pom.xml

<?xml version="1.0"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">

    <modelVersion>4.0.0</modelVersion>
    <groupId>org.owasp.webgoat</groupId>
    <artifactId>webgoat</artifactId>
    <packaging>jar</packaging>
    <version>8.2.3-SNAPSHOT</version>

    <parent>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-parent</artifactId>
        <version>2.6.6</version>
    </parent>

    <name>WebGoat</name>
    <description>WebGoat, a deliberately insecure Web Application</description>
    <inceptionYear>2006</inceptionYear>
    <url>https://github.com/WebGoat/WebGoat</url>
    <organization>
        <name>OWASP</name>
        <url>https://github.com/WebGoat/WebGoat/</url>
    </organization>
    <licenses>
        <license>
            <name>GNU General Public License, version 2</name>
            <url>https://www.gnu.org/licenses/gpl-2.0.txt</url>
        </license>
    </licenses>
    <developers>
        <developer>
            <id>mayhew64</id>
            <name>Bruce Mayhew</name>
            <email>webgoat@owasp.org</email>
            <organization>OWASP</organization>
            <organizationUrl>https://github.com/WebGoat/WebGoat</organizationUrl>
        </developer>
        <developer>
            <id>nbaars</id>
            <name>Nanne Baars</name>
            <email>nanne.baars@owasp.org</email>
            <organizationUrl>https://github.com/nbaars</organizationUrl>
            <timezone>Europe/Amsterdam</timezone>
        </developer>
        <developer>
            <id>misfir3</id>
            <name>Jason White</name>
            <email>jason.white@owasp.org</email>
        </developer>
        <developer>
            <id>zubcevic</id>
            <name>René Zubcevic</name>
            <email>rene.zubcevic@owasp.org</email>
        </developer>
        <developer>
            <id>aolle</id>
            <name>Àngel Ollé Blázquez</name>
            <email>angel@olleb.com</email>
        </developer>
        <developer>
            <id>jwayman</id>
            <name>Jeff Wayman</name>
            <email/>
        </developer>
        <developer>
            <id>dcowden</id>
            <name>Dave Cowden</name>
            <email/>
        </developer>
        <developer>
            <id>lawson89</id>
            <name>Richard Lawson</name>
            <email/>
        </developer>
        <developer>
            <id>dougmorato</id>
            <name>Doug Morato</name>
            <email>doug.morato@owasp.org</email>
            <organization>OWASP</organization>
            <organizationUrl>https://github.com/dougmorato</organizationUrl>
            <timezone>America/New_York</timezone>
            <properties>
                <picUrl>https://avatars2.githubusercontent.com/u/9654?v=3&amp;s=150</picUrl>
            </properties>
        </developer>
    </developers>

    <mailingLists>
        <mailingList>
            <name>OWASP WebGoat Mailing List</name>
            <subscribe>https://lists.owasp.org/mailman/listinfo/owasp-webgoat</subscribe>
            <unsubscribe>Owasp-webgoat-request@lists.owasp.org</unsubscribe>
            <post>owasp-webgoat@lists.owasp.org</post>
            <archive>http://lists.owasp.org/pipermail/owasp-webgoat/</archive>
        </mailingList>
    </mailingLists>

    <scm>
        <url>https://github.com/WebGoat/WebGoat</url>
        <connection>scm:git:git@github.com:WebGoat/WebGoat.git</connection>
        <developerConnection>scm:git:git@github.com:WebGoat/WebGoat.git</developerConnection>
        <tag>HEAD</tag>
    </scm>

    <issueManagement>
        <system>Github Issues</system>
        <url>https://github.com/WebGoat/WebGoat/issues</url>
    </issueManagement>

    <properties>
        <!-- Use UTF-8 Encoding -->
        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
        <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
        <maven.compiler.source>17</maven.compiler.source>
        <maven.compiler.target>17</maven.compiler.target>
        <java.version>17</java.version>
        <webgoat.port>8080</webgoat.port>
        <webwolf.port>9090</webwolf.port>

