Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Vulnerability 5.2.1 #1741

Merged
merged 27 commits into from
Nov 17, 2023
+7,433 −3,406
Merged

Vulnerability 5.2.1 #1741

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
27 commits
Select commit Hold shift + click to select a range
56d7484
Upgrading to Camunda 7.20 and Spring boot 3
sumesh-aot Oct 31, 2023
e98b763
Update pom.xml
sumesh-aot Oct 31, 2023
ae219e6
Merge pull request #1672 from sumesh-aot/vulnerability-5.2.1
sumesh-aot Oct 31, 2023
b483ec3
Updating python image and version to 3.10 as part of security vulnera…
sumesh-aot Nov 3, 2023
747d144
Merge pull request #1681 from sumesh-aot/vulnerability-5.2.1
sumesh-aot Nov 3, 2023
c6592c4
Update pom.xml
SnehaSuresh-aot Nov 7, 2023
1140b1a
Update pom.xml
SnehaSuresh-aot Nov 7, 2023
e9a99bf
fix: forms-flow-bpm/pom.xml to reduce vulnerabilities
snyk-bot Nov 7, 2023
6a65ed3
Merge pull request #34 from SnehaSuresh-aot/snyk-fix-d7009c6975afffba…
SnehaSuresh-aot Nov 7, 2023
1868c70
Merge pull request #1688 from SnehaSuresh-aot/vulnerability-fix
SnehaSuresh-aot Nov 8, 2023
d74e75f
code optimization + bug fixes
SnehaSuresh-aot Nov 8, 2023
472db59
Update application.yaml
SnehaSuresh-aot Nov 9, 2023
cd301ce
Update RestApiSecurityConfig.java
SnehaSuresh-aot Nov 9, 2023
244bb3f
Changes for adding EnableWebSecurity for OAuth login
sumesh-aot Nov 10, 2023
29a313c
formsflow-Web vulnerability fix (#1698)
abilpraju-aot Nov 10, 2023
59f43a0
Merge pull request #38 from sumesh-aot/vulnerability-fix2
SnehaSuresh-aot Nov 10, 2023
cb6f372
added patterns + fixes
SnehaSuresh-aot Nov 10, 2023
4bb364b
More changes
sumesh-aot Nov 11, 2023
fe28d2f
Moving all security config to one class
sumesh-aot Nov 14, 2023
564eeec
Update KeycloakAuthenticationFilter.java
sumesh-aot Nov 14, 2023
7cb5768
Merge pull request #1724 from sumesh-aot/vulnerability-fix3
sumesh-aot Nov 15, 2023
5e2bb76
removing hateos impl from bpm layer
SnehaSuresh-aot Nov 16, 2023
d5db07b
Merge pull request #1728 from SnehaSuresh-aot/bpm_bug_fix
SnehaSuresh-aot Nov 16, 2023
2f2e2ce
Update AdminRestServiceImpl.java
SnehaSuresh-aot Nov 17, 2023
000b5d5
updated admin rest api implementation
SnehaSuresh-aot Nov 17, 2023
7d97d5c
cleanup
SnehaSuresh-aot Nov 17, 2023
24def75
Merge pull request #1734 from SnehaSuresh-aot/bpm_bug_fix
auslin-aot Nov 17, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion VERSION
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1 +1 @@
v5.2.1
v5.2.2
2 changes: 1 addition & 1 deletion forms-flow-api/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
#Author: Kurian Benoy
FROM python:3.9-slim-buster
FROM python:3.10.13-slim-bullseye

# set label for image
LABEL Name="formsflow"
Expand Down
142 changes: 95 additions & 47 deletions forms-flow-bpm/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
<modelVersion>4.0.0</modelVersion>

<groupId>org.camunda.bpm.extension</groupId>
Expand All @@ -22,14 +22,16 @@
<failOnMissingWebXml>false</failOnMissingWebXml>

