Fix Sonar security vulnerabilities
[nonrtric.git] / dashboard / webapp-backend / pom.xml
index a7100be..e847561 100644 (file)
@@ -1,5 +1,8 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<!--<![CDATA[
+<!--
+
+
+<![CDATA[
 ========================LICENSE_START=================================
 O-RAN-SC
 %%
@@ -18,287 +21,327 @@ See the License for the specific language governing permissions and
 limitations under the License.
 ========================LICENSE_END===================================
 ]]>-->
-<project xmlns="http://maven.apache.org/POM/4.0.0"
-       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+<project
+    xmlns="http://maven.apache.org/POM/4.0.0"
+    xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
        xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
-       <modelVersion>4.0.0</modelVersion>
-       <parent>
-               <groupId>org.o-ran-sc.nonrt.ric-dashboard</groupId>
-               <artifactId>ric-dash-parent</artifactId>
-               <version>1.0.0-SNAPSHOT</version>
-       </parent>
-       <artifactId>ric-dash-be</artifactId>
-       <name>NonRT RIC Dashboard Webapp backend</name>
-       <properties>
-               <springfox.version>2.9.2</springfox.version>
-               <!-- Set by Jenkins -->
-               <build.number>0</build.number>
-       </properties>
-       <repositories>
-               <repository>
-                       <id>onap-releases</id>
-                       <name>ONAP - Release Repository</name>
-                       <url>https://nexus.onap.org/content/repositories/releases</url>
-               </repository>
-       </repositories>
-       <dependencies>
-               <!-- Platform components -->
-               <dependency>
-                       <groupId>org.o-ran-sc.ric.plt.a1controller.client</groupId>
-                       <artifactId>a1-controller-client</artifactId>
-                       <version>0.1.0-SNAPSHOT</version>
-               </dependency>
-               <dependency>
-                       <groupId>org.onap.portal.sdk</groupId>
-                       <artifactId>epsdk-fw</artifactId>
-                       <version>2.6.0</version>
-                       <exclusions>
-                               <exclusion>
-                                       <groupId>commons-logging</groupId>
-                                       <artifactId>commons-logging</artifactId>
-                               </exclusion>
-                               <exclusion>
-                                       <groupId>log4j</groupId>
-                                       <artifactId>log4j</artifactId>
-                               </exclusion>
-                               <exclusion>
-                                       <groupId>log4j</groupId>
-                                       <artifactId>apache-log4j-extras</artifactId>
-                               </exclusion>
-                               <exclusion>
-                                       <groupId>org.slf4j</groupId>
-                                       <artifactId>slf4j-log4j12</artifactId>
-                               </exclusion>
-                               <exclusion>
-                                       <groupId>junit</groupId>
-                                       <artifactId>junit</artifactId>
-                               </exclusion>
-                               <exclusion>
-                                       <groupId>commons-fileupload</groupId>
-                                       <artifactId>commons-fileupload</artifactId>
-                               </exclusion>
-                               <exclusion>
-                                       <groupId>commons-beanutils</groupId>
-                                       <artifactId>commons-beanutils</artifactId>
-                               </exclusion>
-                               <!-- EELF omits "test" scope on this dependency -->
-                               <exclusion>
-                                       <groupId>org.powermock</groupId>
-                                       <artifactId>powermock-module-junit4</artifactId>
-                               </exclusion>
-                               <!-- EELF omits "test" scope on this dependency -->
-                               <exclusion>
-                                       <groupId>org.powermock</groupId>
-                                       <artifactId>powermock-api-mockito</artifactId>
-                               </exclusion>
-                       </exclusions>
-               </dependency>
-               <dependency>
-                       <groupId>org.springframework.boot</groupId>
-                       <artifactId>spring-boot-starter-security</artifactId>
-               </dependency>
-               <dependency>
-                       <groupId>org.springframework.boot</groupId>
-                       <artifactId>spring-boot-starter-web</artifactId>
-               </dependency>
-               <dependency>
-                       <groupId>org.slf4j</groupId>
-                       <artifactId>slf4j-api</artifactId>
-               </dependency>
-               <!-- Bridge uses of Apache commons logging, like EPSDK-FW -->
-               <dependency>
-                       <groupId>org.slf4j</groupId>
-                       <artifactId>jcl-over-slf4j</artifactId>
-               </dependency>
-               <dependency>
-                       <groupId>ch.qos.logback</groupId>
