Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
File renamed without changes.
20 changes: 12 additions & 8 deletions pom.xml
Original file line number Diff line number Diff line change
Expand Up @@ -69,7 +69,7 @@
<module>vpro-shared-monitoring</module>
<module>vpro-shared-persistence</module>
<module>vpro-shared-rs</module>
<module>vpro-shared-swagger</module>
<module>vpro-shared-swagger3</module>

<module>vpro-shared-test</module>
<module>vpro-shared-util</module>
Expand All @@ -81,6 +81,7 @@
<module>vpro-shared-bom</module>

<!--
<module>vpro-shared-swagger</module>
<module>vpro-shared-client-resteasy3</module> - the other resteasy module as made compatibe with 3 too
<module>vpro-shared-resteasy</module>
<module>vpro-shared-camel</module>
Expand Down Expand Up @@ -285,10 +286,8 @@
<hibernate.validator.version>6.2.5.Final</hibernate.validator.version>

<ektorp.version>1.5.0</ektorp.version>
<!--
<swagger.version>2.0.0-rc2</swagger.version>
-->
<swagger.version>1.6.9</swagger.version>

<swagger.version>2.2.8</swagger.version>
<lombok.version>1.18.24</lombok.version>
<delombok.output>${project.build.directory}/delombok</delombok.output>

Expand All @@ -305,15 +304,20 @@
<dependencyManagement>
<dependencies>
<dependency>
<groupId>io.swagger</groupId>
<groupId>io.swagger.core.v3</groupId>
<artifactId>swagger-annotations</artifactId>
<version>${swagger.version}</version>
</dependency>
<dependency>
<groupId>io.swagger</groupId>
<artifactId>swagger-jaxrs</artifactId>
<groupId>io.swagger.core.v3</groupId>
<artifactId>swagger-jaxrs2</artifactId>
<version>${swagger.version}</version>
</dependency>
<dependency>
<groupId>io.swagger.core.v3</groupId>
<artifactId>swagger-core</artifactId>
<version>${swagger.version}</version>
</dependency>
<dependency>
<groupId>nl.vpro.shared</groupId>
<artifactId>vpro-shared-bom</artifactId>
Expand Down
9 changes: 8 additions & 1 deletion vpro-shared-bom/pom.xml
Original file line number Diff line number Diff line change
Expand Up @@ -159,9 +159,11 @@
<artifactId>vpro-shared-xml</artifactId>
<version>${project.version}</version>
</dependency>


<dependency>
<groupId>nl.vpro.shared</groupId>
<artifactId>vpro-shared-swagger</artifactId>
<artifactId>vpro-shared-swagger3</artifactId>
<version>${project.version}</version>
</dependency>

Expand Down Expand Up @@ -233,6 +235,11 @@
<artifactId>vpro-shared-resteasy</artifactId>
<version>2.21.0</version>
</dependency>
<dependency>
<groupId>nl.vpro.shared</groupId>
<artifactId>vpro-shared-swagger</artifactId>
<version>3.0.1</version>
</dependency>
</dependencies>
</dependencyManagement>

Expand Down
5 changes: 5 additions & 0 deletions vpro-shared-swagger3/README.adoc
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
= Swagger utilities

This contains a few utility methods to deal with swagger.

It has a dependency on a webjars for swagger frontend itself, and supplies a simply taglib to wire that into the actual HTML.
71 changes: 71 additions & 0 deletions vpro-shared-swagger3/pom.xml
Original file line number Diff line number Diff line change
@@ -0,0 +1,71 @@
<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
<modelVersion>4.0.0</modelVersion>

<parent>
<artifactId>vpro-shared-parent</artifactId>
<groupId>nl.vpro.shared</groupId>
<version>3.1-SNAPSHOT</version>
</parent>
<artifactId>vpro-shared-swagger3</artifactId>
<version>3.1-SNAPSHOT</version>

<properties>
</properties>

<dependencies>
<dependency>
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Critical OSS Vulnerability:

pkg:maven/nl.vpro.shared/vpro-shared-jackson2@2.30-SNAPSHOT

2 Critical, 1 Severe, 0 Moderate, 0 Unknown vulnerabilities have been found across 2 dependencies

Components
    pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1
      CRITICAL Vulnerabilities (2)
        CVE-2020-36518

        [CVE-2020-36518] CWE-787: Out-of-bounds Write

        jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects.

