From 39f94caf86e054b2485beeae09c4947d75b017c1 Mon Sep 17 00:00:00 2001 From: Thomas Lenz Date: Wed, 9 Dec 2020 15:36:45 +0100 Subject: update third-party lib org.cryptacular to v 1.2.4 because openSAML 3.4.5 includes v1.1.3 with CVE-2020-7226 --- eaaf_modules/eaaf_module_pvp2_core/pom.xml | 4 ++++ pom.xml | 7 +++++++ 2 files changed, 11 insertions(+) diff --git a/eaaf_modules/eaaf_module_pvp2_core/pom.xml b/eaaf_modules/eaaf_module_pvp2_core/pom.xml index 86a66f4e..a0eee0e6 100644 --- a/eaaf_modules/eaaf_module_pvp2_core/pom.xml +++ b/eaaf_modules/eaaf_module_pvp2_core/pom.xml @@ -54,6 +54,10 @@ org.apache.santuario xmlsec + + org.cryptacular + cryptacular + org.bouncycastle bcprov-jdk15to18 diff --git a/pom.xml b/pom.xml index c9f7309a..33588b5d 100644 --- a/pom.xml +++ b/pom.xml @@ -50,6 +50,7 @@ 5.2.8.RELEASE 3.4.5 2.2.0 + 1.2.4 1.67 1.67 @@ -431,6 +432,12 @@ xmlsec ${org.apache.santuario.xmlsec.version} + + + org.cryptacular + cryptacular + ${org.cryptacular.version} + org.bouncycastle bcprov-jdk15to18 -- cgit v1.2.3 From 9e7812cb52bfe64e72855eecbd28a756718ce1e1 Mon Sep 17 00:00:00 2001 From: Thomas Lenz Date: Wed, 9 Dec 2020 15:37:09 +0100 Subject: update jUnit for JWE encryption by using HSM-Facade --- .../sl20/utils/AbstractJsonSecurityUtilsTest.java | 52 +++++++++++++++++++++- .../sl20/utils/JsonSecurityUtilsHsmKeyTest.java | 13 +++--- 2 files changed, 58 insertions(+), 7 deletions(-) diff --git a/eaaf_modules/eaaf_module_auth_sl20/src/test/java/at/gv/egiz/eaaf/modules/auth/sl20/utils/AbstractJsonSecurityUtilsTest.java b/eaaf_modules/eaaf_module_auth_sl20/src/test/java/at/gv/egiz/eaaf/modules/auth/sl20/utils/AbstractJsonSecurityUtilsTest.java index 6550b026..cfa8868e 100644 --- a/eaaf_modules/eaaf_module_auth_sl20/src/test/java/at/gv/egiz/eaaf/modules/auth/sl20/utils/AbstractJsonSecurityUtilsTest.java +++ b/eaaf_modules/eaaf_module_auth_sl20/src/test/java/at/gv/egiz/eaaf/modules/auth/sl20/utils/AbstractJsonSecurityUtilsTest.java @@ -150,7 +150,32 @@ public abstract class AbstractJsonSecurityUtilsTest { final String encData = jwe.getCompactSerialization(); Assert.assertNotNull("JWE", encData); + + /* + //decrypt it again + final JsonWebEncryption jweDecrypt = new JsonWebEncryption(); + jweDecrypt.setCompactSerialization(encData); + jweDecrypt.setKey(JoseUtils.convertToBcKeyIfRequired(key.getFirst())); + + + // set special provider if required + if (rsaEncKeyStore.getSecond() != null) { + final ProviderContext providerCtx = new ProviderContext(); + providerCtx.getSuppliedKeyProviderContext().setGeneralProvider(rsaEncKeyStore.getSecond().getName()); + providerCtx.getGeneralProviderContext().setGeneralProvider(BouncyCastleProvider.PROVIDER_NAME); + jweDecrypt.setProviderContext(providerCtx); + } else { + final ProviderContext providerCtx = new ProviderContext(); + providerCtx.getGeneralProviderContext().setGeneralProvider(BouncyCastleProvider.PROVIDER_NAME); + jweDecrypt.setProviderContext(providerCtx); + + } + + String decPayload = jweDecrypt.getPayload(); + Assert.assertNotNull("decrypted Payload", decPayload); + Assert.assertEquals("Decrypted message not match", payLoad, decPayload); + */ } @@ -171,8 +196,7 @@ public abstract class AbstractJsonSecurityUtilsTest { // set special provider if required if (rsaEncKeyStore.getSecond() != null) { final ProviderContext providerCtx = new ProviderContext(); - providerCtx.getSuppliedKeyProviderContext().setSignatureProvider( - rsaEncKeyStore.getSecond().getName()); + providerCtx.getSuppliedKeyProviderContext().setGeneralProvider(rsaEncKeyStore.getSecond().getName()); providerCtx.getGeneralProviderContext().setGeneralProvider(BouncyCastleProvider.PROVIDER_NAME); jwe.setProviderContext(providerCtx); @@ -188,6 +212,30 @@ public abstract class AbstractJsonSecurityUtilsTest { Assert.assertNotNull("JWE", encData); + //decrypt it again + final JsonWebEncryption jweDecrypt = new JsonWebEncryption(); + jweDecrypt.setCompactSerialization(encData); + jweDecrypt.setKey(JoseUtils.convertToBcKeyIfRequired(key.getFirst())); + + + // set