From 128621b0afd95c0e24ad861d44715201585aa536 Mon Sep 17 00:00:00 2001 From: william dutton Date: Tue, 21 Apr 2026 10:26:18 +1000 Subject: [PATCH 1/2] OWASP + Github workflow updates * Library updates * Dependancy suppression cleanup --- .github/workflows/maven.yml | 21 +++- .github/workflows/owasp.yml | 91 +++++++++++++++ .github/workflows/sonar.yml | 10 +- plugins/jasperreports/pom.xml | 2 +- plugins/spring/README.md | 8 ++ pom.xml | 78 ++++++++++++- src/etc/project-suppression.xml | 196 +++++++------------------------- 7 files changed, 243 insertions(+), 163 deletions(-) create mode 100644 .github/workflows/owasp.yml diff --git a/.github/workflows/maven.yml b/.github/workflows/maven.yml index 5a57ff41f2..754dc98e3b 100644 --- a/.github/workflows/maven.yml +++ b/.github/workflows/maven.yml @@ -20,8 +20,11 @@ on: push: branches: - 'main' + - 'develop' - 'release/*' - 'support/*' + workflow_dispatch: + workflow_call: permissions: read-all @@ -31,9 +34,10 @@ env: jobs: build: - name: Build and Test (JDK ${{ matrix.java }})${{ matrix.profile == '-Pjakartaee11' && ' with Jakarta EE 11' || matrix.profile }} + name: Build and Test (JDK ${{ matrix.java }})${{ matrix.profile == '-Pjakartaee11' && ' (Jakarta EE 11 + Spring 7)' || matrix.profile }} runs-on: ubuntu-latest strategy: + fail-fast: false matrix: include: - java: '17' @@ -44,6 +48,8 @@ jobs: profile: '-Pjakartaee11' - java: '25' profile: '' + - java: '25' + profile: '-Pjakartaee11' steps: - name: Checkout code uses: actions/checkout@v7 @@ -53,5 +59,16 @@ jobs: distribution: temurin java-version: ${{ matrix.java }} cache: 'maven' - - name: Maven Verify on Java ${{ matrix.java }}${{ matrix.profile == '-Pjakartaee11' && ' (Jakarta EE 11)' || matrix.profile }} + - name: Maven Verify on Java ${{ matrix.java }}${{ matrix.profile == '-Pjakartaee11' && ' (Jakarta EE 11 + Spring 7)' || matrix.profile }} run: mvn -B -V -DskipAssembly verify ${{ matrix.profile }} --no-transfer-progress + + - name: Test Summary ${{ matrix.java }} ${{ matrix.profile }} + uses: mikepenz/action-junit-report@d9f48fc87bc235f7e214acf696ca5abc0a986f16 #v6.4.2 + continue-on-error: true + if: always() + with: + annotate_only: true # forked repo cannot write to checks so just do annotations + report_paths: | + **/surefire-reports/TEST-*.xml + **/failsafe-reports/TEST-*.xml + diff --git a/.github/workflows/owasp.yml b/.github/workflows/owasp.yml new file mode 100644 index 0000000000..c1873284e2 --- /dev/null +++ b/.github/workflows/owasp.yml @@ -0,0 +1,91 @@ +# Licensed to the Apache Software Foundation (ASF) under one or more +# contributor license agreements. See the NOTICE file distributed with +# this work for additional information regarding copyright ownership. +# The ASF licenses this file to You under the Apache License, Version 2.0 +# (the "License"); you may not use this file except in compliance with +# the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +name: OWASP checkup + +on: + pull_request: + push: + branches: + - 'main' + - 'develop' + - 'release/*' + - 'support/*' + workflow_dispatch: + workflow_call: + +permissions: read-all + +env: + MAVEN_OPTS: -Xmx2048m -Xms1024m + LANG: en_US.utf8 + +jobs: + + + owasp: + name: OWASP + runs-on: ubuntu-latest + steps: + - name: Checkout code + uses: actions/checkout@v7 + - name: Setup Java 25 + uses: actions/setup-java@v5 + with: + distribution: temurin + java-version: 25 + cache: 'maven' + + - name: Cache NVD Database + id: cache-nvd + uses: actions/cache/restore@v6 + with: + path: ~/.m2/repository/org/owasp/dependency-check-data + key: nvd-cache-${{ runner.os }}-owasp-${{ github.run_id }} + restore-keys: | + nvd-cache-${{ runner.os }}-owasp- + nvd-cache-${{ runner.os }}- + + - name: OWASP Dependency check update cache + run: mvn -N -V -DskipAssembly -Dmaven.test.skip=true -Powasp-nvd-mirror -Pdependency-update-only --no-transfer-progress + env: + NVD_NIST_APIKEY: ${{ secrets.NVD_NIST_APIKEY}} + + - name: Cache NVD Database + uses: actions/cache/save@v6 + if: ${{ always() }} + with: + path: ~/.m2/repository/org/owasp/dependency-check-data + key: nvd-cache-${{ runner.os }}-owasp-${{ github.run_id }} + + - name: OWASP check (Without running tests) + run: mvn -B org.owasp:dependency-check-maven:aggregate -Pdependency-check -Pjakartaee11 --no-transfer-progress + + - name: Upload Dependency Check reports + uses: actions/upload-artifact@v7 + if: always() + with: + name: dependency-check + path: target/dependency-check* + + - name: Add OWASP summary + if: always() + run: | + { + echo "## OWASP Dependency Check" + echo "" + echo "The HTML report has been uploaded as the **dependency-check** artifact." + echo "Download it from the Artifacts section of this workflow run." + } >> "$GITHUB_STEP_SUMMARY" diff --git a/.github/workflows/sonar.yml b/.github/workflows/sonar.yml index 6f3212f860..bf33a5520b 100644 --- a/.github/workflows/sonar.yml +++ b/.github/workflows/sonar.yml @@ -26,6 +26,7 @@ permissions: read-all env: MAVEN_OPTS: -Xmx2048m -Xms1024m LANG: en_US.utf8 + HAVE_SONARCLOUD_TOKEN: ${{ secrets.SONARCLOUD_TOKEN != '' }} jobs: sonarcloud: @@ -41,7 +42,14 @@ jobs: distribution: temurin java-version: 21 cache: 'maven' - - env: + - name: SonarCloud Scan + if: ${{ env.HAVE_SONARCLOUD_TOKEN == 'true' }} + env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} SONAR_TOKEN: ${{ secrets.SONARCLOUD_TOKEN }} run: ./mvnw -B verify org.sonarsource.scanner.maven:sonar-maven-plugin:sonar -Pcoverage -DskipAssembly + - name: SonarCloud Scan -- SKIPPED + if: ${{ env.HAVE_SONARCLOUD_TOKEN != 'true' }} + run: | + echo "### SonarCloud not configured" >> $GITHUB_STEP_SUMMARY + echo "secrets.SONARCLOUD_TOKEN not existing, cannot push coverage checks" >> $GITHUB_STEP_SUMMARY diff --git a/plugins/jasperreports/pom.xml b/plugins/jasperreports/pom.xml index f3d9d5f4a6..2c90d5fca2 100644 --- a/plugins/jasperreports/pom.xml +++ b/plugins/jasperreports/pom.xml @@ -35,7 +35,7 @@ net.sf.jasperreports jasperreports - 6.21.3 + 6.21.5 provided diff --git a/plugins/spring/README.md b/plugins/spring/README.md index fbaf2781e3..dac48b0c43 100644 --- a/plugins/spring/README.md +++ b/plugins/spring/README.md @@ -4,3 +4,11 @@ You will find more details in [documentation](https://struts.apache.org/plugins/ ## Installation Just drop this plugin JAR into `WEB-INF/lib` folder or add it as a Maven dependency. + + +## Struts & Spring Compatibility Matrix + +| Struts Plugin Version | Compatible Spring Version | Spring OSS End of Life (EOL) | +|:----------------------|:---------------------------|:--------------------------------------------| +| **7.1.1** | 6.2.x | 2026-06 (Commercial 2032-06-30) | +| **7.1.1** | 7.0.8 (Jakarta EE 11 only) | 2027-07 (Commercial 2028-07-31) | diff --git a/pom.xml b/pom.xml index 5377ee3b43..d1016a5a55 100644 --- a/pom.xml +++ b/pom.xml @@ -112,7 +112,9 @@ 3.12.0 3.5.6 - + 12.2.2 + false + 9.10.1 1.18.11 @@ -125,7 +127,7 @@ 2.26.1 5.23.0 3.4.11 - 6.2.12 + 6.2.19 2.0 3.1 5.3.7 @@ -162,8 +164,8 @@ jakartaee11 - 11.0.0-M5 - 7.0.5 + 11.0.0 + 7.0.8 @@ -173,9 +175,10 @@ org.owasp dependency-check-maven + ${dependencycheck.version} - verify + initialize check @@ -185,6 +188,71 @@ + + dependency-update-only + + + + org.owasp + dependency-check-maven + ${dependencycheck.version} + + + + update-only + + + + + + + + + + owasp-nvd-api + + + NVD_NIST_APIKEY + + + + + + org.owasp + dependency-check-maven + ${dependencycheck.version} + + owasp-suppressions.xml + 0 + false + ${NVD_NIST_APIKEY} + ${owasp.skip} + + + + + + + + + owasp-nvd-mirror + + + + org.owasp + dependency-check-maven + ${dependencycheck.version} + + owasp-suppressions.xml + 0 + false + https://dependency-check.github.io/DependencyCheck_Builder/nvd_cache/nvdcve-{0}.json.gz + ${owasp.skip} + + + + + coverage diff --git a/src/etc/project-suppression.xml b/src/etc/project-suppression.xml index b0d5ebc951..718b3a7cbe 100644 --- a/src/etc/project-suppression.xml +++ b/src/etc/project-suppression.xml @@ -19,167 +19,55 @@ --> - - ^pkg:maven/org\.apache\.struts/struts\-core@.*$ - cpe:/a:apache:struts - - - - ^pkg:maven/org\.apache\.struts/struts\-core@.*$ - CVE-2011-5057 - - - - ^pkg:maven/org\.apache\.struts/struts\-core@.*$ - CVE-2012-0391 - - - - ^pkg:maven/org\.apache\.struts/struts\-core@.*$ - CVE-2012-0392 - - - - ^pkg:maven/org\.apache\.struts/struts\-core@.*$ - CVE-2012-0393 - - - - ^pkg:maven/org\.apache\.struts/struts\-core@.*$ - CVE-2012-0394 - - - - ^pkg:maven/org\.apache\.struts/struts\-core@.*$ - CVE-2012-0838 - - - - ^pkg:maven/org\.apache\.struts/struts\-core@.*$ - CVE-2013-1965 - - - - ^pkg:maven/org\.apache\.struts/struts\-core@.*$ - CVE-2013-1966 - - - - ^pkg:maven/org\.apache\.struts/struts\-core@.*$ - CVE-2013-2115 - - - - ^pkg:maven/org\.apache\.struts/struts\-core@.*$ - CVE-2013-2134 - - - - ^pkg:maven/org\.apache\.struts/struts\-core@.*$ - CVE-2013-2135 - - - - ^pkg:maven/org\.apache\.struts/struts\-core@.*$ - CVE-2014-0094 - - - - ^pkg:maven/org\.apache\.struts/struts\-core@.*$ - CVE-2014-0113 - - - - ^pkg:maven/org\.apache\.struts/struts\-core@.*$ - CVE-2015-5169 - - - - ^pkg:maven/org\.apache\.struts/struts\-core@.*$ - CVE-2016-0785 - - - - ^pkg:maven/org\.apache\.struts/struts\-core@.*$ - CVE-2016-4003 - - - - ^pkg:maven/org\.apache\.struts/struts\-annotations@.*$ - cpe:/a:apache:struts + + CVE-2025-10492 - - ^org\.apache\.struts:struts\-tiles\:1\.3\.8.*$ + + CVE-2023-49735 cpe:/a:apache:struts - - ^org\.apache\.struts:struts\-taglib\:1\.3\.8.*$ - cpe:/a:apache:struts - - - - ^pkg:maven/dom4j/dom4j@.*$ - CVE-2018-1000632 - - - - ^pkg:maven/org\.beanshell/bsh@.*$ - CVE-2016-2510 - - - - ^pkg:maven/org\.codehaus\.plexus/plexus\-utils@.*$ - cpe:/a:plexus-utils_project:plexus-utils - CVE-2022-4244 - CVE-2022-4245 - CVE-2017-1000487 - - - - ^pkg:maven/org\.codehaus\.plexus\/plexus\-container\-default@.