From 232503755a6dbece5380f7a57a054de094a18caa Mon Sep 17 00:00:00 2001 From: Lucian Holland Date: Tue, 28 Mar 2023 17:04:43 +0200 Subject: [PATCH 1/3] Bump deps to fix owasp --- pom.xml | 47 ++++++++++++++---------------- spring-boot-infrastructure/pom.xml | 1 - spring-infrastructure/pom.xml | 8 ++--- suppression.xml | 13 +++++++-- 4 files changed, 37 insertions(+), 32 deletions(-) diff --git a/pom.xml b/pom.xml index 998dfb97..b7dfdabb 100644 --- a/pom.xml +++ b/pom.xml @@ -47,7 +47,7 @@ UTF-8 1.10.0 - 0.61.1 + 0.61.2 2.2 0.10.2 @@ -57,7 +57,7 @@ 2.6 8.0 1.11.0 - 3.19.0 + 3.20.2 3.8.1 3.2.1 @@ -75,17 +75,17 @@ 54-8e2e575-247593 2021.0.5 - 2.7.5 + 2.7.10 2.9.0 - 3.25.0 + 3.32.0 1.6.21 - 2.16 + 2.18.0 2.5.17 2.9.0 4.10.0 2.2.3 2.3.3 - 5.6.9.Final + 5.6.15.Final 1.0 2.3.6 2.0.1 @@ -94,13 +94,10 @@ 3.23.1 - 3.4.0 + 3.4.7 - - 5.7.5 - - 2.9.0 + 2.14.2 @@ -119,14 +116,6 @@ - - - org.springframework.security - spring-security-bom - ${spring.security.version} - pom - import - com.google.cloud spring-cloud-gcp-dependencies @@ -134,6 +123,13 @@ pom import + + com.fasterxml.jackson + jackson-bom + ${jackson-bom.version} + import + pom + org.springframework.boot spring-boot-dependencies @@ -311,6 +307,13 @@ pom import + + org.apache.camel + camel-core + test-jar + test + ${camel.version} + org.apache.camel camel-xml-jaxb @@ -395,12 +398,6 @@ jakarta.persistence-api ${jakarta.persistence-api.version} - - com.google.code.gson - gson - - ${google.gson.version} - diff --git a/spring-boot-infrastructure/pom.xml b/spring-boot-infrastructure/pom.xml index 480509f0..ae832eb6 100644 --- a/spring-boot-infrastructure/pom.xml +++ b/spring-boot-infrastructure/pom.xml @@ -19,7 +19,6 @@ org.springframework.boot spring-boot-starter - ${spring.boot.version} test diff --git a/spring-infrastructure/pom.xml b/spring-infrastructure/pom.xml index 5aa5d3eb..caf6e9d9 100644 --- a/spring-infrastructure/pom.xml +++ b/spring-infrastructure/pom.xml @@ -17,10 +17,10 @@ org.apache.commons commons-lang3 - - org.checkerframework - checker-qual - + + + + com.google.guava guava diff --git a/suppression.xml b/suppression.xml index c686e05b..ae221bd5 100644 --- a/suppression.xml +++ b/suppression.xml @@ -1,7 +1,7 @@ - + ^pkg:maven/com\.google\.http\-client/google\-http\-client\-gson@.*$ CVE-2022-25647 - + @@ -19,5 +19,14 @@ ^pkg:maven/org\.springframework\.security/spring\-security\-.*$ CVE-2020-5408 + + + + + ^pkg:maven/com\.google\.guava/guava@.*$ + CVE-2020-8908 + From 7b9eda9e8a01e36cd19d041965220a829fc54ae0 Mon Sep 17 00:00:00 2001 From: Lucian Holland Date: Tue, 28 Mar 2023 18:15:26 +0200 Subject: [PATCH 2/3] Add back pin for gson + remove comment --- pom.xml | 12 +++++++----- spring-infrastructure/pom.xml | 4 ---- 2 files changed, 7 insertions(+), 9 deletions(-) diff --git a/pom.xml b/pom.xml index b7dfdabb..b0b3fd2f 100644 --- a/pom.xml +++ b/pom.xml @@ -98,6 +98,7 @@ 2.14.2 + 2.10.1 @@ -398,6 +399,11 @@ jakarta.persistence-api ${jakarta.persistence-api.version} + + com.google.code.gson + gson + ${google.gson.version} + @@ -449,11 +455,7 @@ to pick the highest version. Otherwise we may end up unexpectedly swapping to an older version if the 'nearest' definition changes, or end up unexpectedly using a different version to what we've specified via a parent bom --> - - - com.google.code.gson:gson - - + diff --git a/spring-infrastructure/pom.xml b/spring-infrastructure/pom.xml index caf6e9d9..2edf1fed 100644 --- a/spring-infrastructure/pom.xml +++ b/spring-infrastructure/pom.xml @@ -17,10 +17,6 @@ org.apache.commons commons-lang3 - - - - com.google.guava guava From 3b3cbb33af62dd67d0a1c96f2d02f00d2467b601 Mon Sep 17 00:00:00 2001 From: Lucian Holland Date: Mon, 27 Mar 2023 11:08:46 +0200 Subject: [PATCH 3/3] Change FakeDateTimeService to return wrapper clock Allows for injecting a mockable clock into classes that