-                       <artifactId>logback-classic</artifactId>
-               </dependency>
-               <dependency>
-                       <groupId>ch.qos.logback</groupId>
-                       <artifactId>logback-core</artifactId>
-               </dependency>
-               <dependency>
-                       <groupId>io.springfox</groupId>
-                       <artifactId>springfox-swagger2</artifactId>
-                       <version>${springfox.version}</version>
-               </dependency>
-               <dependency>
-                       <groupId>io.springfox</groupId>
-                       <artifactId>springfox-swagger-ui</artifactId>
-                       <version>${springfox.version}</version>
-               </dependency>
-               <!-- Test dependencies -->
-               <!-- Mockito supports development, not just testing -->
-               <dependency>
-                       <groupId>org.mockito</groupId>
-                       <artifactId>mockito-core</artifactId>
-                       <scope>test</scope>
-               </dependency>
-               <dependency>
-                       <groupId>org.springframework.boot</groupId>
-                       <artifactId>spring-boot-starter-test</artifactId>
-                       <scope>test</scope>
-               </dependency>
-               <dependency>
-                       <groupId>org.junit.jupiter</groupId>
-                       <artifactId>junit-jupiter-api</artifactId>
-                       <scope>test</scope>
-               </dependency>
-               <dependency>
-                       <groupId>org.junit.jupiter</groupId>
-                       <artifactId>junit-jupiter-engine</artifactId>
-                       <scope>test</scope>
-               </dependency>
-               <dependency>
-                       <groupId>org.junit.platform</groupId>
-                       <artifactId>junit-platform-launcher</artifactId>
-                       <!-- Override Spring-Boot choice for Eclipse -->
-                       <version>1.4.2</version>
-                       <scope>test</scope>
-               </dependency>
-       </dependencies>
-       <build>
-               <plugins>
-                       <plugin>
-                               <groupId>org.springframework.boot</groupId>
-                               <artifactId>spring-boot-maven-plugin</artifactId>
-                       </plugin>
-                       <plugin>
-                               <!-- Most configuration and all execution is inherited -->
-                               <groupId>org.codehaus.mojo</groupId>
-                               <artifactId>license-maven-plugin</artifactId>
-                               <configuration>
-                                       <roots>
-                                               <root>src</root>
-                                       </roots>
-                                       <excludes>
-                                               <exclude>**/*.json</exclude>
-                                       </excludes>
-                               </configuration>
-                       </plugin>
-                       <!-- Add the build number to the jar manifest. Spring-Boot uses a complex 
+    <modelVersion>4.0.0</modelVersion>
+    <parent>
+        <groupId>org.o-ran-sc.nonrt.ric-dashboard</groupId>
+        <artifactId>ric-dash-parent</artifactId>
+        <version>1.0.1-SNAPSHOT</version>
+    </parent>
+    <artifactId>ric-dash-be</artifactId>
+    <name>NonRT RIC Dashboard Webapp backend</name>
+    <properties>
+        <springfox.version>2.9.2</springfox.version>
+        <immutable.version>2.7.1</immutable.version>
+        <apache-axis2.version>1.7.9</apache-axis2.version>
+        <formatter-maven-plugin.version>2.8.1</formatter-maven-plugin.version>
+        <spotless-maven-plugin.version>1.18.0</spotless-maven-plugin.version>
+        <!-- Set by Jenkins -->
+        <build.number>0</build.number>
+    </properties>
+    <repositories>
+        <repository>
+            <id>onap-releases</id>
+            <name>ONAP - Release Repository</name>
+            <url>https://nexus.onap.org/content/repositories/releases</url>
+        </repository>
+    </repositories>
+    <dependencies>
+        <!-- Platform components -->
+        <dependency>
+            <groupId>org.onap.portal.sdk</groupId>
+            <artifactId>epsdk-fw</artifactId>
+            <version>2.6.0</version>
+            <exclusions>
+                <exclusion>
+                    <groupId>commons-logging</groupId>
+                    <artifactId>commons-logging</artifactId>
+                </exclusion>
+                <exclusion>
+                    <groupId>log4j</groupId>
+                    <artifactId>log4j</artifactId>
+                </exclusion>
+                <exclusion>
+                    <groupId>log4j</groupId>
+                    <artifactId>apache-log4j-extras</artifactId>
+                </exclusion>
+                <exclusion>
+                    <groupId>org.slf4j</groupId>
+                    <artifactId>slf4j-log4j12</artifactId>
+                </exclusion>
+                <exclusion>
+                    <groupId>junit</groupId>
+                    <artifactId>junit</artifactId>
+                </exclusion>
+                <exclusion>
+                    <groupId>commons-fileupload</groupId>
+                    <artifactId>commons-fileupload</artifactId>
+                </exclusion>
