From 101652effbf03aa8785cc6770b2cddabca86f10e Mon Sep 17 00:00:00 2001 From: meghfossa Date: Mon, 12 Feb 2024 11:53:10 -0700 Subject: [PATCH] wip: add example --- .github/workflows/ci.yml | 34 ++++++ .gitignore | 4 + .vscode/settings.json | 3 + README.md | 24 +++- pom.xml | 104 ++++++++++++++++++ src/main/java/com/example/app/App.java | 28 +++++ .../example/app/utils/SomeOtherReader.java | 25 +++++ src/test/java/com/example/app/AppTest.java | 12 ++ 8 files changed, 233 insertions(+), 1 deletion(-) create mode 100644 .github/workflows/ci.yml create mode 100644 .gitignore create mode 100644 .vscode/settings.json create mode 100644 pom.xml create mode 100644 src/main/java/com/example/app/App.java create mode 100644 src/main/java/com/example/app/utils/SomeOtherReader.java create mode 100644 src/test/java/com/example/app/AppTest.java diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml new file mode 100644 index 0000000..67eea06 --- /dev/null +++ b/.github/workflows/ci.yml @@ -0,0 +1,34 @@ +name: ci + +on: + push: + schedule: + - cron: '0 9 * * *' # Run every day at 9am UTC + +jobs: + build: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v4 + - name: Set up JDK 18 for x64 + uses: actions/setup-java@v3 + with: + java-version: '18' + distribution: 'temurin' + architecture: x64 + + - name: Install + run: mvn -B clean install + + - name: Package + run: mvn package + + - name: Install FOSSA CLI + run: | + curl -H 'Cache-Control: no-cache' https://raw.githubusercontent.com/fossas/fossa-cli/master/install-latest.sh | bash + + - name: Check FOSSA CLI Version + run: fossa -V + + - name: Run Analysis (in debug mode) (and output mode) + run: fossa analyze -o --debug \ No newline at end of file diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..8a86439 --- /dev/null +++ b/.gitignore @@ -0,0 +1,4 @@ +target +fossa.debug.json +fossa.debug.json.gz +fossa.telemetry.json \ No newline at end of file diff --git a/.vscode/settings.json b/.vscode/settings.json new file mode 100644 index 0000000..c5f3f6b --- /dev/null +++ b/.vscode/settings.json @@ -0,0 +1,3 @@ +{ + "java.configuration.updateBuildConfiguration": "interactive" +} \ No newline at end of file diff --git a/README.md b/README.md index f030892..df1666e 100644 --- a/README.md +++ b/README.md @@ -1 +1,23 @@ -# reachability-with-maven-example \ No newline at end of file +# reachability-with-maven-example + +This repository includes example project for reachability walkthrough. + +- You will need jdk8+ installed (`java` must be in PATH) +- You will need maven installed (`mvn` must be in PATH) + +```bash +# Install fossa-cli +; curl -H 'Cache-Control: no-cache' https://raw.githubusercontent.com/fossas/fossa-cli/master/install-latest.sh | bash + +# Check fossa-cli version +; fossa --version + +# Build project (required) +; mvn package + +# Run Analysis +# Docs: https://github.com/fossas/fossa-cli +; fossa analyze --project reachability-with-maven-example --fossa-api-key MY_FOSSA_API_KEY +``` + +You can also refer to example in our [CI](./.github/workflows/ci.yml). \ No newline at end of file diff --git a/pom.xml b/pom.xml new file mode 100644 index 0000000..7582dbf --- /dev/null +++ b/pom.xml @@ -0,0 +1,104 @@ + + + + 4.0.0 + + com.example.app + example + 1.1 + example-artifact-name + https://fossa.com + + + UTF-8 + 1.8 + 1.8 + + + + + Apache License, Version 2.0 + https://www.apache.org/licenses/LICENSE-2.0.txt + repo + A business-friendly OSS license + + + + + + + false + + central + Maven Repository Switchboard + http://repo1.maven.org/maven2 + + + + + + junit + junit + 4.11 + test + + + org.dom4j + dom4j + 2.1.0 + + + com.google.guava + guava + 28.1-jre + + + + + + + + + + maven-clean-plugin + 3.1.0 + + + + maven-resources-plugin + 3.0.2 + + + maven-compiler-plugin + 3.8.0 + + + maven-surefire-plugin + 2.22.1 + + + maven-jar-plugin + 3.0.2 + + + maven-install-plugin + 2.5.2 + + + maven-deploy-plugin + 2.8.2 + + + + maven-site-plugin + 3.7.1 + + + maven-project-info-reports-plugin + 3.0.0 + + + + + diff --git a/src/main/java/com/example/app/App.java b/src/main/java/com/example/app/App.java new file mode 100644 index 0000000..0d8bf83 --- /dev/null +++ b/src/main/java/com/example/app/App.java @@ -0,0 +1,28 @@ +package com.example.app; + +import java.net.URI; +import java.net.URL; +import com.example.app.utils.SomeOtherReader; + +// org.dom4j (CVE-2020-10683) +// --------------------------- +// dom4j before 2.0.3 and 2.1.x before 2.1.3 allows +// external DTDs and External Entities by default, which might enable XXE attacks +import org.dom4j.Document; +import org.dom4j.DocumentException; +import org.dom4j.io.SAXReader; + +public class App +{ + public static void main(String[] args) throws Exception { + URL url = new URI(args[0]).toURL(); + System.out.println(parse(url)); + System.out.println(SomeOtherReader.parse(url)); + } + + public static Document parse(URL url) throws DocumentException { + SAXReader reader = new SAXReader(); + Document document = reader.read(url); + return document; + } +} diff --git a/src/main/java/com/example/app/utils/SomeOtherReader.java b/src/main/java/com/example/app/utils/SomeOtherReader.java new file mode 100644 index 0000000..f4a8bb8 --- /dev/null +++ b/src/main/java/com/example/app/utils/SomeOtherReader.java @@ -0,0 +1,25 @@ +package com.example.app.utils; + +import java.net.URL; +import org.dom4j.Document; +import org.dom4j.DocumentException; +import org.dom4j.jaxb.JAXBReader; +import com.google.common.io.Files; +import com.google.common.base.Charsets; +import java.io.File; + +public class SomeOtherReader +{ + @SuppressWarnings("deprecation") + public static Document parse(URL url) throws DocumentException, java.io.IOException { + // Example usage of com.google.common.io.* + File addrFile = new File("config.txt"); + String missingFileContent = Files.toString(addrFile, Charsets.UTF_8); + System.out.println(missingFileContent); + + // Example usage of org.dom4j.jaxb.JAXBReader + JAXBReader reader = new JAXBReader("some context path that is incorrect"); + Document document = reader.read(url); + return document; + } +} diff --git a/src/test/java/com/example/app/AppTest.java b/src/test/java/com/example/app/AppTest.java new file mode 100644 index 0000000..fa5fd35 --- /dev/null +++ b/src/test/java/com/example/app/AppTest.java @@ -0,0 +1,12 @@ +package com.example.app; +import static org.junit.Assert.assertTrue; +import org.junit.Test; + +public class AppTest +{ + @Test + public void shouldAnswerWithTrue() + { + assertTrue(true); + } +}