Instruction:
作为 Java 安全专家，检测此代码中的安全漏洞：
## 内容1
### 文件路径：
pom.xml
### 代码内容：
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">

    <modelVersion>4.0.0</modelVersion>
    <groupId>eionet.cr</groupId>
    <artifactId>cr3</artifactId>
    <packaging>war</packaging>

    <properties>
        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
        <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
        <env>default</env>
        <javaVersion>1.8</javaVersion>
        <!-- TODO Replace with RDF4j and modernize -->
        <sesame.openrdf.version>2.6.10</sesame.openrdf.version>
        <checkstyle.config.location>${basedir}/docs/checkstyle.xml</checkstyle.config.location>
        <spring.version>4.3.24.RELEASE</spring.version>
    </properties>

    <version>1.0-SNAPSHOT</version>
    <name>cr3</name>
    <url>http://maven.apache.org</url>

    <!-- configuration of Maven repositories to be used -->
    <repositories>
        <repository>
            <id>archiva.internal</id>
            <name>Internal Release Repository</name>
            <url>http://archiva.eionet.europa.eu/repository/internal/</url>
            <snapshots>
                <enabled>false</enabled>
            </snapshots>
        </repository>
        <repository>
            <id>archiva.snapshots</id>
            <name>Internal Snapshot Repository</name>
            <url>http://archiva.eionet.europa.eu/repository/snapshots/</url>
            <snapshots>
                <enabled>true</enabled>
            </snapshots>
        </repository>
        <!--For unpublished Virtuoso 4.2.fix -->
        <repository>
            <id>project-local</id>
            <name>project-local repository</name>
            <layout>default</layout>
            <url>file:///${basedir}/lib</url>
            <snapshots>
                <enabled>false</enabled>
            </snapshots>
        </repository>
    </repositories>

    <distributionManagement>
        <repository>
            <id>archiva.internal</id>
            <name>Internal Release Repository</name>
            <url>http://archiva.eionet.europa.eu/repository/internal/</url>
        </repository>
        <snapshotRepository>
            <id>archiva.snapshots</id>
            <name>Internal Snapshot Repository</name>
            <url>http://archiva.eionet.europa.eu/repository/snapshots/</url>
        </snapshotRepository>
    </distributionManagement>

    <profiles>
      <profile>
        <id>docker</id>
        <activation>
          <activeByDefault>true</activeByDefault>
        </activation>
        <properties>
          <valid.images>virtuoso, httpd</valid.images>
        </properties>
      </profile>
      <profile>
        <id>local</id>
        <properties>
          <tests.virtuoso.host>localhost</tests.virtuoso.host>
          <valid.images>none</valid.images>
        </properties>
      </profile>
    </profiles>

    <!-- the build configuration -->
    <build>
        <plugins>

            <plugin>
                <groupId>org.codehaus.mojo</groupId>
                <artifactId>properties-maven-plugin</artifactId>
                <version>1.0.0</version>
                <executions>
                    <execution>
                        <phase>initialize</phase>
                        <goals>
                            <goal>read-project-properties</goal>
                        </goals>
                        <configuration>
                            <files>
                                <file>tests.properties</file>
                            </files>
                        </configuration>
                    </execution>
                </executions>
            </plugin>

            <!-- maven-compiler-plugin -->
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-compiler-plugin</artifactId>
                <version>3.6.1</version>
                <inherited>true</inherited>
                <configuration>
                    <verbose>false</verbose>
                    <fork>false</fork>
                    <compilerVersion>${javaVersion}</compilerVersion>
                    <source>${javaVersion}</source>
                    <target>${javaVersion}</target>
                    <encoding>UTF-8</encoding>
                </configuration>
            </plugin>

            <!-- maven-surefire-plugin -->
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-surefire-plugin</artifactId>
                <version>2.20</version>
                <configuration>
                    <excludes>
                        <exclude>**/*.java</exclude>
                    </excludes>
                </configuration>
            </plugin>

            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-failsafe-plugin</artifactId>
                <version>2.20</version>
                <configuration>
                    <reportFormat>xml</reportFormat>
                    <systemPropertyVariables>
                        <tests.virtuoso.host>${tests.virtuoso.host}</tests.virtuoso.host>
                        <tests.virtuoso.port>${tests.virtuoso.port}</tests.virtuoso.port>
                        <tests.httpd.host>${tests.httpd.host}</tests.httpd.host>
                        <tests.httpd.port>${tests.httpd.port}</tests.httpd.port>
                    </systemPropertyVariables>
                    <includes>
                        <include>**/*.java</include>
                    </includes>
                    <argLine>${itCoverAgent}</argLine>
                </configuration>
                <executions>
                    <execution>
                        <goals>
                            <goal>integration-test</goal>
                            <goal>verify</goal>
                        </goals>
                    </execution>
                </executions>
            </plugin>

            <!-- maven-war-plugin -->
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-war-plugin</artifactId>
                <version>3.1.0</version>
                <configuration>
                    <filters>
                        <filter>${basedir}/${env}.properties</filter>
                    </filters>
                    <webResources>
                        <resource>
                            <directory>${basedir}/src/main/webapp/WEB-INF</directory>
                            <filtering>true</filtering>
                            <targetPath>WEB-INF</targetPath>
                            <includes>
                                <include>web.xml</include>
                            </includes>
                        </resource>
                        <resource>
                            <directory>${basedir}/src/main/webapp/pages/common</directory>
                            <filtering>true</filtering>
                            <targetPath>pages/common</targetPath>
                        </resource>
                    </webResources>
                </configuration>
            </plugin>

            <!-- Run Ant for various preparation tasks, declared in build.xml -->
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-antrun-plugin</artifactId>
                <version>1.8</version>
                <executions>
                    <execution>
                        <id>copy-local-properties</id>
                        <phase>prepare-package</phase>
                        <goals>
                            <goal>run</goal>
                        </goals>
                        <configuration>
                            <tasks>
                                <copy todir="${project.build.directory}/classes/acl">
                                    <fileset dir="${basedir}/acl" />
                                </copy>
                                <copy file="${basedir}/${env}.properties"
                                      toFile="${project.build.directory}/classes/env.properties" />
                                <copy todir="${project.build.directory}/classes/sql">
                                    <fileset dir="sql" />
                                </copy>
                                <mkdir dir="${config.app.home}/tmp"/>
                                <pathconvert property="apphome.unix" targetos="unix">
                                    <path location="${config.app.home}"/>
                                    <map from="C:" to=""/>
                                    <map from="D:" to=""/>
                                    <map from="E:" to=""/>
                                    <map from="F:" to=""/>
                                </pathconvert>
                                <pathconvert property="apphome.windows" targetos="unix">
                                    <path location="${config.app.home}"/>
                                </pathconvert>
                                <echo>apphome.unix = ${apphome.unix}</echo>
                                <echo>apphome.windows = ${apphome.windows}</echo>
                            </tasks>
                            <exportAntProperties>true</exportAntProperties>
                        </configuration>
                    </execution>
                    <execution>
                        <id>pre-test</id>
                        <phase>process-test-resources</phase>
                        <goals>
                            <goal>run</goal>
                        </goals>
                        <configuration>
                            <tasks>
                                <copy file="${basedir}/tests.properties"
                                      toFile="${project.build.directory}/test-classes/env.properties" />
                                <copy todir="${project.build.directory}/test-classes/sql">
                                    <fileset dir="sql" />
                                </copy>
                                <copy todir="${project.build.directory}/test-classes/acl">
                                    <fileset dir="acl" />
                                </copy>
                            </tasks>
                        </configuration>
                    </execution>
                </executions>
            </plugin>

            <plugin>
                <groupId>io.fabric8</groupId>
                <artifactId>docker-maven-plugin</artifactId>
                <version>0.26.1</version>
                <extensions>true</extensions>
                <configuration>
                    <filter>${valid.images}</filter>
                    <images>

                        <image>
                            <alias>virtuoso-cr-jenkins</alias>
                            <name>virtuoso</name>

                            <build>
                                <from>openlink/virtuoso-opensource-7:7.2.6-r1-g0a3336c</from>
                                <assembly>
                                    <descriptor>assembly-virtuoso-unittest.xml</descriptor>
                                </assembly>
                            </build>

                            <run>
                                <env>
                                    <DBA_PASSWORD>dba</DBA_PASSWORD>
                                    <VIRT_Parameters_TimezonelessDatetimes>0</VIRT_Parameters_TimezonelessDatetimes>
                                    <VIRT_Parameters_DirsAllowed>., ../vad, /usr/share/proj, /var/tmp, /tmp, ${config.app.home}/tmp</VIRT_Parameters_DirsAllowed>
                                </env>
                                <ports>
                                    <port>8891:8890</port>
                                    <port>${tests.virtuoso.port}:1111</port>
                                </ports>
                                <wait>
                                    <log>Server online at</log>
                                    <time>60000</time>
                                    <exec>
                                        <postStart>isql localhost:1111 dba dba /maven/1_create_testuser.sql</postStart>
                                    </exec>
                                </wait>
                                <volumes>
                                    <bind>
                                        <volume>${config.docker.sharedVolume}/tmp:${config.app.home}/tmp</volume>
                                    </bind>
                                </volumes>
                            </run>
                        </image>

