+ * All committed: + * local + * tag "v1.0.0-client" will be lead to "1.0.0-l20181108071705" + * tag "v1.1.0-server" will be lead to "1.1.0-l20181108071705" + * + * commit:"aebcd" will lead to "0.0.0-aebcd" + * build server (BUILD_NUMBER set) + * tag "v1.0.0-client" will be lead to "1.0.0-b123" + * tag "v1.1.0-server" will be lead to "1.1.0-b123" + * + * commit:"aebcd" will lead to "0.0.0-aebcd-b123" + * + * + * Additional change: + * local (no BUILD_NUMBER set) + * former tag "v1.0.0-client" will lead for example to "1.0.0-dirty-l1540999578066" + * former commit:"aebcd" will lead for example to "0.0.0-aebcd-dirty-l1540999578066" + * build server (BUILD_NUMBER set) + * former tag "v1.0.0-client" will lead for example to "1.0.0-dirty-l1540999578066" + * former commit:"aebcd" will lead for example to "0.0.0-aebcd-dirty-l1540999578066" + *+ */ +def buildVersionString(commitTag, boolean hasChanged, buildNumber){ + def calcversion = "" + if (commitTag == null) { + calcversion="0.0.0-${git.head().abbreviatedId}" + } else { + calcversion = commitTag.name - 'v' + // remove identifiers for server, client, .. + calcversion=calcversion-"-server" + calcversion=calcversion-"-client" + + } + if (hasChanged){ + calcversion="${calcversion}-dirty"; + } + calcversion="${calcversion}-${buildNumber}"; + return calcversion +} + +def getBuildNr(){ + if (getServerBuildNr()!=null){ + return "b"+getServerBuildNr() + }else{ + if (project.hasProperty('sechub.build.timestamp')){ + if (project.getProperty('sechub.build.timestamp')=="false"){ + return "latest" + } + } + return getLocalBuildNr() + } +} + +def getServerBuildNr(){ + return System.getenv('BUILD_NUMBER' ) +} + +def getLocalBuildNr() { + return new Date().format('yyyyMMddHHmmss') +} + diff --git a/build.gradle b/build.gradle new file mode 100644 index 0000000000..d85c8a4a17 --- /dev/null +++ b/build.gradle @@ -0,0 +1,55 @@ +// SPDX-License-Identifier: MIT +buildscript{ + + apply from: "${rootProject.projectDir}/libraries.gradle" + apply from: "${rootProject.projectDir}/projects.gradle" + + def customMavenRepoURL4plugins = System.getenv('CUST_MVN_URL_PLUGINS') + if (customMavenRepoURL4plugins!=null){ + repositories { + maven { url "${customMavenRepoURL4plugins}" } // e.g. a corporate nexus or artifactory... + } + }else{ + repositories { + mavenCentral() + jcenter() + } + } + + dependencies{ + classpath gradleApi() + classpath "org.springframework.boot:spring-boot-gradle-plugin:${libraryVersion.springBoot}" + classpath "org.asciidoctor:asciidoctor-gradle-plugin:1.5.3" + classpath "org.asciidoctor:asciidoctorj-diagram:1.5.4.1" + classpath "org.asciidoctor:asciidoctorj-pdf:1.5.0-alpha.16" + classpath "org.ajoberstar:grgit:2.1.0" // necessary for version calculation + } + +} + +ext { + git = org.ajoberstar.grgit.Grgit.open() // necessary for version calculation +} + +allprojects { + + def customMavenRepoURL = System.getenv('CUST_MVN_URL') + if (customMavenRepoURL!=null){ + repositories { + maven { url "${customMavenRepoURL}" } // e.g. a corporate nexus or artifactory... + } + }else{ + repositories { + mavenCentral() + jcenter() + } + } + + +} +apply from: "${rootProject.projectDir}/build-versioning.gradle" +apply from: "${rootProject.projectDir}/build-java.gradle" +apply from: "${rootProject.projectDir}/build-spring.gradle" +apply from: "${rootProject.projectDir}/build-maven.gradle" +apply from: "${rootProject.projectDir}/build-eclipse.gradle" + diff --git a/buildSrc/src/main/groovy/CmdExecutor.groovy b/buildSrc/src/main/groovy/CmdExecutor.groovy new file mode 100644 index 0000000000..60139df0a4 --- /dev/null +++ b/buildSrc/src/main/groovy/CmdExecutor.groovy @@ -0,0 +1,45 @@ +// SPDX-License-Identifier: MIT +import org.gradle.api.* + +class CmdExecutor{ + List
-
+ *
- Checkmarx V8.8.0 HF1 + *
![](\"logo.jpg\"/)
\n
\n\tQuickly check a file for malicious activity or suspicious content.
Your file is opened and/or executed in an isolated sandbox environment and every procedure it does is monitored.
Your file is treated as confidential, it is deleted after the analysis and solely analyzed on this server.\n
Netsparker Cloud identified a version disclosure (Apache) in the target web server's HTTP response.
This information might help an attacker gain a greater understanding of the systems in use and potentially develop further attacks targeted at the specific version of Apache.
", + "Impact": "An attacker might use the disclosed information to harvest specific security vulnerabilities for the version identified.