special provider if required + if (rsaEncKeyStore.getSecond() != null) { + final ProviderContext providerCtx = new ProviderContext(); + providerCtx.getSuppliedKeyProviderContext().setGeneralProvider(rsaEncKeyStore.getSecond().getName()); + providerCtx.getGeneralProviderContext().setGeneralProvider(BouncyCastleProvider.PROVIDER_NAME); + jweDecrypt.setProviderContext(providerCtx); + + } else { + final ProviderContext providerCtx = new ProviderContext(); + providerCtx.getGeneralProviderContext().setGeneralProvider(BouncyCastleProvider.PROVIDER_NAME); + jweDecrypt.setProviderContext(providerCtx); + + } + + String decPayload = jweDecrypt.getPayload(); + Assert.assertNotNull("decrypted Payload", decPayload); + Assert.assertEquals("Decrypted message not match", payLoad, decPayload); + } diff --git a/eaaf_modules/eaaf_module_auth_sl20/src/test/java/at/gv/egiz/eaaf/modules/auth/sl20/utils/JsonSecurityUtilsHsmKeyTest.java b/eaaf_modules/eaaf_module_auth_sl20/src/test/java/at/gv/egiz/eaaf/modules/auth/sl20/utils/JsonSecurityUtilsHsmKeyTest.java index 4f8b2a23..b01330d2 100644 --- a/eaaf_modules/eaaf_module_auth_sl20/src/test/java/at/gv/egiz/eaaf/modules/auth/sl20/utils/JsonSecurityUtilsHsmKeyTest.java +++ b/eaaf_modules/eaaf_module_auth_sl20/src/test/java/at/gv/egiz/eaaf/modules/auth/sl20/utils/JsonSecurityUtilsHsmKeyTest.java @@ -3,21 +3,24 @@ package at.gv.egiz.eaaf.modules.auth.sl20.utils; import java.security.KeyStore; import java.security.Provider; -import at.gv.egiz.eaaf.core.exceptions.EaafException; -import at.gv.egiz.eaaf.core.impl.credential.KeyStoreConfiguration; -import at.gv.egiz.eaaf.core.impl.credential.KeyStoreConfiguration.KeyStoreType; -import at.gv.egiz.eaaf.core.impl.data.Pair; - import org.apache.commons.lang3.StringUtils; import org.junit.Before; import org.junit.runner.RunWith; import org.springframework.test.context.ContextConfiguration; import org.springframework.test.context.junit4.SpringJUnit4ClassRunner; +import at.gv.egiz.eaaf.core.exceptions.EaafException; +import at.gv.egiz.eaaf.core.impl.credential.KeyStoreConfiguration; +import at.gv.egiz.eaaf.core.impl.credential.KeyStoreConfiguration.KeyStoreType; +import at.gv.egiz.eaaf.core.impl.data.Pair; + @RunWith(SpringJUnit4ClassRunner.class) @ContextConfiguration("/spring/test_eaaf_sl20_hsm.beans.xml") public class JsonSecurityUtilsHsmKeyTest extends AbstractJsonSecurityUtilsTest { + /** + * Initialize jUnit test. + */ @Before public void initialize() { config.putConfigValue("modules.sl20.security.sigalg.rsa", "RS256"); -- cgit v1.2.3 From c4f117e74b8ade8b420f0443955ec6b94f88cee4 Mon Sep 17 00:00:00 2001 From: Thomas Lenz Date: Wed, 9 Dec 2020 18:20:56 +0100 Subject: add findSecBugs extension into spotbugs plug-in --- .gitlab-ci.yml | 1 - eaaf_core/checks/spotbugs-exclude.xml | 50 ++++ eaaf_core/pom.xml | 272 +++++++++++---------- .../services/ProtocolAuthenticationService.java | 35 +-- .../impl/idp/process/ProcessDefinitionParser.java | 1 + .../at/gv/egiz/eaaf/core/impl/utils/DomUtils.java | 7 +- .../egiz/eaaf/core/exceptions/XPathException.java | 31 --- eaaf_core_utils/checks/spotbugs-exclude.xml | 25 ++ eaaf_core_utils/pom.xml | 10 + .../SecurePendingRequestIdGenerationStrategy.java | 5 +- .../checks/spotbugs-exclude.xml | 15 ++ eaaf_modules/eaaf_module_pvp2_core/pom.xml | 10 + .../checks/spotbugs-exclude.xml | 14 ++ eaaf_modules/eaaf_module_pvp2_idp/pom.xml | 10 + .../idp/impl/builder/Pvp2AssertionBuilder.java | 40 +-- pom.xml | 32 ++- 16 files changed, 339 insertions(+), 219 deletions(-) create mode 100644 eaaf_core/checks/spotbugs-exclude.xml create mode 100644 eaaf_core_utils/checks/spotbugs-exclude.xml create mode 100644 eaaf_modules/eaaf_module_pvp2_core/checks/spotbugs-exclude.xml create mode 100644 eaaf_modules/eaaf_module_pvp2_idp/checks/spotbugs-exclude.xml diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index 37ca635e..ef026155 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -13,7 +13,6 @@ variables: include: - template: Dependency-Scanning.gitlab-ci.yml - - template: Security/SAST.gitlab-ci.yml - template: Secret-Detection.gitlab-ci.yml - template: Code-Quality.gitlab-ci.yml diff --git a/eaaf_core/checks/spotbugs-exclude.xml b/eaaf_core/checks/spotbugs-exclude.xml new file mode 100644 index 00000000..aa11a955 --- /dev/null +++ b/eaaf_core/checks/spotbugs-exclude.xml @@ -0,0 +1,50 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/eaaf_core/pom.xml b/eaaf_core/pom.xml index a1eee06e..178b53a3 100644 --- a/eaaf_core/pom.xml +++ b/eaaf_core/pom.xml @@ -1,108 +1,112 @@ - + 4.0.0 - at.gv.egiz - eaaf - 1.1.11-SNAPSHOT + at.gv.egiz + eaaf + 1.1.11-SNAPSHOT at.gv.egiz.eaaf eaaf-core EAAF core components Core components for identity managment implementations - + - - at.gv.egiz.eaaf - eaaf_core_api - - - at.gv.egiz.eaaf - eaaf_core_utils - - - - at.gv.egiz.components - eventlog-api - - - at.gv.egiz.components - egiz-spring-api - - - javax.annotation - javax.annotation-api - - - org.springframework - spring-webmvc - provided - - - org.slf4j - slf4j-api - - - - commons-codec - commons-codec - - - org.apache.commons - commons-lang3 - - - org.apache.commons - commons-collections4 - - - org.apache.commons - commons-text - - - commons-fileupload - commons-fileupload - - - javax.servlet - javax.servlet-api - - - org.apache.velocity - velocity - + + at.gv.egiz.eaaf + eaaf_core_api + + + at.gv.egiz.eaaf + eaaf_core_utils + + + + at.gv.egiz.components + eventlog-api + + + at.gv.egiz.components + egiz-spring-api + + + javax.annotation + javax.annotation-api + + + org.springframework + spring-webmvc + provided + + + org.slf4j + slf4j-api + + + + commons-codec + commons-codec + + + org.apache.commons + commons-lang3 + + + org.apache.commons + commons-collections4 + + + org.apache.commons + commons-text + + + commons-fileupload + commons-fileupload + + + javax.servlet + javax.servlet-api + + + org.apache.velocity + velocity + commons-collections - commons-collections - - - jaxen - jaxen - - - xerces - xercesImpl - - - xalan - xalan - - + commons-collections + + + org.owasp.encoder + encoder + + + jaxen + jaxen + + + xerces + xercesImpl + + + xalan + xalan + + - - junit - junit - test - - - org.springframework - spring-test - test - + + junit + junit + test + + + org.springframework + spring-test + test + at.gv.egiz.eaaf eaaf_core_utils @@ -110,10 +114,10 @@ test-jar - - + + eaaf_core - + org.apache.maven.plugins @@ -124,44 +128,54 @@ 1.8 - - - compile - testCompile - - + + + compile + testCompile + + - org.apache.maven.plugins - maven-jar-plugin - 3.1.0 - - - - test-jar - - - - - + org.apache.maven.plugins + maven-jar-plugin + 3.1.0 + + + + test-jar + + + + + - - maven-surefire-plugin - ${surefire.version} - - 1 - - - - org.apache.maven.surefire - surefire-junit47 - ${surefire.version} - - - - + + maven-surefire-plugin + ${surefire.version} + + 1 + + + + org.apache.maven.surefire + surefire-junit47 + ${surefire.version} + + + + + + com.github.spotbugs + spotbugs-maven-plugin + ${spotbugs-maven-plugin.version} + + true + checks/spotbugs-exclude.xml + + + - + diff --git a/eaaf_core/src/main/java/at/gv/egiz/eaaf/core/impl/idp/auth/services/ProtocolAuthenticationService.java b/eaaf_core/src/main/java/at/gv/egiz/eaaf/core/impl/idp/auth/services/ProtocolAuthenticationService.java index 50bf76db..4410267e 100644 --- a/eaaf_core/src/main/java/at/gv/egiz/eaaf/core/impl/idp/auth/services/ProtocolAuthenticationService.java +++ b/eaaf_core/src/main/java/at/gv/egiz/eaaf/core/impl/idp/auth/services/ProtocolAuthenticationService.java @@ -20,8 +20,6 @@ package at.gv.egiz.eaaf.core.impl.idp.auth.services; import java.io.IOException; -import java.io.PrintWriter; -import java.io.StringWriter; import java.util.HashSet; import javax.annotation.PostConstruct; @@ -32,6 +30,7 @@ import javax.servlet.http.HttpServletResponse; import org.apache.commons.lang3.ArrayUtils; import org.apache.commons.lang3.StringUtils; import