From c7df06333fa81063785d9513ad271018fc74775f Mon Sep 17 00:00:00 2001 From: thomaswoehlke Date: Fri, 2 Oct 2020 09:57:15 +0200 Subject: [PATCH 01/31] Issue #283 prepare Release 2.3.24 --- .idea/compiler.xml | 2 +- etc/TODO.md | 6 ++++++ 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/.idea/compiler.xml b/.idea/compiler.xml index 96f6de9d..ddb391b5 100644 --- a/.idea/compiler.xml +++ b/.idea/compiler.xml @@ -11,7 +11,7 @@ - + diff --git a/etc/TODO.md b/etc/TODO.md index ce172bd4..e81501a3 100644 --- a/etc/TODO.md +++ b/etc/TODO.md @@ -125,3 +125,9 @@ Caused by: org.postgresql.util.PSQLException: ERROR: relation "spring_session" d ## 2.3.24 * fixed #277 heroku: Compiled slug size: 617.9M is too large (max is 500M) * fixed #279 Formular Layout Errors +* Issue #283 prepare Release 2.3.24 +* Issue #284 make release with maven plugin + +## 2.3.245 +* Issue #285 Update spring-boot 2.3.3 to 2.3.4 + From 58fe86c835b82c89549129628eccc995030fade4 Mon Sep 17 00:00:00 2001 From: thomaswoehlke Date: Fri, 2 Oct 2020 10:00:34 +0200 Subject: [PATCH 02/31] [maven-release-plugin] prepare release v2.3.24 --- pom.xml | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/pom.xml b/pom.xml index 5637a930..0e3f9c23 100644 --- a/pom.xml +++ b/pom.xml @@ -1,12 +1,10 @@ - + 4.0.0 org.woehlke simpleworklist - 2.3.24-SNAPSHOT + 2.3.24 jar @@ -19,7 +17,7 @@ scm:git:git@github.com:Spring-Framework-Java-Apps/simpleworklist.git scm:git:git@github.com:Spring-Framework-Java-Apps/simpleworklist.git https://github.com/Spring-Framework-Java-Apps/simpleworklist/tree/${project.scm.tag} - master + v2.3.24 simpleworklist From cf75952773e63c5fe54545599c476e45c69f634e Mon Sep 17 00:00:00 2001 From: thomaswoehlke Date: Fri, 2 Oct 2020 10:00:41 +0200 Subject: [PATCH 03/31] [maven-release-plugin] prepare for next development iteration --- pom.xml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pom.xml b/pom.xml index 0e3f9c23..d4787238 100644 --- a/pom.xml +++ b/pom.xml @@ -4,7 +4,7 @@ org.woehlke simpleworklist - 2.3.24 + 2.3.25-SNAPSHOT jar @@ -17,7 +17,7 @@ scm:git:git@github.com:Spring-Framework-Java-Apps/simpleworklist.git scm:git:git@github.com:Spring-Framework-Java-Apps/simpleworklist.git https://github.com/Spring-Framework-Java-Apps/simpleworklist/tree/${project.scm.tag} - v2.3.24 + master simpleworklist From c0f56f206151eeb49848557515029a04b783b087 Mon Sep 17 00:00:00 2001 From: thomaswoehlke Date: Fri, 2 Oct 2020 10:09:55 +0200 Subject: [PATCH 04/31] Issue #283 prepare Release 2.3.24 --- .idea/compiler.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.idea/compiler.xml b/.idea/compiler.xml index ddb391b5..96f6de9d 100644 --- a/.idea/compiler.xml +++ b/.idea/compiler.xml @@ -11,7 +11,7 @@ - + From 49302855a02fc571606dfb6e92a1f108c6c52ed8 Mon Sep 17 00:00:00 2001 From: thomaswoehlke Date: Fri, 2 Oct 2020 10:11:23 +0200 Subject: [PATCH 05/31] Issue #285 Update spring-boot 2.3.3 to 2.3.4 --- etc/TODO.md | 4 ++-- pom.xml | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/etc/TODO.md b/etc/TODO.md index e81501a3..b47453f5 100644 --- a/etc/TODO.md +++ b/etc/TODO.md @@ -125,8 +125,8 @@ Caused by: org.postgresql.util.PSQLException: ERROR: relation "spring_session" d ## 2.3.24 * fixed #277 heroku: Compiled slug size: 617.9M is too large (max is 500M) * fixed #279 Formular Layout Errors -* Issue #283 prepare Release 2.3.24 -* Issue #284 make release with maven plugin +* fixed #283 prepare Release 2.3.24 +* fixed #284 make release with maven plugin ## 2.3.245 * Issue #285 Update spring-boot 2.3.3 to 2.3.4 diff --git a/pom.xml b/pom.xml index d4787238..d1ced70e 100644 --- a/pom.xml +++ b/pom.xml @@ -10,7 +10,7 @@ org.springframework.boot spring-boot-starter-parent - 2.3.3.RELEASE + 2.3.4.RELEASE From e7e8c592c508e1fa278a67a71981ff220a185be9 Mon Sep 17 00:00:00 2001 From: thomaswoehlke Date: Fri, 2 Oct 2020 10:20:20 +0200 Subject: [PATCH 06/31] Issue #285 Update spring-boot 2.3.3 to 2.3.4 --- pom.xml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/pom.xml b/pom.xml index d1ced70e..f2664af6 100644 --- a/pom.xml +++ b/pom.xml @@ -137,9 +137,9 @@ ${project.parent.version} - Neumann-SR3 - Dragonfruit-RELEASE - 5.2.8.RELEASE + Neumann-SR4 + Dragonfruit-SR1 + 5.2.9.RELEASE 5.3.2.RELEASE From f4f43b5c71341b4c29595481f373dc153c9d8857 Mon Sep 17 00:00:00 2001 From: thomaswoehlke Date: Fri, 2 Oct 2020 10:23:29 +0200 Subject: [PATCH 07/31] Issue #285 Update spring-boot 2.3.3 to 2.3.4 --- pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pom.xml b/pom.xml index f2664af6..2db252c0 100644 --- a/pom.xml +++ b/pom.xml @@ -140,7 +140,7 @@ Neumann-SR4 Dragonfruit-SR1 5.2.9.RELEASE - 5.3.2.RELEASE + 5.3.4.RELEASE 5.6.2 From dc17426e5f865eac5aa4089c00348e9017ccd903 Mon Sep 17 00:00:00 2001 From: thomaswoehlke Date: Fri, 2 Oct 2020 10:26:54 +0200 Subject: [PATCH 08/31] Issue #285 Update spring-boot 2.3.3 to 2.3.4 --- pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pom.xml b/pom.xml index 2db252c0..dec8c05f 100644 --- a/pom.xml +++ b/pom.xml @@ -146,7 +146,7 @@ 5.6.2 2.6.4 2.6.4 - 2.40.0 + 2.43.0 2.2 1.18.12 1.13.1 From e8e69d0410065b51f39055945bd366e91beb7e70 Mon Sep 17 00:00:00 2001 From: thomaswoehlke Date: