Bump tika from 2.9.2 to 3.2.2 (opensearch-project#19125)

* Fix tika CVE

Signed-off-by: Prudhvi Godithi <[email protected]>

* Update CHANGELOG.md

Signed-off-by: Prudhvi Godithi <[email protected]>

* fix html parser

Signed-off-by: Prudhvi Godithi <[email protected]>

* fix html parser

Signed-off-by: Prudhvi Godithi <[email protected]>

* fix html parser

Signed-off-by: Prudhvi Godithi <[email protected]>

* Add license

Signed-off-by: Prudhvi Godithi <[email protected]>

* Add license

Signed-off-by: Prudhvi Godithi <[email protected]>

* Update checksums

Signed-off-by: Prudhvi Godithi <[email protected]>

* Update shas

Signed-off-by: Prudhvi Godithi <[email protected]>

* Add pdf box license

Signed-off-by: Prudhvi Godithi <[email protected]>

* Fix tests

Signed-off-by: Prudhvi Godithi <[email protected]>

* Update security fonts permission

Signed-off-by: Prudhvi Godithi <[email protected]>

* Add dummy fonts

Signed-off-by: Prudhvi Godithi <[email protected]>

* Upstream fetch

Signed-off-by: Prudhvi Godithi <[email protected]>

* Fix license check error

Signed-off-by: Prudhvi Godithi <[email protected]>

* Fix license check error

Signed-off-by: Prudhvi Godithi <[email protected]>

---------

Signed-off-by: Prudhvi Godithi <[email protected]>
Signed-off-by: Ankit Jain <[email protected]>

Author: prudhvigodithi

.gitattributes

@@ -10,5 +10,6 @@
 *.bcfks binary
 *.crt binary
 *.p12 binary
+*.ttf binary
 *.txt text=auto
 CHANGELOG.md merge=union

CHANGELOG.md

@@ -44,6 +44,8 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 - Bump `com.google.auth:google-auth-library-oauth2-http` from 1.37.1 to 1.38.0 ([#19144](https://github.com/opensearch-project/OpenSearch/pull/19144))
 - Bump `com.squareup.okio:okio` from 3.15.0 to 3.16.0 ([#19146](https://github.com/opensearch-project/OpenSearch/pull/19146))
 - Bump Slf4j from 1.7.36 to 2.0.17 ([#19136](https://github.com/opensearch-project/OpenSearch/pull/19136))
+- Bump `org.apache.tika` from 2.9.2 to 3.2.2 ([#19125](https://github.com/opensearch-project/OpenSearch/pull/19125))
+- Bump `org.apache.commons:commons-compress` from 1.26.1 to 1.28.0 ([#19125](https://github.com/opensearch-project/OpenSearch/pull/19125))
 
 ### Deprecated
 

distribution/tools/plugin-cli/build.gradle

@@ -81,5 +81,10 @@ thirdPartyAudit.ignoreMissingClasses(
   'org.tukaani.xz.XZOutputStream',
   'org.apache.commons.codec.digest.PureJavaCrc32C',
   'org.apache.commons.codec.digest.XXHash32',
-  'org.apache.commons.lang3.reflect.FieldUtils'
+  'org.apache.commons.lang3.reflect.FieldUtils',
+  'org.apache.commons.lang3.ArrayFill',
+  'org.apache.commons.lang3.ArrayUtils',
+  'org.apache.commons.lang3.StringUtils',
+  'org.apache.commons.lang3.SystemProperties',
+  'org.apache.commons.lang3.function.Suppliers'
 )

distribution/tools/plugin-cli/licenses/commons-compress-1.26.1.jar.sha1

@@ -0,0 +1 @@
+e482f2c7a88dac3c497e96aa420b6a769f59c8d7

distribution/tools/plugin-cli/licenses/commons-compress-1.28.0.jar.sha1

@@ -50,7 +50,7 @@ httpasyncclient   = "4.1.5"
 commonslogging    = "1.2"
 commonscodec      = "1.18.0"
 commonslang       = "3.18.0"
-commonscompress   = "1.26.1"
+commonscompress   = "1.28.0"
 commonsio         = "2.16.0"
 # plugin dependencies
 aws               = "2.30.31"

gradle/libs.versions.toml

@@ -38,8 +38,8 @@ opensearchplugin {
 }
 
 versions << [
-  'tika'  : '2.9.2',
-  'pdfbox': '2.0.31',
+  'tika'  : '3.2.2',
+  'pdfbox': '3.0.5',
   'poi'   : '5.4.1',
   'mime4j': '0.8.11'
 ]
@@ -75,10 +75,11 @@ dependencies {
 
