Insecure.inc - Update to JRE 21

OWASP · Mar 17, 2024 · 8e85ae9 · 8e85ae9
1 parent 0e9b22e
commit 8e85ae9
Show file tree

Hide file tree

Showing 12 changed files with 77 additions and 72 deletions.
diff --git a/insecureinc/Dockerfile.insecureinc b/insecureinc/Dockerfile.insecureinc
@@ -1,10 +1,10 @@
 # Please use buildImage.sh script to build this image.
 # This stage is compiling the code and packaging war file in target folder
-FROM maven:3.8.1-openjdk-8 as build_image
+FROM maven:3.9.6-eclipse-temurin-21-alpine as build_image
 ADD . /insecureinc
 RUN cd /insecureinc && mvn clean install
 
-FROM tomcat:8.5-jre8
+FROM tomcat:11.0-jre21
 RUN rm -rf /var/lib/apt/lists/* && \
     apt-get update --fix-missing &&\
     apt-get -y install gcc

diff --git a/insecureinc/pom.xml b/insecureinc/pom.xml
@@ -9,9 +9,9 @@
     <packaging>war</packaging>
     <dependencies>
         <dependency>
-            <groupId>javax.servlet</groupId>
-            <artifactId>javax.servlet-api</artifactId>
-            <version>3.0.1</version>
+            <groupId>jakarta.servlet</groupId>
+            <artifactId>jakarta.servlet-api</artifactId>
+            <version>6.1.0-M2</version>
             <scope>provided</scope>
         </dependency>
         <dependency>
@@ -27,7 +27,12 @@
         <dependency>
             <groupId>org.apache.tomcat</groupId>
             <artifactId>tomcat-util</artifactId>
-            <version>8.5.53</version>
+            <version>11.0.0-M18</version>
+        </dependency>
+        <dependency>
+            <groupId>org.apache.tomcat</groupId>
+            <artifactId>tomcat-servlet-api</artifactId>
+            <version>11.0.0-M18</version>
         </dependency>
         <dependency>
             <groupId>org.openjdk.nashorn</groupId>
@@ -40,10 +45,10 @@
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-compiler-plugin</artifactId>
-                <version>3.1</version>
+                <version>3.12.1</version>
                 <configuration>
-                    <source>1.8</source>
-                    <target>1.8</target>
+                    <source>21</source>
+                    <target>21</target>
                     <optimize>true</optimize>
                     <debug>true</debug>
                 </configuration>

diff --git a/insecureinc/src/main/java/insecure/inc/Ch1Loggedin.java b/insecureinc/src/main/java/insecure/inc/Ch1Loggedin.java
@@ -8,13 +8,13 @@
 
 import java.io.IOException;
 
-import javax.servlet.ServletException;
-import javax.servlet.annotation.WebServlet;
-import javax.servlet.http.Cookie;
-import javax.servlet.http.HttpServlet;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-import javax.servlet.http.HttpSession;
+import jakarta.servlet.ServletException;
+import jakarta.servlet.annotation.WebServlet;
+import jakarta.servlet.http.Cookie;
+import jakarta.servlet.http.HttpServlet;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import jakarta.servlet.http.HttpSession;
 
 /**
  * Servlet implementation class Ch1Loggedin

diff --git a/insecureinc/src/main/java/insecure/inc/Cwe22Servlet.java b/insecureinc/src/main/java/insecure/inc/Cwe22Servlet.java
@@ -7,11 +7,11 @@
 package insecure.inc;
 
 import java.io.IOException;
-import javax.servlet.ServletException;
-import javax.servlet.annotation.WebServlet;
-import javax.servlet.http.HttpServlet;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
+import jakarta.servlet.ServletException;
+import jakarta.servlet.annotation.WebServlet;
+import jakarta.servlet.http.HttpServlet;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
 
 /**
  * Servlet implementation class Cwe22Servlet

diff --git a/insecureinc/src/main/java/insecure/inc/Cwe352Profile.java b/insecureinc/src/main/java/insecure/inc/Cwe352Profile.java
@@ -7,11 +7,11 @@
 package insecure.inc;
 
 import java.io.IOException;
-import javax.servlet.ServletException;
-import javax.servlet.annotation.WebServlet;
-import javax.servlet.http.HttpServlet;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
+import jakarta.servlet.ServletException;
+import jakarta.servlet.annotation.WebServlet;
+import jakarta.servlet.http.HttpServlet;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
 
 /**
  * Servlet implementation class Cwe352Profile

diff --git a/insecureinc/src/main/java/insecure/inc/Cwe434FileUpload.java b/insecureinc/src/main/java/insecure/inc/Cwe434FileUpload.java
@@ -8,14 +8,14 @@
 
 import java.io.IOException;
 
