Merge remote-tracking branch 'upstream/master' into sync-upstream-master

Author: fgibelin

.github/workflows/codeql-analysis.yml

@@ -27,14 +27,14 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v6
+      uses: actions/checkout@v7
       # Get full history for spotless ratchetFrom
       with:
         fetch-depth: 0
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v4
+      uses: github/codeql-action/init@v4.37.9
       with:
         languages: ${{ matrix.language }}
         queries: security-extended, security-experimental, security-and-quality
@@ -43,7 +43,7 @@ jobs:
       run: mvn -DskipTests=true install
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v4
+      uses: github/codeql-action/analyze@v4.37.9
 
     - name: Upload Output
       uses: actions/upload-artifact@v7

.github/workflows/maven.yaml

@@ -8,11 +8,11 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v6
+    - uses: actions/checkout@v7
       with:
         fetch-depth: 0
     - name: Set up JDK 17
-      uses: actions/setup-java@v5
+      uses: actions/setup-java@v6
       with:
         java-version: 17
         distribution: zulu

pom.xml

@@ -636,7 +636,7 @@
         <dependency>
             <groupId>commons-codec</groupId>
             <artifactId>commons-codec</artifactId>
-            <version>1.22.0</version>
+            <version>1.22.1</version>
         </dependency>
 
         <!-- mvn dependency:analyze says this is an unused declared dependency, but its wrong. Get this runtime error if it's not included: Caused by: org.springframework.beans.factory.CannotLoadBeanClassException: Cannot find class [org.apache.commons.dbcp.BasicDataSource] for bean with name 'dataSource' defined in class path resource [context.xml]; nested exception is java.lang.ClassNotFoundException: org.apache.commons.dbcp.BasicDataSource -->
@@ -663,13 +663,14 @@
         <dependency>
             <groupId>org.slf4j</groupId>
             <artifactId>slf4j-reload4j</artifactId>
-            <version>2.0.17</version>
+            <version>2.0.19</version>
         </dependency>
 
+        <!-- NOTE: Do NOT upgrade this library until the Apache team fixes issue: https://issues.apache.org/jira/browse/DIRAPI-433 -->
         <dependency>
             <groupId>org.apache.directory.api</groupId>
             <artifactId>api-ldap-model</artifactId>
-            <version>${version.apache.api-ldap}</version>
+            <version>2.1.7</version>
         </dependency>
 
         <dependency>
@@ -777,13 +778,13 @@
         <dependency>
             <groupId>org.apache.httpcomponents.client5</groupId>
             <artifactId>httpclient5</artifactId>
-            <version>5.6.1</version>
+            <version>5.6.4</version>
         </dependency>
 
         <dependency>
             <groupId>org.apache.httpcomponents.core5</groupId>
             <artifactId>httpcore5</artifactId>
-            <version>5.4.2</version>
+            <version>5.4.3</version>
         </dependency>
 
         <dependency>
@@ -866,7 +867,7 @@
         <dependency>
             <groupId>com.fasterxml.jackson.core</groupId>
             <artifactId>jackson-databind</artifactId>
-            <version>2.21.3</version>
+            <version>2.22.2</version>
         </dependency>
     </dependencies>
 
@@ -902,7 +903,7 @@
                 <plugin>
                     <groupId>org.apache.maven.plugins</groupId>
                     <artifactId>maven-dependency-plugin</artifactId>
-                    <version>3.10.0</version>
+                    <version>3.11.0</version>
                     <configuration>
                         <usedDependencies>
                             <dependency>com.sun.jersey:jersey-servlet</dependency>
@@ -936,7 +937,7 @@
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-compiler-plugin</artifactId>
-                <version>3.15.0</version>
+                <version>3.16.0</version>
                 <configuration>
                     <fork>true</fork>
                     <meminitial>1000m</meminitial>
@@ -954,7 +955,7 @@
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-enforcer-plugin</artifactId>
-                <version>3.6.2</version>
+                <version>3.6.3</version>
                 <dependencies>
                     <dependency>
                         <groupId>org.codehaus.mojo</groupId>
@@ -999,7 +1000,7 @@
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-help-plugin</artifactId>
-                <version>3.5.1</version>
+                <version>3.5.2</version>
             </plugin>
 
             <plugin>
@@ -1036,7 +1037,7 @@
                 <!-- Note: This uses the maven-fluido-skin version specified next. The skin is referenced in src/site/site.xml. -->
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-site-plugin</artifactId>
-                <version>3.21.0</version>
+                <version>3.22.0</version>
                 <dependencies>
                     <!-- Explicitly declare these dependencies so the versions plugin and library bots will flag available updates. The fluido-skin plugin is referenced in src/site/site.xml using the same fluido version property. -->
                     <dependency>
@@ -1050,7 +1051,7 @@
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-surefire-plugin</artifactId>
-                <version>3.5.5</version>
+                <version>3.6.0</version>
             </plugin>
 
             <plugin>
@@ -1065,7 +1066,7 @@
             <plugin>
                 <groupId>org.codehaus.cargo</groupId>
                 <artifactId>cargo-maven3-plugin</artifactId>
-                <version>1.10.27</version>
+                <version>1.10.28</version>
             </plugin>
 
