Issue with HttpClient in AEM

Question

I have an HttpClient code written that is from org.apache.commons.httpclient package.

In that I am setting connection time and socket time out this way.

final HttpClient http = new HttpClient(this.connectionManager);

http.getParams().setParameter("http.connection.timeout", this.connectionTimeout);
http.getParams().setParameter("http.socket.timeout", this.socketTimeout);

Now the Adobe Cloud has raised issue that timeout is not being set(which is not true). They suggested to set timeouts using

@Reference
private HttpClientBuilderFactory httpClientBuilderFactory;

public void doThis() {
  HttpClientBuilder builder = httpClientBuilderFactory.newBuilder();
  RequestConfig requestConfig = RequestConfig.custom()
    .setConnectTimeout(5000)
    .setSocketTimeout(5000)
    .build();
  builder.setDefaultRequestConfig(requestConfig);

  HttpClient httpClient = builder.build();

  // do something with the client
}

Refer Link

But HttpClientBuilderFactory does not belong to **org.apache.commons.httpclient it belongs to org.apache.http.client**

And always returns Closable Http client.

How do I resolve this security issue? Can I add an annotation for exception? Or will I have to rewrite all my code?

This issue is with Adobe Experience Manager 6.5 instance.

Answer 1

The problem is Adobe has two versions of HttpClient the old 3.x that has package structure org.apache.commons.httpclient.HttpClient and the one that HttpClientBuilderFactory gives out that is 4.x org.apache.http.Httpclient.

I was breaking my head around this. Finally we were left with two options...

1) Rewrite all our commons http api(3.x) to the newer version of apache.http (4.x) that has the methods setTimeout and setConnectionTimeout

OR

2)@SuppressWarnings("CQRules:ConnectionTimeoutMechanism")

We chose Option number 2 as the effort arround this was huge and we are planning to go live soon.