Update dependency org.owasp:dependency-check-maven to v12.1.9

Reviewed-on: #12

.drone.yml

@@ -1,27 +1,41 @@
 kind: pipeline
-name: default
+name: verify
 platform:
   os: linux
   arch: arm64
 
+trigger:
+  event:
+    - push
+    - pull_request
+
 steps:
   # test if it compiles correctly
   - name: build
-    image: maven:3-eclipse-temurin-17
+    image: maven:3-eclipse-temurin-21
     commands:
       - mvn verify --no-transfer-progress -DskipTests=true -Dmaven.javadoc.skip=true -B -V
 
   # run unit tests
   - name: test
-    image: maven:3-eclipse-temurin-17
+    image: maven:3-eclipse-temurin-21
     commands:
       - mvn test --no-transfer-progress -B -V
 
+  # check maven dependencies
+  - name: dependency-check
+    image: maven:3-eclipse-temurin-21
+    commands:
+      - mvn dependency-check:check --no-transfer-progress -B -V -DnvdApiKey=$NVD_API_KEY
+    environment:
+      NVD_API_KEY:
+        from_secret: nvd_api_key
+
   # run code analysis
   - name: code-analysis
-    image: maven:3-eclipse-temurin-17
+    image: maven:3-eclipse-temurin-21
     commands:
-      - mvn sonar:sonar --no-transfer-progress -Dsonar.projectKey=$SONAR_PROJECT_KEY -Dsonar.host.url=$SONAR_INSTANCE_URL -Dsonar.login=$SONAR_LOGIN_KEY -B -V
+      - mvn sonar:sonar --no-transfer-progress -Dsonar.projectKey=$SONAR_PROJECT_KEY -Dsonar.host.url=$SONAR_INSTANCE_URL -Dsonar.token=$SONAR_LOGIN_KEY -B -V
     environment:
       SONAR_PROJECT_KEY:
         from_secret: sonar_project_key
@@ -29,3 +43,32 @@ steps:
         from_secret: sonar_instance_url
       SONAR_LOGIN_KEY:
         from_secret: sonar_login_key
+
+---
+
+kind: pipeline
+name: deploy
+type: docker
+platform:
+  os: linux
+  arch: arm64
+
+trigger:
+  event:
+    - promote
+  target:
+    - production
+
+steps:
+  # skip all previous steps because they were already ran in the "build" phase; we don't need to re-analyze the code.
+
+  # upload to maven repository
+  - name: maven-deploy
+    image: maven:3-eclipse-temurin-21
+    commands:
+      - mvn deploy --no-transfer-progress -DskipTests=true -Dmaven.javadoc.skip=true -B -V -gs settings.xml -Dmaven.repo.username=$MAVEN_REPO_USERNAME -Dmaven.repo.password=$MAVEN_REPO_PASSWORD
+    environment:
+      MAVEN_REPO_USERNAME:
+        from_secret: maven_repo_username
+      MAVEN_REPO_PASSWORD:
+        from_secret: maven_repo_password

pom.xml

@@ -6,73 +6,107 @@
 
     <groupId>wtf.beatrice</groupId>
     <artifactId>release-hive</artifactId>
-    <version>0.0.1-SNAPSHOT</version>
+    <version>0.0.2-SNAPSHOT</version>
-
 
     <dependencies>
         <!-- Logging Dependencies -->
         <dependency>
             <groupId>org.apache.logging.log4j</groupId>
             <artifactId>log4j-api</artifactId>
-            <version>2.23.1</version>
+            <version>2.25.2</version>
         </dependency>
         <dependency>
             <groupId>org.apache.logging.log4j</groupId>
             <artifactId>log4j-core</artifactId>
-            <version>2.23.1</version>
+            <version>2.25.2</version>
         </dependency>
 
         <!-- Web Dependencies -->
         <dependency>
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-starter-web</artifactId>
-            <version>3.3.2</version>
+            <version>3.5.7</version>
         </dependency>
         <dependency>
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-starter-json</artifactId>
-            <version>3.3.2</version>
+            <version>3.5.7</version>
         </dependency>
         <dependency>
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-starter-data-jpa</artifactId>
-            <version>3.3.2</version>
+            <version>3.5.7</version>
         </dependency>
 
         <!-- Security and Auth -->
         <dependency>
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-starter-security</artifactId>
-            <version>3.3.2</version>
+            <version>3.5.7</version>
         </dependency>
         <dependency>
             <groupId>io.jsonwebtoken</groupId>
             <artifactId>jjwt-api</artifactId>
-            <version>0.11.5</version>
+            <version>0.13.0</version>
         </dependency>
         <dependency>
             <groupId>io.jsonwebtoken</groupId>
             <artifactId>jjwt-impl</artifactId>
-            <version>0.11.5</version>
+            <version>0.13.0</version>
         </dependency>
         <dependency>
             <groupId>io.jsonwebtoken</groupId>
             <artifactId>jjwt-jackson</artifactId>
-            <version>0.11.5</version>
+            <version>0.13.0</version>
         </dependency>
 
         <!-- Database Dependencies -->
         <dependency>
             <groupId>org.postgresql</groupId>
             <artifactId>postgresql</artifactId>
-            <version>42.7.3</version>
+            <version>42.7.8</version>
         </dependency>
     </dependencies>
 