                        <image>
                            <alias>httpd-cr-jenkins</alias>
                            <name>httpd</name>

                            <build>
                                <from>httpd:2.4</from>
                                <assembly>
                                    <descriptor>assembly-httpd-unittest.xml</descriptor>
                                </assembly>
                            </build>

                            <run>
                                <links>
                                    <link>virtuoso</link>
                                </links>
                                <ports>
                                    <port>${tests.httpd.port}:80</port>
                                </ports>
                                <wait>
                                    <!-- Check for this URL to return a 200 return code .... -->
                                    <url>http://${tests.httpd.host}:${tests.httpd.port}/</url>
                                    <!-- ... but at max 2 minutes -->
                                    <time>120000</time>
                                    <exec>
                                        <postStart>/maven/move-test-files.sh</postStart>
                                    </exec>
                                </wait>
                            </run>
                        </image>

                    </images>

                </configuration>
                <executions>
                    <execution>
                        <configuration>
                            <skip>${maven.test.skip}</skip>
                        </configuration>
                        <id>start</id>
                        <phase>pre-integration-test</phase>
                        <goals>
                            <goal>stop</goal>
                            <goal>build</goal>
                            <goal>start</goal>
                        </goals>
                    </execution>
                    <execution>
                        <configuration>
                            <skip>${maven.test.skip}</skip>
                        </configuration>
                        <id>stop</id>
                        <phase>post-integration-test</phase>
                        <goals>
                            <goal>stop</goal>
                        </goals>
                    </execution>
                </executions>
            </plugin>

            <plugin>
                <groupId>org.jacoco</groupId>
                <artifactId>jacoco-maven-plugin</artifactId>
                <version>0.8.7</version>
                <executions>
                    <execution>
                        <goals>
                            <goal>prepare-agent</goal>
                        </goals>
                        <configuration>
                            <propertyName>itCoverAgent</propertyName>
                        </configuration>
                    </execution>
                    <!-- attached to Maven verify phase -->
                    <execution>
                        <id>report</id>
                        <phase>verify</phase>
                        <goals>
                            <goal>report</goal>
                        </goals>
                        <configuration>
                            <includes>
                                <include>eionet/cr/**/*.class</include>
                            </includes>
                        </configuration>
                    </execution>
                </executions>
            </plugin>

            <plugin>
                <groupId>com.github.spotbugs</groupId>
                <artifactId>spotbugs-maven-plugin</artifactId>
                <version>4.2.3</version>
            </plugin>
        </plugins>
        <!-- name of the bundled project when it is finally built -->
        <finalName>cr</finalName>

    </build>

    <!-- dependencies -->

    <dependencies>
        <dependency>
            <groupId>net.sf.ehcache</groupId>
            <artifactId>ehcache-core</artifactId>
            <version>2.5.2</version>
        </dependency>
        <dependency>
            <groupId>javax.activation</groupId>
            <artifactId>activation</artifactId>
            <version>1.1</version>
        </dependency>
        <dependency>
            <groupId>javax.mail</groupId>
            <artifactId>mail</artifactId>
            <version>1.4.1</version>
        </dependency>
        <dependency>
            <groupId>commons-codec</groupId>
            <artifactId>commons-codec</artifactId>
            <version>1.6</version>
        </dependency>
        <dependency>
            <groupId>commons-fileupload</groupId>
            <artifactId>commons-fileupload</artifactId>
            <version>1.4</version>
        </dependency>
        <dependency>
            <groupId>commons-collections</groupId>
            <artifactId>commons-collections</artifactId>
            <version>3.2</version>
        </dependency>
        <dependency>
            <groupId>commons-io</groupId>
            <artifactId>commons-io</artifactId>
            <version>2.2</version>
        </dependency>
        <dependency>
            <groupId>commons-validator</groupId>
            <artifactId>commons-validator</artifactId>
            <version>1.4.0</version>
        </dependency>
        <dependency>
            <groupId>org.apache.commons</groupId>
            <artifactId>commons-pool2</artifactId>
            <version>2.3</version>
        </dependency>
        <dependency>
            <groupId>org.apache.commons</groupId>
            <artifactId>commons-dbcp2</artifactId>
            <version>2.5.0</version>
        </dependency>
        <dependency>
            <groupId>org.apache.commons</groupId>
            <artifactId>commons-compress</artifactId>
            <version>1.19</version>
        </dependency>
        <dependency>
            <groupId>net.sourceforge.stripes</groupId>
            <artifactId>stripes</artifactId>
            <version>1.5.8</version>
            <exclusions>
                <exclusion>
                    <groupId>org.slf4j</groupId>
                    <artifactId>slf4j-log4j12</artifactId>
                </exclusion>
                <exclusion>
                    <groupId>log4j</groupId>
                    <artifactId>log4j</artifactId>
                </exclusion>
            </exclusions>
        </dependency>
        <dependency>
            <groupId>javax.servlet</groupId>
            <artifactId>javax.servlet-api</artifactId>
            <version>3.1.0</version>
            <scope>provided</scope>
        </dependency>
        <dependency>
            <groupId>javax.servlet</groupId>
            <artifactId>jstl</artifactId>
            <version>1.1.0</version>
        </dependency>
        <dependency>
            <groupId>javax.servlet</groupId>
            <artifactId>jsp-api</artifactId>
            <version>2.0</version>
            <scope>provided</scope>
            <exclusions>
                <exclusion>
                    <groupId>javax.servlet</groupId>
                    <artifactId>servlet-api</artifactId>
                </exclusion>
            </exclusions>
        </dependency>
        <dependency>
            <groupId>cas</groupId>
            <artifactId>casclient</artifactId>
            <version>2.1.1</version>
            <exclusions>
                <exclusion>
                    <groupId>javax.servlet</groupId>
                    <artifactId>servlet-api</artifactId>
                </exclusion>
            </exclusions>
        </dependency>
        <dependency>
            <groupId>taglibs</groupId>
            <artifactId>standard</artifactId>
            <version>1.1.2</version>
        </dependency>
        <dependency>
            <groupId>com.hp.hpl.jena</groupId>
            <artifactId>jena</artifactId>
            <version>2.6.4</version>
            <exclusions>
                <exclusion>
                    <groupId>org.slf4j</groupId>
                    <artifactId>slf4j-log4j12</artifactId>
                </exclusion>
                <exclusion>
                    <groupId>log4j</groupId>
                    <artifactId>log4j</artifactId>
                </exclusion>
            </exclusions>
        </dependency>
        <dependency>
            <groupId>xerces</groupId>
            <artifactId>xercesImpl</artifactId>
            <version>2.11.0</version>
        </dependency>
        <dependency>
            <groupId>displaytag</groupId>
            <artifactId>displaytag</artifactId>
            <version>1.2</version>
            <exclusions>
                <exclusion>
                    <groupId>org.slf4j</groupId>
                    <artifactId>jcl104-over-slf4j</artifactId>
                </exclusion>
                <exclusion>
                    <groupId>org.slf4j</groupId>
                    <artifactId>slf4j-log4j12</artifactId>
                </exclusion>
            </exclusions>
        </dependency>
        <!-- Eionet dependencies -->
        <dependency>
            <groupId>eionet</groupId>
            <artifactId>documentation.core</artifactId>
            <version>2.0-SNAPSHOT</version>
            <exclusions>
                <exclusion>
                    <groupId>org.slf4j</groupId>
                    <artifactId>slf4j-log4j12</artifactId>
                </exclusion>
                <exclusion>
                    <groupId>log4j</groupId>
                    <artifactId>log4j</artifactId>
                </exclusion>
            </exclusions>
        </dependency>
        <dependency>
            <groupId>eionet</groupId>
            <artifactId>documentation.extensions.stripes</artifactId>
            <version>1.0-SNAPSHOT</version>
        </dependency>
        <dependency>
            <groupId>eionet</groupId>
            <artifactId>acl</artifactId>
            <version>4.0-SNAPSHOT</version>
            <exclusions>
                <exclusion>
                    <groupId>org.slf4j</groupId>
                    <artifactId>slf4j-log4j12</artifactId>
                </exclusion>
                <exclusion>
                    <groupId>log4j</groupId>
                    <artifactId>log4j</artifactId>
                </exclusion>
            </exclusions>
        </dependency>
        <dependency>
            <groupId>eionet</groupId>
            <artifactId>rpcserver</artifactId>
            <version>2.0</version>
        </dependency>
        <dependency>
            <groupId>eionet</groupId>
            <artifactId>eionet-dir</artifactId>
            <version>2.5</version>
            <scope>runtime</scope>
        </dependency>
        <dependency>
            <groupId>org.apache.ws.commons.util</groupId>
            <artifactId>ws-commons-util</artifactId>
            <version>1.0.2</version>
        </dependency>
        <dependency>
            <groupId>org.quartz-scheduler</groupId>
            <artifactId>quartz</artifactId>
            <version>1.7.3</version>
        </dependency>
        <dependency>
            <groupId>javax.transaction</groupId>
            <artifactId>jta</artifactId>
            <version>1.0.1B</version>
        </dependency>
        <dependency>
            <groupId>commons-lang</groupId>
            <artifactId>commons-lang</artifactId>
            <version>2.4</version>
        </dependency>
        <dependency>
            <groupId>commons-beanutils</groupId>
            <artifactId>commons-beanutils</artifactId>
            <version>1.7.0</version>
        </dependency>
        <dependency>
            <groupId>org.apache.poi</groupId>
            <artifactId>poi</artifactId>
            <version>3.5-FINAL</version>
            <exclusions>
                <exclusion>
                    <groupId>org.slf4j</groupId>
                    <artifactId>slf4j-log4j12</artifactId>
                </exclusion>
                <exclusion>
                    <groupId>log4j</groupId>
                    <artifactId>log4j</artifactId>
                </exclusion>
            </exclusions>
        </dependency>
        <dependency>
            <groupId>org.simpleframework</groupId>
            <artifactId>simple-xml</artifactId>
            <version>2.1.3</version>
        </dependency>
        <dependency>
            <groupId>net.sf.json-lib</groupId>
            <artifactId>json-lib</artifactId>
            <version>2.3</version>
            <type>jar</type>
            <classifier>jdk15</classifier>
        </dependency>

