You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@directory.apache.org by sm...@apache.org on 2021/07/01 22:55:20 UTC
[directory-fortress-commander] branch master updated: update
dependencies, add owasp dependency check mechanism, improve ant loader
This is an automated email from the ASF dual-hosted git repository.
smckinney pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/directory-fortress-commander.git
The following commit(s) were added to refs/heads/master by this push:
new 96ddaea update dependencies, add owasp dependency check mechanism, improve ant loader
96ddaea is described below
commit 96ddaea93c4c86625c1c704e12a1c64e35f53024
Author: Shawn McKinney <sm...@symas.com>
AuthorDate: Thu Jul 1 17:55:15 2021 -0500
update dependencies, add owasp dependency check mechanism, improve ant loader
---
pom.xml | 116 +++++++++++++++++++-----------------
src/main/resources/log4j.properties | 20 -------
src/owasp/suppression.xml | 115 +++++++++++++++++++++++++++++++++++
3 files changed, 176 insertions(+), 75 deletions(-)
diff --git a/pom.xml b/pom.xml
index ad33d29..8175b9a 100644
--- a/pom.xml
+++ b/pom.xml
@@ -80,15 +80,13 @@
<title>${project.name} ${project.version}</title>
<java.version>1.8</java.version>
<fortress.realm.version>2.0.6</fortress.realm.version>
- <wicket.version>8.9.0</wicket.version>
- <wicket.googlecode.version>8.6.0</wicket.googlecode.version>
+ <wicket.version>8.11.0</wicket.version>
+ <wicket.googlecode.version>8.11.0</wicket.googlecode.version>
<version.log4j>2.13.3</version.log4j>
- <version.ant>1.9.7</version.ant>
- <version.slf4j.api>1.7.29</version.slf4j.api>
- <version.slf4j.impl>2.13.3</version.slf4j.impl>
- <spring.security.version>5.3.2.RELEASE</spring.security.version>
+ <version.ant>1.10.10</version.ant>
+ <spring.security.version>5.5.1</spring.security.version>
<javadoc.version>2.9.1</javadoc.version>
- <jetty.version>8.1.8.v20121106</jetty.version>
+ <jetty.version>8.2.0.v20160908</jetty.version>
<jetty.stopKey>stopJetty</jetty.stopKey>
<jetty.stopPort>9081</jetty.stopPort>
<jetty.port>9080</jetty.port>
@@ -103,18 +101,6 @@
</dependency>
<dependency>
- <groupId>org.apache.logging.log4j</groupId>
- <artifactId>log4j-api</artifactId>
- <version>${version.log4j}</version>
- </dependency>
-
- <dependency>
- <groupId>org.apache.logging.log4j</groupId>
- <artifactId>log4j-slf4j-impl</artifactId>
- <version>${version.slf4j.impl}</version>
- </dependency>
-
- <dependency>
<groupId>javax.servlet</groupId>
<artifactId>javax.servlet-api</artifactId>
<version>3.1.0</version>
@@ -185,7 +171,7 @@
<dependency>
<groupId>org.mortbay.jetty</groupId>
<artifactId>jetty</artifactId>
- <version>6.1.25</version>
+ <version>6.1.26</version>
<scope>test</scope>
</dependency>
@@ -199,7 +185,7 @@
<dependency>
<groupId>junit</groupId>
<artifactId>junit</artifactId>
- <version>4.11</version>
+ <version>4.13.2</version>
<scope>test</scope>
</dependency>
@@ -214,7 +200,14 @@
<dependency>
<groupId>io.github.bonigarcia</groupId>
<artifactId>webdrivermanager</artifactId>
- <version>4.0.0</version>
+ <version>4.4.3</version>
+ <scope>test</scope>
+ </dependency>
+
+ <dependency>
+ <groupId>xerces</groupId>
+ <artifactId>xercesImpl</artifactId>
+ <version>2.12.1</version>
<scope>test</scope>
</dependency>
@@ -425,6 +418,17 @@
<groupId>org.apache.rat</groupId>
<artifactId>apache-rat-plugin</artifactId>
<configuration>
+ <licenses>
+ <!-- TODO (low prio): Remove this simple workaround when Apache Rat 0.14 has been released. -->
+ <!-- See also: https://issues.apache.org/jira/browse/RAT-212 -->
+ <!-- and https://issues.apache.org/jira/browse/LEGAL-265 -->
+ <license implementation="org.apache.rat.analysis.license.ApacheSoftwareLicense20">
+ <notes>Also allow the license url to be https.</notes>
+ <patterns>
+ <pattern>https://www.apache.org/licenses/LICENSE-2.0</pattern>
+ </patterns>
+ </license>
+ </licenses>
<excludeSubProjects>false</excludeSubProjects>
<excludes>
<!-- MAVEN_DEFAULT_EXCLUDES -->
@@ -470,44 +474,13 @@
<phase>test</phase>
<configuration>
<target name="fortress-load" if="load.file" description="Loads fortress rbac policy files into ldap">
- <echo message="############### Run Fortress Policy Load ###############" />
