Skip to content

Commit 4626f9f

Browse files
costas80costas80
committed
Resolution of CVEs and centralised dependency management
1 parent e217caa commit 4626f9f

File tree

2 files changed

+11
-268
lines changed

2 files changed

+11
-268
lines changed

‎etc/owasp-suppressions.xml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,4 +28,11 @@
2828
<packageUrl regex="true">^pkg:maven/org\.springframework/spring\-.*@.*$</packageUrl>
2929
<cve>CVE-2016-1000027</cve>
3030
</suppress>
31+
<suppress>
32+
<notes><![CDATA[
33+
file name: spring-security-crypto-5.7.1.jar
34+
]]></notes>
35+
<packageUrl regex="true">^pkg:maven/org\.springframework\.security/spring\-security\-crypto@.*$</packageUrl>
36+
<vulnerabilityName>CVE-2020-5408</vulnerabilityName>
37+
</suppress>
3138
</suppressions>

‎pom.xml‎

Lines changed: 4 additions & 268 deletions
Original file line numberDiff line numberDiff line change
@@ -11,9 +11,10 @@
1111
<description>Web and command-line application for the validation of JSON data.</description>
1212

1313
<parent>
14-
<groupId>org.springframework.boot</groupId>
15-
<artifactId>spring-boot-starter-parent</artifactId>
16-
<version>2.6.7</version>
14+
<groupId>eu.europa.ec.itb.commons</groupId>
15+
<artifactId>validator-parent</artifactId>
16+
<version>1.2.0-SNAPSHOT</version>
17+
<relativePath/>
1718
</parent>
1819

