[PLUTO-794] Downgrade to hibernate-validator-5.4.3.Final and validation-api-1.1.0.Final in order to conform to Java EE 7

• Type: Task
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 3.1.1
• Component/s: build system, demo portlets, maven archetypes
• Assignee: Neil Griffin (Inactive)
• Reporter: Neil Griffin (Inactive)
• Created: 17/Dec/21 01:24
• Updated: 17/Dec/21 15:38
• Resolved: 17/Dec/21 15:38

Description

Section 1.8 of the Portlet 3.0 Specification titled "Relationship to Java Enterprise Edition" states:

The Portlet API v3.0 is based on the Java Standard Edition 7.0 and Java Enterprise Edition v7.0. Portlet containers should at least meet the requirements described by the Java EE 7.0 specification for executing in a Java EE environment.

Pluto 3.x implements the Portlet 3.0 API and targets Java EE 7, which includes the CDI 1.2 API and the Bean Validation 1.1 API. . As such, it relies on JBoss Weld 2.3.1.Final (which implements the CDI 1.2 API).

When trying to upgrade to hibernate-validator-6.0.20.Final via PLUTO-791, the attached stacktrace.txt started happening when trying to onblur out of the "Postal Code" field of the applicant-mvcbean-cdi-jsp-portlet demo. This revealed that hibernate-validator-6.0.20.Final was attempting to call the javax.enterprise.inject.spi.BeanManager.createInstance() method, which the Javadoc indicates was introduced in CDI 2.0 (Java EE 8).

Upon closer examination, the Hibernate Validator Releases page states that version 6.0 targets Bean Validation 2.0, which explains why the Hibernate Validator implementation of the Bean Validation API would be permitted to call version 2.0 method signatures in the CDI API such as the aforementioned BeanManager.createInstance().

The Hibernate Validator FAQ page states that Hibernate Validator 5.x is the reference implementation of Bean Validation 1.1 (JSR 349). In addition, the project's main pom.xml descriptor corroborates the FAQ. Therefore, in order to be compatible with CDI 1.2 and Bean Validation 1.1 (Java EE 7), it is necessary to downgrade to the newest version of Hibernate Validator 5.x (which is hibernate-validator-5.4.3.Final at the time of this writing) and validation-api-1.1.0.Final

This task involves downgrading from the following dependency versions:

pom.xml (before)

<dependency>
	<groupId>javax.validation</groupId>
	<artifactId>validation-api</artifactId>
	<version>2.0.1.Final</version>
	<scope>provided</scope>
</dependency>
<dependency>
	<groupId>org.hibernate</groupId>
	<artifactId>hibernate-validator</artifactId>
	<version>6.0.14.Final</version>
	<exclusions>
		<exclusion>
			<groupId>javax.validation</groupId>
			<artifactId>validation-api</artifactId>
		</exclusion>
	</exclusions>
</dependency>
<dependency>
	<groupId>org.hibernate</groupId>
	<artifactId>hibernate-validator-cdi</artifactId>
	<version>6.0.14.Final</version>
</dependency>

pom.xml (after)

<dependency>
	<groupId>javax.validation</groupId>
	<artifactId>validation-api</artifactId>
	<version>1.1.0.Final</version>
	<scope>provided</scope>
</dependency>
<dependency>
	<groupId>org.hibernate</groupId>
	<artifactId>hibernate-validator</artifactId>
	<version>5.4.3.Final</version>
	<exclusions>
		<exclusion>
			<groupId>javax.validation</groupId>
			<artifactId>validation-api</artifactId>
		</exclusion>
	</exclusions>
</dependency>
<dependency>
	<groupId>org.hibernate</groupId>
	<artifactId>hibernate-validator-cdi</artifactId>
	<version>5.4.3.Final</version>
</dependency>

In addition, since the demo and archetypes use Bean Validation 2.0 annotations such as:

• @javax.validation.constraints.NotBlank
• @javax.validation.constraints.Email
• @javax.validation.constraints.Positive

... it will be necessary to use their Bean Validation 1.2 counterparts, which are vendor-specific to Hibernate Validator:

• @org.hibernate.validator.constraints.NotBlank
• @org.hibernate.validator.constraints.Email
• @org.hibernate.validator.constraints.Range

Issue Links

• relates to: PLUTO-791 Upgrade to hibernate-validator-6.0.20.Final due to CVE-2020-10693 and CVE-2019-10219