bumped versions and fixed command-line interface

[RalphSteinhagen]

• Bumped sundry library versions:

  • fastjson from 1.2.75 to 1.2.76
  • jackson-databind from 2.12.2 to 2.12.3
  • oshi-core from 5.7.0 to 5.7.4
  • disruptor from 3.4.2 to 3.4.4
  • jacoco-maven-plugin from 0.8.6 to 0.8.7
  • version.micrometer from 1.6.5 to 1.6.6

• fixed and added command-line parameter example

[sonatype-lift]

Severe OSS Vulnerability:  

pkg:maven/org.eclipse.jetty/jetty-http@9.4.40.v20210413

0 Critical, 1 Severe, 0 Moderate and 0 Unknown vulnerabilities have been found in a transitive dependency of pkg:maven/org.eclipse.jetty/jetty-server@9.4.40.v20210413

SEVERE Vulnerabilities (1)

---

[CVE-2021-28169] For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for r...

For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory. For example a request to /concat?/%2557EB-INF/web.xml can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.

CVSS Score: 5.3

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

---

(at-me in a reply with help or ignore)

[sonatype-lift]

Severe OSS Vulnerability:  

pkg:maven/org.eclipse.jetty/jetty-http@9.4.40.v20210413

0 Critical, 1 Severe, 0 Moderate and 0 Unknown vulnerabilities have been found in a transitive dependency of pkg:maven/org.eclipse.jetty/jetty-webapp@9.4.40.v20210413

SEVERE Vulnerabilities (1)

---

[CVE-2021-28169] For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for r...

For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory. For example a request to /concat?/%2557EB-INF/web.xml can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.

CVSS Score: 5.3

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

---

(at-me in a reply with help or ignore)

[sonatype-lift]

Severe OSS Vulnerability:  

pkg:maven/org.eclipse.jetty/jetty-server@9.4.40.v20210413

0 Critical, 1 Severe, 0 Moderate and 0 Unknown vulnerabilities have been found in a direct dependency

SEVERE Vulnerabilities (1)

---

[CVE-2021-28169] For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for r...

For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory. For example a request to /concat?/%2557EB-INF/web.xml can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.

CVSS Score: 5.3

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

---

(at-me in a reply with help or ignore)

[sonatype-lift]

Severe OSS Vulnerability:  

pkg:maven/org.eclipse.jetty/jetty-server@9.4.40.v20210413

0 Critical, 1 Severe, 0 Moderate and 0 Unknown vulnerabilities have been found in a transitive dependency of pkg:maven/org.eclipse.jetty/jetty-webapp@9.4.40.v20210413

SEVERE Vulnerabilities (1)

---

[CVE-2021-28169] For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for r...

For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory. For example a request to /concat?/%2557EB-INF/web.xml can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.

CVSS Score: 5.3

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

---

(at-me in a reply with help or ignore)

[codecov]

Codecov Report

Merging #103 (d8f7b11) into main (d1a0cc7) will increase coverage by 0.39%.
The diff coverage is 83.54%.

@@             Coverage Diff              @@
##               main     #103      +/-   ##
============================================
+ Coverage     72.49%   72.89%   +0.39%     
- Complexity     2481     2633     +152     
============================================
  Files            87       89       +2     
  Lines         10820    11020     +200     
  Branches       1652     1719      +67     
============================================
+ Hits           7844     8033     +189     
+ Misses         2037     2023      -14     
- Partials        939      964      +25     

Impacted Files	Coverage Δ
...a/io/opencmw/server/rest/RestCommonThreadPool.java	0.00% <0.00%> (ø)
.../opencmw/server/rest/user/RestUserHandlerImpl.java	31.42% <40.00%> (-0.96%)	⬇️
...io/opencmw/client/cmwlight/CmwLightDataSource.java	68.25% <62.50%> (-0.18%)	⬇️
.../opencmw/serialiser/spi/ClassFieldDescription.java	53.46% <63.63%> (-4.92%)	⬇️
...main/java/io/opencmw/client/OpenCmwDataSource.java	76.39% <66.66%> (+2.16%)	⬆️
...va/io/opencmw/server/rest/MajordomoRestPlugin.java	70.23% <69.44%> (+0.50%)	⬆️
...c/main/java/io/opencmw/server/rest/RestServer.java	65.89% <73.68%> (+4.04%)	⬆️
...in/java/io/opencmw/client/DataSourcePublisher.java	85.27% <75.00%> (-0.06%)	⬇️
...rc/main/java/io/opencmw/server/BasicMdpWorker.java	74.60% <77.77%> (-6.03%)	⬇️
...ava/io/opencmw/server/rest/RestServerSettings.java	80.00% <80.00%> (ø)
... and 14 more

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 701ec35...d8f7b11. Read the comment docs.

[wirew0rm]

Diff looks good, tested command line parameters and Java Properties as well as the MajordomoRestPlugin with the samples and extenal projects and everything seems to be working fine 👍