<!-- versions -->
<version.camundaKeycloak>7.18.0</version.camundaKeycloak>
<version.camunda>7.18.0</version.camunda><!-- 7.17.0 - 7.18.0 -->
<version.camundaKeycloak>7.20.0</version.camundaKeycloak>
<version.camunda>7.20.0</version.camunda><!-- 7.17.0 - 7.18.0 -->
<version.camundaConnect>1.5.4</version.camundaConnect><!-- 1.5.4 -->
<version.camundaMail>1.5.0</version.camundaMail><!-- 1.5.0 -->
<version.springBoot>2.7.12</version.springBoot><!-- 2.6.6 - 2.7.12 -->
<version.springSecurityOauth2>2.6.7</version.springSecurityOauth2><!--
<version.springBoot>3.1.5</version.springBoot><!-- 2.6.6 - 2.7.12 -->
<version.springSecurityOauth2>2.6.8</version.springSecurityOauth2><!--
2.6.6 - 2.6.7 -->
<version.jackson>2.15.0</version.jackson>
<version.commonsFileUpload>1.5</version.commonsFileUpload>
<version.snakeyaml>2.0</version.snakeyaml>
</properties>

<dependencyManagement>
Expand All @@ -55,10 +57,19 @@
<version>${version.camundaKeycloak}</version>
<scope>provided</scope>
</dependency>


</dependencies>
</dependencyManagement>

<dependencies>
<!-- https://mvnrepository.com/artifact/org.yaml/snakeyaml -->
<dependency>
<groupId>org.yaml</groupId>
<artifactId>snakeyaml</artifactId>
<version>2.2</version>
</dependency>

<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-webflux</artifactId>
Expand All @@ -70,6 +81,7 @@
<version>${version.camunda}</version>
</dependency>


<dependency>
<groupId>org.camunda.bpm.springboot</groupId>
<artifactId>camunda-bpm-spring-boot-starter-rest</artifactId>
Expand Down Expand Up @@ -146,6 +158,14 @@
<groupId>org.camunda.bpm</groupId>
<artifactId>camunda-engine-plugin-connect</artifactId>
</dependency>
<!--
https://mvnrepository.com/artifact/org.camunda.bpm/camunda-engine-rest -->
<dependency>
<groupId>org.camunda.bpm</groupId>
<artifactId>camunda-engine-rest-core</artifactId>
<version>7.20.0</version>
</dependency>


<dependency>
<groupId>com.sun.mail</groupId>
Expand All @@ -156,7 +176,7 @@
<dependency>
<groupId>org.slf4j</groupId>
<artifactId>slf4j-api</artifactId>
<version>1.7.29</version>
<version>2.0.6</version>
</dependency>

<!-- Freemarker Template -->
Expand All @@ -167,9 +187,9 @@
</dependency>

<dependency>
<groupId>org.camunda.template-engines</groupId>
<artifactId>camunda-template-engines-velocity</artifactId>
<version>2.1.0</version>
<groupId>org.camunda.community.template.engine</groupId>
<artifactId>camunda-7-template-engine-velocity</artifactId>
<version>2.2.0</version>
</dependency>

<!-- Database -->
Expand Down Expand Up @@ -227,19 +247,19 @@
<scope>test</scope>
</dependency>

<!-- java util logging => slf4j -->
<!-- java util logging => slf4j-->
<dependency>
<groupId>org.slf4j</groupId>
<artifactId>jul-to-slf4j</artifactId>
<scope>test</scope>
</dependency>

<!-- Add your own dependencies here, if in compile scope, they are added
<!-- Add your own dependencies here, if in compile scope, they are added
to the jar -->
<dependency>
<groupId>org.codehaus.groovy</groupId>
<artifactId>groovy-all</artifactId>
<version>3.0.17</version>
<version>3.0.19</version>
<type>pom</type>
</dependency>

Expand All @@ -252,25 +272,21 @@
<dependency>
<groupId>com.fasterxml.jackson.core</groupId>
<artifactId>jackson-databind</artifactId>
<version>${version.jackson}</version>
</dependency>

<dependency>
<groupId>com.fasterxml.jackson.core</groupId>
<artifactId>jackson-core</artifactId>
<version>${version.jackson}</version>
</dependency>

<dependency>
<groupId>com.fasterxml.jackson.dataformat</groupId>
<artifactId>jackson-dataformat-xml</artifactId>
<version>${version.jackson}</version>
</dependency>

<dependency>
<groupId>com.fasterxml.jackson.core</groupId>
<artifactId>jackson-annotations</artifactId>
<version>${version.jackson}</version>
</dependency>

