OWASP · ismisepaul · Dec 7, 2022 · Dec 7, 2022 · Dec 7, 2022 · Dec 7, 2022
diff --git a/.env b/.env
@@ -1,8 +1,8 @@
 VERSION=3.1
 
-TOMCAT_DOCKER_VERSION=8-jre8-openjdk
-DB_VERSION=10.6.11
-MONGODB_VERSION=4.1.13
+TOMCAT_DOCKER_VERSION=8.5-jre11
+DB_VERSION=10.6
+MONGODB_VERSION=4.4
 
 IMAGE_TOMCAT=owasp/security-shepherd
 IMAGE_MARIADB=owasp/security-shepherd_mariadb
@@ -36,6 +36,6 @@ HTTPS_PORT=443
 
 DOCKER_NETWORK_NAME=securityshepherd_default
 
-TEST_MYSQL_HOST=127.0.0.1
-TEST_MYSQL_PORT=3306
-TEST_MYSQL_PASSWORD=password
+TEST_MARIADB_HOST=127.0.0.1
+TEST_MARIADB_PORT=3306
+TEST_MARIADB_PASSWORD=password
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -20,11 +20,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v2
-      - name: Set up JDK 1.8
-        uses: actions/setup-java@v3.6.0
+      - name: Set up JDK 11
+        uses: actions/setup-java@v3
         with:
           distribution: 'zulu'
-          java-version: '8'
+          java-version: '11'
       - name: Build Maven with Docker Profile and Generate SBOM
         run: mvn clean install -Pdocker -DskipTests -B -DexcludeTestProject=true cyclonedx:makeBom
       - name: Upload WAR File
@@ -80,14 +80,14 @@ jobs:
         uses: actions/checkout@v2
 
       - name: Log in to Docker Hub
-        uses: docker/login-action@v2.1.0
+        uses: docker/login-action@v2
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
 
       - name: Extract metadata (tags, labels) for Docker
         id: meta
-        uses: docker/metadata-action@v4.1.1
+        uses: docker/metadata-action@v4
         with:
           images: owasp/security-shepherd
 
@@ -107,7 +107,7 @@ jobs:
           env-file: .env
 
       - name: Build and push Tomcat
-        uses: docker/build-push-action@v3.2.0
+        uses: docker/build-push-action@v3
         with:
           context: .
           push: true

diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
@@ -25,7 +25,7 @@ jobs:
   lint-java:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v3.2.0
       - uses: axel-op/googlejavaformat-action@fe78db8a90171b6a836449f8d0e982d5d71e5c5a #v3.6.0
         with:
           args: "--set-exit-if-changed"
@@ -35,11 +35,12 @@ jobs:
     name: build
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v2
-      - name: Set up JDK 1.8
-        uses: actions/setup-java@v1
+      - uses: actions/checkout@v3.2.0
+      - name: Set up JDK 11
+        uses: actions/setup-java@v3
         with:
-          java-version: 1.8
+          distribution: 'zulu'
+          java-version: '11'
       - name: Build Maven with Docker Profile
         run: mvn clean install -Pdocker -DskipTests -B
       - name: Docker Compose Build
@@ -49,57 +50,75 @@ jobs:
     needs: [lint-java, build]
     runs-on: ubuntu-latest
     services:
-      mysql:
-        image: mysql:5.7
+      mariadb:
+        image: mariadb:10.6
         env:
-          MYSQL_ROOT_PASSWORD: password
-          MYSQL_DATABASE: core
+          MARIADB_ROOT_PASSWORD: password
+          MARIADB_DATABASE: core
         ports:
           - '8888:3306'
         options: --health-cmd="mysqladmin ping" --health-interval=10s --health-timeout=5s --health-retries=3
     steps:
-      - uses: actions/checkout@v2
-      - name: Set up JDK 1.8
-        uses: actions/setup-java@v1
+      - uses: actions/checkout@v3.2.0
+      - name: Set up JDK 11
+        uses: actions/setup-java@v3
         with:
-          java-version: 1.8
-      - name: Start MYSQL Server
+          distribution: 'zulu'
+          java-version: '11'
+      - name: Start MariaDB Server
         run: sudo /etc/init.d/mysql start
-      - name: Modify MySQL Connection Variables
+      - name: Modify MyMariaDBSQL Connection Variables
         run: |
           sed -i "s/'@'localhost'/'@'%'/g" ${GITHUB_WORKSPACE}/src/main/resources/database/moduleSchemas.sql
-          sed -i 's/TEST_MYSQL_PORT=3306/TEST_MYSQL_PORT=8888/g' ${GITHUB_WORKSPACE}/.env
+          sed -i 's/TEST_MARIADB_PORT=3306/TEST_MARIADB_PORT=8888/g' ${GITHUB_WORKSPACE}/.env
       - name: Run Unit Tests
         run: mvn test -B -e -X
+      - name: Upload unit test reports
+        if: ${{ always() }}
+        uses: actions/upload-artifact@v3
+        with:
+          name: failsafe-reports
+          path: |
+            target/surefire-reports/*.txt
+            target/surefire-reports/*.xml
 