Fri, 2 Oct 2020 10:33:36 +0200 Subject: [PATCH 09/31] * fixed #283 prepare Release 2.3.24 * fixed #284 make release with maven plugin * fixed #285 Update spring-boot 2.3.3 to 2.3.4 * fixed #286 Update spring-data-releasetrain to Neumann-SR4 * fixed #287 Update spring-session-bom to Dragonfruit-SR1 --- etc/TODO.md | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/etc/TODO.md b/etc/TODO.md index b47453f5..e291da5e 100644 --- a/etc/TODO.md +++ b/etc/TODO.md @@ -128,6 +128,9 @@ Caused by: org.postgresql.util.PSQLException: ERROR: relation "spring_session" d * fixed #283 prepare Release 2.3.24 * fixed #284 make release with maven plugin -## 2.3.245 -* Issue #285 Update spring-boot 2.3.3 to 2.3.4 +## 2.3.25 +* fixed #285 Update spring-boot 2.3.3 to 2.3.4 +* fixed #286 Update spring-data-releasetrain to Neumann-SR4 +* fixed #287 Update spring-session-bom to Dragonfruit-SR1 + From 91822fe2f86d7d342fbca05c1064a97d2e75ab1a Mon Sep 17 00:00:00 2001 From: thomaswoehlke Date: Fri, 2 Oct 2020 10:35:10 +0200 Subject: [PATCH 10/31] [maven-release-plugin] prepare release v2.3.25 --- pom.xml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pom.xml b/pom.xml index dec8c05f..db13e79c 100644 --- a/pom.xml +++ b/pom.xml @@ -4,7 +4,7 @@ org.woehlke simpleworklist - 2.3.25-SNAPSHOT + 2.3.25 jar @@ -17,7 +17,7 @@ scm:git:git@github.com:Spring-Framework-Java-Apps/simpleworklist.git scm:git:git@github.com:Spring-Framework-Java-Apps/simpleworklist.git https://github.com/Spring-Framework-Java-Apps/simpleworklist/tree/${project.scm.tag} - master + v2.3.25 simpleworklist From c8885bc86ce5a6af6688f1e24ced3ce457cc6782 Mon Sep 17 00:00:00 2001 From: thomaswoehlke Date: Fri, 2 Oct 2020 10:35:19 +0200 Subject: [PATCH 11/31] [maven-release-plugin] prepare for next development iteration --- pom.xml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/pom.xml b/pom.xml index db13e79c..6439463f 100644 --- a/pom.xml +++ b/pom.xml @@ -4,7 +4,7 @@ org.woehlke simpleworklist - 2.3.25 + 2.3.26-SNAPSHOT jar @@ -17,7 +17,7 @@ scm:git:git@github.com:Spring-Framework-Java-Apps/simpleworklist.git scm:git:git@github.com:Spring-Framework-Java-Apps/simpleworklist.git https://github.com/Spring-Framework-Java-Apps/simpleworklist/tree/${project.scm.tag} - v2.3.25 + master simpleworklist From 66c57f476609f848ea218de568cd2dfd8cbb4408 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thomas=20W=C3=B6hlke?= <36666317+thomaswoehlke@users.noreply.github.com> Date: Fri, 2 Oct 2020 10:49:57 +0200 Subject: [PATCH 12/31] Create codeql-analysis.yml --- .github/workflows/codeql-analysis.yml | 71 +++++++++++++++++++++++++++ 1 file changed, 71 insertions(+) create mode 100644 .github/workflows/codeql-analysis.yml diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml new file mode 100644 index 00000000..4f01cf2b --- /dev/null +++ b/.github/workflows/codeql-analysis.yml @@ -0,0 +1,71 @@ +# For most projects, this workflow file will not need changing; you simply need +# to commit it to your repository. +# +# You may wish to alter this file to override the set of languages analyzed, +# or to provide custom queries or build logic. +name: "CodeQL" + +on: + push: + branches: [master] + pull_request: + # The branches below must be a subset of the branches above + branches: [master] + schedule: + - cron: '0 19 * * 2' + +jobs: + analyze: + name: Analyze + runs-on: ubuntu-latest + + strategy: + fail-fast: false + matrix: + # Override automatic language detection by changing the below list + # Supported options are ['csharp', 'cpp', 'go', 'java', 'javascript', 'python'] + language: ['java', 'javascript'] + # Learn more... + # https://docs.github.com/en/github/finding-security-vulnerabilities-and-errors-in-your-code/configuring-code-scanning#overriding-automatic-language-detection + + steps: + - name: Checkout repository + uses: actions/checkout@v2 + with: + # We must fetch at least the immediate parents so that if this is + # a pull request then we can checkout the head. + fetch-depth: 2 + + # If this run was triggered by a pull request event, then checkout + # the head of the pull request instead of the merge commit. + - run: git checkout HEAD^2 + if: ${{ github.event_name == 'pull_request' }} + + # Initializes the CodeQL tools for scanning. + - name: Initialize CodeQL + uses: github/codeql-action/init@v1 + with: + languages: ${{ matrix.language }} + # If you wish to specify custom queries, you can do so here or in a config file. + # By default, queries listed here will override any specified in a config file. + # Prefix the list here with "+" to use these queries and those in the config file. + # queries: ./path/to/local/query, your-org/your-repo/queries@main + + # Autobuild attempts to build any compiled languages (C/C++, C#, or Java). + # If this step fails, then you should remove it and run the build manually (see below) + - name: Autobuild + uses: github/codeql-action/autobuild@v1 + + # ℹī¸ Command-line programs to run using the OS shell. + # 📚 https://git.io/JvXDl + + # ✏ī¸ If the Autobuild fails above, remove it and uncomment the following three lines + # and modify them (or add more) to build your code if your project + # uses a compiled language + + #- run: | + # make bootstrap + # make release + + - name: Perform CodeQL Analysis + uses: github/codeql-action/analyze@v1 From 24719ed0b137db4b291ba43b2da8c15cca17fe2c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thomas=20W=C3=B6hlke?