Get rid of XWiki#getHttpClient API

Development
1

Hi devs,

While XWiki#getHttpClient is an API, there are two important problems with it:

  • it exposes as API an external library: Apache HTTP Client 3
  • Apache HTTP Client 3 has a serious vulnerability. Unfortunately, it’s never going to get any bugfix.

This method is the last string preventing us from removing Apache HTTP Client 3 from the XWiki WAR, so while it’s never great to break an API, I don’t really see any way around it: we need to delete this method.

I’m proposing to simply delete it in master (so in 17.10.0). For the LTS branches, I’m not sure, but I’m leaning toward removing it too. Even if we don’t use it in XWiki Standard, it does not make sense to keep exposing as API something vulnerable that should have never existed in the first place anyway. IMO, just deleting it will do a better job at pushing extensions to find an alternative than just saying “don’t use this, guys”.

WDYT ?

Here is my +1 to remove that in all supported branches.

2

It also does not look like something used, at least by contrib extensions.

+1 for me. Thanks

3

+1 as well.

Thanks,
Marius

4

+1

Thanks,
Alex

5

+1, thank you!

6

5 +1, API removed in all supported branches.