   // external parser libraries
   // HTML
-  api 'org.ccil.cowan.tagsoup:tagsoup:1.2.1'
+  api 'org.jsoup:jsoup:1.20.1'
   // Adobe PDF
   api "org.apache.pdfbox:pdfbox:${versions.pdfbox}"
   api "org.apache.pdfbox:fontbox:${versions.pdfbox}"
+  api "org.apache.pdfbox:pdfbox-io:${versions.pdfbox}"
   api "org.apache.pdfbox:jempbox:1.8.17"
   api "commons-logging:commons-logging:${versions.commonslogging}"
   // OpenOffice
@@ -121,6 +122,7 @@ forbiddenPatterns {
   exclude '**/*.pdf'
   exclude '**/*.epub'
   exclude '**/*.vsdx'
+  exclude '**/*.ttf'
 }
 
 thirdPartyAudit {

plugins/ingest-attachment/build.gradle

@@ -0,0 +1,93 @@
+Copyright 2011 The Roboto Project Authors (https://github.com/googlefonts/roboto-classic)
+
+This Font Software is licensed under the SIL Open Font License, Version 1.1.
+This license is copied below, and is also available with a FAQ at:
+https://openfontlicense.org
+
+
+-----------------------------------------------------------
+SIL OPEN FONT LICENSE Version 1.1 - 26 February 2007
+-----------------------------------------------------------
+
+PREAMBLE
+The goals of the Open Font License (OFL) are to stimulate worldwide
+development of collaborative font projects, to support the font creation
+efforts of academic and linguistic communities, and to provide a free and
+open framework in which fonts may be shared and improved in partnership
+with others.
+
+The OFL allows the licensed fonts to be used, studied, modified and
+redistributed freely as long as they are not sold by themselves. The
+fonts, including any derivative works, can be bundled, embedded,
+redistributed and/or sold with any software provided that any reserved
+names are not used by derivative works. The fonts and derivatives,
+however, cannot be released under any other type of license. The
+requirement for fonts to remain under this license does not apply
+to any document created using the fonts or their derivatives.
+
+DEFINITIONS
+"Font Software" refers to the set of files released by the Copyright
+Holder(s) under this license and clearly marked as such. This may
+include source files, build scripts and documentation.
+
+"Reserved Font Name" refers to any names specified as such after the
+copyright statement(s).
+
+"Original Version" refers to the collection of Font Software components as
+distributed by the Copyright Holder(s).
+
+"Modified Version" refers to any derivative made by adding to, deleting,
+or substituting -- in part or in whole -- any of the components of the
+Original Version, by changing formats or by porting the Font Software to a
+new environment.
+
+"Author" refers to any designer, engineer, programmer, technical
+writer or other person who contributed to the Font Software.
+
+PERMISSION & CONDITIONS
+Permission is hereby granted, free of charge, to any person obtaining
+a copy of the Font Software, to use, study, copy, merge, embed, modify,
+redistribute, and sell modified and unmodified copies of the Font
+Software, subject to the following conditions:
+
+1) Neither the Font Software nor any of its individual components,
+in Original or Modified Versions, may be sold by itself.
+
+2) Original or Modified Versions of the Font Software may be bundled,
+redistributed and/or sold with any software, provided that each copy
+contains the above copyright notice and this license. These can be
+included either as stand-alone text files, human-readable headers or
+in the appropriate machine-readable metadata fields within text or
+binary files as long as those fields can be easily viewed by the user.
+
+3) No Modified Version of the Font Software may use the Reserved Font
+Name(s) unless explicit written permission is granted by the corresponding
+Copyright Holder. This restriction only applies to the primary font name as
+presented to the users.
+
+4) The name(s) of the Copyright Holder(s) or the Author(s) of the Font
+Software shall not be used to promote, endorse or advertise any
+Modified Version, except to acknowledge the contribution(s) of the
+Copyright Holder(s) and the Author(s) or with their explicit written
+permission.
+
+5) The Font Software, modified or unmodified, in part or in whole,
+must be distributed entirely under this license, and must not be
+distributed under any other license. The requirement for fonts to
+remain under this license does not apply to any document created
+using the Font Software.
+
+TERMINATION
+This license becomes null and void if any of the above conditions are
+not met.
+
+DISCLAIMER
+THE FONT SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTIES OF
+MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT
+OF COPYRIGHT, PATENT, TRADEMARK, OR OTHER RIGHT. IN NO EVENT SHALL THE
+COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY,
+INCLUDING ANY GENERAL, SPECIAL, INDIRECT, INCIDENTAL, OR CONSEQUENTIAL
+DAMAGES, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF THE USE OR INABILITY TO USE THE FONT SOFTWARE OR FROM
+OTHER DEALINGS IN THE FONT SOFTWARE.

plugins/ingest-attachment/licenses/Roboto-OFL.txt

@@ -0,0 +1 @@
+e482f2c7a88dac3c497e96aa420b6a769f59c8d7