Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Upgrade uses of Jena to 5.3.0 #6704

Merged
merged 4 commits into from
Feb 12, 2025
Merged

Conversation

krauzer
Copy link
Contributor

@krauzer krauzer commented Feb 12, 2025

Hello,

This PR upgrades uses of Apache Jena to 5.3.0 for RDF writing and reading. This resolves #6302.

The main issue is that Jena removed the uses of reader and writer in their read and write methods in version 5, so I modified the utility method to check for StringReader and InputStreamReader on read, and building a OutputStream out of the passed writer. Those readers were the types I could infer that were coming in from HAPI for RDF. Jena only handles a couple types anyway.

Below are the more specific changes I made to accommodate the use of the latest version, as well as removing some unmaintained testing dependencies for RDF.

If there are any adjustments/changes I should make, let me know and I can try to make them. We plan to use HAPI within CMS, where I work, and we'd like to be able to contribute to the code where we can/when needed, such as resolving security issues.

Changes:

-fixes CVE-2024-7254 in dependencies prior to 5.2.0
-hapi-fhir-base: include httpclient dependency which was removed from jena-arq
-hapi-fhir-base RDFParser: init JenaSystem on initialization
-hapi-fhir-base RDFParser: specify signature for null values on methods that are overloaded
-hapi-fhir-base RDFUtil: Jena Riot RDFDataMgr no longer accepts reading and writing into generic reader and writer. Handle reading for StringReader and InputStreamReader. Handle writing by building an output stream from the writer.
-hapi-fhir-structures-r4: Remove shexjava dependency - unmaintained
-hapi-fhir-structures-r4: Use jena-shex for shex validation
-hapi-fhir-structures-r4 RDFParserTest: use jena libraries - compatibile with jena-shex
-hapi-fhir-structures-r4 RDFParserTest: simplify FixedShapeMapEntry by attaching nodes vs recreating them (handles blank nodes)
-hapi-fhir-structures-r4 RDFParserR4Test: jena 5.0.0 defaults to using PREFIX, not @Prefix. Read testing strings and use isomorphic comparison to check for equality. Added extra assertion to test isomorphism check.

-fixes CVE-2024-7254 in dependencies prior to 5.2.0
-hapi-fhir-base: include httpclient dependency which was removed from jena-arq
-hapi-fhir-base RDFParser: init JenaSystem on initialization
-hapi-fhir-base RDFParser: specify signature for null values on methods that are overloaded
-hapi-fhir-base RDFUtil: Jena Riot RDFDataMgr no longer accepts reading and writing
into generic reader and writer. Handle reading for StringReader and InputStreamReader.
Handle writing by building an output stream from the writer.
-hapi-fhir-structures-r4: Remove shexjava dependency - unmaintained
-hapi-fhir-structures-r4: Use jena-shex for shex validation
-hapi-fhir-structures-r4 RDFParserTest: use jena libraries - compatibile with jena-shex
-hapi-fhir-structures-r4 RDFParserTest: simplify FixedShapeMapEntry by attaching nodes vs recreating them (handles blank nodes)
-hapi-fhir-structures-r4 RDFParserR4Test: jena 5.0.0 defaults to using PREFIX, not @Prefix. Read testing strings and
use isomorphic comparison to check for equality. Added extra assertion to test isomorphism check.
Copy link

codecov bot commented Feb 12, 2025

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 83.48%. Comparing base (46d5809) to head (5f61d35).
Report is 10 commits behind head on master.

Additional details and impacted files
@@             Coverage Diff              @@
##             master    #6704      +/-   ##
============================================
- Coverage     83.50%   83.48%   -0.03%     
+ Complexity    28566    28562       -4     
============================================
  Files          1797     1797              
  Lines        111166   111184      +18     
  Branches      13965    13967       +2     
============================================
- Hits          92828    92818      -10     
- Misses        12351    12375      +24     
- Partials       5987     5991       +4     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

Copy link
Collaborator

@jamesagnew jamesagnew left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the contribution!

@jamesagnew jamesagnew merged commit c9889a9 into hapifhir:master Feb 12, 2025
61 of 62 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

CVE-2024-7254 (High) detected in protobuf-java-3.23.3.jar, protobuf-java-4.26.1.jar
2 participants