",
+ "RemedialActions": "",
+ "ExploitationSkills": "",
+ "RemedialProcedure": "Configure your web server to prevent information leakage from the
",
+ "RemedyReferences": "",
+ "ExternalReferences": "",
+ "ProofOfConcept": ""
+ },
+ {
+ "Url": "https://fscan.intranet.example.org/",
+ "Type": "ApacheOutOfDate",
+ "Name": "Out-of-date Version (Apache)",
+ "Severity": "Medium",
+ "Certainty": 90,
+ "Confirmed": false,
+ "State": "Present",
+ "Classification": {
+ "Owasp": "A9",
+ "Wasc": "",
+ "Cwe": "",
+ "Capec": "310",
+ "Pci31": "6.2",
+ "Pci32": "6.2",
+ "Hipaa": "",
+ "OwaspProactiveControls": "C1"
+ },
+ "HttpRequest": {
+ "Method": "GET",
+ "Content": "GET / HTTP/1.1\r\nHost: fscan.intranet.example.org\r\nCache-Control: no-cache\r\nConnection: Keep-Alive\r\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8\r\nUser-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.99 Safari/537.36\r\nAccept-Language: en-us,en;q=0.5\r\nX-Scanner: Netsparker Cloud\r\nAccept-Encoding: gzip, deflate\r\n\r\n",
+ "Parameters": []
+ },
+ "HttpResponse": {
+ "StatusCode": 200,
+ "Duration": 62.4938,
+ "Content": "HTTP/1.1 200 OK\r\nServer: Apache/2.4.10 (Debian)\r\nConnection: Keep-Alive\r\nKeep-Alive: timeout=5, max=100\r\nContent-Length: 1564\r\nContent-Type: text/html; charset=UTF-8\r\nContent-Encoding: \r\nDate: Tue, 13 Feb 2018 14:50:31 GMT\r\nVary: Accept-Encoding\r\n\r\n\n\n\n\t\n\tSERVER header of its HTTP response.\n
\n\tQuickly check a file for malicious activity or suspicious content.
Your file is opened and/or executed in an isolated sandbox environment and every procedure it does is monitored.
Your file is treated as confidential, it is deleted after the analysis and solely analyzed on this server.\n
Netsparker Cloud identified you are using an out-of-date version of Apache.
", + "Impact": "Since this is an old version of the software, it may be vulnerable to attacks.
",
+ "RemedialActions": "",
+ "ExploitationSkills": "",
+ "RemedialProcedure": "Please upgrade your installation of Apache to the latest stable version.
Netsparker Cloud detected that a certificate is signed using a weak signature algorithm.
The weak signature algorithm is known to be cryptographically weak and vulnerable to collision attacks.
", + "Impact": "Attackers can observe the encrypted traffic between your website and its visitors by leveraging the use of this vulnerability.
",
+ "RemedialActions": "",
+ "ExploitationSkills": "",
+ "RemedialProcedure": "You'll need to generate a new certificate request, and get your CA to issue you a new certificate using SHA-2.
",
+ "RemedyReferences": "",
+ "ExternalReferences": "- MD5 considered harmful today - Creating a rogue CA certificate
- MS Security Advisory : Research proves feasibility of collision attacks against MD5
- OWASP - Insecure Configuration Management
- OWASP - Insufficient Transport Layer Protection
- When Will We See Collisions for SHA-1?
- Gradually sunsetting SHA-1
- Why Google is Hurrying the Web to Kill SHA-1
- SHA1 Deprecation: What You Need to Know
Netsparker Cloud detected that insecure transportation security protocol (TLS 1.0) is supported by your web server.
TLS 1.0 has several flaws. An attacker can cause connection failures and they can trigger the use of TLS 1.0 to exploit vulnerabilities like BEAST (Browser Exploit Against SSL/TLS).
Websites using TLS 1.0 will be considered non-compliant by PCI after 30 June 2018.
", + "Impact": "Attackers can perform man-in-the-middle attacks and observe the encryption traffic between your website and its visitors.
",
+ "RemedialActions": "",
+ "ExploitationSkills": "",
+ "RemedialProcedure": "Configure your web server to disallow using weak ciphers. You need to restart the web server to enable changes.
- For Apache, adjust the SSLProtocol directive provided by the mod_ssl module. This directive can be set either at the server level or in a virtual host configuration.
SSLProtocol +TLSv1.1 +TLSv1.2\n
- For Nginx, locate any use of the directive ssl_protocols in the
nginx.conffile and removeTLSv1.ssl_protocols TLSv1.1 TLSv1.2;\n
- For Microsoft IIS, you should make some changes on the system registry.
- Click on Start and then Run, type
regedt32orregedit, and then click OK. - In Registry Editor, locate the following registry key or create if it does not exist:
HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\SCHANNEL\\Protocols\\TLS 1.0\\\n
- Locate a key named
Serveror create if it doesn't exist. - Under the
Serverkey, locate a DWORD value namedEnabledor create if it doesn't exist and set its value to \"0\".
- Click on Start and then Run, type
- How to disable TLS v1.0
- OWASP - Insecure Configuration Management
- OWASP - Insufficient Transport Layer Protection
- How to disable PCT 1.0, SSL 2.0, SSL 3.0, or TLS 1.0 in Internet Information Services
- IIS Crypto is a free tool that gives administrators the ability to enable or disable protocols, ciphers, hashes and key exchange algorithms on Windows Server 2003, 2008 and 2012
- Date Change for Migrating from SSL and Early TLS
- Browser Exploit Against SSL/TLS Attack (BEAST)
+
+ Quickly check a file for malicious activity or suspicious content.