        <!-- Shared properties with plugins and version numbers across submodules-->
        <ant.version>1.6.5</ant.version>
        <asciidoctorj.version>2.5.2</asciidoctorj.version>
        <bootstrap.version>3.3.7</bootstrap.version>
        <cglib.version>2.2</cglib.version> <!-- do not update necessary for lesson -->
        <checkstyle.version>3.1.2</checkstyle.version>
        <commons-collections.version>3.2.1</commons-collections.version>
        <commons-lang3.version>3.12.0</commons-lang3.version>
        <commons-io.version>2.6</commons-io.version>
        <commons-text.version>1.9</commons-text.version>
        <guava.version>30.1-jre</guava.version>
        <jjwt.version>0.9.1</jjwt.version>
        <jose4j.version>0.7.6</jose4j.version>
        <jsoup.version>1.14.3</jsoup.version>
        <jquery.version>3.5.1</jquery.version>
        <maven-compiler-plugin.version>3.8.0</maven-compiler-plugin.version>
        <maven-failsafe-plugin.version>2.22.0</maven-failsafe-plugin.version>
        <maven-jar-plugin.version>3.1.2</maven-jar-plugin.version>
        <maven-javadoc-plugin.version>3.1.1</maven-javadoc-plugin.version>
        <maven-source-plugin.version>3.1.0</maven-source-plugin.version>
        <maven-surefire-plugin.version>3.0.0-M5</maven-surefire-plugin.version>
        <pmd.version>3.15.0</pmd.version>
        <thymeleaf.version>3.0.15.RELEASE</thymeleaf.version>
        <webdriver.version>4.3.1</webdriver.version>
        <wiremock.version>2.27.2</wiremock.version>
        <xml-resolver.version>1.2</xml-resolver.version>
        <xstream.version>1.4.5</xstream.version> <!-- do not update necessary for lesson -->
        <zxcvbn.version>1.5.2</zxcvbn.version>
    </properties>

    <dependencyManagement>
        <dependencies>
            <dependency>
                <groupId>org.apache.commons</groupId>
                <artifactId>commons-exec</artifactId>
                <version>1.3</version>
            </dependency>
            <dependency>
                <groupId>org.asciidoctor</groupId>
                <artifactId>asciidoctorj</artifactId>
                <version>${asciidoctorj.version}</version>
            </dependency>
            <dependency>
                <!-- jsoup HTML parser library @ https://jsoup.org/ -->
                <groupId>org.jsoup</groupId>
                <artifactId>jsoup</artifactId>
                <version>${jsoup.version}</version>
            </dependency>
            <dependency>
                <groupId>com.nulab-inc</groupId>
                <artifactId>zxcvbn</artifactId>
                <version>${zxcvbn.version}</version>
            </dependency>
            <dependency>
                <groupId>com.thoughtworks.xstream</groupId>
                <artifactId>xstream</artifactId>
                <version>${xstream.version}</version>
            </dependency>
            <dependency>
                <groupId>cglib</groupId>
                <artifactId>cglib-nodep</artifactId>
                <version>${cglib.version}</version>
            </dependency>
            <dependency>
                <groupId>ant</groupId>
                <artifactId>ant-launcher</artifactId>
                <version>${ant.version}</version>
            </dependency>
            <dependency>
                <groupId>ant</groupId>
                <artifactId>ant</artifactId>
                <version>${ant.version}</version>
            </dependency>
            <dependency>
                <groupId>xml-resolver</groupId>
                <artifactId>xml-resolver</artifactId>
                <version>${xml-resolver.version}</version>
            </dependency>
            <dependency>
                <groupId>io.jsonwebtoken</groupId>
                <artifactId>jjwt</artifactId>
                <version>${jjwt.version}</version>
            </dependency>
            <dependency>
                <groupId>com.google.guava</groupId>
                <artifactId>guava</artifactId>
                <version>${guava.version}</version>
            </dependency>
            <dependency>
                <groupId>commons-io</groupId>
                <artifactId>commons-io</artifactId>
                <version>${commons-io.version}</version>
            </dependency>
            <dependency>
                <groupId>org.apache.commons</groupId>
                <artifactId>commons-text</artifactId>
                <version>${commons-text.version}</version>
            </dependency>
            <dependency>
                <groupId>org.bitbucket.b_c</groupId>
                <artifactId>jose4j</artifactId>
                <version>${jose4j.version}</version>
            </dependency>
            <dependency>
                <groupId>org.webjars</groupId>
                <artifactId>bootstrap</artifactId>
                <version>${bootstrap.version}</version>
            </dependency>
            <dependency>
                <groupId>org.webjars</groupId>
                <artifactId>jquery</artifactId>
                <version>${jquery.version}</version>
            </dependency>
            <dependency>
                <groupId>com.github.tomakehurst</groupId>
                <artifactId>wiremock</artifactId>
                <version>${wiremock.version}</version>
            </dependency>
            <dependency>
                <groupId>io.github.bonigarcia</groupId>
                <artifactId>webdrivermanager</artifactId>
                <version>${webdriver.version}</version>
            </dependency>
        </dependencies>
    </dependencyManagement>