+    <build>
+        <plugins>
+            <plugin>
+                <groupId>org.owasp</groupId>
+                <artifactId>dependency-check-maven</artifactId>
+                <version>12.1.9</version>
+                <configuration>
+                    <failBuildOnCVSS>8</failBuildOnCVSS>
+                    <nvdApiKey>${nvdApiKey}</nvdApiKey>
+                    <formats>
+                        <format>html</format>
+                        <format>json</format>
+                    </formats>
+                    <suppressionFiles>
+                        <suppressionFile>./suppressions.xml</suppressionFile>
+                    </suppressionFiles>
+                </configuration>
+            </plugin>
+        </plugins>
+    </build>
+
     <properties>
-        <maven.compiler.source>17</maven.compiler.source>
+        <maven.compiler.source>21</maven.compiler.source>
-        <maven.compiler.target>17</maven.compiler.target>
+        <maven.compiler.target>21</maven.compiler.target>
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
+        <sonar.dependencyCheck.htmlReportPath>./target/dependency-check-report.html</sonar.dependencyCheck.htmlReportPath>
+        <sonar.dependencyCheck.jsonReportPath>./target/dependency-check-report.json</sonar.dependencyCheck.jsonReportPath>
+        <sonar.dependencyCheck.summarize>true</sonar.dependencyCheck.summarize>
     </properties>
 
+    <distributionManagement>
+        <repository>
+            <id>nexus-releases</id>
+            <url>https://nexus.beatrice.wtf/repository/maven-releases/</url>
+        </repository>
+        <snapshotRepository>
+            <id>nexus-snapshots</id>
+            <url>https://nexus.beatrice.wtf/repository/maven-snapshots/</url>
+        </snapshotRepository>
+    </distributionManagement>
+
 </project>

readme.md

@@ -16,7 +16,7 @@ this is currently the only supported database backend.
 ## building  
 ### required tools  
    
- - java 17+ sdk  
+ - java 21+ sdk  
  - git  
  - maven  
   

renovate.json

@@ -0,0 +1,3 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json"
+}

settings.xml

@@ -0,0 +1,20 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<settings xmlns="http://maven.apache.org/SETTINGS/1.1.0"
+          xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+          xsi:schemaLocation="http://maven.apache.org/SETTINGS/1.1.0 http://maven.apache.org/xsd/settings-1.1.0.xsd">
+
+    <servers>
+        <server>
+            <id>nexus-snapshots</id>
+            <username>${maven.repo.username}</username>
+            <password>${maven.repo.password}</password>
+        </server>
+        <server>
+            <id>nexus-releases</id>
+            <username>${maven.repo.username}</username>
+            <password>${maven.repo.password}</password>
+        </server>
+    </servers>
+
+</settings>
+

src/main/java/wtf/beatrice/releasehive/resources/UserResource.java

@@ -11,7 +11,6 @@ import wtf.beatrice.releasehive.models.User;
 import wtf.beatrice.releasehive.services.UserService;
 
 import java.util.List;
-import java.util.UUID;
 
 @RestController
 @RequestMapping("/api/v1/users")

src/main/java/wtf/beatrice/releasehive/services/JWTService.java

@@ -2,14 +2,13 @@ package wtf.beatrice.releasehive.services;
 
 import io.jsonwebtoken.Claims;
 import io.jsonwebtoken.Jwts;
-import io.jsonwebtoken.SignatureAlgorithm;
 import io.jsonwebtoken.io.Decoders;
 import io.jsonwebtoken.security.Keys;
 import org.springframework.beans.factory.annotation.Value;
 import org.springframework.stereotype.Service;
 import wtf.beatrice.releasehive.models.User;
 
-import java.security.Key;
+import javax.crypto.SecretKey;
 import java.util.Date;
 import java.util.HashMap;
 import java.util.Map;
@@ -52,11 +51,11 @@ public class JWTService
     ) {
         return Jwts
                 .builder()
-                .setClaims(extraClaims)
+                .claims(extraClaims)
-                .setSubject(userDetails.getEmail())
+                .subject(userDetails.getEmail())
-                .setIssuedAt(new Date(System.currentTimeMillis()))
+                .issuedAt(new Date(System.currentTimeMillis()))
-                .setExpiration(new Date(System.currentTimeMillis() + expiration))
+                .expiration(new Date(System.currentTimeMillis() + expiration))
-                .signWith(getSignInKey(), SignatureAlgorithm.HS256)
+                .signWith(getSignInKey(), Jwts.SIG.HS256)
                 .compact();
     }
 
@@ -75,14 +74,14 @@ public class JWTService
 
     private Claims extractAllClaims(String token) {
         return Jwts
-                .parserBuilder()
+                .parser()
-                .setSigningKey(getSignInKey())
+                .verifyWith(getSignInKey())
                 .build()
-                .parseClaimsJws(token)
+                .parseSignedClaims(token)
-                .getBody();
+                .getPayload();
     }
 
-    private Key getSignInKey() {
+    private SecretKey getSignInKey() {
         byte[] keyBytes = Decoders.BASE64.decode(secretKey);
         return Keys.hmacShaKeyFor(keyBytes);
     }

src/main/java/wtf/beatrice/releasehive/services/UserServiceImpl.java

@@ -35,10 +35,10 @@ public class UserServiceImpl implements UserService
 
     @Override
     public boolean deleteUser(UUID id) {
-        if (userRepository.findById(id).isEmpty()) {
+        userRepository.delete(userRepository
-            throw new UsernameNotFoundException(id.toString());
+                .findById(id)
-        }
+                .orElseThrow(() -> new UsernameNotFoundException("User not found")));
-        userRepository.delete(userRepository.findById(id).get());
+
         return true;
     }
 }

suppressions.xml

@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">
+    <suppress>
+        <notes><![CDATA[
+   file name: snakeyaml-1.33.jar
+   ]]></notes>
+        <packageUrl regex="true">^pkg:maven/org\.yaml/snakeyaml@.*$</packageUrl>
+        <cve>CVE-2021-4235</cve>
+    </suppress>
+</suppressions>