Your file is opened and/or executed in an isolated sandbox environment and every procedure it does is monitored.
Your file is treated as confidential, it is deleted after the analysis and solely analyzed on this server. +
This information might help an attacker gain a greater understanding of the systems in use and potentially develop further attacks targeted at the specific version of Apache.
]]>SERVER header of its HTTP response.]]>+
+ Quickly check a file for malicious activity or suspicious content.
Your file is opened and/or executed in an isolated sandbox environment and every procedure it does is monitored.
Your file is treated as confidential, it is deleted after the analysis and solely analyzed on this server. +
Please upgrade your installation of Apache to the latest stable version.
]]>The weak signature algorithm is known to be cryptographically weak and vulnerable to collision attacks.
]]>- MD5 considered harmful today - Creating a rogue CA certificate
- MS Security Advisory : Research proves feasibility of collision attacks against MD5
- OWASP - Insecure Configuration Management
- OWASP - Insufficient Transport Layer Protection
- When Will We See Collisions for SHA-1?
- Gradually sunsetting SHA-1
- Why Google is Hurrying the Web to Kill SHA-1
- SHA1 Deprecation: What You Need to Know
TLS 1.0 has several flaws. An attacker can cause connection failures and they can trigger the use of TLS 1.0 to exploit vulnerabilities like BEAST (Browser Exploit Against SSL/TLS).
Websites using TLS 1.0 will be considered non-compliant by PCI after 30 June 2018.
]]>Configure your web server to disallow using weak ciphers. You need to restart the web server to enable changes.
- For Apache, adjust the SSLProtocol directive provided by the mod_ssl module. This directive can be set either at the server level or in a virtual host configuration.
SSLProtocol +TLSv1.1 +TLSv1.2 +
- For Nginx, locate any use of the directive ssl_protocols in the
nginx.conffile and removeTLSv1.ssl_protocols TLSv1.1 TLSv1.2; +
- For Microsoft IIS, you should make some changes on the system registry.
- Click on Start and then Run, type
regedt32orregedit, and then click OK. - In Registry Editor, locate the following registry key or create if it does not exist:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.0\ +
- Locate a key named
Serveror create if it doesn't exist. - Under the
Serverkey, locate a DWORD value namedEnabledor create if it doesn't exist and set its value to "0".
- Click on Start and then Run, type
- How to disable TLS v1.0
- OWASP - Insecure Configuration Management
- OWASP - Insufficient Transport Layer Protection
- How to disable PCT 1.0, SSL 2.0, SSL 3.0, or TLS 1.0 in Internet Information Services
- IIS Crypto is a free tool that gives administrators the ability to enable or disable protocols, ciphers, hashes and key exchange algorithms on Windows Server 2003, 2008 and 2012
- Date Change for Migrating from SSL and Early TLS
- Browser Exploit Against SSL/TLS Attack (BEAST)
null if there is none. + *
+ * Is used to create API urls.
+ * An example: host:"localhost:8080", apiCall:"users", prefix:"api/v1.0" would + * lead to "http://localhost:8080/api/v1.0/users" + * + * @return + */ + protected abstract String getAPIPrefix(); + + protected APIURLSupport createAPIURLSupport() { + return new APIURLSupport(); + } + + private String internalCreateAPIURL(String apiPath, C config, String apiPrefix, String otherBaseURL, Map
null
+ */
+ protected URIShrinkSupport createURIShrinker() {
+ return new URIShrinkSupport();
+ }
+
+ /**
+ * Set result check interval in milliseconds.
+ *
+ * @param minutes
+ * when <0 the setting will be ignored and default value used!"
+ * see {@link #DOCUMENT_INFO_CHECK}
+ * @return builder
+ */
+ @SuppressWarnings("unchecked")
+ public final B setTimeToWaitForNextCheckOperationInMinutes(int minutes) {
+ if (minutes < 0) {
+ return (B) this;
+ }
+ this.timeToWaitForNextCheckOperationInMinutes = minutes;
+ return (B) this;
+ }
+
+ /**
+ * Set result check timeout in minutes.
+ *
+ * @param scanResultTimeOutInMinutes
+ * when <0 the setting will be ignored and default value used!"
