[Crawler] Bump httpclient5 to 5.5.1 to resolve CVE-2025-8671 (httpcore5-h2 HTTP/2 DoS)

Jarfile

@@ -13,7 +13,9 @@ jar 'com.github.crawler-commons:crawler-commons', '1.2'
 jar 'commons-io:commons-io', '2.16.1'
 
 # Apache HTTP client used for requests to websites
-jar 'org.apache.httpcomponents.client5:httpclient5', '5.1'
+# Pinned to 5.5.1+ to pull in httpcore5/httpcore5-h2 5.3.6, resolving CVE-2025-8671
+# (HTTP/2 stream-reset DoS in httpcore5-h2 < 5.3.5)
+jar 'org.apache.httpcomponents.client5:httpclient5', '5.5.1'
 
 # For managing Brotli input streams
 jar 'org.apache.commons:commons-compress', '1.27.1'

Jars.lock

@@ -10,11 +10,11 @@ xml-apis:xml-apis:1.4.01:compile:
 com.github.crawler-commons:crawler-commons:1.2:compile:
 org.slf4j:slf4j-api:1.7.7:compile:
 commons-io:commons-io:2.16.1:compile:
-org.apache.httpcomponents.client5:httpclient5:5.1:compile:
-org.apache.httpcomponents.core5:httpcore5:5.1.1:compile:
-org.apache.httpcomponents.core5:httpcore5-h2:5.1.1:compile:
-commons-codec:commons-codec:1.15:compile:
+org.apache.httpcomponents.client5:httpclient5:5.5.1:compile:
+org.apache.httpcomponents.core5:httpcore5:5.3.6:compile:
+org.apache.httpcomponents.core5:httpcore5-h2:5.3.6:compile:
 org.apache.commons:commons-compress:1.27.1:compile:
+commons-codec:commons-codec:1.17.1:compile:
 org.apache.commons:commons-lang3:3.16.0:compile:
 org.brotli:dec:0.1.2:compile:
 org.jsoup:jsoup:1.20.1:compile:

lib/crawler/http_utils/filtering_dns_resolver.rb

@@ -11,6 +11,7 @@
 module Crawler
   module HttpUtils
     class FilteringDnsResolver
+      java_import java.net.InetSocketAddress
       java_import org.apache.hc.client5.http.DnsResolver
       java_import org.apache.hc.client5.http.SystemDefaultDnsResolver
 
@@ -25,9 +26,29 @@ def initialize(loopback_allowed:, private_networks_allowed:, logger:)
         @logger = logger
       end
 
-      def resolve(host)
+      # Implements both overloads of the httpcore DnsResolver interface:
+      #   * resolve(String)           -> InetAddress[]
+      #   * resolve(String, int port) -> List<InetSocketAddress>
+      # httpclient5 5.3+ invokes the two-argument variant from the connection
+      # manager, so we must accept the optional port and return socket addresses
+      # in that case while still applying our private-address filtering.
+      def resolve(host, port = nil)
         resolved_addresses = default_resolver.resolve(host)
-        remove_private_addresses(host, resolved_addresses)
+        filtered_addresses = remove_private_addresses(host, resolved_addresses)
+
+        if port.nil?
+          # resolve(String) must return an InetAddress[]
+          filtered_addresses.to_java(java.net.InetAddress)
+        else
+          # resolve(String, int) must return a List<InetSocketAddress>
+          socket_addresses = java.util.ArrayList.new
+          filtered_addresses.each { |address| socket_addresses.add(InetSocketAddress.new(address, port)) }
+          socket_addresses
+        end
+      end
+
+      def resolve_canonical_hostname(host)
+        default_resolver.resolve_canonical_hostname(host)
       end
 
       def loopback_allowed?

spec/lib/crawler/http_client_spec.rb

@@ -29,10 +29,20 @@
   let(:site_server) { Faux::Site.new(site, site_server_settings) }
 
   #-------------------------------------------------------------------------------------------------
-  # Stubs DNS resolution in HTTP client to always return localhost IPs
+  # Stubs DNS resolution in HTTP client to always return localhost IPs.
+  # Mirrors both overloads of the httpcore DnsResolver interface:
+  #   * resolve(String)           -> InetAddress[]
+  #   * resolve(String, int port) -> List<InetSocketAddress>
   def stub_http_resolver!
-    allow_any_instance_of(Crawler::HttpUtils::FilteringDnsResolver).to receive(:resolve) do |resolver, _host|
-      resolver.default_resolver.resolve('localhost')
+    allow_any_instance_of(Crawler::HttpUtils::FilteringDnsResolver).to receive(:resolve) do |resolver, _host, port|
+      resolved_addresses = resolver.default_resolver.resolve('localhost')
+      if port.nil?
+        resolved_addresses
+      else
+        socket_addresses = java.util.ArrayList.new
+        resolved_addresses.each { |address| socket_addresses.add(java.net.InetSocketAddress.new(address, port)) }
+        socket_addresses
+      end
     end
   end