[PRODSEC-8961] fix for commons-net vulnerability

[PRODSEC-9043] fix for maven-core vulnerability (#669 )
[PRODSEC-8959] fix for zt-zip vulnerability (#668 )
2025-09-10 14:12:12 +00:00 · 2024-06-12 16:09:49 +05:30 · 2024-06-11 16:50:41 +05:30 · 2024-06-07 13:22:30 +05:30 · 2024-05-31 15:41:28 +05:30 · 2024-05-28 12:40:18 +05:30
11 changed files with 48 additions and 35 deletions
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -28,6 +28,23 @@ jobs:
    steps:
      - uses: Alfresco/alfresco-build-tools/.github/actions/pre-commit@v1.35.0

+  veracode_sca:
+    name: "Veracode - Source Clear Scan (SCA)"
+    runs-on: ubuntu-latest
+    if: >
+      github.ref_name == 'master' ||
+      github.event_name == 'pull_request'
+    steps:
+      - uses: actions/checkout@v3
+      - uses: Alfresco/alfresco-build-tools/.github/actions/get-build-info@v1.34.0
+      - uses: Alfresco/alfresco-build-tools/.github/actions/setup-java-build@v1.34.0
+      - name: "Clean-up SNAPSHOT artifacts"
+        run: find "${HOME}/.m2/repository/" -type d -name "*-SNAPSHOT*" | xargs -r -l rm -rf
+      - uses: Alfresco/alfresco-build-tools/.github/actions/veracode@v1.34.0
+        continue-on-error: true
+        with:
+          srcclr-api-token: ${{ secrets.SRCCLR_API_TOKEN }}
+
  build:
    name: "Build application"
    runs-on: ubuntu-latest
--- a/archetypes/alfresco-allinone-archetype/pom.xml
+++ b/archetypes/alfresco-allinone-archetype/pom.xml
@@ -11,7 +11,7 @@
  <parent>
    <groupId>org.alfresco.maven</groupId>
    <artifactId>alfresco-sdk-aggregator</artifactId>
-    <version>4.8.0</version>
+    <version>4.9.0-SNAPSHOT</version>
    <relativePath>../../pom.xml</relativePath>
  </parent>

--- a/archetypes/alfresco-allinone-archetype/src/main/resources/archetype-resources/rootArtifactId-platform-docker/src/main/docker/Dockerfile
+++ b/archetypes/alfresco-allinone-archetype/src/main/resources/archetype-resources/rootArtifactId-platform-docker/src/main/docker/Dockerfile
@@ -14,10 +14,16 @@ RUN java -jar $TOMCAT_DIR/alfresco-mmt/alfresco-mmt*.jar install \
              $TOMCAT_DIR/amps $TOMCAT_DIR/webapps/alfresco -directory -nobackup -force

 COPY alfresco-global.properties $TOMCAT_DIR/shared/classes/alfresco-global.properties
-COPY dev-log4j2.properties $TOMCAT_DIR/shared/classes/alfresco/extension
+COPY dev-log4j2.properties $TOMCAT_DIR/shared/classes/alfresco/extension/dev-log4j2.properties
 COPY disable-webscript-caching-context.xml $TOMCAT_DIR/shared/classes/alfresco/extension

 # Copy Dockerfile to avoid an error if no license file exists
 COPY Dockerfile license/*.* $TOMCAT_DIR/webapps/alfresco/WEB-INF/classes/alfresco/extension/license/

