Merge pull request #7587 from eugene7646/APriestman-8251_take6

Log4J upgrade (8251)

Core/build.xml

@@ -185,7 +185,13 @@
         <copy file="${thirdparty.dir}/LICENSE-2.0.txt" todir="${ext.dir}" />        
         <!-- fetch all the dependencies from Ivy and stick them in the right places -->
         <ivy:resolve log="quiet"/>
+	    
+        <!-- Make a report that lists out the dependencies that our JARs have -->	
+        <ivy:report todir='${basedir}/build/ivy-reports' graph='true' xml='false'/>
         <ivy:retrieve conf="core" pattern="${ext.dir}/[artifact]-[revision](-[classifier]).[ext]" />
+	    
+	<!-- ZooKeeper is currently (Jan 2022) pulling down Log4J 1. Delete it so that we use only v2 -->
+        <delete file="${basedir}/release/modules/ext/log4j-1.2.16.jar"/>
     </target>
 
     <target name="init" depends="get-deps,harness.init"/>

Core/nbproject/project.properties

@@ -88,7 +88,6 @@ file.reference.jxmapviewer2-2.4.jar=release\\modules\\ext\\jxmapviewer2-2.4.jar
 file.reference.jython-standalone-2.7.0.jar=release\\modules\\ext\\jython-standalone-2.7.0.jar
 file.reference.libphonenumber-3.5.jar=release\\modules\\ext\\libphonenumber-3.5.jar
 file.reference.listenablefuture-9999.0-empty-to-avoid-conflict-with-guava.jar=release\\modules\\ext\\listenablefuture-9999.0-empty-to-avoid-conflict-with-guava.jar
-file.reference.log4j-1.2.16.jar=release\\modules\\ext\\log4j-1.2.16.jar
 file.reference.mchange-commons-java-0.2.9.jar=release\\modules\\ext\\mchange-commons-java-0.2.9.jar
 file.reference.metadata-extractor-2.11.0.jar=release\\modules\\ext\\metadata-extractor-2.11.0.jar
 file.reference.mockito-core-3.5.7.jar=release\\modules\\ext\\mockito-core-3.5.7.jar

Core/nbproject/project.xml

@@ -633,10 +633,6 @@
                 <runtime-relative-path>ext/commons-lang3-3.5.jar</runtime-relative-path>
                 <binary-origin>release\modules\ext\commons-lang3-3.5.jar</binary-origin>
             </class-path-extension>
-            <class-path-extension>
-                <runtime-relative-path>ext/log4j-1.2.16.jar</runtime-relative-path>
-                <binary-origin>release\modules\ext\log4j-1.2.16.jar</binary-origin>
-            </class-path-extension>
             <class-path-extension>
                 <runtime-relative-path>ext/commons-logging-1.2.jar</runtime-relative-path>
                 <binary-origin>release\modules\ext\commons-logging-1.2.jar</binary-origin>

CoreLibs/build.xml

@@ -37,7 +37,13 @@
     <target name="get-deps" description="retrieve dependencies using ivy" depends="init-ivy,build-native-libs,get-thirdparty-dependencies">
         <ivy:settings file="ivysettings.xml" />
         <ivy:resolve log="quiet"/>
-        <ivy:retrieve pattern="${basedir}/release/modules/ext/[artifact]-[revision](-[classifier]).[ext]" />    
+        
+        <!-- Make a report that lists out the dependencies that our JARs have -->	
+        <ivy:report todir='${basedir}/build/ivy-reports' graph='true' xml='false'/>
+        <ivy:retrieve pattern="${basedir}/release/modules/ext/[artifact]-[revision](-[classifier]).[ext]" />
+        
+        <!-- sigar and commons-logging are currently (Jan 2022) pulling down Log4J 1. Delete it so that we use only v2 -->
+        <delete file="${basedir}/release/modules/ext/log4j-1.2.17.jar"/>
     </target>
     
     <target name="init" depends="get-deps,harness.init"/>

CoreLibs/ivy.xml

@@ -29,7 +29,10 @@
         <dependency conf="autopsy_core->*" org="commons-lang" name="commons-lang" rev="2.6"/> 
         <dependency conf="autopsy_core->*" org="commons-logging" name="commons-logging" rev="1.1.2"/>
         <dependency conf="autopsy_core->*" org="commons-io" name="commons-io" rev="2.5"/>
-        <dependency conf="autopsy_core->*" org="log4j" name="log4j" rev="1.2.17"/>
+	<!-- Prevent log4j 2.17.2 from bringing in its many optional dependencies -->
+	<dependency conf="autopsy_core->*" org="org.osgi" name="osgi.core" rev="8.0.0"/>
+	<dependency conf="autopsy_core->*" org="org.apache.logging.log4j" name="log4j-api" rev="2.17.2" transitive="false"/>
+        <dependency conf="autopsy_core->*" org="org.apache.logging.log4j" name="log4j-core" rev="2.17.2" transitive="false"/>
         <!-- <dependency conf="autopsy_core->*" org="org.jdom" name="jdom" rev="1.1.3"/> -->
         <dependency conf="autopsy_core->*" org="org.apache.poi" name="poi-excelant" rev="4.0.1"/>
         <dependency conf="autopsy_core->*" org="org.apache.poi" name="poi-scratchpad" rev="4.0.1"/>

