From 23789f5265f9c525eeffbde84d6de8ea4ce0fe33 Mon Sep 17 00:00:00 2001 From: Felix Dittrich Date: Tue, 31 Jan 2023 18:39:17 +0100 Subject: [PATCH 1/2] Prepare Spring Boot 3.0 Ready build --- pom.xml | 21 ++++++++++--------- .../ec/dgc/DgcLibAutoConfiguration.java | 3 ++- .../connector/DgcGatewayConnectorUtils.java | 6 +++--- ...gcGatewayCountryListDownloadConnector.java | 2 +- .../DgcGatewayDownloadConnector.java | 2 +- ...cGatewayRevocationListUploadConnector.java | 2 +- ...GatewayTrustedIssuerDownloadConnector.java | 2 +- .../connector/DgcGatewayUploadConnector.java | 2 +- ...cGatewayValidationRuleUploadConnector.java | 2 +- src/main/resources/META-INF/spring.factories | 1 - ...ot.autoconfigure.AutoConfiguration.imports | 1 + 11 files changed, 23 insertions(+), 21 deletions(-) delete mode 100644 src/main/resources/META-INF/spring.factories create mode 100644 src/main/resources/META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.imports diff --git a/pom.xml b/pom.xml index 922759c..ad59140 100644 --- a/pom.xml +++ b/pom.xml @@ -4,9 +4,16 @@ xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd"> 4.0.0 + + org.springframework.cloud + spring-cloud-starter-parent + 2022.0.1 + + + eu.europa.ec.dgc dgc-lib - latest + 2.0.0 jar dgc-lib @@ -17,15 +24,13 @@ - 11 - 11 + 17 + 17 UTF-8 UTF-8 7.3.0 - 2.7.5 - 3.1.4 11.10 1.70 1.18.24 @@ -74,7 +79,6 @@ org.springframework.boot spring-boot-starter-web - ${spring.boot.version} true @@ -96,13 +100,11 @@ org.springframework.boot spring-boot-configuration-processor - ${spring.boot.version} true org.springframework.cloud spring-cloud-starter-openfeign - ${spring.cloud.version} org.springframework @@ -162,7 +164,6 @@ org.springframework.boot spring-boot-starter-test test - ${spring.boot.version} com.squareup.okhttp3 @@ -293,7 +294,7 @@ org.springframework.boot spring-boot-configuration-processor - ${spring.boot.version} + ${project.parent.parent.version} diff --git a/src/main/java/eu/europa/ec/dgc/DgcLibAutoConfiguration.java b/src/main/java/eu/europa/ec/dgc/DgcLibAutoConfiguration.java index 14be84b..605ea32 100644 --- a/src/main/java/eu/europa/ec/dgc/DgcLibAutoConfiguration.java +++ b/src/main/java/eu/europa/ec/dgc/DgcLibAutoConfiguration.java @@ -20,11 +20,12 @@ package eu.europa.ec.dgc; +import org.springframework.boot.autoconfigure.AutoConfiguration; import org.springframework.boot.context.properties.EnableConfigurationProperties; import org.springframework.context.annotation.ComponentScan; import org.springframework.context.annotation.Configuration; -@Configuration +@AutoConfiguration @ComponentScan("eu.europa.ec.dgc") @EnableConfigurationProperties public class DgcLibAutoConfiguration { diff --git a/src/main/java/eu/europa/ec/dgc/gateway/connector/DgcGatewayConnectorUtils.java b/src/main/java/eu/europa/ec/dgc/gateway/connector/DgcGatewayConnectorUtils.java index 7da1edf..1dcb708 100644 --- a/src/main/java/eu/europa/ec/dgc/gateway/connector/DgcGatewayConnectorUtils.java +++ b/src/main/java/eu/europa/ec/dgc/gateway/connector/DgcGatewayConnectorUtils.java @@ -33,6 +33,7 @@ import eu.europa.ec.dgc.signing.SignedStringMessageParser; import eu.europa.ec.dgc.utils.CertificateUtils; import feign.FeignException; +import jakarta.annotation.PostConstruct; import java.io.IOException; import java.io.Serializable; import java.nio.charset.StandardCharsets; @@ -48,7 +49,6 @@ import java.util.Map; import java.util.Objects; import java.util.stream.Collectors; -import javax.annotation.PostConstruct; import lombok.Getter; import lombok.RequiredArgsConstructor; import lombok.Setter; @@ -217,7 +217,7 @@ public List fetchCertificatesAndVerifyByTrustAnchor(Certi if (downloadedCertificates.getStatusCode() != HttpStatus.OK || downloadedCertificates.getBody() == null) { log.error("Failed to Download certificates from DGC Gateway, Type: {}, Status Code: {}", - type, downloadedCertificates.getStatusCodeValue()); + type, downloadedCertificates.getStatusCode()); return Collections.emptyList(); } @@ -249,7 +249,7 @@ public List fetchTrustedIssuersAndVerifyByTrustAnchor( if (responseEntity.getStatusCode() != HttpStatus.OK || downloadedTrustedIssuers == null) { throw new DgcGatewayConnectorUtils.DgcGatewayConnectorException( - responseEntity.getStatusCodeValue(), "Download of TrustedIssuers failed."); + responseEntity.getStatusCode().value(), "Download of TrustedIssuers failed."); } else { log.info("Got Response from DGCG, Downloaded TrustedIssuers: {}", downloadedTrustedIssuers.size()); diff --git a/src/main/java/eu/europa/ec/dgc/gateway/connector/DgcGatewayCountryListDownloadConnector.java b/src/main/java/eu/europa/ec/dgc/gateway/connector/DgcGatewayCountryListDownloadConnector.java index f88a288..b48ea0e 100644 --- a/src/main/java/eu/europa/ec/dgc/gateway/connector/DgcGatewayCountryListDownloadConnector.java +++ b/src/main/java/eu/europa/ec/dgc/gateway/connector/DgcGatewayCountryListDownloadConnector.java @@ -23,13 +23,13 @@ import eu.europa.ec.dgc.gateway.connector.client.DgcGatewayConnectorRestClient; import eu.europa.ec.dgc.gateway.connector.config.DgcGatewayConnectorConfigProperties; import feign.FeignException; +import jakarta.annotation.PostConstruct; import java.security.Security; import java.time.LocalDateTime; import java.time.temporal.ChronoUnit; import java.util.ArrayList; import java.util.Collections; import java.util.List; -import javax.annotation.PostConstruct; import lombok.Getter; import lombok.RequiredArgsConstructor; import lombok.extern.slf4j.Slf4j; diff --git a/src/main/java/eu/europa/ec/dgc/gateway/connector/DgcGatewayDownloadConnector.java b/src/main/java/eu/europa/ec/dgc/gateway/connector/DgcGatewayDownloadConnector.java index 801408e..fcfc6dc 100644 --- a/src/main/java/eu/europa/ec/dgc/gateway/connector/DgcGatewayDownloadConnector.java +++ b/src/main/java/eu/europa/ec/dgc/gateway/connector/DgcGatewayDownloadConnector.java @@ -28,6 +28,7 @@ import eu.europa.ec.dgc.gateway.connector.model.TrustListItem; import eu.europa.ec.dgc.signing.SignedCertificateMessageParser; import feign.FeignException; +import jakarta.annotation.PostConstruct; import java.security.Security; import java.time.LocalDateTime; import java.time.temporal.ChronoUnit; @@ -37,7 +38,6 @@ import java.util.List; import java.util.Map; import java.util.stream.Collectors; -import javax.annotation.PostConstruct; import lombok.Getter; import lombok.RequiredArgsConstructor; import lombok.extern.slf4j.Slf4j; diff --git a/src/main/java/eu/europa/ec/dgc/gateway/connector/DgcGatewayRevocationListUploadConnector.java