    <profiles>
        <profile>
            <id>local-server</id>
        </profile>
        <profile>
            <id>start-server</id>
            <activation>
                <activeByDefault>true</activeByDefault>
            </activation>
            <build>
                <plugins>
                    <plugin>
                        <groupId>org.codehaus.mojo</groupId>
                        <artifactId>build-helper-maven-plugin</artifactId>
                        <executions>
                            <execution>
                                <id>reserve-container-port</id>
                                <goals>
                                    <goal>reserve-network-port</goal>
                                </goals>
                                <phase>process-resources</phase>
                                <configuration>
                                    <portNames>
                                        <portName>webgoat.port</portName>
                                        <portName>webwolf.port</portName>
                                        <portName>jmxPort</portName>
                                    </portNames>
                                </configuration>
                            </execution>
                        </executions>
                    </plugin>
                    <plugin>
                        <groupId>com.bazaarvoice.maven.plugins</groupId>
                        <artifactId>process-exec-maven-plugin</artifactId>
                        <version>0.9</version>
                        <executions>
                            <execution>
                                <id>start-jar</id>
                                <phase>pre-integration-test</phase>
                                <goals>
                                    <goal>start</goal>
                                </goals>
                                <configuration>
                                    <workingDir></workingDir>
                                    <arguments>
                                        <argument>java</argument>
                                        <argument>-jar</argument>
                                        <argument>-Dlogging.pattern.console=</argument>
                                        <argument>-Dspring.main.banner-mode=off</argument>
                                        <argument>-Dspring.datasource.url=jdbc:hsqldb:file:${java.io.tmpdir}/webgoat
                                        </argument>
                                        <argument>-Dwebgoat.port=${webgoat.port}</argument>
                                        <argument>-Dwebwolf.port=${webwolf.port}</argument>
                                        <argument>--add-opens</argument>
                                        <argument>java.base/java.lang=ALL-UNNAMED</argument>
                                        <argument>--add-opens</argument>
                                        <argument>java.base/java.util=ALL-UNNAMED</argument>
                                        <argument>--add-opens</argument>
                                        <argument>java.base/java.lang.reflect=ALL-UNNAMED</argument>
                                        <argument>--add-opens</argument>
                                        <argument>java.base/java.text=ALL-UNNAMED</argument>
                                        <argument>--add-opens</argument>
                                        <argument>java.desktop/java.beans=ALL-UNNAMED</argument>
                                        <argument>--add-opens</argument>
                                        <argument>java.desktop/java.awt.font=ALL-UNNAMED</argument>
                                        <argument>--add-opens</argument>
                                        <argument>java.base/sun.nio.ch=ALL-UNNAMED</argument>
                                        <argument>--add-opens</argument>
                                        <argument>java.base/java.io=ALL-UNNAMED</argument>
                                        <argument>--add-opens</argument>
                                        <argument>java.base/java.util=ALL-UNNAMED</argument>
                                        <argument>
                                            ${project.build.directory}/webgoat-${project.version}.jar
                                        </argument>
                                    </arguments>
                                    <waitForInterrupt>false</waitForInterrupt>
                                    <healthcheckUrl>http://localhost:${webgoat.port}/WebGoat/</healthcheckUrl>
                                </configuration>
                            </execution>
                            <execution>
                                <id>stop-jar-process</id>
                                <phase>post-integration-test</phase>
                                <goals>
                                    <goal>stop-all</goal>
                                </goals>
                            </execution>
                        </executions>
                    </plugin>
                </plugins>
            </build>
        </profile>
        <profile>
            <id>owasp</id>
            <activation>
                <activeByDefault>false</activeByDefault>
            </activation>
            <build>
                <plugins>
                    <plugin>
                        <groupId>org.owasp</groupId>
                        <artifactId>dependency-check-maven</artifactId>
                        <version>6.5.1</version>
                        <configuration>
                            <failBuildOnCVSS>7</failBuildOnCVSS>
                            <skipProvidedScope>true</skipProvidedScope>
                            <skipRuntimeScope>true</skipRuntimeScope>
                            <suppressionFiles>
                                <!--suppress UnresolvedMavenProperty -->
                                <suppressionFile>
                                    ${maven.multiModuleProjectDirectory}/config/dependency-check/project-suppression.xml
                                </suppressionFile>
                            </suppressionFiles>
                        </configuration>
                        <executions>
                            <execution>
                                <goals>
                                    <goal>check</goal>
                                </goals>
                            </execution>
                        </executions>
                    </plugin>
                </plugins>
            </build>
        </profile>
    </profiles>