+ <echo message="############### Run Fortress Rest Test Policy Load ###############" />
<java classname="org.apache.tools.ant.launch.Launcher" fork="true" clonevm="true" failonerror="true" dir="${basedir}" timeout="120000" taskname="startAnt">
- <classpath>
- <pathelement location="./src/main/resources" />
- <pathelement location="${org.apache.ant:ant-launcher:jar}" />
- <pathelement location="${org.apache.ant:ant:jar}" />
- <pathelement location="${org.apache.directory.fortress:fortress-core:jar}" />
- <pathelement location="${org.openldap:accelerator-api:jar}" />
- <pathelement location="${org.openldap:accelerator-impl:jar}" />
- <pathelement location="${org.apache.logging.log4j:log4j-api:jar}" />
- <pathelement location="${org.apache.logging.log4j:log4j-core:jar}" />
- <pathelement location="${org.apache.directory.api:api-all:jar}" />
- <pathelement location="${org.apache.mina:mina-core:jar}" />
- <pathelement location="${org.jgrapht:jgrapht-core:jar}" />
- <pathelement location="${org.jasypt:jasypt:jar}" />
- <pathelement location="${commons-configuration:commons-configuration:jar}" />
- <pathelement location="${commons-lang:commons-lang:jar}" />
- <pathelement location="${commons-collections:commons-collections:jar}" />
- <pathelement location="${commons-logging:commons-logging:jar}" />
- <pathelement location="${commons-io:commons-io:jar}" />
- <pathelement location="${commons-pool:commons-pool:jar}" />
- <pathelement location="${net.sf.ehcache:ehcache-core:jar}" />
- <pathelement location="${org.slf4j:slf4j-api:jar}" />
- <pathelement location="${org.apache.logging.log4j:log4j-slf4j-impl:jar}" />
- <pathelement location="${org.apache.cxf:cxf-api:jar}" />
- <pathelement location="${javax.ws.rs:javax.ws.rs-api:jar}" />
- <pathelement location="${javax.ws.rs:javax.ws.rs-api:jar}" />
- <pathelement location="${org.apache.httpcomponents:httpclient:jar}" />
- <pathelement location="${org.apache.httpcomponents:httpcore:jar}" />
- <pathelement location="${com.sun.xml.bind:jaxb-impl:jar}" />
- <pathelement location="${commons-codec:commons-codec:jar}" />
- <pathelement location="${antlr:antlr:jar}" />
- </classpath>
+ <classpath refid="maven.test.classpath" />
<sysproperty key="version" value="${project.version}" />
<sysproperty key="tenant" value="${tenant}" />
<arg value="-buildfile" />
<arg file="./${load.file}" />
- <!-- <arg file="./src/main/resources/FortressRestServerPolicy.xml" />-->
</java>
</target>
</configuration>
@@ -518,6 +491,16 @@
</executions>
</plugin>
+ <plugin>
+ <groupId>org.owasp</groupId>
+ <artifactId>dependency-check-maven</artifactId>
+ <version>6.2.2</version>
+ <configuration>
+ <failBuildOnAnyVulnerability>true</failBuildOnAnyVulnerability>
+ <suppressionFile>${project.basedir}/src/owasp/suppression.xml</suppressionFile>
+ </configuration>
+ </plugin>
+
</plugins>
</build>
@@ -528,4 +511,27 @@
</repository>
</repositories>
+ <!-- OWASP Dependency Vulnerability Scanner Profile -->
+ <profiles>
+
+ <profile>
+ <id>owasp</id>
+ <build>
+ <plugins>
+ <plugin>
+ <groupId>org.owasp</groupId>
+ <artifactId>dependency-check-maven</artifactId>
+ <executions>
+ <execution>
+ <goals>
+ <goal>check</goal>
+ </goals>
+ </execution>
+ </executions>
+ </plugin>
+ </plugins>
+ </build>
+ </profile>
+ </profiles>
+
</project>
diff --git a/src/main/resources/log4j.properties b/src/main/resources/log4j.properties
deleted file mode 100644
index 095233a..0000000
--- a/src/main/resources/log4j.properties
+++ /dev/null
@@ -1,20 +0,0 @@
-#
-# Licensed to the Apache Software Foundation (ASF) under one
-# or more contributor license agreements. See the NOTICE file
-# distributed with this work for additional information
-# regarding copyright ownership. The ASF licenses this file
-# to you under the Apache License, Version 2.0 (the
-# "License"); you may not use this file except in compliance
-# with the License. You may obtain a copy of the License at
-#
-# http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing,
-# software distributed under the License is distributed on an
-# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
-# KIND, either express or implied. See the License for the
-# specific language governing permissions and limitations
-# under the License.
