pom.xml

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
  <modelVersion>4.0.0</modelVersion>

  <parent>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-parent</artifactId>
    <version>3.1.5</version>
    <!-- lookup parent from repository -->
  </parent>

  <groupId>org.owasp</groupId>
  <artifactId>wrongsecrets</artifactId>
  <version>1.7.2-SNAPSHOT</version>

  <name>OWASP WrongSecrets</name>
  <description>Examples with how to not use secrets</description>
  <url>https://owasp.org/www-project-wrongsecrets/</url>
  <organization>
    <name>The Open Web Application Security Project (OWASP)</name>
    <url>https://owasp.org/</url>
  </organization>
  <licenses>
    <license>
      <name>AGPLv3 License</name>
      <url>https://opensource.org/license/agpl-v3/</url>
      <distribution>repo</distribution>
    </license>
  </licenses>

  <scm>
    <url>https://github.com/OWASP/wrongsecrets</url>
  </scm>
  <issueManagement>
    <system>GitHub Issue Tracking</system>
    <url>https://github.com/OWASP/wrongsecrets/issues</url>
  </issueManagement>

  <!--    <distributionManagement>-->
  <!--        <snapshotRepository>-->
  <!--            <id>ossrh</id>-->
  <!--            <url>https://s01.oss.sonatype.org/content/repositories/snapshots</url>-->
  <!--        </snapshotRepository>-->
  <!--    </distributionManagement>-->
  <properties>
    <KeePassJava2.version>2.2.1</KeePassJava2.version>
    <asciidoctor.maven.plugin.version>2.2.4</asciidoctor.maven.plugin.version>
    <asciidoctorj.version>2.5.10</asciidoctorj.version>
    <aws.sdk.version>2.21.13</aws.sdk.version>
    <bootstrap.version>5.3.1</bootstrap.version>
    <com.azure.spring.version>5.6.0</com.azure.spring.version>
    <cyclonedx.core.version>8.0.3</cyclonedx.core.version>
    <datatables.version>1.13.5</datatables.version>
    <dependency-check-maven.version>8.2.1</dependency-check-maven.version>
    <gcp.sdk.version>4.8.3</gcp.sdk.version>
    <github.button.version>2.14.1</github.button.version>
    <java.version>21</java.version>
    <jquery.version>3.7.1</jquery.version>
    <jruby.version>9.4.4.0</jruby.version>
    <lombok.version>1.18.30</lombok.version>
    <maven.compiler.target>21</maven.compiler.target>
    <spring.cloud-version>2022.0.4</spring.cloud-version>
    <spring.security.version>6.1.4</spring.security.version>
    <system-stubs-jupiter.version>2.1.3</system-stubs-jupiter.version>
    <thymeleaf-extras-springsecurity6.version>3.1.2.RELEASE</thymeleaf-extras-springsecurity6.version>
    <thymeleaf.layout.version>3.3.0</thymeleaf.layout.version>
  </properties>

  <dependencyManagement>
    <dependencies>
      <dependency>
        <groupId>org.springframework.cloud</groupId>
        <artifactId>spring-cloud-dependencies</artifactId>
        <version>${spring.cloud-version}</version>
        <type>pom</type>
        <scope>import</scope>
      </dependency>
      <dependency>
        <groupId>com.google.cloud</groupId>
        <artifactId>spring-cloud-gcp-dependencies</artifactId>
        <version>${gcp.sdk.version}</version>
        <type>pom</type>
        <scope>import</scope>
      </dependency>
      <dependency>
        <groupId>com.azure.spring</groupId>
        <artifactId>spring-cloud-azure-dependencies</artifactId>
        <version>${com.azure.spring.version}</version>
        <type>pom</type>
        <scope>import</scope>
      </dependency>
    </dependencies>
  </dependencyManagement>
  <dependencies>
    <dependency>
      <groupId>org.projectlombok</groupId>
      <artifactId>lombok</artifactId>
      <version>${lombok.version}</version>
      <scope>provided</scope>
    </dependency>
    <dependency>
      <groupId>org.springframework.boot</groupId>
      <artifactId>spring-boot-starter-thymeleaf</artifactId>
    </dependency>

