Skip to content

Commit

Permalink
Merge branch 'vulnerability-fix-5' into backport-5
Browse files Browse the repository at this point in the history
  • Loading branch information
@sattvikc
sattvikc committed Apr 2, 2024
2 parents b64b320 + 603032e commit f0317d3
Show file tree
Hide file tree
Showing 12 changed files with 148 additions and 69 deletions.
3 changes: 2 additions & 1 deletion CHANGELOG.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,8 @@ to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).

## [5.0.3] - 2024-04-02

- Fixes telemetry data length to 31
- Fixes vulnerabilities in dependencies
- Updates telemetry payload

## [5.0.2] - 2023-09-07

Expand Down
10 changes: 5 additions & 5 deletions build.gradle
View file
Original file line number Diff line number Diff line change
Expand Up @@ -33,22 +33,22 @@ dependencies {
implementation group: 'com.google.code.gson', name: 'gson', version: '2.3.1'

// https://mvnrepository.com/artifact/com.fasterxml.jackson.dataformat/jackson-dataformat-yaml
implementation group: 'com.fasterxml.jackson.dataformat', name: 'jackson-dataformat-yaml', version: '2.14.0'
implementation group: 'com.fasterxml.jackson.dataformat', name: 'jackson-dataformat-yaml', version: '2.16.1'

// https://mvnrepository.com/artifact/com.fasterxml.jackson.core/jackson-core
implementation group: 'com.fasterxml.jackson.core', name: 'jackson-databind', version: '2.14.0'
implementation group: 'com.fasterxml.jackson.core', name: 'jackson-databind', version: '2.16.1'

// https://mvnrepository.com/artifact/ch.qos.logback/logback-classic
implementation group: 'ch.qos.logback', name: 'logback-classic', version: '1.2.3'
implementation group: 'ch.qos.logback', name: 'logback-classic', version: '1.4.14'

// https://mvnrepository.com/artifact/org.apache.tomcat.embed/tomcat-embed-core
implementation group: 'org.apache.tomcat.embed', name: 'tomcat-embed-core', version: '10.1.1'
implementation group: 'org.apache.tomcat.embed', name: 'tomcat-embed-core', version: '10.1.18'

// https://mvnrepository.com/artifact/com.google.code.findbugs/jsr305
implementation group: 'com.google.code.findbugs', name: 'jsr305', version: '3.0.2'

// https://mvnrepository.com/artifact/org.xerial/sqlite-jdbc
implementation group: 'org.xerial', name: 'sqlite-jdbc', version: '3.30.1'
implementation group: 'org.xerial', name: 'sqlite-jdbc', version: '3.45.1.0'

// https://mvnrepository.com/artifact/org.mindrot/jbcrypt
implementation group: 'org.mindrot', name: 'jbcrypt', version: '0.4'
Expand Down
4 changes: 2 additions & 2 deletions cli/build.gradle
View file
Original file line number Diff line number Diff line change
Expand Up @@ -19,10 +19,10 @@ dependencies {
implementation group: 'com.google.code.gson', name: 'gson', version: '2.3.1'

// https://mvnrepository.com/artifact/com.fasterxml.jackson.dataformat/jackson-dataformat-yaml
implementation group: 'com.fasterxml.jackson.dataformat', name: 'jackson-dataformat-yaml', version: '2.10.0'
implementation group: 'com.fasterxml.jackson.dataformat', name: 'jackson-dataformat-yaml', version: '2.16.1'

// https://mvnrepository.com/artifact/com.fasterxml.jackson.core/jackson-core
implementation group: 'com.fasterxml.jackson.core', name: 'jackson-databind', version: '2.10.0'
implementation group: 'com.fasterxml.jackson.core', name: 'jackson-databind', version: '2.16.1'

