From 26e422ff90f2a4fb9d2d25c0b2328b365fe5f0d7 Mon Sep 17 00:00:00 2001 From: Thomas Lenz Date: Fri, 11 Dec 2020 16:33:00 +0100 Subject: add 'findSecBugs' plug-in into 'spotBugs' module and solve bugs or exclude false-positive update gitlab-ci configuration to display jUnit test-coverage --- .gitlab-ci.yml | 41 ++++++++++++ build_reporting/pom.xml | 75 ++++++++++++++++++++++ connector/checks/spotbugs-exclude.xml | 22 +++++++ connector/pom.xml | 9 +++ .../connector/controller/MonitoringController.java | 7 +- connector_lib/checks/spotbugs-exclude.xml | 9 +++ connector_lib/pom.xml | 9 +++ .../checks/spotbugs-exclude.xml | 31 +++++++++ eidas_modules/authmodule-eIDAS-v2/pom.xml | 13 +--- .../authmodule-eIDAS-v2/spotbugs_exclude.xml | 6 -- .../modules/auth/eidas/v2/szr/SzrClient.java | 7 +- pom.xml | 57 ++++++++++++---- 12 files changed, 253 insertions(+), 33 deletions(-) create mode 100644 build_reporting/pom.xml create mode 100644 connector/checks/spotbugs-exclude.xml create mode 100644 connector_lib/checks/spotbugs-exclude.xml create mode 100644 eidas_modules/authmodule-eIDAS-v2/checks/spotbugs-exclude.xml delete mode 100644 eidas_modules/authmodule-eIDAS-v2/spotbugs_exclude.xml diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml index 81a4a4dd..3d865418 100644 --- a/.gitlab-ci.yml +++ b/.gitlab-ci.yml @@ -9,6 +9,7 @@ variables: MAVEN_OPTS: "-Dhttps.protocols=TLSv1.2 -Dmaven.repo.local=${CI_PROJECT_DIR}/.m2/repository -Dorg.slf4j.simpleLogger.log.org.apache.maven.cli.transfer.Slf4jMavenTransferListener=WARN -Dorg.slf4j.simpleLogger.showDateTime=true -Djava.awt.headless=true" GIT_DEPTH: "2" SECURE_LOG_LEVEL: "debug" + JACOCO_CSV_LOCATION: '${CI_PROJECT_DIR}/build_reporting/target/site/jacoco-aggregate-ut/jacoco.csv' include: - template: Dependency-Scanning.gitlab-ci.yml @@ -31,7 +32,47 @@ assemble: - tags script: | mvn $MAVEN_CLI_OPTS generate-sources compile test + after_script: + - awk -F"," '{ instructions += $4 + $5; covered += $5 } END { print covered, "/", instructions, " instructions covered"; print 100*covered/instructions, "% covered" }' $JACOCO_CSV_LOCATION artifacts: when: always reports: junit: "**/target/surefire-reports/TEST-*.xml" + paths: + - target/jacoco-report/jacoco.xml + + +buildDistributionPackage: + stage: package + except: + - tags + script: | + export VERSION=$(mvn -B help:evaluate -Dexpression=project.version -B | grep -v "\[INFO\]" | grep -Po "\d+\.\d+\.\d+((-\w*)+)?") + echo "Build full package of version $VERSION + mvn $MAVEN_CLI_OPTS verify -s .cisettings.xml -DskipTests + echo "VERSION=$VERSION" >> variables.env + artifacts: + when: always + reports: + dotenv: variables.env + name: "$CI_JOB_NAME-$CI_COMMIT_REF_NAME" + paths: + - target/*.-dist.zip + +release: + stage: release + image: registry.gitlab.com/gitlab-org/release-cli:latest + needs: + - job: buildDistributionPackage + artifacts: true + when: manual + only: + - master + script: | + echo "Releasing version $VERSION of $LIB_NAME" + echo "Publishing version $VERSION to public EGIZ maven" + mvn $MAVEN_CLI_OPTS deploy -s .cisettings.xml + artifacts: + name: "$CI_JOB_NAME-$CI_COMMIT_REF_NAME-EGIZ" + paths: + - target/*.