BAH-4709 | Fix critical security vulnerabilities on docker images

.github/workflows/build_publish.yml

@@ -12,15 +12,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - name: Setup Java 8
+      - name: Setup Java 17
         uses: actions/setup-java@v4
         with:
           distribution: "zulu"
-          java-version: "8"
-      # - name: Run Unit Tests
-      #   run: mvn --no-transfer-progress clean test
-      - name: Install bower
-        run: npm install -g bower 
+          java-version: "17"
+      - name: Run Unit Tests
+        run: mvn --no-transfer-progress clean test
       - name: Package
         run: mvn --no-transfer-progress clean package -DskipTests
       - uses: actions/upload-artifact@v4

package/docker/.appversion

@@ -1 +1 @@
-1.0.0
+2.0.0

package/docker/Dockerfile

@@ -1,4 +1,4 @@
-FROM amazoncorretto:8
+FROM amazoncorretto:17
 COPY package/docker/resources/application.yml.template .
 COPY package/docker/resources/start.sh .
 COPY package/docker/resources/*.jar .

package/docker/resources/application.yml.template

@@ -1,6 +1,7 @@
 server:
   port: 9080
-  contextPath: /atomfeed-console
+  servlet:
+    context-path: /atomfeed-console
 appConfigs:
 -
    appName: OpenMRS

package/docker/resources/start.sh

@@ -4,4 +4,4 @@ set -e
 echo "[INFO] Substituting Environment Variables"
 envsubst < application.yml.template > application.yml
 echo "[INFO] Starting Application"
-java -jar *.jar --spring.config.location=appilcation.yml
+java -jar *.jar --spring.config.location=application.yml

pom.xml

@@ -11,7 +11,7 @@
     <parent>
         <groupId>org.springframework.boot</groupId>
         <artifactId>spring-boot-starter-parent</artifactId>
-        <version>1.3.2.RELEASE</version>
+        <version>3.4.5</version>
     </parent>
 
 
@@ -23,7 +23,6 @@
         <dependency>
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-starter-test</artifactId>
-            <version>1.3.2.RELEASE</version>
             <scope>test</scope>
         </dependency>
         <dependency>
@@ -34,45 +33,39 @@
         <dependency>
             <groupId>org.postgresql</groupId>
             <artifactId>postgresql</artifactId>
-            <version>9.4.1211.jre7</version>
+            <version>42.7.4</version>
         </dependency>
         <dependency>
-            <groupId>mysql</groupId>
-            <artifactId>mysql-connector-java</artifactId>
-            <version>5.1.8</version>
+            <groupId>com.mysql</groupId>
+            <artifactId>mysql-connector-j</artifactId>
+            <version>9.1.0</version>
         </dependency>
         <dependency>
-            <groupId>c3p0</groupId>
+            <groupId>com.mchange</groupId>
             <artifactId>c3p0</artifactId>
-            <version>0.9.1.2</version>
-        </dependency>
-        <dependency>
-            <groupId>log4j</groupId>
-            <artifactId>log4j</artifactId>
-            <version>1.2.17</version>
-            <scope>provided</scope>
+            <version>0.9.5.5</version>
         </dependency>
         <dependency>
             <groupId>com.h2database</groupId>
             <artifactId>h2</artifactId>
-            <version>1.4.191</version>
             <scope>test</scope>
         </dependency>
+        <!-- JUnit 4 (vintage) support for existing tests -->
         <dependency>
-            <groupId>com.github.searls</groupId>
-            <artifactId>jasmine-maven-plugin</artifactId>
+            <groupId>org.junit.vintage</groupId>
+            <artifactId>junit-vintage-engine</artifactId>
             <scope>test</scope>
-            <version>2.1</version>
         </dependency>
+        <!-- Bridge log4j 1.x API calls (from atomfeed-client) to SLF4J -->
         <dependency>
-            <groupId>com.kelveden</groupId>
-            <artifactId>maven-karma-plugin</artifactId>
-            <version>1.6</version>
+            <groupId>org.slf4j</groupId>
+            <artifactId>log4j-over-slf4j</artifactId>
         </dependency>
     </dependencies>
 
     <properties>
-        <java.version>1.7</java.version>
+        <java.version>17</java.version>
+        <tomcat.version>10.1.55</tomcat.version>
         <rpm.build.number>1</rpm.build.number>
     </properties>
 
