Skip to content

Commit

Permalink
fix: Vulnerabilities and warnings
Browse files Browse the repository at this point in the history
  • Loading branch information
reneleonhardt committed Jun 26, 2024
1 parent 9d11d44 commit f25548b
Show file tree
Hide file tree
Showing 28 changed files with 853 additions and 932 deletions.
2 changes: 2 additions & 0 deletions buildSrc/settings.gradle.kts
Original file line number Diff line number Diff line change
@@ -1,3 +1,5 @@
rootProject.name = "graphql-kotlin"

dependencyResolutionManagement {
versionCatalogs {
create("libs") {
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -35,7 +35,7 @@ tasks {
}
detekt {
toolVersion = libs.versions.detekt.get()
config = files("${rootProject.projectDir}/detekt.yml")
config.setFrom(files("${rootProject.projectDir}/detekt.yml"))
}
ktlint {
version.set(libs.versions.ktlint.core.get())
Expand Down Expand Up @@ -70,7 +70,7 @@ tasks {
val dokka = named("dokkaJavadoc", DokkaTask::class)
val javadocJar by registering(Jar::class) {
archiveClassifier.set("javadoc")
from("$buildDir/dokka/javadoc")
from("${layout.buildDirectory}/dokka/javadoc")
dependsOn(dokka)
}
publishing {
Expand Down Expand Up @@ -143,8 +143,9 @@ dependencies {
implementation(libs.kotlin.reflect)
implementation(libs.kotlinx.coroutines.jdk8)
testImplementation(libs.kotlin.test)
testImplementation(platform(libs.junit.bom))
testImplementation("org.junit.jupiter:junit-jupiter")
testRuntimeOnly("org.junit.platform:junit-platform-launcher")
testImplementation(libs.kotlin.junit.test)
testImplementation(libs.junit.api)
testImplementation(libs.junit.engine)
testImplementation(libs.mockk)
}
Original file line number Diff line number Diff line change
Expand Up @@ -475,7 +475,7 @@ class GraphQLWebClientTest {
client.execute(HelloWorldQuery())
}
}
assertEquals(500, error.rawStatusCode)
assertEquals(500, error.statusCode.value())
assertEquals("Internal server error", error.responseBodyAsString)
}

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -23,8 +23,6 @@ dependencies {
implementation(libs.kotlinx.coroutines.jdk8)
implementation(libs.icu)
testImplementation(libs.kotlin.junit.test)
testImplementation(libs.junit.api)
testImplementation(libs.junit.engine)
}

tasks.withType<KotlinCompile> {
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -15,12 +15,12 @@ tasks {
limit {
counter = "INSTRUCTION"
value = "COVEREDRATIO"
minimum = "0.95".toBigDecimal()
minimum = "0.85".toBigDecimal()
}
limit {
counter = "BRANCH"
value = "COVEREDRATIO"
minimum = "0.90".toBigDecimal()
minimum = "0.80".toBigDecimal()
}
}
}
Expand Down
6 changes: 5 additions & 1 deletion generator/graphql-kotlin-federation/build.gradle.kts
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,11 @@ dependencies {
api(libs.graphql.java)
testImplementation(libs.reactor.core)
testImplementation(libs.reactor.extensions)
testImplementation(libs.junit.params)
constraints {
implementation(libs.commons.codec) {
because("Cxeb68d52e-5509: Apache commons-codec before 1.13 is vulnerable to information exposure. https://devhub.checkmarx.com/cve-details/Cxeb68d52e-5509/")
}
}
}

tasks {
Expand Down
1 change: 0 additions & 1 deletion generator/graphql-kotlin-schema-generator/build.gradle.kts
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,6 @@ dependencies {
implementation(libs.classgraph)
implementation(libs.slf4j)
testImplementation(libs.rxjava)
testImplementation(libs.junit.params)
}

tasks {
Expand Down
10 changes: 8 additions & 2 deletions gradle/libs.versions.toml
Original file line number Diff line number Diff line change
Expand Up @@ -24,14 +24,17 @@ slf4j = "2.0.13"
spring = "6.1.10"
spring-boot = "3.3.1"

# security vulnerabilities overrides
commons-codec = { strictly = "[1.13, 2[", prefer = "1.16.0" }

# test dependencies
compile-testing = "0.5.0"
icu = "75.1"
junit = "5.10.2"
logback = "1.5.6"
mockk = "1.13.11"
rxjava = "3.1.8"
wiremock = "3.6.0"
wiremock = "3.7.0"

# plugins
detekt = "1.23.6"
Expand Down Expand Up @@ -84,13 +87,16 @@ spring-boot-webflux = { group = "org.springframework.boot", name = "spring-boot-
spring-webflux = { group = "org.springframework", name = "spring-webflux", version.ref = "spring" }
spring-context = { group = "org.springframework", name = "spring-context", version.ref = "spring" }