        <!-- Logging dependencies -->
        <dependency>
            <groupId>io.sentry</groupId>
            <artifactId>sentry-log4j2</artifactId>
            <version>1.7.23</version>
        </dependency>

        <dependency>
            <groupId>org.apache.logging.log4j</groupId>
            <artifactId>log4j-core</artifactId>
            <version>2.17.1</version>
        </dependency>
        <dependency>
            <groupId>org.apache.logging.log4j</groupId>
            <artifactId>log4j-api</artifactId>
            <version>2.17.1</version>
        </dependency>
        <!--The Log4j 2 SLF4J Binding allows applications coded to the SLF4J API to use Log4j 2 as the implementation.-->
        <dependency>
            <groupId>org.apache.logging.log4j</groupId>
            <artifactId>log4j-slf4j-impl</artifactId>
            <version>2.17.1</version>
        </dependency>
        <dependency>
            <groupId>org.slf4j</groupId>
            <artifactId>slf4j-api</artifactId>
            <version>1.7.25</version>
        </dependency>
        <!-- Intercepts logging from log4j and redirects it to slf4j -->
        <dependency>
            <groupId>org.slf4j</groupId>
            <artifactId>log4j-over-slf4j</artifactId>
            <version>1.7.25</version>
        </dependency>
        <!-- Intercepts logging from apache commons logging and redirects it to slf4j -->
        <dependency>
            <groupId>org.slf4j</groupId>
            <artifactId>jcl-over-slf4j</artifactId>
            <version>1.7.25</version>
        </dependency>
        <!--GELF-->
        <dependency>
            <groupId>biz.paluch.logging</groupId>
            <artifactId>logstash-gelf</artifactId>
            <version>1.11.2</version>
        </dependency>

        <dependency>
            <groupId>org.apache.httpcomponents</groupId>
            <artifactId>httpclient</artifactId>
            <version>4.5.3</version>
        </dependency>
        <dependency>
            <groupId>org.apache.httpcomponents</groupId>
            <artifactId>httpmime</artifactId>
            <version>4.5.3</version>
        </dependency>
        <dependency>
            <groupId>xalan</groupId>
            <artifactId>xalan</artifactId>
            <version>2.7.0</version>
            <scope>runtime</scope>
        </dependency>

        <!-- start org.openrdf.sesame dependencies -->
        <dependency>
            <groupId>org.openrdf.sesame</groupId>
            <artifactId>sesame-util</artifactId>
            <version>${sesame.openrdf.version}</version>
        </dependency>
        <dependency>
            <groupId>org.openrdf.sesame</groupId>
            <artifactId>sesame-rio-api</artifactId>
            <version>${sesame.openrdf.version}</version>
        </dependency>
        <dependency>
            <groupId>org.openrdf.sesame</groupId>
            <artifactId>sesame-rio-binary</artifactId>
            <version>${sesame.openrdf.version}</version>
        </dependency>
        <dependency>
            <groupId>org.openrdf.sesame</groupId>
            <artifactId>sesame-rio-n3</artifactId>
            <version>${sesame.openrdf.version}</version>
        </dependency>
        <dependency>
            <groupId>org.openrdf.sesame</groupId>
            <artifactId>sesame-rio-ntriples</artifactId>
            <version>${sesame.openrdf.version}</version>
        </dependency>
        <dependency>
            <groupId>org.openrdf.sesame</groupId>
            <artifactId>sesame-rio-rdfxml</artifactId>
            <version>${sesame.openrdf.version}</version>
        </dependency>
        <dependency>
            <groupId>org.openrdf.sesame</groupId>
            <artifactId>sesame-rio-trix</artifactId>
            <version>${sesame.openrdf.version}</version>
        </dependency>
        <dependency>
            <groupId>org.openrdf.sesame</groupId>
            <artifactId>sesame-rio-turtle</artifactId>
            <version>${sesame.openrdf.version}</version>
        </dependency>
        <dependency>
            <groupId>org.openrdf.sesame</groupId>
            <artifactId>sesame-rio-trig</artifactId>
            <version>${sesame.openrdf.version}</version>
        </dependency>
        <dependency>
            <groupId>org.openrdf.sesame</groupId>
            <artifactId>sesame-repository-api</artifactId>
            <version>${sesame.openrdf.version}</version>
        </dependency>
        <dependency>
            <groupId>org.openrdf.sesame</groupId>
            <artifactId>sesame-queryresultio-api</artifactId>
            <version>${sesame.openrdf.version}</version>
        </dependency>
        <dependency>
            <groupId>org.openrdf.sesame</groupId>
            <artifactId>sesame-queryresultio-text</artifactId>
            <version>${sesame.openrdf.version}</version>
        </dependency>
        <dependency>
            <groupId>org.openrdf.sesame</groupId>
            <artifactId>sesame-queryparser-api</artifactId>
            <version>${sesame.openrdf.version}</version>
        </dependency>
        <dependency>
            <groupId>org.openrdf.sesame</groupId>
            <artifactId>sesame-queryparser-sparql</artifactId>
            <version>${sesame.openrdf.version}</version>
        </dependency>
        <dependency>
            <groupId>org.openrdf.sesame</groupId>
            <artifactId>sesame-queryalgebra-evaluation</artifactId>
            <version>${sesame.openrdf.version}</version>
        </dependency>
        <dependency>
            <groupId>org.openrdf.sesame</groupId>
            <artifactId>sesame-queryalgebra-model</artifactId>
            <version>${sesame.openrdf.version}</version>
        </dependency>

        <!-- end org.openrdf.sesame dependencies -->
        <dependency>
            <groupId>virtuoso</groupId>
            <artifactId>virt-sesame</artifactId>
            <version>2.7.3</version>
        </dependency>
        <dependency>
            <groupId>virtuoso</groupId>
            <artifactId>virtjdbc</artifactId>
            <version>4.2.fix</version>
        </dependency>
        <dependency>
            <groupId>commons-httpclient</groupId>
            <artifactId>commons-httpclient</artifactId>
            <version>3.1</version>
        </dependency>
        <dependency>
            <groupId>nl.bitwalker</groupId>
            <artifactId>UserAgentUtils</artifactId>
            <version>1.2.4</version>
        </dependency>
        <dependency>
            <groupId>net.sf.opencsv</groupId>
            <artifactId>opencsv</artifactId>
            <version>2.0</version>
        </dependency>
        <dependency>
            <groupId>eionet</groupId>
            <artifactId>eea-template</artifactId>
            <version>3.0</version>
            <exclusions>
                <exclusion>
                    <groupId>javax.servlet</groupId>
                    <artifactId>servlet-api</artifactId>
                </exclusion>
            </exclusions>
        </dependency>
        <dependency>
            <groupId>rome</groupId>
            <artifactId>rome</artifactId>
            <version>1.0</version>
        </dependency>
        <dependency>
            <groupId>net.htmlparser.jericho</groupId>
            <artifactId>jericho-html</artifactId>
            <version>3.2</version>
        </dependency>
        <dependency>
            <groupId>com.healthmarketscience.jackcess</groupId>
            <artifactId>jackcess</artifactId>
            <version>1.2.9</version>
        </dependency>
        <!-- JWT Lib -->
        <dependency>
            <groupId>com.auth0</groupId>
            <artifactId>java-jwt</artifactId>
            <version>2.1.0</version>
        </dependency>

