BTB-47 Aktualisierung der Bibliotheken
diff --git a/pom.xml b/pom.xml
index 75a9bef..5b62261 100644
--- a/pom.xml
+++ b/pom.xml
@@ -11,7 +11,7 @@
<properties>
<skip.asciidoc>false</skip.asciidoc>
- <httpclient.version>4.5.3</httpclient.version>
+ <httpclient.version>4.5.13</httpclient.version>
<jersey-bundle.version>1.19.3</jersey-bundle.version>
<org.json.version>20160810</org.json.version>
<jersey.server.version>1.19.3</jersey.server.version>
@@ -25,10 +25,48 @@
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
<servlet-api>2.5</servlet-api>
<maven.test.skip>false</maven.test.skip>
- <jacoco-maven-plugin.version>0.7.9</jacoco-maven-plugin.version>
- <sonar-maven-plugin.version>3.0.2</sonar-maven-plugin.version>
- <hibernate-annotations.version>3.5.6-Final</hibernate-annotations.version>
+ <jacoco-maven-plugin.version>0.8.6</jacoco-maven-plugin.version>
+ <sonar-maven-plugin.version>3.2</sonar-maven-plugin.version>
+ <dependency-check-maven.version>6.1.5</dependency-check-maven.version>
+ <hibernate-core.version>5.4.30.Final</hibernate-core.version>
</properties>
+
+ <profiles>
+ <profile>
+ <id>local-fast-build</id>
+ <properties>
+ <skip.asciidoc>true</skip.asciidoc>
+ <maven.test.skip>true</maven.test.skip>
+ </properties>
+ </profile>
+ <profile>
+ <id>securitycheck</id>
+ <build>
+ <plugins>
+ <plugin>
+ <groupId>org.owasp</groupId>
+ <artifactId>dependency-check-maven</artifactId>
+ <version>${dependency-check-maven.version}</version>
+ <configuration>
+ <skipProvidedScope>true</skipProvidedScope>
+ <skipRuntimeScope>true</skipRuntimeScope>
+ <failBuildOnCVSS>7</failBuildOnCVSS>
+ <assemblyAnalyzerEnabled>false</assemblyAnalyzerEnabled>
+ <suppressionFiles>${basedir}/securitycheck/suppressed.xml</suppressionFiles>
+ </configuration>
+ <executions>
+ <execution>
+ <goals>
+ <goal>check</goal>
+ </goals>
+ </execution>
+ </executions>
+ </plugin>
+ </plugins>
+ </build>
+ </profile>
+ </profiles>
+
<dependencies>
<dependency>
<groupId>org.apache.httpcomponents</groupId>
@@ -95,6 +133,18 @@
<artifactId>postgresql</artifactId>
<version>42.2.18</version>
</dependency>
+ <!-- https://mvnrepository.com/artifact/org.apache.commons/commons-collections4 -->
+ <dependency>
+ <groupId>org.apache.commons</groupId>
+ <artifactId>commons-collections4</artifactId>
+ <version>4.4</version>
+ </dependency>
+ <!-- https://mvnrepository.com/artifact/org.apache.commons/commons-lang3 -->
+ <dependency>
+ <groupId>org.apache.commons</groupId>
+ <artifactId>commons-lang3</artifactId>
+ <version>3.12.0</version>
+ </dependency>
<dependency>
<groupId>junit</groupId>
<artifactId>junit</artifactId>
@@ -105,6 +155,7 @@
<groupId>org.easymock</groupId>
<artifactId>easymock</artifactId>
<version>${easymock.version}</version>
+ <scope>test</scope>
</dependency>
<dependency>
<groupId>org.powermock</groupId>
@@ -122,16 +173,17 @@
<groupId>org.jacoco</groupId>
<artifactId>jacoco-maven-plugin</artifactId>
<version>${jacoco-maven-plugin.version}</version>
+ <scope>test</scope>
</dependency>
<dependency>
<groupId>com.fasterxml.jackson.core</groupId>
<artifactId>jackson-annotations</artifactId>
- <version>2.5.4</version>
+ <version>2.12.3</version>
</dependency>
<dependency>
<groupId>org.hibernate</groupId>
- <artifactId>hibernate-annotations</artifactId>
- <version>${hibernate-annotations.version}</version>
+ <artifactId>hibernate-core</artifactId>