        CVSS Score: 7.5

        CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

        CWE: CWE-787

        sonatype-2021-4682

        [sonatype-2021-4682] CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')

        jackson-databind - Denial of Service (DoS)

        The software does not properly restrict the size or amount of resources that are requested or influenced by an actor, which can be used to consume more resources than intended.

        CVSS Score: 7.5

        CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

        CWE: CWE-400

    pkg:maven/com.google.guava/guava@31.1-jre
      SEVERE Vulnerabilities (1)

        [sonatype-2020-0926] CWE-379: Creation of Temporary File in Directory with Incorrect Permissions

        guava - Creation of Temporary File in Directory with Insecure Permissions [CVE-2020-8908]

        The software creates a temporary file in a directory whose permissions allow unintended actors to determine the file's existence or otherwise access that file.

        CVSS Score: 6.2

        CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

        CWE: CWE-379

(at-me in a reply with help or ignore)

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Severe OSS Vulnerability:

pkg:maven/nl.vpro.shared/vpro-shared-jackson2@2.30-SNAPSHOT

0 Critical, 1 Severe, 0 Moderate, 0 Unknown vulnerabilities have been found across 1 dependencies

Components
    pkg:maven/com.google.guava/guava@31.1-jre
      SEVERE Vulnerabilities (1)

        [sonatype-2020-0926] CWE-379: Creation of Temporary File in Directory with Incorrect Permissions

        guava - Creation of Temporary File in Directory with Insecure Permissions [CVE-2020-8908]

        The software creates a temporary file in a directory whose permissions allow unintended actors to determine the file's existence or otherwise access that file.

        CVSS Score: 6.2

        CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

        CWE: CWE-379

(at-me in a reply with help or ignore)

<groupId>nl.vpro.shared</groupId>
<artifactId>vpro-shared-jackson2</artifactId>
</dependency>
<dependency>
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Severe OSS Vulnerability:

pkg:maven/nl.vpro.shared/vpro-shared-web@2.30-SNAPSHOT

0 Critical, 1 Severe, 0 Moderate, 0 Unknown vulnerabilities have been found across 1 dependencies

Components
    pkg:maven/com.google.guava/guava@31.1-jre
      SEVERE Vulnerabilities (1)

        [sonatype-2020-0926] CWE-379: Creation of Temporary File in Directory with Incorrect Permissions

        guava - Creation of Temporary File in Directory with Insecure Permissions [CVE-2020-8908]

        The software creates a temporary file in a directory whose permissions allow unintended actors to determine the file's existence or otherwise access that file.

        CVSS Score: 6.2

        CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

        CWE: CWE-379

(at-me in a reply with help or ignore)

<groupId>nl.vpro.shared</groupId>
<artifactId>vpro-shared-web</artifactId>
</dependency>

<dependency>
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Critical OSS Vulnerability:

pkg:maven/io.swagger.core.v3/swagger-core@2.1.13

2 Critical, 0 Severe, 0 Moderate, 0 Unknown vulnerabilities have been found across 1 dependencies

Components
    pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1
      CRITICAL Vulnerabilities (2)
        CVE-2020-36518

        [CVE-2020-36518] CWE-787: Out-of-bounds Write

        jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects.

        CVSS Score: 7.5

        CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

        CWE: CWE-787

        sonatype-2021-4682

        [sonatype-2021-4682] CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')

        jackson-databind - Denial of Service (DoS)

        The software does not properly restrict the size or amount of resources that are requested or influenced by an actor, which can be used to consume more resources than intended.

        CVSS Score: 7.5

        CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

        CWE: CWE-400

(at-me in a reply with help or ignore)

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ignore

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I've recorded this as ignored for this pull request.
If you change your mind, just comment @sonatype-lift unignore.