   integration-tests:
     needs: [lint-java, build]
     runs-on: ubuntu-latest
     services:
-      mysql:
-        image: mysql:5.7
+      mariadb:
+        image: mariadb:10.6
         env:
-          MYSQL_ROOT_PASSWORD: password
-          MYSQL_DATABASE: core
+          MARIADB_ROOT_PASSWORD: password
+          MARIADB_DATABASE: core
         ports:
           - '8888:3306'
         options: --health-cmd="mysqladmin ping" --health-interval=10s --health-timeout=5s --health-retries=3
     steps:
-      - uses: actions/checkout@v2
-      - name: Set up JDK 1.8
-        uses: actions/setup-java@v1
+      - uses: actions/checkout@v3.2.0
+      - name: Set up JDK 11
+        uses: actions/setup-java@v3
         with:
-          java-version: 1.8
-      - name: Start MYSQL Server
+          distribution: 'zulu'
+          java-version: '11'
+      - name: Start MARIADB Server
         run: sudo /etc/init.d/mysql start
-      - name: Modify MySQL Connection Variables
+      - name: Modify MARIADB Connection Variables
         run: |
           sed -i "s/'@'localhost'/'@'%'/g" ${GITHUB_WORKSPACE}/src/main/resources/database/moduleSchemas.sql
-          sed -i 's/TEST_MYSQL_PORT=3306/TEST_MYSQL_PORT=8888/g' ${GITHUB_WORKSPACE}/.env
-      - name: Prepare Intergration Tests
+          sed -i 's/TEST_MARIADB_PORT=3306/TEST_MARIADB_PORT=8888/g' ${GITHUB_WORKSPACE}/.env
+      - name: Prepare Integration Tests
         run: |
           sudo apt-get -y install libargon2-0
           mvn -Pdocker validate
       - name: Run Intergration Tests
         run: |
           mvn verify -DskipUTs=true -DmongoDocker -B
+      - name: Upload integration test reports
+        if: ${{ always() }}
+        uses: actions/upload-artifact@v3
+        with:
+          name: failsafe-reports
+          path: |
+            target/failsafe-reports/*.txt
+            target/failsafe-reports/*.xml
diff --git a/docker/mongo/Dockerfile b/docker/mongo/Dockerfile
@@ -26,17 +26,15 @@ RUN { \
 
 FROM mongo:${MONGODB_VERSION}
 COPY --from=builder /workdir/moduleSchemas.js /docker-entrypoint-initdb.d/
-
-ENV RUN_USER mongodb
-ENV RUN_GROUP mongodb
-
 COPY --from=builder /workdir/mongod.conf /etc/mongod.conf
 
-RUN chown -R ${RUN_USER}:${RUN_GROUP} "/etc/mongod.conf"
-RUN chown -R ${RUN_USER}:${RUN_GROUP} "/docker-entrypoint-initdb.d"
+ENV RUN_USER mongodb
 
-USER ${RUN_USER}
+USER root
 RUN sed -i 's/\/\/REMOVE/ /g' /docker-entrypoint-initdb.d/moduleSchemas.js
+RUN chown -R ${RUN_USER}:${RUN_USER} /etc/mongod.conf
+RUN chown -R ${RUN_USER}:${RUN_USER} /docker-entrypoint-initdb.d/moduleSchemas.js
+USER ${RUN_USER}
 