b/src/main/java/eu/europa/ec/dgc/gateway/connector/DgcGatewayRevocationListUploadConnector.java index 4520162..75860fa 100644 --- a/src/main/java/eu/europa/ec/dgc/gateway/connector/DgcGatewayRevocationListUploadConnector.java +++ b/src/main/java/eu/europa/ec/dgc/gateway/connector/DgcGatewayRevocationListUploadConnector.java @@ -31,6 +31,7 @@ import eu.europa.ec.dgc.signing.SignedStringMessageBuilder; import eu.europa.ec.dgc.utils.CertificateUtils; import feign.FeignException; +import jakarta.annotation.PostConstruct; import java.io.IOException; import java.security.KeyStore; import java.security.KeyStoreException; @@ -39,7 +40,6 @@ import java.security.UnrecoverableKeyException; import java.security.cert.CertificateEncodingException; import java.security.cert.X509Certificate; -import javax.annotation.PostConstruct; import lombok.Getter; import lombok.RequiredArgsConstructor; import lombok.extern.slf4j.Slf4j; diff --git a/src/main/java/eu/europa/ec/dgc/gateway/connector/DgcGatewayTrustedIssuerDownloadConnector.java b/src/main/java/eu/europa/ec/dgc/gateway/connector/DgcGatewayTrustedIssuerDownloadConnector.java index 2263dbb..01a5265 100644 --- a/src/main/java/eu/europa/ec/dgc/gateway/connector/DgcGatewayTrustedIssuerDownloadConnector.java +++ b/src/main/java/eu/europa/ec/dgc/gateway/connector/DgcGatewayTrustedIssuerDownloadConnector.java @@ -23,6 +23,7 @@ import eu.europa.ec.dgc.gateway.connector.config.DgcGatewayConnectorConfigProperties; import eu.europa.ec.dgc.gateway.connector.model.QueryParameter; import eu.europa.ec.dgc.gateway.connector.model.TrustedIssuer; +import jakarta.annotation.PostConstruct; import java.io.Serializable; import java.security.Security; import java.time.LocalDateTime; @@ -31,7 +32,6 @@ import java.util.Collections; import java.util.HashMap; import java.util.List; -import javax.annotation.PostConstruct; import lombok.Getter; import lombok.RequiredArgsConstructor; import lombok.extern.slf4j.Slf4j; diff --git a/src/main/java/eu/europa/ec/dgc/gateway/connector/DgcGatewayUploadConnector.java b/src/main/java/eu/europa/ec/dgc/gateway/connector/DgcGatewayUploadConnector.java index ed7f075..04883ba 100644 --- a/src/main/java/eu/europa/ec/dgc/gateway/connector/DgcGatewayUploadConnector.java +++ b/src/main/java/eu/europa/ec/dgc/gateway/connector/DgcGatewayUploadConnector.java @@ -28,6 +28,7 @@ import eu.europa.ec.dgc.signing.SignedCertificateMessageBuilder; import eu.europa.ec.dgc.utils.CertificateUtils; import feign.FeignException; +import jakarta.annotation.PostConstruct; import java.io.IOException; import java.security.KeyStore; import java.security.KeyStoreException; @@ -36,7 +37,6 @@ import java.security.UnrecoverableKeyException; import java.security.cert.CertificateEncodingException; import java.security.cert.X509Certificate; -import javax.annotation.PostConstruct; import lombok.Getter; import lombok.RequiredArgsConstructor; import lombok.extern.slf4j.Slf4j; diff --git a/src/main/java/eu/europa/ec/dgc/gateway/connector/DgcGatewayValidationRuleUploadConnector.java b/src/main/java/eu/europa/ec/dgc/gateway/connector/DgcGatewayValidationRuleUploadConnector.java index 613afb7..5ba3eae 100644 --- a/src/main/java/eu/europa/ec/dgc/gateway/connector/DgcGatewayValidationRuleUploadConnector.java +++ b/src/main/java/eu/europa/ec/dgc/gateway/connector/DgcGatewayValidationRuleUploadConnector.java @@ -28,6 +28,7 @@ import eu.europa.ec.dgc.signing.SignedStringMessageBuilder; import eu.europa.ec.dgc.utils.CertificateUtils; import feign.FeignException; +import jakarta.annotation.PostConstruct; import java.io.IOException; import java.security.KeyStore; import java.security.KeyStoreException; @@ -36,7 +37,6 @@ import java.security.UnrecoverableKeyException; import java.security.cert.CertificateEncodingException; import java.security.cert.X509Certificate; -import javax.annotation.PostConstruct; import lombok.Getter; import lombok.RequiredArgsConstructor; import lombok.extern.slf4j.Slf4j; diff --git a/src/main/resources/META-INF/spring.factories b/src/main/resources/META-INF/spring.factories deleted file mode 100644 index 2ac5bc2..0000000 --- a/src/main/resources/META-INF/spring.factories +++ /dev/null @@ -1 +0,0 @@ -org.springframework.boot.autoconfigure.EnableAutoConfiguration=eu.europa.ec.dgc.DgcLibAutoConfiguration diff --git a/src/main/resources/META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.imports b/src/main/resources/META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.imports new file mode 100644 index 0000000..bd2794c --- /dev/null +++ b/src/main/resources/META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.imports @@ -0,0 +1 @@ +eu.europa.ec.dgc.DgcLibAutoConfiguration From 6e520628dcc1a6f4c177e0ba00cf664892a158e9 Mon Sep 17 00:00:00 2001 From: Felix Dittrich Date: Mon, 13 Feb 2023 13:13:11 +0100 Subject: [PATCH 2/2] Remove hardcoded 2.0.0 version (reset to latest) Update 3rd Party Libs Update OWASP Suppression file Update CI Jobs (Update Runner and JDK version) --- .github/workflows/ci-dependency-check.yml | 2 +- .github/workflows/ci-main.yml | 4 +- .github/workflows/ci-pullrequest.yml | 4 +- .github/workflows/ci-release-notes.yml | 2 +- .github/workflows/ci-release.yml | 4 +- .github/workflows/ci-sonar.yml | 4 +- owasp/suppressions.xml | 26 +----------- pom.xml | 51 ++++------------------- 8 files changed, 20 insertions(+), 77 deletions(-) diff --git a/.github/workflows/ci-dependency-check.yml b/.github/workflows/ci-dependency-check.yml index b70c32f..601390c 100644 --- a/.github/workflows/ci-dependency-check.yml +++ b/.github/workflows/ci-dependency-check.yml @@ -15,7 +15,7 @@ jobs: steps: - uses: actions/setup-java@v2 with: - java-version: 11 + java-version: 17 distribution: adopt - uses: actions/checkout@v2 with: diff --git a/.github/workflows/ci-main.yml b/.github/workflows/ci-main.yml index 4c33da8..36a91f9 100644 --- a/.github/workflows/ci-main.yml +++ b/.github/workflows/ci-main.yml @@ -6,11 +6,11 @@ on: - main jobs: build: - runs-on: ubuntu-20.04 + runs-on: ubuntu-latest steps: - uses: actions/setup-java@v2 with: - java-version: 11 + java-version: 17 distribution: adopt - uses: actions/checkout@v2 with: diff --git a/.github/workflows/ci-pullrequest.yml b/.github/workflows/ci-pullrequest.yml index 558aa10..f577089 100644 --- a/.github/workflows/ci-pullrequest.yml +++ b/.github/workflows/ci-pullrequest.yml @@ -7,11 +7,11 @@ on: - reopened jobs: build: - runs-on: ubuntu-20.04 + runs-on: ubuntu-latest steps: - uses: actions/setup-java@v2 with: - java-version: 11 + java-version: 17 