org.apache.commons.text.StringEscapeUtils; +import org.owasp.encoder.Encode; import org.slf4j.Logger; import org.slf4j.LoggerFactory; import org.springframework.beans.factory.annotation.Autowired; @@ -286,7 +285,7 @@ public class ProtocolAuthenticationService implements IProtocolAuthenticationSer // write generic message for general exceptions final String msg = statusMessager.getMessage(IStatusMessenger.CODES_INTERNAL_ERROR_GENERIC, null); - writeHtmlErrorResponse(req, resp, msg, "9199", null, (Exception) throwable); + writeHtmlErrorResponse(req, resp, msg, "9199", null); } @@ -460,8 +459,7 @@ public class ProtocolAuthenticationService implements IProtocolAuthenticationSer private void writeHtmlErrorResponse(@NonNull final HttpServletRequest httpReq, @NonNull final HttpServletResponse httpResp, @NonNull final String msg, - @NonNull final String errorCode, @Nullable final Object[] params, - @NonNull final Exception error) throws EaafException { + @NonNull final String errorCode, @Nullable final Object[] params) throws EaafException { try { final IGuiBuilderConfiguration config = @@ -492,14 +490,6 @@ public class ProtocolAuthenticationService implements IProtocolAuthenticationSer AbstractGuiFormBuilderConfiguration.PARAM_GROUP_MSG, PARAM_GUI_ERRORCODEPARAMS, ArrayUtils.toString(errorCodeParams)); - // add stacktrace if debug is enabled - if (log.isTraceEnabled()) { - ((ModifyableGuiBuilderConfiguration) config).putCustomParameter( - AbstractGuiFormBuilderConfiguration.PARAM_GROUP_MSG, PARAM_GUI_ERRORSTACKTRACE, - getStacktraceFromException(error)); - - } - } else { log.info( "Can not ADD error message, because 'GUIBuilderConfiguration' is not modifieable "); @@ -515,18 +505,11 @@ public class ProtocolAuthenticationService implements IProtocolAuthenticationSer } - private String getStacktraceFromException(final Exception ex) { - final StringWriter errors = new StringWriter(); - ex.printStackTrace(new PrintWriter(errors)); - return errors.toString(); - - } - private void internalMoaidExceptionHandler(final HttpServletRequest req, final HttpServletResponse resp, final Exception e, final boolean writeExceptionToStatisicLog) throws IOException, EaafException { if (e instanceof ProtocolNotActiveException) { - resp.getWriter().write(e.getMessage()); + resp.getWriter().write(Encode.forHtml(e.getMessage())); resp.setContentType(EaafConstants.CONTENTTYPE_HTML_UTF8); resp.sendError(HttpServletResponse.SC_FORBIDDEN, StringEscapeUtils.escapeHtml4(StringEscapeUtils.escapeEcmaScript(e.getMessage()))); @@ -540,27 +523,27 @@ public class ProtocolAuthenticationService implements IProtocolAuthenticationSer // write error message writeHtmlErrorResponse(req, resp, e.getMessage(), statusMessager.getResponseErrorCode(e), - null, e); + null); } else if (e instanceof InvalidProtocolRequestException) { // send error response writeHtmlErrorResponse(req, resp, e.getMessage(), statusMessager.getResponseErrorCode(e), - null, e); + null); } else if (e instanceof ConfigurationException) { // send HTML formated error message writeHtmlErrorResponse(req, resp, e.getMessage(), statusMessager.getResponseErrorCode(e), - null, e); + null); } else if (e instanceof EaafException) { // send HTML formated error message writeHtmlErrorResponse(req, resp, e.getMessage(), statusMessager.getResponseErrorCode(e), - ((EaafException) e).getParams(), e); + ((EaafException) e).getParams()); } else if (e instanceof ProcessExecutionException) { // send HTML formated error message writeHtmlErrorResponse(req, resp, e.getMessage(), statusMessager.getResponseErrorCode(e), - null, e); + null); } diff --git a/eaaf_core/src/main/java/at/gv/egiz/eaaf/core/impl/idp/process/ProcessDefinitionParser.java b/eaaf_core/src/main/java/at/gv/egiz/eaaf/core/impl/idp/process/ProcessDefinitionParser.java index 14537d44..edca0fba 100644 --- a/eaaf_core/src/main/java/at/gv/egiz/eaaf/core/impl/idp/process/ProcessDefinitionParser.java +++ b/eaaf_core/src/main/java/at/gv/egiz/eaaf/core/impl/idp/process/ProcessDefinitionParser.java @@ -101,6 +101,7 @@ public class ProcessDefinitionParser { // Standard implementation of XMLInputFactory seems not to be thread-safe final XMLInputFactory inputFactory = XMLInputFactory.newInstance(); + inputFactory.setProperty(XMLInputFactory.SUPPORT_DTD, false); reader = inputFactory.createXMLEventReader(processDefinitionInputStream); final List transitionElements = new ArrayList<>(); diff --git a/eaaf_core/src/main/java/at/gv/egiz/eaaf/core/impl/utils/DomUtils.java b/eaaf_core/src/main/java/at/gv/egiz/eaaf/core/impl/utils/DomUtils.java index e8d5c294..4b8a7a04 100644 --- a/eaaf_core/src/main/java/at/gv/egiz/eaaf/core/impl/utils/DomUtils.java +++ b/eaaf_core/src/main/java/at/gv/egiz/eaaf/core/impl/utils/DomUtils.java @@ -33,6 +33,7 @@ import java.util.Map.Entry; import java.util.Set; import java.util.Vector; +import javax.xml.XMLConstants; import javax.xml.parsers.DocumentBuilder; import javax.xml.parsers.DocumentBuilderFactory; import javax.xml.parsers.ParserConfigurationException; @@ -45,8 +46,6 @@ import javax.xml.transform.TransformerFactory; import javax.xml.transform.dom.DOMSource; import javax.xml.transform.stream.StreamResult; -import at.gv.egiz.eaaf.core.api.data.XmlNamespaceConstants; - import org.apache.commons.io.IOUtils; import org.apache.commons.lang3.StringUtils; import org.apache.xerces.parsers.DOMParser; @@ -71,6 +70,8 @@ import org.xml.sax.ErrorHandler; import org.xml.sax.InputSource; import org.xml.sax.SAXException; +import at.gv.egiz.eaaf.core.api.data.XmlNamespaceConstants; + /** * Various utility functions for handling XML DOM trees. * @@ -785,6 +786,7 @@ public class DomUtils { throws TransformerException, IOException { final TransformerFactory transformerFactory = TransformerFactory.newInstance(); + transformerFactory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true); final Transformer transformer = transformerFactory.newTransformer(); final ByteArrayOutputStream bos = new ByteArrayOutputStream(16384); @@ -1211,6 +1213,7 @@ public class DomUtils { // StringWriter stringWriter = new StringWriter(); final Result result = new StreamResult(out); final TransformerFactory factory = TransformerFactory.newInstance(); + factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true); final Transformer transformer = factory.newTransformer(); transformer.transform(source, result); return out.toByteArray(); diff --git a/eaaf_core_api/src/main/java/at/gv/egiz/eaaf/core/exceptions/XPathException.java b/eaaf_core_api/src/main/java/at/gv/egiz/eaaf/core/exceptions/XPathException.java index b20efe3d..3343a089 100644 --- a/eaaf_core_api/src/main/java/at/gv/egiz/eaaf/core/exceptions/XPathException.java +++ b/eaaf_core_api/src/main/java/at/gv/egiz/eaaf/core/exceptions/XPathException.java @@ -19,9 +19,6 @@ package at.gv.egiz.eaaf.core.exceptions; -import java.io.PrintStream; -import java.io.PrintWriter; - /** * An exception occurred evaluating an XPath. * @@ -56,32 +53,4 @@ public class XPathException extends RuntimeException { return wrapped; } - /** - * Print error message. - * - * @see java.lang.Throwable#printStackTrace(java.io.PrintStream) - */ - @Override - public void printStackTrace(final PrintStream s) { - super.printStackTrace(s); - if (getWrapped() != null) { - s.print("Caused by: "); - getWrapped().printStackTrace(s); - } - } - - /** - * Print error message. - * - * @see java.lang.Throwable#printStackTrace(java.io.PrintWriter) - */ - @Override - public void printStackTrace(final PrintWriter s) { - super.printStackTrace(s); - if (getWrapped() != null) { - s.print("Caused by: "); - getWrapped().printStackTrace(s); - } - } - } diff --git a/eaaf_core_utils/checks/spotbugs-exclude.xml b/eaaf_core_utils/checks/spotbugs-exclude.xml new file mode 100644 index 00000000..b42f34c2 --- /dev/null +++ b/eaaf_core_utils/checks/spotbugs-exclude.xml @@ -0,0 +1,25 @@ + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/eaaf_core_utils/pom.xml b/eaaf_core_utils/pom.xml