[ARCHETYPE-568] Remove dom4j library

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 3.1.0
• Fix Version/s: 3.1.1
• Assignee: Tibor Digana
• Reporter: Tibor Digana
• Created: 07/Jun/19 11:20
• Updated: 05/Apr/20 15:00
• Resolved: 07/Jun/19 11:39

Description

Due to the vulnerable to CVE-2018-1000632 in dom4j:1.6.1, we are removing the library and we use Java XML API instead.

The vulnerable to CVE-2018-1000632 is fixed in dom4j:2.1.1 at Java 1.8 which breaks the current bytecode version 1.7 in this project.

Improved code is very small. Originally the code was duplicated twice. We made a refactoring and new code with Java API has no duplicates. Particular unit tests were improved using xmlunit-matchers.

Issue Links

• breaks: ARCHETYPE-584 Resulting root pom.xml from archetype generation has additional newlines with JDK11
• causes: ARCHETYPE-587 Multi-modules Archetypes' Root POM file contains empty lines in Java 11
• links to: GH pull request