From b7e63833f3464968f56b428c58b6f483ef904032 Mon Sep 17 00:00:00 2001 From: Sean Lin Date: Wed, 3 Jun 2020 16:50:25 -0700 Subject: [PATCH] feat: allow admin to update any SDB configuration (#258) * feat: allow admin to update any SDB configuration * chore: address vulnerabilities in dependencies * chore: update sha1 of spring boot parent pom * fix: Gradle 6.4.1 seems to have issues with SpotBugs, downgrading to 6.3 --- build.gradle | 9 +- cerberus-api-tests/cerberus-api-tests.gradle | 2 +- cerberus-dashboard/package-lock.json | 123 +- .../PrincipalHasOwnerPermsForSdb.java | 2 +- dependency-check-supressions.xml | 28 +- gradle.properties | 2 +- gradle/verification-metadata.xml | 1742 ++++++++++------- gradle/wrapper/gradle-wrapper.properties | 2 +- 8 files changed, 1100 insertions(+), 810 deletions(-) diff --git a/build.gradle b/build.gradle index dae9ddfc8..88e9b49fc 100644 --- a/build.gradle +++ b/build.gradle @@ -28,6 +28,7 @@ buildscript { springBoot: springBootVersion, ] } + ext['groovy.version'] = '2.5.12' repositories { maven { @@ -47,7 +48,7 @@ buildscript { } plugins { - id "io.spring.dependency-management" version "1.0.8.RELEASE" + id "io.spring.dependency-management" version "1.0.9.RELEASE" id "com.github.kt3k.coveralls" version "2.9.0" } @@ -66,7 +67,7 @@ allprojects { } spotbugs { - toolVersion = '3.1.12' + toolVersion = '4.0.3' sourceSets = [ sourceSets.main ] excludeFilter = file("${rootProject.projectDir}/findbugs-supressions.xml") } @@ -134,7 +135,7 @@ subprojects { annotationProcessor "org.projectlombok:lombok:${versions.lombok}" // common test deps - testImplementation 'org.codehaus.groovy:groovy-all:2.5.7' + testImplementation 'org.codehaus.groovy:groovy-all:2.5.12' testImplementation 'org.spockframework:spock-core:1.3-groovy-2.5' testImplementation 'junit:junit:4.12' testImplementation group: 'org.mockito', name: 'mockito-all', version: '1.10.19' @@ -195,7 +196,7 @@ configurations { } dependencies { - antJUnit 'org.apache.ant:ant-junit:1.9.7' + antJUnit 'org.apache.ant:ant-junit:1.9.15' } // Compile all the test results into a single one. diff --git a/cerberus-api-tests/cerberus-api-tests.gradle b/cerberus-api-tests/cerberus-api-tests.gradle index 17fa7a5ec..944566613 100644 --- a/cerberus-api-tests/cerberus-api-tests.gradle +++ b/cerberus-api-tests/cerberus-api-tests.gradle @@ -26,7 +26,7 @@ dependencies { compile group: 'org.testng', name: 'testng', version: '7.1.0' compile 'junit:junit:4.12' compile 'org.slf4j:slf4j-api:1.7.21' - compile group: 'org.codehaus.groovy', name: 'groovy-all', version: '2.5.9' + compile group: 'org.codehaus.groovy', name: 'groovy-all', version: '2.5.12' compile 'io.rest-assured:rest-assured:4.1.2' compile group: 'io.rest-assured', name: 'json-schema-validator', version: '4.1.2' compile group: 'io.rest-assured', name: 'json-path', version: '4.1.2' diff --git a/cerberus-dashboard/package-lock.json b/cerberus-dashboard/package-lock.json index 975b57731..0eddd1133 100644 --- a/cerberus-dashboard/package-lock.json +++ b/cerberus-dashboard/package-lock.json @@ -8996,7 +8996,8 @@ "ansi-regex": { "version": "2.1.1", "bundled": true, - "dev": true + "dev": true, + "optional": true }, "aproba": { "version": "1.2.0", @@ -9017,12 +9018,14 @@ "balanced-match": { "version": "1.0.0", "bundled": true, - "dev": true + "dev": true, + "optional": true }, "brace-expansion": { "version": "1.1.11", "bundled": true, "dev": true, + "optional": true, "requires": { "balanced-match": "^1.0.0", "concat-map": "0.0.1" @@ -9037,17 +9040,20 @@ "code-point-at": { "version": "1.1.0", "bundled": true, - "dev": true + "dev": true, + "optional": true }, "concat-map": { "version": "0.0.1", "bundled": true, - "dev": true + "dev": true, + "optional": true }, "console-control-strings": { "version": "1.1.0", "bundled": true, - "dev": true + "dev": true, + "optional": true }, "core-util-is": { "version": "1.0.2", @@ -9164,7 +9170,8 @@ "inherits": { "version": "2.0.4", "bundled": true, - "dev": true + "dev": true, + "optional": true }, "ini": { "version": "1.3.5", @@ -9176,6 +9183,7 @@ "version": "1.0.0", "bundled": true, "dev": true, + "optional": true, "requires": { "number-is-nan": "^1.0.0" } @@ -9190,6 +9198,7 @@ "version": "3.0.4", "bundled": true, "dev": true, + "optional": true, "requires": { "brace-expansion": "^1.1.7" } @@ -9197,12 +9206,14 @@ "minimist": { "version": "0.0.8", "bundled": true, - "dev": true + "dev": true, + "optional": true }, "minipass": { "version": "2.9.0", "bundled": true, "dev": true, + "optional": true, "requires": { "safe-buffer": "^5.1.2", "yallist": "^3.0.0" @@ -9221,6 +9232,7 @@ "version": "0.5.1", "bundled": true, "dev": true, + "optional": true, "requires": { "minimist": "0.0.8" } @@ -9310,7 +9322,8 @@ "number-is-nan": { "version": "1.0.1", "bundled": true, - "dev": true + "dev": true, + "optional": true }, "object-assign": { "version": "4.1.1", @@ -9322,6 +9335,7 @@ "version": "1.4.0", "bundled": true, "dev": true, + "optional": true, "requires": { "wrappy": "1" } @@ -9407,7 +9421,8 @@ "safe-buffer": { "version": "5.1.2", "bundled": true, - "dev": true + "dev": true, + "optional": true }, "safer-buffer": { "version": "2.1.2", @@ -9443,6 +9458,7 @@ "version": "1.0.2", "bundled": true, "dev": true, + "optional": true, "requires": { "code-point-at": "^1.0.0", "is-fullwidth-code-point": "^1.0.0", @@ -9462,6 +9478,7 @@ "version": "3.0.1", "bundled": true, "dev": true, + "optional": true, "requires": { "ansi-regex": "^2.0.0" } @@ -9505,12 +9522,14 @@ "wrappy": { "version": "1.0.2", "bundled": true, - "dev": true + "dev": true, + "optional": true }, "yallist": { "version": "3.1.1", "bundled": true, - "dev": true + "dev": true, + "optional": true } } } @@ -17065,7 +17084,8 @@ "ansi-regex": { "version": "2.1.1", "bundled": true, - "dev": true + "dev": true, + "optional": true }, "aproba": { "version": "1.2.0", @@ -17086,12 +17106,14 @@ "balanced-match": { "version": "1.0.0", "bundled": true, - "dev": true + "dev": true, + "optional": true }, "brace-expansion": { "version": "1.1.11", "bundled": true, "dev": true, + "optional": true, "requires": { "balanced-match": "^1.0.0", "concat-map": "0.0.1" @@ -17106,17 +17128,20 @@ "code-point-at": { "version": "1.1.0", "bundled": true, - "dev": true + "dev": true, + "optional": true }, "concat-map": { "version": "0.0.1", "bundled": true, - "dev": true + "dev": true, + "optional": true }, "console-control-strings": { "version": "1.1.0", "bundled": true, - "dev": true + "dev": true, + "optional": true }, "core-util-is": { "version": "1.0.2", @@ -17233,7 +17258,8 @@ "inherits": { "version": "2.0.4", "bundled": true, - "dev": true + "dev": true, + "optional": true }, "ini": { "version": "1.3.5", @@ -17245,6 +17271,7 @@ "version": "1.0.0", "bundled": true, "dev": true, + "optional": true, "requires": { "number-is-nan": "^1.0.0" } @@ -17259,6 +17286,7 @@ "version": "3.0.4", "bundled": true, "dev": true, + "optional": true, "requires": { "brace-expansion": "^1.1.7" } @@ -17266,12 +17294,14 @@ "minimist": { "version": "0.0.8", "bundled": true, - "dev": true + "dev": true, + "optional": true }, "minipass": { "version": "2.9.0", "bundled": true, "dev": true, + "optional": true, "requires": { "safe-buffer": "^5.1.2", "yallist": "^3.0.0" @@ -17290,6 +17320,7 @@ "version": "0.5.1", "bundled": true, "dev": true, + "optional": true, "requires": { "minimist": "0.0.8" } @@ -17379,7 +17410,8 @@ "number-is-nan": { "version": "1.0.1", "bundled": true, - "dev": true + "dev": true, + "optional": true }, "object-assign": { "version": "4.1.1", @@ -17391,6 +17423,7 @@ "version": "1.4.0", "bundled": true, "dev": true, + "optional": true, "requires": { "wrappy": "1" } @@ -17476,7 +17509,8 @@ "safe-buffer": { "version": "5.1.2", "bundled": true, - "dev": true + "dev": true, + "optional": true }, "safer-buffer": { "version": "2.1.2", @@ -17512,6 +17546,7 @@ "version": "1.0.2", "bundled": true, "dev": true, + "optional": true, "requires": { "code-point-at": "^1.0.0", "is-fullwidth-code-point": "^1.0.0", @@ -17531,6 +17566,7 @@ "version": "3.0.1", "bundled": true, "dev": true, + "optional": true, "requires": { "ansi-regex": "^2.0.0" } @@ -17574,12 +17610,14 @@ "wrappy": { "version": "1.0.2", "bundled": true, - "dev": true + "dev": true, + "optional": true }, "yallist": { "version": "3.1.1", "bundled": true, - "dev": true + "dev": true, + "optional": true } } }, @@ -17968,7 +18006,8 @@ "ansi-regex": { "version": "2.1.1", "bundled": true, - "dev": true + "dev": true, + "optional": true }, "aproba": { "version": "1.2.0", @@ -17989,12 +18028,14 @@ "balanced-match": { "version": "1.0.0", "bundled": true, - "dev": true + "dev": true, + "optional": true }, "brace-expansion": { "version": "1.1.11", "bundled": true, "dev": true, + "optional": true, "requires": { "balanced-match": "^1.0.0", "concat-map": "0.0.1" @@ -18009,17 +18050,20 @@ "code-point-at": { "version": "1.1.0", "bundled": true, - "dev": true + "dev": true, + "optional": true }, "concat-map": { "version": "0.0.1", "bundled": true, - "dev": true + "dev": true, + "optional": true }, "console-control-strings": { "version": "1.1.0", "bundled": true, - "dev": true + "dev": true, + "optional": true }, "core-util-is": { "version": "1.0.2", @@ -18136,7 +18180,8 @@ "inherits": { "version": "2.0.4", "bundled": true, - "dev": true + "dev": true, + "optional": true }, "ini": { "version": "1.3.5", @@ -18148,6 +18193,7 @@ "version": "1.0.0", "bundled": true, "dev": true, + "optional": true, "requires": { "number-is-nan": "^1.0.0" } @@ -18162,6 +18208,7 @@ "version": "3.0.4", "bundled": true, "dev": true, + "optional": true, "requires": { "brace-expansion": "^1.1.7" } @@ -18169,12 +18216,14 @@ "minimist": { "version": "0.0.8", "bundled": true, - "dev": true + "dev": true, + "optional": true }, "minipass": { "version": "2.9.0", "bundled": true, "dev": true, + "optional": true, "requires": { "safe-buffer": "^5.1.2", "yallist": "^3.0.0" @@ -18193,6 +18242,7 @@ "version": "0.5.1", "bundled": true, "dev": true, + "optional": true, "requires": { "minimist": "0.0.8" } @@ -18282,7 +18332,8 @@ "number-is-nan": { "version": "1.0.1", "bundled": true, - "dev": true + "dev": true, + "optional": true }, "object-assign": { "version": "4.1.1", @@ -18294,6 +18345,7 @@ "version": "1.4.0", "bundled": true, "dev": true, + "optional": true, "requires": { "wrappy": "1" } @@ -18379,7 +18431,8 @@ "safe-buffer": { "version": "5.1.2", "bundled": true, - "dev": true + "dev": true, + "optional": true }, "safer-buffer": { "version": "2.1.2", @@ -18415,6 +18468,7 @@ "version": "1.0.2", "bundled": true, "dev": true, + "optional": true, "requires": { "code-point-at": "^1.0.0", "is-fullwidth-code-point": "^1.0.0", @@ -18434,6 +18488,7 @@ "version": "3.0.1", "bundled": true, "dev": true, + "optional": true, "requires": { "ansi-regex": "^2.0.0" } @@ -18477,12 +18532,14 @@ "wrappy": { "version": "1.0.2", "bundled": true, - "dev": true + "dev": true, + "optional": true }, "yallist": { "version": "3.1.1", "bundled": true, - "dev": true + "dev": true, + "optional": true } } }, diff --git a/cerberus-web/src/main/java/com/nike/cerberus/security/PrincipalHasOwnerPermsForSdb.java b/cerberus-web/src/main/java/com/nike/cerberus/security/PrincipalHasOwnerPermsForSdb.java index c1bafbc72..e498376c1 100644 --- a/cerberus-web/src/main/java/com/nike/cerberus/security/PrincipalHasOwnerPermsForSdb.java +++ b/cerberus-web/src/main/java/com/nike/cerberus/security/PrincipalHasOwnerPermsForSdb.java @@ -25,5 +25,5 @@ @Target(ElementType.METHOD) @Retention(RetentionPolicy.RUNTIME) @PreAuthorize( - "@permissionValidationService.doesPrincipalHaveOwnerPermissions(authentication, #sdbId)") + "hasRole('ROLE_ADMIN') or @permissionValidationService.doesPrincipalHaveOwnerPermissions(authentication, #sdbId)") public @interface PrincipalHasOwnerPermsForSdb {} diff --git a/dependency-check-supressions.xml b/dependency-check-supressions.xml index 5f8a23664..485c30d35 100644 --- a/dependency-check-supressions.xml +++ b/dependency-check-supressions.xml @@ -18,35 +18,35 @@ - c934efe76038c21dbf033b797593acfbf5db73a9 + ]]> + ^pkg:maven/org\.springframework\.security/spring\-security\-web@.*$ CVE-2018-1258 - 8e6c8c1e88654122d84ab79ad87186344b3d5eb2 + ]]> + ^pkg:maven/org\.springframework\.security/spring\-security\-core@.*$ CVE-2018-1258 - 2b52303edc13f2b45869e778ff47f4b390feb0a9 + ]]> + ^pkg:maven/org\.springframework\.security/spring\-security\-config@.*$ CVE-2018-1258 @@ -73,4 +73,14 @@ 606ef790ce33d9cd6b892c47cc2a9508efc57698 CVE-2016-6798 + + + ^pkg:maven/org\.dom4j/dom4j@.