    <dependencies>
        <dependency>
            <groupId>org.apache.commons</groupId>
            <artifactId>commons-exec</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-validation</artifactId>
        </dependency>
        <dependency>
            <groupId>org.projectlombok</groupId>
            <artifactId>lombok</artifactId>
            <scope>provided</scope>
            <optional>true</optional>
        </dependency>
        <dependency>
            <groupId>javax.xml.bind</groupId>
            <artifactId>jaxb-api</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-undertow</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-web</artifactId>
            <exclusions>
                <exclusion>
                    <groupId>org.springframework.boot</groupId>
                    <artifactId>spring-boot-starter-tomcat</artifactId>
                </exclusion>
            </exclusions>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-actuator</artifactId>
        </dependency>
        <dependency>
            <groupId>org.flywaydb</groupId>
            <artifactId>flyway-core</artifactId>
        </dependency>
        <dependency>
            <groupId>org.asciidoctor</groupId>
            <artifactId>asciidoctorj</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-data-jpa</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-security</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-thymeleaf</artifactId>
        </dependency>
        <dependency>
            <groupId>org.thymeleaf.extras</groupId>
            <artifactId>thymeleaf-extras-springsecurity5</artifactId>
        </dependency>
        <dependency>
            <groupId>org.hsqldb</groupId>
            <artifactId>hsqldb</artifactId>
        </dependency>
        <dependency>
            <groupId>org.jsoup</groupId>
            <artifactId>jsoup</artifactId>
        </dependency>
        <dependency>
            <groupId>com.nulab-inc</groupId>
            <artifactId>zxcvbn</artifactId>
        </dependency>
        <dependency>
            <groupId>com.thoughtworks.xstream</groupId>
            <artifactId>xstream</artifactId>
        </dependency>
        <dependency>
            <groupId>cglib</groupId>
            <artifactId>cglib-nodep</artifactId>
        </dependency>
        <dependency>
            <groupId>ant</groupId>
            <artifactId>ant-launcher</artifactId>
        </dependency>
        <dependency>
            <groupId>ant</groupId>
            <artifactId>ant</artifactId>
        </dependency>
        <dependency>
            <groupId>xml-resolver</groupId>
            <artifactId>xml-resolver</artifactId>
        </dependency>
        <dependency>
            <groupId>io.jsonwebtoken</groupId>
            <artifactId>jjwt</artifactId>
        </dependency>
        <dependency>
            <groupId>com.google.guava</groupId>
            <artifactId>guava</artifactId>
        </dependency>
        <dependency>
            <groupId>commons-io</groupId>
            <artifactId>commons-io</artifactId>
        </dependency>
        <dependency>
            <groupId>org.apache.commons</groupId>
            <artifactId>commons-lang3</artifactId>
        </dependency>
        <dependency>
            <groupId>org.apache.commons</groupId>
            <artifactId>commons-text</artifactId>
        </dependency>
        <dependency>
            <groupId>org.bitbucket.b_c</groupId>
            <artifactId>jose4j</artifactId>
        </dependency>
        <dependency>
            <groupId>org.webjars</groupId>
            <artifactId>bootstrap</artifactId>
        </dependency>
        <dependency>
            <groupId>org.webjars</groupId>
            <artifactId>jquery</artifactId>
        </dependency>
        <dependency>
            <groupId>org.glassfish.jaxb</groupId>
            <artifactId>jaxb-runtime</artifactId>
        </dependency>

        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-test</artifactId>
            <scope>test</scope>
        </dependency>
        <dependency>
            <groupId>org.springframework.security</groupId>
            <artifactId>spring-security-test</artifactId>
            <scope>test</scope>
        </dependency>
        <dependency>
            <groupId>com.github.tomakehurst</groupId>
            <artifactId>wiremock</artifactId>
            <scope>test</scope>
        </dependency>
        <dependency>
            <groupId>org.seleniumhq.selenium</groupId>
            <artifactId>selenium-java</artifactId>
            <scope>test</scope>
        </dependency>
        <dependency>
            <groupId>io.rest-assured</groupId>
            <artifactId>rest-assured</artifactId>
            <scope>test</scope>
        </dependency>
        <dependency>
            <groupId>io.github.bonigarcia</groupId>
            <artifactId>webdrivermanager</artifactId>
            <scope>test</scope>
        </dependency>
    </dependencies>

