How do you replace the class of a Maven dependency

Question

There is a class in a maven dependency that is incompatible with Java 8.

How do you properly fix that problem?

Right now I'm doing the following:

1. Create a package with the same name
2. Create a class with the same name in that package
3. Copy and paste the code
4. Fix the incompatible API call

The problem is that this class contains API calls to restricted classes and although I changed the Eclipse compiler settings (Window -> Preferences -> Java -> Compiler -> Error/Warnings -> Deprecated and restricted API -> Forbidden reference (access rule): Error -> Warning) to allow access the project will only compile sometimes. If it doesn't compile I'll get a "can't find symbol" error.

Edit:

Here are the details you asked for:

• Dependency: http://mvnrepository.com/artifact/com.sun.xml.wss/xws-security/3.0

• Class: EncryptionProcessor

• Necessary change:

  // Change line 1053 FROM: 
  // _dataEncryptor = XMLCipher.getInstance(dataEncAlgo, _dataCipher); 
  // TO:
  _dataEncryptor = XMLCipher.getInstance(dataEncAlgo); 
  

Edit-2:

Maven build error:

 [ERROR] symbol:   class XMLCipher
 [ERROR] location: class com.sun.xml.wss.impl.apachecrypto.EncryptionProcessor
 [ERROR] /C:/Users/{name}/development/eclipse_workspace/git/xws-security/src/main/java/com/sun/xml/wss/impl/apachecrypto/EncryptionProcessor.java:[1482,98] cannot find symbol

Answer 1

Similar to Steven S.'s answer, but using the maven-dependency-plugin. Based on this blog post.

I changed the name of the patched library (not the version), but it depends on your needs what works better for you.

The dependency on the original library should be marked as <optional>true</optional>. Otherwise, the projects that depend on your patched library will also depend on the original library, which means that both the patched and the original version will be on the classpath, which can lead to all kinds of problems.

If your project is a child project, you can still use a completely different groupId and version than your parent pom. Doesn't matter.

You can exclude the classes you patch from unpacking, but it's probably not necessary, because Maven will first unpack the original library and then compile your new version, which means that the original classes are overwritten. Nice!

<?xml version="1.0"?>
<project xmlns="http://maven.apache.org/POM/4.0.0">
  <modelVersion>4.0.0</modelVersion>

  <!-- remove this if you don't have a parent pom -->
  <parent>
    <groupId>my.company</groupId>
    <artifactId>my.company</artifactId>
    <version>1.2.3</version>
    <relativePath>../pom.xml</relativePath>
  </parent>

  <groupId>com.foo</groupId>
  <artifactId>foo-bar-patched</artifactId>
  <version>4.5.6</version>

  <build>
    <plugins>
      <plugin>
        <artifactId>maven-dependency-plugin</artifactId>
        <executions>
          <execution>
            <goals>
              <goal>unpack</goal>
            </goals>
            <configuration>
              <artifactItems>
                <artifactItem>
                  <groupId>com.foo</groupId>
                  <artifactId>foo-bar</artifactId>
                  <outputDirectory>${project.build.directory}/classes</outputDirectory>
                  <!-- excludes are probably not necessary -->
                  <!-- <excludes>**/Foo.class,**/Bar.class</excludes> -->
                </artifactItem>
              </artifactItems>
            </configuration>
          </execution>
        </executions>
      </plugin>
    </plugins>
  </build>

  <dependencies>
    <dependency>
      <groupId>com.foo</groupId>
      <artifactId>foo-bar</artifactId>
      <version>4.5.6</version>
      <optional>true</optional>
    </dependency>
  </dependencies>

</project>

Answer 2

General solution:

• download all project sources
• apply your modification
• • use version control so that change isn't lost
• change version in pom.xml, for example from 3.0 to 3.0-patched
• launch maven build
• copy generated artifacts to you repository/Artifactory, if you use one
• change dependency version in your own project

Answer 3

Here is a detailed guide describing what I did exactly:

1. Create new Maven project in Eclipse

2. Configure Maven settings of new project (Important: Use the same group and artifact ID and only change the version number)

   <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
   xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
       <modelVersion>4.0.0</modelVersion>
   
       <groupId>com.sun.xml.wss</groupId>
       <artifactId>xws-security</artifactId>
       <version>3.0-java8-fix</version>
   
       <properties>
           <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
           <java.version>1.8</java.version>
       </properties>
   </project>
   

3. Add dependency of bugged JAR

   <dependencies>
       <dependency>
           <groupId>com.sun.xml.wss</groupId>
           <artifactId>xws-security</artifactId>
           <version>3.0</version>
           <exclusions>
               <exclusion>
                 <artifactId>xmldsig</artifactId>
                 <groupId>javax.xml.crypto</groupId>
               </exclusion>
               <exclusion>
                 <artifactId>activation</artifactId>
                 <groupId>javax.activation</groupId>
               </exclusion>
           </exclusions>
       </dependency>
    </dependencies>  
   

4. Create Java file in the same package of class that needs to be fixed

   package com.sun.xml.wss.impl.apachecrypto;
   
   public class EncryptionProcessor {
       // The FIX goes here
   }
   

5. Add Maven shade build plug in to handle creation of patched JAR file (this is not the only plug in to handle this kind of task - e.g. dependency:unpack)

   <build>
       <plugins>
           <!-- plug in for creation of patched JAR file -->
           <plugin>
               <groupId>org.apache.maven.plugins</groupId>
               <artifactId>maven-shade-plugin</artifactId>
               <version>2.1</version>
               <executions>
                   <execution>
                       <phase>package</phase>
                       <goals>
                           <goal>shade</goal>
                       </goals>
                       <configuration>
                           <filters>
                               <filter>
                                   <artifact>com.sun.xml.wss:xws-security:3.0</artifact>
                                   <includes>
                                       <include>**/*.class</include>
                                       <include>**/*.xml</include>
                                   </includes>
                                   <excludes>
                                       <exlude>
                               com/sun/xml/wss/impl/apachecrypto/EncryptionProcessor.class
                                       </exlude>
                                   </excludes>
                               </filter>
                           </filters>
                       </configuration>
                   </execution>
               </executions>
           </plugin>
       </plugins>
   </build>
   

6. Include patched JAR in other projects as necessary (Note: If you experience ClassNotFoundExceptions or similar errors do this: Right-click on the project -> Properties -> Maven -> "Resolve dependencies from Workspace projects":false)

In case you are not familiar with Maven. Here is the complete pom.xml: http://pastebucket.com/88444