Merge pull request #10 from WorldHealthOrganization/who-spring-boot-3

Update DDCG-Lib to Spring Boot 3+
WorldHealthOrganization · Feb 3, 2023 · df60b04 · df60b04
2 parents 78c3d04 + cd5ba96
commit df60b04
Show file tree

Hide file tree

Showing 19 changed files with 51 additions and 104 deletions.
diff --git a/.github/workflows/ci-dependency-check.yml b/.github/workflows/ci-dependency-check.yml
@@ -15,7 +15,7 @@ jobs:
     steps:
       - uses: actions/setup-java@v2
         with:
-          java-version: 11
+          java-version: 17
           distribution: adopt
       - uses: actions/checkout@v2
         with:

diff --git a/.github/workflows/ci-main.yml b/.github/workflows/ci-main.yml
@@ -6,11 +6,11 @@ on:
       - main
 jobs:
   build:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-latest
     steps:
       - uses: actions/setup-java@v2
         with:
-          java-version: 11
+          java-version: 17
           distribution: adopt
       - uses: actions/checkout@v2
         with:
@@ -46,11 +46,11 @@ jobs:
           APP_PACKAGES_USERNAME: ${{ github.actor }}
           APP_PACKAGES_PASSWORD: ${{ secrets.GITHUB_TOKEN }}
   license:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-latest
     steps:
       - uses: actions/setup-java@v2
         with:
-          java-version: 11
+          java-version: 17
           distribution: adopt
       - uses: actions/checkout@v2
         with:

diff --git a/.github/workflows/ci-pullrequest.yml b/.github/workflows/ci-pullrequest.yml
@@ -7,11 +7,11 @@ on:
       - reopened
 jobs:
   build:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-latest
     steps:
       - uses: actions/setup-java@v2
         with:
-          java-version: 11
+          java-version: 17
           distribution: adopt
       - uses: actions/checkout@v2
         with:

diff --git a/.github/workflows/ci-release-notes.yml b/.github/workflows/ci-release-notes.yml
@@ -5,7 +5,7 @@ on:
     - created
 jobs:
   release-notes:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v2
       with:

diff --git a/.github/workflows/ci-release.yml b/.github/workflows/ci-release.yml
@@ -5,11 +5,11 @@ on:
     - created
 jobs:
   release:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-latest
     steps:
     - uses: actions/setup-java@v2
       with:
-        java-version: 11
+        java-version: 17
         distribution: adopt
     - uses: actions/checkout@v2
       with:

diff --git a/.github/workflows/ci-sonar.yml b/.github/workflows/ci-sonar.yml
@@ -10,11 +10,11 @@ on:
       - reopened
 jobs:
   sonar:
-    runs-on: ubuntu-20.04
+    runs-on: ubuntu-latest
     steps:
       - uses: actions/setup-java@v2
         with:
-          java-version: 11
+          java-version: 17
           distribution: adopt
       - uses: actions/checkout@v2
         with:

diff --git a/owasp/suppressions.xml b/owasp/suppressions.xml
@@ -1,29 +1,7 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">
   <suppress>
-    <notes>see https://github.com/jeremylong/DependencyCheck/issues/1827></notes>
-    <cve>CVE-2018-1258</cve>
-  </suppress>
-  <suppress>
-    <notes>see https://github.com/jeremylong/DependencyCheck/issues/2952</notes>
-    <cve>CVE-2011-2732</cve>
-    <cve>CVE-2011-2731</cve>
-    <cve>CVE-2012-5055</cve>
-  </suppress>
-  <suppress>
-    <notes>see https://tomcat.apache.org/security-9.html#Apache_Tomcat_9.x_vulnerabilities vulnerability is fixed in tomcat 9.0.38</notes>
-    <cve>CVE-2020-13943</cve>
-  </suppress>
-  <suppress>
-    <notes>H2 is not used by this project.</notes>
-    <cve>CVE-2021-23463</cve>
-  </suppress>
-  <suppress>
-    <notes>False Positive, Should match only up to 5.3.2 (excluding) but we have 5.6.3 </notes>
-    <cve>CVE-2020-5408</cve>
-  </suppress>
-  <suppress>
-    <notes>False Positive, Should match only up to 1.32 (excluding) but we have 1.33</notes>
-    <cve>CVE-2022-38752</cve>
+    <notes>no YAML content from users is parsed within this service</notes>
+    <cve>CVE-2022-1471</cve>
   </suppress>
 </suppressions>
diff --git a/pom.xml b/pom.xml
@@ -4,9 +4,16 @@
          xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
     <modelVersion>4.0.0</modelVersion>
 