CoreLibs/nbproject/project.properties

@@ -1,4 +1,3 @@
-file.reference.activation-1.1.jar=release/modules/ext/activation-1.1.jar
 file.reference.ant-1.8.2.jar=release/modules/ext/ant-1.8.2.jar
 file.reference.ant-launcher-1.8.2.jar=release/modules/ext/ant-launcher-1.8.2.jar
 file.reference.AppleJavaExtensions-1.4.jar=release/modules/ext/AppleJavaExtensions-1.4.jar
@@ -18,7 +17,6 @@ file.reference.commons-logging-1.1.2.jar=release/modules/ext/commons-logging-1.1
 file.reference.compiler-0.9.1.jar=release/modules/ext/compiler-0.9.1.jar
 file.reference.controlsfx-8.40.11.jar=release/modules/ext/controlsfx-8.40.11.jar
 file.reference.dom4j-1.6.1.jar=release/modules/ext/dom4j-1.6.1.jar
-file.reference.geronimo-jms_1.1_spec-1.0.jar=release/modules/ext/geronimo-jms_1.1_spec-1.0.jar
 file.reference.gson-2.8.5.jar=release/modules/ext/gson-2.8.5.jar
 file.reference.gst1-java-core-1.0.0.jar=release\\modules\\ext\\gst1-java-core-1.0.0.jar
 file.reference.guava-19.0.jar=release/modules/ext/guava-19.0.jar
@@ -37,7 +35,6 @@ file.reference.imageio-tga-3.2.jar=release/modules/ext/imageio-tga-3.2.jar
 file.reference.imageio-thumbsdb-3.2.jar=release/modules/ext/imageio-thumbsdb-3.2.jar
 file.reference.imageio-tiff-3.2.jar=release/modules/ext/imageio-tiff-3.2.jar
 file.reference.imgscalr-lib-4.2.jar=release/modules/ext/imgscalr-lib-4.2.jar
-file.reference.javaee-api-5.0-2.jar=release/modules/ext/javaee-api-5.0-2.jar
 file.reference.javassist-3.12.1.GA.jar=release/modules/ext/javassist-3.12.1.GA.jar
 file.reference.jfxtras-common-8.0-r4.jar=release/modules/ext/jfxtras-common-8.0-r4.jar
 file.reference.jfxtras-controls-8.0-r4.jar=release/modules/ext/jfxtras-controls-8.0-r4.jar
@@ -47,9 +44,8 @@ file.reference.jna-platform-5.11.0.jar=release/modules/ext/jna-platform-5.11.0.j
 file.reference.joda-time-2.4.jar=release/modules/ext/joda-time-2.4.jar
 file.reference.jsr305-1.3.9.jar=release/modules/ext/jsr305-1.3.9.jar
 file.reference.LGoodDatePicker-10.3.1.jar=release/modules/ext/LGoodDatePicker-10.3.1.jar
-file.reference.log4j-1.2.17.jar=release/modules/ext/log4j-1.2.17.jar
+file.reference.log4j-core-2.17.2.jar=release/modules/ext/log4j-core-2.17.2.jar
 file.reference.logkit-1.0.1.jar=release/modules/ext/logkit-1.0.1.jar
-file.reference.mail-1.4.3.jar=release/modules/ext/mail-1.4.3.jar
 file.reference.opencv-248.jar=release/modules/ext/opencv-248.jar
 file.reference.openjfx-dialogs-1.0.2.jar=release/modules/ext/openjfx-dialogs-1.0.3.jar
 file.reference.poi-4.0.1.jar=release\\modules\\ext\\poi-4.0.1.jar

