Merge pull request #101 from viadee/development

Development
viadee · Jan 22, 2019 · 1e3b686 · 1e3b686
2 parents 7055b52 + 5458256
commit 1e3b686
Show file tree

Hide file tree

Showing 111 changed files with 5,262 additions and 5,850 deletions.
diff --git a/owasp-dependency-check-suppressions.xml b/owasp-dependency-check-suppressions.xml
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.1.xsd">
+    <suppress>
+      <notes>this vulnerability is in slf4j-ext-*.jar (org.slf4j.ext.EventData), which we don't have in classpath</notes>
+      <gav regex="true">^org\.slf4j:slf4j-api:.*$</gav>
+      <cve>CVE-2018-8088</cve>
+    </suppress>
+    <suppress>
+        <notes>this vulnerability is in slf4j-ext-*.jar (org.slf4j.ext.EventData), which we don't have in classpath</notes>
+        <gav regex="true">^org\.slf4j:slf4j-simple:.*$</gav>
+        <cve>CVE-2018-8088</cve>
+    </suppress>
+</suppressions>
diff --git a/pom.xml b/pom.xml
@@ -5,7 +5,7 @@
 	<groupId>de.viadee</groupId>
 	<artifactId>viadeeProcessApplicationValidator</artifactId>
 
-	<version>2.7.3</version>
+	<version>2.8.0-SNAPSHOT</version>
 
 	<name>viadee Process Application Validator</name>
 
@@ -183,18 +183,10 @@
 		<dependency>
 			<groupId>ca.mcgill.sable</groupId>
 			<artifactId>soot</artifactId>
-			<version>3.0.0-SNAPSHOT</version>
+			<version>3.2.0</version>
 		</dependency>
 	</dependencies>
 
-	<repositories>
-		<repository>
-			<id>soot-snapshot</id>
-			<name>soot snapshots</name>
-			<url>https://soot-build.cs.uni-paderborn.de/nexus/repository/soot-snapshot/</url>
-		</repository>
-	</repositories>
-
 	<profiles>
 		<profile>
 			<id>release-sign-artifacts</id>
@@ -342,8 +334,11 @@
 			<plugin>
 				<groupId>org.owasp</groupId>
 				<artifactId>dependency-check-maven</artifactId>
-				<version>3.3.4</version>
+				<version>4.0.2</version>
 				<configuration>
+					<suppressionFiles>
+						<suppressionFile>owasp-dependency-check-suppressions.xml</suppressionFile>
+					</suppressionFiles>
 					<failBuildOnCVSS>7</failBuildOnCVSS>
 				</configuration>
 				<executions>

diff --git a/src/main/java/de/viadee/bpm/vPAV/BpmnScanner.java b/src/main/java/de/viadee/bpm/vPAV/BpmnScanner.java
@@ -31,23 +31,17 @@
  */
 package de.viadee.bpm.vPAV;
 
-import java.io.IOException;
-import java.util.ArrayList;
-import java.util.HashMap;
-import java.util.Map;
+import de.viadee.bpm.vPAV.constants.BpmnConstants;
+import org.w3c.dom.*;
+import org.xml.sax.SAXException;
 
 import javax.xml.parsers.DocumentBuilder;
 import javax.xml.parsers.DocumentBuilderFactory;
 import javax.xml.parsers.ParserConfigurationException;
-
-import org.w3c.dom.Document;
-import org.w3c.dom.Element;
-import org.w3c.dom.NamedNodeMap;
-import org.w3c.dom.Node;
-import org.w3c.dom.NodeList;
-import org.xml.sax.SAXException;
-
-import de.viadee.bpm.vPAV.constants.BpmnConstants;
+import java.io.IOException;
+import java.util.ArrayList;
+import java.util.HashMap;
+import java.util.Map;
 
 public class BpmnScanner {
 

diff --git a/src/main/java/de/viadee/bpm/vPAV/FileScanner.java b/src/main/java/de/viadee/bpm/vPAV/FileScanner.java
@@ -31,22 +31,11 @@
  */
 package de.viadee.bpm.vPAV;
 
-import java.io.File;
-import java.net.URL;
-import java.net.URLClassLoader;
-import java.util.ArrayList;
-import java.util.Arrays;
-import java.util.Collection;
-import java.util.HashMap;
-import java.util.HashSet;
-import java.util.LinkedList;
-import java.util.Map;
-import java.util.Set;
-import java.util.logging.Level;
-import java.util.logging.Logger;
-import java.util.regex.Matcher;
-import java.util.regex.Pattern;
-
+import de.viadee.bpm.vPAV.config.model.Rule;
+import de.viadee.bpm.vPAV.config.model.Setting;
+import de.viadee.bpm.vPAV.constants.ConfigConstants;
+import de.viadee.bpm.vPAV.processing.ConfigItemNotFoundException;
+import de.viadee.bpm.vPAV.processing.checker.VersioningChecker;
 import org.apache.commons.io.FileUtils;
 import org.apache.commons.io.filefilter.DirectoryFileFilter;
 import org.apache.commons.io.filefilter.TrueFileFilter;
@@ -60,11 +49,14 @@
 import org.camunda.bpm.model.dmn.DmnModelInstance;
 import org.camunda.bpm.model.dmn.instance.Decision;
 
-import de.viadee.bpm.vPAV.config.model.Rule;
-import de.viadee.bpm.vPAV.config.model.Setting;
-import de.viadee.bpm.vPAV.constants.ConfigConstants;
-import de.viadee.bpm.vPAV.processing.ConfigItemNotFoundException;
-import de.viadee.bpm.vPAV.processing.checker.VersioningChecker;
+import java.io.File;
+import java.net.URL;
+import java.net.URLClassLoader;
+import java.util.*;
+import java.util.logging.Level;
+import java.util.logging.Logger;
+import java.util.regex.Matcher;
+import java.util.regex.Pattern;
 
 /**
  * scans maven project for files, which are necessary for the later analysis