+    <parent>
+        <groupId>org.springframework.cloud</groupId>
+        <artifactId>spring-cloud-starter-parent</artifactId>
+        <version>2022.0.1</version>
+        <relativePath/>
+    </parent>
+
     <groupId>eu.europa.ec.dgc</groupId>
     <artifactId>ddcc-gateway-lib</artifactId>
-    <version>latest</version>
+    <version>2.0.0</version>
     <packaging>jar</packaging>
 
     <name>ddcc-gateway-lib</name>
@@ -17,26 +24,22 @@
     </organization>
 
     <properties>
-        <maven.compiler.source>11</maven.compiler.source>
-        <maven.compiler.target>11</maven.compiler.target>
+        <maven.compiler.source>17</maven.compiler.source>
+        <maven.compiler.target>17</maven.compiler.target>
         <!-- charset -->
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
         <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
         <!-- dependencies -->
-        <owasp.version>7.3.0</owasp.version>
-        <spring.boot.version>2.7.5</spring.boot.version>
-        <spring.cloud.version>3.1.4</spring.cloud.version>
-        <feign.version>11.10</feign.version>
-        <bcpkix.version>1.70</bcpkix.version>
+        <owasp.version>8.0.2</owasp.version>
+        <bcpkix.version>1.72</bcpkix.version>
         <lombok.version>1.18.24</lombok.version>
         <mapstruct.version>1.5.3.Final</mapstruct.version>
         <commonsio.version>2.11.0</commonsio.version>
         <cbor.version>4.5.2</cbor.version>
-        <jackson.version>2.13.4</jackson.version>
-        <jackson.databind.version>2.13.4.2</jackson.databind.version>
         <mockwebserver.version>4.10.0</mockwebserver.version>
-        <plugin.checkstyle.version>3.2.0</plugin.checkstyle.version>
-        <plugin.surefire.version>3.0.0-M7</plugin.surefire.version>
+        <plugin.checkstyle.version>3.2.1</plugin.checkstyle.version>
+        <plugin.sonar.version>3.9.1.2184</plugin.sonar.version>
+        <plugin.surefire.version>3.0.0-M8</plugin.surefire.version>
         <plugin.jacoco.version>0.8.8</plugin.jacoco.version>
 
         <!-- license -->
@@ -73,47 +76,21 @@
     <dependencies>
         <dependency>
             <groupId>org.springframework.boot</groupId>
-            <artifactId>spring-boot-starter-web</artifactId>
-            <version>${spring.boot.version}</version>
+            <artifactId>spring-boot-starter</artifactId>
             <optional>true</optional>
-            <exclusions>
-                <exclusion>
-                    <groupId>org.yaml</groupId>
-                    <artifactId>snakeyaml</artifactId>
-                </exclusion>
-                <exclusion>
-                    <groupId>com.fasterxml.jackson.core</groupId>
-                    <artifactId>jackson-databind</artifactId>
-                </exclusion>
-            </exclusions>
-        </dependency>
-        <!-- Explicit inclusion of SnakeYaml because of CVE -->
-        <dependency>
-            <groupId>org.yaml</groupId>
-            <artifactId>snakeyaml</artifactId>
-            <version>1.33</version>
         </dependency>
         <dependency>
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-configuration-processor</artifactId>
-            <version>${spring.boot.version}</version>
             <optional>true</optional>
         </dependency>
         <dependency>
             <groupId>org.springframework.cloud</groupId>
             <artifactId>spring-cloud-starter-openfeign</artifactId>
-            <version>${spring.cloud.version}</version>
-            <exclusions>
-                <exclusion>
-                    <groupId>org.springframework</groupId>
-                    <artifactId>spring-web</artifactId>
-                </exclusion>
-            </exclusions>
         </dependency>
         <dependency>
             <groupId>io.github.openfeign</groupId>
             <artifactId>feign-httpclient</artifactId>
-            <version>${feign.version}</version>
         </dependency>
         <dependency>
             <groupId>org.mapstruct</groupId>
@@ -124,11 +101,10 @@
             <groupId>org.projectlombok</groupId>
             <artifactId>lombok</artifactId>
             <scope>provided</scope>
-            <version>${lombok.version}</version>
         </dependency>
         <dependency>
             <groupId>org.bouncycastle</groupId>
-            <artifactId>bcpkix-jdk15on</artifactId>
+            <artifactId>bcpkix-jdk18on</artifactId>
             <version>${bcpkix.version}</version>
         </dependency>
         <dependency>
@@ -144,25 +120,15 @@
         <dependency>
             <groupId>com.fasterxml.jackson.core</groupId>
             <artifactId>jackson-databind</artifactId>
-            <version>${jackson.databind.version}</version>
         </dependency>
         <dependency>
             <groupId>com.fasterxml.jackson.datatype</groupId>
             <artifactId>jackson-datatype-jsr310</artifactId>
-            <version>${jackson.version}</version>
-            <exclusions>
-                <exclusion>
-                    <groupId>com.fasterxml.jackson.core</groupId>
-                    <artifactId>jackson-databind</artifactId>
-                </exclusion>
-            </exclusions>
         </dependency>
-
         <dependency>
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-starter-test</artifactId>
             <scope>test</scope>
-            <version>${spring.boot.version}</version>
         </dependency>
         <dependency>
             <groupId>com.squareup.okhttp3</groupId>
@@ -245,6 +211,7 @@
                 <configuration>
                     <configLocation>codestyle/checkstyle.xml</configLocation>
                     <excludes>target/**/*</excludes>
+                    <excludes>**/springbootworkaroundforks/*</excludes>
                     <consoleOutput>true</consoleOutput>
                     <failsOnError>true</failsOnError>
                     <violationSeverity>warning</violationSeverity>
@@ -296,7 +263,7 @@
                         <path>
                             <groupId>org.springframework.boot</groupId>
                             <artifactId>spring-boot-configuration-processor</artifactId>
-                            <version>${spring.boot.version}</version>
+                            <version>${project.parent.parent.version}</version>
                         </path>
                     </annotationProcessorPaths>
                 </configuration>