+# Move the log file
+RUN sed -i -e "s_appender.rolling.fileName\=alfresco.log_appender.rolling.fileName\=${TOMCAT_DIR}/logs\/alfresco.log_" \
+        ${TOMCAT_DIR}/shared/classes/alfresco/extension/dev-log4j2.properties && \
+    sed -i -e "s_appender.rolling.filePattern=alfresco.log.%d{yyyy-MM-dd}_appender.rolling.filePattern\=${TOMCAT_DIR}/logs\/alfresco.log.%d{yyyy-MM-dd}_" \
+        ${TOMCAT_DIR}/shared/classes/alfresco/extension/dev-log4j2.properties
+
 USER ${USERNAME}
--- a/archetypes/alfresco-allinone-archetype/src/main/resources/archetype-resources/rootArtifactId-platform-docker/src/main/docker/dev-log4j2.properties
+++ b/archetypes/alfresco-allinone-archetype/src/main/resources/archetype-resources/rootArtifactId-platform-docker/src/main/docker/dev-log4j2.properties
@@ -1,19 +1,11 @@
-#set( $symbol_pound = '#' )
-#set( $symbol_dollar = '$' )
-#set( $symbol_escape = '\' )
-# Set root logger level to error
-#log4j2.rootLogger=error, Console, File
 rootLogger.level=error
 rootLogger.appenderRef.stdout.ref=ConsoleAppender
 rootLogger.appenderRef.rolling.ref=RollingAppender

-
 # All outputs currently set to be a ConsoleAppender.
 appender.console.type=Console
 appender.console.name=ConsoleAppender
 appender.console.layout.type=PatternLayout
-appender.console.layout.pattern=%d{ISO8601} %x %-5p [%c{3}] [%t] %replace{%m}{[\r\n]+}{}%n
-
 # use log4j NDC to replace %x with tenant domain / username
 appender.console.layout.pattern=%d{ISO8601} %x %-5p [%c{3}] [%t] %replace{%m}{[\r\n]+}{}%n

@@ -206,10 +198,6 @@ logger.alfresco-repo-node-db-NodeStringLengthWorker.level=info
 logger.alfresco-repo-workflow.name=org.alfresco.repo.workflow
 logger.alfresco-repo-workflow.level=info

-# CIFS server debugging
-logger.alfresco-smb.protocol.name=org.alfresco.smb.protocol
-logger.alfresco-smb.protocol.level=error
-
 # FTP server debugging
 logger.alfresco-ftp-protocol.name=org.alfresco.ftp.protocol
 logger.alfresco-ftp-protocol.level=error
@@ -368,7 +356,6 @@ logger.alfresco-repo-domain-schema-script-DeleteNotExistsExecutor.level=off
 logger.alfresco-repo-search-impl-solr-facet-SolrFacetServiceImpl.name=org.alfresco.repo.search.impl.solr.facet.SolrFacetServiceImpl
 logger.alfresco-repo-search-impl-solr-facet-SolrFacetServiceImpl.level=info

-
 # Bulk Filesystem Import Tool
 logger.alfresco-repo-bulkimport.name=org.alfresco.repo.bulkimport
 logger.alfresco-repo-bulkimport.level=warn
@@ -386,9 +373,6 @@ logger.alfresco-repo-content-metadata-AbstractMappingMetadataExtracter.level=war
 logger.apache-pdfbox-pdmodel-font-PDSimpleFont.name=org.apache.pdfbox.pdmodel.font.PDSimpleFont
 logger.apache-pdfbox-pdmodel-font-PDSimpleFont.level=fatal

-logger.apache-pdfbox-pdmodel-font-PDFont.name=org.apache.pdfbox.pdmodel.font.PDFont
-logger.apache-pdfbox-pdmodel-font-PDFont=fatal
-
 logger.apache-pdfbox-pdmodel-font-PDCIDFont.name=org.apache.pdfbox.pdmodel.font.PDCIDFont
 logger.apache-pdfbox-pdmodel-font-PDCIDFont.level=fatal

@@ -398,7 +382,6 @@ logger.alfresco-repo-search-impl-noindex-NoIndexIndexer.level=fatal

 logger.alfresco-repo-search-impl-noindex-NoIndexSearchService.name=org.alfresco.repo.search.impl.noindex.NoIndexSearchService
 logger.alfresco-repo-search-impl-noindex-NoIndexSearchService.level=fatal
-.