+ * see {@link #DOCUMENT_INFO_TIMEOUT}
+ * @return
+ */
+ @SuppressWarnings("unchecked")
+ public final B setScanResultTimeOutInMinutes(int scanResultTimeOutInMinutes) {
+ if (scanResultTimeOutInMinutes < 0) {
+ return (B) this;
+ }
+ this.scanResultTimeOutInMinutes = scanResultTimeOutInMinutes;
+ return (B) this;
+ }
+
+ @SuppressWarnings("unchecked")
+ public final B setUser(String userID) {
+ this.user = userID;
+ return (B) this;
+ }
+
+ @SuppressWarnings("unchecked")
+ public final B setPassword(String password) {
+ this.password=CryptoAccess.CRYPTO_STRING.seal(password);
+ return (B) this;
+ }
+
+ @SuppressWarnings("unchecked")
+ public final B setApiToken(String apiToken) {
+ this.apiToken = apiToken;
+ return (B) this;
+ }
+
+ @SuppressWarnings("unchecked")
+ public final B setTraceID(String traceID) {
+ this.traceID = traceID;
+ return (B) this;
+ }
+
+ /**
+ * Set the base url for the product - e.g. "https://x.y.z:8123"
+ * @param baseURL
+ * @return
+ */
+ @SuppressWarnings("unchecked")
+ public final B setProductBaseUrl(String baseURL) {
+ this.productBaseURL = baseURL;
+ return (B) this;
+ }
+
+ @SuppressWarnings("unchecked")
+ public final B setProxyHostname(String hostname) {
+ this.proxyHostname = hostname;
+ return (B) this;
+ }
+
+ @SuppressWarnings("unchecked")
+ public final B setProxyPort(int proxyPort) {
+ this.proxyPort = proxyPort;
+ return (B) this;
+ }
+
+ @SuppressWarnings("unchecked")
+ public final B setPolicyID(String policyID) {
+ this.policyID = policyID;
+ return (B) this;
+ }
+
+ @SuppressWarnings("unchecked")
+ public B setTargetURIs(Set+ *
+ * Already initial checked before are: + *
-
+ *
- when a proxy hostname is set the proxy port must be set too + *
- product base url set + *
null
+ */
+ @Override
+ public final C getConfig() {
+ return config;
+ }
+
+ @Override
+ public final void setResult(String result) {
+ this.result = result;
+ }
+
+ @Override
+ public final String getResult() {
+ return result;
+ }
+
+ @Override
+ public final boolean isTimeOut() {
+ long millis = getMillisecondsRun();
+ return millis > config.getTimeOutInMilliseconds();
+ }
+
+ @Override
+ public final long getMillisecondsRun() {
+ return System.currentTimeMillis() - started;
+ }
+
+ @Override
+ public String getTraceID() {
+ return getConfig().getTraceID();
+ }
+
+}
diff --git a/sechub-adapter/src/main/java/com/daimler/sechub/adapter/AbstractCodeScanAdapterConfig.java b/sechub-adapter/src/main/java/com/daimler/sechub/adapter/AbstractCodeScanAdapterConfig.java
new file mode 100644
index 0000000000..e3d49ba29c
--- /dev/null
+++ b/sechub-adapter/src/main/java/com/daimler/sechub/adapter/AbstractCodeScanAdapterConfig.java
@@ -0,0 +1,15 @@
+// SPDX-License-Identifier: MIT
+package com.daimler.sechub.adapter;
+
+public class AbstractCodeScanAdapterConfig extends AbstractAdapterConfig {
+
+ String sourceScanTargetString;
+
+ @Override
+ public String getTargetAsString() {
+ if (sourceScanTargetString!=null) {
+ return sourceScanTargetString;
+ }
+ return super.getTargetAsString();
+ }
+}
diff --git a/sechub-adapter/src/main/java/com/daimler/sechub/adapter/AbstractCodeScanAdapterConfigBuilder.java b/sechub-adapter/src/main/java/com/daimler/sechub/adapter/AbstractCodeScanAdapterConfigBuilder.java
new file mode 100644
index 0000000000..082572b3da
--- /dev/null
+++ b/sechub-adapter/src/main/java/com/daimler/sechub/adapter/AbstractCodeScanAdapterConfigBuilder.java
@@ -0,0 +1,35 @@
+// SPDX-License-Identifier: MIT
+package com.daimler.sechub.adapter;
+
+import java.util.Iterator;
+import java.util.Set;
+
+public abstract class AbstractCodeScanAdapterConfigBuilder, C extends AbstractCodeScanAdapterConfig> extends AbstractAdapterConfigBuildernull
+ */
+ String getProductBaseURL();
+
+ /**
+ * Returns a string describing the target type (e.g. "INTRANET")
+ * @return a string describing the target, never null. when type not set an empty string is returned
+ */
+ String getTargetType();
+
+ /**
+ * Return all target URIs
+ * @return target URIs (equals in URLs is a little bit odd, can make Domain look ups so we use URI instead).+ */ + Set
+ * This is interesting when the product is only able to scan one URI at a time. So it would be a little bit cumbersome to use {@link #getTargetURIs()} + * @return target URI or
null if none defined
+ */
+ URI getTargetURI();
+
+ /**
+ * Returns a target string. When configured target is a for URIs, only the first target URI is returned as a simple string. But Target can
+ * also be one ore more folder pathes - e.g. for source scanning
+ * + * This is interesting when the product scans no URLs or is only able to scan one URI at a time. So it would be a little bit cumbersome to use {@link #getTargetURIs()} + * @return target URI string or
null if none defined
+ */
+ String getTargetAsString();
+
+ /**
+ *
+ * @return a base 64 encoded token containing "USERID:APITOKEN" inside
+ */
+ String getBase64Token();
+
+ String getUser();
+
+ String getPolicyId();
+
+ String getPassword();
+
+ /**
+ * Returns a map for options. Can be used to provide special behaviours which are not default. E.g. wire mock extensions etc.
+ * @return map with options
+ */
+ public Map+ * An example: + *
+ * The config has got following target uris: + *
+ * https://www.mycoolstuff.com/app1/ + * https://www.mycoolstuff.com/app2/ + * https://www.mycoolstuff.com/app3/ + * https://www.othercoolstuff.com/app4/ + *+ * the call to this method will result in + *
+ * https://www.mycoolstuff.com + * https://www.othercoolstuff.com + *+ * @return a set, never
null
+ */
+ Setnull)
+ * @return root uri or null
+ */
+ URI getRootTargetURI();
+
+ /**
+ * Returns root target URI as string (will return always the first one or null)
+ * @return root uri as string or null
+ */
+ String getRootTargetURIasString();
+
+ /**
+ * Returns IP adresses.