= <36666317+thomaswoehlke@users.noreply.github.com> Date: Fri, 2 Oct 2020 10:53:39 +0200 Subject: [PATCH 13/31] Create ossar-analysis.yml --- .github/workflows/ossar-analysis.yml | 49 ++++++++++++++++++++++++++++ 1 file changed, 49 insertions(+) create mode 100644 .github/workflows/ossar-analysis.yml diff --git a/.github/workflows/ossar-analysis.yml b/.github/workflows/ossar-analysis.yml new file mode 100644 index 00000000..1360736d --- /dev/null +++ b/.github/workflows/ossar-analysis.yml @@ -0,0 +1,49 @@ +# This workflow integrates a collection of open source static analysis tools +# with GitHub code scanning. For documentation, or to provide feedback, visit +# https://github.com/github/ossar-action +name: OSSAR + +on: + push: + pull_request: + +jobs: + OSSAR-Scan: + # OSSAR runs on windows-latest. + # ubuntu-latest and macos-latest support coming soon + runs-on: ubuntu-latest + + steps: + # Checkout your code repository to scan + - name: Checkout repository + uses: actions/checkout@v2 + with: + # We must fetch at least the immediate parents so that if this is + # a pull request then we can checkout the head. + fetch-depth: 2 + + # If this run was triggered by a pull request event, then checkout + # the head of the pull request instead of the merge commit. + - run: git checkout HEAD^2 + if: ${{ github.event_name == 'pull_request' }} + + # Ensure a compatible version of dotnet is installed. + # The [Microsoft Security Code Analysis CLI](https://aka.ms/mscadocs) is built with dotnet v3.1.201. + # A version greater than or equal to v3.1.201 of dotnet must be installed on the agent in order to run this action. + # GitHub hosted runners already have a compatible version of dotnet installed and this step may be skipped. + # For self-hosted runners, ensure dotnet version 3.1.201 or later is installed by including this action: + # - name: Install .NET + # uses: actions/setup-dotnet@v1 + # with: + # dotnet-version: '3.1.x' + + # Run open source static analysis tools + - name: Run OSSAR + uses: github/ossar-action@v1 + id: ossar + + # Upload results to the Security tab + - name: Upload OSSAR results + uses: github/codeql-action/upload-sarif@v1 + with: + sarif_file: ${{ steps.ossar.outputs.sarifFile }} From d660802bc3e8fd852a52e98c0d19ba864b7cb3ec Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thomas=20W=C3=B6hlke?= <36666317+thomaswoehlke@users.noreply.github.com> Date: Fri, 2 Oct 2020 10:56:07 +0200 Subject: [PATCH 14/31] Create SECURITY.md --- SECURITY.md | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 00000000..c02d19ce --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,19 @@ +# Security Policy + +## Supported Versions + +Use this section to tell people about which versions of your project are +currently being supported with security updates. + +| Version | Supported | +| -------- | ------------------ | +| 2.3.x | :white_check_mark: | +| < 2.3.25 | :x: | + +## Reporting a Vulnerability + +Use this section to tell people how to report a vulnerability. + +Tell them where to go, how often they can expect to get an update on a +reported vulnerability, what to expect if the vulnerability is accepted or +declined, etc. From 37348b1caea6cf4a057d415b3ff031c912cdac3f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thomas=20W=C3=B6hlke?= <36666317+thomaswoehlke@users.noreply.github.com> Date: Fri, 2 Oct 2020 10:57:03 +0200 Subject: [PATCH 15/31] Update SECURITY.md --- SECURITY.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index c02d19ce..1a233404 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -2,8 +2,7 @@ ## Supported Versions -Use this section to tell people about which versions of your project are -currently being supported with security updates. +These versions of the project are currently being supported with security updates. | Version | Supported | | -------- | ------------------ | From 8e1e0e09b973b7ecc3db9a85ae70729e5b4f9fdd Mon Sep 17 00:00:00 2001 From: thomaswoehlke Date: Fri, 2 Oct 2020 11:07:30 +0200 Subject: [PATCH 16/31] * fixed #283 prepare Release 2.3.24 * fixed #284 make release with maven plugin * fixed #285 Update spring-boot 2.3.3 to 2.3.4 * fixed #286 Update spring-data-releasetrain to Neumann-SR4 * fixed #287 Update spring-session-bom to Dragonfruit-SR1 --- .github/workflows/ossar-analysis.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/ossar-analysis.yml b/.github/workflows/ossar-analysis.yml index 1360736d..84e84392 100644 --- a/.github/workflows/ossar-analysis.yml +++ b/.github/workflows/ossar-analysis.yml @@ -5,13 +5,15 @@ name: OSSAR on: push: + branches: [ master ] pull_request: + branches: [ master ] jobs: OSSAR-Scan: # OSSAR runs on windows-latest. # ubuntu-latest and macos-latest support coming soon - runs-on: ubuntu-latest + runs-on: windows-latest steps: # Checkout your code repository to scan From 83cacdd2294872df109b7697ff59e3716afaaafd Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thomas=20W=C3=B6hlke?