Some Eclipse Foundation services are deprecated, or will be soon. Please ensure you've read this important communication.

Bug 542478

Summary: Upgrade org.apache.commons.fileupload to latest version (1.3.3)
Product: [RT] RAP Reporter: Georg Breitschopf <georg.breitschopf>
Component: OtherAssignee: Project Inbox <rap-inbox>
Status: RESOLVED MOVED QA Contact:
Severity: normal    
Priority: P3 CC: mknauer
Version: 3.7   
Target Milestone: ---   
Hardware: All   
OS: All   
URL: https://github.com/eclipse-rap/org.eclipse.rap/issues/41
Whiteboard: github

Description Georg Breitschopf CLA 2018-12-06 10:49:46 EST 
The result of a dependency check of our application (which is based on Eclipse RAP) showed a vulnerability in org.apache.commons.fileupload_1.3.2 with high severity and high confidence (CVE-2016-1000031). Therefore, I would like to request an upgrade of org.apache.commons.fileupload to the latest version (1.3.3) in RAP 3.7.
Comment 1 Ivan Furnadjiev CLA 2018-12-11 06:29:59 EST 
RAP (org.eclipse.rap.fileupload bundle) is not using DiskFileItem. We are processing the input streem directly using FileItemStream (see FileUploadProcessor#handleFileUpload). That's why I believe that we are not affected by the above vulnerability. Nevertheless, once the updated org.apache.commons.fileupload 1.3.3 is available in Eclipse Orbit we will include it in RAP runtime.
Comment 2 Ivan Furnadjiev CLA 2019-01-22 04:16:33 EST 
As of now the latest version of Apache Commons FileUpload is 1.4. The Orbit version is still on 1.3.2.
Comment 3 Ivan Furnadjiev CLA 2019-01-22 06:59:18 EST 
More info about the issue and the "fix" from Apache Commons FileUpload Security report. Now I'm confident that it does not affect RAP.

[1] https://commons.apache.org/proper/commons-fileupload/security-reports.html
Comment 4 Georg Breitschopf CLA 2019-01-22 08:42:44 EST 
Thank you for further analysis and clarification.
Comment 5 Markus Knauer CLA 2022-08-03 11:51:34 EDT 
Because we switched to GitHub with the RAP version 3.21 that includes the implementation for this issue, and because we'd like to have all release relevant tickets in one place, I am copying the basic details to GitHub issues https://github.com/eclipse-rap/org.eclipse.rap/issues/41. Any kind of future enhancement should be discussed there.