index 947faf4b..c7cefa8d 100644 --- a/eaaf_core_utils/pom.xml +++ b/eaaf_core_utils/pom.xml @@ -181,6 +181,16 @@ + + com.github.spotbugs + spotbugs-maven-plugin + ${spotbugs-maven-plugin.version} + + true + checks/spotbugs-exclude.xml + + + diff --git a/eaaf_core_utils/src/main/java/at/gv/egiz/eaaf/core/impl/utils/SecurePendingRequestIdGenerationStrategy.java b/eaaf_core_utils/src/main/java/at/gv/egiz/eaaf/core/impl/utils/SecurePendingRequestIdGenerationStrategy.java index 8ec5f3a8..cfb4ed88 100644 --- a/eaaf_core_utils/src/main/java/at/gv/egiz/eaaf/core/impl/utils/SecurePendingRequestIdGenerationStrategy.java +++ b/eaaf_core_utils/src/main/java/at/gv/egiz/eaaf/core/impl/utils/SecurePendingRequestIdGenerationStrategy.java @@ -2,8 +2,8 @@ package at.gv.egiz.eaaf.core.impl.utils; import java.nio.charset.StandardCharsets; import java.security.InvalidKeyException; +import java.security.MessageDigest; import java.security.NoSuchAlgorithmException; -import java.util.Arrays; import java.util.Base64; import javax.annotation.PostConstruct; @@ -109,7 +109,8 @@ public class SecurePendingRequestIdGenerationStrategy log.trace("Checking HMAC from externalPendingReqId ... "); final byte[] tokenDigest = Base64.getDecoder().decode(tokenElements[2]); final byte[] refDigist = calculateHmac(buildInternalToken(internalPendingReqId, timeStamp)); - if (!Arrays.equals(tokenDigest, refDigist)) { + + if (!MessageDigest.isEqual(refDigist,tokenDigest)) { log.warn("Digest of Token does NOT match"); log.debug("Token: {} | Ref: {}", tokenDigest, refDigist); throw new PendingReqIdValidationException(null, "internal.pendingreqid.04"); diff --git a/eaaf_modules/eaaf_module_pvp2_core/checks/spotbugs-exclude.xml b/eaaf_modules/eaaf_module_pvp2_core/checks/spotbugs-exclude.xml new file mode 100644 index 00000000..b1d216dc --- /dev/null +++ b/eaaf_modules/eaaf_module_pvp2_core/checks/spotbugs-exclude.xml @@ -0,0 +1,15 @@ + + + + + + + + + + + + + + + diff --git a/eaaf_modules/eaaf_module_pvp2_core/pom.xml b/eaaf_modules/eaaf_module_pvp2_core/pom.xml index a0eee0e6..45819787 100644 --- a/eaaf_modules/eaaf_module_pvp2_core/pom.xml +++ b/eaaf_modules/eaaf_module_pvp2_core/pom.xml @@ -172,6 +172,16 @@ + + com.github.spotbugs + spotbugs-maven-plugin + ${spotbugs-maven-plugin.version} + + true + checks/spotbugs-exclude.xml + + + diff --git a/eaaf_modules/eaaf_module_pvp2_idp/checks/spotbugs-exclude.xml b/eaaf_modules/eaaf_module_pvp2_idp/checks/spotbugs-exclude.xml new file mode 100644 index 00000000..855f39bd --- /dev/null +++ b/eaaf_modules/eaaf_module_pvp2_idp/checks/spotbugs-exclude.xml @@ -0,0 +1,14 @@ + + + + + + + + + + + + + + diff --git a/eaaf_modules/eaaf_module_pvp2_idp/pom.xml b/eaaf_modules/eaaf_module_pvp2_idp/pom.xml index 3840c8d9..b92d0f56 100644 --- a/eaaf_modules/eaaf_module_pvp2_idp/pom.xml +++ b/eaaf_modules/eaaf_module_pvp2_idp/pom.xml @@ -91,6 +91,16 @@ + + com.github.spotbugs + spotbugs-maven-plugin + ${spotbugs-maven-plugin.version} + + true + checks/spotbugs-exclude.xml + + + diff --git a/eaaf_modules/eaaf_module_pvp2_idp/src/main/java/at/gv/egiz/eaaf/modules/pvp2/idp/impl/builder/Pvp2AssertionBuilder.java b/eaaf_modules/eaaf_module_pvp2_idp/src/main/java/at/gv/egiz/eaaf/modules/pvp2/idp/impl/builder/Pvp2AssertionBuilder.java index b7b18f0f..d2ed2c11 100644 --- a/eaaf_modules/eaaf_module_pvp2_idp/src/main/java/at/gv/egiz/eaaf/modules/pvp2/idp/impl/builder/Pvp2AssertionBuilder.java +++ b/eaaf_modules/eaaf_module_pvp2_idp/src/main/java/at/gv/egiz/eaaf/modules/pvp2/idp/impl/builder/Pvp2AssertionBuilder.java @@ -26,26 +26,6 @@ import java.util.List; import javax.naming.ConfigurationException; -import at.gv.egiz.eaaf.core.api.data.EaafConstants; -import at.gv.egiz.eaaf.core.api.data.ILoALevelMapper; -import at.gv.egiz.eaaf.core.api.idp.IAuthData; -import at.gv.egiz.eaaf.core.api.idp.ISpConfiguration; -import at.gv.egiz.eaaf.core.api.idp.slo.SloInformationInterface; -import at.gv.egiz.eaaf.core.exceptions.UnavailableAttributeException; -import