take a clock as a constructor parameter --- .../AutoAdvanceFakeDateTimeService.java | 20 +++++++-- .../common/datetime/FakeDateTimeService.java | 44 +++++++++++++++---- 2 files changed, 52 insertions(+), 12 deletions(-) diff --git a/date-time/src/main/java/com/pkb/common/datetime/AutoAdvanceFakeDateTimeService.java b/date-time/src/main/java/com/pkb/common/datetime/AutoAdvanceFakeDateTimeService.java index ab66c054..18d70742 100644 --- a/date-time/src/main/java/com/pkb/common/datetime/AutoAdvanceFakeDateTimeService.java +++ b/date-time/src/main/java/com/pkb/common/datetime/AutoAdvanceFakeDateTimeService.java @@ -1,6 +1,8 @@ package com.pkb.common.datetime; import java.time.Clock; +import java.time.Instant; +import java.time.ZoneId; import java.time.temporal.TemporalAmount; /** @@ -16,10 +18,22 @@ public class AutoAdvanceFakeDateTimeService extends FakeDateTimeService { @Override public Clock clock() { - if (this.currentFixedClock != null && autoAdvanceDuration != null) { - moveTime(autoAdvanceDuration); + return new AutoAdvanceClockShim(getCurrentZoneId()); + } + + private class AutoAdvanceClockShim extends ClockShim { + + AutoAdvanceClockShim(ZoneId zone) { + super(zone); + } + + @Override + public Instant instant() { + if (currentFixedTime != null && autoAdvanceDuration != null) { + moveTime(autoAdvanceDuration); + } + return super.instant(); } - return super.clock(); } public void setAutoAdvanceDuration(TemporalAmount autoAdvanceDuration) { diff --git a/date-time/src/main/java/com/pkb/common/datetime/FakeDateTimeService.java b/date-time/src/main/java/com/pkb/common/datetime/FakeDateTimeService.java index 95a207de..c69fb56a 100644 --- a/date-time/src/main/java/com/pkb/common/datetime/FakeDateTimeService.java +++ b/date-time/src/main/java/com/pkb/common/datetime/FakeDateTimeService.java @@ -6,16 +6,17 @@ import java.lang.invoke.MethodHandles; import java.time.Clock; import java.time.Instant; +import java.time.ZoneId; import java.time.ZonedDateTime; import java.time.temporal.TemporalAmount; import java.time.temporal.TemporalUnit; +import java.util.Optional; import java.util.concurrent.TimeUnit; public class FakeDateTimeService implements DateTimeService { private static final Logger LOGGER = LoggerFactory.getLogger(MethodHandles.lookup().lookupClass()); - protected volatile ZonedDateTime currentFixedTime; - protected volatile Clock currentFixedClock; + volatile ZonedDateTime currentFixedTime; private final DateTimeService fallbackService; @@ -29,10 +30,11 @@ public FakeDateTimeService(DateTimeService fallbackService) { @Override public Clock clock() { - if (currentFixedClock == null) { - return fallbackService.clock(); - } - return currentFixedClock; + return new ClockShim(getCurrentZoneId()); + } + + ZoneId getCurrentZoneId() { + return Optional.ofNullable(currentFixedTime).map(ZonedDateTime::getZone).orElseGet(fallbackService.clock()::getZone); } @Override @@ -58,13 +60,37 @@ public long nowNanoTime() { @Override public void forgetFixedCurrentTimeForTesting() { - this.currentFixedClock = null; + this.currentFixedTime = null; LOGGER.info("Cleared fixed fake date time."); } private void fixTime(ZonedDateTime zdt) { currentFixedTime = zdt; - currentFixedClock = Clock.fixed(zdt.toInstant(), zdt.getZone()); - LOGGER.info("Set fixed fake date time to: {}", currentFixedClock); + LOGGER.info("Set fixed fake date time to: {}", currentFixedTime); + } + + + class ClockShim extends Clock { + + private final ZoneId zone; + + ClockShim(ZoneId zone) { + this.zone = zone; + } + + @Override + public ZoneId getZone() { + return zone; + } + + @Override + public Clock withZone(ZoneId zone) { + return new ClockShim(zone); + } + + @Override + public Instant instant() { + return Optional.ofNullable(currentFixedTime).map(ZonedDateTime::toInstant).orElseGet(fallbackService.clock()::instant); + } } }