Update Analyzer Manager version to 1.2.2.1846078 (#374)

.github/workflows/integration-tests.yml

@@ -29,7 +29,7 @@ jobs:
         uses: actions/setup-java@v3
         with:
           distribution: "temurin"
-          java-version: "11"
+          java-version: "17"
 
       # Run integration tests
       - name: Integration Tests

src/main/java/com/jfrog/ide/idea/scan/ScanBinaryExecutor.java

@@ -57,7 +57,7 @@ public abstract class ScanBinaryExecutor {
     private static final int NOT_SUPPORTED = 13;
     private static final Path BINARIES_DIR = HOME_PATH.resolve("dependencies").resolve("jfrog-security");
     private static final String SCANNER_BINARY_NAME = "analyzerManager";
-    private static final String SCANNER_BINARY_VERSION = "1.1.9.1786834";
+    private static final String SCANNER_BINARY_VERSION = "1.2.2.1846078";
     private static final String DEFAULT_BINARY_DOWNLOAD_URL = "xsc-gen-exe-analyzer-manager-local/v1/" + SCANNER_BINARY_VERSION;
     private static final String DOWNLOAD_SCANNER_NAME = "analyzerManager.zip";
     private static final String MINIMAL_XRAY_VERSION_SUPPORTED_FOR_ENTITLEMENT = "3.66.0";

src/main/resources/META-INF/plugin.xml

@@ -30,10 +30,8 @@
 
     <change-notes>
         <![CDATA[
-          <li>Improved cache expiry mechanism.</li>
-          <li>Decreased memory consumption while building dependency trees.</li>
-          <li>Bug fix - Yarn projects inspection not running on plugin startup.</li>
-          <li>Bug fix - usage report to Artifactory not using proxy configuration.</li>
+          <li>Adds new Secrets and IaC scans.</li>
+          <li>Adds Contextual Analysis support for Maven and Gradle projects.</li>
         ]]>
     </change-notes>
 

src/test/java/com/jfrog/ide/idea/integration/ApplicabilityScannerIntegrationTests.java

@@ -24,7 +24,7 @@ protected void setUp() throws Exception {
         scanner = new ApplicabilityScannerExecutor(Logger.getInstance(), serverConfig, binaryDownloadUrl, useReleases);
     }
 
-    public void testApplicabilityScannerNpmProjectNotApplicable() throws IOException, InterruptedException {
+    public void testApplicabilityScannerJsProjectNotApplicable() throws IOException, InterruptedException {
         String testProjectRoot = createTempProjectDir("npm");
         ScanConfig.Builder input = new ScanConfig.Builder()
                 .roots(List.of(testProjectRoot))
@@ -35,7 +35,7 @@ public void testApplicabilityScannerNpmProjectNotApplicable() throws IOException
         assertFalse(results.stream().anyMatch(JFrogSecurityWarning::isApplicable));
     }
 
-    public void testApplicabilityScannerNpmProject() throws IOException, InterruptedException {
+    public void testApplicabilityScannerJsProject() throws IOException, InterruptedException {
         String testProjectRoot = createTempProjectDir("npm");
         ScanConfig.Builder input = new ScanConfig.Builder()
                 .roots(List.of(testProjectRoot))
@@ -81,6 +81,23 @@ public void testApplicabilityScannerPythonProject() throws IOException, Interrup
         assertTrue(results.get(0).getFilePath().endsWith("main.py"));
     }
 
+    public void testApplicabilityScannerJavaProject() throws IOException, InterruptedException {
+        String testProjectRoot = createTempProjectDir("maven");
+        ScanConfig.Builder input = new ScanConfig.Builder()
+                .roots(List.of(testProjectRoot))
+                .cves(List.of("CVE-2013-7285"));
+        List<JFrogSecurityWarning> results = scanner.execute(input, this::dummyCheckCanceled);
+        assertEquals(5, results.size());
+        // Expect specific indications
+        assertTrue(results.get(0).isApplicable());
+        assertEquals("xstream.fromXML(payload)", results.get(0).getLineSnippet());
+        assertEquals(56, results.get(0).getLineStart());
+        assertEquals(56, results.get(0).getLineEnd());
+        assertEquals(26, results.get(0).getColStart());
+        assertEquals(50, results.get(0).getColEnd());
+        assertTrue(results.get(0).getFilePath().endsWith("VulnerableComponentsLesson.java"));
+    }
+
     private void dummyCheckCanceled() {
 