// https://mvnrepository.com/artifact/de.mkammerer/argon2-jvm
implementation group: 'de.mkammerer', name: 'argon2-jvm', version: '2.11'
Expand Down
30 changes: 15 additions & 15 deletions cli/implementationDependencies.json
View file
Original file line number Diff line number Diff line change
Expand Up @@ -7,29 +7,29 @@
"src": "https://repo1.maven.org/maven2/com/google/code/gson/gson/2.3.1/gson-2.3.1-sources.jar"
},
{
"jar": "https://repo1.maven.org/maven2/com/fasterxml/jackson/dataformat/jackson-dataformat-yaml/2.10.0/jackson-dataformat-yaml-2.10.0.jar",
"name": "Jackson Dataformat 2.10.0",
"src": "https://repo1.maven.org/maven2/com/fasterxml/jackson/dataformat/jackson-dataformat-yaml/2.10.0/jackson-dataformat-yaml-2.10.0-sources.jar"
"jar": "https://repo1.maven.org/maven2/com/fasterxml/jackson/dataformat/jackson-dataformat-yaml/2.16.1/jackson-dataformat-yaml-2.16.1.jar",
"name": "Jackson Dataformat 2.16.1",
"src": "https://repo1.maven.org/maven2/com/fasterxml/jackson/dataformat/jackson-dataformat-yaml/2.16.1/jackson-dataformat-yaml-2.16.1-sources.jar"
},
{
"jar": "https://repo1.maven.org/maven2/org/yaml/snakeyaml/1.24/snakeyaml-1.24.jar",
"name": "SnakeYAML 1.24",
"src": "https://repo1.maven.org/maven2/org/yaml/snakeyaml/1.24/snakeyaml-1.24-sources.jar"
"jar": "https://repo1.maven.org/maven2/org/yaml/snakeyaml/2.2/snakeyaml-2.2.jar",
"name": "SnakeYAML 2.2",
"src": "https://repo1.maven.org/maven2/org/yaml/snakeyaml/2.2/snakeyaml-2.2-sources.jar"
},
{
"jar": "https://repo1.maven.org/maven2/com/fasterxml/jackson/core/jackson-core/2.10.0/jackson-core-2.10.0.jar",
"name": "Jackson core 2.10.0",
"src": "https://repo1.maven.org/maven2/com/fasterxml/jackson/core/jackson-core/2.10.0/jackson-core-2.10.0-sources.jar"
"jar": "https://repo1.maven.org/maven2/com/fasterxml/jackson/core/jackson-core/2.16.1/jackson-core-2.16.1.jar",
"name": "Jackson core 2.16.1",
"src": "https://repo1.maven.org/maven2/com/fasterxml/jackson/core/jackson-core/2.16.1/jackson-core-2.16.1-sources.jar"
},
{
"jar": "https://repo1.maven.org/maven2/com/fasterxml/jackson/core/jackson-databind/2.10.0/jackson-databind-2.10.0.jar",
"name": "Jackson databind 2.10.0",
"src": "https://repo1.maven.org/maven2/com/fasterxml/jackson/core/jackson-databind/2.10.0/jackson-databind-2.10.0-sources.jar"
"jar": "https://repo1.maven.org/maven2/com/fasterxml/jackson/core/jackson-databind/2.16.1/jackson-databind-2.16.1.jar",
"name": "Jackson databind 2.16.1",
"src": "https://repo1.maven.org/maven2/com/fasterxml/jackson/core/jackson-databind/2.16.1/jackson-databind-2.16.1-sources.jar"
},
{
"jar": "https://repo1.maven.org/maven2/com/fasterxml/jackson/core/jackson-annotations/2.10.0/jackson-annotations-2.10.0.jar",
"name": "Jackson annotation 2.10.0",
"src": "https://repo1.maven.org/maven2/com/fasterxml/jackson/core/jackson-annotations/2.10.0/jackson-annotations-2.10.0-sources.jar"
"jar": "https://repo1.maven.org/maven2/com/fasterxml/jackson/core/jackson-annotations/2.16.1/jackson-annotations-2.16.1.jar",
"name": "Jackson annotation 2.16.1",
"src": "https://repo1.maven.org/maven2/com/fasterxml/jackson/core/jackson-annotations/2.16.1/jackson-annotations-2.16.1-sources.jar"
},
{
"jar": "https://repo1.maven.org/maven2/de/mkammerer/argon2-jvm/2.11/argon2-jvm-2.11.jar",
Expand Down
8 changes: 4 additions & 4 deletions ee/build.gradle
View file
Original file line number Diff line number Diff line change
Expand Up @@ -35,21 +35,21 @@ dependencies {
testImplementation group: 'org.mockito', name: 'mockito-core', version: '3.1.0'