+                <exclusion>
+                    <groupId>commons-beanutils</groupId>
+                    <artifactId>commons-beanutils</artifactId>
+                </exclusion>
+                <!-- EELF omits "test" scope on this dependency -->
+                <exclusion>
+                    <groupId>org.powermock</groupId>
+                    <artifactId>powermock-module-junit4</artifactId>
+                </exclusion>
+                <!-- EELF omits "test" scope on this dependency -->
+                <exclusion>
+                    <groupId>org.powermock</groupId>
+                    <artifactId>powermock-api-mockito</artifactId>
+                </exclusion>
+            </exclusions>
+        </dependency>
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-security</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-web</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.slf4j</groupId>
+            <artifactId>slf4j-api</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>org.apache.axis2</groupId>
+            <artifactId>axis2-kernel</artifactId>
+            <version>${apache-axis2.version}</version>
+        </dependency>
+        <!-- Bridge uses of Apache commons logging, like EPSDK-FW -->
+        <dependency>
+            <groupId>org.slf4j</groupId>
+            <artifactId>jcl-over-slf4j</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>ch.qos.logback</groupId>
+            <artifactId>logback-classic</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>ch.qos.logback</groupId>
+            <artifactId>logback-core</artifactId>
+        </dependency>
+        <dependency>
+            <groupId>io.springfox</groupId>
+            <artifactId>springfox-swagger2</artifactId>
+            <version>${springfox.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>io.springfox</groupId>
+            <artifactId>springfox-swagger-ui</artifactId>
+            <version>${springfox.version}</version>
+        </dependency>
+        <dependency>
+            <groupId>org.immutables</groupId>
+            <artifactId>value</artifactId>
+            <version>${immutable.version}</version>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.immutables</groupId>
+            <artifactId>gson</artifactId>
+            <version>${immutable.version}</version>
+        </dependency>
+        <!-- Test dependencies -->
+        <!-- Mockito supports development, not just testing -->
+        <dependency>
+            <groupId>org.mockito</groupId>
+            <artifactId>mockito-core</artifactId>
+            <scope>test</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.springframework.boot</groupId>
+            <artifactId>spring-boot-starter-test</artifactId>
+            <scope>test</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.junit.jupiter</groupId>
+            <artifactId>junit-jupiter-api</artifactId>
+            <scope>test</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.junit.jupiter</groupId>
+            <artifactId>junit-jupiter-engine</artifactId>
+            <scope>test</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.junit.platform</groupId>
+            <artifactId>junit-platform-launcher</artifactId>
+            <scope>test</scope>
+        </dependency>
+    </dependencies>
+    <build>
+        <plugins>
+            <plugin>
+                <groupId>org.springframework.boot</groupId>
+                <artifactId>spring-boot-maven-plugin</artifactId>
+            </plugin>
+            <plugin>
+                <groupId>net.revelc.code.formatter</groupId>
+                <artifactId>formatter-maven-plugin</artifactId>
+                <version>${formatter-maven-plugin.version}</version>
+                <configuration>
+                    <configFile>${project.basedir}/eclipse-formatter.xml</configFile>
+                </configuration>
+                <!-- https://code.revelc.net/formatter-maven-plugin/ use
+                    mvn formatter:format spotless:apply process-sources -->
+            </plugin>
+            <plugin>
+                <groupId>com.diffplug.spotless</groupId>
+                <artifactId>spotless-maven-plugin</artifactId>
+                <version>${spotless-maven-plugin.version}</version>
+                <configuration>
+                    <java>
+                        <removeUnusedImports />
+                        <importOrder>
+                            <order>com,java,javax,org</order>
+                        </importOrder>
+                    </java>
+                </configuration>
+                <!-- https://github.com/diffplug/spotless/tree/master/plugin-maven
+                    use mvn spotless:apply to rewrite source files use mvn spotless:check to
+                    validate source files -->
+            </plugin>
+            <plugin>
+                <!-- Most configuration and all execution is inherited -->
+                <groupId>org.codehaus.mojo</groupId>
+                <artifactId>license-maven-plugin</artifactId>
+                <configuration>
+                    <roots>
+                        <root>src</root>
+                    </roots>
+                    <excludes>
+                        <exclude>**/*.json</exclude>
+                    </excludes>
+                </configuration>
+            </plugin>
+            <!-- Add the build number to the jar manifest. Spring-Boot uses a complex 
                                packaging process that makes access to the original Manifest.MF very difficult. 
