Using external dependencies - xstream

[Edwardiv1]

Why is xstream being used? Couldn't Java's native XML libraries be used instead?

[ctmay4]

I'm sure it could have been done in many other ways. XStream just make it easy. Why is using XStream an issue?

[Edwardiv1]

XStream is an issue because it's yet another unnecessary dependency/library to include and it has several vulnerabilities identified at https://mvnrepository.com/artifact/com.thoughtworks.xstream/xstream/1.4.20

[ctmay4]

I was behind a version on xstream and will update that and release. All those vulnerabilities have either been rejected by NIST or are going through more analysis..

These 2 are rejected:

https://nvd.nist.gov/vuln/detail/CVE-2022-40153
https://nvd.nist.gov/vuln/detail/CVE-2022-40156

The rest are all undergoing more analysis.

https://nvd.nist.gov/vuln/detail/CVE-2022-40152
https://nvd.nist.gov/vuln/detail/CVE-2022-40150
https://nvd.nist.gov/vuln/detail/CVE-2022-40149

While I agree that it would be better to not bring this dependency into play, I have no plans to remove it. The application that was the reason we wrote this library also uses XStream so removing it would not change anything on our side.

If you feel strongly, we would accept a pull request which removed XStream. Sorry, but we not have the time to work on this.

[ctmay4]

When I release through Sonotype is does scanning for vulnerabilities. I just released and it reported no threats.

https://sbom.lift.sonatype.com/report/T1-a0368c8f29fdaa555824-63e5ddd3ab0d16-1675173783-574543b070124c93836522abf28e41d7

[Edwardiv1]

I understand. Thanks for replying and for the x12 parser.