 # lucene index warnings
 logger.alfresco-repo-search-impl-lucene-index-IndexInfo.name=org.alfresco.repo.search.impl.lucene.index.IndexInfo
@@ -421,10 +404,9 @@ logger.alfresco-enterprise-repo-authorization-AuthorizationsConsistencyMonitor.l
 #-----------------------------------------------------------------------
 # Platform module logging
 #-----------------------------------------------------------------------
-logger.${package}-platformsample-DemoComponent.name=${package}.platformsample.DemoComponent
-logger.${package}-platformsample-DemoComponent.level=debug
-logger.${package}-platformsample-HelloWorldWebScript.name=${package}.platformsample.HelloWorldWebScript
-logger.${package}-platformsample-HelloWorldWebScript.level=debug
-
+logger.platformsample-DemoComponent.name=${package}.platformsample.DemoComponent
+logger.platformsample-DemoComponent.level=debug
+logger.platformsample-HelloWorldWebScript.name=${package}.platformsample.HelloWorldWebScript
+logger.platformsample-HelloWorldWebScript.level=debug


--- a/archetypes/alfresco-platform-jar-archetype/pom.xml
+++ b/archetypes/alfresco-platform-jar-archetype/pom.xml
@@ -12,7 +12,7 @@
  <parent>
    <groupId>org.alfresco.maven</groupId>
    <artifactId>alfresco-sdk-aggregator</artifactId>
-    <version>4.8.0</version>
+    <version>4.9.0-SNAPSHOT</version>
    <relativePath>../../pom.xml</relativePath>
  </parent>

--- a/archetypes/alfresco-share-jar-archetype/pom.xml
+++ b/archetypes/alfresco-share-jar-archetype/pom.xml
@@ -14,7 +14,7 @@
    <parent>
        <groupId>org.alfresco.maven</groupId>
        <artifactId>alfresco-sdk-aggregator</artifactId>
-        <version>4.8.0</version>
+        <version>4.9.0-SNAPSHOT</version>
        <relativePath>../../pom.xml</relativePath>
    </parent>

--- a/archetypes/archetypes-it/pom.xml
+++ b/archetypes/archetypes-it/pom.xml
@@ -17,7 +17,7 @@
    <parent>
        <groupId>org.alfresco.maven</groupId>
        <artifactId>alfresco-sdk-aggregator</artifactId>
-        <version>4.8.0</version>
+        <version>4.9.0-SNAPSHOT</version>
        <relativePath>../../pom.xml</relativePath>
    </parent>

--- a/modules/alfresco-rad/pom.xml
+++ b/modules/alfresco-rad/pom.xml
@@ -10,7 +10,7 @@
    <parent>
        <groupId>org.alfresco.maven</groupId>
        <artifactId>alfresco-sdk-aggregator</artifactId>
-        <version>4.8.0</version>
+        <version>4.9.0-SNAPSHOT</version>
        <relativePath>../../pom.xml</relativePath>
    </parent>

--- a/plugins/alfresco-maven-plugin/pom.xml
+++ b/plugins/alfresco-maven-plugin/pom.xml
@@ -8,7 +8,7 @@
    <parent>
        <groupId>org.alfresco.maven</groupId>
        <artifactId>alfresco-sdk-aggregator</artifactId>
-        <version>4.8.0</version>
+        <version>4.9.0-SNAPSHOT</version>
        <relativePath>../../pom.xml</relativePath>
    </parent>

