandLine cl) throws Exception {
         for (File file: localFiles) {
             if (file.isDirectory()) {
                 if (verbose) {
-                    System.out.printf("traversing: %s%n", file);
+                    System.out.printf(Locale.ENGLISH, "traversing: %s%n", file);
                     for (Pattern p: parsedPatterns) {
-                        System.out.printf("scanning for files matching: %s%n", p);
+                        System.out.printf(Locale.ENGLISH, "scanning for files matching: %s%n", p);
                     }
                 }
                 formattedFiles.addAll(format.format(file, parsedPatterns, checkOnly));
             } else {
                 if (verbose) {
-                    System.out.printf("processing: %s%n", file);
+                    System.out.printf(Locale.ENGLISH, "processing: %s%n", file);
                 }
                 if (format.format(file, checkOnly)) {
                     formattedFiles.add(file.getPath());

diff --git a/vault-cli/src/main/java/org/apache/jackrabbit/vault/cli/CmdSync.java b/vault-cli/src/main/java/org/apache/jackrabbit/vault/cli/CmdSync.java
@@ -19,6 +19,7 @@
 
 import java.io.File;
 import java.util.List;
+import java.util.Locale;
 
 import org.apache.commons.cli2.Argument;
 import org.apache.commons.cli2.CommandLine;
@@ -116,7 +117,7 @@ public void validate(List list) throws InvalidArgumentException {
                     if (list.size() > 0) {
                         String cmd = list.get(0).toString();
                         try {
-                            list.set(0, Sync.Command.valueOf(cmd.toUpperCase()));
+                            list.set(0, Sync.Command.valueOf(cmd.toUpperCase(Locale.ROOT)));
                         } catch (IllegalArgumentException e) {
                             throw new InvalidArgumentException("Invalid command: " + cmd);
                         }

diff --git a/vault-cli/src/main/java/org/apache/jackrabbit/vault/cli/VaultFsApp.java b/vault-cli/src/main/java/org/apache/jackrabbit/vault/cli/VaultFsApp.java
@@ -21,6 +21,7 @@
 import java.io.IOException;
 import java.util.ArrayList;
 import java.util.List;
+import java.util.Locale;
 import java.util.Map;
 
 import javax.jcr.Credentials;
@@ -794,7 +795,7 @@ public Credentials getCredentials(RepositoryAddress mountpoint) {
                 try {
                     SimpleCredentials simpleCredentials = (SimpleCredentials) creds;
                     if (simpleCredentials.getPassword().length == 0) {
-                        System.out.printf("Please enter password for user %s connecting to %s: ",
+                        System.out.printf(Locale.ENGLISH, "Please enter password for user %s connecting to %s: ",
                                 simpleCredentials.getUserID(), mountpoint);
                         String password = new jline.ConsoleReader().readLine('*');
                         creds = new SimpleCredentials(simpleCredentials.getUserID(), password.toCharArray());

diff --git a/vault-cli/src/main/java/org/apache/jackrabbit/vault/util/console/AbstractApplication.java b/vault-cli/src/main/java/org/apache/jackrabbit/vault/util/console/AbstractApplication.java
@@ -20,7 +20,8 @@
 import java.io.FileInputStream;
 import java.io.FileOutputStream;
 import java.io.IOException;
-import java.time.LocalDate;
+import java.time.Instant;
+import java.time.temporal.ChronoField;
 import java.util.Iterator;
 import java.util.Properties;
 
@@ -80,7 +81,7 @@ public PomProperties getPomProperties() {
     }
 
     public String getCopyrightLine() {
-        return "copyright 2013-" + LocalDate.now().getYear() +" by Apache Software Foundation. See LICENSE.txt for more information.";
+        return "copyright 2013-" + Instant.now().get(ChronoField.YEAR) +" by Apache Software Foundation. See LICENSE.txt for more information.";
     }
 
     public String getVersionString() {

diff --git a/vault-cli/src/main/java/org/apache/jackrabbit/vault/util/console/platform/CmdLs.java b/vault-cli/src/main/java/org/apache/jackrabbit/vault/util/console/platform/CmdLs.java
@@ -20,6 +20,7 @@
 import java.io.IOException;
 import java.time.Instant;
 import java.time.format.DateTimeFormatter;
+import java.util.Locale;
 
 import org.apache.commons.cli2.CommandLine;
 import org.apache.commons.cli2.Option;
@@ -40,7 +41,7 @@
  */
 public class CmdLs extends AbstractConsoleCommand {
 
-    private static final DateTimeFormatter DATE_FMT = DateTimeFormatter.ofPattern("yyyy MMM dd HH:mm");
+    private static final DateTimeFormatter DATE_FMT = DateTimeFormatter.ofPattern("yyyy MMM dd HH:mm", Locale.ENGLISH);
 