    <dependency>
      <groupId>nz.net.ultraq.thymeleaf</groupId>
      <artifactId>thymeleaf-layout-dialect</artifactId>
      <version>${thymeleaf.layout.version}</version>
    </dependency>
    <dependency>
      <groupId>org.thymeleaf.extras</groupId>
      <artifactId>thymeleaf-extras-springsecurity6</artifactId>
      <version>${thymeleaf-extras-springsecurity6.version}</version>
    </dependency>
    <dependency>
      <groupId>org.springframework.boot</groupId>
      <artifactId>spring-boot-starter</artifactId>
    </dependency>
    <dependency>
      <groupId>org.springframework.boot</groupId>
      <artifactId>spring-boot-starter-actuator</artifactId>
    </dependency>
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-config</artifactId>
      <version>${spring-security.version}</version>
    </dependency>
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-web</artifactId>
      <version>${spring-security.version}</version>
    </dependency>
    <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-test</artifactId>
      <version>${spring-security.version}</version>
      <scope>test</scope>
    </dependency>
    <dependency>
      <groupId>org.springframework.boot</groupId>
      <artifactId>spring-boot-starter-web</artifactId>
    </dependency>
    <dependency>
      <groupId>org.springframework.cloud</groupId>
      <artifactId>spring-cloud-starter-vault-config</artifactId>
    </dependency>
    <dependency>
      <groupId>org.springframework.cloud</groupId>
      <artifactId>spring-cloud-vault-config</artifactId>
    </dependency>
    <dependency>
      <groupId>software.amazon.awssdk</groupId>
      <artifactId>sts</artifactId>
      <version>${aws.sdk.version}</version>
    </dependency>
    <dependency>
      <groupId>software.amazon.awssdk</groupId>
      <artifactId>ssm</artifactId>
      <version>${aws.sdk.version}</version>
    </dependency>
    <dependency>
      <groupId>org.linguafranca.pwdb</groupId>
      <artifactId>KeePassJava2</artifactId>
      <version>${KeePassJava2.version}</version>
    </dependency>
    <dependency>
      <groupId>org.asciidoctor</groupId>
      <artifactId>asciidoctorj-api</artifactId>
      <version>${asciidoctorj.version}</version>
    </dependency>
    <dependency>
      <groupId>org.asciidoctor</groupId>
      <artifactId>asciidoctorj</artifactId>
      <version>${asciidoctorj.version}</version>
    </dependency>
    <dependency>
      <groupId>org.jruby</groupId>
      <artifactId>jruby-complete</artifactId>
      <version>${jruby.version}</version>
    </dependency>
    <dependency>
      <groupId>org.webjars</groupId>
      <artifactId>bootstrap</artifactId>
      <version>${bootstrap.version}</version>
    </dependency>
    <dependency>
      <groupId>org.webjars.npm</groupId>
      <artifactId>github-buttons</artifactId>
      <version>${github.button.version}</version>
    </dependency>
    <dependency>
      <groupId>org.webjars</groupId>
      <artifactId>datatables</artifactId>
      <version>${datatables.version}</version>
    </dependency>
    <dependency>
      <groupId>org.webjars</groupId>
      <artifactId>jquery</artifactId>
      <version>${jquery.version}</version>
    </dependency>
    <!--        <dependency>-->
    <!--            <groupId>org.springframework.boot</groupId>-->
    <!--            <artifactId>spring-boot-devtools</artifactId>-->
    <!--            <optional>true</optional>-->
    <!--        </dependency>-->
    <dependency>
      <groupId>com.google.cloud</groupId>
      <artifactId>google-cloud-secretmanager</artifactId>
    </dependency>
    <dependency>
      <groupId>org.springdoc</groupId>
      <artifactId>springdoc-openapi-starter-webmvc-ui</artifactId>
      <version>2.2.0</version>
    </dependency>
    <dependency>
      <groupId>com.azure.spring</groupId>
      <artifactId>spring-cloud-azure-starter-keyvault-secrets</artifactId>
    </dependency>

