Skip to content
Snippets Groups Projects
Commit a209f09e authored by bhill6@wisc.edu's avatar bhill6@wisc.edu
Browse files

Dependency updates to eliminate vulnerabilities discovered by dependency-check

parent 29d8527d
No related branches found
No related tags found
1 merge request!36Dependency updates to eliminate vulnerabilities discovered by dependency-check
Hide whitespace changes
Inline Side-by-side
.gitlab-ci.yml
+ 45
− 4
View file @ a209f09e
include:
# Security scanning
- template: Security/SAST.gitlab-ci.yml
- template: Security/SAST-IaC.latest.gitlab-ci.yml
- template: Security/Secret-Detection.gitlab-ci.yml
- template: Security/Dependency-Scanning.gitlab-ci.yml
image: maven:3-amazoncorretto-8
variables:
......@@ -20,15 +27,49 @@ default:
- aws
- docker
test:
stage: test
stages:
- build
- test
- deploy
build_jar:
stage: build
cache:
paths:
- .m2/repository
script:
- mvn clean $MAVEN_CLI_OPTS verify
- mvn $MAVEN_CLI_OPTS clean verify
artifacts:
paths:
- .m2/
- "*/target"
expire_in: 1 week
secret_detection:
needs: []
semgrep-sast:
needs: []
gemnasium-maven-dependency_scanning:
variables:
DS_JAVA_VERSION: 8
needs:
- build_jar
spotbugs-sast:
tags:
needs:
- build_jar
variables:
SAST_JAVA_VERSION: 8
MAVEN_REPO_PATH: $CI_PROJECT_DIR/.m2/repository
COMPILE: "false"
deploy:
stage: deploy
only:
- main
- trunk
script:
- env
- mvn $MAVEN_CLI_OPTS deploy -Pdeploy -X
pom.xml
+ 32
− 10
View file @ a209f09e
......@@ -2,7 +2,7 @@
<modelVersion>4.0.0</modelVersion>
<groupId>edu.wisc.uwss</groupId>
<artifactId>uw-spring-security</artifactId>
<version>3.0.5</version>
<version>3.0.6</version>
<packaging>pom</packaging>
<name>UW Spring Security Parent</name>
<description>Parent project for module to integrate Spring Security with UW authentication mechanism.</description>
......@@ -33,12 +33,13 @@
</repositories>
<properties>
<revision>3.0.4</revision>
<revision>3.0.6</revision>
<adi.development.version>2.0.1</adi.development.version>
<jackson.version>2.11.1</jackson.version>
<slf4j.version>1.7.7</slf4j.version>
<spring.framework.version>5.2.7.RELEASE</spring.framework.version>
<spring.security.version>5.3.3.RELEASE</spring.security.version>
<jackson.version>2.14.0-rc1</jackson.version>
<slf4j.version>2.0.3</slf4j.version>
<spring.framework.version>5.3.23</spring.framework.version>
<spring.security.version>5.7.3</spring.security.version>
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
</properties>
<dependencyManagement>
<dependencies>
......@@ -93,8 +94,28 @@
<groupId>joda-time</groupId>
<artifactId>joda-time</artifactId>
</exclusion>
<exclusion>
<groupId>org.opensaml</groupId>
<artifactId>opensaml</artifactId>
</exclusion>
</exclusions>
</dependency>
<dependency>
<groupId>org.opensaml</groupId>
<artifactId>opensaml</artifactId>
<version>2.6.4</version>
<exclusions>
<exclusion>
<groupId>org.owasp.esapi</groupId>
<artifactId>esapi</artifactId>
</exclusion>
</exclusions>
</dependency>
<dependency>
<groupId>org.owasp.esapi</groupId>
<artifactId>esapi</artifactId>
<version>2.5.0.0</version>
</dependency>
<dependency>
<groupId>edu.wisc.uwss</groupId>
<artifactId>uw-spring-security-config</artifactId>
......@@ -118,7 +139,7 @@
<dependency>
<groupId>junit</groupId>
<artifactId>junit</artifactId>
<version>4.12</version>
<version>4.13.1</version>
</dependency>
<dependency>
<groupId>org.apache.commons</groupId>
......@@ -141,9 +162,9 @@
<version>${slf4j.version}</version>
</dependency>
<dependency>
<groupId>org.slf4j</groupId>
<artifactId>slf4j-log4j12</artifactId>
<version>${slf4j.version}</version>
<groupId>ch.qos.logback</groupId>
<artifactId>logback-classic</artifactId>
<version>1.3.4</version>
</dependency>
<dependency>
<groupId>org.springframework</groupId>
......@@ -250,6 +271,7 @@
<artifactId>maven-install-plugin</artifactId>
<version>3.0.0-M1</version>
</plugin>
</plugins>
</build>
<modules>
......
