Conversation
Added new commandline and ant argument ignoreDeprecated, which ignores methods and classes from instrumenting
Deleting the travis.yml file since we're using cloudbees for our continuous integration.
The web-app element requires version 2.4 of the Java Servlet specification while the DTD points to version 2.3. This confuses some app servers and e.g. GlassFish 3.1 reports the following error and refuses to deploy the application: Error occurred during deployment: Exception while deploying the app [coberturaFlush] : org.xml.sax.SAXParseException: Attribute "xmlns" must be declared for element type "web-app".. Please see server.log for more details. I don't think there even is a DTD for version 2.4 anymore and removing the 2.3 DTD declaration fixes the issue.
The 2.4 web-app XML schema is strict about the order of some elements in the web.xml. Put the elements into the correct order.
The file that actually gets bundled is in src/main/resources.
No dependencies are needed except for cobertura.jar. The classpath manifest entries will trigger errors like this when deploying to GlassFish 3.1: |WARNING|glassfish3.1.1|org.apache.jasper.runtime.TldScanner|_ThreadID=24;_ThreadName=Thread-2;|PWC6351: In TLD scanning, the supplied resource file:/opt/glassfish3/glassfish/domains/domain1/applications/lib/hamcrest-core-1.3.jar does not exist
Create DSL for Cobertura
Resolve conflict and merge changes
The command-line scripts were modified to include tokens for the versions of the different libraries, which will change over time and were out of date. The modified POM now filters the scripts, substituting in the versions as specified in the POM, and the modified assembly descriptor includes them in the distribution.
…tings to reactor root. Parent poms pending.
…nt rules. Added new cobertura parent pom.
…ernal interactions.
…cs API with coverage calculator and event listener specification.
…msiemczyk-master Conflicts: cobertura/executables/cobertura-check.sh cobertura/executables/cobertura-instrument.sh cobertura/executables/cobertura-merge.sh cobertura/executables/cobertura-report.sh cobertura/pom.xml cobertura/src/main/javacc/Java1.1.jj cobertura/src/test/java/net/sourceforge/cobertura/test/AbstractCoberturaTestCase.java
Fix executable scripts
maven-compiler-plugin 3.8.1
Bumps `antVersion` from 1.9.3 to 1.10.9. Updates `ant` from 1.9.3 to 1.10.9 Updates `ant-junit` from 1.9.3 to 1.10.9 Updates `ant-junit4` from 1.9.3 to 1.10.9 Signed-off-by: dependabot[bot] <support@github.com>
…rsion-1.10.9 Bump antVersion from 1.9.3 to 1.10.9 in /cobertura
Create SECURITY.md
Bump slf4j version to a more recent one
Updated surefire, ASM, and findbugs to JDK 1.8
use github actions for maven build (JDK 7 to 14)
This fixes temporary file information disclosure vulnerability due to the use of the vulnerable `File.createTempFile()` method. The vulnerability is fixed by using the `Files.createTempFile()` method which sets the correct posix permissions. Weakness: CWE-377: Insecure Temporary File Severity: Medium CVSSS: 5.5 Detection: CodeQL & OpenRewrite (https://public.moderne.io/recipes/org.openrewrite.java.security.SecureTempFileCreation) Reported-by: Jonathan Leitschuh <Jonathan.Leitschuh@gmail.com> Signed-off-by: Jonathan Leitschuh <Jonathan.Leitschuh@gmail.com> Bug-tracker: JLLeitschuh/security-research#18 Co-authored-by: Moderne <team@moderne.io>
…emporary_file_local_information_disclosure [SECURITY] Fix Temporary File Information Disclosure Vulnerability
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
18 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Merge pull request to fix Issue #200