// https://mvnrepository.com/artifact/org.apache.tomcat.embed/tomcat-embed-core
testImplementation group: 'org.apache.tomcat.embed', name: 'tomcat-embed-core', version: '10.1.1'
testImplementation group: 'org.apache.tomcat.embed', name: 'tomcat-embed-core', version: '10.1.18'

// https://mvnrepository.com/artifact/ch.qos.logback/logback-classic
testImplementation group: 'ch.qos.logback', name: 'logback-classic', version: '1.2.3'
testImplementation group: 'ch.qos.logback', name: 'logback-classic', version: '1.4.14'

// https://mvnrepository.com/artifact/com.google.code.gson/gson
testImplementation group: 'com.google.code.gson', name: 'gson', version: '2.3.1'

testImplementation 'com.tngtech.archunit:archunit-junit4:0.22.0'

// https://mvnrepository.com/artifact/com.fasterxml.jackson.dataformat/jackson-dataformat-yaml
testImplementation group: 'com.fasterxml.jackson.dataformat', name: 'jackson-dataformat-yaml', version: '2.14.0'
testImplementation group: 'com.fasterxml.jackson.dataformat', name: 'jackson-dataformat-yaml', version: '2.16.1'

// https://mvnrepository.com/artifact/com.fasterxml.jackson.core/jackson-core
testImplementation group: 'com.fasterxml.jackson.core', name: 'jackson-databind', version: '2.14.0'
testImplementation group: 'com.fasterxml.jackson.core', name: 'jackson-databind', version: '2.16.1'