at.gv.egiz.eaaf.core.impl.data.Pair; -import at.gv.egiz.eaaf.core.impl.idp.controller.protocols.RequestImpl; -import at.gv.egiz.eaaf.core.impl.utils.Random; -import at.gv.egiz.eaaf.modules.pvp2.PvpConstants; -import at.gv.egiz.eaaf.modules.pvp2.exception.Pvp2Exception; -import at.gv.egiz.eaaf.modules.pvp2.exception.QaaNotSupportedException; -import at.gv.egiz.eaaf.modules.pvp2.idp.api.builder.ISubjectNameIdGenerator; -import at.gv.egiz.eaaf.modules.pvp2.idp.exception.ResponderErrorException; -import at.gv.egiz.eaaf.modules.pvp2.idp.exception.UnprovideableAttributeException; -import at.gv.egiz.eaaf.modules.pvp2.idp.impl.PvpSProfilePendingRequest; -import at.gv.egiz.eaaf.modules.pvp2.impl.builder.PvpAttributeBuilder; -import at.gv.egiz.eaaf.modules.pvp2.impl.utils.QaaLevelVerifier; -import at.gv.egiz.eaaf.modules.pvp2.impl.utils.Saml2Utils; - import org.apache.commons.lang3.StringUtils; import org.joda.time.DateTime; import org.opensaml.saml.common.xml.SAMLConstants; @@ -79,6 +59,26 @@ import org.springframework.beans.factory.annotation.Autowired; import org.springframework.stereotype.Service; import org.springframework.util.Base64Utils; +import at.gv.egiz.eaaf.core.api.data.EaafConstants; +import at.gv.egiz.eaaf.core.api.data.ILoALevelMapper; +import at.gv.egiz.eaaf.core.api.idp.IAuthData; +import at.gv.egiz.eaaf.core.api.idp.ISpConfiguration; +import at.gv.egiz.eaaf.core.api.idp.slo.SloInformationInterface; +import at.gv.egiz.eaaf.core.exceptions.UnavailableAttributeException; +import at.gv.egiz.eaaf.core.impl.data.Pair; +import at.gv.egiz.eaaf.core.impl.idp.controller.protocols.RequestImpl; +import at.gv.egiz.eaaf.core.impl.utils.Random; +import at.gv.egiz.eaaf.modules.pvp2.PvpConstants; +import at.gv.egiz.eaaf.modules.pvp2.exception.Pvp2Exception; +import at.gv.egiz.eaaf.modules.pvp2.exception.QaaNotSupportedException; +import at.gv.egiz.eaaf.modules.pvp2.idp.api.builder.ISubjectNameIdGenerator; +import at.gv.egiz.eaaf.modules.pvp2.idp.exception.ResponderErrorException; +import at.gv.egiz.eaaf.modules.pvp2.idp.exception.UnprovideableAttributeException; +import at.gv.egiz.eaaf.modules.pvp2.idp.impl.PvpSProfilePendingRequest; +import at.gv.egiz.eaaf.modules.pvp2.impl.builder.PvpAttributeBuilder; +import at.gv.egiz.eaaf.modules.pvp2.impl.utils.QaaLevelVerifier; +import at.gv.egiz.eaaf.modules.pvp2.impl.utils.Saml2Utils; + @Service("PVP2AssertionBuilder") public class Pvp2AssertionBuilder implements PvpConstants { diff --git a/pom.xml b/pom.xml index 33588b5d..ae131914 100644 --- a/pom.xml +++ b/pom.xml @@ -11,7 +11,7 @@ EGIZ EAAF components - + UTF-8 1.8 @@ -68,6 +68,7 @@ 2.10.8 3.0.2 30.0-jre + 1.2.3 4.5.13 4.4.14 @@ -92,6 +93,7 @@ 3.1.1 3.14.0 4.1.4 + 1.11.0 6.0.3 ${project.build.directory}/thirdparty_licenses @@ -107,7 +109,7 @@ gitlab-localbuild https://gitlab.iaik.tugraz.at/api/v4/groups/119/-/packages/maven - + egiz-commons https://apps.egiz.gv.at/maven/ @@ -197,7 +199,7 @@ - + @@ -356,7 +358,7 @@ javax.annotation javax.annotation-api ${javax.annotation-api} - + commons-collections commons-collections @@ -433,11 +435,12 @@ ${org.apache.santuario.xmlsec.version} - + org.cryptacular cryptacular ${org.cryptacular.version} - + org.bouncycastle bcprov-jdk15to18 @@ -446,7 +449,7 @@ org.bouncycastle bctls-jdk15to18 - ${org.bouncycastle.bctls-jdk15to18.version} + ${org.bouncycastle.bctls-jdk15to18.version} @@ -487,6 +490,12 @@ ${httpcore.version} + + org.owasp.encoder + encoder + ${org.owasp.encoder.version} + + joda-time joda-time @@ -534,7 +543,7 @@ okhttp-tls ${com.squareup.okhttp3.version} test - + at.gv.egiz.eaaf eaaf_core_utils @@ -723,6 +732,13 @@ true + + + com.h3xstream.findsecbugs + findsecbugs-plugin + ${findsecbugs-plugin.version} + + -- cgit v1.2.3 From ba4489b7666e4ee669a1c91bfe36ae4ac90b1d93 Mon Sep 17 00:00:00 2001 From: Thomas Lenz Date: Thu, 10 Dec 2020 09:34:37 +0100 Subject: update jUnit version --- pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pom.xml b/pom.xml index