1920
<modules>
@@ -41,62 +42,6 @@
4142
</developer>
4243
</developers>
4344

44-
<properties>
45-
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
46-
<validatorTimestamp>${maven.build.timestamp}</validatorTimestamp>
47-
<maven.build.timestamp.format>yyyy-MM-dd HH:mm:ss (XXX)</maven.build.timestamp.format>
48-
<sonar.organization>isaitb</sonar.organization>
49-
<sonar.host.url>https://sonarcloud.io</sonar.host.url>
50-
<version.springBoot>2.6.7</version.springBoot>
51-
<version.gitbTypes>1.16.0</version.gitbTypes>
52-
<version.itbCommons>1.2.0-SNAPSHOT</version.itbCommons>
53-
<version.jaxws>2.3.1</version.jaxws>
54-
<version.jws>1.1</version.jws>
55-
<version.javaxAnnotationApi>1.3.2</version.javaxAnnotationApi>
56-
<version.javaxActivation>1.1.1</version.javaxActivation>
57-
<version.cxf>3.5.1</version.cxf>
58-
<version.commonsConfiguration>2.7</version.commonsConfiguration>
59-
<version.commonsLang>3.10</version.commonsLang>
60-
<version.commonsIo>2.7</version.commonsIo>
61-
<version.justify>3.1.0</version.justify>
62-
<version.jakartaJson>2.0.0</version.jakartaJson>
63-
<version.gson>2.9.0</version.gson>
64-
<version.tika>2.1.0</version.tika>
65-
<version.aspectjWeaver>1.9.6</version.aspectjWeaver>
66-
<version.jayway>2.7.0</version.jayway>
67-
</properties>
68-
69-
<repositories>
70-
<repository>
71-
<id>central</id>
72-
<url>https://repo1.maven.org/maven2/</url>
73-
</repository>
74-
<repository>
75-
<id>jitpack.io</id>
76-
<url>https://jitpack.io</url>
77-
</repository>
78-
<repository>
79-
<id>jasperreports</id>
80-
<url>https://jaspersoft.jfrog.io/artifactory/jrs-ce-releases/</url>
81-
</repository>
82-
<repository>
83-
<id>jaspersoft-third-party</id>
84-
<url>https://jaspersoft.jfrog.io/artifactory/third-party-ce-artifacts/</url>
85-
</repository>
86-
<repository>
87-
<id>itbRepoRead</id>
88-
<url>${itbRepoReadUrl}</url>
89-
</repository>
90-
</repositories>
91-
92-
<dependencies>
93-
<dependency>
94-
<groupId>org.springframework.boot</groupId>
95-
<artifactId>spring-boot-devtools</artifactId>
96-
<optional>true</optional>
97-
</dependency>
98-
</dependencies>
99-
10045
<dependencyManagement>
10146
<dependencies>
10247
<dependency>
@@ -114,204 +59,14 @@
11459
<artifactId>jsonvalidator-web</artifactId>
11560
<version>${project.version}</version>
11661
</dependency>
117-
<dependency>
118-
<groupId>eu.europa.ec.itb</groupId>
119-
<artifactId>gitb-types</artifactId>
120-
<version>${version.gitbTypes}</version>
121-
</dependency>
122-
<dependency>
123-
<groupId>eu.europa.ec.itb.commons</groupId>
124-
<artifactId>validation-commons</artifactId>
125-
<version>${version.itbCommons}</version>
126-
</dependency>
127-
<dependency>
128-
<groupId>eu.europa.ec.itb.commons</groupId>
129-
<artifactId>validation-commons-report</artifactId>
130-
<version>${version.itbCommons}</version>
131-
</dependency>
132-
<dependency>
133-
<groupId>eu.europa.ec.itb.commons</groupId>
134-
<artifactId>validation-commons-web</artifactId>
135-
<version>${version.itbCommons}</version>
136-
</dependency>
137-
<dependency>
138-
<groupId>eu.europa.ec.itb.commons</groupId>
139-
<artifactId>validation-commons-war</artifactId>
140-
<version>${version.itbCommons}</version>
141-
</dependency>
142-
<dependency>
143-
<groupId>eu.europa.ec.itb.commons</groupId>
144-
<artifactId>validation-commons-jar</artifactId>
145-
<version>${version.itbCommons}</version>
146-
</dependency>
147-
<dependency>
148-
<groupId>org.apache.cxf</groupId>
149-
<artifactId>cxf-spring-boot-starter-jaxws</artifactId>
150-
<version>${version.cxf}</version>
151-
</dependency>
152-
<dependency>
153-
<groupId>org.springframework.boot</groupId>
154-
<artifactId>spring-boot-starter</artifactId>
155-
<version>${version.springBoot}</version>
156-
</dependency>
157-
<dependency>
158-
<groupId>org.springframework.boot</groupId>
159-
<artifactId>spring-boot-starter-web</artifactId>
160-
<version>${version.springBoot}</version>
161-
</dependency>
162-
<dependency>
163-
<groupId>javax.xml.ws</groupId>
164-
<artifactId>jaxws-api</artifactId>
165-
<version>${version.jaxws}</version>
166-
</dependency>
167-
<dependency>
168-
<groupId>javax.jws</groupId>
169-
<artifactId>javax.jws-api</artifactId>
170-
<version>${version.jws}</version>
171-
</dependency>
172-
<dependency>
173-
<groupId>javax.annotation</groupId>
174-
<artifactId>javax.annotation-api</artifactId>
175-
<version>${version.javaxAnnotationApi}</version>
176-
</dependency>
177-
<dependency>
178-
<groupId>javax.activation</groupId>
179-
<artifactId>activation</artifactId>
180-
<version>${version.javaxActivation}</version>
181-
</dependency>
182-
<dependency>
183-
<groupId>org.apache.commons</groupId>
184-
<artifactId>commons-configuration2</artifactId>
185-
<version>${version.commonsConfiguration}</version>
186-
</dependency>
187-
<dependency>
188-
<groupId>org.apache.commons</groupId>
189-
<artifactId>commons-lang3</artifactId>
190-
<version>${version.commonsLang}</version>
191-
</dependency>
192-
<dependency>
193-
<groupId>commons-io</groupId>
194-
<artifactId>commons-io</artifactId>
195-
<version>${version.commonsIo}</version>
196-
</dependency>
197-
<dependency>
198-
<groupId>org.leadpony.justify</groupId>
199-
<artifactId>justify</artifactId>
200-
<version>${version.justify}</version>
201-
</dependency>
202-
<dependency>
203-
<groupId>jakarta.json</groupId>
204-
<artifactId>jakarta.json-api</artifactId>
205-
<version>${version.jakartaJson}</version>
206-
</dependency>
207-
<dependency>
208-
<groupId>com.jayway.jsonpath</groupId>
209-
<artifactId>json-path</artifactId>
210-
<version>${version.jayway}</version>
211-
</dependency>
212-
<dependency>
213-
<groupId>org.glassfish</groupId>
214-
<artifactId>jakarta.json</artifactId>
215-
<classifier>module</classifier>
216-
<version>${version.jakartaJson}</version>
217-
<scope>runtime</scope>
218-
</dependency>
219-
<dependency>
220-
<groupId>com.google.code.gson</groupId>
221-
<artifactId>gson</artifactId>
222-
<version>${version.gson}</version>
223-
</dependency>
224-
<dependency>
225-
<groupId>org.springframework.boot</groupId>
226-
<artifactId>spring-boot-starter-thymeleaf</artifactId>
227-
<version>${version.springBoot}</version>
228-
</dependency>
229-
<dependency>
230-
<groupId>org.apache.tika</groupId>
231-
<artifactId>tika-core</artifactId>
232-
<version>${version.tika}</version>
233-
</dependency>
234-
<dependency>
235-
<groupId>org.springframework.boot</groupId>
236-
<artifactId>spring-boot-starter-validation</artifactId>
237-
<version>${version.springBoot}</version>
238-
</dependency>
239-
<dependency>
240-
<groupId>org.aspectj</groupId>
241-
<artifactId>aspectjweaver</artifactId>
242-
<version>${version.aspectjWeaver}</version>
243-
</dependency>
244-
<dependency>
245-
<groupId>org.springframework.boot</groupId>
246-
<artifactId>spring-boot-starter-test</artifactId>
247-
<scope>test</scope>
248-
<version>${version.springBoot}</version>
249-
</dependency>
250-
<dependency>
251-
<groupId>eu.europa.ec.itb.commons</groupId>
252-
<artifactId>validation-commons</artifactId>
253-
<version>${version.itbCommons}</version>
254-
<type>test-jar</type>
255-
<classifier>tests</classifier>
256-
<scope>test</scope>
257-
</dependency>
25862
</dependencies>
25963
</dependencyManagement>
26064