        <!-- Ant -->

        <dependency>
            <groupId>org.apache.ant</groupId>
            <artifactId>ant</artifactId>
            <version>1.9.3</version>
        </dependency>
        <dependency>
            <groupId>org.apache.ant</groupId>
            <artifactId>ant-apache-log4j</artifactId>
            <version>1.9.3</version>
            <exclusions>
                <exclusion>
                    <groupId>org.slf4j</groupId>
                    <artifactId>slf4j-log4j12</artifactId>
                </exclusion>
                <exclusion>
                    <groupId>log4j</groupId>
                    <artifactId>log4j</artifactId>
                </exclusion>
            </exclusions>
        </dependency>

        <!-- Liquibase -->
        <!-- TODO Upgrade to 3.5.3+ asap -->
        <dependency>
            <groupId>org.liquibase</groupId>
            <artifactId>liquibase-core</artifactId>
            <version>3.0.6</version>
        </dependency>

        <!-- TEST dependencies -->

        <dependency>
            <groupId>junit</groupId>
            <artifactId>junit</artifactId>
            <version>4.12</version>
            <scope>test</scope>
        </dependency>
        <dependency>
            <groupId>org.sonarsource.scanner.maven</groupId>
            <artifactId>sonar-maven-plugin</artifactId>
            <version>3.9.1.2184</version>
            <scope>test</scope>
        </dependency>
        <dependency>
            <groupId>org.dbunit</groupId>
            <artifactId>dbunit</artifactId>
            <version>2.5.3</version>
            <scope>test</scope>
        </dependency>
        <dependency>
            <groupId>org.eclipse.jetty</groupId>
            <artifactId>jetty-server</artifactId>
            <version>9.4.19.v20190610</version>
            <scope>test</scope>
        </dependency>
        <dependency>
            <groupId>org.eclipse.jetty</groupId>
            <artifactId>jetty-util</artifactId>
            <version>9.4.19.v20190610</version>
            <scope>test</scope>
        </dependency>

        <!-- Spring framework dependencies -->
        <dependency>
            <groupId>org.springframework</groupId>
            <artifactId>spring-core</artifactId>
            <version>${spring.version}</version>
        </dependency>
        <dependency>
            <groupId>org.springframework</groupId>
            <artifactId>spring-context</artifactId>
            <version>${spring.version}</version>
        </dependency>
        <dependency>
            <groupId>org.springframework</groupId>
            <artifactId>spring-web</artifactId>
            <version>${spring.version}</version>
        </dependency>
        <dependency>
            <groupId>org.springframework</groupId>
            <artifactId>spring-webmvc</artifactId>
            <version>${spring.version}</version>
        </dependency>
        <dependency>
            <groupId>org.springframework</groupId>
            <artifactId>spring-jdbc</artifactId>
            <version>${spring.version}</version>
        </dependency>
        <dependency>
            <groupId>org.springframework</groupId>
            <artifactId>spring-test</artifactId>
            <version>${spring.version}</version>
            <scope>test</scope>
        </dependency>

        <!-- PropertyPlaceholderConfigurer -->
        <dependency>
            <groupId>eionet</groupId>
            <artifactId>property-placeholder-resolver</artifactId>
            <version>1.0</version>
            <type>jar</type>
        </dependency>

        <dependency>
            <groupId>org.mockito</groupId>
            <artifactId>mockito-core</artifactId>
            <version>3.11.2</version>
            <scope>test</scope>
        </dependency>

    </dependencies>
    <reporting>
        <plugins>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-pmd-plugin</artifactId>
                <version>3.14.0</version>
                <configuration>
                    <linkXRef>false</linkXRef>
                    <sourceEncoding>utf-8</sourceEncoding>
                    <minimumTokens>300</minimumTokens>
                    <targetJdk>${javaVersion}</targetJdk>
                </configuration>
            </plugin>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-checkstyle-plugin</artifactId>
                <version>3.1.2</version>
                <configuration>
                    <configLocation>${checkstyle.config.location}</configLocation>
                </configuration>
            </plugin>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-jxr-plugin</artifactId>
                <version>2.5</version>
            </plugin>
        </plugins>
    </reporting>

</project>

## 内容2
### 文件路径：
src/main/java/eionet/cr/web/action/TagSearchActionBean.java
### 代码内容：
package eionet.cr.web.action;

import java.util.ArrayList;
import java.util.LinkedList;
import java.util.List;

import net.sourceforge.stripes.action.DefaultHandler;
import net.sourceforge.stripes.action.ForwardResolution;
import net.sourceforge.stripes.action.Resolution;
import net.sourceforge.stripes.action.UrlBinding;
import eionet.cr.common.Predicates;
import eionet.cr.config.GeneralConfig;
import eionet.cr.dao.DAOException;
import eionet.cr.dao.DAOFactory;
import eionet.cr.dao.SearchDAO;
import eionet.cr.dto.SearchResultDTO;
import eionet.cr.dto.SubjectDTO;
import eionet.cr.dto.TagDTO;
import eionet.cr.util.SortOrder;
import eionet.cr.util.SortingRequest;
import eionet.cr.util.pagination.PagingRequest;
import eionet.cr.web.util.ApplicationCache;
import eionet.cr.web.util.columns.SearchResultColumn;
import eionet.cr.web.util.columns.SubjectPredicateColumn;

/**
 *
 * @author <a href="mailto:enriko.kasper@tieto.com">Enriko Käsper</a>
 *
 */

@UrlBinding("/tagSearch.action")
public class TagSearchActionBean extends AbstractSearchActionBean<SubjectDTO> {

    /** */
    private static final String TAG_SEARCH_PATH = "/pages/tagSearch.jsp";
    private static final String SELECTED_TAGS_CACHE = TypeSearchActionBean.class.getName() + ".selectedTagsCache";

    /** */
    private List<TagDTO> tagCloud;
    private String cloudSorted = "name";
    private String searchTag;
    private String queryString;

    // selected tags
    private List<String> selectedTags;
    // columns
    private static final ArrayList<SearchResultColumn> columns;

    private int tagCloudSize = Integer.parseInt(GeneralConfig.getProperty(GeneralConfig.TAGCOLUD_TAGSEARCH_SIZE));

    static {
        columns = new ArrayList<SearchResultColumn>();

        SubjectPredicateColumn col = new SubjectPredicateColumn();
        col.setPredicateUri(Predicates.RDF_TYPE);
        col.setTitle("Type");
        col.setSortable(true);
        columns.add(col);

        col = new SubjectPredicateColumn();
        col.setPredicateUri(Predicates.RDFS_LABEL);
        col.setTitle("Label");
        col.setSortable(true);
        columns.add(col);

        col = new SubjectPredicateColumn();
        col.setPredicateUri(Predicates.CR_TAG);
        col.setTitle("Tags");
        col.setSortable(false);
        columns.add(col);
    }

    /**
     * @return
     * @throws Exception
     */
    @DefaultHandler
    public Resolution preparePage() throws Exception {
        tagCloud = ApplicationCache.getTagCloudSortedByName(tagCloudSize);
        return new ForwardResolution(TAG_SEARCH_PATH);
    }

    public Resolution sortByName() throws Exception {
        tagCloud = ApplicationCache.getTagCloudSortedByName(tagCloudSize);
        cloudSorted = "name";
        return new ForwardResolution(TAG_SEARCH_PATH);
    }

    public Resolution sortByCount() throws Exception {
        tagCloud = ApplicationCache.getTagCloudSortedByCount(tagCloudSize);
        cloudSorted = "count";
        return new ForwardResolution(TAG_SEARCH_PATH);
    }

    @Override
    public Resolution search() throws DAOException {

        if ((searchTag == null || searchTag.isEmpty()) && (selectedTags == null || selectedTags.isEmpty())) {
            return new ForwardResolution(TAG_SEARCH_PATH);
        }
        if (selectedTags == null) {
            selectedTags = new LinkedList<String>();
        }

        if (!selectedTags.contains(searchTag) && searchTag != null && !searchTag.isEmpty()) {
            selectedTags.add(getSearchTag().trim());
        }

        SearchResultDTO<SubjectDTO> searchResult =
                DAOFactory
                        .get()
                        .getDao(SearchDAO.class)
                        .searchByTags(selectedTags, PagingRequest.create(getPageN()),
                                new SortingRequest(getSortP(), SortOrder.parse(getSortO())));
        resultList = searchResult.getItems();
        matchCount = searchResult.getMatchCount();
        queryString = searchResult.getQuery();
        this.getContext().getRequest().setAttribute("searchTag", "");

        getSession().setAttribute(SELECTED_TAGS_CACHE, selectedTags);

        return new ForwardResolution(TAG_SEARCH_PATH).addParameter("searchTag", "");
    }

