fix commons-io security problem. #1782

memorycompiler/pom.xml

@@ -11,13 +11,6 @@
     <name>arthas-memorycompiler</name>
 
     <dependencies>
-        <dependency>
-            <groupId>commons-io</groupId>
-            <artifactId>commons-io</artifactId>
-            <version>2.6</version>
-            <scope>test</scope>
-        </dependency>
-
         <dependency>
             <groupId>org.slf4j</groupId>
             <artifactId>slf4j-api</artifactId>

memorycompiler/src/test/java/com/taobao/arthas/compiler/DynamicCompilerTest.java

@@ -1,14 +1,14 @@
 package com.taobao.arthas.compiler;
 
+import java.io.BufferedReader;
 import java.io.File;
 import java.io.IOException;
 import java.io.InputStream;
+import java.io.InputStreamReader;
 import java.net.URL;
 import java.net.URLClassLoader;
-import java.nio.charset.Charset;
 import java.util.Map;
 
-import org.apache.commons.io.IOUtils;
 import org.junit.Assert;
 import org.junit.Test;
 import org.slf4j.LoggerFactory;
@@ -33,8 +33,8 @@ public class DynamicCompilerTest {
         InputStream logger1Stream = DynamicCompilerTest.class.getClassLoader().getResourceAsStream("TestLogger1.java");
         InputStream logger2Stream = DynamicCompilerTest.class.getClassLoader().getResourceAsStream("TestLogger2.java");
 
-        dynamicCompiler.addSource("TestLogger2", IOUtils.toString(logger2Stream, Charset.defaultCharset()));
-        dynamicCompiler.addSource("TestLogger1", IOUtils.toString(logger1Stream, Charset.defaultCharset()));
+        dynamicCompiler.addSource("TestLogger2", toString(logger2Stream));
+        dynamicCompiler.addSource("TestLogger1", toString(logger1Stream));
 
         Map<String, byte[]> byteCodes = dynamicCompiler.buildByteCodes();
 
@@ -42,4 +42,36 @@ public class DynamicCompilerTest {
         Assert.assertTrue("TestLogger2", byteCodes.containsKey("com.hello.TestLogger2"));
     }
 
+    /**
+     * Get the contents of an <code>InputStream</code> as a String
+     * using the default character encoding of the platform.
+     * <p>
+     * This method buffers the input internally, so there is no need to use a
+     * <code>BufferedInputStream</code>.
+     *
+     * @param input  the <code>InputStream</code> to read from
+     * @return the requested String
+     * @throws NullPointerException if the input is null
+     * @throws IOException if an I/O error occurs
+     */
+    public static String toString(InputStream input) throws IOException {
+        BufferedReader br = null;
+        try {
+            StringBuilder sb = new StringBuilder();
+            br = new BufferedReader(new InputStreamReader(input));
+            String line;
+            while ((line = br.readLine()) != null) {
+                sb.append(line).append("\n");
+            }
+            return sb.toString();
+        } finally {
+            if (br != null) {
+                try {
+                    br.close();
+                } catch (IOException e) {
+                    // ignore
+                }
+            }
+        }
+    }
 }