-import javax.servlet.ServletException;
-import javax.servlet.annotation.MultipartConfig;
-import javax.servlet.annotation.WebServlet;
-import javax.servlet.http.HttpServlet;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-import javax.servlet.http.HttpSession;
-import javax.servlet.http.Part;
+import jakarta.servlet.ServletException;
+import jakarta.servlet.annotation.MultipartConfig;
+import jakarta.servlet.annotation.WebServlet;
+import jakarta.servlet.http.HttpServlet;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import jakarta.servlet.http.HttpSession;
+import jakarta.servlet.http.Part;
 
 /**
  * Servlet implementation class Cwe434FileUpload

diff --git a/insecureinc/src/main/java/insecure/inc/Cwe611FileUpload.java b/insecureinc/src/main/java/insecure/inc/Cwe611FileUpload.java
@@ -7,13 +7,13 @@
 package insecure.inc;
 
 import java.io.IOException;
-import javax.servlet.ServletException;
-import javax.servlet.annotation.MultipartConfig;
-import javax.servlet.annotation.WebServlet;
-import javax.servlet.http.HttpServlet;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-import javax.servlet.http.Part;
+import jakarta.servlet.ServletException;
+import jakarta.servlet.annotation.MultipartConfig;
+import jakarta.servlet.annotation.WebServlet;
+import jakarta.servlet.http.HttpServlet;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import jakarta.servlet.http.Part;
 
 /**
  * Servlet implementation class Cwe611FileUpload

diff --git a/insecureinc/src/main/java/insecure/inc/Cwe79Profile.java b/insecureinc/src/main/java/insecure/inc/Cwe79Profile.java
@@ -7,11 +7,11 @@
 package insecure.inc;
 
 import java.io.IOException;
-import javax.servlet.ServletException;
-import javax.servlet.annotation.WebServlet;
-import javax.servlet.http.HttpServlet;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
+import jakarta.servlet.ServletException;
+import jakarta.servlet.annotation.WebServlet;
+import jakarta.servlet.http.HttpServlet;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
 
 /**
  * Servlet implementation class Cwe79Profile

diff --git a/insecureinc/src/main/java/insecure/inc/GetCode.java b/insecureinc/src/main/java/insecure/inc/GetCode.java
@@ -9,11 +9,11 @@
 import java.io.IOException;
 import java.security.NoSuchAlgorithmException;
 
-import javax.servlet.annotation.WebServlet;
-import javax.servlet.http.HttpServlet;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-import javax.servlet.http.HttpSession;
+import jakarta.servlet.annotation.WebServlet;
+import jakarta.servlet.http.HttpServlet;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import jakarta.servlet.http.HttpSession;
 
 /**
  * Servlet implementation class GetCode

diff --git a/insecureinc/src/main/java/insecure/inc/SetUnlockCode.java b/insecureinc/src/main/java/insecure/inc/SetUnlockCode.java
@@ -8,11 +8,11 @@
 
 import java.io.IOException;
 
-import javax.servlet.annotation.WebServlet;
-import javax.servlet.http.HttpServlet;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-import javax.servlet.http.HttpSession;
+import jakarta.servlet.annotation.WebServlet;
+import jakarta.servlet.http.HttpServlet;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import jakarta.servlet.http.HttpSession;
 
 /**
  * Servlet implementation class GetCode

diff --git a/insecureinc/src/main/java/insecure/inc/UnlockCodeFilter.java b/insecureinc/src/main/java/insecure/inc/UnlockCodeFilter.java
@@ -7,16 +7,16 @@
 package insecure.inc;
 
 import java.io.IOException;
-import javax.servlet.Filter;
-import javax.servlet.FilterChain;
-import javax.servlet.FilterConfig;
-import javax.servlet.ServletException;
-import javax.servlet.ServletRequest;
-import javax.servlet.ServletResponse;
-import javax.servlet.annotation.WebFilter;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-import javax.servlet.http.HttpSession;
+import jakarta.servlet.Filter;
+import jakarta.servlet.FilterChain;
+import jakarta.servlet.FilterConfig;
+import jakarta.servlet.ServletException;
+import jakarta.servlet.ServletRequest;
+import jakarta.servlet.ServletResponse;
+import jakarta.servlet.annotation.WebFilter;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import jakarta.servlet.http.HttpSession;
 
 /**
  * Servlet Filter implementation class UnlockCode

diff --git a/insecureinc/src/main/java/serial/SubmitObject.java b/insecureinc/src/main/java/serial/SubmitObject.java
@@ -13,12 +13,12 @@
 import java.io.ObjectInputStream;
 import java.io.ObjectOutputStream;
 
-import javax.servlet.ServletException;
-import javax.servlet.annotation.WebServlet;
-import javax.servlet.http.HttpServlet;
-import javax.servlet.http.HttpServletRequest;
-import javax.servlet.http.HttpServletResponse;
-import javax.servlet.http.HttpSession;
+import jakarta.servlet.ServletException;
+import jakarta.servlet.annotation.WebServlet;
+import jakarta.servlet.http.HttpServlet;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import jakarta.servlet.http.HttpSession;
 
 import org.apache.tomcat.util.codec.binary.Base64;