T2.x hardening: replace javafaker in SecureStringUtils.generateRandomPassword with SecureRandom (drops snakeyaml 1.23-android, closes 16 CVEs)

[natechadwick-intsof]

Summary

Replace the one production-code use of com.github.javafaker.Faker (Faker.lorem().characters()) in SecureStringUtils.generateRandomPassword() with a direct SecureRandom call, and remove javafaker from perc-security-utils/pom.xml. javafaker:1.0.2 is the actual source of the 16 SnakeYAML CVEs attributed to the project; commons-beanutils:1.11.0 does not declare SnakeYAML in its pom.

Why

The original 16-CVE SnakeYAML bucket was tied to issue #91 ("EOL replace commons-beanutils 1.11.0 with commons-beanutils2 2.0.0"). #91 was closed as out-of-date — the 2.x line does not exist, and commons-beanutils 1.11.0 is the latest 1.x (released 2025-05-25, Java 8 compatible, bytecode v52).

Dep-tree shows the real SnakeYAML source:

[INFO] +- com.percussion:perc-security-utils:jar:8.1.8-SNAPSHOT:compile
[INFO] |  \- com.github.javafaker:javafaker:jar:1.0.2:compile
[INFO] |     \- org.yaml:snakeyaml:jar:android:1.23:compile

javafaker is stuck at 1.0.2 (Feb 2020), effectively unmaintained, and the only production use is one method that asks for "6-20 random alphanumeric chars with a few specials sprinkled in" — a job for SecureRandom, not a lorem-ipsum generator.

What changes

modules/perc-security-utils/.../SecureStringUtils.java

Replace the body of generateRandomPassword():

public static String generateRandomPassword() {
  Faker f = Faker.instance(getSecureRandom());
  char[] password = f.lorem().characters(6, 20, true, true).toCharArray();
  char[] special = new char[] {'@', '$', '%', '^', '&', '*'};
  for (int i = 0; i < f.random().nextInt(6); i++) {
    password[f.random().nextInt(password.length)] = special[f.random().nextInt(special.length)];
  }
  return new String(password);
}

with a SecureRandom-only implementation that preserves the semantics:

• 6-20 chars from [A-Za-z0-9]
• 0-5 of those positions overwritten with one of @$%^&*
• getSecureRandom() already exists on the same class (line 268)

The import com.github.javafaker.Faker is removed.

modules/perc-security-utils/pom.xml

Remove the javafaker <dependency> block. The class is no longer used in production. The two remaining test usages in projects/sitemanage and deliverytiersuite/delivery-tier-suite/metadata already declare javafaker at <scope>test</scope> in their own poms and keep working.

Out of scope

• The test usages of javafaker in projects/sitemanage and deliverytiersuite/delivery-tier-suite/metadata are scoped test and are not pulled into the production classpath. Leave alone.
• snakeyaml:2.6 from liquibase-core (via perc-shared-app) is already the latest and is unrelated to the 16 CVEs.

Verification

• ./mvn-env.sh clean install -DskipTests -pl modules/perc-security-utils -am -B succeeds.
• ./mvn-env.sh dependency:tree -pl modules/perc-security-utils -Dincludes=org.yaml:snakeyaml shows snakeyaml:1.23-android is gone. snakeyaml:2.6 may remain (from a different transitive, not our concern).
• ./mvn-env.sh dependency:tree -pl modules/perc-security-utils -Dincludes=com.github.javafaker shows javafaker is gone.
• The existing unit test TestSecureStringUtils.testRandomPassword still passes (it only checks the result is non-null).
• ./mvn-env.sh test -pl modules/perc-security-utils (with tests enabled) passes.

References

• Parent epic: [epic] Mitigations for 117 GAVs that cannot be upgraded on Java 1.8 (closes 504 CVEs) #73
• Original (closed-as-out-of-date) issue: deps: EOL replace commons-beanutils 1.11.0 with commons-beanutils2 2.0.0 (closes 3 CVEs + drops transitive SnakeYAML 16 CVEs) #91
• javafaker on Maven Central: https://search.maven.org/artifact/com.github.javafaker/javafaker — last release 1.0.2 (2020-02-10)
• SnakeYAML CVE history: 1.23 is the EOL line; the 2.x line is the maintained successor (already in the tree from liquibase-core)

Co-Authored by Mavis v1.0.0 using minimax-m3 with agent mavis.

[natechadwick-intsof]

Fixed via #99 (PR opened, awaiting merge). javafaker is gone from the production classpath in perc-security-utils. SecureStringUtils.generateRandomPassword() now uses SecureRandom directly. snakeyaml:1.23-android (the source of 16 CVEs) is no longer pulled in. The two test-only usages of javafaker in sitemanage and metadata already declare it at <scope>test</scope> in their own poms and keep working unchanged.