+ * @return ip adresses or empty set, never null
+ */
+ Setnull if none set
+ */
+ String getProjectId();
+
+}
\ No newline at end of file
diff --git a/sechub-adapter/src/main/java/com/daimler/sechub/adapter/AdapterContext.java b/sechub-adapter/src/main/java/com/daimler/sechub/adapter/AdapterContext.java
new file mode 100644
index 0000000000..7656a62887
--- /dev/null
+++ b/sechub-adapter/src/main/java/com/daimler/sechub/adapter/AdapterContext.java
@@ -0,0 +1,60 @@
+// SPDX-License-Identifier: MIT
+package com.daimler.sechub.adapter;
+
+import java.util.Map;
+
+import org.springframework.web.client.RestOperations;
+
+import com.daimler.sechub.adapter.support.JSONAdapterSupport;
+
+public interface AdapterContextnull
+ */
+ C getConfig();
+
+ void setResult(String result);
+
+ String getResult();
+
+ boolean isTimeOut();
+
+ long getMillisecondsRun();
+
+ JSONAdapterSupport json();
+
+ /**
+ * Gives back full API URL, containing of base url from configuration and given api path
+ * @param apiPath
+ * @return full API URL - e.g. "https://localhost/prefix/$apiPath"
+ */
+ String getAPIURL(String apiPath);
+
+ /**
+ * Gives back full API URL, containing of base url from configuration and given api path.
+ * At the end of the url the map entries are added
+ * @param apiPath
+ * @param map - can be null
+ * @return full API URL - e.g. "https://localhost/prefix/$apiPath?key1=value1&key2=value2"
+ */
+ String getAPIURL(String apiPart, Map
+ incrementalSupport = new IcrementalAdditionalPrefixAPIURLSupport("teststep");
+
+ // lets use
+ adapterToTest = new XyzAdapter(){
+ createAPIURLSupport(){
+ return incrementalSupport;
+ }
+ }
+
+ stubFor(post(urlEqualTo(incrementalSupport.nextURL("/api/1.0/person"))...
+ ...
+ adapterToTest.executeAction()...
+
+ ...
+ verify(postRequestedFor(urlEqualTo("/teststep_1/api/1.0/person"))); // checks teh first rest call had was the post
+ *
+ *
+ * @author Albert Tregnaghi
+ *
+ */
+public class IcrementalAdditionalPrefixAPIURLSupport extends APIURLSupport {
+ private static final int START_INDEX = 1;// we start with 1
+ private int createdPrefixIndex = START_INDEX;
+ private int checkingPrefixIndex = START_INDEX;
+ private String additionalPrefix;
+
+ public IcrementalAdditionalPrefixAPIURLSupport(String additionalPrefix) {
+ this.additionalPrefix = additionalPrefix;
+ }
+
+ @Override
+ public String createAPIURL(String apiPath, AdapterConfig config, String apiPrefix, String otherBaseURL, Mapnull
+ */
+ String getTraceID();
+
+}
diff --git a/sechub-adapter/src/main/java/com/daimler/sechub/adapter/TraceLogClientHTTPRequestInterceptor.java b/sechub-adapter/src/main/java/com/daimler/sechub/adapter/TraceLogClientHTTPRequestInterceptor.java
new file mode 100644
index 0000000000..58ce9a5e94
--- /dev/null
+++ b/sechub-adapter/src/main/java/com/daimler/sechub/adapter/TraceLogClientHTTPRequestInterceptor.java
@@ -0,0 +1,75 @@
+// SPDX-License-Identifier: MIT
+package com.daimler.sechub.adapter;
+
+import java.io.BufferedReader;
+import java.io.IOException;
+import java.io.InputStreamReader;
+import java.util.stream.Collectors;
+
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.springframework.http.HttpRequest;
+import org.springframework.http.client.ClientHttpRequestExecution;
+import org.springframework.http.client.ClientHttpRequestInterceptor;
+import org.springframework.http.client.ClientHttpResponse;
+
+/**
+ * This http request interceptor does a trace logging of all adapter
+ * communication when log level for this logger is set to trace. It uses the DEBUG log level from SLF4J to
+ * identify if the data shall be inspected and logged or not.+ * + * @author Albert Tregnaghi + * + */ +public class TraceLogClientHTTPRequestInterceptor implements ClientHttpRequestInterceptor { + + private static final Logger LOG = LoggerFactory.getLogger(TraceLogClientHTTPRequestInterceptor.class); + + @Override + public final ClientHttpResponse intercept(HttpRequest request, byte[] body, ClientHttpRequestExecution execution) + throws IOException { + + ClientHttpResponse response = execution.execute(request, body); + + log(request, body, response); + + return response; + } + + private void log(HttpRequest request, byte[] body, ClientHttpResponse response) throws IOException { + if (!LOG.isDebugEnabled()) { + /* no output wanted - just do nothing and return. we use debug level, because this is the + * standard log level when executing as wiremock too - currently not able to change the log + * level for those tests because wiremock... does something special with logging in this case... + * If the wiremock logging issue could be changed then we should use a TRACE level instead!