+ <version>${hibernate-core.version}</version>
</dependency>
<dependency>
<groupId>org.slf4j</groupId>
@@ -141,7 +193,7 @@
<dependency>
<groupId>com.auth0</groupId>
<artifactId>java-jwt</artifactId>
- <version>3.2.0</version>
+ <version>3.15.0</version>
</dependency>
<dependency>
<groupId>commons-codec</groupId>
@@ -160,11 +212,6 @@
</exclusion>
</exclusions>-->
</dependency>
-<!-- <dependency>-->
-<!-- <groupId>javax.mail</groupId>-->
-<!-- <artifactId>mail</artifactId>-->
-<!-- <version>${javax.mail.version}</version>-->
-<!-- </dependency>-->
<!-- https://mvnrepository.com/artifact/com.sun.mail/jakarta.mail -->
<dependency>
<groupId>com.sun.mail</groupId>
@@ -203,8 +250,9 @@
</configuration>
</plugin>
<plugin>
+ <groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-war-plugin</artifactId>
- <version>2.1</version>
+ <version>3.3.1</version>
<configuration>
<archive>
<manifest>
@@ -220,7 +268,7 @@
<version>2.7</version>
</plugin>
<plugin>
- <groupId>org.codehaus.mojo</groupId>
+ <groupId>org.sonarsource.scanner.maven</groupId>
<artifactId>sonar-maven-plugin</artifactId>
<version>${sonar-maven-plugin.version}</version>
</plugin>
diff --git a/securitycheck/suppressed.xml b/securitycheck/suppressed.xml
new file mode 100644
index 0000000..0b7abcb
--- /dev/null
+++ b/securitycheck/suppressed.xml
@@ -0,0 +1,17 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">
+ <suppress>
+ <notes><![CDATA[
+ file name: log4j-1.2.16.jar
+ ]]></notes>
+ <packageUrl regex="true">^pkg:maven/log4j/log4j@.*$</packageUrl>
+ <vulnerabilityName>CVE-2019-17571</vulnerabilityName>
+ </suppress>
+ <suppress>
+ <notes><![CDATA[
+ file name: log4j-1.2.16.jar
+ ]]></notes>
+ <packageUrl regex="true">^pkg:maven/log4j/log4j@.*$</packageUrl>
+ <vulnerabilityName>CVE-2020-9488</vulnerabilityName>
+ </suppress>
+</suppressions>
\ No newline at end of file
diff --git a/src/main/java/org/eclipse/openk/elogbook/controller/BackendControllerResponsibility.java b/src/main/java/org/eclipse/openk/elogbook/controller/BackendControllerResponsibility.java
index 1e7d0f7..8e48cd5 100644
--- a/src/main/java/org/eclipse/openk/elogbook/controller/BackendControllerResponsibility.java
+++ b/src/main/java/org/eclipse/openk/elogbook/controller/BackendControllerResponsibility.java
@@ -18,7 +18,7 @@
import java.util.Date;
import java.util.List;
import javax.persistence.EntityManager;
-import org.apache.commons.lang.SerializationUtils;
+import org.apache.commons.lang3.SerializationUtils;
import org.apache.log4j.Logger;
import org.eclipse.openk.elogbook.common.JsonGeneratorBase;
import org.eclipse.openk.elogbook.common.mapper.HResponsibilityMapper;
diff --git a/src/main/java/org/eclipse/openk/elogbook/controller/EmailService.java b/src/main/java/org/eclipse/openk/elogbook/controller/EmailService.java
index 33309dc..d46b853 100644
--- a/src/main/java/org/eclipse/openk/elogbook/controller/EmailService.java
+++ b/src/main/java/org/eclipse/openk/elogbook/controller/EmailService.java
@@ -13,8 +13,8 @@
import jakarta.mail.MessagingException;
-import org.apache.commons.lang.time.DateFormatUtils;
-import org.apache.commons.lang.time.DateUtils;
+import org.apache.commons.lang3.time.DateFormatUtils;
+import org.apache.commons.lang3.time.DateUtils;
import org.apache.log4j.Logger;
import org.eclipse.openk.elogbook.common.BackendConfig;
import org.eclipse.openk.elogbook.common.Globals;