# security vulnerabilities overrides
commons-codec = { group = "commons-codec", name = "commons-codec", version.ref = "commons-codec" }

# test dependencies
compile-testing = { group = "dev.zacsweers.kctfork", name = "core", version.ref = "compile-testing" }
icu = { group = "com.ibm.icu", name = "icu4j", version.ref = "icu" }
logback = { group = "ch.qos.logback", name = "logback-classic", version.ref = "logback" }
junit-api = { group = "org.junit.jupiter", name = "junit-jupiter-api", version.ref = "junit" }
junit-bom = { group = "org.junit", name = "junit-bom", version.ref = "junit" }
junit-engine = { group = "org.junit.jupiter", name = "junit-jupiter-engine", version.ref = "junit" }
junit-params = { group = "org.junit.jupiter", name = "junit-jupiter-params", version.ref = "junit" }
kotlin-junit-test = { group = "org.jetbrains.kotlin", name = "kotlin-test-junit5", version.ref = "kotlin" }
kotlin-annotation-processing = { group = "org.jetbrains.kotlin", name = "kotlin-annotation-processing-embeddable", version.ref = "kotlin" }
kotlin-compiler = { group = "org.jetbrains.kotlin", name = "kotlin-compiler-embeddable", version.ref = "kotlin" }
Expand Down
1 change: 0 additions & 1 deletion integration/graalvm/spring-graalvm-server/build.gradle.kts
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,6 @@ plugins {
dependencies {
implementation("com.expediagroup", "graphql-kotlin-spring-server")
implementation(projects.commonGraalvmServer)
testImplementation(libs.junit.api)
testImplementation(libs.kotlin.test)
testImplementation(libs.spring.boot.test)
}
Expand Down
2 changes: 0 additions & 2 deletions integration/gradle-plugin-android-test/app/build.gradle.kts
Original file line number Diff line number Diff line change
Expand Up @@ -20,8 +20,6 @@ android {
dependencies {
implementation("com.expediagroup:graphql-kotlin-ktor-client")
implementation(libs.kotlin.stdlib)
testImplementation(libs.junit.api)
testImplementation(libs.junit.engine)
}

graphql {
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -15,8 +15,6 @@ dependencies {
implementation("com.expediagroup:graphql-kotlin-spring-server")
implementation(libs.icu)
testImplementation(libs.kotlin.junit.test)
testImplementation(libs.junit.api)
testImplementation(libs.junit.engine)
testImplementation(libs.spring.boot.test)
}

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -17,8 +17,6 @@ dependencies {
implementation(libs.ktor.server.cio)
implementation(libs.ktor.server.netty)
implementation(libs.logback)
testImplementation(libs.junit.api)
testImplementation(libs.junit.engine)
testImplementation(libs.kotlin.junit.test)
testImplementation(libs.ktor.server.test.host)
}
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -8,8 +8,6 @@ plugins {

dependencies {
implementation("com.expediagroup:graphql-kotlin-spring-client")
testImplementation(libs.junit.api)
testImplementation(libs.junit.engine)
testImplementation(libs.mockk)
}

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -18,8 +18,6 @@ dependencies {
implementation(libs.ktor.server.cio)
implementation(libs.ktor.server.netty)
implementation(libs.logback)
testImplementation(libs.junit.api)
testImplementation(libs.junit.engine)
testImplementation(libs.kotlin.junit.test)
testImplementation(libs.ktor.server.test.host)
}
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -16,8 +16,6 @@ dependencies {
implementation(libs.ktor.server.cio)
implementation(libs.ktor.server.netty)
implementation(libs.logback)
testImplementation(libs.junit.api)
testImplementation(libs.junit.engine)
testImplementation(libs.kotlin.junit.test)
testImplementation(libs.ktor.server.test.host)
}
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -12,8 +12,6 @@ dependencies {
implementation("com.expediagroup:graphql-kotlin-spring-client")
implementation("com.expediagroup:graphql-kotlin-spring-server")
testImplementation(libs.kotlin.junit.test)
testImplementation(libs.junit.api)
testImplementation(libs.junit.engine)
testImplementation(libs.spring.boot.test)
}