26165
<build>
262-
<pluginManagement>
263-
<plugins>
264-
<plugin>
265-
<groupId>org.owasp</groupId>
266-
<artifactId>dependency-check-maven</artifactId>
267-
<version>6.3.1</version>
268-
<configuration>
269-
<failBuildOnCVSS>0</failBuildOnCVSS>
270-
<suppressionFile>etc/owasp-suppressions.xml</suppressionFile>
271-
</configuration>
272-
<executions>
273-
<execution>
274-
<phase>none</phase>
275-
<!-- Run manually with mvn dependency-check:aggregate -->
276-
</execution>
277-
</executions>
278-
</plugin>
279-
</plugins>
280-
</pluginManagement>
28166
<plugins>
282-
<plugin>
283-
<groupId>org.apache.maven.plugins</groupId>
284-
<artifactId>maven-compiler-plugin</artifactId>
285-
<version>3.8.1</version>
286-
<configuration>
287-
<source>11</source>
288-
<target>11</target>
289-
</configuration>
290-
</plugin>
291-
<plugin>
292-
<groupId>org.apache.maven.plugins</groupId>
293-
<artifactId>maven-jar-plugin</artifactId>
294-
<version>3.2.0</version>
295-
<configuration>
296-
<archive>
297-
<manifestEntries>
298-
<Build-Timestamp>${validatorTimestamp}</Build-Timestamp>
299-
</manifestEntries>
300-
</archive>
301-
</configuration>
302-
</plugin>
303-
<plugin>
304-
<groupId>org.codehaus.mojo</groupId>
305-
<artifactId>versions-maven-plugin</artifactId>
306-
<version>2.8.1</version>
307-
<configuration>
308-
<processAllModules>true</processAllModules>
309-
</configuration>
310-
</plugin>
31167
<plugin>
31268
<groupId>org.apache.maven.plugins</groupId>
31369
<artifactId>maven-enforcer-plugin</artifactId>
314-
<version>3.0.0-M3</version>
31570
<configuration>
31671
<rules>
31772
<requireReleaseDeps>
@@ -325,25 +80,6 @@
32580
<fail>true</fail>
32681
</configuration>
32782
</plugin>
328-
<plugin>
329-
<groupId>org.jacoco</groupId>
330-
<artifactId>jacoco-maven-plugin</artifactId>
331-
<version>0.8.7</version>
332-
<executions>
333-
<execution>
334-
<goals>
335-
<goal>prepare-agent</goal>
336-
</goals>
337-
</execution>
338-
<execution>
339-
<id>report</id>
340-
<phase>test</phase>
341-
<goals>
342-
<goal>report</goal>
343-
</goals>
344-
</execution>
345-
</executions>
346-
</plugin>
34783
</plugins>
34884
</build>
34985

0 commit comments

Comments
 (0)