testImplementation group: 'org.jetbrains', name: 'annotations', version: '13.0'
}
Expand Down
2 changes: 1 addition & 1 deletion ee/src/test/java/io/supertokens/ee/test/EETest.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -1215,7 +1215,7 @@ protected URLConnection openConnection(URL u) {
JsonObject paidFeatureUsageStats = j.getAsJsonObject("paidFeatureUsageStats");
JsonArray mauArr = paidFeatureUsageStats.get("maus").getAsJsonArray();
assertEquals(paidFeatureUsageStats.entrySet().size(), 1);
assertEquals(mauArr.size(), 30);
assertEquals(mauArr.size(), 31);
assertEquals(mauArr.get(0).getAsInt(), 0);
assertEquals(mauArr.get(29).getAsInt(), 0);
}
Expand Down
4 changes: 2 additions & 2 deletions ee/src/test/java/io/supertokens/ee/test/api/GetFeatureFlagAPITest.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -54,7 +54,7 @@ public void testRetrievingFeatureFlagInfoWhenNoLicenseKeyIsSet() throws Exceptio
if (StorageLayer.getStorage(process.getProcess()).getType() == STORAGE_TYPE.SQL) {
JsonArray mauArr = usageStats.get("maus").getAsJsonArray();
assertEquals(1, usageStats.entrySet().size());
assertEquals(30, mauArr.size());
assertEquals(31, mauArr.size());
assertEquals(0, mauArr.get(0).getAsInt());
assertEquals(0, mauArr.get(29).getAsInt());
} else {
Expand Down Expand Up @@ -87,7 +87,7 @@ public void testRetrievingFeatureFlagInfoWhenLicenseKeyIsSet() throws Exception
if (StorageLayer.getStorage(process.getProcess()).getType() == STORAGE_TYPE.SQL) {
JsonArray mauArr = usageStats.get("maus").getAsJsonArray();
assertEquals(1, usageStats.entrySet().size());
assertEquals(30, mauArr.size());
assertEquals(31, mauArr.size());
assertEquals(0, mauArr.get(0).getAsInt());
assertEquals(0, mauArr.get(29).getAsInt());
} else {
Expand Down
68 changes: 34 additions & 34 deletions implementationDependencies.json
View file
Original file line number Diff line number Diff line change
Expand Up @@ -7,54 +7,54 @@
"src": "https://repo1.maven.org/maven2/com/google/code/gson/gson/2.3.1/gson-2.3.1-sources.jar"
},
{
"jar": "https://repo1.maven.org/maven2/com/fasterxml/jackson/dataformat/jackson-dataformat-yaml/2.14.2/jackson-dataformat-yaml-2.14.2.jar",
"name": "Jackson Dataformat 2.14.2",
"src": "https://repo1.maven.org/maven2/com/fasterxml/jackson/dataformat/jackson-dataformat-yaml/2.14.2/jackson-dataformat-yaml-2.14.2-sources.jar"
"jar": "https://repo1.maven.org/maven2/com/fasterxml/jackson/dataformat/jackson-dataformat-yaml/2.16.1/jackson-dataformat-yaml-2.16.1.jar",
"name": "Jackson Dataformat 2.16.1",
"src": "https://repo1.maven.org/maven2/com/fasterxml/jackson/dataformat/jackson-dataformat-yaml/2.16.1/jackson-dataformat-yaml-2.16.1-sources.jar"
},
{
"jar": "https://repo1.maven.org/maven2/org/yaml/snakeyaml/1.33/snakeyaml-1.33.jar",
"name": "SnakeYAML 1.33",
"src": "https://repo1.maven.org/maven2/org/yaml/snakeyaml/1.33/snakeyaml-1.33-sources.jar"
"jar": "https://repo1.maven.org/maven2/org/yaml/snakeyaml/2.2/snakeyaml-2.2.jar",
"name": "SnakeYAML 2.2",
"src": "https://repo1.maven.org/maven2/org/yaml/snakeyaml/2.2/snakeyaml-2.2-sources.jar"
},
{
"jar": "https://repo1.maven.org/maven2/com/fasterxml/jackson/core/jackson-core/2.14.2/jackson-core-2.14.2.jar",
"name": "Jackson core 2.14.2",
"src": "https://repo1.maven.org/maven2/com/fasterxml/jackson/core/jackson-core/2.14.2/jackson-core-2.14.2-sources.jar"
"jar": "https://repo1.maven.org/maven2/com/fasterxml/jackson/core/jackson-core/2.16.1/jackson-core-2.16.1.jar",
"name": "Jackson core 2.16.1",
"src": "https://repo1.maven.org/maven2/com/fasterxml/jackson/core/jackson-core/2.16.1/jackson-core-2.16.1-sources.jar"
},
{
"jar": "https://repo1.maven.org/maven2/com/fasterxml/jackson/core/jackson-databind/2.14.2/jackson-databind-2.14.2.jar",
"name": "Jackson databind 2.14.2",
"src": "https://repo1.maven.org/maven2/com/fasterxml/jackson/core/jackson-databind/2.14.2/jackson-databind-2.14.2-sources.jar"
"jar": "https://repo1.maven.org/maven2/com/fasterxml/jackson/core/jackson-databind/2.16.1/jackson-databind-2.16.1.jar",
"name": "Jackson databind 2.16.1",
"src": "https://repo1.maven.org/maven2/com/fasterxml/jackson/core/jackson-databind/2.16.1/jackson-databind-2.16.1-sources.jar"
},
{