= <36666317+thomaswoehlke@users.noreply.github.com> Date: Fri, 2 Oct 2020 11:09:47 +0200 Subject: [PATCH 17/31] Create fortify-analysis.yml --- .github/workflows/fortify-analysis.yml | 95 ++++++++++++++++++++++++++ 1 file changed, 95 insertions(+) create mode 100644 .github/workflows/fortify-analysis.yml diff --git a/.github/workflows/fortify-analysis.yml b/.github/workflows/fortify-analysis.yml new file mode 100644 index 00000000..f8c56c15 --- /dev/null +++ b/.github/workflows/fortify-analysis.yml @@ -0,0 +1,95 @@ +################################################################################################################################################ +# Fortify lets you build secure software fast with an appsec platform that automates testing throughout the DevSecOps pipeline. Fortify static,# +# dynamic, interactive, and runtime security testing is available on premises or as a service. To learn more about Fortify, start a free trial # +# or contact our sales team, visit microfocus.com/appsecurity. # +# # +# Use this workflow template as a basis for integrating Fortify on Demand Static Application Security Testing(SAST) into your GitHub workflows.# +# This template demonstrates the steps to prepare the code+dependencies, initiate a scan, download results once complete and import into # +# GitHub Security Code Scanning Alerts. Existing customers should review inputs and environment variables below to configure scanning against # +# an existing application in your Fortify on Demand tenant. Additional information is available in the comments throughout the workflow, the # +# documentation for the Fortify actions used, and the Fortify on Demand / ScanCentral Client product documentation. If you need additional # +# assistance with configuration, feel free to create a help ticket in the Fortify on Demand portal. # +################################################################################################################################################ + +name: Fortify on Demand Scan + +# TODO: Customize trigger events based on your DevSecOps processes and typical FoD SAST scan time +on: + workflow_dispatch: + push: + branches: [master] + pull_request: + # The branches below must be a subset of the branches above + branches: [master] + +jobs: + FoD-SAST-Scan: + # Use the appropriate runner for building your source code. + # TODO: Use a Windows runner for .NET projects that use msbuild. Additional changes to RUN commands will be required to switch to Windows syntax. + runs-on: ubuntu-latest + + steps: + # Check out source code + - name: Check Out Source Code + uses: actions/checkout@v2 + with: + # Fetch at least the immediate parents so that if this is a pull request then we can checkout the head. + fetch-depth: 2 + # If this run was triggered by a pull request event, then checkout the head of the pull request instead of the merge commit. + - run: git checkout HEAD^2 + if: ${{ github.event_name == 'pull_request' }} + # Java 8 required by ScanCentral Client and FoD Uploader(Univeral CI Tool) + - name: Setup Java + uses: actions/setup-java@v1 + with: + java-version: 1.8 + + # Prepare source+dependencies for upload. The default example is for a Maven project that uses pom.xml. + # TODO: Update PACKAGE_OPTS based on the ScanCentral Client documentation for your project's included tech stack(s). Helpful hints: + # ScanCentral Client will download dependencies for maven (-bt mvn) and gradle (-bt gradle). + # ScanCentral Client can download dependencies for msbuild projects (-bt msbuild); however, you must convert the workflow to use a Windows runner. + # ScanCentral has additional options that should be set for PHP and Python projects + # For other build tools, add your build commands to download necessary dependencies and prepare according to Fortify on Demand Packaging documentation. + # ScanCentral Client documentation is located at https://www.microfocus.com/documentation/fortify-software-security-center/ + - name: Download Fortify ScanCentral Client + uses: fortify/gha-setup-scancentral-client@v1 + - name: Package Code + Dependencies + run: scancentral package $PACKAGE_OPTS -o package.zip + env: + PACKAGE_OPTS: "-bt mvn" + + # Start Fortify on Demand SAST scan and wait until results complete. For more information on FoDUploader commands, see https://github.com/fod-dev/fod-uploader-java + # TODO: Update ENV variables for your application and create the necessary GitHub Secrets. Helpful hints: + # Credentials and release ID should be obtained from your FoD tenant (either Personal Access Token or API Key can be used). + # Automated Audit preference should be configured for the release's Static Scan Settings in the Fortify on Demand portal. + - name: Download Fortify on Demand Universal CI Tool + uses: fortify/gha-setup-fod-uploader@v1 + - name: Perform SAST Scan + run: java -jar $FOD_UPLOAD_JAR -z package.zip -aurl $FOD_API_URL -purl $FOD_URL -rid "$FOD_RELEASE_ID" -tc "$FOD_TENANT" -uc "$FOD_USER" "$FOD_PAT" $FOD_UPLOADER_OPTS -n "$FOD_UPLOADER_NOTES" + env: + FOD_TENANT: ${{ secrets.FOD_TENANT }} + FOD_USER: ${{ secrets.FOD_USER }} + FOD_PAT: ${{ secrets.FOD_PAT }} + FOD_RELEASE_ID: ${{ secrets.FOD_RELEASE_ID }} + FOD_URL: "https://ams.fortify.com/" + FOD_API_URL: "https://api.ams.fortify.com/" + FOD_UPLOADER_OPTS: "-ep 2 -pp 0 -I 1 -apf" + FOD_UPLOADER_NOTES: 'Triggered by GitHub Actions (${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})' + + # Once scan completes, pull SAST issues from Fortify on Demand and generate SARIF output. + # TODO: Review Action inputs. For most users, these will be the same as used in the Perform SAST Scan step. + - name: Download Results + uses: fortify/gha-fod-generate-sarif@1.1.0 + with: + base-url: https://ams.fortify.com + tenant: ${{ secrets.FOD_TENANT }} + user: ${{ secrets.FOD_USER }} + password: ${{ secrets.FOD_PAT }} + release-id: ${{ secrets.FOD_RELEASE_ID }} + output: ./sarif/output.sarif + + # Import Fortify on Demand results to GitHub Security Code Scanning + - name: Import Results + uses: github/codeql-action/upload-sarif@v1 + with: + sarif_file: ./sarif/output.sarif From 9221168775dccd6ea0c8ef4bdc5e42ff049fff36 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thomas=20W=C3=B6hlke?= <36666317+thomaswoehlke@users.noreply.github.com> Date: Fri, 2 Oct 2020 11:10:21 +0200 Subject: [PATCH 18/31] Create codacy-analysis.yml --- .github/workflows/codacy-analysis.yml | 44 +++++++++++++++++++++++++++ 1 file changed, 44 insertions(+) create mode 100644 .github/workflows/codacy-analysis.yml diff --git a/.github/workflows/codacy-analysis.yml b/.github/workflows/codacy-analysis.yml new file mode 100644 index 00000000..c9e3e9c8 --- /dev/null +++ b/.github/workflows/codacy-analysis.yml @@ -0,0 +1,44 @@ +# This workflow checks out code, performs a Codacy security scan +# and integrates the results with the +# GitHub Advanced Security code scanning feature. For more information on +# the Codacy security scan action usage and parameters, see +# https://github.com/codacy/codacy-analysis-cli-action. +# For more information on Codacy Analysis CLI in general, see +# https://github.com/codacy/codacy-analysis-cli. + +name: Codacy Security Scan + +on: + push: + branches: [ "master", "main" ] + pull_request: + branches: [ "master", "main" ] + +jobs: + codacy-security-scan: + name: Codacy Security Scan + runs-on: ubuntu-latest + steps: + # Checkout the repository to the GitHub Actions runner + - name: Checkout code + uses: actions/checkout@v2 + + # Execute Codacy Analysis CLI and generate a SARIF output with the security issues identified during the analysis + - name: Run Codacy Analysis CLI + uses: codacy/codacy-analysis-cli-action@1.0.0 + with: + # Check https://github.com/codacy/codacy-analysis-cli#project-token to get your project token from your Codacy repository + # You can also omit the token and run the tools that support default configurations + project-token: ${{ secrets.CODACY_PROJECT_TOKEN }} + verbose: true + output: results.sarif + format: sarif + # Force 0 exit code to allow SARIF file generation + # This will handover control about PR rejection to the GitHub side + max-allowed-issues: 2147483647 + + # Upload the SARIF file generated in the previous step + - name: Upload SARIF results file + uses: github/codeql-action/upload-sarif@v1 + with: + sarif_file: results.sarif From c9525f2da0fe03979ff12072e4abf4a96836cfc2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thomas=20W=C3=B6hlke?= <36666317+thomaswoehlke@users.noreply.github.com> Date: Fri, 2 Oct 2020 11:11:16 +0200 Subject: [PATCH 19/31] Create veracode-analysis.yml --- .github/workflows/veracode-analysis.yml | 60 +++++++++++++++++++++++++ 1 file changed, 60 insertions(+) create mode 100644 .github/workflows/veracode-analysis.yml diff --git a/.github/workflows/veracode-analysis.yml b/.github/workflows/veracode-analysis.yml new file mode 100644 index 00000000..395f8316 --- /dev/null +++ b/.github/workflows/veracode-analysis.yml @@ -0,0 +1,60 @@ +# This workflow will initiate a Veracode Static Analysis Pipeline scan, return a results.json and convert to SARIF for upload as a code scanning alert + +name: Veracode Static Analysis Pipeline Scan + +# Controls when the action will run. Triggers the workflow on push or pull request +# events but only for the master branch +on: + push: + branches: [ master ] + pull_request: + branches: [ master ] + +# A workflow run is made up of one or more jobs that can run sequentially or in parallel +jobs: + # This workflow contains a job to build and submit pipeline scan, you will need to customize the build process accordingly and make sure the artifact you build is used as the file input to the pipeline scan file parameter + build-and-pipeline-scan: + # The type of runner that the job will run on + runs-on: ubuntu-latest + steps: + + # Checks-out your repository under $GITHUB_WORKSPACE, so your job can access it and copies all sources into ZIP file for submitting for analysis. Replace this section with your applications build steps + - uses: actions/checkout@v2 + with: + repository: '' + + - uses: papeloto/action-zip@v1 + with: + files: / + recursive: true + dest: veracode-pipeline-scan-results-to-sarif.zip + + - uses: actions/upload-artifact@v1 + with: + name: my-artifact + path: veracode-pipeline-scan-results-to-sarif.zip + + # download the Veracode Static Analysis Pipeline scan jar + - uses: wei/curl@master + with: + args: -O https://downloads.veracode.com/securityscan/pipeline-scan-LATEST.zip + - run: unzip -o pipeline-scan-LATEST.zip + + - uses: actions/setup-java@v1 + with: + java-version: 1.8 + - run: java -jar pipeline-scan.jar --veracode_api_id "${{secrets.VERACODE_API_ID}}" --veracode_api_key "${{secrets.VERACODE_API_KEY}}" --fail_on_severity="Very High, High" --file veracode-pipeline-scan-results-to-sarif.zip + continue-on-error: true + - uses: actions/upload-artifact@v1 + with: + name: ScanResults + path: results.json + - name: Convert pipeline scan output to SARIF format + id: convert + uses: veracode/veracode-pipeline-scan-results-to-sarif@master + with: + pipeline-results-json: results.json + - uses: github/codeql-action/upload-sarif@v1 + with: + # Path to SARIF file relative to the root of the repository + sarif_file: veracode-results.sarif From e3e7ef6a4cf2722dc4fc124ac944b9c3d852c4fd Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Thomas=20W=C3=B6hlke?= <36666317+thomaswoehlke@users.noreply.github.com> Date: Fri, 2 Oct 2020 11:12:30 +0200 Subject: [PATCH 20/31] Create xanitizer-analysis.yml --- .github/workflows/xanitizer-analysis.yml | 86 ++++++++++++++++++++++++ 1 file changed, 86 insertions(+) create mode 100644 .github/workflows/xanitizer-analysis.yml diff --git a/.github/workflows/xanitizer-analysis.yml b/.github/workflows/xanitizer-analysis.yml new file mode 100644 index 00000000..0148a8d5 --- /dev/null +++ b/.github/workflows/xanitizer-analysis.yml @@ -0,0 +1,86 @@ +# This workflow downloads and installs the latest version of Xanitizer, builds your project, runs a Xanitizer security analysis on it, +# and then archives the findings list reports and uploads the findings into the GitHub code scanning alert section of your repository. +# +# Documentation for the `RIGS-IT/xanitizer-action` is located here: https://github.com/RIGS-IT/xanitizer-action +# +# To use this basic workflow, you will need to complete the following setup steps: +# +# 1. The underlying Xanitizer, used in this workflow, needs a separate license file. +# Licenses are free of charge for open source projects and for educational usage. +# To get more information about the Xanitizer licenses and how to obtain a license file, +# please consult https://www.xanitizer.com/xanitizer-pricing/. +# +# 2. The content of the license file has to be stored as a GitHub secret (e.g. XANITIZER_LICENSE) on this repository. +# Please consult https://docs.github.com/en/actions/configuring-and-managing-workflows/creating-and-storing-encrypted-secrets for details. +# +# 3. Reference the GitHub secret in the step using the `RIGS-IT/xanitizer-action` GitHub action. +# Example: +# - name: Xanitizer Security Analysis +# uses: RIGS-IT/xanitizer-action@v1 +# with: +# license: ${{ secrets.XANITIZER_LICENSE }} +# +# 4. As a static application security testing (SAST) tool, +# Xanitizer requires that all dependencies of the artifacts being analyzed can be resolved successfully. +# So you have to install all used libraries and build your project before running the security analysis, +# e.g. via `mvn compile` for Java or `npm install` for JavaScript + +name: "Xanitizer Security Analysis" + +on: + # Run the workflow on each push + push: + # Run the workflow each day at 5 am + # schedule: + # - cron: '0 5 * * *' + # Run the workflow manually + workflow_dispatch: + +jobs: + xanitizer-security-analysis: + # Xanitizer runs on ubuntu-latest and windows-latest. + runs-on: ubuntu-latest + + steps: + # Check out the repository + - name: Checkout + uses: actions/checkout@v2 + + # Set up the correct Java version for your project + # Please comment out, if your project does not contain Java source code. + - name: Set up JDK 13 + uses: actions/setup-java@v1 + with: + java-version: 13 + + # Compile the code for Java projects and get all libraries, e.g. via Maven + # Please adapt, if your project uses another build system to compile Java source code. + # Please comment out, if your project does not contain Java source code. + - name: Compile Java code + run: mvn -B compile + + # Install all dependent libraries for JavaScript/TypeScript projects, e.g. via npm + # Please adapt to run `npm install` in the correct directories. + # Please adapt, if your project uses another package manager for getting JavaScript libraries. + # Please comment out, if your project does not use a package manager for getting JavaScript libraries. + #- name: Install JavaScript libraries + # run: npm install + + # Run the security analysis with default settings + - name: Xanitizer Security Analysis + uses: RIGS-IT/xanitizer-action@v1 + with: + license: ${{ secrets.XANITIZER_LICENSE }} + + # Archiving the findings list reports + - uses: actions/upload-artifact@v2 + with: + name: Xanitizer-Reports + path: | + *-Findings-List.pdf + *-Findings-List.sarif + + # Uploads the findings into the GitHub code scanning alert section using the upload-sarif action + - uses: github/codeql-action/upload-sarif@v1 + with: + sarif_file: Xanitizer-Findings-List.sarif From ce6691a35219bcb23e70eca79312f26e07f9c908 Mon Sep 17 00:00:00 2001 From: thomaswoehlke Date: Fri, 2 Oct 2020 11:24:16 +0200 Subject: [PATCH 21/31] * Issue #249 TaskRepository: move the JQL Query-String to Entity as Prepared Statement * Issue #234 Taskstate: Task Edit Form -> change Project via DropDown * Issue #235 Project/Root: Task Edit Form -> change Project via DropDown * Issue #236 Project/id: Task Edit Form -> change Project via DropDown --- etc/TODO.md | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/etc/TODO.md b/etc/TODO.md index e291da5e..3fd3e10a 100644 --- a/etc/TODO.md +++ b/etc/TODO.md @@ -101,8 +101,7 @@ Caused by: org.postgresql.util.PSQLException: ERROR: relation "spring_session" d * Fixed #241, Fixed #242, Fixed #243, Fixed #252 ## 2.3.20 -* Update Spring-Boot to 2.3.0 #255 -* Fixed #255 - working on: Update Spring-Boot to 2.3.0 +* fixed #255 Update Spring-Boot to 2.3.0 ## 2.3.23 * fixed #274 add Annotations to suppress Deprecation Warnings @@ -133,4 +132,11 @@ Caused by: org.postgresql.util.PSQLException: ERROR: relation "spring_session" d * fixed #286 Update spring-data-releasetrain to Neumann-SR4 * fixed #287 Update spring-session-bom to Dragonfruit-SR1 +## 2.3.26 +* Issue #249 TaskRepository: move the JQL Query-String to Entity as Prepared Statement +* Issue #234 Taskstate: Task Edit Form -> change Project via DropDown +* Issue #235 Project/Root: Task Edit Form -> change Project via DropDown +* Issue #236 Project/id: Task Edit Form -> change Project via DropDown + + From fc33a258bf537a10a31ceba6653521234542c1f7 Mon Sep 17 00:00:00 2001 From: thomaswoehlke Date: Fri, 2 Oct 2020 11:57:22 +0200 Subject: [PATCH 22/31] * Issue #249 TaskRepository: move the JQL Query-String to Entity as Prepared Statement * Issue #234 Taskstate: Task Edit Form -> change Project via DropDown * Issue #235 Project/Root: Task Edit Form -> change Project via DropDown * Issue #236 Project/id: Task Edit Form -> change Project via DropDown --- build.sh | 4 +- .../simpleworklist/domain/task/Task.java | 28 ++++++++++++-- .../domain/task/TaskRepository.java | 38 ++++++++++--------- 3 files changed, 47 insertions(+), 23 deletions(-) diff --git a/build.sh b/build.sh index dc63e176..2cab7251 100755 --- a/build.sh +++ b/build.sh @@ -31,8 +31,8 @@ function setupTravis() { } function main() { - # firstSetup - setupTravis + firstSetup + # setupTravis } main diff --git a/src/main/java/org/woehlke/simpleworklist/domain/task/Task.java b/src/main/java/org/woehlke/simpleworklist/domain/task/Task.java index d4b9e5cd..0cf717c7 100644 --- a/src/main/java/org/woehlke/simpleworklist/domain/task/Task.java +++ b/src/main/java/org/woehlke/simpleworklist/domain/task/Task.java @@ -11,15 +11,14 @@ import lombok.Getter; import lombok.Setter; import lombok.ToString; -import org.hibernate.annotations.LazyToOne; -import org.hibernate.annotations.OnDelete; -import org.hibernate.annotations.OnDeleteAction; +import org.hibernate.annotations.*; import org.hibernate.validator.constraints.Length; import javax.validation.constraints.NotBlank; import javax.validation.constraints.NotNull; //import org.hibernate.validator.constraints.SafeHtml; +import org.springframework.data.jpa.repository.*; import org.springframework.format.annotation.DateTimeFormat; import org.woehlke.simpleworklist.domain.context.Context; import org.woehlke.simpleworklist.domain.project.Project; @@ -53,6 +52,29 @@ @Index(name = "ix_task_title", columnList = "title") } ) +@NamedQueries({ + @NamedQuery( + name = "queryGetTasksByOrderIdTaskStateBetweenLowerTaskAndHigherTask", + query = "select t from Task t" + + " where t.orderIdTaskState > :lowerOrderIdTaskState and t.orderIdTaskState < :higherOrderIdTaskState" + + " and t.taskState = :taskState and t.context = :context", + readOnly = true + ), + @NamedQuery( + name = "queryGetTasksByOrderIdProjectBetweenLowerTaskAndHigherTask", + query = "select t from Task t" + + " where t.orderIdProject > :lowerOrderIdProject and t.orderIdProject < :higherOrderIdProject" + + " and t.project = :project", + readOnly = true + ), + @NamedQuery( + name = "queryGetTasksByOrderIdProjectRootBetweenLowerTaskAndHigherTask", + query = "select t from Task t" + + " where t.orderIdProject > :lowerOrderIdProject and t.orderIdProject < :higherOrderIdProject" + + " and t.project is null and t.context = :context ", + readOnly = true + ) +}) @Getter @Setter @EqualsAndHashCode(callSuper = true) diff --git a/src/main/java/org/woehlke/simpleworklist/domain/task/TaskRepository.java b/src/main/java/org/woehlke/simpleworklist/domain/task/TaskRepository.java index 3c01ce6d..faa25cc4 100644 --- a/src/main/java/org/woehlke/simpleworklist/domain/task/TaskRepository.java +++ b/src/main/java/org/woehlke/simpleworklist/domain/task/TaskRepository.java @@ -2,6 +2,7 @@ import java.util.List; +import org.hibernate.annotations.NamedQuery; import org.springframework.data.domain.Page; import org.springframework.data.domain.Pageable; import org.springframework.data.jpa.repository.JpaRepository; @@ -47,19 +48,19 @@ Page findByTaskStateAndContextOrderByOrderIdTaskStateAsc( //TODO: #244 change