TH2-4347 vulnerabilities fix

.github/workflows/dev-docker-publish.yml

@@ -3,43 +3,17 @@ name: Dev build and publish Docker distributions to Github Container Registry gh
 on:
   push:
     branches-ignore:
-    - master
-    - version-*
+      - master
+      - version-*
+      - dependabot**
+    paths-ignore:
+      - README.md
 
 jobs:
-  build:
-    runs-on: ubuntu-20.04
-    steps:
-    - uses: actions/checkout@v2
-# Prepare custom build version
-    - name: Get branch name
-      id: branch
-      run: echo ::set-output name=branch_name::${GITHUB_REF#refs/*/}
-    - name: Get release_version
-      id: ver
-      uses: christian-draeger/read-properties@1.0.1
-      with:
-        path: gradle.properties
-        property: release_version
-    - name: Build custom release version
-      id: release_ver
-      run: echo ::set-output name=value::"${{ steps.ver.outputs.value }}-${{ steps.branch.outputs.branch_name }}-${{ github.run_id }}"
-    - name: Show custom release version
-      run: echo ${{ steps.release_ver.outputs.value }}
-# Build and publish image
-    - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@v1
-    - uses: docker/login-action@v1
-      with:
-        registry: ghcr.io
-        username: ${{ github.repository_owner }}
-        password: ${{ secrets.CR_PAT }}
-    - run: echo "::set-output name=REPOSITORY_NAME::$(echo '${{ github.repository }}' | awk -F '/' '{print $2}')"
-      id: meta
-    - name: Build and push
-      id: docker_build
-      uses: docker/build-push-action@v2
-      with:
-        push: true
-        tags: ghcr.io/${{ github.repository }}:${{ steps.release_ver.outputs.value }}
-        labels: com.exactpro.th2.${{ steps.meta.outputs.REPOSITORY_NAME }}=${{ steps.ver.outputs.value }}
+  build-job:
+    uses: th2-net/.github/.github/workflows/compound-java-dev.yml@main
+    with:
+      build-target: 'Docker'
+      docker-username: ${{ github.actor }}
+    secrets:
+      docker-password: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/docker-publish.yml

@@ -3,33 +3,18 @@ name: Build and publish Docker distributions to Github Container Registry ghcr.i
 on:
   push:
     branches:
-    - master
-    - version-*
+      - master
+      - version-*
+    paths:
+      - gradle.properties
+#    - package_info.json  
 
 jobs:
-  build:
-    runs-on: ubuntu-20.04
-    steps:
-    - uses: actions/checkout@v2
-    - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@v1
-    - uses: docker/login-action@v1
-      with:
-        registry: ghcr.io
-        username: ${{ github.repository_owner }}
-        password: ${{ secrets.CR_PAT }}
-    - run: echo "::set-output name=REPOSITORY_NAME::$(echo '${{ github.repository }}' | awk -F '/' '{print $2}')"
-      id: meta
-    - name: Read version from gradle.properties
-      id: read_property
-      uses: christian-draeger/read-properties@1.0.1
-      with:
-        path: ./gradle.properties
-        property: release_version
-    - name: Build and push
-      id: docker_build
-      uses: docker/build-push-action@v2
-      with:
-        push: true
-        tags: ghcr.io/${{ github.repository }}:${{ steps.read_property.outputs.value }}
-        labels: com.exactpro.th2.${{ steps.meta.outputs.REPOSITORY_NAME }}=${{ steps.read_property.outputs.value }}
+  build-job:
+    uses: th2-net/.github/.github/workflows/compound-java.yml@main
+    with:
+      build-target: 'Docker'
+      docker-username: ${{ github.actor }}
+    secrets:
+      docker-password: ${{ secrets.GITHUB_TOKEN }}
+

README.md

@@ -133,6 +133,8 @@ spec:
 ### 4.0.0
 
 + Migrated to `th2-codec` core part. Uses the standard configuration format and pins for th2-codec
++ Updated `bom`: `3.1.0` -> `4.1.0`
++ Updated `common`: `3.37.1` -> `3.44.0`
 
 ### 3.2.1
 

build.gradle

@@ -2,12 +2,11 @@ plugins {
     id 'java-library'
     id 'application'
     id 'com.palantir.docker' version '0.25.0'
-    id "org.owasp.dependencycheck" version "7.2.0"
+    id "org.owasp.dependencycheck" version "7.4.4"
 }
 
 dependencyCheck {
     format='HTML'
-    failBuildOnCVSS=5
 }
 
 ext {
@@ -56,13 +55,11 @@ jar {
 }
 
 dependencies {
-    api platform('com.exactpro.th2:bom:4.0.1')
+    api platform('com.exactpro.th2:bom:4.1.0')
 
-    implementation 'com.exactpro.th2:common:3.41.0'
+    implementation 'com.exactpro.th2:common:3.44.0'
     implementation 'com.exactpro.th2:codec:4.7.4'
 
-    implementation "org.slf4j:slf4j-api"
-
     implementation 'net.sourceforge.javacsv:javacsv:2.0'
     implementation 'org.jetbrains:annotations:23.0.0'
 

src/main/java/com/exactpro/th2/codec/csv/CodecFactory.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2022 Exactpro (Exactpro Systems Limited)
+ * Copyright 2023 Exactpro (Exactpro Systems Limited)
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.

src/main/java/com/exactpro/th2/codec/csv/CsvCodec.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2020-2022 Exactpro (Exactpro Systems Limited)
+ * Copyright 2020-2023 Exactpro (Exactpro Systems Limited)
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -89,6 +89,12 @@ public MessageGroup decode(@NotNull MessageGroup messageGroup) {
                 continue;
             }
             RawMessage rawMessage = anyMessage.getRawMessage();
+            String protocol = rawMessage.getMetadata().getProtocol();
+            if (!"".equals(protocol) && !"csv".equalsIgnoreCase(protocol)) {
+                LOGGER.error("Wrong protocol: message should have empty or 'csv' protocol but has {}", protocol);
+                continue;
+            }
+
             ByteString body = rawMessage.getBody();
             List<String[]> data = decodeValues(body);
             if (data.isEmpty()) {

src/main/java/com/exactpro/th2/codec/csv/cfg/CsvCodecConfiguration.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2020-2022 Exactpro (Exactpro Systems Limited)
+ * Copyright 2020-2023 Exactpro (Exactpro Systems Limited)
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.