*$ + CVE-2020-10683 + diff --git a/gradle.properties b/gradle.properties index e90332d4b..e5e062c9b 100644 --- a/gradle.properties +++ b/gradle.properties @@ -16,4 +16,4 @@ version=4.3.3 group=com.nike.cerberus -springBootVersion=2.2.5.RELEASE +springBootVersion=2.3.0.RELEASE diff --git a/gradle/verification-metadata.xml b/gradle/verification-metadata.xml index 5c5aebbb1..ad957b2dc 100644 --- a/gradle/verification-metadata.xml +++ b/gradle/verification-metadata.xml @@ -184,6 +184,11 @@ + + + + + @@ -273,19 +278,14 @@ - - - - - - - - + + + - - - + + + @@ -308,6 +308,11 @@ + + + + + @@ -331,12 +336,12 @@ - - - + + + - - + + @@ -347,70 +352,70 @@ - - - + + + - - + + - - - + + + - - + + - - - + + + - - + + - - - + + + - - - + + + - - + + - - - + + + - - + + - - - + + + - - + + - - - + + + - - + + - - - + + + @@ -421,26 +426,26 @@ - - - + + + - - + + - - + + - - - + + + - - + + - - + + @@ -525,20 +530,26 @@ - - - + + + - - + + + + + - - - + + + + + + - - + + @@ -856,6 +867,14 @@ + + + + + + + + @@ -1178,12 +1197,12 @@ - - - + + + - - + + @@ -1194,9 +1213,9 @@ - - - + + + @@ -1243,11 +1262,32 @@ + + + + + + + + + + + + + + + + + + + + + @@ -1289,6 +1329,11 @@ + + + + + @@ -1340,14 +1385,24 @@ + + + + + - - - + + + + + + + + @@ -1411,12 +1466,12 @@ - - - + + + - - + + @@ -1435,12 +1490,12 @@ - - - + + + - - + + @@ -1500,6 +1555,9 @@ + + + @@ -1520,12 +1578,17 @@ - - - + + + + + + - - + + + + @@ -1536,12 +1599,12 @@ - - - + + + - - + + @@ -1549,9 +1612,9 @@ - - - + + + @@ -1639,17 +1702,17 @@ - - - + + + - - - + + + - - + + @@ -1662,9 +1725,9 @@ - - - + + + @@ -1677,9 +1740,14 @@ - - - + + + + + + + + @@ -1769,22 +1837,14 @@ - - - + + + - - - - - - - - - - - + + + @@ -1858,11 +1918,24 @@ + + + + + + + + + + + + + @@ -1919,6 +1992,14 @@ + + + + + + + + @@ -1932,6 +2013,14 @@ + + + + + + + + @@ -1956,12 +2045,25 @@ - - - + + + + + + + + + + + + + + + + - - + + @@ -1980,14 +2082,6 @@ - - - - - - - - @@ -2020,25 +2114,25 @@ - - - + + + - - + + - - - + + + - - + + - - - + + + @@ -2061,6 +2155,35 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -2114,6 +2237,14 @@ + + + + + + + + @@ -2190,44 +2321,28 @@ - - - - - - - - - - - + + + - - + + - - - + + + - - + + - - - + + + - - - - - - - - - - + + @@ -2238,20 +2353,12 @@ - - - - - - - - - - - + + + - - + + @@ -2259,22 +2366,17 @@ - - - + + + - - - + + + - - - - - - - + + @@ -2298,6 +2400,14 @@ + + + + + + + + @@ -2379,6 +2489,16 @@ + + + + + + + + + + @@ -2405,12 +2525,12 @@ - - - + + + - - + + @@ -2423,9 +2543,9 @@ - - - + + + @@ -2477,12 +2597,12 @@ - - - + + + - - + + @@ -2500,17 +2620,17 @@ - - - + + + - - - + + + - - + + @@ -2518,17 +2638,17 @@ - - - + + + - - - + + + - - + + @@ -2744,33 +2864,20 @@ - - - + + + - - - - - - - - - - - - - - - + + - - - + + + - - + + @@ -2799,17 +2906,17 @@ - - - + + + - - + + - - - + + + @@ -2876,12 +2983,12 @@ - - - + + + - - + + @@ -2897,182 +3004,177 @@ - - - - - - + + + - - - - + + - - - + + + - - - + + + - - + + - - - + + + - - + + - - - + + + - - + + - - - + + + - - + + - - - + + + - - + + - - - + + + - - + + - - - + + + - - + + - - - + + + - - + + - - - + + + - - + + - - - + + + - - + + - - - + + + - - + + - - - + + + - - + + - - - + + + - - + + - - - + + + - - + + - - - + + + - - + + - - - + + + - - + + - - - + + + - - + + - - - + + + - - + + - - - + + + - - + + - - - + + + - - + + @@ -3083,12 +3185,12 @@ - - - + + + - - + + @@ -3187,6 +3289,14 @@ + + + + + + + + @@ -3212,9 +3322,9 @@ - - - + + + @@ -3253,6 +3363,14 @@ + + + + + + + + @@ -3289,6 +3407,11 @@ + + + + + @@ -3297,12 +3420,20 @@ - - - + + + + + + + + + + + - - + + @@ -3310,17 +3441,9 @@ - - - - - - - - - - - + + + @@ -3347,12 +3470,12 @@ - - - + + + - - + + @@ -3360,12 +3483,12 @@ - - - + + + - - + + @@ -3378,17 +3501,12 @@ - - - - - - + + + - - - - + + @@ -3396,6 +3514,11 @@ + + + + + @@ -3510,20 +3633,25 @@ - - - + + + - - + + + + + + + - - - + + + - - + + @@ -3531,12 +3659,9 @@ - - - - - - + + + @@ -3560,78 +3685,105 @@ - - - - - - - - + + + - - + + - - - + + + + + + - - + + - - - + + + - - + + + + + - - - + + + + + + - - + + - - - + + + - - + + + + + + + + + + + + + + + + - - - + + + - - + + + + + - - - + + + + + + - - + + - - - + + + + + + - - + + @@ -3658,20 +3810,20 @@ - - - + + + - - + + - - - + + + - - + + @@ -3771,14 +3923,6 @@ - - - - - - - - @@ -3787,12 +3931,12 @@ - - - + + + - - + + @@ -3803,12 +3947,12 @@ - - - + + + - - + + @@ -3819,19 +3963,19 @@ + + + + + + + + - - - - - - - - @@ -3840,12 +3984,20 @@ - - - + + + - - + + + + + + + + + + @@ -4075,44 +4227,44 @@ - - - + + + - - + + - - - + + + - - + + - - - + + + - - + + - - - + + + - - + + - - - + + + - - + + @@ -4125,94 +4277,114 @@ - - - + + + - - - + + + - - + + - - - + + + - - + + - - - + + + - - + + - - - + + + - - + + - - - + + + - - + + - - - + + + - - + + - - - + + + - - - + + + + + + - - + + - - - + + + - - + + + + + + + + + + + + + + + + - - - + + + - - + + + + + - - - + + + - - + + @@ -4225,136 +4397,154 @@ - - - + + + - - - + + + - - + + - - - - - - + + + - - - - + + - - - + + + - - + + - - - + + + - - + + + + + - - - + + + + + + - - + + - - - + + + - - + + + + + - - - + + + + + + - - + + - - - + + + + + + - - + + - - - + + + - - + + + + + - - - + + + + + + - - + + - - - + + + + + + - - + + - - - + + + - - + + - - - - + + - - - + + + + + + - - + + - - - + + + - - + + - - - - + + @@ -4482,9 +4672,9 @@ - - - + + + @@ -4497,9 +4687,9 @@ - - - + + + @@ -4512,9 +4702,12 @@ - - - + + + + + + @@ -4522,33 +4715,33 @@ - - - + + + - - - + + + - - + + - - - + + + - - + + - - - + + + - - + + @@ -4561,9 +4754,9 @@ - - - + + + @@ -4571,6 +4764,11 @@ + + + + + @@ -4587,25 +4785,41 @@ - - - + + + + + + + + + + + + + + + + - - + + - - - + + + + + + - - - + + + - - + + @@ -4648,5 +4862,13 @@ + + + + + + + + diff --git a/gradle/wrapper/gradle-wrapper.properties b/gradle/wrapper/gradle-wrapper.properties index b7c8c5dbf..a4b442974 100644 --- a/gradle/wrapper/gradle-wrapper.properties +++ b/gradle/wrapper/gradle-wrapper.properties @@ -1,5 +1,5 @@ distributionBase=GRADLE_USER_HOME distributionPath=wrapper/dists -distributionUrl=https\://services.gradle.org/distributions/gradle-6.2-bin.zip +distributionUrl=https\://services.gradle.org/distributions/gradle-6.3-bin.zip zipStoreBase=GRADLE_USER_HOME zipStorePath=wrapper/dists