<groupId>io.swagger.core.v3</groupId>
<artifactId>swagger-core</artifactId>
</dependency>
<dependency>
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Critical OSS Vulnerability:

pkg:maven/io.swagger.core.v3/swagger-jaxrs2@2.1.13

2 Critical, 0 Severe, 0 Moderate, 0 Unknown vulnerabilities have been found across 1 dependencies

Components
    pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.10.5.1
      CRITICAL Vulnerabilities (2)
        CVE-2020-36518

        [CVE-2020-36518] CWE-787: Out-of-bounds Write

        jackson-databind before 2.13.0 allows a Java StackOverflow exception and denial of service via a large depth of nested objects.

        CVSS Score: 7.5

        CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

        CWE: CWE-787

        sonatype-2021-4682

        [sonatype-2021-4682] CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')

        jackson-databind - Denial of Service (DoS)

        The software does not properly restrict the size or amount of resources that are requested or influenced by an actor, which can be used to consume more resources than intended.

        CVSS Score: 7.5

        CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

        CWE: CWE-400

(at-me in a reply with help or ignore)

<groupId>io.swagger.core.v3</groupId>
<artifactId>swagger-jaxrs2</artifactId>
</dependency>
<dependency>
<groupId>org.jboss.spec.javax.ws.rs</groupId>
<artifactId>jboss-jaxrs-api_2.1_spec</artifactId>
<version>2.0.1.Final</version>
<scope>provided</scope>
</dependency>
<dependency>
<groupId>jakarta.servlet</groupId>
<artifactId>jakarta.servlet-api</artifactId>
</dependency>
<dependency>
<groupId>org.webjars</groupId>
<artifactId>swagger-ui</artifactId>
<version>4.9.1</version>
</dependency>
<dependency>
<groupId>org.projectlombok</groupId>
<artifactId>lombok</artifactId>
</dependency>
<dependency>
<groupId>nl.vpro.shared</groupId>
<artifactId>vpro-shared-test</artifactId>
<scope>test</scope>
</dependency>
<dependency>
<groupId>org.meeuw</groupId>
<artifactId>mihxil-json-grep</artifactId>
</dependency>
<dependency>
<groupId>org.apache.logging.log4j</groupId>
<artifactId>log4j-core</artifactId>
</dependency>
<dependency>
<groupId>jakarta.annotation</groupId>
<artifactId>jakarta.annotation-api</artifactId>
</dependency>
</dependencies>
</project>
Original file line number Diff line number Diff line change
@@ -0,0 +1,35 @@
package nl.vpro.rs.media;

import lombok.extern.slf4j.Slf4j;

import java.io.IOException;

import javax.servlet.*;
import javax.servlet.http.HttpServletResponse;

/**
* MSE-4330. Er was gewoon een index.jsp die dat deed, maar dat werkt niet meer, omdat om een of andere reden het resteasy servlet er altijd tussen zat (terwijl niet eens gemapt)
* @author Michiel Meeuwissen
* @since 2.6
*/
@Slf4j
public class WelcomeFilter implements Filter {



@Override
public void init(FilterConfig filterConfig) {

}

@Override
public void doFilter(ServletRequest servletRequest, ServletResponse servletResponse, FilterChain filterChain) throws IOException {
((HttpServletResponse)servletResponse).sendRedirect("docs/api");

}

@Override
public void destroy() {

}
}
Original file line number Diff line number Diff line change
@@ -0,0 +1,57 @@
/*
* Copyright (C) 2013 All rights reserved
* VPRO The Netherlands
*/
package nl.vpro.swagger;

import lombok.extern.slf4j.Slf4j;

import java.util.*;

import javax.annotation.PostConstruct;
import javax.ws.rs.ApplicationPath;
import javax.ws.rs.core.Application;


/**
* Static helper to expose a dummy JAX-RS Application. Swagger needs such an application to expose the API docs for
* the given endpoints.
*
* @author Roelof Jan Koekoek
* @since 2.0
*/
@Slf4j
@ApplicationPath("")
public class SwaggerApplication extends Application {
private static final Set<Object> singletons = new HashSet<>();

@Override
public Set<Class<?>> getClasses() {
Set<Class<?>> set = new HashSet<>();
return set;
}