uw-spring-security-config/pom.xml
+ 3
− 3
View file @ a209f09e
......@@ -3,7 +3,7 @@
<parent>
<groupId>edu.wisc.uwss</groupId>
<artifactId>uw-spring-security</artifactId>
<version>3.0.5</version>
<version>3.0.6</version>
</parent>
<artifactId>uw-spring-security-config</artifactId>
<name>UW Spring Security Configuration</name>
......@@ -46,8 +46,8 @@
<scope>test</scope>
</dependency>
<dependency>
<groupId>org.slf4j</groupId>
<artifactId>slf4j-log4j12</artifactId>
<groupId>ch.qos.logback</groupId>
<artifactId>logback-classic</artifactId>
<scope>test</scope>
</dependency>
<dependency>
......
uw-spring-security-core/pom.xml
+ 3
− 3
View file @ a209f09e
......@@ -3,7 +3,7 @@
<parent>
<groupId>edu.wisc.uwss</groupId>
<artifactId>uw-spring-security</artifactId>
<version>3.0.5</version>
<version>3.0.6</version>
</parent>
<artifactId>uw-spring-security-core</artifactId>
<name>UW Spring Security Core</name>
......@@ -59,8 +59,8 @@
<scope>test</scope>
</dependency>
<dependency>
<groupId>org.slf4j</groupId>
<artifactId>slf4j-log4j12</artifactId>
<groupId>ch.qos.logback</groupId>
<artifactId>logback-classic</artifactId>
<scope>test</scope>
</dependency>
<dependency>
......
uw-spring-security-sample-war/pom.xml
+ 6
− 7
View file @ a209f09e
......@@ -3,7 +3,7 @@
<parent>
<groupId>edu.wisc.uwss</groupId>
<artifactId>uw-spring-security</artifactId>
<version>3.0.5</version>
<version>3.0.6</version>
</parent>
<artifactId>uw-spring-security-sample-war</artifactId>
<name>UW Spring Security Sample War</name>
......@@ -50,16 +50,15 @@
<groupId>org.springframework</groupId>
<artifactId>spring-webmvc</artifactId>
</dependency>
<dependency>
<groupId>org.slf4j</groupId>
<artifactId>jcl-over-slf4j</artifactId>
<scope>runtime</scope>
<groupId>ch.qos.logback</groupId>
<artifactId>logback-classic</artifactId>
<scope>test</scope>
</dependency>
<dependency>
<groupId>org.slf4j</groupId>
<artifactId>slf4j-log4j12</artifactId>
<scope>runtime</scope>
<artifactId>jcl-over-slf4j</artifactId>
<scope>test</scope>
</dependency>
</dependencies>
<build>
......
uw-spring-security-sample-war/src/main/java/edu/wisc/uwss/sample/configuration/DemonstrationOnlyPreAuthenticationConfiguration.java
+ 5
− 1
View file @ a209f09e
......@@ -96,7 +96,11 @@ public class DemonstrationOnlyPreAuthenticationConfiguration {
HttpServletRequest httpRequest = (HttpServletRequest) request;
String uri = httpRequest.getRequestURI();
String param = httpRequest.getParameter("_ignorepreauth");
logger.debug("uri={}, param={}", uri, param);
// remove CRLF to avoid CWE-93
String cleanUri = (uri!=null) ? uri.replaceAll("([\\r\\n])", " ") : null;
String cleanParam = (param!=null) ? param.replace("([\\r\\n])","") : null;
logger.debug("uri={}, param={}", cleanUri, cleanParam);
if(null != param || IGNORED.contains(uri)) {
logger.info("skipping PreAuthenticationSimulationServletFilter, either due to '_ignorepreauth' or visiting ignore uri");
filterChain.doFilter(request, response);
......
uw-spring-security-web/pom.xml
+ 3
− 3
View file @ a209f09e
......@@ -15,7 +15,7 @@
<parent>
<groupId>edu.wisc.uwss</groupId>
<artifactId>uw-spring-security</artifactId>
<version>3.0.5</version>
<version>3.0.6</version>
</parent>
<artifactId>uw-spring-security-web</artifactId>
<name>UW Spring Security Web</name>
......@@ -38,8 +38,8 @@
<scope>test</scope>
</dependency>
<dependency>
<groupId>org.slf4j</groupId>
<artifactId>slf4j-log4j12</artifactId>
<groupId>ch.qos.logback</groupId>
<artifactId>logback-classic</artifactId>
<scope>test</scope>
</dependency>
<dependency>
......
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment