fix(TUP-37016):CVE-2022-41853, upgrade org.hsqldb:hsqldb:2.3.1 to 2.7.1. (#5806)

* fix(TDI-48676):ResumeUtil OOM

* replace duplicate variable

main/plugins/org.talend.core.runtime/src/main/java/org/talend/core/database/conn/version/EDatabaseVersion4Drivers.java

@@ -27,8 +27,8 @@ import org.talend.core.database.conn.DatabaseConnConstants;
 public enum EDatabaseVersion4Drivers {
     // access
     ACCESS_JDBC(new DbVersion4Drivers(EDatabaseTypeName.ACCESS, new String[] {
-            "jackcess-2.1.0.jar", "ucanaccess-2.0.9.5.jar", "commons-lang-2.6.jar", "commons-logging-1.1.1.jar", "hsqldb.jar", //$NON-NLS-1$ //$NON-NLS-2$ //$NON-NLS-3$
-            "jackcess-encrypt-2.1.0.jar", "bcprov-jdk15on-1.51.jar", "talend-ucanaccess-utils-1.0.0.jar" })),
+            "jackcess-2.1.12.jar", "ucanaccess-2.0.9.5.jar", "commons-lang-2.6.jar", "commons-logging-1.1.3.jar", "hsqldb.jar", //$NON-NLS-1$ //$NON-NLS-2$ //$NON-NLS-3$
+            "jackcess-encrypt-2.1.4.jar", "bcprov-jdk15on-1.70.jar", "talend-ucanaccess-utils-1.0.0.jar" })),
     ACCESS_2003(new DbVersion4Drivers(EDatabaseTypeName.ACCESS, "Access 2003", "Access_2003")), //$NON-NLS-1$ //$NON-NLS-2$
     ACCESS_2007(new DbVersion4Drivers(EDatabaseTypeName.ACCESS, "Access 2007", "Access_2007")), //$NON-NLS-1$ //$NON-NLS-2$
     // oracle

main/plugins/org.talend.core.runtime/src/main/java/org/talend/core/model/metadata/SparkBatchMetadataTalendTypeFilter.java

@@ -19,7 +19,9 @@ public class SparkBatchMetadataTalendTypeFilter extends SparkMetadataTalendTypeF
             "tJDBCInput",
             "tJDBCOutput",
             "tLogRow",
-            "tMongoDBInput", 
+            "tSqlRow",
+            "tAvroInput",
+            "tMongoDBInput",
             "tMongoDBOutput",
             "tSqlRow"
             );

main/plugins/org.talend.libraries.jdbc.hsql/licenses/license.txt

@@ -6,9 +6,42 @@ COPYRIGHTS AND LICENSES
 
 ORIGINAL LICENSE (a.k.a. "hypersonic_lic.txt")
 
-For content, code, and products originally developed by Thomas Mueller and the Hypersonic SQL Group:
+For work developed by the HSQL Development Group:
 
-Copyright (c) 1995-2000 by the Hypersonic SQL Group.
+Copyright (c) 2001-2022, The HSQL Development Group
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+Redistributions of source code must retain the above copyright notice, this
+list of conditions and the following disclaimer.
+
+Redistributions in binary form must reproduce the above copyright notice,
+this list of conditions and the following disclaimer in the documentation
+and/or other materials provided with the distribution.
+
+Neither the name of the HSQL Development Group nor the names of its
+contributors may be used to endorse or promote products derived from this
+software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
+AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ARE DISCLAIMED. IN NO EVENT SHALL HSQL DEVELOPMENT GROUP, HSQLDB.ORG,
+OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
+EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
+PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
+ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+
+
+For work originally developed by the Hypersonic SQL Group:
+
+Copyright (c) 1995-2000, The Hypersonic SQL Group.
 All rights reserved.
 
 Redistribution and use in source and binary forms, with or without
@@ -37,12 +70,12 @@ ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
 SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-This software consists of voluntary contributions made by many individuals on behalf of the
-Hypersonic SQL Group.
+This software consists of voluntary contributions made by many individuals
+on behalf of the Hypersonic SQL Group.
 
 For work added by the HSQL Development Group (a.k.a. hsqldb_lic.txt):
 
-Copyright (c) 2001-2005, The HSQL Development Group
+Copyright (c) 2001-2022, The HSQL Development Group
 All rights reserved.
 