    <dependency>
      <groupId>org.springframework.boot</groupId>
      <artifactId>spring-boot-starter-test</artifactId>
      <scope>test</scope>
    </dependency>

    <dependency>
      <groupId>uk.org.webcompere</groupId>
      <artifactId>system-stubs-jupiter</artifactId>
      <version>${system-stubs-jupiter.version}</version>
      <scope>test</scope>
    </dependency>

    <dependency>
      <groupId>org.cyclonedx</groupId>
      <artifactId>cyclonedx-core-java</artifactId>
      <version>${cyclonedx.core.version}</version>
    </dependency>

    <dependency>
      <groupId>org.owasp</groupId>
      <artifactId>dependency-check-maven</artifactId>
      <version>${dependency-check-maven.version}</version>
      <type>maven-plugin</type>
    </dependency>
    <dependency>
      <groupId>com.github.spotbugs</groupId>
      <artifactId>spotbugs-annotations</artifactId>
      <version>4.8.0</version>
    </dependency>
    <!--        <dependency>-->
    <!--            <groupId>com.h2database</groupId>-->
    <!--            <artifactId>h2</artifactId>-->
    <!--            <version>2.1.214</version>-->
    <!--        </dependency>-->
  </dependencies>

  <build>
    <pluginManagement>
      <plugins>
        <plugin>
          <groupId>org.apache.maven.plugins</groupId>
          <artifactId>maven-checkstyle-plugin</artifactId>
          <version>3.3.1</version>
          <dependencies>
            <dependency>
              <groupId>com.puppycrawl.tools</groupId>
              <artifactId>checkstyle</artifactId>
              <version>10.12.4</version>
            </dependency>
          </dependencies>
        </plugin>
        <plugin>
          <groupId>com.github.spotbugs</groupId>
          <artifactId>spotbugs-maven-plugin</artifactId>
          <version>4.7.3.6</version>
          <configuration>
            <omitVisitors>FindReturnRef</omitVisitors>
            <plugins>
              <plugin>
                <groupId>com.h3xstream.findsecbugs</groupId>
                <artifactId>findsecbugs-plugin</artifactId>
                <version>1.12.0</version>
              </plugin>
            </plugins>
          </configuration>
          <dependencies>
            <!-- overwrite dependency on spotbugs if you want to specify the version of spotbugs -->
            <dependency>
              <groupId>com.github.spotbugs</groupId>
              <artifactId>spotbugs</artifactId>
              <version>4.8.0</version>
            </dependency>
          </dependencies>
        </plugin>
      </plugins>
    </pluginManagement>
    <plugins>
      <plugin>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-maven-plugin</artifactId>
        <configuration>
          <excludeDevtools>true</excludeDevtools>
          <!-- See http://docs.spring.io/spring-boot/docs/current/reference/html/howto-build.html#howto-extract-specific-libraries-when-an-executable-jar-runs -->
          <requiresUnpack>
            <dependency>
              <groupId>org.asciidoctor</groupId>
              <artifactId>asciidoctorj</artifactId>
            </dependency>
            <dependency>
              <groupId>org.jruby</groupId>
              <artifactId>jruby-complete</artifactId>
            </dependency>
          </requiresUnpack>
          <jvmArguments>
            <!-- -Xdebug -Xrunjdwp:transport=dt_socket,server=y,suspend=y,address=8000-->
          </jvmArguments>
        </configuration>
        <executions>
          <execution>
            <id>start-app</id>
            <goals>
              <goal>start</goal>
            </goals>
            <phase>pre-integration-test</phase>
            <configuration>
              <profiles>local,without-vault</profiles>
              <environmentVariables>
                <CHALLENGEDOCKERMTPATH>src/test/resources/</CHALLENGEDOCKERMTPATH>
                <challengedockermtpath>src/test/resources/</challengedockermtpath>
                <KEEPASSPATH>src/test/resources/alibabacreds.kdbx</KEEPASSPATH>
                <keepasspath>src/test/resources/alibabacreds.kdbx</keepasspath>
              </environmentVariables>
            </configuration>
          </execution>
          <execution>
            <id>stop-app</id>
            <goals>
              <goal>stop</goal>
            </goals>
            <phase>post-integration-test</phase>
          </execution>
        </executions>
      </plugin>
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-checkstyle-plugin</artifactId>