diff --git a/src/main/java/eu/europa/ec/dgc/DgcLibAutoConfiguration.java b/src/main/java/eu/europa/ec/dgc/DgcLibAutoConfiguration.java
@@ -20,11 +20,11 @@
 
 package eu.europa.ec.dgc;
 
+import org.springframework.boot.autoconfigure.AutoConfiguration;
 import org.springframework.boot.context.properties.EnableConfigurationProperties;
 import org.springframework.context.annotation.ComponentScan;
-import org.springframework.context.annotation.Configuration;
 
-@Configuration
+@AutoConfiguration
 @ComponentScan("eu.europa.ec.dgc")
 @EnableConfigurationProperties
 public class DgcLibAutoConfiguration {

diff --git a/src/main/java/eu/europa/ec/dgc/gateway/connector/DgcGatewayConnectorUtils.java b/src/main/java/eu/europa/ec/dgc/gateway/connector/DgcGatewayConnectorUtils.java
@@ -40,6 +40,7 @@
 import eu.europa.ec.dgc.signing.SignedStringMessageParser;
 import eu.europa.ec.dgc.utils.CertificateUtils;
 import feign.FeignException;
+import jakarta.annotation.PostConstruct;
 import java.io.IOException;
 import java.io.Serializable;
 import java.nio.charset.StandardCharsets;
@@ -55,7 +56,6 @@
 import java.util.List;
 import java.util.Map;
 import java.util.stream.Collectors;
-import javax.annotation.PostConstruct;
 import lombok.Getter;
 import lombok.RequiredArgsConstructor;
 import lombok.Setter;
@@ -70,6 +70,7 @@
 import org.springframework.beans.factory.annotation.Qualifier;
 import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty;
 import org.springframework.http.HttpStatus;
+import org.springframework.http.HttpStatusCode;
 import org.springframework.http.ResponseEntity;
 import org.springframework.stereotype.Service;
 