     // format flags
     private static int F_FLAG_TIME = 0x01;

diff --git a/vault-core-it/pom.xml b/vault-core-it/pom.xml
@@ -67,6 +67,13 @@
                         <skip>true</skip>
                     </configuration>
                 </plugin>
+                <plugin>
+                    <groupId>de.thetaphi</groupId>
+                    <artifactId>forbiddenapis</artifactId>
+                    <configuration>
+                        <skip>true</skip>
+                    </configuration>
+                </plugin>
             </plugins>
         </pluginManagement>
     </build>

diff --git a/vault-core/pom.xml b/vault-core/pom.xml
@@ -133,6 +133,20 @@
                 <groupId>biz.aQute.bnd</groupId>
                 <artifactId>bnd-resolver-maven-plugin</artifactId>
             </plugin>
+            <plugin>
+                <groupId>de.thetaphi</groupId>
+                <artifactId>forbiddenapis</artifactId>
+                <configuration>
+                    <excludes>
+                        <!-- excluded embedded 3rd party libraries -->
+                        <exclude>com/ctc/wstx/**/*.class</exclude>
+                        <exclude>org/apache/jackrabbit/jcr2spi/**/*.class</exclude>
+                        <exclude>org/codehaus/stax/**/*.class</exclude>
+                        <exclude>org/codehaus/stax2/**/*.class</exclude>
+                        <exclude>org/h2/**/*.class</exclude>
+                    </excludes>
+                </configuration>
+            </plugin>
         </plugins>
     </build>
 

diff --git a/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/api/DumpContext.java b/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/api/DumpContext.java
@@ -19,6 +19,7 @@
 
 import java.io.PrintWriter;
 import java.util.LinkedList;
+import java.util.Locale;
 
 /**
  * {@code DumpHandler}...
@@ -46,7 +47,7 @@ public void println(boolean isLast, String str) {
     }
 
     public void printf(boolean isLast, String format, Object ... args) {
-        println(isLast, String.format(format, args));
+        println(isLast, String.format(Locale.ENGLISH, format, args));
     }
 
     public void indent(boolean isLast) {

diff --git a/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/config/ConfigHelper.java b/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/config/ConfigHelper.java
@@ -20,6 +20,7 @@
 import java.lang.reflect.InvocationTargetException;
 import java.lang.reflect.Method;
 import java.util.HashMap;
+import java.util.Locale;
 import java.util.Map;
 
 import org.slf4j.Logger;
@@ -125,7 +126,7 @@ public Object create(Element elem)
     }
 
     public static String getMethodName(String prefix, String name) {
-        return prefix + name.substring(0, 1).toUpperCase() + name.substring(1);
+        return prefix + name.substring(0, 1).toUpperCase(Locale.ROOT) + name.substring(1);
     }
 
     public static Method getMethod(Object obj, String name, Class ... params) {

diff --git a/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/config/DefaultWorkspaceFilter.java b/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/config/DefaultWorkspaceFilter.java
@@ -30,6 +30,7 @@
 import java.util.Iterator;
 import java.util.LinkedList;
 import java.util.List;
+import java.util.Locale;
 import java.util.Set;
 import java.util.TreeSet;
 
@@ -425,7 +426,7 @@ private void readDef(Element elem) throws ConfigurationException {
         String mode = elem.getAttribute("mode");
         if (mode != null && mode.length() > 0) {
             try {
-                ImportMode importMode = ImportMode.valueOf(mode.toUpperCase());
+                ImportMode importMode = ImportMode.valueOf(mode.toUpperCase(Locale.ROOT));
                 nodeFilters.setImportMode(importMode);
                 propFilters.setImportMode(importMode);
                 bothFilters.setImportMode(importMode);
@@ -531,7 +532,7 @@ private void generateSource() {
                 writer.writeStartElement("filter");
                 writer.writeAttribute("root", set.getRoot());
                 if (set.getImportMode() != ImportMode.REPLACE) {
-                    writer.writeAttribute("mode", set.getImportMode().name().toLowerCase());
+                    writer.writeAttribute("mode", set.getImportMode().name().toLowerCase(Locale.ROOT));
                 }
                 if (set.getType() != null) {
                     writer.writeAttribute("type", set.getType());

diff --git a/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/impl/io/CompressionUtil.java b/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/impl/io/CompressionUtil.java
@@ -22,6 +22,7 @@
 import java.io.InputStream;
 import java.util.Arrays;
 import java.util.HashSet;
+import java.util.Locale;
 import java.util.Set;
 import java.util.zip.Deflater;
 import java.util.zip.ZipEntry;
@@ -113,7 +114,7 @@ public static int isCompressible(@NotNull Artifact artifact) {
              */
             String contentType = artifact.getContentType();
             if (contentType != null) {
-                contentType = contentType.toLowerCase();
+                contentType = contentType.toLowerCase(Locale.ROOT);
                 if (isCompressibleContentType(contentType)) {
                     return 1;
                 }

diff --git a/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/impl/io/DocViewImporter.java b/vault-core/src/main/java/org/apache/jackrabbit/vault/fs/impl/io/DocViewImporter.java
@@ -19,6 +19,7 @@
 import java.io.IOException;
 import java.io.InputStream;
 import java.time.Duration;
+import java.time.ZoneOffset;
 import java.util.ArrayList;
 import java.util.Calendar;
 import java.util.Collection;
@@ -27,9 +28,11 @@
 import java.util.HashSet;
 import java.util.LinkedList;
 import java.util.List;
+import java.util.Locale;
 import java.util.Map;
 import java.util.Optional;
 import java.util.Set;
+import java.util.TimeZone;
 import java.util.UUID;
 
 import javax.jcr.ImportUUIDBehavior;
@@ -707,7 +710,7 @@ private void handleBinNode(Node node, BlobInfo info, boolean checkIfNtFileOk)
         }
         // always update last modified if binary was modified (bug #22969)
         if (!node.hasProperty(JcrConstants.JCR_LASTMODIFIED) || modified) {
-            Calendar lastModified = Calendar.getInstance();
+            Calendar lastModified = Calendar.getInstance(TimeZone.getTimeZone(ZoneOffset.UTC), Locale.ROOT);
             node.setProperty(JcrConstants.JCR_LASTMODIFIED, lastModified);
             modified = true;
         }