@@ -83,44 +76,6 @@
                 <groupId>org.springframework.boot</groupId>
                 <artifactId>spring-boot-maven-plugin</artifactId>
             </plugin>
-            <plugin>
-                <groupId>org.codehaus.mojo</groupId>
-                <artifactId>exec-maven-plugin</artifactId>
-                <executions>
-                    <execution>
-                        <phase>generate-sources</phase>
-                        <goals>
-                            <goal>exec</goal>
-                        </goals>
-                    </execution>
-                </executions>
-                <configuration>
-                    <executable>bower</executable>
-                    <arguments>
-                        <argument>install</argument>
-                    </arguments>
-                    <workingDirectory>${basedir}/src/main</workingDirectory>
-                </configuration>
-
-            </plugin>
-
-            <plugin>
-                <groupId>com.kelveden</groupId>
-                <artifactId>maven-karma-plugin</artifactId>
-                <version>1.6</version>
-                <executions>
-                    <execution>
-                        <phase>process-test-classes</phase>
-                        <goals>
-                            <goal>start</goal>
-                        </goals>
-                    </execution>
-                </executions>
-                <configuration>
-                    <karmaExecutable>${basedir}/src/main/resources/static/node_modules/karma/bin/karma</karmaExecutable>
-                    <configFile>src/main/resources/static/test/karma.conf.js</configFile>
-                </configuration>
-            </plugin>
             <plugin>
                 <groupId>org.codehaus.mojo</groupId>
                 <artifactId>rpm-maven-plugin</artifactId>

src/main/java/org/ict4h/config/WebConfig.java

@@ -3,20 +3,19 @@
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
 import org.springframework.web.servlet.config.annotation.ViewControllerRegistry;
-import org.springframework.web.servlet.config.annotation.WebMvcConfigurerAdapter;
+import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;
 
 @Configuration
 public class WebConfig {
 
     @Bean
-    public WebMvcConfigurerAdapter forwardToIndex() {
-        return new WebMvcConfigurerAdapter() {
+    public WebMvcConfigurer forwardToIndex() {
+        return new WebMvcConfigurer() {
             @Override
             public void addViewControllers(ViewControllerRegistry registry) {
-                // forward requests to /admin and /user to their index.html
+                // forward requests to /app to its index.html
                 registry.addViewController("/app").setViewName(
-                        "/Users/kritikaj/kritika_code/atomfeed-console/src/main/static/index.html");
-
+                        "forward:/index.html");
             }
         };
     }

src/main/java/org/ict4h/jdbc/ConnectionPools.java

@@ -6,7 +6,7 @@
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.stereotype.Component;
 
-import javax.annotation.PostConstruct;
+import jakarta.annotation.PostConstruct;
 import java.sql.Connection;
 import java.sql.SQLException;
 import java.util.HashMap;

src/main/java/org/ict4h/service/AppStatusService.java

@@ -1,6 +1,5 @@
 package org.ict4h.service;
 
-import org.apache.log4j.Logger;
 import org.ict4h.atomfeed.client.domain.Marker;
 import org.ict4h.atomfeed.client.repository.AllFailedEvents;
 import org.ict4h.atomfeed.client.repository.AllMarkers;
@@ -11,6 +10,8 @@
 import org.ict4h.domain.Feeds;
 import org.ict4h.domain.Feed;
 import org.ict4h.jdbc.ConnectionPools;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.stereotype.Component;
 
@@ -21,7 +22,7 @@
 
 @Component
 public class AppStatusService {
-    private static Logger logger = Logger.getLogger(AppStatusService.class);
+    private static Logger logger = LoggerFactory.getLogger(AppStatusService.class);
     ConnectionPools connectionPools;
 
     @Autowired

src/main/java/org/ict4h/service/FailedEventRetryLogService.java

@@ -1,18 +1,19 @@
 package org.ict4h.service;
 
-import org.apache.log4j.Logger;
 import org.ict4h.atomfeed.client.domain.FailedEventRetryLog;
 import org.ict4h.atomfeed.client.repository.AllFailedEvents;
 import org.ict4h.atomfeed.client.repository.jdbc.AllFailedEventsJdbcImpl;
 import org.ict4h.domain.configuration.AppConfig;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.stereotype.Component;
 
 import java.util.List;
 
 @Component
 public class FailedEventRetryLogService {
-    private static Logger logger = Logger.getLogger(FailedEventRetryLogService.class);
+    private static Logger logger = LoggerFactory.getLogger(FailedEventRetryLogService.class);
     @Autowired
     private AppStatusService appStatusService;
 

src/main/java/org/ict4h/service/FailedEventService.java

@@ -1,18 +1,19 @@
 package org.ict4h.service;
 
-import org.apache.log4j.Logger;
 import org.ict4h.atomfeed.client.domain.FailedEvent;
 import org.ict4h.atomfeed.client.repository.AllFailedEvents;
 import org.ict4h.atomfeed.client.repository.jdbc.AllFailedEventsJdbcImpl;
 import org.ict4h.domain.configuration.AppConfig;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
 import org.springframework.beans.factory.annotation.Autowired;
 import org.springframework.stereotype.Component;
 
 import java.util.List;
 
 @Component
 public class FailedEventService {
-    private static Logger logger = Logger.getLogger(FailedEventService.class);
+    private static Logger logger = LoggerFactory.getLogger(FailedEventService.class);
 
