binance-derivatives-trading-usds-futures incompatible with Jetty 12

[andrii-k6a]

When using Jetty 12.0.12, the connector fails with the following error:
java.lang.NoClassDefFoundError: org/eclipse/jetty/client/api/Response$CompleteListener

This indicates that binance-derivatives-trading-usds-futures is not compatible with Jetty 12. With Jetty 10 and 11 reaching End of Life (EOL (End of Life) for Jetty 10 / Jetty 11 - January 2025), please add support for Jetty 12+ in the SDK to ensure continued compatibility.

[theo-s68]

Hello @andrii-k6a ,

Indeed for now Binance uses Jetty 11 to keep the SDK compatible with Java 11.
We will migrate once most of the users migrated to Java 17 or newer.

In the meantime, please let us know if you face any issue with Jetty 11.

Thank you.

[andrii-k6a]

The issue is that the deprecated connector works fine with Jetty 12, but switching to the new connector would require downgrading other dependencies, which I’d rather avoid.

[luniard]

Hello @andrii-k6a ,

Indeed for now Binance uses Jetty 11 to keep the SDK compatible with Java 11. We will migrate once most of the users migrated to Java 17 or newer.

In the meantime, please let us know if you face any issue with Jetty 11.

Thank you.

So, how to fix this problem right now? (Java 17)

[rbm4]

Ive been dealing with the same problem trying to use simple websocket connection on the Spot connector (java 17), i've been trying to insert by hand jetty dependencies and exploring possible solutions, came out to the conclusion that the responsibility of managing jetty dependency should be from the Binance connector, tried many version combinations but ultimately it doesn't work

binance-spot: 6.0.0
binance-connector-java: 3.4.1

code snippet that generates the error:
WebSocketClientConfiguration clientConfiguration = new WebSocketClientConfiguration();
clientConfiguration.setSignatureConfiguration(signatureConfig);
this.spotWebSocketStreams = new SpotWebSocketStreams(clientConfiguration);

---- EDIT ----
i've managed to get pass the classNotFound excepton by using all of these libraries in my pom.xml:

	<dependency>
		<groupId>org.eclipse.jetty</groupId>
		<artifactId>jetty-client</artifactId>
		<version>11.0.26</version>
	</dependency>
	<dependency>
		<groupId>org.eclipse.jetty</groupId>
		<artifactId>jetty-io</artifactId>
		<version>11.0.26</version>
	</dependency>
	<dependency>
		<groupId>org.eclipse.jetty</groupId>
		<artifactId>jetty-util</artifactId>
		<version>11.0.26</version>
	</dependency>
	<dependency>
		<groupId>org.eclipse.jetty</groupId>
		<artifactId>jetty-http</artifactId>
		<version>11.0.26</version>
	</dependency>
	<dependency>
		<groupId>org.eclipse.jetty</groupId>
		<artifactId>jetty-slf4j-impl</artifactId>
		<version>11.0.26</version>
	</dependency>
	<dependency>
		<groupId>org.eclipse.jetty.websocket</groupId>
		<artifactId>websocket-jetty-client</artifactId>
		<version>11.0.26</version>
	</dependency>
	<dependency>
		<groupId>org.eclipse.jetty.websocket</groupId>
		<artifactId>websocket-jetty-api</artifactId>
		<version>11.0.26</version>
	</dependency>
	<dependency>
		<groupId>org.eclipse.jetty.websocket</groupId>
		<artifactId>websocket-jetty-common</artifactId>
		<version>11.0.26</version>
	</dependency>
	<dependency>
		<groupId>org.eclipse.jetty.websocket</groupId>
		<artifactId>websocket-core-client</artifactId>
		<version>11.0.26</version>
	</dependency>
	<dependency>
		<groupId>org.eclipse.jetty.websocket</groupId>
		<artifactId>websocket-core-common</artifactId>
		<version>11.0.26</version>
	</dependency>

in which i was able to at least start the application, im getting different errors while trying to use the websocket but i don't know yet if they are related to the mismatch between versions, i'll figure it out and add here later if that's the case

---- EDIT 2 ----
From what i could test, it seems to be working, i've managed to listen to the "rollingWindowTicker" websocket example, in theory it should work for this issue aswell

[AlexanderBartash]

In the meantime, please let us know if you face any issue with Jetty 11.

@theo-s68 Hi. What about CVE-2024-6763 GHSA-qh8g-58pp-2wxh ?

The HttpURI class does insufficient validation on the authority segment of a URI. However the behaviour of HttpURI differs from the common browsers in how it handles a URI that would be considered invalid if fully validated against the RRC. Specifically HttpURI and the browser may differ on the value of the host extracted from an invalid URI and thus a combination of Jetty and a vulnerable browser may be vulnerable to a open redirect attack or to a SSRF attack if the URI is used after passing validation checks.

Also #199 (comment)