"jar": "https://repo1.maven.org/maven2/com/fasterxml/jackson/core/jackson-annotations/2.14.2/jackson-annotations-2.14.2.jar",
"name": "Jackson annotation 2.14.2",
"src": "https://repo1.maven.org/maven2/com/fasterxml/jackson/core/jackson-annotations/2.14.2/jackson-annotations-2.14.2-sources.jar"
"jar": "https://repo1.maven.org/maven2/com/fasterxml/jackson/core/jackson-annotations/2.16.1/jackson-annotations-2.16.1.jar",
"name": "Jackson annotation 2.16.1",
"src": "https://repo1.maven.org/maven2/com/fasterxml/jackson/core/jackson-annotations/2.16.1/jackson-annotations-2.16.1-sources.jar"
},
{
"jar": "https://repo1.maven.org/maven2/ch/qos/logback/logback-classic/1.2.3/logback-classic-1.2.3.jar",
"name": "Logback classic 1.2.3",
"src": "https://repo1.maven.org/maven2/ch/qos/logback/logback-classic/1.2.3/logback-classic-1.2.3-sources.jar"
"jar": "https://repo1.maven.org/maven2/ch/qos/logback/logback-classic/1.4.14/logback-classic-1.4.14.jar",
"name": "Logback classic 1.4.14",
"src": "https://repo1.maven.org/maven2/ch/qos/logback/logback-classic/1.4.14/logback-classic-1.4.14-sources.jar"
},
{
"jar": "https://repo1.maven.org/maven2/ch/qos/logback/logback-core/1.2.3/logback-core-1.2.3.jar",
"name": "Logback core 1.2.3",
"src": "https://repo1.maven.org/maven2/ch/qos/logback/logback-core/1.2.3/logback-core-1.2.3-sources.jar"
"jar": "https://repo1.maven.org/maven2/ch/qos/logback/logback-core/1.4.14/logback-core-1.4.14.jar",
"name": "Logback core 1.4.14",
"src": "https://repo1.maven.org/maven2/ch/qos/logback/logback-core/1.4.14/logback-core-1.4.14-sources.jar"
},
{
"jar": "https://repo1.maven.org/maven2/org/slf4j/slf4j-api/1.7.25/slf4j-api-1.7.25.jar",
"name": "SLF4j API 1.7.25",
"src": "https://repo1.maven.org/maven2/org/slf4j/slf4j-api/1.7.25/slf4j-api-1.7.25-sources.jar"
"jar": "https://repo1.maven.org/maven2/org/slf4j/slf4j-api/2.0.7/slf4j-api-2.0.7.jar",
"name": "SLF4j API 2.0.7",
"src": "https://repo1.maven.org/maven2/org/slf4j/slf4j-api/2.0.7/slf4j-api-2.0.7-sources.jar"
},
{
"jar": "https://repo1.maven.org/maven2/org/apache/tomcat/tomcat-annotations-api/10.1.1/tomcat-annotations-api-10.1.1.jar",
"name": "Tomcat annotations API 10.1.1",
"src": "https://repo1.maven.org/maven2/org/apache/tomcat/tomcat-annotations-api/10.1.1/tomcat-annotations-api-10.1.1-sources.jar"
"jar": "https://repo1.maven.org/maven2/org/apache/tomcat/tomcat-annotations-api/10.1.18/tomcat-annotations-api-10.1.18.jar",
"name": "Tomcat annotations API 10.1.18",
"src": "https://repo1.maven.org/maven2/org/apache/tomcat/tomcat-annotations-api/10.1.18/tomcat-annotations-api-10.1.18-sources.jar"
},
{
"jar": "https://repo1.maven.org/maven2/org/apache/tomcat/embed/tomcat-embed-core/10.1.1/tomcat-embed-core-10.1.1.jar",
"name": "Tomcat embed core API 10.1.1",
"src": "https://repo1.maven.org/maven2/org/apache/tomcat/embed/tomcat-embed-core/10.1.1/tomcat-embed-core-10.1.1-sources.jar"
"jar": "https://repo1.maven.org/maven2/org/apache/tomcat/embed/tomcat-embed-core/10.1.18/tomcat-embed-core-10.1.18.jar",
"name": "Tomcat embed core API 10.1.18",
"src": "https://repo1.maven.org/maven2/org/apache/tomcat/embed/tomcat-embed-core/10.1.18/tomcat-embed-core-10.1.18-sources.jar"
},
{
"jar": "https://repo1.maven.org/maven2/com/google/code/findbugs/jsr305/3.0.2/jsr305-3.0.2.jar",
Expand All @@ -67,13 +67,13 @@
"src": "https://repo1.maven.org/maven2/org/jetbrains/annotations/13.0/annotations-13.0-sources.jar"
},
{
"jar": "https://repo1.maven.org/maven2/org/xerial/sqlite-jdbc/3.30.1/sqlite-jdbc-3.30.1.jar",
"name": "SQLite JDBC Driver 3.30.1",
"src": "https://repo1.maven.org/maven2/org/xerial/sqlite-jdbc/3.30.1/sqlite-jdbc-3.30.1-sources.jar"
"jar": "https://repo1.maven.org/maven2/org/xerial/sqlite-jdbc/3.45.1.0/sqlite-jdbc-3.45.1.0.jar",
"name": "SQLite JDBC Driver 3.45.1.0",
"src": "https://repo1.maven.org/maven2/org/xerial/sqlite-jdbc/3.45.1.0/sqlite-jdbc-3.45.1.0-sources.jar"
},
{
"jar": "https://repo1.maven.org/maven2/org/mindrot/jbcrypt/0.4/jbcrypt-0.4.jar",
"name": "SQLite JDBC Driver 3.30.1",
"name": "JBCrypt 0.4",
"src": "https://repo1.maven.org/maven2/org/mindrot/jbcrypt/0.4/jbcrypt-0.4-sources.jar"
},
{
Expand Down
49 changes: 49 additions & 0 deletions src/main/java/io/supertokens/cronjobs/telemetry/Telemetry.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -16,17 +16,24 @@