CoreLibs/nbproject/project.xml

@@ -838,10 +838,6 @@
                 <runtime-relative-path>ext/xmlbeans-3.0.2.jar</runtime-relative-path>
                 <binary-origin>release/modules/ext/xmlbeans-3.0.2.jar</binary-origin>
             </class-path-extension>
-            <class-path-extension>
-                <runtime-relative-path>ext/mail-1.4.3.jar</runtime-relative-path>
-                <binary-origin>release/modules/ext/mail-1.4.3.jar</binary-origin>
-            </class-path-extension>
             <class-path-extension>
                 <runtime-relative-path>ext/imageio-tga-3.2.jar</runtime-relative-path>
                 <binary-origin>release/modules/ext/imageio-tga-3.2.jar</binary-origin>
@@ -854,10 +850,6 @@
                 <runtime-relative-path>ext/slf4j-api-1.6.1.jar</runtime-relative-path>
                 <binary-origin>release/modules/ext/slf4j-api-1.6.1.jar</binary-origin>
             </class-path-extension>
-            <class-path-extension>
-                <runtime-relative-path>ext/activation-1.1.jar</runtime-relative-path>
-                <binary-origin>release/modules/ext/activation-1.1.jar</binary-origin>
-            </class-path-extension>
             <class-path-extension>
                 <runtime-relative-path>ext/poi-scratchpad-4.0.1.jar</runtime-relative-path>
                 <binary-origin>release\modules\ext\poi-scratchpad-4.0.1.jar</binary-origin>
@@ -883,8 +875,8 @@
                 <binary-origin>release/modules/ext/imageio-pcx-3.2.jar</binary-origin>
             </class-path-extension>
             <class-path-extension>
-                <runtime-relative-path>ext/log4j-1.2.17.jar</runtime-relative-path>
-                <binary-origin>release/modules/ext/log4j-1.2.17.jar</binary-origin>
+                <runtime-relative-path>ext/log4j-core-2.17.2.jar</runtime-relative-path>
+                <binary-origin>release/modules/ext/log4j-core-2.17.2.jar</binary-origin>
             </class-path-extension>
             <class-path-extension>
                 <runtime-relative-path>ext/avalon-framework-4.1.5.jar</runtime-relative-path>
@@ -906,10 +898,6 @@
                 <runtime-relative-path>ext/imageio-sgi-3.2.jar</runtime-relative-path>
                 <binary-origin>release/modules/ext/imageio-sgi-3.2.jar</binary-origin>
             </class-path-extension>
-            <class-path-extension>
-                <runtime-relative-path>ext/geronimo-jms_1.1_spec-1.0.jar</runtime-relative-path>
-                <binary-origin>release/modules/ext/geronimo-jms_1.1_spec-1.0.jar</binary-origin>
-            </class-path-extension>
             <class-path-extension>
                 <runtime-relative-path>ext/jfxtras-fxml-8.0-r4.jar</runtime-relative-path>
                 <binary-origin>release/modules/ext/jfxtras-fxml-8.0-r4.jar</binary-origin>
@@ -990,10 +978,6 @@
                 <runtime-relative-path>ext/controlsfx-8.40.11.jar</runtime-relative-path>
                 <binary-origin>release/modules/ext/controlsfx-8.40.11.jar</binary-origin>
             </class-path-extension>
-            <class-path-extension>
-                <runtime-relative-path>ext/javaee-api-5.0-2.jar</runtime-relative-path>
-                <binary-origin>release/modules/ext/javaee-api-5.0-2.jar</binary-origin>
-            </class-path-extension>
             <class-path-extension>
                 <runtime-relative-path>ext/common-image-3.2.jar</runtime-relative-path>
                 <binary-origin>release/modules/ext/common-image-3.2.jar</binary-origin>

KeywordSearch/ivy.xml

@@ -43,9 +43,9 @@
         <dependency conf="servlet->default" org="org.eclipse.jetty.orbit" name="javax.servlet" rev="3.0.0.v201112011016"/>
 
         <!-- logging -->
-        <dependency conf="slf4j-libs->default" org="org.slf4j" name="slf4j-log4j12" rev="1.7.10"/>
-        <dependency conf="slf4j-libs->default" org="org.slf4j" name="jcl-over-slf4j" rev="1.7.10"/>
-        <dependency conf="slf4j-libs->default" org="org.slf4j" name="jul-to-slf4j" rev="1.7.10"/>
+        <dependency conf="slf4j-libs->default" org="org.slf4j" name="slf4j-log4j12" rev="1.7.36"/>
+        <dependency conf="slf4j-libs->default" org="org.slf4j" name="jcl-over-slf4j" rev="1.7.36"/>
+        <dependency conf="slf4j-libs->default" org="org.slf4j" name="jul-to-slf4j" rev="1.7.36"/> 
         
         <!-- Remnants of a past Tika dependency. These jars were being exported from Tika, which has since 
              moved into it's own NBM. For sake of backwards compatibility, these are still provided. -->

KeywordSearch/nbproject/project.properties

@@ -30,7 +30,6 @@ file.reference.json-simple-1.1.1.jar=release/modules/ext/json-simple-1.1.1.jar
 file.reference.juniversalchardet-1.0.3.jar=release/modules/ext/juniversalchardet-1.0.3.jar
 file.reference.language-detector-0.6.jar=release\\modules\\ext\\language-detector-0.6.jar
 file.reference.libsvm-3.1.jar=release/modules/ext/libsvm-3.1.jar
-file.reference.log4j-1.2.17.jar=release/modules/ext/log4j-1.2.17.jar
 file.reference.lucene-core-4.0.0.jar=release/modules/ext/lucene-core-4.0.0.jar
 file.reference.lucene-queries-4.0.0.jar=release/modules/ext/lucene-queries-4.0.0.jar
 file.reference.lucene-sandbox-4.0.0.jar=release/modules/ext/lucene-sandbox-4.0.0.jar