From aaa07115ba06a1e5995f40d1632ee827fad61829 Mon Sep 17 00:00:00 2001
From: Michael Jumper <mjumper@apache.org>
Date: Fri, 2 Apr 2021 21:18:21 -0700
Subject: [PATCH] GUACAMOLE-773: Add exclusions as necessary to force correct
 dependency versions. Remove exclusions that are no longer necessary.

---
 extensions/guacamole-auth-cas/pom.xml    |  6 -----
 extensions/guacamole-auth-ldap/pom.xml   |  6 -----
 extensions/guacamole-auth-openid/pom.xml |  6 -----
 extensions/guacamole-auth-radius/pom.xml | 18 ++++++++++-----
 extensions/guacamole-auth-saml/pom.xml   | 15 +++++++++++--
 guacamole/pom.xml                        | 28 +++++++++++++++---------
 pom.xml                                  | 10 +++++++++
 7 files changed, 53 insertions(+), 36 deletions(-)

diff --git a/extensions/guacamole-auth-cas/pom.xml b/extensions/guacamole-auth-cas/pom.xml
index d5191fad3..a40c0fb31 100644
--- a/extensions/guacamole-auth-cas/pom.xml
+++ b/extensions/guacamole-auth-cas/pom.xml
@@ -52,12 +52,6 @@
             <groupId>org.jasig.cas.client</groupId>
             <artifactId>cas-client-core</artifactId>
             <version>3.6.2</version>
-            <exclusions>
-                <exclusion>
-                    <groupId>org.slf4j</groupId>
-                    <artifactId>slf4j-api</artifactId>
-                </exclusion>
-            </exclusions>
         </dependency>
         
         <!-- Guava - Utility Library -->
diff --git a/extensions/guacamole-auth-ldap/pom.xml b/extensions/guacamole-auth-ldap/pom.xml
index aa241ed14..fa9d8a215 100644
--- a/extensions/guacamole-auth-ldap/pom.xml
+++ b/extensions/guacamole-auth-ldap/pom.xml
@@ -52,12 +52,6 @@
             <groupId>org.apache.directory.api</groupId>
             <artifactId>api-all</artifactId>
             <version>2.0.1</version>
-            <exclusions>
-                <exclusion>
-                    <groupId>org.slf4j</groupId>
-                    <artifactId>slf4j-api</artifactId>
-                </exclusion>
-            </exclusions>
         </dependency>
 
         <!-- Guice -->
diff --git a/extensions/guacamole-auth-openid/pom.xml b/extensions/guacamole-auth-openid/pom.xml
index 2920ef204..7c578dc1f 100644
--- a/extensions/guacamole-auth-openid/pom.xml
+++ b/extensions/guacamole-auth-openid/pom.xml
@@ -103,12 +103,6 @@
             <groupId>org.bitbucket.b_c</groupId>
             <artifactId>jose4j</artifactId>
             <version>0.7.6</version>
-            <exclusions>
-                <exclusion>
-                    <groupId>org.slf4j</groupId>
-                    <artifactId>slf4j-api</artifactId>
-                </exclusion>
-            </exclusions>
         </dependency>
 
         <!-- Guice -->
diff --git a/extensions/guacamole-auth-radius/pom.xml b/extensions/guacamole-auth-radius/pom.xml
index dbed7af44..f4bc18ec9 100644
--- a/extensions/guacamole-auth-radius/pom.xml
+++ b/extensions/guacamole-auth-radius/pom.xml
@@ -146,14 +146,15 @@
             <version>1.1.5</version>
             <exclusions>
 
-                <exclusion>
-                    <groupId>org.slf4j</groupId>
-                    <artifactId>slf4j-api</artifactId>
-                </exclusion>
+                <!-- Force consistent versions of Apache Commons libraries (see below) -->
                 <exclusion>
                     <groupId>commons-logging</groupId>
                     <artifactId>commons-logging</artifactId>
                 </exclusion>
+                <exclusion>
+                    <groupId>commons-collections</groupId>
+                    <artifactId>commons-collections</artifactId>
+                </exclusion>
 
                 <!-- Rely on Guacamole's existing use of logback rather than log4j -->
                 <exclusion>
@@ -182,13 +183,18 @@
             <version>1.1.5</version>
         </dependency>
 