        <version>3.3.1</version>
        <configuration>
          <consoleOutput>true</consoleOutput>
          <failsOnError>true</failsOnError>
          <configLocation>config/checkstyle/checkstyle.xml</configLocation>
          <suppressionsLocation>config/checkstyle/suppressions.xml</suppressionsLocation>
          <suppressionsFileExpression>checkstyle.suppressions.file</suppressionsFileExpression>
        </configuration>
      </plugin>
      <plugin>
        <groupId>org.asciidoctor</groupId>
        <artifactId>asciidoctor-maven-plugin</artifactId>
        <version>${asciidoctor.maven.plugin.version}</version>
        <configuration>
          <baseDir>${project.basedir}</baseDir>
          <sourceDirectory>src/main/resources/explanations</sourceDirectory>
          <outputDirectory>${project.build.outputDirectory}/explanations</outputDirectory>
          <!-- https://github.com/asciidoctor/asciidoctor-maven-examples/blob/main/asciidoc-to-html-example/pom.xml -->
        </configuration>
        <executions>
          <execution>
            <id>asciidoc-to-html</id>
            <goals>
              <goal>process-asciidoc</goal>
            </goals>
            <phase>compile</phase>
            <configuration>
              <headerFooter>false</headerFooter>
              <attributes>
                <docType>null</docType>
              </attributes>
            </configuration>
          </execution>
        </executions>
      </plugin>
      <plugin>
        <groupId>org.cyclonedx</groupId>
        <artifactId>cyclonedx-maven-plugin</artifactId>
        <version>2.7.10</version>
        <configuration>
          <projectType>library</projectType>
          <schemaVersion>1.3</schemaVersion>
          <includeBomSerialNumber>true</includeBomSerialNumber>
          <includeCompileScope>true</includeCompileScope>
          <includeProvidedScope>true</includeProvidedScope>
          <includeRuntimeScope>true</includeRuntimeScope>
          <includeSystemScope>true</includeSystemScope>
          <includeTestScope>false</includeTestScope>
          <includeLicenseText>false</includeLicenseText>
          <outputFormat>all</outputFormat>
          <outputName>bom</outputName>
        </configuration>
        <executions>
          <execution>
            <goals>
              <goal>makeAggregateBom</goal>
            </goals>
            <phase>install</phase>
          </execution>
        </executions>
      </plugin>
      <plugin>
        <groupId>org.owasp</groupId>
        <artifactId>dependency-check-maven</artifactId>
        <version>${dependency-check-maven.version}</version>
        <executions>
          <execution>
            <goals>
              <goal>check</goal>
            </goals>
          </execution>
        </executions>
      </plugin>
      <!-- todo: #178 add the missing plugins and profiles from https://central.sonatype.org/publish/publish-maven/-->
      <plugin>
        <groupId>com.github.eirslett</groupId>
        <artifactId>frontend-maven-plugin</artifactId>
        <version>1.14.2</version>
        <executions>
          <execution>
            <id>install node and npm</id>
            <goals>
              <goal>install-node-and-npm</goal>
            </goals>
            <phase>generate-resources</phase>
            <configuration>
              <nodeVersion>v20.9.0</nodeVersion>
              <!-- download node from https://nodejs.org/dist/ -->
              <workingDirectory>js</workingDirectory>
            </configuration>
          </execution>
          <execution>
            <id>npm install</id>
            <goals>
              <goal>npm</goal>
            </goals>
            <phase>generate-resources</phase>
            <configuration>
              <arguments>install</arguments>
              <workingDirectory>js</workingDirectory>
            </configuration>
          </execution>
        </executions>
      </plugin>
      <plugin>
        <groupId>org.springdoc</groupId>
        <artifactId>springdoc-openapi-maven-plugin</artifactId>
        <version>1.4</version>
      </plugin>
      <plugin>
        <groupId>org.codehaus.mojo</groupId>
        <artifactId>exec-maven-plugin</artifactId>
        <version>3.1.0</version>
        <configuration>
          <executable>./js/node_modules/.bin/javascript-obfuscator${script.extension}</executable>
          <arguments>