*/ + return; + } + StringBuilder sb = new StringBuilder(); + sb.append("\nRequest:"); + sb.append("\n Method:"); + sb.append(request.getMethodValue()); + sb.append("\n Headers:"); + sb.append(request.getHeaders().toString()); + sb.append("\n URI:"); + sb.append(request.getURI().toString()); + sb.append("\n Body:\n"); + sb.append(new String(body, "UTF-8")); + sb.append("\n\nResponse:"); + sb.append("\n Status:"); + sb.append(response.getStatusCode()); + sb.append(":"); + sb.append(response.getStatusText()); + sb.append("\n Headers:"); + sb.append(response.getHeaders().toString()); + sb.append("\n Body:"); + try (BufferedReader buffer = new BufferedReader(new InputStreamReader(response.getBody()))) { + sb.append(buffer.lines().collect(Collectors.joining("\n"))); + }catch(Exception e) { + sb.append(" Body not accessible - reason::"+e.getMessage()); + } + sb.append(response.getHeaders().toString()); + + String message = sb.toString(); + LOG.debug(message); + } +} \ No newline at end of file diff --git a/sechub-adapter/src/main/java/com/daimler/sechub/adapter/TrustAllConfig.java b/sechub-adapter/src/main/java/com/daimler/sechub/adapter/TrustAllConfig.java new file mode 100644 index 0000000000..b6116f57ce --- /dev/null +++ b/sechub-adapter/src/main/java/com/daimler/sechub/adapter/TrustAllConfig.java @@ -0,0 +1,7 @@ +// SPDX-License-Identifier: MIT +package com.daimler.sechub.adapter; + +public interface TrustAllConfig extends ProxyConfig, TraceIdProvider{ + + boolean isTrustAllCertificatesEnabled(); +} diff --git a/sechub-adapter/src/main/java/com/daimler/sechub/adapter/WaitForStateSupport.java b/sechub-adapter/src/main/java/com/daimler/sechub/adapter/WaitForStateSupport.java new file mode 100644 index 0000000000..b225b27699 --- /dev/null +++ b/sechub-adapter/src/main/java/com/daimler/sechub/adapter/WaitForStateSupport.java @@ -0,0 +1,96 @@ +// SPDX-License-Identifier: MIT +package com.daimler.sechub.adapter; + +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; +import org.springframework.web.client.HttpClientErrorException; + +/** + * Abstract class to support waiting for given states + * + * @author Albert Tregnaghi + * + * @param
null if none found
+ */
+ public MockedAdapterSetupEntry getEntryFor(String adapterId) {
+ if (adapterId==null) {
+ return null;
+ }
+ for (MockedAdapterSetupEntry entry: entries) {
+ if (entry==null) {
+ continue;
+ }
+ if (adapterId.equals(entry.getAdapterId())){
+ return entry;
+ }
+ }
+ return null;
+ }
+
+}
diff --git a/sechub-adapter/src/main/java/com/daimler/sechub/adapter/mock/MockedAdapterSetupCombination.java b/sechub-adapter/src/main/java/com/daimler/sechub/adapter/mock/MockedAdapterSetupCombination.java
new file mode 100644
index 0000000000..72bbdd096d
--- /dev/null
+++ b/sechub-adapter/src/main/java/com/daimler/sechub/adapter/mock/MockedAdapterSetupCombination.java
@@ -0,0 +1,51 @@
+// SPDX-License-Identifier: MIT
+package com.daimler.sechub.adapter.mock;
+
+/**
+ * Combination object for an adapter
+ * @author Albert Tregnaghi
+ *
+ */
+public class MockedAdapterSetupCombination{
+
+ /**
+ * Special identifier for a combination which is a fallback for all not defined
+ */
+ public static final String ANY_OTHER_TARGET="{any-other-target}";
+
+ private String target;
+ private boolean throwsAdapterException;
+ private String filePath;
+
+ private long timeToElapseInMilliseconds;
+
+
+ public String getTarget() {
+ return target;
+ }
+ public void setTarget(String target) {
+ this.target = target;
+ }
+ public boolean isThrowsAdapterException() {
+ return throwsAdapterException;
+ }
+ public void setThrowsAdapterException(boolean throwsAdapterException) {
+ this.throwsAdapterException = throwsAdapterException;
+ }
+ public String getFilePath() {
+ return filePath;
+ }
+ public void setFilePath(String filePath) {
+ this.filePath = filePath;
+ }
+
+ public void setTimeToElapseInMilliseconds(long timeToElapse) {
+ this.timeToElapseInMilliseconds = timeToElapse;
+ }
+
+ public long getTimeToElapseInMilliseconds() {
+ return timeToElapseInMilliseconds;
+ }
+
+
+}
\ No newline at end of file
diff --git a/sechub-adapter/src/main/java/com/daimler/sechub/adapter/mock/MockedAdapterSetupEntry.java b/sechub-adapter/src/main/java/com/daimler/sechub/adapter/mock/MockedAdapterSetupEntry.java
new file mode 100644
index 0000000000..60967c8f73
--- /dev/null
+++ b/sechub-adapter/src/main/java/com/daimler/sechub/adapter/mock/MockedAdapterSetupEntry.java
@@ -0,0 +1,82 @@
+// SPDX-License-Identifier: MIT