-        <!-- Force single, specific version commons-logging (multiple
-            dependencies reference multiple versions of this). -->
+        <!-- Force single, specific versions of Apache Commons libraries
+            (multiple dependencies reference multiple versions of these). -->
         <dependency>
             <groupId>commons-logging</groupId>
             <artifactId>commons-logging</artifactId>
             <version>1.1.1</version>
         </dependency>
+        <dependency>
+            <groupId>commons-collections</groupId>
+            <artifactId>commons-collections</artifactId>
+            <version>3.2</version>
+        </dependency>
 
     </dependencies>
 
diff --git a/extensions/guacamole-auth-saml/pom.xml b/extensions/guacamole-auth-saml/pom.xml
index d1ab3092e..ed550e448 100644
--- a/extensions/guacamole-auth-saml/pom.xml
+++ b/extensions/guacamole-auth-saml/pom.xml
@@ -75,13 +75,24 @@
             <artifactId>java-saml</artifactId>
             <version>2.6.0</version>
             <exclusions>
+
+                <!-- Force consistent version of commons-codec (see below) -->
                 <exclusion>
-                    <groupId>org.slf4j</groupId>
-                    <artifactId>slf4j-api</artifactId>
+                    <groupId>commons-codec</groupId>
+                    <artifactId>commons-codec</artifactId>
                 </exclusion>
+
             </exclusions>
         </dependency>
 
+        <!-- Force single, specific version of commons-codec (multiple
+            dependencies reference multiple versions of this). -->
+        <dependency>
+            <groupId>commons-codec</groupId>
+            <artifactId>commons-codec</artifactId>
+            <version>1.15</version>
+        </dependency>
+
     </dependencies>
 
 </project>
diff --git a/guacamole/pom.xml b/guacamole/pom.xml
index cb30ba899..ba108b1c1 100644
--- a/guacamole/pom.xml
+++ b/guacamole/pom.xml
@@ -436,23 +436,31 @@
             <artifactId>jersey-media-json-jackson</artifactId>
             <exclusions>
 
-                <!-- Use newer 1.2.2 version required by Jakarta JAXB, rather
-                than 1.2.1 version specified by Jackson -->
+                <!-- Use newer 2.12.2 version required by Guacamole, rather
+                than 2.11.3 version required by Jersey (see below) -->
                 <exclusion>
-                    <groupId>jakarta.activation</groupId>
-                    <artifactId>jakarta.activation-api</artifactId>
+                    <groupId>com.fasterxml.jackson.core</groupId>
+                    <artifactId>jackson-core</artifactId>
                 </exclusion>
-
-                <!-- Use newer 2.3.3 version required by Jersey, rather than
-                2.3.2 version specified by Jackson -->
                 <exclusion>
-                    <groupId>jakarta.xml.bind</groupId>
-                    <artifactId>jakarta.xml.bind-api</artifactId>
+                    <groupId>com.fasterxml.jackson.module</groupId>
+                    <artifactId>jackson-module-jaxb-annotations</artifactId>
                 </exclusion>
 
             </exclusions>
         </dependency>
-        
+
+        <!-- Force newer version of Jackson, rather than slightly older version
+            specified by Jersey -->
+        <dependency>
+            <groupId>com.fasterxml.jackson.core</groupId>
+            <artifactId>jackson-core</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>com.fasterxml.jackson.module</groupId>
+            <artifactId>jackson-module-jaxb-annotations</artifactId>
+        </dependency>
+
         <!-- JSR-250 annotations -->
         <dependency>
             <groupId>javax.annotation</groupId>
diff --git a/pom.xml b/pom.xml
index 8548b8414..d67ef17be 100644
--- a/pom.xml
+++ b/pom.xml
@@ -331,11 +331,21 @@
                 <artifactId>jackson-annotations</artifactId>
                 <version>${jackson.version}</version>
             </dependency>
+            <dependency>
+                <groupId>com.fasterxml.jackson.core</groupId>
+                <artifactId>jackson-core</artifactId>
+                <version>${jackson.version}</version>
+            </dependency>
             <dependency>
                 <groupId>com.fasterxml.jackson.core</groupId>
                 <artifactId>jackson-databind</artifactId>
                 <version>${jackson.version}</version>
             </dependency>
+            <dependency>
+                <groupId>com.fasterxml.jackson.module</groupId>
+                <artifactId>jackson-module-jaxb-annotations</artifactId>
+                <version>${jackson.version}</version>
+            </dependency>
 
             <!-- Logging -->
             <dependency>