@@ -92,7 +92,7 @@
        <dependency>
            <groupId>org.codehaus.plexus</groupId>
            <artifactId>plexus-archiver</artifactId>
-            <version>3.4</version>
+            <version>4.9.2</version>
        </dependency>
        <dependency>
            <groupId>org.apache.maven</groupId>
@@ -102,7 +102,7 @@
        <dependency>
            <groupId>org.apache.maven</groupId>
            <artifactId>maven-core</artifactId>
-            <version>3.2.5</version>
+            <version>3.9.7</version>
        </dependency>
        <dependency>
            <groupId>org.apache.httpcomponents</groupId>
@@ -112,7 +112,7 @@
        <dependency>
            <groupId>commons-net</groupId>
            <artifactId>commons-net</artifactId>
-            <version>3.6</version>
+            <version>3.10.0</version>
        </dependency>
        <dependency>
            <groupId>commons-io</groupId>
@@ -127,7 +127,12 @@
        <dependency>
            <groupId>org.alfrescolabs.alfresco-technical-validation</groupId>
            <artifactId>org.alfrescolabs.alfresco-technical-validation</artifactId>
-            <version>0.4.0</version>
+            <version>0.6.0</version>
+        </dependency>
+        <dependency>
+            <groupId>commons-lang</groupId>
+            <artifactId>commons-lang</artifactId>
+            <version>2.6</version>
        </dependency>
        <dependency>
            <groupId>org.twdata.maven</groupId>
@@ -138,7 +143,7 @@
        <dependency>
            <groupId>org.zeroturnaround</groupId>
            <artifactId>zt-zip</artifactId>
-            <version>1.11</version>
+            <version>1.17</version>
        </dependency>
        <dependency>
            <groupId>de.schlichtherle.truezip</groupId>
--- a/pom.xml
+++ b/pom.xml
@@ -3,7 +3,7 @@
    <modelVersion>4.0.0</modelVersion>
    <groupId>org.alfresco.maven</groupId>
    <artifactId>alfresco-sdk-aggregator</artifactId>
-    <version>4.8.0</version>
+    <version>4.9.0-SNAPSHOT</version>
    <name>Alfresco SDK</name>
    <description>This aggregator Project builds all modules required for the Alfresco SDK</description>
    <packaging>pom</packaging>
--- a/srcclr.yml
+++ b/srcclr.yml
@@ -0,0 +1,3 @@
+# To avoid the provided dependencies we set the scope to runtime. See: https://docs.veracode.com/r/c_sc_scan_directives
+# runtime: to restrict the scan to compile and runtime dependencies.
+scope: runtime
Author	SHA1	Message	Date
pmm	869446e1df	[PRODSEC-8961] fix for commons-net vulnerability	2024-06-12 16:09:49 +05:30
purusothaman-mm	9521f6ef42	[PRODSEC-9043] fix for maven-core vulnerability (#669 )	2024-06-11 16:50:41 +05:30
purusothaman-mm	0a0039dcb0	[PRODSEC-8959] fix for zt-zip vulnerability (#668 )	2024-06-07 13:22:30 +05:30
purusothaman-mm	2c29c915d4	fix for alfresco security issues (#667 )	2024-05-31 15:41:28 +05:30
Manish Kumar	7878155ed9	[PRODSEC-9051] updated plexus archiver version from 3.4 to 4.9.2 (#666 )	2024-05-28 12:40:18 +05:30
pmm	7aa6400210	Revert "[PRODSEC-9046] fix for sdk vulnerability (#665 )" This reverts commit `cc0955e012`.	2024-05-27 15:14:03 +05:30
purusothaman-mm	cc0955e012	[PRODSEC-9046] fix for sdk vulnerability (#665 )	2024-05-22 14:41:47 +05:30
purusothaman-mm	2899b205ba	[MNT-24306] Added fix for log4j2 config issue (#664 ) * [MNT-24306] Added Fix for Log4j2 issue * [MNT-24306] Added Fix for Log4j2 issue * [MNT-24306] Added Fix for Log4j2 issue * [MNT-24306] fix for the log4j2 config * [MNT-24306] Added Fix for Log4j2 issue --------- Co-authored-by: suneet-gupta <suneet.gupta@hyland.com>	2024-05-16 12:39:01 +05:30
Marcin Strankowski	340785180d	Merge pull request #662 from Alfresco/feature/add_agent_based_scanning SCA setup	2024-04-04 15:49:03 +02:00
mstrankowski	2bc06e4222	SCA setup	2024-04-04 15:01:34 +02:00
Suneet Gupta	4f70d0f575	Merge pull request #660 from Alfresco/PRODDEL-7832-UpdateSnapshot [PRODDEL-7832] Switched to 4.9.0-SNAPSHOT	2024-03-06 17:06:20 +05:30
Manish Kumar	fd106b13c7	[PRODDEL-7832] Switched to 4.9.0-SNAPSHOT	2024-03-06 16:44:13 +05:30