<dependency>
Expand All @@ -287,27 +303,27 @@
<dependency>
<groupId>org.springframework</groupId>
<artifactId>spring-websocket</artifactId>
<version>5.3.20</version>
<version>6.0.11</version>
</dependency>

<dependency>
<groupId>org.springframework</groupId>
<artifactId>spring-messaging</artifactId>
<version>5.3.20</version>
<version>6.0.11</version>
</dependency>

<dependency>
<groupId>org.graalvm.js</groupId>
<artifactId>js-scriptengine</artifactId>
<version>22.3.2</version>
<version>22.3.3</version>
</dependency>

<dependency>
<groupId>org.graalvm.js</groupId>
<artifactId>js</artifactId>
<version>22.3.2</version>
<version>22.3.3</version>
</dependency>

<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-starter-jersey</artifactId>
Expand All @@ -319,6 +335,13 @@
<artifactId>spring-boot-starter-data-redis-reactive</artifactId>
</dependency>

<!-- Adding common file upload -->
<dependency>
<groupId>commons-fileupload</groupId>
<artifactId>commons-fileupload</artifactId>
<version>${version.commonsFileUpload}</version>
</dependency>

</dependencies>

<repositories>
Expand All @@ -330,7 +353,8 @@
<repository>
<id>camunda-bpm-nexus-snapshot</id>
<name>Camunda Maven Repository</name>
<url>https://app.camunda.com/nexus/repository/camunda-bpm-community-extensions-snapshots</url>
<url>
https://app.camunda.com/nexus/repository/camunda-bpm-community-extensions-snapshots</url>
</repository>

</repositories>
Expand All @@ -352,31 +376,55 @@
<excludes>
<exclude>org/camunda/bpm/extension/keycloak/sso/*.class</exclude>
<exclude>org/camunda/bpm/extension/keycloak/rest/*.class</exclude>
<exclude>org/camunda/bpm/extension/keycloak/rest/oauth2client/*.class</exclude>
<exclude>org/camunda/bpm/extension/keycloak/plugin/*.class</exclude>
<exclude>org/camunda/bpm/extension/hooks/controllers/mapper/*.class</exclude>
<exclude>org/camunda/bpm/extension/hooks/controllers/data/*.class</exclude>
<exclude>org/camunda/bpm/extension/hooks/listeners/data/*.class</exclude>
<exclude>org/camunda/bpm/extension/hooks/services/IUser.class</exclude>
<exclude>org/camunda/bpm/extension/hooks/delegates/data/*.class</exclude>
<exclude>org/camunda/bpm/extension/commons/io/socket/message/*.class</exclude>
<exclude>org/camunda/bpm/extension/commons/io/socket/*.class</exclude>
<exclude>org/camunda/bpm/extension/commons/connector/auth/FormioConfiguration.class</exclude>
<exclude>org/camunda/bpm/extension/commons/connector/auth/FormioContext.class</exclude>
<exclude>org/camunda/bpm/extension/commons/connector/*.class</exclude>
<exclude>org/camunda/bpm/extension/CamundaApplication.class</exclude>
<exclude>org/camunda/bpm/extension/commons/exceptions/*.class</exclude>
<exclude>
org/camunda/bpm/extension/keycloak/rest/oauth2client/*.class</exclude>
<exclude>
org/camunda/bpm/extension/keycloak/plugin/*.class</exclude>
<exclude>
org/camunda/bpm/extension/hooks/controllers/mapper/*.class</exclude>
<exclude>
org/camunda/bpm/extension/hooks/controllers/data/*.class</exclude>
<exclude>
org/camunda/bpm/extension/hooks/listeners/data/*.class</exclude>
<exclude>
org/camunda/bpm/extension/hooks/services/IUser.class</exclude>
<exclude>
org/camunda/bpm/extension/hooks/delegates/data/*.class</exclude>
<exclude>
org/camunda/bpm/extension/commons/io/socket/message/*.class</exclude>
<exclude>
org/camunda/bpm/extension/commons/io/socket/*.class</exclude>
<exclude>
org/camunda/bpm/extension/commons/connector/auth/FormioConfiguration.class</exclude>
<exclude>
org/camunda/bpm/extension/commons/connector/auth/FormioContext.class</exclude>
<exclude>
org/camunda/bpm/extension/commons/connector/*.class</exclude>
<exclude>
org/camunda/bpm/extension/CamundaApplication.class</exclude>
<exclude>
org/camunda/bpm/extension/commons/exceptions/*.class</exclude>
<exclude>org/camunda/bpm/extension/commons/utils/*.class</exclude>
<exclude>org/camunda/bpm/extension/hooks/controllers/mapper/*.class</exclude>
<exclude>org/camunda/bpm/extension/hooks/exceptions/*.class</exclude>
<exclude>org/camunda/bpm/extension/hooks/listeners/execution/FormAccessTokenCacheListener.class</exclude>
<exclude>org/camunda/bpm/extension/hooks/rest/exception/*.class</exclude>
<exclude>org/camunda/bpm/extension/commons/exceptions/*.class</exclude>
<exclude>org/camunda/bpm/extension/commons/config/*.class</exclude>
<exclude>org/camunda/bpm/extension/hooks/rest/constant/*.class</exclude>
<exclude>org/camunda/bpm/extension/hooks/services/IMessageEvent.class</exclude>
<exclude>org/camunda/bpm/extension/hooks/rest/dto/*.class</exclude>
<exclude>org/camunda/bpm/extension/hooks/rest/impl/*.class</exclude>
<exclude>
org/camunda/bpm/extension/hooks/controllers/mapper/*.class</exclude>
<exclude>
org/camunda/bpm/extension/hooks/exceptions/*.class</exclude>
<exclude>
org/camunda/bpm/extension/hooks/listeners/execution/FormAccessTokenCacheListener.class</exclude>
<exclude>
org/camunda/bpm/extension/hooks/rest/exception/*.class</exclude>
<exclude>
org/camunda/bpm/extension/commons/exceptions/*.class</exclude>
<exclude>
org/camunda/bpm/extension/commons/config/*.class</exclude>
<exclude>
org/camunda/bpm/extension/hooks/rest/constant/*.class</exclude>
<exclude>
org/camunda/bpm/extension/hooks/services/IMessageEvent.class</exclude>
<exclude>
org/camunda/bpm/extension/hooks/rest/dto/*.class</exclude>
<exclude>
org/camunda/bpm/extension/hooks/rest/impl/*.class</exclude>
</excludes>
</configuration>
<executions>
Expand Down
2 changes: 1 addition & 1 deletion forms-flow-bpm/src/main/java/org/camunda/bpm/extension/commons/config/AppConfig.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,7 @@
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;

