From cc567c0cb782fdecf6703df6e123081d6c7dd54d Mon Sep 17 00:00:00 2001
From: anandsudhir <anandsudhir86@gmail.com>
Date: Mon, 2 Jul 2018 10:40:09 +0200
Subject: [PATCH 1/3] Use spotbugs instead of findbugs

---
 .../{findbugs-base.xml => spotbugs-base.xml}   |  0
 .../spotbugs-base.xml                          |  0
 .../spotbugs-base.xml                          |  0
 pom.xml                                        | 18 +++++++++---------
 .../findbugs-base.xml => spotbugs-base.xml     |  0
 ...udefilter.xml => spotbugs-excludefilter.xml |  7 +++++--
 6 files changed, 14 insertions(+), 11 deletions(-)
 rename burp-maven-plugin/{findbugs-base.xml => spotbugs-base.xml} (100%)
 rename findbugs-base.xml => headless-burp-proxy/spotbugs-base.xml (100%)
 rename headless-burp-proxy/findbugs-base.xml => headless-burp-scanner/spotbugs-base.xml (100%)
 rename headless-burp-scanner/findbugs-base.xml => spotbugs-base.xml (100%)
 rename findbugs-excludefilter.xml => spotbugs-excludefilter.xml (58%)

diff --git a/burp-maven-plugin/findbugs-base.xml b/burp-maven-plugin/spotbugs-base.xml
similarity index 100%
rename from burp-maven-plugin/findbugs-base.xml
rename to burp-maven-plugin/spotbugs-base.xml
diff --git a/findbugs-base.xml b/headless-burp-proxy/spotbugs-base.xml
similarity index 100%
rename from findbugs-base.xml
rename to headless-burp-proxy/spotbugs-base.xml
diff --git a/headless-burp-proxy/findbugs-base.xml b/headless-burp-scanner/spotbugs-base.xml
similarity index 100%
rename from headless-burp-proxy/findbugs-base.xml
rename to headless-burp-scanner/spotbugs-base.xml
diff --git a/pom.xml b/pom.xml
index fc3b1f8..a836e73 100644
--- a/pom.xml
+++ b/pom.xml
@@ -20,8 +20,8 @@
     <java.version>1.8</java.version>
     <dependency-check.skip>false</dependency-check.skip>
     <checkstyle-config.location>${project.basedir}</checkstyle-config.location>
-    <findbugs-excludefilter.location>${project.basedir}/../findbugs-excludefilter.xml
-    </findbugs-excludefilter.location>
+    <spotbugs-excludefilter.location>${project.basedir}/../spotbugs-excludefilter.xml
+    </spotbugs-excludefilter.location>
   </properties>
 
   <dependencyManagement>
@@ -206,15 +206,15 @@
         </configuration>
       </plugin>
       <plugin>
-        <groupId>org.codehaus.mojo</groupId>
-        <artifactId>findbugs-maven-plugin</artifactId>
-        <version>3.0.5</version>
+        <groupId>com.github.spotbugs</groupId>
+        <artifactId>spotbugs-maven-plugin</artifactId>
+        <version>3.1.3</version>
         <configuration>
           <effort>Max</effort>
           <threshold>Low</threshold>
           <xmlOutput>true</xmlOutput>
-          <excludeFilterFile>${findbugs-excludefilter.location}</excludeFilterFile>
-          <excludeBugsFile>${project.basedir}/findbugs-base.xml</excludeBugsFile>
+          <excludeFilterFile>${spotbugs-excludefilter.location}</excludeFilterFile>
+          <excludeBugsFile>${project.basedir}/spotbugs-base.xml</excludeBugsFile>
           <plugins>
             <plugin>
               <groupId>com.h3xstream.findsecbugs</groupId>
@@ -291,10 +291,10 @@
       <id>quick</id>
       <properties>
         <checkstyle.skip>true</checkstyle.skip>
-        <findbugs.skip>true</findbugs.skip>
+        <spotbugs.skip>true</spotbugs.skip>
         <dependency-check.skip>true</dependency-check.skip>
       </properties>
     </profile>
   </profiles>
 
-</project>
\ No newline at end of file
+</project>
diff --git a/headless-burp-scanner/findbugs-base.xml b/spotbugs-base.xml
similarity index 100%
rename from headless-burp-scanner/findbugs-base.xml
rename to spotbugs-base.xml
diff --git a/findbugs-excludefilter.xml b/spotbugs-excludefilter.xml
similarity index 58%
rename from findbugs-excludefilter.xml
rename to spotbugs-excludefilter.xml
index 8d1a10a..e0996af 100644
--- a/findbugs-excludefilter.xml
+++ b/spotbugs-excludefilter.xml
@@ -1,4 +1,7 @@
-<FindBugsFilter>
+<FindBugsFilter
+        xmlns="https://github.com/spotbugs/filter/3.0.0"
+        xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+        xsi:schemaLocation="https://github.com/spotbugs/filter/3.0.0 https://raw.githubusercontent.com/spotbugs/spotbugs/3.1.0/spotbugs/etc/findbugsfilter.xsd">
   <!--headless burp specific exclusions-->
   <Match>
     <Class name="HelpMojo"/>
@@ -21,6 +24,6 @@
   </Match>
   <Match>
     <Class name="eu.nets.burp.JUnitXmlGenerator"/>
-    <Bug code="SECXSLT"/>
+    <Bug pattern="MALICIOUS_XSLT,URLCONNECTION_SSRF_FD,XXE_DTD_TRANSFORM_FACTORY,XXE_XSLT_TRANSFORM_FACTORY"/>
   </Match>
 </FindBugsFilter>

From d18458e6ef83f52fa08189017bf25f284d227c27 Mon Sep 17 00:00:00 2001
From: anandsudhir <anandsudhir86@gmail.com>
Date: Mon, 2 Jul 2018 10:41:15 +0200
Subject: [PATCH 2/3] Bump version of jackson-databind as fix for CVE-2018-7489

---
 pom.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index a836e73..2a10f88 100644
--- a/pom.xml
+++ b/pom.xml
@@ -66,7 +66,7 @@
     <dependency>
       <groupId>com.fasterxml.jackson.core</groupId>
       <artifactId>jackson-databind</artifactId>
-      <version>2.9.4</version>
+      <version>2.9.5</version>
     </dependency>
 
     <!-- test -->

From fde4512dfc48b1140367d2512c091d15c9537e22 Mon Sep 17 00:00:00 2001
From: anandsudhir <anandsudhir86@gmail.com>
Date: Mon, 2 Jul 2018 10:44:00 +0200
Subject: [PATCH 3/3] Exclude false positive from findsecbugs

---
 spotbugs-excludefilter.xml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/spotbugs-excludefilter.xml b/spotbugs-excludefilter.xml
index e0996af..10933fd 100644
--- a/spotbugs-excludefilter.xml
+++ b/spotbugs-excludefilter.xml
@@ -26,4 +26,8 @@
     <Class name="eu.nets.burp.JUnitXmlGenerator"/>
     <Bug pattern="MALICIOUS_XSLT,URLCONNECTION_SSRF_FD,XXE_DTD_TRANSFORM_FACTORY,XXE_XSLT_TRANSFORM_FACTORY"/>
   </Match>
+  <Match>
+    <Class name="eu.nets.burp.maven.StreamLog"/>
+    <Bug pattern="INFORMATION_EXPOSURE_THROUGH_AN_ERROR_MESSAGE"/>
+  </Match>
 </FindBugsFilter>