distribution: adopt - uses: actions/checkout@v2 with: diff --git a/.github/workflows/ci-release-notes.yml b/.github/workflows/ci-release-notes.yml index b155d77..2fd0c68 100644 --- a/.github/workflows/ci-release-notes.yml +++ b/.github/workflows/ci-release-notes.yml @@ -5,7 +5,7 @@ on: - created jobs: release-notes: - runs-on: ubuntu-20.04 + runs-on: ubuntu-latest steps: - uses: actions/checkout@v2 with: diff --git a/.github/workflows/ci-release.yml b/.github/workflows/ci-release.yml index 9af8f11..2ced4ac 100644 --- a/.github/workflows/ci-release.yml +++ b/.github/workflows/ci-release.yml @@ -5,11 +5,11 @@ on: - created jobs: release: - runs-on: ubuntu-20.04 + runs-on: ubuntu-latest steps: - uses: actions/setup-java@v2 with: - java-version: 11 + java-version: 17 distribution: adopt - uses: actions/checkout@v2 with: diff --git a/.github/workflows/ci-sonar.yml b/.github/workflows/ci-sonar.yml index 90171d4..5e7dcc4 100644 --- a/.github/workflows/ci-sonar.yml +++ b/.github/workflows/ci-sonar.yml @@ -10,11 +10,11 @@ on: - reopened jobs: sonar: - runs-on: ubuntu-20.04 + runs-on: ubuntu-latest steps: - uses: actions/setup-java@v2 with: - java-version: 11 + java-version: 17 distribution: adopt - uses: actions/checkout@v2 with: diff --git a/owasp/suppressions.xml b/owasp/suppressions.xml index 5f48248..3fd8b02 100644 --- a/owasp/suppressions.xml +++ b/owasp/suppressions.xml @@ -1,29 +1,7 @@ - see https://github.com/jeremylong/DependencyCheck/issues/1827> - CVE-2018-1258 - - - see https://github.com/jeremylong/DependencyCheck/issues/2952 - CVE-2011-2732 - CVE-2011-2731 - CVE-2012-5055 - - - see https://tomcat.apache.org/security-9.html#Apache_Tomcat_9.x_vulnerabilities vulnerability is fixed in tomcat 9.0.38 - CVE-2020-13943 - - - H2 is not used by this project. - CVE-2021-23463 - - - False Positive, Should match only up to 5.3.2 (excluding) but we have 5.6.3 - CVE-2020-5408 - - - False Positive, Should match only up to 1.32 (excluding) but we have 1.33 - CVE-2022-38752 + no YAML content from users is parsed within this service + CVE-2022-1471 diff --git a/pom.xml b/pom.xml index ad59140..9270a25 100644 --- a/pom.xml +++ b/pom.xml @@ -13,7 +13,7 @@ eu.europa.ec.dgc dgc-lib - 2.0.0 + latest jar dgc-lib @@ -30,18 +30,16 @@ UTF-8 UTF-8 - 7.3.0 - 11.10 - 1.70 + 8.0.2 + 1.72 1.18.24 1.5.3.Final 2.11.0 4.5.2 - 2.13.4 - 2.13.4.2 4.10.0 - 3.2.0 - 3.0.0-M7 + 3.2.1 + 3.9.1.2184 + 3.0.0-M8 0.8.8 @@ -78,24 +76,8 @@ org.springframework.boot - spring-boot-starter-web + spring-boot-starter true - - - org.yaml - snakeyaml - - - com.fasterxml.jackson.core - jackson-databind - - - - - - org.yaml - snakeyaml - 1.33 org.springframework.boot @@ -105,17 +87,10 @@ org.springframework.cloud spring-cloud-starter-openfeign - - - org.springframework - spring-web - - io.github.openfeign feign-httpclient - ${feign.version} org.mapstruct @@ -126,11 +101,10 @@ org.projectlombok lombok provided - ${lombok.version} org.bouncycastle - bcpkix-jdk15on + bcpkix-jdk18on ${bcpkix.version} @@ -146,20 +120,11 @@ com.fasterxml.jackson.core jackson-databind - ${jackson.databind.version} com.fasterxml.jackson.datatype jackson-datatype-jsr310 - ${jackson.version} - - - com.fasterxml.jackson.core - jackson-databind - - - org.springframework.boot spring-boot-starter-test