                                However, Java provides access to the implementation version for a package, 
                                so cram the build number into there. -->
-                       <plugin>
-                               <groupId>org.apache.maven.plugins</groupId>
-                               <artifactId>maven-jar-plugin</artifactId>
-                               <configuration>
-                                       <archive>
-                                               <manifest>
-                                                       <addDefaultImplementationEntries>true</addDefaultImplementationEntries>
-                                               </manifest>
-                                               <manifestEntries>
-                                                       <Implementation-Version>${project.version}-b${build.number}</Implementation-Version>
-                                               </manifestEntries>
-                                       </archive>
-                               </configuration>
-                       </plugin>
-                       <plugin>
-                               <artifactId>maven-resources-plugin</artifactId>
-                               <executions>
-                                       <execution>
-                                               <id>copy-resources</id>
-                                               <phase>validate</phase>
-                                               <goals>
-                                                       <goal>copy-resources</goal>
-                                               </goals>
-                                               <configuration>
-                                                       <outputDirectory>${project.build.directory}/classes/resources/</outputDirectory>
-                                                       <resources>
-                                                               <resource>
-                                                                       <directory>${project.parent.basedir}/webapp-frontend/dist/dashApp/</directory>
-                                                               </resource>
-                                                       </resources>
-                                               </configuration>
-                                       </execution>
-                               </executions>
-                       </plugin>
-                       <!-- do not deploy a jar or pom file -->
-                       <plugin>
-                               <groupId>org.apache.maven.plugins</groupId>
-                               <artifactId>maven-deploy-plugin</artifactId>
-                               <configuration>
-                                       <skip>true</skip>
-                               </configuration>
-                       </plugin>
-                       <plugin>
-                               <groupId>org.jacoco</groupId>
-                               <artifactId>jacoco-maven-plugin</artifactId>
-                               <version>0.8.4</version>
-                               <executions>
-                                       <execution>
-                                               <id>default-prepare-agent</id>
-                                               <goals>
-                                                       <goal>prepare-agent</goal>
-                                               </goals>
-                                       </execution>
-                                       <execution>
-                                               <id>default-report</id>
-                                               <phase>prepare-package</phase>
-                                               <goals>
-                                                       <goal>report</goal>
-                                               </goals>
-                                       </execution>
-                               </executions>
-                       </plugin>
-                       <!-- https://stackoverflow.com/questions/39126226/fabric8-springboot-full-example -->
-                       <plugin>
-                               <groupId>io.fabric8</groupId>
-                               <artifactId>docker-maven-plugin</artifactId>
-                               <version>0.30.0</version>
-                               <configuration>
-                                       <verbose>true</verbose>
-                                       <!-- environment variables supplied by Jenkins -->
-                                       <pullRegistry>${env.CONTAINER_PULL_REGISTRY}</pullRegistry>
-                                       <pushRegistry>${env.CONTAINER_PUSH_REGISTRY}</pushRegistry>
-                                       <images>
-                                               <image>
-                                                       <!-- Specify a tag to avoid default tag "latest" -->
-                                                       <!-- Avoid maven artifact name here -->
-                                                       <name>ric-dashboard:${project.version}</name>
-                                                       <build>
-                                                               <from>openjdk:11-jre-slim</from>
-                                                               <tags>
-                                                                       <!-- Add tag with build number -->
-                                                                       <tag>${project.version}</tag>
-                                                               </tags>
-                                                               <assembly>
-                                                                       <descriptorRef>artifact</descriptorRef>
-                                                               </assembly>
-                                                               <runCmds>
-                                                                       <!-- Ensure logs dir exists and is world writable -->
-                                                                       <runCmd>mkdir /logs</runCmd>
-                                                                       <runCmd>chmod -R 777 /logs</runCmd>
-                                                               </runCmds>
-                                                               <cmd>
-                                                                       <!-- Include maven dir on classpath for prop files -->
-                                                                       <exec>
-                                                                               <arg>java</arg>
-                                                                               <arg>-Xms128m</arg>
-                                                                               <arg>-Xmx256m</arg>
-                                                                               <arg>-cp</arg>
-                                                                               <arg>maven:maven/${project.artifactId}-${project.version}.${project.packaging}</arg>
