fix(security): close #140 — migrate constant-only commons-httpclient callers to org.apache.http (SEC-03)

[NSchatz]

Summary

Closes #140.

Migrates the three constant-only commons-httpclient 3.0.1 callers to the already-vendored org.apache.http (httpcore-4.4.13.jar / httpclient-4.5.13.jar). Per CONTEXT.md, commons-httpclient-3.0.1.jar STAYS on the classpath because WebDavConnection.java still depends on it at runtime (Apache Slide WebDAV). Full WebDAV migration is deferred to SEC-V2-01.

Changes

• server/src/com/mirth/connect/connectors/http/HttpReceiver.java line 75 — import swap. All HttpStatus.SC_* usage sites (lines 483, 485, 529, 550, 722, 815) byte-unchanged (constant names identical between 3.x and 4.x).
• server/src/com/mirth/connect/server/MirthWebServer.java line 43 — import swap. Usage sites (lines 927, 956, 960) byte-unchanged.
• server/src/com/mirth/connect/client/core/ConnectServiceUtil.java line 20 — import swap. Usage sites (lines 79, 115, 173, 224) byte-unchanged. (This file already imported other org.apache.http.* classes; the HttpStatus import was the lone remaining 3.x reference.)
• server/src/com/mirth/connect/connectors/file/filesystems/WebDavConnection.java — inline // TODO comment referencing SEC-V2-01 (Sardine migration deferred; Apache Slide HttpURL / HttpsURL runtime dependency).
• server/src/com/mirth/connect/server/userutil/HTTPUtil.java — inline // TODO comment referencing SEC-V2-01 companion (HttpParser.parseHeaders() rewrite deferred — no direct 4.x equivalent).
• SECURITY.md — appended a new "Known residual dependencies" section disclosing the residual commons-httpclient-3.0.1.jar on classpath.

Per RESEARCH.md, NO build.xml modification is required: the classpath is a glob <fileset dir="${lib}" includes="**/*.jar" /> — the jar stays on disk and resolves transitively.

Scope clarifications

• Three constant-only callers migrated (HttpReceiver, MirthWebServer, ConnectServiceUtil).
• WebDavConnection.java and HTTPUtil.java intentionally NOT migrated — both require behavior-level API rewrites and are deferred to SEC-V2-01 / SEC-V2-01 companion in the next milestone. Inline // TODO comments mark the deferral.
• commons-httpclient-3.0.1.jar retained on classpath at server/lib/commons/commons-httpclient-3.0.1.jar — required by WebDavConnection.java at runtime.
• server/build.xml not modified — the classpath is a glob (<fileset dir="${lib}" includes="**/*.jar" />); no individual jar entry exists to annotate. The two inline // TODO comments serve the discoverability intent.
• Residual CVE exposure disclosed in SECURITY.md under a new "Known residual dependencies" section.

Test plan

• Per-file gate grep: grep -n "org.apache.commons.httpclient" <three target files> returns ZERO matches.
• Each target file contains exactly one import org.apache.http.HttpStatus; line.
• find server/lib -name 'commons-httpclient-3.0.1.jar' | wc -l returns 1 (jar still on disk for WebDAV).
• Transitive scan: no other jar in server/lib bundles org/apache/commons/httpclient/ classes.
• Deferred files (WebDavConnection.java, HTTPUtil.java) still import from org.apache.commons.httpclient (intentional — runtime resolution preserved) and now carry an explicit // TODO referencing SEC-V2-01.
• ant -f server/build.xml compile — deferred to CI: ant/java not available in the executor's local environment. Compile validation falls back to GitHub Actions on push.
• ant -f server/build.xml test -Dtest=DigesterTest and -Dtest=DefaultUserControllerTest — deferred to CI (same reason).
• Runtime WebDAV smoke test (manual; described in .planning/phases/01-security-cluster/01-VALIDATION.md).
• Second-set-of-eyes review.

Residual risk disclosed

commons-httpclient-3.0.1.jar remains on classpath for the WebDAV WebDavConnection.java runtime dependency. CVE-2012-5783, CVE-2014-3577, and CVE-2015-5262 remain exposed in that code path until SEC-V2-01 lands. The migrated call sites (HttpReceiver, MirthWebServer, ConnectServiceUtil) are no longer exposed.

---

Local test verification (2026-05-13)

Ant 1.10.14 + OpenJDK 17.0.18.

• ant -f server/build.xml compile — BUILD SUCCESSFUL (48s)

• ant -f server/build.xml test-compile — BUILD SUCCESSFUL (20s)

• java org.junit.runner.JUnitCore on the four test classes that exercise the migrated files:

  • com.mirth.connect.server.MirthWebServerTest
  • com.mirth.connect.connectors.http.HttpReceiverTest
  • com.mirth.connect.connectors.http.HttpListenerRequestHeaderSizeTest
  • com.mirth.connect.connectors.http.HttpReceiverPropertiesTest

  Result: 107 of 108 tests pass in 7.7s.

  The single failure — MirthWebServerTest.testContextPathNormalizationHandlesEmpty (expected /, was empty string) — is pre-existing on bridgelink_development: rerunning the same test on trunk (bridgelink_development HEAD afcfa7160) produces the identical failure. Unrelated to the commons-httpclient import migration.

• Production-code grep gate: grep -n "org.apache.commons.httpclient" server/src/com/mirth/connect/connectors/http/HttpReceiver.java server/src/com/mirth/connect/server/MirthWebServer.java server/src/com/mirth/connect/client/core/ConnectServiceUtil.java returns zero matches. Each target file imports org.apache.http.HttpStatus exactly once.

• Deferred files (WebDavConnection.java, HTTPUtil.java) still resolve their org.apache.commons.httpclient imports — commons-httpclient-3.0.1.jar retained at server/lib/commons/commons-httpclient-3.0.1.jar. Server compiles cleanly with the deferred-file // TODO markers in place.