     @Autowired
     private AppStatusService appStatusService;

src/main/resources/application.yml

@@ -1,6 +1,7 @@
 server:
   port: 9080
-  contextPath: /atomfeed-console
+  servlet:
+    context-path: /atomfeed-console
 appConfigs:
 -
    appName: App1

src/test/java/org/ict4h/controller/AppStatusControllerTest.java

@@ -2,13 +2,10 @@
 
 import org.ict4h.AtomfeedConsoleApplication;
 import org.ict4h.controllers.AppController;
-import org.ict4h.domain.configuration.AppConfig;
-import org.ict4h.domain.configuration.AppConfigs;
 import org.junit.Test;
 import org.junit.runner.RunWith;
 import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.beans.factory.annotation.Value;
-import org.springframework.boot.test.SpringApplicationConfiguration;
+import org.springframework.boot.test.context.SpringBootTest;
 import org.springframework.test.context.junit4.SpringJUnit4ClassRunner;
 
 import java.util.List;
@@ -18,13 +15,12 @@
 import static org.junit.Assert.*;
 
 @RunWith(SpringJUnit4ClassRunner.class)
-@SpringApplicationConfiguration(AtomfeedConsoleApplication.class)
+@SpringBootTest(classes = AtomfeedConsoleApplication.class)
 public class AppStatusControllerTest {
 
     @Autowired
     private AppController appController;
 
-    @Value("${../../resources/application.yml}")
     @Test
     public void shouldRetrieveConfig() {
         List<String> appDetails = appController.getAppDetails();

src/test/java/org/ict4h/controller/FailedEventControllerTest.java

@@ -9,7 +9,7 @@
 import org.junit.Test;
 import org.junit.runner.RunWith;
 import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.boot.test.SpringApplicationConfiguration;
+import org.springframework.boot.test.context.SpringBootTest;
 import org.springframework.test.context.junit4.SpringJUnit4ClassRunner;
 
 import java.sql.SQLException;
@@ -21,7 +21,7 @@
 import static org.junit.Assert.assertThat;
 
 @RunWith(SpringJUnit4ClassRunner.class)
-@SpringApplicationConfiguration(AtomfeedConsoleApplication.class)
+@SpringBootTest(classes = AtomfeedConsoleApplication.class)
 public class FailedEventControllerTest extends BaseTest {
 
     private int failedEventId = 1;

src/test/java/org/ict4h/controller/FailedEventRetryLogControllerTest.java

@@ -9,7 +9,7 @@
 import org.junit.Test;
 import org.junit.runner.RunWith;
 import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.boot.test.SpringApplicationConfiguration;
+import org.springframework.boot.test.context.SpringBootTest;
 import org.springframework.test.context.junit4.SpringJUnit4ClassRunner;
 
 import java.sql.SQLException;
@@ -20,7 +20,7 @@
 import static org.junit.Assert.assertThat;
 
 @RunWith(SpringJUnit4ClassRunner.class)
-@SpringApplicationConfiguration(AtomfeedConsoleApplication.class)
+@SpringBootTest(classes = AtomfeedConsoleApplication.class)
 public class FailedEventRetryLogControllerTest extends BaseTest {
     private int failedEventRetryId = 1;
 

src/test/java/org/ict4h/controller/FeedsControllerTest.java

@@ -10,7 +10,7 @@
 import org.junit.Test;
 import org.junit.runner.RunWith;
 import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.boot.test.SpringApplicationConfiguration;
+import org.springframework.boot.test.context.SpringBootTest;
 import org.springframework.test.context.junit4.SpringJUnit4ClassRunner;
 
 import java.sql.SQLException;
@@ -21,7 +21,7 @@
 
 
 @RunWith(SpringJUnit4ClassRunner.class)
-@SpringApplicationConfiguration(AtomfeedConsoleApplication.class)
+@SpringBootTest(classes = AtomfeedConsoleApplication.class)
 public class FeedsControllerTest extends BaseTest {
 
     private static final String CREATE_MARKERS= "insert into markers " +

src/test/java/org/ict4h/controller/ResetRetriesForFailedEventTest.java

@@ -7,7 +7,7 @@
 import org.junit.Test;
 import org.junit.runner.RunWith;
 import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.boot.test.SpringApplicationConfiguration;
+import org.springframework.boot.test.context.SpringBootTest;
 import org.springframework.test.context.junit4.SpringJUnit4ClassRunner;
 
 import java.sql.SQLException;
@@ -18,7 +18,7 @@
 import static org.junit.Assert.assertThat;
 
 @RunWith(SpringJUnit4ClassRunner.class)
-@SpringApplicationConfiguration(AtomfeedConsoleApplication.class)
+@SpringBootTest(classes = AtomfeedConsoleApplication.class)
 public class ResetRetriesForFailedEventTest extends BaseTest {
 
     private int failedEventId = 1;

src/test/java/org/ict4h/util/Database.java

@@ -14,7 +14,7 @@ public static void createDatabase() throws SQLException {
     }
 
     public static Connection getConnection() throws SQLException {
-        return DriverManager.getConnection("jdbc:h2:mem:test;DB_CLOSE_DELAY=-1", "", "");
+        return DriverManager.getConnection("jdbc:h2:mem:test;DB_CLOSE_DELAY=-1;MODE=MySQL", "", "");
     }
 
     private static final String CREATE_MARKERS_TABLE = "CREATE TABLE markers (\n" +