fix(security): T2.x hardening: drop javafaker in SecureStringUtils (closes 16 SnakeYAML CVEs) (issue #98) - #99
Merged
Conversation
…loses 16 SnakeYAML CVEs) (issue #98) The transitive snakeyaml:1.23-android dep that the analysis flagged with 16 CVEs comes from com.github.javafaker:javafaker:1.0.2 (stuck at that version since Feb 2020). It is NOT from commons-beanutils (issue #91 was closed as out-of-date -- commons-beanutils 1.11.0 is the latest 1.x and does not declare SnakeYAML). The single production use of javafaker is SecureStringUtils.generateRandomPassword(), which asked for "6-20 random alphanumeric chars with 0-5 special-char substitutions." That is a direct fit for SecureRandom. Rewrote the method body and removed javafaker from modules/perc-security-utils/pom.xml. The two remaining javafaker usages (PSDefaultPasswordEncryptionBeanTest in sitemanage, PSMetadataQueryServiceTest in metadata) are already <scope>test</scope> in their own poms and continue to work unchanged. Verified: - ./mvn-env.sh clean install -DskipTests -pl modules/perc-security-utils -am BUILD SUCCESS - dependency:tree -pl modules/perc-security-utils -Dincludes=org.yaml:snakeyaml,com.github.javafaker returns empty (both deps are gone from the production classpath) - TestSecureStringUtils (14 tests, 0 failures, 1 skipped) passes - PSDefaultPasswordEncryptionBeanTest (1 test, 0 failures) passes - PSMetadataQueryServiceTest (compiles and runs) passes Closes 16 CVEs in the analysis report that were attributed to snakeyaml:1.23-android. > Co-Authored by Mavis v1.0.0 using minimax-m3 with agent mavis.
natechadwick
approved these changes
Aug 29, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The 16 SnakeYAML CVEs in the analysis report (parent epic #73) come from the transitive
org.yaml:snakeyaml:1.23-androiddep thatcom.github.javafaker:javafaker:1.0.2pulls in.commons-beanutils:1.11.0does NOT declare SnakeYAML (issue #91 was closed as out-of-date).javafakeris stuck at 1.0.2 (Feb 2020), effectively unmaintained.The single production use of
javafakerisSecureStringUtils.generateRandomPassword(), which asks for "6-20 random alphanumeric chars with 0-5 special-char substitutions." That is a direct fit forSecureRandom. Rewrote the method body and removedjavafakerfrommodules/perc-security-utils/pom.xml.Changes
SecureStringUtils.generateRandomPassword()now usesSecureRandomdirectly via the existinggetSecureRandom()helper on the same class. Semantics preserved:Faker.lorem().characters(6, 20, true, true))[A-Za-z0-9]@$%^&*com.github.javafaker.Fakerimport removed.javafaker<dependency>block removed frommodules/perc-security-utils/pom.xml.What still uses javafaker (and is fine)
The two test classes that use
new Faker()directly already declarejavafakerat<scope>test</scope>in their own poms and are unaffected:projects/sitemanage/.../PSDefaultPasswordEncryptionBeanTest.java(usesfaker.aquaTeenHungerForce().character())deliverytiersuite/delivery-tier-suite/metadata/.../PSMetadataQueryServiceTest.java(usesfakerfor test fixture data)Verification
./mvn-env.sh clean install -DskipTests -pl modules/perc-security-utils -am -B→ BUILD SUCCESS./mvn-env.sh dependency:tree -pl modules/perc-security-utils -Dincludes=org.yaml:snakeyaml,com.github.javafaker→ empty (both deps removed from the production classpath)./mvn-env.sh test -pl modules/perc-security-utils -Dtest=TestSecureStringUtils→ 14 run, 0 failures, 0 errors, 1 skipped./mvn-env.sh test -pl projects/sitemanage -Dtest=PSDefaultPasswordEncryptionBeanTest→ 1 run, 0 failures./mvn-env.sh test -pl deliverytiersuite/delivery-tier-suite/metadata -Dtest=PSMetadataQueryServiceTest→ passes (javafaker still works in test scope)CVEs closed
16 CVEs in the analysis report (the SnakeYAML bucket) — see the categorization in
docs/ai-generated/tasks/PR#-DependencyVulnerabilityAnalysis/categorized-final.json.Closes #98.