Skip to content

Commit 5cccb30

Browse files
author
Grahame Grieve
committed
Merge remote-tracking branch 'origin/master'
2 parents 47a264c + 87b1904 commit 5cccb30

12 files changed

+321
-35
lines changed

‎.github/workflows/codeql.yml

+82
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
# For most projects, this workflow file will not need changing; you simply need
2+
# to commit it to your repository.
3+
#
4+
# You may wish to alter this file to override the set of languages analyzed,
5+
# or to provide custom queries or build logic.
6+
#
7+
# ******** NOTE ********
8+
# We have attempted to detect the languages in your repository. Please check
9+
# the `language` matrix defined below to confirm you have the correct set of
10+
# supported CodeQL languages.
11+
#
12+
name: "CodeQL"
13+
14+
on:
15+
push:
16+
branches: [ "master" ]
17+
pull_request:
18+
# The branches below must be a subset of the branches above
19+
branches: [ "master" ]
20+
schedule:
21+
- cron: '18 18 * * 1'
22+
23+
jobs:
24+
analyze:
25+
name: Analyze
26+
# Runner size impacts CodeQL analysis time. To learn more, please see:
27+
# - https://gh.io/recommended-hardware-resources-for-running-codeql
28+
# - https://gh.io/supported-runners-and-hardware-resources
29+
# - https://gh.io/using-larger-runners
30+
# Consider using larger runners for possible analysis time improvements.
31+
runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }}
32+
timeout-minutes: ${{ (matrix.language == 'swift' && 120) || 360 }}
33+
permissions:
34+
actions: read
35+
contents: read
36+
security-events: write
37+
38+
strategy:
39+
fail-fast: false
40+
matrix:
41+
language: [ 'java' ]
42+
# CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby', 'swift' ]
43+
# Use only 'java' to analyze code written in Java, Kotlin or both
44+
# Use only 'javascript' to analyze code written in JavaScript, TypeScript or both
45+
# Learn more about CodeQL language support at https://aka.ms/codeql-docs/language-support
46+
47+
steps:
48+
- name: Checkout repository
49+
uses: actions/checkout@v4
50+
51+
# Initializes the CodeQL tools for scanning.
52+
- name: Initialize CodeQL
53+
uses: github/codeql-action/init@v3
54+
with:
55+
languages: ${{ matrix.language }}
56+
# If you wish to specify custom queries, you can do so here or in a config file.
57+
# By default, queries listed here will override any specified in a config file.
58+
# Prefix the list here with "+" to use these queries and those in the config file.
59+
60+
# For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
61+
# queries: security-extended,security-and-quality
62+
63+
64+
# Autobuild attempts to build any compiled languages (C/C++, C#, Go, Java, or Swift).
65+
# If this step fails, then you should remove it and run the build manually (see below)
66+
- name: Autobuild
67+
uses: github/codeql-action/autobuild@v3
68+
69+
# ℹ️ Command-line programs to run using the OS shell.
70+
# 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
71+
72+
# If the Autobuild fails above, remove it and uncomment the following three lines.
73+
# modify them (or add more) to build your code if your project, please refer to the EXAMPLE below for guidance.
74+
75+
# - run: |
76+
# echo "Run, Build Application using script"
77+
# ./location_of_script_within_repo/buildscript.sh
78+
79+
- name: Perform CodeQL Analysis
80+
uses: github/codeql-action/analyze@v3
81+
with:
82+
category: "/language:${{matrix.language}}"

