Remove JDOM dependency

[aalsanie]

zaproxy/zaproxy#9182

[psiinon]

Checkmarx One – Scan Summary & Details – 9cb90f25-26f3-4952-8b5c-ec9443d50aa3

New Issues (3)

Checkmarx found the following issues in this Pull Request

Severity	Issue	Source File / Package	Checkmarx Insight
	Improper_Restriction_of_Stored_XXE_Ref	/subprojects/zap-clientapi/src/main/java/org/zaproxy/clientapi/core/ClientApiMain.java: 139	details The loads and parses XML using parse, at line 213 of /subprojects/zap-clientapi/src/main/java/org/zaproxy/clientapi/core/AlertsFile.java. This... ID: 3413re42ASScwEJ4OVgQKvGAWzY%3D Attack Vector
	Improper_Restriction_of_XXE_Ref	/subprojects/zap-clientapi/src/main/java/org/zaproxy/clientapi/core/ClientApi.java: 335	details The loads and parses XML using parse, at line 298 of /subprojects/zap-clientapi/src/main/java/org/zaproxy/clientapi/core/ClientApi.java. This ... ID: vHzwCI5avOGEY1r%2BVIGYBBDG7QA%3D Attack Vector
	Missing_HSTS_Header	/subprojects/zap-clientapi/src/main/java/org/zaproxy/clientapi/core/ClientApi.java: 328	details The web-application does not define an HSTS header, leaving it vulnerable to attack. ID: 11j8aaphazQJTYBpSFhbOadG6Bc%3D Attack Vector

Fixed Issues (3)

Great job! The following issues were fixed in this Pull Request

Severity	Issue	Source File / Package
	CVE-2021-33813	Maven-org.jdom:jdom-1.1.3
	Improper_Restriction_of_Stored_XXE_Ref	/subprojects/zap-clientapi/src/main/java/org/zaproxy/clientapi/core/ClientApiMain.java: 214
	Improper_Restriction_of_XXE_Ref	/subprojects/zap-clientapi/src/main/java/org/zaproxy/clientapi/core/ClientApi.java: 465

---

Use @Checkmarx to reach out to us for assistance.

Just send a PR comment with @Checkmarx followed by a natural language request.

Examples: @Checkmarx how are you able to help me? @Checkmarx rescan this PR

[aalsanie]

@thc202 comments addressed in this new PR.
Thanks for the review

[thc202]

There's no need for a 2.0 version and refactorings.

[aalsanie]

There's no need for a 2.0 version and refactorings.

The clientApi is tightly coupled upon private methods that are used as well in ClientMainApi. This will cause you maintainability issues in the future. Your CLI class became a god object doing things like: parsing text, task routing, scans, ops, validation etc

[thc202]

Please, focus on the removal of the JDOM dependency in this pull request. If you want to do 2.0/refactorings ask in the dev group.