@@ -227,7 +228,7 @@ public List<TrustListItem> fetchCertificatesAndVerifyByTrustAnchor(
         HashMap<QueryParameter<? extends Serializable>, List<? extends Serializable>> queryParameterMap)
         throws DgcGatewayConnectorException {
         List<TrustListItemDto> downloadedCertificates;
-        HttpStatus responseStatus;
+        HttpStatusCode responseStatus;
         try {
             if (properties.isEnableDdccSupport()) {
                 // clone and modify parameter map to only get certs of requested type
@@ -300,7 +301,7 @@ public List<TrustedIssuer> fetchTrustedIssuersAndVerifyByTrustAnchor(
 
         if (responseEntity.getStatusCode() != HttpStatus.OK || downloadedTrustedIssuers == null) {
             throw new DgcGatewayConnectorUtils.DgcGatewayConnectorException(
-                responseEntity.getStatusCodeValue(), "Download of TrustedIssuers failed.");
+                responseEntity.getStatusCode().value(), "Download of TrustedIssuers failed.");
         } else {
             log.info("Got Response from DGCG, Downloaded TrustedIssuers: {}",
                 downloadedTrustedIssuers.size());
@@ -332,7 +333,7 @@ public List<TrustedReference> fetchTrustedReferencesAndVerifyByUploadCertificate
 
         if (responseEntity.getStatusCode() != HttpStatus.OK || downloadedTrustedReferences == null) {
             throw new DgcGatewayConnectorUtils.DgcGatewayConnectorException(
-                responseEntity.getStatusCodeValue(), "Download of TrustedReferences failed.");
+                responseEntity.getStatusCode().value(), "Download of TrustedReferences failed.");
         } else {
             log.info("Got Response from DGCG, Downloaded TrustedReferences: {}",
                 downloadedTrustedReferences.size());

diff --git a/src/main/java/eu/europa/ec/dgc/gateway/connector/DgcGatewayCountryListDownloadConnector.java b/src/main/java/eu/europa/ec/dgc/gateway/connector/DgcGatewayCountryListDownloadConnector.java
@@ -23,13 +23,13 @@
 import eu.europa.ec.dgc.gateway.connector.client.DgcGatewayConnectorRestClient;
 import eu.europa.ec.dgc.gateway.connector.config.DgcGatewayConnectorConfigProperties;
 import feign.FeignException;
+import jakarta.annotation.PostConstruct;
 import java.security.Security;
 import java.time.LocalDateTime;
 import java.time.temporal.ChronoUnit;
 import java.util.ArrayList;
 import java.util.Collections;
 import java.util.List;
-import javax.annotation.PostConstruct;
 import lombok.Getter;
 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;

diff --git a/src/main/java/eu/europa/ec/dgc/gateway/connector/DgcGatewayDownloadConnector.java b/src/main/java/eu/europa/ec/dgc/gateway/connector/DgcGatewayDownloadConnector.java
@@ -34,6 +34,7 @@
 import eu.europa.ec.dgc.gateway.connector.model.TrustedReference;
 import eu.europa.ec.dgc.signing.SignedCertificateMessageParser;
 import feign.FeignException;
+import jakarta.annotation.PostConstruct;
 import java.io.Serializable;
 import java.security.Security;
 import java.time.LocalDateTime;
@@ -44,7 +45,6 @@
 import java.util.List;
 import java.util.Map;
 import java.util.stream.Collectors;
-import javax.annotation.PostConstruct;
 import lombok.Getter;
 import lombok.RequiredArgsConstructor;
 import lombok.extern.slf4j.Slf4j;
@@ -55,6 +55,7 @@
 import org.springframework.context.annotation.Lazy;
 import org.springframework.context.annotation.Scope;
 import org.springframework.http.HttpStatus;
+import org.springframework.http.HttpStatusCode;
 import org.springframework.http.ResponseEntity;
 import org.springframework.scheduling.annotation.EnableScheduling;
 import org.springframework.stereotype.Service;
@@ -282,7 +283,7 @@ private void fetchTrustListAndVerifyByCscaAndUpload() throws DgcGatewayConnector
         log.info("Fetching TrustList from DGCG");
 
         List<TrustListItemDto> downloadedCertificates;
-        HttpStatus responseStatus;
+        HttpStatusCode responseStatus;
         try {
             if (properties.isEnableDdccSupport()) {
                 // clone and modify parameter map to only get certs of requested type
@@ -345,7 +346,7 @@ private void fetchTrustedCertificatesAndVerifyByTrustAnchorOrCscaAndUpload() thr
 
         if (responseEntity.getStatusCode() != HttpStatus.OK || responseEntity.getBody() == null) {
             throw new DgcGatewayConnectorUtils.DgcGatewayConnectorException(
-                responseEntity.getStatusCodeValue(), "Download of TrustedCertificates failed.");
+                responseEntity.getStatusCode().value(), "Download of TrustedCertificates failed.");
         } else {
             log.info("Got Response from DGCG, Downloaded Trusted Certificates: {}", responseEntity.getBody().size());
         }