‎.github/workflows/owasp.yml

+32
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
on:
2+
push:
3+
branches: [ "master" ]
4+
pull_request:
5+
branches: [ "master" ]
6+
7+
workflow_dispatch:
8+
9+
jobs:
10+
analyze:
11+
name: Analyze
12+
runs-on: ubuntu-latest
13+
14+
steps:
15+
- name: Checkout repository
16+
uses: actions/checkout@v4
17+
18+
- env:
19+
NVD_API_KEY:
20+
${{ secrets.NVD_API_KEY }}
21+
run: |
22+
mvn -DskipTests install -P OWASP_CHECK
23+
24+
- name: Upload SARIF file
25+
uses: github/codeql-action/upload-sarif@v3
26+
with:
27+
# Path to SARIF file relative to the root of the repository
28+
sarif_file: target/dependency-check-report.sarif
29+
# Optional category for the results
30+
# Used to differentiate multiple results for one commit
31+
32+
category: OWASP-dependency-check

‎.github/workflows/trivy.yml

+39
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,39 @@
1+
name: Trivy Security Scans
2+
3+
on:
4+
push:
5+
branches: [ "master" ]
6+
pull_request:
7+
branches: [ "master" ]
8+
9+
workflow_dispatch:
10+
11+
jobs:
12+
build:
13+
name: build
14+
runs-on: ubuntu-latest
15+
steps:
16+
- name: Checkout code
17+
uses: actions/checkout@v4
18+
19+
- name: Run static analysis
20+
uses: aquasecurity/trivy-action@master
21+
env:
22+
# temporary workaround for rate limiting on github
23+
TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db
24+
TRIVY_JAVA_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-java-db
25+
with:
26+
scan-type: 'fs'
27+
vuln-type: 'library'
28+
scanners: 'vuln,secret,config'
29+
ignore-unfixed: true
30+
format: 'sarif'
31+
output: 'trivy-results.sarif'
32+
severity: 'MEDIUM,HIGH,CRITICAL'
33+
34+
35+
- name: Upload Trivy scan results to GitHub Security tab
36+
uses: github/codeql-action/upload-sarif@v3
37+
with:
38+
sarif_file: 'trivy-results.sarif'
39+
category: 'code'

‎SECURITY.md

+9
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
# Security Policy
2+
3+
## Supported Versions
4+
5+
Only new releases of this project will contain security updates. All clients should use the latest version of this project in their dependencies. There is no process in place to backport security fixes to previous releases. If you require a backport, please [create an issue](../../issues/new/choose) containing an explanation of why the latest version cannot be used.
6+
7+
## Reporting Vulnerabilities
8+
9+
Please report all potential security vulnerabilities using the [Report a vulnerability](../../security/advisories/new) button in the [Security](../../security) section of this repository.

