fix(security): T2.x.2 hardening: drop test-scope javafaker (fully removes snakeyaml 1.x) (issue #100) - #101
Open
natechadwick-intsof wants to merge 1 commit into
Open
Conversation
…oves snakeyaml 1.x) (issue #100) PR #99 removed javafaker from production (modules/perc-security-utils), but two test files still declared javafaker at <scope>test</scope> in their own poms, which kept org.yaml:snakeyaml:1.23-android reachable on the test classpath. This slice removes those final javafaker usages so the project dep graph has no snakeyaml:1.x left at any scope. Replaces: - PSDefaultPasswordEncryptionBeanTest: faker.aquaTeenHungerForce().character().toString() with a UUID-based random string. Test only checks password round-trip, content is irrelevant. - PSMetadataQueryServiceTest: faker.chuckNorris().fact(), faker.hitchhikersGuideToTheGalaxy() .quote(), faker.animal().name() (x4) with per-entry deterministic strings ("linktext-{idx}", "abstract-{idx}", "cat-{idx}-a/b/c/d"). Tests assert on counts and structure, not on the specific text. Removes the javafaker <dependency> blocks from: - projects/sitemanage/pom.xml - deliverytiersuite/delivery-tier-suite/metadata/pom.xml Verified: - dependency:tree -pl projects/sitemanage,metadata,perc-security-utils -Dincludes=org.yaml:snakeyaml,com.github.javafaker All three modules return either empty (no snakeyaml at all) or snakeyaml:2.6 only. javafaker is gone everywhere. - ./mvn-env.sh test -pl projects/sitemanage -Dtest=PSDefaultPasswordEncryptionBeanTest -> 1 run, 0 failures. - ./mvn-env.sh test-compile -pl deliverytiersuite/delivery-tier-suite/metadata -> BUILD SUCCESS (the metadata test class is a JUnit 3 TestCase hybrid; same pre-existing surefire behavior on main, not a regression from this slice). After this merge, the next Dependabot re-scan will not see snakeyaml:1.23-android in the dep graph at any scope, so the 8 alerts (#102-#109) dismissed in the prior slice will not resurrect. > Co-Authored by Mavis v1.0.0 using minimax-m3 with agent mavis.
natechadwick
approved these changes
Aug 29, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
PR #99 removed javafaker from production code, but two test files still declared
javafakerat<scope>test</scope>in their own poms, keepingorg.yaml:snakeyaml:1.23-androidreachable on the test classpath. This slice removes those final javafaker usages, so the project dep graph has nosnakeyaml:1.xleft at any scope.Changes
projects/sitemanage/.../PSDefaultPasswordEncryptionBeanTest.javaFaker.aquaTeenHungerForce().character()→UUID.randomUUID()deliverytiersuite/delivery-tier-suite/metadata/.../PSMetadataQueryServiceTest.javaFaker.chuckNorris().fact()/Faker.hitchhikersGuideToTheGalaxy().quote()/Faker.animal().name()(×4) → per-entry deterministic strings ("linktext-{idx}","abstract-{idx}","cat-{idx}-a/b/c/d")projects/sitemanage/pom.xmlcom.github.javafaker:javafaker:1.0.2(test-scope)deliverytiersuite/delivery-tier-suite/metadata/pom.xmlcom.github.javafaker:javafaker:1.0.2(test-scope)Verification
./mvn-env.sh dependency:tree -pl projects/sitemanage,deliverytiersuite/delivery-tier-suite/metadata,modules/perc-security-utils -Dincludes=org.yaml:snakeyaml,com.github.javafakerjavafakergone everywhere.snakeyaml:1.23-androidgone everywhere. Onlysnakeyaml:2.6remains in sitemanage (runtime) and metadata (compile), fromliquibase-core— already past the patched versions for all 8 CVEs../mvn-env.sh test -pl projects/sitemanage -Dtest=PSDefaultPasswordEncryptionBeanTest./mvn-env.sh test-compile -pl deliverytiersuite/delivery-tier-suite/metadataTestCasehybrid; pre-existing surefire behavior onmain, not a regression)Why the determinism upgrade matters
The original
Fakercalls produced non-deterministic data on every test run (random character name, random animal, etc.). The replacement uses the existingentryIdxcounter, so test runs are now reproducible. If a future failure is traced to "the abstract field had value X," X is now stable.Closing the loop
After this merges, the next Dependabot re-scan of
origin/mainwill not seesnakeyaml:1.23-androidin the dep graph at any scope. The 8 alerts (#102-#109) dismissed in the prior slice will not resurrect on re-scan, and the 16 CVEs in the analysis report (parent epic #73) are durably closed.Closes #100.