            <argument>./js/index.js</argument>
            <argument>--output</argument>
            <argument>./target/classes/static/js/index.js</argument>
          </arguments>
        </configuration>
        <executions>
          <execution>
            <goals>
              <goal>exec</goal>
            </goals>
            <phase>generate-resources</phase>
          </execution>
          <execution>
            <id>npm-install</id>
            <goals>
              <goal>exec</goal>
            </goals>
            <phase>integration-test</phase>
            <configuration>
              <executable>npm</executable>
              <arguments>
                <argument>install</argument>
              </arguments>
            </configuration>
          </execution>
          <execution>
            <id>xcypress-test</id>
            <goals>
              <goal>exec</goal>
            </goals>
            <phase>integration-test</phase>
            <configuration>
              <executable>npm</executable>
              <arguments>
                <argument>run</argument>
                <argument>test:ci</argument>
              </arguments>
            </configuration>
          </execution>
        </executions>
      </plugin>
      <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <artifactId>maven-compiler-plugin</artifactId>
        <configuration>
          <source>21</source>
          <target>21</target>
        </configuration>
      </plugin>
      <plugin>
        <groupId>org.codehaus.mojo</groupId>
        <artifactId>tidy-maven-plugin</artifactId>
        <version>1.2.0</version>
        <executions>
          <execution>
            <id>validate</id>
            <goals>
              <goal>check</goal>
            </goals>
            <phase>validate</phase>
          </execution>
        </executions>
      </plugin>
      <plugin>
        <groupId>com.diffplug.spotless</groupId>
        <artifactId>spotless-maven-plugin</artifactId>
        <version>2.40.0</version>
        <configuration>
          <formats>
            <format>
              <includes>
                <include>.gitignore</include>
              </includes>
              <trimTrailingWhitespace></trimTrailingWhitespace>
              <endWithNewline></endWithNewline>
              <indent>
                <tabs>true</tabs>
                <spacesPerTab>4</spacesPerTab>
              </indent>
            </format>
          </formats>
          <java>
            <includes>
              <include>src/main/java/**/*.java</include>
              <include>src/test/java/**/*.java</include>
            </includes>
            <removeUnusedImports></removeUnusedImports>
            <googleJavaFormat>
              <style>GOOGLE</style>
              <reflowLongStrings>true</reflowLongStrings>
            </googleJavaFormat>
          </java>
          <pom>
            <sortPom>
              <encoding>UTF-8</encoding>
              <lineSeparator>${line.separator}</lineSeparator>
              <expandEmptyElements>true</expandEmptyElements>
              <spaceBeforeCloseEmptyElement>false</spaceBeforeCloseEmptyElement>
              <keepBlankLines>true</keepBlankLines>
              <nrOfIndentSpace>2</nrOfIndentSpace>
              <indentBlankLines>false</indentBlankLines>
              <indentSchemaLocation>false</indentSchemaLocation>
              <predefinedSortOrder>recommended_2008_06</predefinedSortOrder>
              <sortProperties>true</sortProperties>
              <sortModules>true</sortModules>
              <sortExecutions>true</sortExecutions>
            </sortPom>
          </pom>
        </configuration>
        <executions>
          <execution>
            <goals>
              <goal>check</goal>
            </goals>
          </execution>
        </executions>
      </plugin>
    </plugins>
  </build>

  <!-- Required by exec-maven-plugin to run NPM *.CMD script on Windows  -->
  <profiles>
    <profile>
      <id>Windows</id>
      <activation>
        <os>
          <family>Windows</family>
        </os>
      </activation>
      <properties>
        <script.extension>.cmd</script.extension>
      </properties>
    </profile>
    <profile>
      <id>unix</id>
      <activation>
        <os>
          <family>unix</family>
        </os>
      </activation>
      <properties>
        <script.extension></script.extension>
      </properties>
    </profile>
  </profiles>
</project>