Deprecate usage of javax.mail package

[Tomáš Hanus]

There is javax.mail dependency which was marked as vulnerable. For what this dependency is used? It is useful?

            <dependency>
                <groupId>com.nimbusds</groupId>
                <artifactId>oauth2-oidc-sdk</artifactId>
                <version>4.17</version>
            </dependency>

[Connect2id OSS]

Hi Thomas,

It's apparently used to represent Content-Type headers and email addresses:

$ grep javax.mail -R src/main/
src/main/java/com/nimbusds/openid/connect/sdk/UserInfoSuccessResponse.java:import javax.mail.internet.ContentType;
src/main/java/com/nimbusds/openid/connect/sdk/claims/ClaimsSet.java:import javax.mail.internet.InternetAddress;
src/main/java/com/nimbusds/openid/connect/sdk/claims/UserInfo.java:import javax.mail.internet.InternetAddress;
src/main/java/com/nimbusds/oauth2/sdk/auth/ClientSecretPost.java:import javax.mail.internet.ContentType;
src/main/java/com/nimbusds/oauth2/sdk/auth/JWTAuthentication.java:import javax.mail.internet.ContentType;
src/main/java/com/nimbusds/oauth2/sdk/http/DefaultResourceRetriever.java:import javax.mail.internet.ContentType;
src/main/java/com/nimbusds/oauth2/sdk/http/DefaultResourceRetriever.java:import javax.mail.internet.ParseException;
src/main/java/com/nimbusds/oauth2/sdk/http/Resource.java:import javax.mail.internet.ContentType;
src/main/java/com/nimbusds/oauth2/sdk/http/CommonContentTypes.java:import javax.mail.internet.ContentType;
src/main/java/com/nimbusds/oauth2/sdk/http/CommonContentTypes.java:import javax.mail.internet.ParameterList;
src/main/java/com/nimbusds/oauth2/sdk/http/HTTPMessage.java:import javax.mail.internet.ContentType;
src/main/java/com/nimbusds/oauth2/sdk/http/HTTPMessage.java:            } catch (javax.mail.internet.ParseException e) {
src/main/java/com/nimbusds/oauth2/sdk/http/HTTPMessage.java:            } catch (javax.mail.internet.ParseException e) {
src/main/java/com/nimbusds/oauth2/sdk/client/ClientMetadata.java:import javax.mail.internet.AddressException;
src/main/java/com/nimbusds/oauth2/sdk/client/ClientMetadata.java:import javax.mail.internet.InternetAddress;
src/main/java/com/nimbusds/oauth2/sdk/util/JSONObjectUtils.java:import javax.mail.internet.AddressException;
src/main/java/com/nimbusds/oauth2/sdk/util/JSONObjectUtils.java:import javax.mail.internet.InternetAddress;
src/main/java/com/nimbusds/oauth2/sdk/util/JSONObjectUtils.java:         * {@code javax.mail.internet.InternetAddress}.
src/main/java/com/nimbusds/oauth2/sdk/util/ContentTypeUtils.java:import javax.mail.internet.ContentType;

Is that a potential issue?

[Tomáš Hanus]

Probably no. Maybe we can use other lib?

[Vladimir Dzhuvinov]

Hi, I'm the core maintainer of the OIDC SDK.

I'm not aware of a suitable Java lib replacement for these two classes - for representing emails and content type headers.

One way around that is to deprecate the associated getters / setters in favor of simple string based ones, and mark javax.mail as optional dependency.

While the mail and content-type format checking can probably be replicated some way.

What is your take on this?

[Tomáš Hanus]

Hi,

maybe apacha.http.core or org.springframework.http. But I think that optional dependency is appropriate solution.

Thanks, Tomas

[Connect2id OSS]

Categorised as proposal to represent content types and email addresses as plain strings.

[Tomáš Hanus]

Ok, agree.

[Connect2id OSS]

The javax.mail CVE-2007-6059 vulnerability brought forward by reporter doesn't affect the SDK, but let's deprecate usage of this package.

[Connect2id OSS]

Deprecated use of javax.mail.internet.InternetAddress (commit 25a3273).

ContentType will need more work.

[Yavor Vasilev]

Issue #266 was marked as a duplicate of this issue.

[Tom Billiet]

This also breaks the usage of this library on android, since javax.mail is not usable there:

‌

Caused by: java.lang.ClassNotFoundException: Didn't find class "java.awt.datatransfer.Transferable" on path: 
  at java.lang.Class dalvik.system.BaseDexClassLoader.findClass(java.lang.String) (BaseDexClassLoader.java:134)
  at java.lang.Class java.lang.ClassLoader.loadClass(java.lang.String, boolean) (ClassLoader.java:379)
  at java.lang.Class java.lang.ClassLoader.loadClass(java.lang.String) (ClassLoader.java:312)
  at java.lang.String javax.mail.internet.MimeUtility.quote(java.lang.String, java.lang.String) (MimeUtility.java:1013)
  at java.lang.String javax.mail.internet.ParameterList.quote(java.lang.String) (ParameterList.java:772)
  at java.lang.String javax.mail.internet.ParameterList.toString(int) (ParameterList.java:719)
  at java.lang.String javax.mail.internet.ContentType.toString() (ContentType.java:229)
  at void com.nimbusds.oauth2.sdk.http.HTTPMessage.setContentType(javax.mail.internet.ContentType) (HTTPMessage.java:81)
  at void com.nimbusds.oauth2.sdk.http.HTTPRequest.setContentType(javax.mail.internet.ContentType) (HTTPRequest.java:69)
  at com.nimbusds.oauth2.sdk.http.HTTPRequest com.nimbusds.oauth2.sdk.TokenRequest.toHTTPRequest() (TokenRequest.java:429)

‌

[Yavor Vasilev]

bf171497 -> Makes com.sun.mail:javax.mail optional, use kept only in deprecated API calls that depend on it

[Connect2id OSS]

Released as part of v7.0 to Maven Central

[Yavor Vasilev]

Due to class loading issues javax.mail was restored as non-optional dep in 7.1.1, see issue #291. Will be completely removed in v8.0.

[Yavor Vasilev]

Removed javax.mail for 8.0: 63677d20