-#
-
-log4j.logger.RequestCycleExtra=OFF
\ No newline at end of file
diff --git a/src/owasp/suppression.xml b/src/owasp/suppression.xml
new file mode 100644
index 0000000..2f95cc3
--- /dev/null
+++ b/src/owasp/suppression.xml
@@ -0,0 +1,115 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ *
+-->
+<suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">
+ <!-- Suppress OWASP warnings about spring security, security method override, not applicable here. -->
+ <suppress>
+ <notes><![CDATA[
+ file name: api-i18n-2.0.0.jar
+ ]]></notes>
+ <packageUrl regex="true">^pkg:maven/org\.apache\.directory\.api/api\-i18n@.*$</packageUrl>
+ <cpe>cpe:/a:i18n_project:i18n</cpe>
+ </suppress>
+ <suppress>
+ <notes><![CDATA[
+ file name: guava-25.0-jre.jar
+ ]]></notes>
+ <packageUrl regex="true">^pkg:maven/com\.google\.guava/guava@.*$</packageUrl>
+ <cve>CVE-2020-8908</cve>
+ </suppress>
+ <suppress>
+ <notes><![CDATA[
+ file name: javax.activation-1.1.0.v201105071233.jar
+ ]]></notes>
+ <packageUrl regex="true">^pkg:maven/org\.eclipse\.jetty\.orbit/javax\.activation@.*$</packageUrl>
+ <cve>CVE-2009-5045</cve>
+ </suppress>
+ <suppress>
+ <notes><![CDATA[
+ file name: javax.activation-1.1.0.v201105071233.jar
+ ]]></notes>
+ <packageUrl regex="true">^pkg:maven/org\.eclipse\.jetty\.orbit/javax\.activation@.*$</packageUrl>
+ <cve>CVE-2017-7656</cve>
+ </suppress>
+ <suppress>
+ <notes><![CDATA[
+ file name: javax.activation-1.1.0.v201105071233.jar
+ ]]></notes>
+ <packageUrl regex="true">^pkg:maven/org\.eclipse\.jetty\.orbit/javax\.activation@.*$</packageUrl>
+ <cve>CVE-2009-5046</cve>
+ </suppress>
+ <suppress>
+ <notes><![CDATA[
+ file name: javax.activation-1.1.0.v201105071233.jar
+ ]]></notes>
+ <packageUrl regex="true">^pkg:maven/org\.eclipse\.jetty\.orbit/javax\.activation@.*$</packageUrl>
+ <cve>CVE-2017-7657</cve>
+ </suppress>
+ <suppress>
+ <notes><![CDATA[
+ file name: javax.activation-1.1.0.v201105071233.jar
+ ]]></notes>
+ <packageUrl regex="true">^pkg:maven/org\.eclipse\.jetty\.orbit/javax\.activation@.*$</packageUrl>
+ <cve>CVE-2017-7658</cve>
+ </suppress>
+ <suppress>
+ <notes><![CDATA[
+ file name: javax.activation-1.1.0.v201105071233.jar
+ ]]></notes>
+ <packageUrl regex="true">^pkg:maven/org\.eclipse\.jetty\.orbit/javax\.activation@.*$</packageUrl>
+ <cve>CVE-2020-27216</cve>
+ </suppress>
+ <suppress>
+ <notes><![CDATA[
+ file name: javax.activation-1.1.0.v201105071233.jar
+ ]]></notes>
+ <packageUrl regex="true">^pkg:maven/org\.eclipse\.jetty\.orbit/javax\.activation@.*$</packageUrl>
+ <cve>CVE-2021-28169</cve>
+ </suppress>
+ <suppress>
+ <notes><![CDATA[
+ file name: javax.activation-1.1.0.v201105071233.jar
+ ]]></notes>
+ <packageUrl regex="true">^pkg:maven/org\.eclipse\.jetty\.orbit/javax\.activation@.*$</packageUrl>
+ <cve>CVE-2021-34428</cve>
+ </suppress>
+ <suppress>
+ <notes><![CDATA[
+ file name: javax.mail.glassfish-1.4.1.v201005082020.jar
+ ]]></notes>
+ <packageUrl regex="true">^pkg:maven/org\.eclipse\.jetty\.orbit/javax\.mail\.glassfish@.*$</packageUrl>
+ <cve>CVE-2009-5045</cve>
+ </suppress>
+ <suppress>
+ <notes><![CDATA[
+ file name: javax.mail.glassfish-1.4.1.v201005082020.jar
+ ]]></notes>
+ <packageUrl regex="true">^pkg:maven/org\.eclipse\.jetty\.orbit/javax\.mail\.glassfish@.*$</packageUrl>
+ <cve>CVE-2009-5046</cve>
+ </suppress>
+ <suppress>
+ <notes><![CDATA[
+ file name: javax.mail.glassfish-1.4.1.v201005082020.jar
+ ]]></notes>
+ <packageUrl regex="true">^pkg:maven/org\.eclipse\.jetty\.orbit/javax\.mail\.glassfish@.*$</packageUrl>
+ <cve>CVE-2017-7656</cve>
+ </suppress>
+
+</suppressions>