    /*
     * reads the selected tag list from session
     */
    @SuppressWarnings("unchecked")
    public Resolution addTag() throws DAOException {
        selectedTags = (List<String>) getSession().getAttribute(SELECTED_TAGS_CACHE);

        return search();
    }

    @SuppressWarnings("unchecked")
    public Resolution removeTag() throws Exception {
        selectedTags = (List<String>) getSession().getAttribute(SELECTED_TAGS_CACHE);
        if (selectedTags != null && !selectedTags.isEmpty()) {
            selectedTags.remove(searchTag);
        }
        searchTag = "";

        Resolution result = null;
        if (selectedTags.size() == 0) {
            result = preparePage();
        } else {
            result = search();
        }
        if (result instanceof ForwardResolution) {
            ((ForwardResolution) result).addParameter("searchTag", "");
        }
        return result;
    }

    public List<TagDTO> getTagCloud() {
        return tagCloud;
    }

    public void setTagCloud(List<TagDTO> tagCloud) {
        this.tagCloud = tagCloud;
    }

    public String getCloudSorted() {
        return cloudSorted;
    }

    public String getSearchTag() {
        return searchTag;
    }

    public void setSearchTag(String searchTag) {
        this.searchTag = searchTag;
    }

    public List<String> getSelectedTags() {
        return selectedTags;
    }

    public void setSelectedTags(List<String> selectedTags) {
        this.selectedTags = selectedTags;
    }

    @Override
    public List<SearchResultColumn> getColumns() throws DAOException {
        return columns;
    }

    /**
     * @return the queryString
     */
    public String getQueryString() {
        return queryString;
    }

}

## 内容3
### 文件路径：
src/main/java/eionet/cr/web/action/factsheet/FactsheetActionBean.java
### 代码内容：
package eionet.cr.web.action.factsheet;

import java.util.ArrayList;
import java.util.Collection;
import java.util.Collections;
import java.util.HashMap;
import java.util.List;
import java.util.Map;

import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpSession;

import net.sourceforge.stripes.action.DefaultHandler;
import net.sourceforge.stripes.action.ForwardResolution;
import net.sourceforge.stripes.action.HandlesEvent;
import net.sourceforge.stripes.action.RedirectResolution;
import net.sourceforge.stripes.action.Resolution;
import net.sourceforge.stripes.action.StreamingResolution;
import net.sourceforge.stripes.action.UrlBinding;
import net.sourceforge.stripes.validation.SimpleError;
import net.sourceforge.stripes.validation.ValidationMethod;

import org.apache.commons.lang.StringEscapeUtils;
import org.apache.commons.lang.StringUtils;
import org.apache.commons.lang.math.NumberUtils;

import eionet.cr.common.Predicates;
import eionet.cr.common.Subjects;
import eionet.cr.config.GeneralConfig;
import eionet.cr.dao.CompiledDatasetDAO;
import eionet.cr.dao.DAOException;
import eionet.cr.dao.DAOFactory;
import eionet.cr.dao.HarvestSourceDAO;
import eionet.cr.dao.HelperDAO;
import eionet.cr.dao.SpoBinaryDAO;
import eionet.cr.dao.util.UriLabelPair;
import eionet.cr.dao.virtuoso.PredicateObjectsReader;
import eionet.cr.dataset.CurrentLoadedDatasets;
import eionet.cr.dto.DatasetDTO;
import eionet.cr.dto.FactsheetDTO;
import eionet.cr.dto.HarvestSourceDTO;
import eionet.cr.dto.ObjectDTO;
import eionet.cr.dto.SubjectDTO;
import eionet.cr.dto.TripleDTO;
import eionet.cr.harvest.CurrentHarvests;
import eionet.cr.harvest.HarvestException;
import eionet.cr.harvest.OnDemandHarvester;
import eionet.cr.harvest.scheduled.UrgentHarvestQueue;
import eionet.cr.harvest.util.CsvImportUtil;
import eionet.cr.util.Pair;
import eionet.cr.util.URLUtil;
import eionet.cr.util.Util;
import eionet.cr.web.action.AbstractActionBean;
import eionet.cr.web.action.source.ViewSourceActionBean;
import eionet.cr.web.util.ApplicationCache;
import eionet.cr.web.util.tabs.FactsheetTabMenuHelper;
import eionet.cr.web.util.tabs.TabElement;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;

/**
 * Factsheet.
 *
 * @author <a href="mailto:jaanus.heinlaid@tietoenator.com">Jaanus Heinlaid</a>
 *
 */
@UrlBinding("/factsheet.action")
public class FactsheetActionBean extends AbstractActionBean {

    private static final Logger LOGGER = LoggerFactory.getLogger(FactsheetActionBean.class);

    /** Prefix for the name of the "which page of predicate values to display" request parameter. */
    public static final String PAGE_PARAM_PREFIX = "page";

    /** Name for session attributes for addible properties. */
    private static final String ADDIBLE_PROPERTIES_SESSION_ATTR = FactsheetActionBean.class.getName() + ".addibleProperties";

    /** URI by which the factsheet has been requested. */
    private String uri;

    /** URI hash by which the factsheet has been requested. Ignored when factsheet requested by URI. */
    private long uriHash;

    /** The subject data object found by the requestd URI or URI hash. */
    private FactsheetDTO subject;

    /** Used in factsheet edit mode only, where it indicates if the subject is anonymous. */
    private boolean anonymous;

    /** */
    private String propertyUri;
    /** */
    private String propertyValue;

    /** List of identifiers of property-value rows submitted from factsheet edit form. */
    private List<String> rowId;

    /** True if the session bears a user and it happens to be an administrator. Otherwise false. */
    private boolean adminLoggedIn;

    /** True if the found subject is a bookmark of the logged-in user. In all other cases false. */
    private Boolean subjectIsUserBookmark;

    /** True if the found subject has downloadable content in filestore. */
    private Boolean subjectDownloadable;

    /** True, if URI is harvest source. */
    private boolean uriIsHarvestSource;

    /** True, if URI is local folder. */
    private boolean uriIsFolder;

    /** */
    private String bookmarkLabel;

    /** */
    private Map<String, Integer> predicatePageNumbers;
    private Map<String, Integer> predicatePageCounts;

    /** */
    private List<TabElement> tabs;

    /** */
    private Boolean subjectIsType = null;

    /** */
    private String predicateUri;
    private String objectMD5;
    private String graphUri;

    /** */
    private List<DatasetDTO> userCompiledDatasets;

    /** */
    private HarvestSourceDTO harvestSourceDTO;

    /**
     *
     * @return Resolution
     * @throws DAOException
     *             if query fails
     */
    @DefaultHandler
    public Resolution view() throws DAOException {

        if (isNoCriteria()) {
            addCautionMessage("No request criteria specified!");
        } else {
            HelperDAO helperDAO = DAOFactory.get().getDao(HelperDAO.class);

            adminLoggedIn = getUser() != null && getUser().isAdministrator();

            subject = helperDAO.getFactsheet(uri, null, getPredicatePageNumbers());

            FactsheetTabMenuHelper tabsHelper = new FactsheetTabMenuHelper(uri, subject, factory.getDao(HarvestSourceDAO.class));

            tabs = tabsHelper.getTabs(FactsheetTabMenuHelper.TabTitle.RESOURCE_PROPERTIES);
            uriIsHarvestSource = tabsHelper.isUriIsHarvestSource();
            uriIsFolder = tabsHelper.isUriFolder();
            harvestSourceDTO = tabsHelper.getHarvestSourceDTO();
        }

        return new ForwardResolution("/pages/factsheet/factsheet.jsp");
    }

    /**
     * Schedules a harvest for resource.
     *
     * @return view resolution
     * @throws HarvestException
     *             if harvesting fails
     * @throws DAOException
     *             if query fails
     */
    public Resolution harvest() throws HarvestException, DAOException {

        HelperDAO helperDAO = DAOFactory.get().getDao(HelperDAO.class);
        SubjectDTO subjectDTO = helperDAO.getSubject(uri);

        if (subjectDTO != null && CsvImportUtil.isSourceTableFile(subjectDTO)) {

            // Special block for harvesting table files.
            try {
                List<String> warnings = CsvImportUtil.harvestTableFile(subjectDTO, getUserName());
                for (String msg : warnings) {
                    addWarningMessage(msg);
                }
                addSystemMessage("Source successfully harvested!");
            } catch (Exception e) {
                LOGGER.error("Failed to harvest table file", e);
                addWarningMessage("Failed to harvest table file: " + e.getMessage());
            }
        } else {

            // Block for harvesting other, i.e. non-table-file sources.
            Pair<Boolean, String> message = harvestNow();
            if (message.getLeft()) {
                addWarningMessage(message.getRight());
            } else {
                addSystemMessage(message.getRight());
            }
        }

        return new RedirectResolution(this.getClass(), "view").addParameter("uri", uri);
    }

    /**
     * helper method to eliminate code duplication.
     *
     * @return Pair<Boolean, String> feedback messages
     * @throws HarvestException
     *             if harvesting fails
     * @throws DAOException
     *             if query fails
     */
    private Pair<Boolean, String> harvestNow() throws HarvestException, DAOException {

        String message = null;
        if (isUserLoggedIn()) {
            if (!StringUtils.isBlank(uri) && URLUtil.isURL(uri)) {

                // Add this URL into HARVEST_SOURCE table.