@Override
public Set<Object> getSingletons() {
return singletons;
}

@PostConstruct
public void init() {
//inject();
}

/**
* Inject Swagger annotated JAX-RS api's you want to publish. Swagger only calls #getSingletons on the first
* API documentation request, so you must take care that your services get injected before an application accepts
* web requests. (Using @PostConstruct on your services is a viable solution)
*
* @param services
*/
public static void inject(Object... services) {
singletons.addAll(Arrays.asList(services));
}



}
125 changes: 125 additions & 0 deletions vpro-shared-swagger3/src/main/java/nl/vpro/swagger/SwaggerFilter.java
Original file line number Diff line number Diff line change
@@ -0,0 +1,125 @@
package nl.vpro.swagger;

import lombok.extern.slf4j.Slf4j;

import java.io.IOException;
import java.io.OutputStream;

import javax.servlet.*;
import javax.servlet.http.*;
import javax.ws.rs.core.MediaType;

import org.meeuw.json.grep.Sed;
import org.meeuw.json.grep.matching.*;

import nl.vpro.web.HttpServletRequestUtils;

/**
* This filter can be used to fill in 'api.basePath' using the request, so you don't have to configure it any more.
* @author Michiel Meeuwissen
* @since 0.21
*/
@Slf4j
public class SwaggerFilter implements Filter {


@Override
public void init(FilterConfig filterConfig) {

}

@Override
public void doFilter(
ServletRequest request,
ServletResponse response, FilterChain chain) throws IOException, ServletException {
HttpServletRequest req = (HttpServletRequest) request;

if (! req.getPathInfo().endsWith(".json")) {
String accept = req.getHeader("accept");
if (accept != null) {
boolean json = false;
try {
String[] mtypes = accept.split(";", 2)[0].split(",");
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

StringSplitter: String.split(String) has surprising behavior (details)

Suggested change
String[] mtypes = accept.split(";", 2)[0].split(",");
Iterable<String> mtypes = Splitter.on(',').split(accept.split(";", 2)[0]);

(at-me in a reply with help or ignore)

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

ignore

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I've recorded this as ignored for this pull request.
If you change your mind, just comment @sonatype-lift unignore.

for (String mtype : mtypes) {
if (MediaType.valueOf(mtype).isCompatible(MediaType.APPLICATION_JSON_TYPE)) {
json = true;
break;
}
}
} catch (Exception e) {
log.warn(e.getMessage());
}
if (!json) {
log.debug("Not json");
chain.doFilter(request, response);
return;
}
}
}

PathMatcher matcher = getPathMatcher(req);

final ServletOutputStream servletOutputStream = response.getOutputStream();
final OutputStream out = transform(servletOutputStream, matcher);
HttpServletResponseWrapper wrapped = new HttpServletResponseWrapper((HttpServletResponse) response) {
@Override
public ServletOutputStream getOutputStream() {
return new ServletOutputStream() {
@Override
public boolean isReady() {
return servletOutputStream.isReady();

}

@Override
public void setWriteListener(WriteListener writeListener) {
servletOutputStream.setWriteListener(writeListener);
}

@Override
public void write(int b) throws IOException {
out.write(b);

}

@Override
public void write(byte[] b) throws IOException {
out.write(b);
}

@Override
public void write(byte[] b, int off, int len) throws IOException {
out.write(b, off, len);
}
};
}
};

chain.doFilter(request, wrapped);
out.close();

}


PathMatcher getPathMatcher(HttpServletRequest req) {
String host = req.getServerName() + HttpServletRequestUtils.getPortPostFixIfNeeded(req);
String basePath = req.getContextPath() + "/api";
return getPathMatcher(basePath, host);
}

PathMatcher getPathMatcher(String basePath, String host) {
return new PathMatcherOrChain(
new PathMatcherAndChain(
new SinglePathMatcher(new PreciseMatch("servers"), new ArrayEntryMatch(), new PreciseMatch("url")),
new ScalarEqualsMatcher("${api.basePath}", basePath)
)
);
}

public OutputStream transform(OutputStream to, PathMatcher pathMatcher) throws IOException {
return Sed.transform(to, pathMatcher);
}



}
Loading