Update commons-fileupload version due to multiple CVEs

[manderson23]

Multiple CVEs are published against commons-fileupload 1.3.1.

• https://nvd.nist.gov/vuln/detail/CVE-2016-1000031
• https://nvd.nist.gov/vuln/detail/CVE-2016-3092

These have both been resolved in commons-fileupload 1.3.3

[nrouge]

I just made a pull request that removes this library, not really necessary since Servlet 3.0.

[cgarrit-os]

@nrouge

The pull request that removes commons-fileupload results in issues for those of us using spring-boot-starter.

The issue first manifests as an initialization error since org.apache.commons.io is no longer being pulled into the project via the graphql-java-servlet package. Once this is resolved, we receive the following when posting via the graphiql interface.

java.lang.IllegalStateException: Unable to process parts as no multi-part configuration has been provided.

GET requests still work. Please advise.

[oliemansm]

@cgarrit-os

I ran into this issue as well. I figured out that you need to set the MultipartConfig when creating the ServletRegistrationBean in the spring boot starter like below. This requires additional configuration, which would have to be added to the library as properties as well.

@Bean
ServletRegistrationBean<GraphQLServlet> graphQLServletRegistrationBean(GraphQLServlet servlet) {
    ServletRegistrationBean<GraphQLServlet> graphqlServletRegistrationBean = new ServletRegistrationBean<>(servlet, graphQLServletProperties.getServletMapping());
    graphqlServletRegistrationBean.setMultipartConfig(new MultipartConfigElement(""));
    return graphqlServletRegistrationBean;
}

However, with this change you run into the next issue, which is that it starts complaining that the enctype is incorrect. Apparently now it's expecting every request to contain an upload instead of supporting both use cases. That's because GraphQLServlet assumes it's a multipart request instead of actually checking that.

This requires changes in both libraries. I've got it working locally now, I'll add it later.

[marceloverdijk]

Thx @oliemansm for the investigation. For now probably the best option is to depend on graphql-java-servlet v5.0.1.

[oliemansm]

This is fixed now in the latest version just released to central.