                HarvestSourceDAO dao = factory.getDao(HarvestSourceDAO.class);
                HarvestSourceDTO dto = new HarvestSourceDTO();
                dto.setUrl(StringUtils.substringBefore(uri, "#"));
                dto.setEmails("");
                dto.setIntervalMinutes(GeneralConfig.getDefaultHarvestIntervalMinutes());
                dto.setPrioritySource(false);
                dto.setOwner(null);
                dao.addSourceIgnoreDuplicate(dto);

                // Issue an instant harvest of this URL.

                OnDemandHarvester.Resolution resolution = OnDemandHarvester.harvest(dto.getUrl(), getUserName());

                // Give feedback to the user.

                if (resolution.equals(OnDemandHarvester.Resolution.ALREADY_HARVESTING)) {
                    message = "The resource is currently being harvested by another user or background harvester!";
                } else if (resolution.equals(OnDemandHarvester.Resolution.UNCOMPLETE)) {
                    message = "The harvest hasn't finished yet, but continues in the background!";
                } else if (resolution.equals(OnDemandHarvester.Resolution.COMPLETE)) {
                    message = "The harvest has been completed!";
                } else if (resolution.equals(OnDemandHarvester.Resolution.SOURCE_UNAVAILABLE)) {
                    message = "The resource was not available!";
                } else if (resolution.equals(OnDemandHarvester.Resolution.NO_STRUCTURED_DATA)) {
                    message = "The resource contained no RDF data!";
                } else {
                    message = "No feedback given from harvest!";
                }
            }
            return new Pair<Boolean, String>(false, message);
        } else {
            return new Pair<Boolean, String>(true, getBundle().getString("not.logged.in"));
        }
    }

    /**
     *
     * @return Resolution
     * @throws DAOException
     *             if query fails if query fails
     */
    public Resolution edit() throws DAOException {

        return view();
    }

    /**
     *
     * @return Resolution
     * @throws DAOException
     *             if query fails if query fails
     */
    public Resolution addbookmark() throws DAOException {
        if (isUserLoggedIn()) {
            DAOFactory.get().getDao(HelperDAO.class).addUserBookmark(getUser(), getUrl(), bookmarkLabel);
            addSystemMessage("Succesfully bookmarked this source.");
        } else {
            addSystemMessage("Only logged in users can bookmark sources.");
        }
        return view();
    }

    /**
     *
     * @return Resolution
     * @throws DAOException
     *             if query fails
     */
    public Resolution removebookmark() throws DAOException {
        if (isUserLoggedIn()) {
            DAOFactory.get().getDao(HelperDAO.class).deleteUserBookmark(getUser(), getUrl());
            addSystemMessage("Succesfully removed this source from bookmarks.");
        } else {
            addSystemMessage("Only logged in users can remove bookmarks.");
        }
        return view();
    }

    /**
     *
     * @return Resolution
     * @throws DAOException
     *             if query fails if query fails
     */
    public Resolution save() throws DAOException {

        SubjectDTO subjectDTO = new SubjectDTO(uri, anonymous);

        if (propertyUri.equals(Predicates.CR_TAG)) {
            List<String> tags = Util.splitStringBySpacesExpectBetweenQuotes(propertyValue);

            for (String tag : tags) {
                ObjectDTO objectDTO = new ObjectDTO(tag, true);
                objectDTO.setSourceUri(getUser().getRegistrationsUri());
                subjectDTO.addObject(propertyUri, objectDTO);
            }
        } else {
            // other properties
            ObjectDTO objectDTO = new ObjectDTO(propertyValue, true);
            objectDTO.setSourceUri(getUser().getRegistrationsUri());
            subjectDTO.addObject(propertyUri, objectDTO);
        }

        HelperDAO helperDao = factory.getDao(HelperDAO.class);
        helperDao.addTriples(subjectDTO);
        helperDao.updateUserHistory(getUser(), uri);

        // since user registrations URI was used as triple source, add it to HARVEST_SOURCE too
        // (but set interval minutes to 0, to avoid it being background-harvested)
        DAOFactory
                .get()
                .getDao(HarvestSourceDAO.class)
                .addSourceIgnoreDuplicate(
                        HarvestSourceDTO.create(getUser().getRegistrationsUri(), true, 0, getUser().getUserName()));

        return new RedirectResolution(this.getClass(), "edit").addParameter("uri", uri);
    }

    /**
     *
     * @return Resolution
     * @throws DAOException
     *             if query fails
     */
    public Resolution delete() throws DAOException {

        if (rowId != null && !rowId.isEmpty()) {

            ArrayList<TripleDTO> triples = new ArrayList<TripleDTO>();

            for (String row : rowId) {
                int i = row.indexOf("_");
                if (i <= 0 || i == (row.length() - 1)) {
                    throw new IllegalArgumentException("Illegal rowId: " + row);
                }

                String predicateHash = row.substring(0, i);
                String predicate = getContext().getRequestParameter("pred_".concat(predicateHash));

                String objectHash = row.substring(i + 1);
                String objectValue = getContext().getRequest().getParameter("obj_".concat(objectHash));
                String sourceUri = getContext().getRequest().getParameter("source_".concat(objectHash));

                TripleDTO triple = new TripleDTO(uri, predicate, objectValue);
                // FIXME - find a better way to determine if the object is literal or not, URIs may be literals also
                triple.setLiteralObject(!URLUtil.isURL(objectValue));
                triple.setSourceUri(sourceUri);

                triples.add(triple);
            }

            HelperDAO helperDao = factory.getDao(HelperDAO.class);
            helperDao.deleteTriples(triples);
            helperDao.updateUserHistory(getUser(), uri);
        }

        return new RedirectResolution(this.getClass(), "edit").addParameter("uri", uri);
    }

    /**
     * Validates if user is logged on and if event property is not empty.
     */
    @ValidationMethod(on = {"save", "delete", "edit", "harvest"})
    public void validateUserKnown() {

        if (getUser() == null) {
            addWarningMessage("Operation not allowed for anonymous users");
        } else if (getContext().getEventName().equals("save") && StringUtils.isBlank(propertyValue)) {
            addGlobalValidationError(new SimpleError("Property value must not be blank"));
        }
    }

    /**
     * @return the resourceUri
     */
    public String getUri() {
        return uri;
    }

    /**
     * @param resourceUri
     *            the resourceUri to set
     */
    public void setUri(final String resourceUri) {
        this.uri = resourceUri;
    }

    /**
     * @return the resource
     */
    public FactsheetDTO getSubject() {
        return subject;
    }

    /**
     * @return the addibleProperties
     * @throws DAOException
     *             if query fails
     */
    @SuppressWarnings("unchecked")
    public Collection<UriLabelPair> getAddibleProperties() throws DAOException {

        // get the addible properties from session

        HttpSession session = getContext().getRequest().getSession();
        ArrayList<UriLabelPair> result = (ArrayList<UriLabelPair>) session.getAttribute(ADDIBLE_PROPERTIES_SESSION_ATTR);

        // if not in session, create them and add to session
        if (result == null || result.isEmpty()) {

            // get addible properties from database

            HelperDAO helperDAO = factory.getDao(HelperDAO.class);
            HashMap<String, String> props = helperDAO.getAddibleProperties(uri);

            // add some hard-coded properties, HashMap assures there won't be duplicates
            props.put(Predicates.RDFS_LABEL, "Title");
            props.put(Predicates.CR_TAG, "Tag");
            props.put(Predicates.RDFS_COMMENT, "Other comments"); // Don't use
            props.put(Predicates.DC_DESCRIPTION, "Description");
            props.put(Predicates.CR_HAS_SOURCE, "hasSource");
            props.put(Predicates.ROD_PRODUCT_OF, "productOf");

            // create the result object from the found and hard-coded properties, sort it

            result = new ArrayList<UriLabelPair>();
            if (props != null && !props.isEmpty()) {

                for (String propUri : props.keySet()) {
                    result.add(UriLabelPair.create(propUri, props.get(propUri)));
                }
                Collections.sort(result);
            }

            // put into session
            session.setAttribute(ADDIBLE_PROPERTIES_SESSION_ATTR, result);
        }

        return result;
    }

    /**
     * @param anonymous
     *            the anonymous to set
     */
    public void setAnonymous(final boolean anonymous) {
        this.anonymous = anonymous;
    }

    /**
     * @param propertyUri
     *            the propertyUri to set
     */
    public void setPropertyUri(final String propertyUri) {
        this.propertyUri = propertyUri;
    }

    /**
     * @param propertyValue
     *            the propertyValue to set
     */
    public void setPropertyValue(final String propertyValue) {
        this.propertyValue = propertyValue;
    }