+package com.daimler.sechub.adapter.mock;
+
+import java.util.ArrayList;
+import java.util.List;
+
+/**
+ * A configuration object for mocked adapters, will be used for marshalling and inside mocked adapters to handle different behaviours
+ * @author Albert Tregnaghi
+ *
+ */
+public class MockedAdapterSetupEntry{
+
+ /**
+ * full class name of the mock adapter - used as an identifier
+ */
+ private String adapterId;
+
+ private Listnull
+ * @throws IllegalStateException
+ * when resource cannot be found
+ *
+ **/
+ public String loadResourceString(String path) {
+ StringBuilder sb = new StringBuilder();
+
+ try (InputStream stream = createPath(path)) {
+ if (stream == null) {
+ throw new FileNotFoundException("Stream not found for:" + path);
+ }
+ BufferedReader br = new BufferedReader(new InputStreamReader(stream));
+ String line = null;
+ while ((line = br.readLine()) != null) {
+ sb.append(line);
+ sb.append("\n");
+ }
+ } catch (IOException e) {
+ throw new IllegalStateException("Cannot load mock resource:" + path, e);
+ }
+ return sb.toString();
+ }
+
+ private InputStream createPath(String path) {
+ File file = new File(path);
+ if (file.exists()) {
+ /* simply use file stream */
+ try {
+ return new FileInputStream(file);
+ } catch (FileNotFoundException e) {
+ throw new IllegalStateException("File exists but not found?");
+ }
+ }
+ /* seems to be not available per file so try resource loading*/
+ return getClass().getResourceAsStream(path);
+ }
+}
diff --git a/sechub-adapter/src/main/java/com/daimler/sechub/adapter/support/TrustAllSupport.java b/sechub-adapter/src/main/java/com/daimler/sechub/adapter/support/TrustAllSupport.java
new file mode 100644
index 0000000000..39572056a9
--- /dev/null
+++ b/sechub-adapter/src/main/java/com/daimler/sechub/adapter/support/TrustAllSupport.java
@@ -0,0 +1,186 @@
+// SPDX-License-Identifier: MIT
+package com.daimler.sechub.adapter.support;
+
+import java.io.IOException;
+import java.net.InetAddress;
+import java.net.InetSocketAddress;
+import java.net.Proxy;
+import java.net.Socket;
+import java.net.UnknownHostException;
+import java.security.KeyManagementException;
+import java.security.NoSuchAlgorithmException;
+import java.security.cert.CertificateException;
+import java.security.cert.X509Certificate;
+
+import javax.net.ssl.HostnameVerifier;
+import javax.net.ssl.SSLContext;
+import javax.net.ssl.SSLSession;
+import javax.net.ssl.TrustManager;
+import javax.net.ssl.X509TrustManager;
+
+import org.apache.http.HttpHost;
+import org.apache.http.config.Registry;
+import org.apache.http.config.RegistryBuilder;
+import org.apache.http.conn.DnsResolver;
+import org.apache.http.conn.socket.ConnectionSocketFactory;
+import org.apache.http.conn.socket.PlainConnectionSocketFactory;
+import org.apache.http.conn.ssl.NoopHostnameVerifier;
+import org.apache.http.conn.ssl.SSLConnectionSocketFactory;
+import org.apache.http.impl.client.CloseableHttpClient;
+import org.apache.http.impl.client.HttpClientBuilder;
+import org.apache.http.impl.client.HttpClients;
+import org.apache.http.impl.conn.PoolingHttpClientConnectionManager;
+import org.apache.http.protocol.HttpContext;
+import org.apache.http.ssl.SSLContexts;
+import org.springframework.http.client.ClientHttpRequestFactory;
+import org.springframework.http.client.HttpComponentsClientHttpRequestFactory;
+
+import com.daimler.sechub.adapter.Adapter;
+import com.daimler.sechub.adapter.AdapterException;
+import com.daimler.sechub.adapter.TrustAllConfig;
+
+/**
+ * This support works with SOCKS-Proxys V4.
+ *
+ * @author Albert Tregnaghi
+ *
+ */
+public class TrustAllSupport {
+
+ private static final String TLS = "TLS";
+ private Adapter adapter;
+ private TrustAllConfig config;
+
+ public TrustAllSupport(Adapter adapter, TrustAllConfig config) {
+ if (adapter == null) {
+ throw new IllegalArgumentException("adapter may not be null");
+ }
+ if (config == null) {
+ throw new IllegalArgumentException("config may not be null");
+ }
+ this.adapter = adapter;
+ this.config = config;
+ }
+
+ public ClientHttpRequestFactory createTrustAllFactory() {
+ HttpClientBuilder clientBuilder = HttpClients.custom();
+ SSLContext sslContext = null;
+ if (config.isTrustAllCertificatesEnabled()) {
+ try {
+ sslContext = createTrustAllSSLContext(adapter);
+ } catch (AdapterException e) {
+ throw new IllegalStateException("Should not happen! See trace", e);
+ }
+ } else {
+ sslContext = SSLContexts.createSystemDefault();
+ }
+ if (config.isProxyDefined()) {
+ // proxy with socks not working with standard HTTPHost,
+ // clientBuilder.setProxy(..)
