Skip to content
This repository was archived by the owner on May 5, 2021. It is now read-only.

Commit 2181752

Browse files
MateStrysewskeMateStrysewske
committed
Merge branch 'development' of https://github.com/hzi-braunschweig/SORMAS-Project into development
2 parents 9765aa1 + 68f1fee commit 2181752

3 files changed

Lines changed: 119 additions & 9 deletions

File tree

‎.github/workflows/ci.yml‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
# This workflow will build a Java project with Maven
2+
# For more information see: https://help.github.com/actions/language-and-framework-guides/building-and-testing-java-with-maven
3+
4+
name: Java CI with Maven
5+
6+
env:
7+
java: 11
8+
9+
on:
10+
push:
11+
branches: [ development, master ]
12+
pull_request:
13+
branches: [ development ]
14+
15+
jobs:
16+
build:
17+
name: Build
18+
runs-on: ubuntu-latest
19+
20+
steps:
21+
- name: Checkout repository
22+
uses: actions/checkout@v2
23+
24+
- name: Set up JDK ${{ env.java }}
25+
uses: actions/setup-java@v1
26+
with:
27+
java-version: ${{ env.java }}
28+
29+
- name: Cache Maven packages
30+
# FIXME(@JonasCir) #3733 remove '**/*.pom' once serverlib pom is renamed
31+
uses: actions/cache@v2
32+
with:
33+
path: ~/.m2
34+
key: ${{ runner.os }}-java-${{ env.java }}-m2-${{ hashFiles('**/pom.xml', '**/*.pom') }}
35+
restore-keys: ${{ runner.os }}-java-${{ env.java }}-m2
36+
37+
- name: Build with Maven
38+
working-directory: ./sormas-base
39+
run: mvn verify -B -ntp

‎.travis.yml‎

Lines changed: 0 additions & 9 deletions
This file was deleted.

‎sormas-base/dependencies/check-suppressions.xml‎

Lines changed: 80 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,80 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">
3+
4+
<!-- *** False positives *** -->
5+
<suppress>
6+
<notes><![CDATA[
7+
We are using newer Gradle version 5.4.1
8+
]]></notes>
9+
<filePath regex="true">.*\bgradle-wrapper.*\.jar</filePath>
10+
<cve>CVE-2019-11065</cve>
11+
</suppress>
12+
<suppress>
13+
<notes><![CDATA[
14+
CVE addresses "data-tools" (not Java) which dows not seem to be uses by "jackson-dataformat-hal"
15+
]]></notes>
16+
<filePath regex="true">.*\bjackson-dataformat-hal.*\.jar</filePath>
17+
<cve>CVE-2018-18749</cve>
18+
</suppress>
19+
<suppress>
20+
<notes><![CDATA[
21+
CVE is fixed with Keycloak 10, we use at least version 11
22+
]]></notes>
23+
<filePath regex="true">.*\bkeycloak-.*\.jar</filePath>
24+
<cve>CVE-2020-1728</cve>
25+
</suppress>
26+
<suppress>
27+
<notes><![CDATA[
28+
We are using a newer version than Vaadin 6.4.9
29+
]]></notes>
30+
<filePath regex="true">.*\bvaadin-sass-compiler\.jar</filePath>
31+
<cve>CVE-2011-0509</cve>
32+
</suppress>
33+
<suppress>
34+
<notes><![CDATA[
35+
False positive documented in Dependency Check 6.0.3, see https://github.com/jeremylong/DependencyCheck/issues/2511
36+
]]></notes>
37+
<filePath regex="true">.*\bvaadin-sass-compiler\.jar</filePath>
38+
<cve>CVE-2019-10799</cve>
39+
</suppress>
40+
<!-- *** False positives END *** -->
41+
42+
<!-- *** Not exploitable *** -->
43+
<suppress>
44+
<notes><![CDATA[
45+
Not exploitable because we use Gradle as build tool to get public available dependencies without any credentials. Upgrade from 5.4.1 to 5.6.x might also be an option.
46+
]]></notes>
47+
<filePath regex="true">.*\bgradle-wrapper.*\.jar</filePath>
48+
<cve>CVE-2019-15052</cve>
49+
</suppress>
50+
<suppress>
51+
<notes><![CDATA[
52+
Not relevant at the moment because we do not use SocketServer to receive logs.
53+
]]></notes>
54+
<filePath regex="true">.*\blogback-.*\.jar</filePath>
55+
<cve>CVE-2017-5929</cve>
56+
</suppress>
57+
<suppress>
58+
<notes><![CDATA[
59+
maven-ant-tasks is not part of the release and is not relied on by the code
60+
]]></notes>
61+
<filePath regex="true">.*\bmaven-ant-tasks.*\.jar/META-INF/.*\bplexus-utils.*</filePath>
62+
<cve>CVE-2017-1000487</cve>
63+
</suppress>
64+
<suppress>
65+
<notes><![CDATA[
66+
maven-ant-tasks is not part of the release and is not relied on by the code
67+
]]></notes>
68+
<filePath regex="true">.*\bmaven-ant-tasks.*\.jar/META-INF/.*\bplexus-utils.*</filePath>
69+
<vulnerabilityName>Directory traversal in org.codehaus.plexus.util.Expand</vulnerabilityName>
70+
</suppress>
71+
<suppress>
72+
<notes><![CDATA[
73+
maven-ant-tasks is not part of the release and is not relied on by the code
74+
]]></notes>
75+
<filePath regex="true">.*\bmaven-ant-tasks.*\.jar/META-INF/.*\bplexus-utils.*</filePath>
76+
<vulnerabilityName>Possible XML Injection</vulnerabilityName>
77+
</suppress>
78+
<!-- *** Not exploitable END *** -->
79+
80+
</suppressions>

0 commit comments

Comments
 (0)