    /**
     * @param rowId
     *            the rowId to set
     */
    public void setRowId(final List<String> rowId) {
        this.rowId = rowId;
    }

    /**
     * @return the noCriteria
     */
    public boolean isNoCriteria() {
        return StringUtils.isBlank(uri);
    }

    /**
     * @return the uriHash
     */
    public long getUriHash() {
        return uriHash;
    }

    /**
     * @param uriHash
     *            the uriHash to set
     */
    public void setUriHash(final long uriHash) {
        this.uriHash = uriHash;
    }

    /**
     *
     * @return String
     */
    public String getUrl() {
        return uri != null && URLUtil.isURL(uri) ? uri : null;
    }

    /**
     * True if admin is logged in.
     *
     * @return boolean
     */
    public boolean isAdminLoggedIn() {
        return adminLoggedIn;
    }

    /**
     *
     * @return boolean
     * @throws DAOException
     *             if query fails if query fails
     */
    public boolean getSubjectIsUserBookmark() throws DAOException {

        if (!isUserLoggedIn()) {
            return false;
        }

        if (subjectIsUserBookmark == null) {
            subjectIsUserBookmark = Boolean.valueOf(factory.getDao(HelperDAO.class).isSubjectUserBookmark(getUser(), uri));
        }

        return subjectIsUserBookmark.booleanValue();
    }

    /**
     * @return the subjectDownloadable
     * @throws DAOException
     */
    public boolean isSubjectDownloadable() throws DAOException {

        if (subjectDownloadable == null) {
            subjectDownloadable = Boolean.valueOf(DAOFactory.get().getDao(SpoBinaryDAO.class).exists(uri));
        }
        return subjectDownloadable.booleanValue();
    }

    /**
     *
     * @return boolean
     * @throws DAOException
     */
    public boolean isCurrentlyHarvested() throws DAOException {

        return uri == null ? false : (CurrentHarvests.contains(uri) || UrgentHarvestQueue.isInQueue(uri) || CurrentLoadedDatasets
                .contains(uri));
    }

    /**
     *
     * @return boolean
     */
    public boolean isCompiledDataset() {

        boolean ret = false;

        if (subject.getObject(Predicates.RDF_TYPE) != null) {
            ret = Subjects.CR_COMPILED_DATASET.equals(subject.getObject(Predicates.RDF_TYPE).getValue());
        }

        return ret;
    }

    /**
     *
     * @return Resolution
     * @throws DAOException
     */
    public Resolution showOnMap() throws DAOException {
        HelperDAO helperDAO = DAOFactory.get().getDao(HelperDAO.class);
        subject = helperDAO.getFactsheet(uri, null, null);

        FactsheetTabMenuHelper helper = new FactsheetTabMenuHelper(uri, subject, factory.getDao(HarvestSourceDAO.class));
        tabs = helper.getTabs(FactsheetTabMenuHelper.TabTitle.SHOW_ON_MAP);
        return new ForwardResolution("/pages/factsheet/map.jsp");
    }

    public boolean isUriIsHarvestSource() {
        return uriIsHarvestSource;
    }

    /**
     *
     * @return
     */
    public String getBookmarkLabel() {
        return bookmarkLabel;
    }

    /**
     *
     * @param bookmarkLabel
     */
    public void setBookmarkLabel(String bookmarkLabel) {
        this.bookmarkLabel = bookmarkLabel;
    }

    /**
     * @return the predicatePages
     */
    @SuppressWarnings("unchecked")
    public Map<String, Integer> getPredicatePageNumbers() {

        if (predicatePageNumbers == null) {

            predicatePageNumbers = new HashMap<String, Integer>();
            HttpServletRequest request = getContext().getRequest();
            Map<String, String[]> paramsMap = request.getParameterMap();

            if (paramsMap != null && !paramsMap.isEmpty()) {

                for (Map.Entry<String, String[]> entry : paramsMap.entrySet()) {

                    String paramName = entry.getKey();
                    if (isPredicatePageParam(paramName)) {

                        int pageNumber = NumberUtils.toInt(paramName.substring(PAGE_PARAM_PREFIX.length()));
                        if (pageNumber > 0) {

                            String[] predicateUris = entry.getValue();
                            if (predicateUris != null) {
                                for (String predUri : predicateUris) {
                                    predicatePageNumbers.put(predUri, pageNumber);
                                }
                            }
                        }
                    }
                }
            }
        }

        return predicatePageNumbers;
    }

    /**
     *
     * @param paramName
     * @return
     */
    public boolean isPredicatePageParam(String paramName) {

        if (paramName.startsWith(PAGE_PARAM_PREFIX) && paramName.length() > PAGE_PARAM_PREFIX.length()) {
            return StringUtils.isNumeric(paramName.substring(PAGE_PARAM_PREFIX.length()));
        } else {
            return false;
        }
    }

    /**
     *
     * @return
     */
    public int getPredicatePageSize() {

        return PredicateObjectsReader.PREDICATE_PAGE_SIZE;
    }

    /**
     *
     * @return
     */
    public List<TabElement> getTabs() {
        return tabs;
    }

    /**
     *
     * @return
     */
    public boolean getSubjectIsType() {

        if (subjectIsType == null) {

            List<String> typeUris = ApplicationCache.getTypeUris();
            subjectIsType = Boolean.valueOf(typeUris.contains(this.uri));
        }

        return subjectIsType;
    }

    /**
     *
     * @return
     */
    @HandlesEvent("openPredObjValue")
    public Resolution openPredObjValue() {

        LOGGER.trace("Retrieving object value for MD5 " + objectMD5 + " of predicate " + predicateUri);
        String value = DAOFactory.get().getDao(HelperDAO.class).getLiteralObjectValue(uri, predicateUri, objectMD5, graphUri);
        if (StringUtils.isBlank(value)) {
            value = "Found no value!";
        } else {
            value = StringEscapeUtils.escapeXml(value);
        }
        return new StreamingResolution("text/html", value);
    }

    /**
     * @param predicateUri
     *            the predicateUri to set
     */
    public void setPredicateUri(String predicateUri) {
        this.predicateUri = predicateUri;
    }

    /**
     * @param objectMD5
     *            the objectMD5 to set
     */
    public void setObjectMD5(String objectMD5) {
        this.objectMD5 = objectMD5;
    }

    /**
     * @param graphUri
     *            the graphUri to set
     */
    public void setGraphUri(String graphUri) {
        this.graphUri = graphUri;
    }

    /**
     *
     * @return
     */
    public List<DatasetDTO> getUserCompiledDatasets() {
        if (userCompiledDatasets == null && !StringUtils.isBlank(uri)) {
            try {
                CompiledDatasetDAO dao = DAOFactory.get().getDao(CompiledDatasetDAO.class);
                userCompiledDatasets = dao.getCompiledDatasets(getUser().getHomeUri(), uri);
            } catch (DAOException e) {
                e.printStackTrace();
            }
        }
        return userCompiledDatasets;
    }

    /**
     *
     * @param userCompiledDatasets
     */
    public void setUserCompiledDatasets(List<DatasetDTO> userCompiledDatasets) {
        this.userCompiledDatasets = userCompiledDatasets;
    }

    /**
     *
     * @return
     */
    public Class<ViewSourceActionBean> getViewSourceActionBeanClass() {
        return ViewSourceActionBean.class;
    }

    /**
     *
     * @return
     */
    public boolean isUriIsFolder() {
        return uriIsFolder;
    }

    /**
     *
     * @param uriIsFolder
     */
    public void setUriIsFolder(boolean uriIsFolder) {
        this.uriIsFolder = uriIsFolder;

    }

    /**
     * @return the harvestSourceDTO
     */
    public HarvestSourceDTO getHarvestSourceDTO() {
        return harvestSourceDTO;
    }

}

Output:
【漏洞类型】跨站脚本（XSS）注入漏洞
【严重性】High
【漏洞摘要】这是一个跨站脚本（XSS）注入漏洞。具体表现为未对用户输入进行适当的HTML转义。在`TagSearchActionBean.java`和`FactsheetActionBean.java`中，用户输入的`searchTag`和`uri`字段直接被设置到类的属性中，并在JSP页面中输出，而没有进行转义处理。这可能导致恶意用户通过注入恶意脚本，操纵网页内容或窃取用户信息。
【关键代码模式】`StringEscapeUtils.escapeHtml`，未验证的用户输入。
【修复方法说明】通过在设置用户输入字段时使用`StringEscapeUtils.escapeHtml`对输入进行HTML转义，有效防止了XSS攻击。