ae131914..40920657 100644 --- a/pom.xml +++ b/pom.xml @@ -82,7 +82,7 @@ 2.22.1 - 4.12 + 4.13.1 4.4.1 -- cgit v1.2.3 From 360df2054cdc5a8bc194f7701b2bfa5a9c39dd0d Mon Sep 17 00:00:00 2001 From: Thomas Lenz Date: Thu, 10 Dec 2020 09:35:01 +0100 Subject: first test with code-coverage in CI pipe --- .gitlab-ci.yml | 23 ++++++++++++++- build_reporting/pom.xml | 78 +++++++++++++++++++++++++++++++++++++++++++++++++ pom.xml | 61 +++++++++++++++++++++++++++++++------- 3 files changed, 150 insertions(+), 12 deletions(-) create mode 100644 build_reporting/pom.xml diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index ef026155..9ec05060 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -18,6 +18,7 @@ include: stages: - assemble + - visualize - test - package - release @@ -36,7 +37,27 @@ assemble: when: always reports: junit: "**/target/surefire-reports/TEST-*.xml" - + paths: + - build_reporting/target/site/jacoco-aggregate-ut/jacoco.xml + +coverage: + stage: visualize + image: haynes/jacoco2cobertura:1.0.4 + script: + - mkdir -p target/site + # convert report from jacoco to cobertura + - 'python /opt/cover2cover.py build_reporting/target/site/jacoco-aggregate-ut/jacoco.xml eaaf_core_api/src/main/java eaaf_core_utils/src/main/java eaaf_core/src/main/java eaaf_modules/eaaf_module_auth_sl20/src/main/java eaaf_modules/eaaf_module_moa-sig/src/main/java eaaf_modules/eaaf_module_pvp2_core/src/main/java eaaf_modules/eaaf_module_pvp2_idp/src/main/java eaaf_modules/eaaf_module_pvp2_sp/src/main/java > target/site/cobertura.xml' + # read the tag and prepend the path to every filename attribute + #- 'python /opt/source2filename.py target/site/cobertura.xml' + needs: + - job: assemble + dependencies: + - assemble + artifacts: + reports: + cobertura: target/site/cobertura.xml + + publishToGitlab: stage: package except: diff --git a/build_reporting/pom.xml b/build_reporting/pom.xml new file mode 100644 index 00000000..5300ff74 --- /dev/null +++ b/build_reporting/pom.xml @@ -0,0 +1,78 @@ + + + 4.0.0 + + at.gv.egiz + eaaf + 1.1.11-SNAPSHOT + + build_reporting + pom + Reporting Module + + + + at.gv.egiz.eaaf + eaaf_core_api + + + at.gv.egiz.eaaf + eaaf_core_utils + + + at.gv.egiz.eaaf + eaaf-core + + + at.gv.egiz.eaaf + eaaf_module_auth_sl20 + + + at.gv.egiz.eaaf + eaaf_module_moa-sig + + + at.gv.egiz.eaaf + eaaf_module_pvp2_core + + + at.gv.egiz.eaaf + eaaf_module_pvp2_idp + + + at.gv.egiz.eaaf + eaaf_module_pvp2_sp + + + + + + + org.jacoco + jacoco-maven-plugin + ${jacoco-maven-plugin.version} + + + + aggregate-reports-ut + test + + report-aggregate + + + Maven Multimodule Coverage Demo: Coverage of Unit Tests + ${project.reporting.outputDirectory}/jacoco-aggregate-ut + + + **/target/jacoco-it.exec + + + + + + + + + \ No newline at end of file diff --git a/pom.xml b/pom.xml index 40920657..585310ce 100644 --- a/pom.xml +++ b/pom.xml @@ -207,6 +207,7 @@ eaaf_core_utils eaaf_core eaaf_modules + build_reporting @@ -220,7 +221,38 @@ at.gv.egiz.eaaf eaaf_core_utils ${egiz.eaaf.version} + + + at.gv.egiz.eaaf + eaaf-core + ${egiz.eaaf.version} + + + at.gv.egiz.eaaf + eaaf_module_auth_sl20 + ${egiz.eaaf.version} + + + at.gv.egiz.eaaf + eaaf_module_moa-sig + ${egiz.eaaf.version} + + + at.gv.egiz.eaaf + eaaf_module_pvp2_core + ${egiz.eaaf.version} + + + at.gv.egiz.eaaf + eaaf_module_pvp2_idp + ${egiz.eaaf.version} + + + at.gv.egiz.eaaf + eaaf_module_pvp2_sp + ${egiz.eaaf.version} + at.gv.egiz.components eventlog-api @@ -597,6 +629,8 @@ ${surefire.version} 1 + + ${surefireArgLine} @@ -649,6 +683,9 @@ prepare-agent + + surefireArgLine + post-unit-report @@ -659,7 +696,7 @@ target/jacoco-report - + post-unit-check test @@ -686,7 +723,7 @@ - + @@ -747,18 +784,20 @@ - + org.jacoco - jacoco-maven-plugin - - - - report - - - + jacoco-maven-plugin + + Maven Multimodule Coverage Demo: Coverage of Unit Tests + ${project.reporting.outputDirectory}/jacoco-aggregate-ut + + + **/target/jacoco-it.exec + + + org.apache.maven.plugins maven-pmd-plugin -- cgit v1.2.3