*$ - cpe:/a:plexus-utils_project:plexus-utils - CVE-2022-4244 - CVE-2022-4245 - - - - - ^pkg:maven/com\.google\.guava/guava@.*$ - CVE-2018-10237 - - - - ^pkg:maven/org\.yaml/snakeyaml@.*$ - CVE-2017-18640 - - - + ^pkg:javascript/jquery@.*$ CVE-2020-11022 - - - - ^pkg:javascript/jquery@.*$ CVE-2020-11023 - - - - ^pkg:maven/org\.testng/testng@.*$ - CVE-2022-4065 - - - - ^pkg:maven/org\.springframework/spring\-.*@.*$ - CVE-2022-22965 - CVE-2022-22950 - CVE-2022-22968 - CVE-2022-22970 - - - - ^pkg:maven/org\.springframework/spring\-web@.*$ - CVE-2016-1000027 + CVE-2015-9251 + CVE-2019-11358 + jquery issue: 11974 + jquery issue: 162 + + + + + 253711c6d825de55a8360552573be950da180614 + CVE-2016-10735 + CVE-2018-14040 + CVE-2018-14041 + CVE-2018-14042 + CVE-2018-20676 + CVE-2018-20677 + CVE-2019-8331 + CVE-2024-6485 + Bootstrap before 4.0.0 is end-of-life and no longer maintained. + + + + ^pkg:maven/org\.apache\.httpcomponents/httpcore@.*$ + CVE-2026-54399 + + + + ^pkg:maven/org\.apache\.httpcomponents/httpcore@.*$ + CVE-2026-54428 From 95b5554a80859784490ae71a010bf8f92ed6d9bb Mon Sep 17 00:00:00 2001 From: william dutton Date: Wed, 22 Jul 2026 06:51:05 +1000 Subject: [PATCH 2/2] #1667 PR Review updates, use NIST_NVD_API_KEY when available else use mirror for forks not configured, remove workflow_call for now since we don't on call --- .github/workflows/owasp.yml | 16 +++++++++++----- pom.xml | 6 +++--- 2 files changed, 14 insertions(+), 8 deletions(-) diff --git a/.github/workflows/owasp.yml b/.github/workflows/owasp.yml index c1873284e2..2ede213254 100644 --- a/.github/workflows/owasp.yml +++ b/.github/workflows/owasp.yml @@ -23,8 +23,7 @@ on: - 'develop' - 'release/*' - 'support/*' - workflow_dispatch: - workflow_call: + workflow_dispatch: #Allow manual triggers permissions: read-all @@ -38,6 +37,8 @@ jobs: owasp: name: OWASP runs-on: ubuntu-latest + env: + HAVE_NIST_NVD_API_KEY: ${{ secrets.NIST_NVD_API_KEY != '' }} steps: - name: Checkout code uses: actions/checkout@v7 @@ -58,10 +59,15 @@ jobs: nvd-cache-${{ runner.os }}-owasp- nvd-cache-${{ runner.os }}- - - name: OWASP Dependency check update cache - run: mvn -N -V -DskipAssembly -Dmaven.test.skip=true -Powasp-nvd-mirror -Pdependency-update-only --no-transfer-progress + - name: OWASP Dependency check update cache via NIST_NVD_API_KEY + if: ${{ env.HAVE_NIST_NVD_API_KEY == 'true' }} + run: mvn -N -V -DskipAssembly -Dmaven.test.skip=true -Powasp-nvd-api -Pdependency-update-only --no-transfer-progress env: - NVD_NIST_APIKEY: ${{ secrets.NVD_NIST_APIKEY}} + NIST_NVD_API_KEY: ${{ secrets.NIST_NVD_API_KEY}} + + - name: OWASP Dependency check update cache via Mirror + if: ${{ env.HAVE_NIST_NVD_API_KEY == 'false' }} + run: mvn -N -V -DskipAssembly -Dmaven.test.skip=true -Powasp-nvd-mirror -Pdependency-update-only --no-transfer-progress - name: Cache NVD Database uses: actions/cache/save@v6 diff --git a/pom.xml b/pom.xml index d1016a5a55..a621b2318a 100644 --- a/pom.xml +++ b/pom.xml @@ -208,11 +208,11 @@ - + owasp-nvd-api - NVD_NIST_APIKEY + NIST_NVD_API_KEY @@ -225,7 +225,7 @@ owasp-suppressions.xml 0 false - ${NVD_NIST_APIKEY} + ${NIST_NVD_API_KEY} ${owasp.skip}