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -14,8 +14,6 @@ dependencies {
implementation(libs.ktor.server.core)
implementation(libs.ktor.server.cio)
implementation(libs.ktor.server.netty)
testImplementation(libs.junit.api)
testImplementation(libs.junit.engine)
testImplementation(libs.kotlin.junit.test)
testImplementation(libs.ktor.server.test.host)
}
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -13,8 +13,6 @@ dependencies {
implementation("com.expediagroup:graphql-kotlin-spring-client")
implementation("com.expediagroup:graphql-kotlin-spring-server")
implementation(libs.icu)
testImplementation(libs.junit.api)
testImplementation(libs.junit.engine)
testImplementation(libs.kotlin.junit.test)
testImplementation(libs.spring.boot.test)
}
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -12,8 +12,6 @@ plugins {
dependencies {
implementation("com.expediagroup:graphql-kotlin-spring-client")
implementation("com.expediagroup:graphql-kotlin-spring-server")
testImplementation(libs.junit.api)
testImplementation(libs.junit.engine)
testImplementation(libs.kotlin.junit.test)
testImplementation(libs.spring.boot.test)
}
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -17,8 +17,6 @@ dependencies {
}
implementation("com.expediagroup", "graphql-kotlin-client-serialization")
implementation("com.expediagroup", "graphql-kotlin-spring-server")
testImplementation(libs.junit.api)
testImplementation(libs.junit.engine)
testImplementation(libs.kotlin.junit.test)
testImplementation(libs.spring.boot.test)
}
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -123,7 +123,7 @@
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-surefire-plugin</artifactId>
<version>3.0.0-M4</version>
<version>3.3.0</version>
<configuration>
<systemPropertyVariables>
<buildDirectory>${project.build.directory}</buildDirectory>
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -24,11 +24,15 @@ dependencies {
testImplementation(libs.wiremock.lib)
testImplementation(libs.compile.testing)
testImplementation(libs.icu)
testImplementation(libs.junit.params)
// compile testing workaround -> explicit dependencies for compiler/annotation-processing
testImplementation(libs.kotlin.annotation.processing)
testImplementation(libs.kotlin.compiler)
testImplementation(libs.kotlin.serialization)
constraints {
implementation(libs.commons.codec) {
because("Cxeb68d52e-5509: Apache commons-codec before 1.13 is vulnerable to information exposure. https://devhub.checkmarx.com/cve-details/Cxeb68d52e-5509/")
}
}
}

tasks {
Expand Down
3 changes: 1 addition & 2 deletions plugins/graphql-kotlin-gradle-plugin/build.gradle.kts
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,6 @@ dependencies {
compileOnly(projects.graphqlKotlinGraalvmMetadataGenerator)

testImplementation(libs.wiremock.lib)
testImplementation(libs.junit.params)
}

java {
Expand All @@ -42,7 +41,7 @@ gradlePlugin {

val generateDefaultVersion by tasks.registering {
val fileName = "PluginVersion.kt"
val defaultVersionFile = File("$buildDir/generated/src/com/expediagroup/graphql/plugin/gradle", fileName)
val defaultVersionFile = layout.buildDirectory.dir("generated/src/com/expediagroup/graphql/plugin/gradle").get().file(fileName).asFile

inputs.property(fileName, project.version)
outputs.dir(defaultVersionFile.parent)
Expand Down
4 changes: 2 additions & 2 deletions plugins/schema/graphql-kotlin-sdl-generator/build.gradle.kts
Original file line number Diff line number Diff line change
Expand Up @@ -50,12 +50,12 @@ tasks {
jacocoTestReport {
dependsOn(testing.suites.named("integrationTest"))
// we need to explicitly add integrationTest coverage info
executionData.setFrom(fileTree(buildDir).include("/jacoco/*.exec"))
executionData.setFrom(fileTree(layout.buildDirectory).include("/jacoco/*.exec"))
}
jacocoTestCoverageVerification {
dependsOn(testing.suites.named("integrationTest"))
// we need to explicitly add integrationTest coverage info
executionData.setFrom(fileTree(buildDir).include("/jacoco/*.exec"))
executionData.setFrom(fileTree(layout.buildDirectory).include("/jacoco/*.exec"))
violationRules {
rule {
limit {
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -49,12 +49,12 @@ tasks {
jacocoTestReport {
dependsOn(testing.suites.named("integrationTest"))
// we need to explicitly add integrationTest coverage info
executionData.setFrom(fileTree(buildDir).include("/jacoco/*.exec"))
executionData.setFrom(fileTree(layout.buildDirectory).include("/jacoco/*.exec"))
}
jacocoTestCoverageVerification {
dependsOn(testing.suites.named("integrationTest"))
// we need to explicitly add integrationTest coverage info
executionData.setFrom(fileTree(buildDir).include("/jacoco/*.exec"))
executionData.setFrom(fileTree(layout.buildDirectory).include("/jacoco/*.exec"))
violationRules {
rule {
limit {
Expand Down
5 changes: 5 additions & 0 deletions servers/graphql-kotlin-ktor-server/build.gradle.kts
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,11 @@ dependencies {
testImplementation(libs.ktor.client.websockets)
testImplementation(libs.ktor.server.cio)
testImplementation(libs.ktor.server.test.host)
constraints {
implementation(libs.commons.codec) {
because("Cxeb68d52e-5509: Apache commons-codec before 1.13 is vulnerable to information exposure. https://devhub.checkmarx.com/cve-details/Cxeb68d52e-5509/")
}
}
}

tasks {
Expand Down
Loading

0 comments on commit f25548b

Please sign in to comment.