[ISSUE-2395]SynchronossPartHttpMessageReader should only create temp directory when needed/CVE-2022-2296

[duhanmin]

spring-projects/spring-framework#27092
1 . SynchronossPartHttpMessageReader should only create temp directory when needed
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-22965
2. A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. The specific exploit requires the application to run on Tomcat as a WAR deployment. If the application is deployed as a Spring Boot executable jar, i.e. the default, it is not vulnerable to the exploit. However, the nature of the vulnerability is more general, and there may be other ways to exploit it.

Does this pull request potentially affect one of the following parts:

• Dependencies (does it add or upgrade a dependency): (yes)

#2395

[codecov]

Codecov Report

Merging #2462 (1b58238) into dev-1.2.0 (b462730) will decrease coverage by 1.23%.
The diff coverage is n/a.

@@               Coverage Diff               @@
##             dev-1.2.0    #2462      +/-   ##
===============================================
- Coverage        17.83%   16.59%   -1.24%     
- Complexity        1077     1103      +26     
===============================================
  Files              595      636      +41     
  Lines            17667    19520    +1853     
  Branches          2635     2769     +134     
===============================================
+ Hits              3151     3240      +89     
- Misses           14092    15843    +1751     
- Partials           424      437      +13     

Impacted Files	Coverage Δ
...apache/linkis/scheduler/future/BDPFutureTask.scala	70.00% <0.00%> (-5.00%)	⬇️
...s/scheduler/queue/fifoqueue/FIFOUserConsumer.scala	35.55% <0.00%> (-2.23%)	⬇️
...org/apache/linkis/common/utils/VariableUtils.scala	59.77% <0.00%> (-0.35%)	⬇️
...n/java/org/apache/linkis/common/utils/DESUtil.java	0.00% <0.00%> (ø)
...a/org/apache/linkis/scheduler/event/LogEvent.scala	50.00% <0.00%> (ø)
...ache/linkis/common/listener/ListenerEventBus.scala	0.00% <0.00%> (ø)
.../apache/linkis/jobhistory/cache/utils/MD5Util.java	0.00% <0.00%> (ø)
.../org/apache/linkis/bml/common/ExecutorManager.java	0.00% <0.00%> (ø)
.../bml/service/impl/BmlShareResourceServiceImpl.java	0.00% <0.00%> (ø)
...va/org/apache/linkis/bml/Entity/DownloadModel.java	0.00% <0.00%> (ø)
... and 43 more

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update b462730...1b58238. Read the comment docs.

[jackxu2011]

LGTM

[casionone]

LGTM