 Redistribution and use in source and binary forms, with or without

main/plugins/org.talend.libraries.jdbc.hsql/pom.xml

@@ -9,4 +9,32 @@
   </parent>
   <artifactId>org.talend.libraries.jdbc.hsql</artifactId>
   <packaging>eclipse-plugin</packaging>
+  <build>
+    <plugins>
+      <plugin>
+        <groupId>org.apache.maven.plugins</groupId>
+        <artifactId>maven-dependency-plugin</artifactId>
+        <executions>
+          <execution>
+            <id>copy</id>
+            <phase>generate-sources</phase>
+            <goals>
+              <goal>copy</goal>
+            </goals>
+            <configuration>
+              <artifactItems>
+                <artifactItem>
+                  <groupId>org.hsqldb</groupId>
+                  <artifactId>hsqldb</artifactId>
+                  <version>2.7.1</version>
+                  <outputDirectory>${project.basedir}/lib</outputDirectory>
+                  <destFileName>hsqldb.jar</destFileName>
+                </artifactItem>
+              </artifactItems>
+            </configuration>
+          </execution>
+        </executions>
+      </plugin>
+    </plugins>
+  </build>
 </project>

main/plugins/org.talend.librariesmanager/resources/java/routines/system/ResumeUtil.java

@@ -520,9 +520,13 @@ public class ResumeUtil {
 
         private String lineSeparator = System.getProperty("line.separator");
         
-        private int capibility = 2 << 22; //8M
+        private final int capibility = 2 << 22; //8M
+        
+        private final int FLUSH_FACTOR = 6 *1024 *1024; //6M
+        
+        private final int SUBSTRING_SIZE = 2 << 20; //2M
+        
         
-        private int FLUSH_FACTOR = 6 *1024 *1024; //6M
         
 
         public SimpleCsvWriter(FileChannel channel) {
@@ -553,6 +557,16 @@ public class ResumeUtil {
                 content = replace(content, "" + TextQualifier, "" + TextQualifier + TextQualifier);
             }
             
+            if (content.length() > SUBSTRING_SIZE) { //2M
+                int index = 0;
+                for (; content.length() - index > SUBSTRING_SIZE; index += SUBSTRING_SIZE) {
+                    flush(true);
+                    final String substring = content.substring(index, index + SUBSTRING_SIZE);
+                    buf.put(substring.getBytes());
+                }
+                content = content.substring(index);
+            }
+            
             byte[] contentByte = content.getBytes();
             if(contentByte.length > capibility - buf.position()) {
             	flush(true);

main/plugins/org.talend.metadata.managment/plugin.xml

@@ -212,6 +212,14 @@
             required="true"
             uripath="platform:/plugin/org.talend.libraries.apache.common/lib/commons-lang-2.4.jar">
       </libraryNeeded>
+      <libraryNeeded
+            context="plugin:org.talend.metadata.managment"
+            language="java"
+            message="Needed for plugin org.talend.metadata.managment"
+            name="hsqldb.jar" mvn_uri="mvn:org.hsqldb/hsqldb/2.7.1" 
+            required="true"
+            uripath="platform:/plugin/org.talend.libraries.jdbc.hsql/lib/hsqldb.jar">
+      </libraryNeeded>
    </extension>
    <extension
          point="org.talend.core.migrationTask">

main/plugins/org.talend.metadata.managment/src/main/java/org/talend/core/model/metadata/builder/database/JDBCDriverLoader.java

@@ -175,6 +175,11 @@ public class JDBCDriverLoader {
                     info.put("charSet", systemCharset.displayName()); //$NON-NLS-1$
                 }
             }
+            
+            //TUP-37016:Upgrade hsqldb to 2.7.1
+            if (dbType.equals(EDatabaseTypeName.ACCESS.getXmlName()) || ConnectionUtils.isHsql(url)) {
+                System.setProperty("hsqldb.method_class_names", "net.ucanaccess.converters.*");
+            }
 
             if (additionalParams != null && !"".equals(additionalParams)
                     && (dbType.toUpperCase().contains("ORACLE") || EDatabaseTypeName.REDSHIFT.getDisplayName().equals(dbType)