-dist.zip diff --git a/build_reporting/pom.xml b/build_reporting/pom.xml new file mode 100644 index 00000000..eca57a03 --- /dev/null +++ b/build_reporting/pom.xml @@ -0,0 +1,75 @@ + + + 4.0.0 + + at.asitplus.eidas + ms_specific + 1.1.1-SNAPSHOT + + build_reporting + pom + Reporting Module + + + + at.asitplus.eidas.ms_specific + connector_lib + + + at.asitplus.eidas.ms_specific.modules + authmodule-eIDAS-v2 + + + at.asitplus.eidas.ms_specific + ms_specific_connector + war + + + + + + + org.jacoco + jacoco-maven-plugin + + + + aggregate-reports-ut + test + + report-aggregate + + + Maven Multimodule Coverage Demo: Coverage of Unit Tests + ${project.reporting.outputDirectory}/jacoco-aggregate-ut + + + **/target/jacoco-it.exec + + + + + + + + org.owasp + dependency-check-maven + + 11 + false + + + + + check + + + + + + + + + diff --git a/connector/checks/spotbugs-exclude.xml b/connector/checks/spotbugs-exclude.xml new file mode 100644 index 00000000..5d4fd515 --- /dev/null +++ b/connector/checks/spotbugs-exclude.xml @@ -0,0 +1,22 @@ + + + + + + + + + + + + + + + + + + + + + diff --git a/connector/pom.xml b/connector/pom.xml index 6621fb0f..3c2ddf07 100644 --- a/connector/pom.xml +++ b/connector/pom.xml @@ -156,6 +156,15 @@ + + com.github.spotbugs + spotbugs-maven-plugin + ${spotbugs-maven-plugin.version} + + checks/spotbugs-exclude.xml + + + diff --git a/connector/src/main/java/at/asitplus/eidas/specific/connector/controller/MonitoringController.java b/connector/src/main/java/at/asitplus/eidas/specific/connector/controller/MonitoringController.java index aa45c836..f2d9fc8c 100644 --- a/connector/src/main/java/at/asitplus/eidas/specific/connector/controller/MonitoringController.java +++ b/connector/src/main/java/at/asitplus/eidas/specific/connector/controller/MonitoringController.java @@ -34,6 +34,7 @@ import org.apache.commons.text.StringEscapeUtils; import org.apache.http.client.methods.CloseableHttpResponse; import org.apache.http.client.methods.HttpGet; import org.apache.http.client.methods.HttpUriRequest; +import org.apache.http.client.utils.URIBuilder; import org.apache.http.impl.client.CloseableHttpClient; import org.slf4j.Logger; import org.slf4j.LoggerFactory; @@ -250,9 +251,9 @@ public class MonitoringController { } // create HTTP client - // TODO: update if we switch to openSAML3 - CloseableHttpClient httpClient = httpClientFactory.getHttpClient(); - HttpUriRequest request = new HttpGet(urlString); + CloseableHttpClient httpClient = httpClientFactory.getHttpClient(); + URIBuilder uriBuilder = new URIBuilder(urlString); + HttpUriRequest request = new HttpGet(uriBuilder.build()); final CloseableHttpResponse respCode = httpClient.execute(request); if (respCode.getStatusLine().getStatusCode() != 200) { diff --git a/connector_lib/checks/spotbugs-exclude.xml b/connector_lib/checks/spotbugs-exclude.xml new file mode 100644 index 00000000..90ca96f2 --- /dev/null +++ b/connector_lib/checks/spotbugs-exclude.xml @@ -0,0 +1,9 @@ + + + + + + + + + diff --git a/connector_lib/pom.xml b/connector_lib/pom.xml index 795096f9..9a187f7f 100644 --- a/connector_lib/pom.xml +++ b/connector_lib/pom.xml @@ -68,6 +68,15 @@ + + + com.github.spotbugs + spotbugs-maven-plugin + ${spotbugs-maven-plugin.version} + + checks/spotbugs-exclude.xml + + diff --git a/eidas_modules/authmodule-eIDAS-v2/checks/spotbugs-exclude.xml b/eidas_modules/authmodule-eIDAS-v2/checks/spotbugs-exclude.xml new file mode 100644 index 00000000..375f73f4 --- /dev/null +++ b/eidas_modules/authmodule-eIDAS-v2/checks/spotbugs-exclude.xml @@ -0,0 +1,31 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/eidas_modules/authmodule-eIDAS-v2/pom.xml b/eidas_modules/authmodule-eIDAS-v2/pom.xml index b2e841fb..ddd2723c 100644 --- a/eidas_modules/authmodule-eIDAS-v2/pom.xml +++ b/eidas_modules/authmodule-eIDAS-v2/pom.xml @@ -251,18 +251,9 @@ com.github.spotbugs spotbugs-maven-plugin - - - spotbugs_validate - test - - check - - - + ${spotbugs-maven-plugin.version} - true - spotbugs_exclude.xml + checks/spotbugs-exclude.xml diff --git a/eidas_modules/authmodule-eIDAS-v2/spotbugs_exclude.xml b/eidas_modules/authmodule-eIDAS-v2/spotbugs_exclude.xml deleted file mode 100644 index 90d418ff..00000000 --- a/eidas_modules/authmodule-eIDAS-v2/spotbugs_exclude.xml +++ /dev/null @@ -1,6 +0,0 @@ - - - - - - \ No newline at end of file diff --git a/eidas_modules/authmodule-eIDAS-v2/src/main/java/at/asitplus/eidas/specific/modules/auth/eidas/v2/szr/SzrClient.java b/eidas_modules/authmodule-eIDAS-v2/src/main/java/at/asitplus/eidas/specific/modules/auth/eidas/v2/szr/SzrClient.java index 69b993a4..067825d8 100644 --- a/eidas_modules/authmodule-eIDAS-v2/src/main/java/at/asitplus/eidas/specific/modules/auth/eidas/v2/szr/SzrClient.java +++ b/eidas_modules/authmodule-eIDAS-v2/src/main/java/at/asitplus/eidas/specific/modules/auth/eidas/v2/szr/SzrClient.java @@ -45,6 +45,7 @@ import javax.net.ssl.KeyManagerFactory; import javax.net.ssl.SSLContext; import javax.net.ssl.TrustManager; import javax.net.ssl.TrustManagerFactory; +import javax.xml.XMLConstants; import javax.xml.bind.JAXBContext; import javax.xml.bind.Marshaller; import javax.xml.namespace.QName; @@ -58,8 +59,6 @@ import javax.xml.ws.BindingProvider; import javax.xml.ws.Dispatch; import javax.xml.ws.handler.Handler; -import com.fasterxml.jackson.core.JsonProcessingException; -import com.fasterxml.jackson.databind.ObjectMapper; import org.apache.commons.lang3.StringUtils; import org.apache.cxf.configuration.jsse.TLSClientParameters; import org.apache.cxf.endpoint.Client; @@ -75,6 +74,9 @@ import org.springframework.stereotype.Service; import org.w3c.dom.Document; import org.w3c.dom.Element; +import com.fasterxml.jackson.core.JsonProcessingException; +import com.fasterxml.jackson.databind.ObjectMapper; + import at.asitplus.eidas.specific.modules.auth.eidas.v2.Constants; import at.asitplus.eidas.specific.modules.auth.eidas.v2.exception.SzrCommunicationException; import at.asitplus.eidas.specific.modules.auth.eidas.v2.utils.LoggingHandler; @@ -488,6 +490,7 @@ public class SzrClient { private byte[] sourceToByteArray(Source result) throws TransformerException { final TransformerFactory factory = TransformerFactory.newInstance(); + factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true); final Transformer transformer = factory.newTransformer(); transformer.setOutputProperty("omit-xml-declaration", "yes"); transformer.setOutputProperty("method", "xml"); diff --git a/pom.xml b/pom.xml index 2c8cb1e7..c360f910 100644 --- a/pom.xml +++ b/pom.xml @@ -20,29 +20,32 @@ 0.3 0.4 1.1.10 - 5.2.9.RELEASE + 5.2.12.RELEASE 3.0.11.RELEASE - 3.4.0 + 3.4.1 3.11 1.9 4.4 - 29.0-jre - 2.10.6 + 30.0-jre + 2.10.8 1.7.30 - 2.11.3 - - + 2.12.0 + + - 4.13 + 4.13.1 2.22.2 1.0.5 0.8.6 3.1.1 - 3.13.0 - 4.0.4 + 3.14.0 + 4.1.4 + 1.11.0 + + 6.0.3 ${project.build.directory}/thirdparty_licenses https://apps.egiz.gv.at/checkstyle/egiz_pmd_checks.xml @@ -95,6 +98,7 @@ connector_lib connector eidas_modules + build_reporting @@ -120,6 +124,12 @@ eaaf_module_pvp2_idp ${eaaf-core.version} + + at.asitplus.eidas.ms_specific + ms_specific_connector + war + ${egiz.eidas.version} + at.asitplus.eidas.ms_specific.modules authmodule-eIDAS-v2 @@ -303,6 +313,24 @@ ${maven-assembly-plugin.version} + + org.owasp + dependency-check-maven + ${dependency-check-maven.version} + + 11 + false + + + + + check + + + + + + @@ -453,6 +481,13 @@ true + + + com.h3xstream.findsecbugs + findsecbugs-plugin + ${findsecbugs-plugin.version} + + @@ -479,4 +514,4 @@ - \ No newline at end of file + -- cgit v1.2.3