Skip to content

Commit 58c2443

Browse files
SelahattinSertSelahattinSert
authored
Merge pull request #47 from SelahattinSert/task/add-org.owasp.dependencycheck
Add org.owasp.dependencycheck
2 parents 4e81a79 + eca3710 commit 58c2443

File tree

3 files changed

+123
-3
lines changed

3 files changed

+123
-3
lines changed

‎.github/workflows/ci.yml‎

Lines changed: 38 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -9,31 +9,66 @@ on:
99

1010
jobs:
1111
build:
12+
name: Build with Maven
1213
runs-on: ubuntu-latest
1314

1415
steps:
1516
- name: Check out the repository
16-
uses: actions/checkout@v2
17+
uses: actions/checkout@v3
1718

1819
- name: Set up JDK 21
19-
uses: actions/setup-java@v1
20+
uses: actions/setup-java@v3
2021
with:
22+
distribution: 'temurin'
2123
java-version: '21'
24+
cache: maven
2225

2326
- name: Set up Maven
2427
uses: stCarolas/setup-maven@v4.2
2528
with:
2629
maven-version: 3.9.6
2730

2831
- name: Cache Maven packages
29-
uses: actions/cache@v2
32+
uses: actions/cache@v3
3033
with:
3134
path: ~/.m2/repository
3235
key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
3336
restore-keys: |
3437
${{ runner.os }}-maven-
38+
3539
- name: Build with Maven
3640
run: mvn -B package --file pom.xml
3741

42+
- name: Run tests
43+
run: mvn clean test
44+
45+
test:
46+
name: Run tests
47+
runs-on: ubuntu-latest
48+
needs: build
49+
steps:
50+
- name: Check out the repository
51+
uses: actions/checkout@v3
52+
53+
- name: Set up JDK 21
54+
uses: actions/setup-java@v3
55+
with:
56+
distribution: 'temurin'
57+
java-version: '21'
58+
cache: maven
59+
60+
- name: Set up Maven
61+
uses: stCarolas/setup-maven@v4.2
62+
with:
63+
maven-version: 3.9.6
64+
65+
- name: Cache Maven packages
66+
uses: actions/cache@v3
67+
with:
68+
path: ~/.m2/repository
69+
key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
70+
restore-keys: |
71+
${{ runner.os }}-maven-
72+
3873
- name: Run tests
3974
run: mvn clean test

‎owasp-suppressions.xml‎

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">
3+
<!-- azure-identity-1.13.1 -->
4+
<!-- com.azure.spring:spring-cloud-azure-starter@5.15.0 -->
5+
<suppress>
6+
<cve>CVE-2023-36415</cve>
7+
<cve>CVE-2024-35255</cve>
8+
</suppress>
9+
<!-- json-smart-2.5.1 -->
10+
<!-- org.springframework.boot:spring-boot-starter-test@3.3.1 -->
11+
<suppress>
12+
<cve>CVE-2024-57699</cve>
13+
</suppress>
14+
<!-- logback-core-1.5.6 -->
15+
<!-- org.springframework.boot:spring-boot-starter-logging@3.3.1 -->
16+
<suppress>
17+
<cve>CVE-2024-12798</cve>
18+
<cve>CVE-2024-12801</cve>
19+
</suppress>
20+
<!-- msal4j-1.16.1 -->
21+
<!-- com.azure.spring:spring-cloud-azure-starter@5.15.0 -->
22+
<suppress>
23+
<cve>CVE-2024-35255</cve>
24+
</suppress>
25+
<!-- netty-common-4.1.111.Final -->
26+
<!-- com.azure:azure-storage-blob@12.27.1 -->
27+
<suppress>
28+
<cve>CVE-2024-47535</cve>
29+
</suppress>
30+
<!-- netty-handler-4.1.111.Final -->
31+
<!-- com.azure:azure-storage-blob@12.27.1 -->
32+
<suppress>
33+
<cve>CVE-2025-24970</cve>
34+
</suppress>
35+
<!-- spring-cloud-azure-starter-storage-queue-5.15.0 -->
36+
<!-- com.azure.spring:spring-cloud-azure-starter-storage@5.15.0 -->
37+
<suppress>
38+
<cve>CVE-2022-30187</cve>
39+
</suppress>
40+
<!-- spring-core-6.1.10 -->
41+
<!-- org.springframework.boot:spring-boot-starter-test@3.3.1 -->
42+
<suppress>
43+
<cve>CVE-2024-38820</cve>
44+
</suppress>
45+
<!-- spring-web-6.1.10 -->
46+
<!-- org.springframework.boot:spring-boot-starter-web@3.3.1 -->
47+
<suppress>
48+
<cve>CVE-2024-38809</cve>
49+
<cve>CVE-2024-38820</cve>
50+
</suppress>
51+
<!-- spring-webmvc-6.1.10 -->
52+
<!-- org.springframework.boot:spring-boot-starter-web@3.3.1 -->
53+
<suppress>
54+
<cve>CVE-2024-38816</cve>
55+
<cve>CVE-2024-38820</cve>
56+
</suppress>
57+
<!-- swagger-ui-5.17.14 (DOMPurify@3.1.4) -->
58+
<!-- org.springdoc:springdoc-openapi-starter-webmvc-ui@2.6.0 -->
59+
<suppress>
60+
<cve>CVE-2025-26791</cve>
61+
</suppress>
62+
<!-- tomcat-embed-core-10.1.25 -->
63+
<!-- org.springframework.boot:spring-boot-starter-web@3.3.1 -->
64+
<suppress>
65+
<cve>CVE-2025-24813</cve>
66+
</suppress>
67+
</suppressions>

‎pom.xml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -172,6 +172,24 @@
172172
<artifactId>versions-maven-plugin</artifactId>
173173
<version>2.18.0</version>
174174
</plugin>
175+
176+
<plugin>
177+
<groupId>org.owasp</groupId>
178+
<artifactId>dependency-check-maven</artifactId>
179+
<version>12.1.0</version>
180+
<configuration>
181+
<suppressionFile>${project.basedir}/owasp-suppressions.xml</suppressionFile>
182+
<knownExploitedEnabled>false</knownExploitedEnabled>
183+
<failBuildOnCVSS>0</failBuildOnCVSS>
184+
</configuration>
185+
<executions>
186+
<execution>
187+
<goals>
188+
<goal>check</goal>
189+
</goals>
190+
</execution>
191+
</executions>
192+
</plugin>
175193
</plugins>
176194
</build>
177195

0 commit comments

Comments
 (0)