 ENTRYPOINT ["docker-entrypoint.sh"]
 

diff --git a/pom.xml b/pom.xml
@@ -99,7 +99,7 @@
 		<dependency>
 			<groupId>org.mariadb.jdbc</groupId>
 			<artifactId>mariadb-java-client</artifactId>
-			<version>3.0.6</version>
+			<version>3.1.0</version>
 		</dependency>
 
 		<!-- https://mvnrepository.com/artifact/org.owasp.encoder/encoder -->
@@ -120,7 +120,7 @@
 		<dependency>
 			<groupId>org.springframework</groupId>
 			<artifactId>spring-web</artifactId>
-			<version>5.3.23</version>
+			<version>6.0.2</version>
 			<scope>test</scope>
 		</dependency>
 
@@ -136,7 +136,7 @@
 		<dependency>
 			<groupId>org.springframework</groupId>
 			<artifactId>spring-core</artifactId>
-			<version>5.3.22</version>
+			<version>6.0.2</version>
 			<scope>test</scope>
 		</dependency>
 
@@ -166,7 +166,7 @@
 		<dependency>
 			<groupId>org.junit.jupiter</groupId>
 			<artifactId>junit-jupiter-api</artifactId>
-			<version>5.9.0</version>
+			<version>5.9.1</version>
 			<scope>test</scope>
 		</dependency>
 
@@ -197,7 +197,7 @@
 		<dependency>
 			<groupId>org.mockito</groupId>
 			<artifactId>mockito-core</artifactId>
-			<version>4.8.0</version>
+			<version>4.9.0</version>
 		</dependency>
 
 		<!-- https://mvnrepository.com/artifact/io.github.cdimascio/java-dotenv -->
@@ -345,19 +345,22 @@
 						<configuration>
 							<images>
 								<image>
-									<name>mongo:${MONGODB_VERSION}</name>
+									<name>mongo_shepherd:${MONGODB_VERSION}</name>
 									<build>
 										<dockerFile>${project.basedir}/docker/mongo/Dockerfile</dockerFile>
 									</build>
 									<run>
+<!--										<log>-->
+<!--											<enabled>true</enabled>-->
+<!--										</log>-->
 										<ports>
 											<port>27017:27017</port>
 										</ports>
-										<wait>
-											<!-- Check for this URL to return a 200 return code .... -->
-											<log>waiting for connections on port 27017</log>
-											<time>120000</time>
-										</wait>
+<!--										<wait>-->
+<!--											&lt;!&ndash; Check for this URL to return a 200 return code .... &ndash;&gt;-->
+<!--											<log>waiting for connections on port 27017</log>-->
+<!--											<time>120000</time>-->
+<!--										</wait>-->
 									</run>
 								</image>
 							</images>
@@ -442,7 +445,7 @@
 			<plugin>
 				<groupId>org.apache.maven.plugins</groupId>
 				<artifactId>maven-surefire-plugin</artifactId>
-				<version>2.19.1</version>
+				<version>2.6</version>
 				<configuration>
 					<skipTests>${skipUTs}</skipTests>
 					<excludes>
@@ -453,12 +456,18 @@
 			<plugin>
 				<groupId>org.apache.maven.plugins</groupId>
 				<artifactId>maven-failsafe-plugin</artifactId>
-				<version>2.22.2</version>
+				<version>2.6</version>
 				<configuration>
+					<failIfNoTests>true</failIfNoTests>
 					<skipTests>${skipTests}</skipTests>
 					<skipITs>${skipITs}</skipITs>
+<!--					<includes>-->
+<!--						<include>**/it/IT*.java</include>-->
+<!--						<include>**/it/*IT.java</include>-->
+<!--						<include>**/it/*ITCase.java</include>-->
+<!--					</includes>-->
 					<excludes>
-						<exclude>**/*Test*</exclude>
+						<exclude>**/test/*Test*</exclude>
 					</excludes>
 				</configuration>
 				<executions>