diff --git a/dependency-check-suppression.xml b/dependency-check-suppression.xml index b4f1abf0..ac33a5ca 100644 --- a/dependency-check-suppression.xml +++ b/dependency-check-suppression.xml @@ -45,20 +45,12 @@ CVE-2019-0232 - + CVE-2018-1258 - - - CVE-2019-14379 - CVE-2018-19362 - CVE-2018-19361 - CVE-2018-19360 diff --git a/pom.xml b/pom.xml index ef4eebfc..1d3a7162 100644 --- a/pom.xml +++ b/pom.xml @@ -57,7 +57,7 @@ please see org.camunda.bpm.springboot.project:camunda-bpm-spring-boot-starter-root --> 7.10.0 - 3.2.7 + 3.2.8 2.2.2.RELEASE @@ -256,7 +256,7 @@ org.owasp dependency-check-maven - 5.2.2 + 5.2.4 8 ALL diff --git a/scb-engine/pom.xml b/scb-engine/pom.xml index 09f3631e..cd04aae2 100644 --- a/scb-engine/pom.xml +++ b/scb-engine/pom.xml @@ -35,6 +35,12 @@ 2.2.2.RELEASE + + org.springframework.security + spring-security-core + 5.2.1.RELEASE + + io.springfox springfox-swagger2 @@ -65,6 +71,7 @@ org.camunda.spin camunda-spin-dataformat-all + 1.7.5 @@ -83,6 +90,22 @@ tomcat-jdbc + + org.apache.tomcat.embed + tomcat-embed-core + 9.0.30 + + + org.apache.tomcat.embed + tomcat-embed-el + 9.0.30 + + + org.apache.tomcat.embed + tomcat-embed-websocket + 9.0.30 + + io.securecodebox.persistenceproviders empty-persistenceprovider diff --git a/scb-persistenceproviders/defectdojo-persistenceprovider/src/main/java/io/securecodebox/persistence/DefectDojoService.java b/scb-persistenceproviders/defectdojo-persistenceprovider/src/main/java/io/securecodebox/persistence/DefectDojoService.java index 1355f2c8..4d70f3ae 100644 --- a/scb-persistenceproviders/defectdojo-persistenceprovider/src/main/java/io/securecodebox/persistence/DefectDojoService.java +++ b/scb-persistenceproviders/defectdojo-persistenceprovider/src/main/java/io/securecodebox/persistence/DefectDojoService.java @@ -262,7 +262,12 @@ private Optional getTestIdByEngagementName(long engagementId, String testN .queryParam("engagement", Long.toString(engagementId)) .queryParam("limit", Long.toString(50L)) .queryParam("offset", Long.toString(offset)); - if(testName!= null) builder.queryParam("testType", testName); + if(testName == null) { + LOG.warn("TestName must be set unique, e.g. with time"); + return Optional.empty(); + } else { + builder.queryParam("testType", testName); + } RestTemplate restTemplate = new RestTemplate(); HttpEntity engagementRequest = new HttpEntity(getHeaders()); @@ -285,6 +290,51 @@ private Optional getTestIdByEngagementName(long engagementId, String testN LOG.warn("Test with name '{}' not found.", testName); return Optional.empty(); } + /* + * Be aware that using latest might results in "conflicting" "latest" in case a new test is added while requesting latest + */ + public Optional getLatestTestIdByEngagementName(String engagementName, String productName, String testName, long offset) { + Optional optionalEngagementId = getEngagementIdByEngagementName(engagementName, productName); + if(!optionalEngagementId.isPresent()) { + LOG.warn("engagementName with name '{}' not found.", engagementName); + return Optional.empty(); + } + Long engagementId = optionalEngagementId.get(); + UriComponentsBuilder builder = UriComponentsBuilder.fromHttpUrl(defectDojoUrl + "/api/v2/tests") + .queryParam("engagement", Long.toString(engagementId)) + .queryParam("limit", Long.toString(50L)) + .queryParam("offset", Long.toString(offset)); + if(testName != null) builder.queryParam("testType", testName); + + RestTemplate restTemplate = new RestTemplate(); + HttpEntity engagementRequest = new HttpEntity(getHeaders()); + + ResponseEntity> response = restTemplate.exchange(builder.toUriString(), HttpMethod.GET, engagementRequest, new ParameterizedTypeReference>(){}); + + Optional testResponseId = null; + for(TestResponse test : response.getBody().getResults()){ + if(testResponseId == null || test.getId() > testResponseId.get()) { + testResponseId = Optional.of(test.getId()); + } + } + + if(response.getBody().getNext() != null){ + Optional subOptionalTestResponseId = getTestIdByEngagementName(engagementId, testName, offset + 1); + if(testResponseId == null || + (subOptionalTestResponseId.isPresent()) && + subOptionalTestResponseId.get() > testResponseId.get() + ) { + testResponseId = subOptionalTestResponseId; + } + } + if(testResponseId != null) { + return testResponseId; + } + + LOG.warn("Test with name '{}' not found.", testName); + return Optional.empty(); + } + private EngagementResponse createTest(TestPayload testPayload) { RestTemplate restTemplate = new RestTemplate();