Instruction:
作为 Java 安全专家，检测此代码中的安全漏洞：
## 内容1
### 文件路径：
src/main/java/bspkrs/mmv/RemoteZipHandler.java
### 代码内容：
package bspkrs.mmv;

import java.io.File;
import java.io.FileInputStream;
import java.io.FileNotFoundException;
import java.io.FileOutputStream;
import java.io.FileWriter;
import java.io.IOException;
import java.io.InputStream;
import java.io.OutputStream;
import java.io.PrintWriter;
import java.net.MalformedURLException;
import java.net.URL;
import java.net.URLConnection;
import java.security.DigestException;
import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;
import java.util.ArrayList;
import java.util.List;
import java.util.Scanner;
import java.util.zip.ZipEntry;
import java.util.zip.ZipInputStream;

import bspkrs.mmv.gui.MappingGui;

public class RemoteZipHandler
{
    private final URL    zipUrl;
    private final URL    digestUrl;
    private final File   localDir;
    private final String digestType;
    private final String zipFileName;

    public RemoteZipHandler(String urlString, File dir, String digestType) throws MalformedURLException
    {
        zipUrl = new URL(urlString);
        if (digestType != null)
            digestUrl = new URL(urlString + "." + digestType.toLowerCase());
        else
            digestUrl = null;
        String[] tokens = urlString.split("/");
        zipFileName = tokens[tokens.length - 1];
        localDir = dir;
        this.digestType = digestType;
    }

    public void checkRemoteZip() throws IOException, NoSuchAlgorithmException, DigestException
    {
        // fetch zip file sha1
        boolean fetchZip = true;
        String remoteHash = null;
        File digestFile = null;
        if (digestType != null)
        {
            // check hash against local hash if exists
            remoteHash = loadTextFromURL(digestUrl, new String[] { "" })[0];
            if (!remoteHash.isEmpty())
            {
                digestFile = new File(localDir, zipFileName + "." + digestType.toLowerCase());

                // if local digest exists and hashes match skip getting the zip file
                if (digestFile.exists())
                {
                    String existingHash = loadTextFromFile(digestFile, new String[] { "" })[0];
                    if (!existingHash.isEmpty() && remoteHash.equals(existingHash))
                        fetchZip = false;
                }
            }
        }

        if (fetchZip)
        {
            // download zip
            File localZip = new File(localDir, zipFileName);
            if (localZip.exists())
                localZip.delete();
            OutputStream output = new FileOutputStream(localZip);
            try
            {
                URLConnection uc = zipUrl.openConnection();
                uc.addRequestProperty("User-Agent", "MMV/" + MappingGui.VERSION_NUMBER);
                byte[] buffer = new byte[1024]; // Or whatever
                int bytesRead;
                try (InputStream is = uc.getInputStream())
                {
                    while ((bytesRead = is.read(buffer)) > 0)
                        output.write(buffer, 0, bytesRead);
                }
            }
            finally
            {
                output.close();
            }

            // Check hash of downloaded file to ensure we received it correctly
            if (digestType != null && !remoteHash.isEmpty())
            {
                String downloadHash = getFileDigest(new FileInputStream(localZip), digestType);
                if (!remoteHash.equals(downloadHash))
                    throw new java.security.DigestException("Remote digest does not match digest of downloaded file!");
            }

            // extract zip file
            extractZip(localZip, localDir);
            if (localZip.exists())
                localZip.delete();

            // save new hash after successful extract
            if (digestType != null && !remoteHash.isEmpty())
            {
                if (digestFile.exists())
                    digestFile.delete();
                digestFile.createNewFile();
                PrintWriter out = new PrintWriter(new FileWriter(digestFile));
                out.print(remoteHash);
                out.close();
            }
        }
    }

    public static String[] loadTextFromURL(URL url, String[] defaultValue)
    {
        List<String> arraylist = new ArrayList<String>();
        Scanner scanner = null;
        try
        {
            URLConnection uc = url.openConnection();
            uc.addRequestProperty("User-Agent", "MMV/" + MappingGui.VERSION_NUMBER);
            InputStream is = uc.getInputStream();
            scanner = new Scanner(is, "UTF-8");

            while (scanner.hasNextLine())
            {
                arraylist.add(scanner.nextLine());
            }
        }
        catch (Throwable e)
        {
            return defaultValue;
        }
        finally
        {
            if (scanner != null)
                scanner.close();
        }
        return arraylist.toArray(new String[arraylist.size()]);
    }

    public static String[] loadTextFromFile(File file, String[] defaultValue)
    {
        ArrayList<String> lines = new ArrayList<String>();

        Scanner scanner = null;
        try
        {
            scanner = new Scanner(file);
            while (scanner.hasNextLine())
                lines.add(scanner.nextLine());
        }
        catch (FileNotFoundException e)
        {
            return defaultValue;
        }
        finally
        {
            if (scanner != null)
                scanner.close();
        }

        return lines.toArray(new String[lines.size()]);
    }

    public static String getFileDigest(InputStream is, String digestType) throws NoSuchAlgorithmException, IOException
    {
        MessageDigest md = MessageDigest.getInstance(digestType);
        byte[] dataBytes = new byte[1024];

        int nread = 0;

        while ((nread = is.read(dataBytes)) != -1)
            md.update(dataBytes, 0, nread);

        is.close();

        byte[] mdbytes = md.digest();

        //convert the byte to hex format
        StringBuffer sb = new StringBuffer("");
        for (int i = 0; i < mdbytes.length; i++)
            sb.append(Integer.toString((mdbytes[i] & 0xff) + 0x100, 16).substring(1));
        return sb.toString();
    }

    public static void extractZip(File zipFile, File destDir) throws IOException
    {
        byte[] buffer = new byte[1024];
        if (!destDir.exists())
            destDir.mkdirs();

        ZipInputStream zis = new ZipInputStream(new FileInputStream(zipFile));
        ZipEntry ze = zis.getNextEntry();
        try
        {
            while (ze != null)
            {
                String fileName = ze.getName();
                File newFile = new File(destDir, fileName);
                if (ze.isDirectory())
                {
                    if (newFile.exists())
                        deleteDirAndContents(newFile);
                    newFile.mkdirs();
                }
                else
                {
                    if (newFile.exists())
                        newFile.delete();
                    if (newFile.getParentFile() != null && !newFile.getParentFile().exists())
                        newFile.getParentFile().mkdirs();
                    FileOutputStream fos = new FileOutputStream(newFile);
                    int len;
                    while ((len = zis.read(buffer)) > 0)
                        fos.write(buffer, 0, len);

                    fos.close();
                }
                ze = zis.getNextEntry();
            }
        }
        finally
        {
            zis.closeEntry();
            zis.close();
        }
    }

    public static boolean deleteDirAndContents(File dir)
    {
        if (dir.isDirectory())
        {
            String[] children = dir.list();
            for (int i = 0; i < children.length; i++)
            {
                boolean success = deleteDirAndContents(new File(dir, children[i]));
                if (!success)
                    return false;
            }
        }
        return dir.delete();
    }
}

Output:
【漏洞类型】路径遍历漏洞
【严重性】高
【漏洞摘要】这是一个路径遍历漏洞。具体表现为在解压ZIP文件时，未对文件路径进行有效的校验，导致攻击者可以通过构造恶意ZIP文件，将文件解压到目标目录的父目录或其他任意目录，从而实现路径遍历攻击。问题行在`extractZip`函数中，当创建新文件时，未检查文件路径是否在目标目录下。
【关键代码模式】与路径遍历漏洞相关的关键代码模式包括：
- 使用未验证的文件路径进行文件操作。
- 在解压ZIP文件时，直接使用ZIP条目的名字来创建文件。
- 未对ZIP条目的路径进行规范化处理，以确保其在预期的目录结构内。
【修复方法说明】修复方法通过在`extractZip`函数中添加路径规范化检查来解决问题。具体来说，通过`newFile.toPath().normalize().startsWith(destDir.toPath().normalize())`来确保解压的文件路径在目标目录下，从而防止路径遍历攻击。适用的最佳实践是始终对文件路径进行规范化和校验，以避免路径遍历漏洞。


Instruction: 作为 Java 安全专家，检测此代码中的安全漏洞：

Output:
【漏洞类型】路径遍历漏洞（Path Traversal）
【严重性】高
【漏洞摘要】这是一个路径遍历漏洞，也被称为Zip Slip漏洞。该漏洞允许攻击者通过精心构造的压缩文件中的路径，将文件提取到目标系统的任意目录中。具体表现为未验证的用户输入在解压文件时被用作文件路径，可能会导致文件被写入到系统中的非法或敏感目录。在原始代码中，可能使用了 `dir.getCanonicalPath().startsWith(parent.getCanonicalPath())` 进行路径验证，但这存在误判的风险，因为 `String` 表示的路径可能会去掉末尾的斜杠，从而导致检查失效。
【关键代码模式】`dir.getCanonicalPath().startsWith(parent.getCanonicalPath())`、`File`、`getCanonicalPath()`、`getCanonicalFile()`、`toPath()`、`startsWith()`
【修复方法说明】修复方法通过使用 `dir.getCanonicalFile().toPath().startsWith(parent.getCanonicalFile().toPath())` 进行路径验证，确保路径检查不因 `String` 表示路径时去掉末尾的斜杠而失效，从而有效防止路径遍历攻击。