import javax.annotation.PostConstruct;
import jakarta.annotation.PostConstruct;

/**
* AppConfig
Expand Down
2 changes: 1 addition & 1 deletion ...src/main/java/org/camunda/bpm/extension/commons/config/FormsFlowJerseyResourceConfig.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@
import org.glassfish.jersey.jackson.JacksonFeature;
import org.springframework.stereotype.Component;

import javax.ws.rs.ApplicationPath;
import jakarta.ws.rs.ApplicationPath;

/**
* Extension to camunda Jersey resources
Expand Down
4 changes: 2 additions & 2 deletions ...src/main/java/org/camunda/bpm/extension/commons/connector/FormioTokenServiceProvider.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,8 +9,8 @@
import org.springframework.stereotype.Service;
import org.springframework.web.reactive.function.client.WebClient;

import javax.annotation.PostConstruct;
import javax.annotation.Resource;
import jakarta.annotation.PostConstruct;
import jakarta.annotation.Resource;
import java.util.Properties;


Expand Down
2 changes: 1 addition & 1 deletion ...low-bpm/src/main/java/org/camunda/bpm/extension/commons/connector/HTTPServiceInvoker.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@
import org.springframework.http.*;
import org.springframework.stereotype.Component;

import javax.annotation.Resource;
import jakarta.annotation.Resource;
import java.io.IOException;
import java.util.Map;
import java.util.Properties;
Expand Down
6 changes: 4 additions & 2 deletions ...in/java/org/camunda/bpm/extension/commons/connector/support/ApplicationAccessHandler.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,7 +47,8 @@ public ResponseEntity<String> exchange(String url, HttpMethod method, String pay
.header(HttpHeaders.CONTENT_TYPE, MediaType.APPLICATION_JSON_VALUE)
.body(Mono.just(payload), String.class)
.retrieve()
.onStatus(HttpStatus::is4xxClientError, clientResponse -> Mono.error(new HttpClientErrorException(HttpStatus.BAD_REQUEST)))
.onStatus(HttpStatusCode::is4xxClientError,
clientResponse -> Mono.error(new HttpClientErrorException(clientResponse.statusCode())))
.toEntity(String.class)
.block();