+ // So own approach necessary, details see
+ // https://stackoverflow.com/questions/22937983/how-to-use-socks-5-proxy-with-apache-http-client-4
+ Registrynull
+ */
+ public Settrue when one time token is outdated or not existing
+ * @param timeOutMillis
+ * @return true when one time token is outdated
+ */
+ public boolean isOneTimeTokenOutDated(long timeOutMillis) {
+ if (oneTimeTokenDate==null) {
+ return true;
+ }
+ if (oneTimeToken==null || oneTimeToken.isEmpty()) {
+ return true;
+ }
+ long current = System.currentTimeMillis();
+ long diff = current-oneTimeTokenDate.getTime();
+ return diff>timeOutMillis;
+ }
+
+ @Override
+ public int hashCode() {
+ final int prime = 31;
+ int result = 1;
+ result = prime * result + ((name == null) ? 0 : name.hashCode());
+ return result;
+ }
+
+ @Override
+ public boolean equals(Object obj) {
+ if (this == obj) {
+ return true;
+ }
+ if (obj == null) {
+ return false;
+ }
+ if (getClass() != obj.getClass()) {
+ return false;
+ }
+ User other = (User) obj;
+ if (name == null) {
+ if (other.name != null)
+ return false;
+ } else if (!name.equals(other.name)) {
+ return false;
+ }
+ return true;
+ }
+
+
+
+}
\ No newline at end of file
diff --git a/sechub-administration/src/main/java/com/daimler/sechub/domain/administration/user/UserAdministrationRestController.java b/sechub-administration/src/main/java/com/daimler/sechub/domain/administration/user/UserAdministrationRestController.java
new file mode 100644
index 0000000000..6fefdca702
--- /dev/null
+++ b/sechub-administration/src/main/java/com/daimler/sechub/domain/administration/user/UserAdministrationRestController.java
@@ -0,0 +1,115 @@
+// SPDX-License-Identifier: MIT
+package com.daimler.sechub.domain.administration.user;
+
+import java.util.List;
+
+import javax.annotation.security.RolesAllowed;
+
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.boot.autoconfigure.EnableAutoConfiguration;
+import org.springframework.http.HttpStatus;
+import org.springframework.http.MediaType;
+import org.springframework.web.bind.annotation.PathVariable;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RequestMethod;
+import org.springframework.web.bind.annotation.ResponseStatus;
+import org.springframework.web.bind.annotation.RestController;
+
+import com.daimler.sechub.domain.administration.AdministrationAPIConstants;
+import com.daimler.sechub.sharedkernel.RoleConstants;
+import com.daimler.sechub.sharedkernel.Step;
+import com.daimler.sechub.sharedkernel.usecases.admin.signup.UseCaseAdministratorAcceptsSignup;
+import com.daimler.sechub.sharedkernel.usecases.admin.user.UseCaseAdministratorDeletesUser;
+import com.daimler.sechub.sharedkernel.usecases.admin.user.UseCaseAdministratorGrantsAdminRightsToUser;
+import com.daimler.sechub.sharedkernel.usecases.admin.user.UseCaseAdministratorListsAllAdmins;
+import com.daimler.sechub.sharedkernel.usecases.admin.user.UseCaseAdministratorListsAllUsers;
+import com.daimler.sechub.sharedkernel.usecases.admin.user.UseCaseAdministratorRevokesAdminRightsFromAdmin;
+import com.daimler.sechub.sharedkernel.usecases.admin.user.UseCaseAdministratorShowsUserDetails;
+
+/**
+ * The rest api for user administration done by a super admin.
+ *
+ * @author Albert Tregnaghi
+ *
+ */
+@RestController
+@EnableAutoConfiguration
+@RolesAllowed(RoleConstants.ROLE_SUPERADMIN)
+public class UserAdministrationRestController {
+
+ @Autowired
+ UserCreationService creationService;
+
+ @Autowired
+ UserDeleteService deleteService;
+
+ @Autowired
+ UserDetailInformationService detailsService;
+
+ @Autowired
+ UserListService userListService;
+
+ @Autowired
+ UserGrantSuperAdminRightsService userGrantSuperAdminRightsService;
+
+ @Autowired
+ UserRevokeSuperAdminRightsService userRevokeSuperAdminRightsService;
+
+ /* @formatter:off */
+ @UseCaseAdministratorAcceptsSignup(@Step(number=1,name="Rest call", description="Administrator accepts a persisted self registration entry by calling rest api",needsRestDoc=true))
+ @RequestMapping(path = AdministrationAPIConstants.API_ACCEPT_USER_SIGNUP, method = RequestMethod.POST, produces= {MediaType.APPLICATION_JSON_UTF8_VALUE,MediaType.APPLICATION_JSON_VALUE})
+ @ResponseStatus(HttpStatus.CREATED)
+ public void acceptUserSignUp(@PathVariable(name="userId") String userId) {
+ /* @formatter:on */
+ creationService.createUserFromSelfRegistration(userId);
+ }
+
+ /* @formatter:off */
+ @UseCaseAdministratorListsAllUsers(@Step(number=1,name="Rest call",description="All userids of sechub users are returned as json",needsRestDoc=true))
+ @RequestMapping(path = AdministrationAPIConstants.API_LIST_ALL_USERS, method = RequestMethod.GET, produces= {MediaType.APPLICATION_JSON_UTF8_VALUE,MediaType.APPLICATION_JSON_VALUE})
+ public List