package io.supertokens.cronjobs.telemetry;

import com.google.gson.JsonArray;
import com.google.gson.JsonObject;
import com.google.gson.JsonPrimitive;
import io.supertokens.Main;
import io.supertokens.ProcessState;
import io.supertokens.ResourceDistributor;
import io.supertokens.authRecipe.AuthRecipe;
import io.supertokens.config.Config;
import io.supertokens.cronjobs.CronTask;
import io.supertokens.cronjobs.CronTaskTest;
import io.supertokens.dashboard.Dashboard;
import io.supertokens.httpRequest.HttpRequest;
import io.supertokens.httpRequest.HttpRequestMocking;
import io.supertokens.pluginInterface.ActiveUsersStorage;
import io.supertokens.pluginInterface.KeyValueInfo;
import io.supertokens.pluginInterface.STORAGE_TYPE;
import io.supertokens.pluginInterface.Storage;
import io.supertokens.pluginInterface.dashboard.DashboardUser;
import io.supertokens.pluginInterface.exceptions.StorageQueryException;
import io.supertokens.storageLayer.StorageLayer;
import io.supertokens.utils.Utils;
Expand Down Expand Up @@ -75,6 +82,48 @@ protected void doTask() throws Exception {
json.addProperty("telemetryId", telemetryId.value);
json.addProperty("superTokensVersion", coreVersion);

json.addProperty("appId", "public");
json.addProperty("connectionUriDomain", "");

if (storage.getType() == STORAGE_TYPE.SQL) {
{ // Users count across all tenants
json.addProperty("usersCount",
AuthRecipe.getUsersCount(main, null));
}

{ // Dashboard user emails
// Dashboard APIs are app specific and are always stored on the public tenant
DashboardUser[] dashboardUsers = Dashboard.getAllDashboardUsers(main);
JsonArray dashboardUserEmails = new JsonArray();
for (DashboardUser user : dashboardUsers) {
dashboardUserEmails.add(new JsonPrimitive(user.email));
}

json.add("dashboardUserEmails", dashboardUserEmails);
}

{ // MAUs
// Active users are always tracked on the public tenant, so we use the public tenant's storage
ActiveUsersStorage activeUsersStorage = (ActiveUsersStorage) storage;

JsonArray mauArr = new JsonArray();

long now = System.currentTimeMillis();

for (int i = 1; i <= 31; i++) {
long timestamp = now - (i * 24 * 60 * 60 * 1000L);
int mau = activeUsersStorage.countUsersActiveSince(timestamp);
mauArr.add(new JsonPrimitive(mau));
}

json.add("maus", mauArr);
}
} else {
json.addProperty("usersCount", -1);
json.add("dashboardUserEmails", new JsonArray());
json.add("maus", new JsonArray());
}

String url = "https://api.supertokens.io/0/st/telemetry";

// we call the API only if we are not testing the core, of if the request can be mocked (in case a test wants
Expand Down
2 changes: 1 addition & 1 deletion src/test/java/io/supertokens/test/StorageLayerTest.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -88,7 +88,7 @@ public void totpCodeLengthTest() throws Exception {
// This error will be different in Postgres and MySQL
// We added (CHECK (LENGTH(code) <= 8)) to the table definition in SQLite
String totpUsedCodeTable = Config.getConfig(start).getTotpUsedCodesTable();
assert e.getMessage().contains("CHECK constraint failed: " + totpUsedCodeTable);
assert e.getMessage().contains("CHECK constraint failed: ");
}

// Try code with length < 8
Expand Down
Loading

0 comments on commit f0317d3

Please sign in to comment.