             <plugin>
@@ -1116,7 +1117,7 @@
             <plugin>
                 <groupId>com.diffplug.spotless</groupId>
                 <artifactId>spotless-maven-plugin</artifactId>
-                <version>3.4.0</version>
+                <version>3.10.2</version>
                 <configuration>
                     <!-- optional: limit format enforcement to just the files changed by this feature branch -->
                     <ratchetFrom>origin/master</ratchetFrom>
@@ -1255,19 +1256,19 @@
         </tomcat.jvmargs.debug>
         <log.directory>${project.build.directory}/log</log.directory>
 
-        <version.apache.api-ldap>2.1.7</version.apache.api-ldap>
+        <version.apache.api-ldap>2.1.8</version.apache.api-ldap>
         <version.apacheds>2.0.0.AM27</version.apacheds>
         <version.fluido>2.1.0</version.fluido>
         <!-- hibernate is up to rev 6+. But 4.0.0. causes this error: symbol: org.hibernate.classic.Session not found -->
         <version.hibernate>3.6.10.Final</version.hibernate>
-        <version.spotbugs.maven>4.9.8.3</version.spotbugs.maven>
-        <version.spotbugs>4.9.8</version.spotbugs>
+        <version.spotbugs.maven>4.10.4.1</version.spotbugs.maven>
+        <version.spotbugs>4.10.4</version.spotbugs>
         <!-- Spring 6.x requires Java 17 -->
         <version.springframework>5.3.39</version.springframework>
         <!-- Tomcat 10 moves from Java EE to Jakarta EE, moving packages javax.* to jakarta.* - code changes likely required to address this change. -->
         <tomcat.major.version>9</tomcat.major.version>
-        <version.tomcat>9.0.115</version.tomcat>
-        <tomcat.url>https://archive.apache.org/dist/tomcat/tomcat-${tomcat.major.version}/v${version.tomcat}/bin/apache-tomcat-${version.tomcat}.zip</tomcat.url>
+        <version.tomcat>9.0.120</version.tomcat>
+        <tomcat.url>https://downloads.apache.org/tomcat/tomcat-${tomcat.major.version}/v${version.tomcat}/bin/apache-tomcat-${version.tomcat}.zip</tomcat.url>
     </properties>
 
 </project>

scripts/runCognium.sh

@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+
+# Install: npm install -g cognium
+# Check for install/updates at https://github.com/cogniumhq/cognium
+
+source scripts/requireCommand.sh
+
+requireCommand cognium
+
+benchmark_version=$(scripts/getBenchmarkVersion.sh 2>/dev/null | grep -E '^[0-9]+\.[0-9]')
+cognium_version=$(cognium --version | grep -oE '[0-9]+\.[0-9]+\.[0-9]+')
+result_file="results/Benchmark_$benchmark_version-cognium-v$cognium_version.sarif"
+
+cognium scan src/main/java --format sarif --category security --output "$result_file"

scripts/runOpenTaint.sh

@@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+
+# Check for install/updates at https://github.com/seqra/opentaint
+
+source scripts/requireCommand.sh
+
+requireCommand docker
+
+docker pull ghcr.io/seqra/opentaint
+
+benchmark_version=$(scripts/getBenchmarkVersion.sh 2>/dev/null | tail -1)
+opentaint_version=$(docker run --rm ghcr.io/seqra/opentaint opentaint --version | awk '{print $NF}')
+result_file="/project/results/Benchmark_$benchmark_version-OpenTaint-$opentaint_version.sarif"
+
+docker run --rm -v $(pwd):/project \
+  ghcr.io/seqra/opentaint:latest \
+  opentaint scan \
+  --severity error \
+  --severity warning \
+  --severity note \
+  --output "$result_file" /project

scripts/runSonarQube.sh

@@ -13,11 +13,6 @@ requireCommand curl
 requireCommand docker
 requireCommand jq
 
-if ! command -v "sonar-report" &> /dev/null; then
-  echo "sonar-report is required. Please install it via https://github.com/soprasteria/sonar-report and then try again."
-  exit 1
-fi
-
 # Check for install/updates at https://github.com/SonarSource/sonarqube
 
 container_name="sonarqube-benchmark"
@@ -69,11 +64,12 @@ echo "Starting scan... (might take some time!)"
 container_ip=$(docker inspect "$container_name" | jq -r '.[0].NetworkSettings.Networks.bridge.IPAddress' )
 sonar_docker_host="http://$container_ip:$sonar_internal_port"
 
-docker run --env SONAR_SCANNER_OPTS=-Xmx4g --rm -v ~/.m2:/root/.m2 -v "$(pwd)":"$(pwd)" -w "$(pwd)" sonarsource/sonar-scanner-cli \
+docker run --env SONAR_SCANNER_OPTS=-Xmx4g --rm -v ~/.m2:/root/.m2 -v "$(pwd)":/benchmark -w "/benchmark" sonarsource/sonar-scanner-cli \
+  -Dsonar.projectBaseDir="/benchmark" \
   -Dsonar.java.binaries="target" \
   -Dsonar.projectKey="$sonar_project" \
   -Dsonar.host.url="$sonar_docker_host" \
-  -Dsonar.login="$sonar_token" \
+  -Dsonar.token="$sonar_token" \
   -Dsonar.sources="src" \
   -Dsonar.exclusions="results/**,scorecard/**,scripts/**,tools/**,VMs/**,**/*.js"
 
@@ -87,8 +83,9 @@ done
 echo ""
 echo "Generating report..."
 
+mvn compile
 mvn exec:java -Dexec.mainClass="org.owasp.benchmark.report.sonarqube.SonarReport"
 
 echo "Shutting down SonarQube..."
 
-#docker stop "$container_name"
+docker stop "$container_name"