‎checkstyle.xml

+59
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
<?xml version="1.0"?>
2+
<!DOCTYPE module PUBLIC
3+
"-//Puppy Crawl//DTD Check Configuration 1.3//EN"
4+
"http://www.puppycrawl.com/dtds/configuration_1_3.dtd">
5+
6+
<module name="Checker">
7+
8+
<property name="severity" value="error"/>
9+
<property name="charset" value="UTF-8"/>
10+
<property name="fileExtensions" value="java, properties, xml, js, json"/>
11+
<module name="TreeWalker">
12+
<!--
13+
<module name="TodoComment">-->
14+
<!-- The (?i) below means Case Insensitive -->
15+
<!--<property name="format" value="(?i)FIXME"/>
16+
-->
17+
<module name="RegexpSinglelineJava">
18+
<property name="format" value="org\.jetbrains\.annotations\.NotNull"/>
19+
</module>
20+
<module name="RegexpSinglelineJava">
21+
<property name="format" value="org\.jetbrains\.annotations\.Nullable"/>
22+
</module>
23+
<module name="RegexpSinglelineJava">
24+
<property name="format" value="org\.jetbrains\.annotations\.\*"/>
25+
</module>
26+
</module>
27+
<module name="RegexpMultiline">
28+
<property name="id" value="transformerFactoryNewInstance"/>
29+
<property name="matchAcrossLines" value="true"/>
30+
<property name="format" value="TransformerFactory\.newInstance\("/>
31+
<property name="message"
32+
value="Usage of TransformerFactory.newInstance() is not permitted. If you require this constructor, please add an XXE protected usage to XMLUtils and add the line number to checkstyle_suppressions.xml"
33+
/>
34+
</module>
35+
<module name="RegexpMultiline">
36+
<property name="id" value="documentBuilderFactoryNewInstance"/>
37+
<property name="matchAcrossLines" value="true"/>
38+
<property name="format" value="DocumentBuilderFactory\.newInstance\("/>
39+
<property name="message"
40+
value="Usage of DocumentBuilderFactory.newInstance() is only allowed in XMLUtils.parseDOM(InputStream stream). If the location of this call in XMLUtils has changed, please modify the expected line number in checkstyle_suppressions.xml"
41+
/>
42+
</module>
43+
<module name="RegexpMultiline">
44+
<property name="id" value="saxParserFactoryNewInstance"/>
45+
<property name="matchAcrossLines" value="true"/>
46+
<property name="format" value="SAXParserFactory\.newInstance\("/>
47+
<property name="message"
48+
value="Usage of SAXParserFactory.newInstance() is not permitted. If you require this constructor, please add an XXE protected usage to XMLUtils and add the line number to checkstyle_suppressions.xml"
49+
/>
50+
</module>
51+
<module name="RegexpMultiline">
52+
<property name="id" value="getXMLReader"/>
53+
<property name="matchAcrossLines" value="true"/>
54+
<property name="format" value="\.getXMLReader\("/>
55+
<property name="message"
56+
value="Usage of SAXParserFactory.getXMLReader() is not permitted. If you require this constructor, please add an XXE protected usage to XMLUtils and add the line number to checkstyle_suppressions.xml"
57+
/>
58+
</module>
59+
</module>

‎checkstyle_suppressions.xml

+8
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
<?xml version="1.0"?>
2+
<!DOCTYPE suppressions PUBLIC
3+
"-//Checkstyle//DTD SuppressionFilter Configuration 1.2//EN"
4+
"https://checkstyle.org/dtds/suppressions_1_2.dtd">
5+
6+
<suppressions>
7+
<suppress id="documentBuilderFactoryNewInstance" files="/src/main/java/org/fhir/ucum/utils/XmlUtils.java" lines="20"/>
8+
</suppressions>

‎master-branch-pipeline.yml

+4-4
Original file line numberDiff line numberDiff line change
@@ -54,11 +54,11 @@ steps:
5454
displayName: 'Create .mvn/settings.xml'
5555
5656
# Runs 'mvn package'
57-
- task: Maven@3
57+
- task: Maven@4
5858
inputs:
5959
mavenPomFile: 'pom.xml'
6060
mavenOptions: '-Xmx3072m'
61-
options: '--settings $(System.DefaultWorkingDirectory)/settings.xml'
61+
options: '--settings $(System.DefaultWorkingDirectory)/settings.xml -P CHECKSTYLE'
6262
javaHomeOption: 'JDKVersion'
6363
jdkVersionOption: '1.11'
6464
jdkArchitectureOption: 'x64'
@@ -89,7 +89,7 @@ steps:
8989
9090
# Deploy the SNAPSHOT artifact to sonatype nexus.
9191
# This is done for the master branch merges only.
92-
- task: Maven@3
92+
- task: Maven@4
9393
displayName: 'Deploy to Sonatype staging'
9494
inputs:
9595
mavenPomFile: '$(System.DefaultWorkingDirectory)/pom.xml'
@@ -99,7 +99,7 @@ steps:
9999

100100
# Deploy the SNAPSHOT artifact to GitHub packages.
101101
# This is done for the master branch merges only.
102-
- task: Maven@3
102+
- task: Maven@4
103103
displayName: 'Deploy to GitHub Packages'
104104
inputs:
105105
mavenPomFile: '$(System.DefaultWorkingDirectory)/pom.xml'

‎owasp-suppression-file.xml

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">
3+
</suppressions>

0 commit comments

Comments
 (0)