Expand All @@ -71,7 +72,8 @@ public ResponseEntity<IResponse> exchange(String url, HttpMethod method, IReques
.header(HttpHeaders.CONTENT_TYPE, MediaType.APPLICATION_JSON_VALUE)
.body((payload == null?BodyInserters.empty():BodyInserters.fromValue(payload)))
.retrieve()
.onStatus(HttpStatus::is4xxClientError, clientResponse -> Mono.error(new HttpClientErrorException(HttpStatus.BAD_REQUEST)))
.onStatus(HttpStatusCode::is4xxClientError,
clientResponse -> Mono.error(new HttpClientErrorException(clientResponse.statusCode())))
.toEntity(responseClazz)
.block();
return new ResponseEntity<>(response.getBody(), response.getStatusCode());
Expand Down
7 changes: 5 additions & 2 deletions ...m/src/main/java/org/camunda/bpm/extension/commons/connector/support/BPMAccessHandler.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,7 @@
import org.springframework.http.HttpHeaders;
import org.springframework.http.HttpMethod;
import org.springframework.http.HttpStatus;
import org.springframework.http.HttpStatusCode;
import org.springframework.http.ResponseEntity;
import org.springframework.http.MediaType;
import org.springframework.stereotype.Service;
Expand Down Expand Up @@ -49,8 +50,10 @@ public ResponseEntity<String> exchange(String url, HttpMethod method, Map<String
.header(HttpHeaders.CONTENT_TYPE, MediaType.APPLICATION_JSON_VALUE)
.body((payload == null? BodyInserters.empty():BodyInserters.fromValue(payload)))
.retrieve()
.onStatus(HttpStatus::is4xxClientError, clientResponse -> Mono.error(new HttpClientErrorException(HttpStatus.BAD_REQUEST)))
.onStatus(HttpStatus::is5xxServerError, clientResponse -> Mono.error(new HttpClientErrorException(HttpStatus.INTERNAL_SERVER_ERROR)))
.onStatus(HttpStatusCode::is4xxClientError,
clientResponse -> Mono.error(new HttpClientErrorException(clientResponse.statusCode())))
.onStatus(HttpStatusCode::is5xxServerError,
clientResponse -> Mono.error(new HttpClientErrorException(clientResponse.statusCode())))
.toEntity(String.class)
.block();

Expand Down
6 changes: 4 additions & 2 deletions ...va/org/camunda/bpm/extension/commons/connector/support/CustomSubmissionAccessHandler.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -50,7 +50,8 @@ public ResponseEntity<String> exchange(String url, HttpMethod method, String pay
.header(HttpHeaders.CONTENT_TYPE, MediaType.APPLICATION_JSON_VALUE)
.body(Mono.just(payload), String.class)
.retrieve()
.onStatus(HttpStatus::is4xxClientError, clientResponse -> Mono.error(new HttpClientErrorException(HttpStatus.BAD_REQUEST)))
.onStatus(HttpStatusCode::is4xxClientError,
clientResponse -> Mono.error(new HttpClientErrorException(clientResponse.statusCode())))
.toEntity(String.class)
.block();

Expand All @@ -73,7 +74,8 @@ public ResponseEntity<IResponse> exchange(String url, HttpMethod method, IReques
.header(HttpHeaders.CONTENT_TYPE, MediaType.APPLICATION_JSON_VALUE)
.body((payload == null?BodyInserters.empty():BodyInserters.fromValue(payload)))
.retrieve()
.onStatus(HttpStatus::is4xxClientError, clientResponse -> Mono.error(new HttpClientErrorException(HttpStatus.BAD_REQUEST)))
.onStatus(HttpStatusCode::is4xxClientError,
clientResponse -> Mono.error(new HttpClientErrorException(clientResponse.statusCode())))
.toEntity(responseClazz)
.block();
return new ResponseEntity<>(response.getBody(), response.getStatusCode());
Expand Down
Loading
Loading