-                                                                               <arg>-Dloader.main=org.oransc.ric.portal.dashboard.DashboardApplication</arg>
-                                                                               <arg>-Djava.security.egd=file:/dev/./urandom</arg>
-                                                                               <arg>org.springframework.boot.loader.PropertiesLauncher</arg>
-                                                                       </exec>
-                                                               </cmd>
-                                                       </build>
-                                               </image>
-                                       </images>
-                               </configuration>
-                               <!-- build Docker images in install phase, push in deploy phase -->
-                               <executions>
-                                       <execution>
-                                               <goals>
-                                                       <goal>build</goal>
-                                                       <goal>push</goal>
-                                               </goals>
-                                       </execution>
-                               </executions>
-                       </plugin>
-               </plugins>
-       </build>
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-jar-plugin</artifactId>
+                <configuration>
+                    <archive>
+                        <manifest>
+                            <addDefaultImplementationEntries>true</addDefaultImplementationEntries>
+                        </manifest>
+                        <manifestEntries>
+                            <Implementation-Version>${project.version}-b${build.number}</Implementation-Version>
+                        </manifestEntries>
+                    </archive>
+                </configuration>
+            </plugin>
+            <plugin>
+                <artifactId>maven-resources-plugin</artifactId>
+                <executions>
+                    <execution>
+                        <id>copy-resources</id>
+                        <phase>validate</phase>
+                        <goals>
+                            <goal>copy-resources</goal>
+                        </goals>
+                        <configuration>
+                            <outputDirectory>${project.build.directory}/classes/resources/</outputDirectory>
+                            <resources>
+                                <resource>
+                                    <directory>${project.parent.basedir}/webapp-frontend/dist/dashApp/</directory>
+                                </resource>
+                            </resources>
+                        </configuration>
+                    </execution>
+                </executions>
+            </plugin>
+            <!-- do not deploy a jar or pom file -->
+            <plugin>
+                <groupId>org.apache.maven.plugins</groupId>
+                <artifactId>maven-deploy-plugin</artifactId>
+                <configuration>
+                    <skip>true</skip>
+                </configuration>
+            </plugin>
+            <plugin>
+                <groupId>org.jacoco</groupId>
+                <artifactId>jacoco-maven-plugin</artifactId>
+                <version>0.8.4</version>
+                <executions>
+                    <execution>
+                        <id>default-prepare-agent</id>
+                        <goals>
+                            <goal>prepare-agent</goal>
+                        </goals>
+                    </execution>
+                    <execution>
+                        <id>default-report</id>
+                        <phase>prepare-package</phase>
+                        <goals>
+                            <goal>report</goal>
+                        </goals>
+                    </execution>
+                </executions>
+            </plugin>
+            <!-- https://stackoverflow.com/questions/39126226/fabric8-springboot-full-example -->
+            <plugin>
+                <groupId>io.fabric8</groupId>
+                <artifactId>docker-maven-plugin</artifactId>
+                <version>0.30.0</version>
+                <configuration>
+                    <verbose>true</verbose>
+                    <!-- environment variables supplied by Jenkins -->
+                    <pullRegistry>${env.CONTAINER_PULL_REGISTRY}</pullRegistry>
+                    <pushRegistry>${env.CONTAINER_PUSH_REGISTRY}</pushRegistry>
+                    <images>
+                        <image>
+                            <!-- Specify a tag to avoid default tag "latest" -->
+                            <!-- Avoid maven artifact name here -->
+                            <name>o-ran-sc/nonrtric-dashboard:${project.version}</name>
+                            <build>
+                                <from>openjdk:11-jre-slim</from>
+                                <tags>
+                                    <!-- Add tag with build number -->
+                                    <tag>${project.version}</tag>
+                                </tags>
+                                <assembly>
+                                    <descriptorRef>artifact</descriptorRef>
+                                </assembly>
+                                <runCmds>
+                                    <!-- Ensure logs dir exists and is world writable -->
+                                    <runCmd>mkdir /logs</runCmd>
+                                    <runCmd>chmod -R 777 /logs</runCmd>
+                                </runCmds>
+                                <cmd>
+                                    <!-- Include maven dir on classpath for prop files -->
+                                    <exec>
+                                        <arg>java</arg>
+                                        <arg>-Xms128m</arg>
+                                        <arg>-Xmx256m</arg>
+                                        <arg>-cp</arg>
+                                        <arg>maven:maven/${project.artifactId}-${project.version}.${project.packaging}</arg>
+                                        <arg>-Dloader.main=org.oransc.ric.portal.dashboard.DashboardApplication</arg>
+                                        <arg>-Djava.security.egd=file:/dev/./urandom</arg>
+                                        <arg>org.springframework.boot.loader.PropertiesLauncher</arg>
+                                    </exec>
+                                </cmd>
+                            </build>
+                        </image>
+                    </images>
+                </configuration>
+                <!-- build Docker images in install phase, push in deploy phase -->
+                <executions>
+                    <execution>
+                        <goals>
+                            <goal>build</goal>
+                            <goal>push</goal>
+                        </goals>
+                    </execution>
+                </executions>
+            </plugin>
+        </plugins>
+    </build>
 </project>