List to Page //TODO: #249 move the JQL Query-String to Entity as Prepared Statement @Deprecated - @Query("select t from Task t" - + " where t.orderIdTaskState > :lowerOrderIdTaskState and t.orderIdTaskState < :higherOrderIdTaskState" - + " and t.taskState = :taskState and t.context = :context") + //@Query("select t from Task t" + // + " where t.orderIdTaskState > :lowerOrderIdTaskState and t.orderIdTaskState < :higherOrderIdTaskState" + // + " and t.taskState = :taskState and t.context = :context") + @Query(name="queryGetTasksByOrderIdTaskStateBetweenLowerTaskAndHigherTask") List getTasksByOrderIdTaskStateBetweenLowerTaskAndHigherTask( @Param("lowerOrderIdTaskState") long lowerOrderIdTaskState, @Param("higherOrderIdTaskState") long higherOrderIdTaskState, @Param("taskState") TaskState taskState, @Param("context") Context context ); + //TODO: #249 move the JQL Query-String to Entity as Prepared Statement - @Query("select t from Task t" - + " where t.orderIdTaskState > :lowerOrderIdTaskState and t.orderIdTaskState < :higherOrderIdTaskState" - + " and t.taskState = :taskState and t.context = :context") + @Query(name="queryGetTasksByOrderIdTaskStateBetweenLowerTaskAndHigherTask") Page getTasksByOrderIdTaskStateBetweenLowerTaskAndHigherTask( @Param("lowerOrderIdTaskState") long lowerOrderIdTaskState, @Param("higherOrderIdTaskState") long higherOrderIdTaskState, @@ -71,18 +72,17 @@ Page getTasksByOrderIdTaskStateBetweenLowerTaskAndHigherTask( //TODO: #244 change List to Page //TODO: #249 move the JQL Query-String to Entity as Prepared Statement @Deprecated - @Query("select t from Task t" - + " where t.orderIdProject > :lowerOrderIdProject and t.orderIdProject < :higherOrderIdProject" - + " and t.project = :project") + @Query(name="queryGetTasksByOrderIdProjectBetweenLowerTaskAndHigherTask") List getTasksByOrderIdProjectBetweenLowerTaskAndHigherTask( @Param("lowerOrderIdProject") long lowerOrderIdProject, @Param("higherOrderIdProject") long higherOrderIdProject, @Param("project") Project project ); //TODO: #249 move the JQL Query-String to Entity as Prepared Statement - @Query("select t from Task t" - + " where t.orderIdProject > :lowerOrderIdProject and t.orderIdProject < :higherOrderIdProject" - + " and t.project = :project") + //@Query("select t from Task t" + // + " where t.orderIdProject > :lowerOrderIdProject and t.orderIdProject < :higherOrderIdProject" + // + " and t.project = :project") + @Query(name="queryGetTasksByOrderIdProjectBetweenLowerTaskAndHigherTask") Page getTasksByOrderIdProjectBetweenLowerTaskAndHigherTask( @Param("lowerOrderIdProject") long lowerOrderIdProject, @Param("higherOrderIdProject") long higherOrderIdProject, @@ -93,18 +93,20 @@ Page getTasksByOrderIdProjectBetweenLowerTaskAndHigherTask( //TODO: #244 move from List to Page //TODO: #249 move the JQL Query-String to Entity as Prepared Statement @Deprecated - @Query("select t from Task t" - + " where t.orderIdProject > :lowerOrderIdProject and t.orderIdProject < :higherOrderIdProject" - + " and t.project is null and t.context = :context ") + //@Query("select t from Task t" + // + " where t.orderIdProject > :lowerOrderIdProject and t.orderIdProject < :higherOrderIdProject" + // + " and t.project is null and t.context = :context ") + @Query(name = "queryGetTasksByOrderIdProjectRootBetweenLowerTaskAndHigherTask") List getTasksByOrderIdProjectRootBetweenLowerTaskAndHigherTask( @Param("lowerOrderIdProject") long lowerOrderIdProject, @Param("higherOrderIdProject") long higherOrderIdProject, @Param("context") Context context ); //TODO: #249 move the JQL Query-String to Entity as Prepared Statement - @Query("select t from Task t" - + " where t.orderIdProject > :lowerOrderIdProject and t.orderIdProject < :higherOrderIdProject" - + " and t.project is null and t.context = :context ") + //@Query("select t from Task t" + // + " where t.orderIdProject > :lowerOrderIdProject and t.orderIdProject < :higherOrderIdProject" + // + " and t.project is null and t.context = :context ") + @Query(name = "queryGetTasksByOrderIdProjectRootBetweenLowerTaskAndHigherTask") Page getTasksByOrderIdProjectRootBetweenLowerTaskAndHigherTask( @Param("lowerOrderIdProject") long lowerOrderIdProject, @Param("higherOrderIdProject") long higherOrderIdProject, From 948d8c646ef5c7431b31b92e3798a18b1960dd93 Mon Sep 17 00:00:00 2001 From: thomaswoehlke Date: Fri, 2 Oct 2020 12:23:01 +0200 Subject: [PATCH 23/31] * Issue #249 TaskRepository: move the JQL Query-String to Entity as Prepared Statement * Issue #234 Taskstate: Task Edit Form -> change Project via DropDown * Issue #235 Project/Root: Task Edit Form -> change Project via DropDown * Issue #236 Project/id: Task Edit Form -> change Project via DropDown --- .idea/compiler.xml | 3 --- .idea/modules.xml | 8 -------- build.sh | 4 ++-- src/site/uml/SimpleWorklist.mdzip.bak | Bin 326781 -> 0 bytes 4 files changed, 2 insertions(+), 13 deletions(-) delete mode 100644 .idea/modules.xml delete mode 100644 src/site/uml/SimpleWorklist.mdzip.bak diff --git a/.idea/compiler.xml b/.idea/compiler.xml index 96f6de9d..3ba69115 100644 --- a/.idea/compiler.xml +++ b/.idea/compiler.xml @@ -10,9 +10,6 @@ - - -