    <build>
        <plugins>
            <plugin>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-maven-plugin</artifactId>
                <executions>
                    <execution>
                        <goals>
                            <goal>repackage</goal>
                        </goals>
                    </execution>
                </executions>
                <configuration>
                    <excludeDevtools>true</excludeDevtools>
                    <executable>true</executable>
                    <mainClass>org.owasp.webgoat.server.StartWebGoat</mainClass>
                    <!-- See http://docs.spring.io/spring-boot/docs/current/reference/html/howto-build.html#howto-extract-specific-libraries-when-an-executable-jar-runs -->
                    <requiresUnpack>
                        <dependency>
                            <groupId>org.asciidoctor</groupId>
                            <artifactId>asciidoctorj</artifactId>
                        </dependency>
                        <dependency>
                            <groupId>org.jruby</groupId>
                            <artifactId>jruby-complete</artifactId>
                        </dependency>
                    </requiresUnpack>
                    <jvmArguments>
                        <!-- -Xdebug -Xrunjdwp:transport=dt_socket,server=y,suspend=y,address=8000-->
                    </jvmArguments>
                </configuration>
            </plugin>
            <plugin>
                <groupId>org.codehaus.mojo</groupId>
                <artifactId>build-helper-maven-plugin</artifactId>
                <executions>
                    <execution>
                        <id>add-integration-test-source-as-test-sources</id>
                        <phase>generate-test-sources</phase>
                        <goals>
                            <goal>add-test-source</goal>
                        </goals>
                        <configuration>
                            <sources>
                                <source>src/it/java</source>
                            </sources>
                        </configuration>
                    </execution>
                </executions>
            </plugin>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-failsafe-plugin</artifactId>
                <configuration>
                    <systemPropertyVariables>
                        <logback.configurationFile>${basedir}/src/test/resources/logback-test.xml</logback.configurationFile>
                    </systemPropertyVariables>
                    <argLine>-Xmx512m -Dwebgoatport=${webgoat.port} -Dwebwolfport=${webwolf.port}</argLine>
                    <includes>**/*IntegrationTest.java</includes>
                </configuration>
                <executions>
                    <execution>
                        <id>integration-test</id>
                        <goals>
                            <goal>integration-test</goal>
                        </goals>
                    </execution>
                    <execution>
                        <id>verify</id>
                        <goals>
                            <goal>verify</goal>
                        </goals>
                    </execution>
                </executions>
            </plugin>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-surefire-plugin</artifactId>
                <version>${maven-surefire-plugin.version}</version>
                <configuration>
                    <argLine>
                        --add-opens java.base/sun.nio.ch=ALL-UNNAMED --add-opens java.base/java.io=ALL-UNNAMED --add-opens java.base/sun.nio.ch=ALL-UNNAMED --add-opens java.base/java.io=ALL-UNNAMED --add-opens java.base/java.util=ALL-UNNAMED --add-opens java.base/java.lang.reflect=ALL-UNNAMED --add-opens java.base/java.text=ALL-UNNAMED --add-opens java.desktop/java.awt.font=ALL-UNNAMED
                    </argLine>
                    <excludes>
                        <exclude>**/*IntegrationTest.java</exclude>
                    </excludes>
                </configuration>
            </plugin>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-checkstyle-plugin</artifactId>
                <version>${checkstyle.version}</version>
                <configuration>
                    <encoding>UTF-8</encoding>
                    <consoleOutput>true</consoleOutput>
                    <failsOnError>true</failsOnError>
                    <configLocation>config/checkstyle/checkstyle.xml</configLocation>
                    <suppressionsLocation>config/checkstyle/suppressions.xml</suppressionsLocation>
                    <suppressionsFileExpression>checkstyle.suppressions.file</suppressionsFileExpression>
                </configuration>
            </plugin>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-enforcer-plugin</artifactId>
                <version>3.0.0</version>
                <executions>
                    <execution>
                        <id>restrict-log4j-versions</id>
                        <phase>validate</phase>
                        <goals>
                            <goal>enforce</goal>
                        </goals>
                        <configuration>
                            <rules>
                                <bannedDependencies>
                                    <excludes combine.children="append">
                                        <exclude>org.apache.logging.log4j:log4j-core</exclude>
                                    </excludes>
                                </bannedDependencies>
                            </rules>
                            <fail>true</fail>
                        </configuration>
                    </execution>
                </executions>
            </plugin>
        </plugins>
    </build>

    <repositories>
        <repository>
            <id>central</id>
            <url>https://repo.maven.apache.org/maven2</url>
            <snapshots>
                <enabled>false</enabled>
            </snapshots>
        </repository>
    </repositories>
    <pluginRepositories>
        <pluginRepository>
            <id>central</id>
            <url>https://repo.maven.apache.org/maven2</url>
            <snapshots>
                <enabled>false</enabled>
            </snapshots>
        </pluginRepository>
    </pluginRepositories>

</project>