     }

src/test/resources/applicability/testProjects/maven/CODE_OF_CONDUCT.md

@@ -0,0 +1,60 @@
+# Contributor Covenant Code of Conduct
+
+## Our Pledge
+
+In the interest of fostering an open and welcoming environment, we as contributors and maintainers pledge to making participation in our project and our community a harassment-free experience for everyone, regardless of age, body size, disability, ethnicity, sex characteristics, gender identity and expression, level of experience, education, socio-economic status, nationality, personal appearance, race, religion, or sexual identity and orientation.
+
+## Our Standards
+
+Examples of behavior that contributes to creating a positive environment include:
+
+- Using welcoming and inclusive language
+- Being respectful of differing viewpoints and experiences
+- Gracefully accepting constructive criticism
+- Focusing on what is best for the community
+- Showing empathy towards other community members
+
+Examples of unacceptable behavior by participants include:
+
+- The use of sexualized language or imagery and unwelcome sexual attention or advances
+- Trolling, insulting/derogatory comments, and personal or political attacks
+- Public or private harassment
+- Publishing others' private information, such as a physical or electronic address, without explicit permission
+- Misusing the context of the WebGoat project for commercial goals (e.g. adding sales pitches to the codebase or to communication channels used by the project, such as Slack).
+- Other conduct which could reasonably be considered inappropriate in a professional setting
+
+## Our Responsibilities
+
+Project maintainers are responsible for clarifying the standards of acceptable behavior and are expected to take appropriate and fair corrective action in response to any instances of unacceptable behavior.
+
+Project maintainers have the right and responsibility to remove, edit, or reject comments, commits, code, wiki edits, issues, and other contributions that are not aligned to this Code of Conduct, or to ban temporarily or permanently any contributor for other behaviors that they deem inappropriate, threatening, offensive, or harmful.
+
+## Disclaimer
+
+The WebGoat project and its materials are conceived for educational and research purposes only.
+
+Refrain from violating the laws in your country by carefully consulting them before executing any tests against web applications or other assets utilizing the WebGoat (or Webwolf) materials.
+
+The WebGoat project is also NOT supporting unethical activities in any way. If you come across such requests, please reach out to the project leaders and raise this to them.
+
+Neither OWASP, the WebGoat project leaders, authors or anyone else involved in this project is going to take responsibility for your actions.
+
+The intention of the WebGoat is not to encourage hacking or malicious activities! Instead, the goal of the project is to learn different hacking techniques and offer ways to reduce or mitigate that risk.
+
+## Scope
+
+This Code of Conduct applies both within project spaces and in public spaces when an individual is representing the project or its community. Examples of representing a project or community includes using an official project e-mail address, posting via an official social media account, or acting as an appointed representative at an online or offline event. Representation of a project may be further defined and clarified by project maintainers.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be reported by contacting the project team at [email protected].
+
+All complaints will be reviewed and investigated and will result in a response that is deemed necessary and appropriate to the circumstances. The project team is obligated to maintain confidentiality with regard to the reporter of an incident. Further details of specific enforcement policies may be posted separately.
+
+Project maintainers who do not follow or enforce the Code of Conduct in good faith may face temporary or permanent repercussions as determined by other members of the project's leadership.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant](https://www.contributor-covenant.org "Contributor Covenant homepage"), [version 1.4](https://www.contributor-covenant.org/version/1/4/code-of-conduct.html "Code of Conduct version 1.4").
+
+For answers to common questions about this code of conduct, see [the Contributor Covenant FAQ](https://www.contributor-covenant.org/faq)

src/test/resources/applicability/testProjects/maven/CONTRIBUTING.md

@@ -0,0 +1,105 @@
+# Contributing
+
+[![GitHub contributors](https://img.shields.io/github/contributors/WebGoat/WebGoat.svg)](https://github.com/WebGoat/WebGoat/graphs/contributors)
+![GitHub issues by-label "help wanted"](https://img.shields.io/github/issues/WebGoat/WebGoat/help%20wanted.svg)
+![GitHub issues by-label "good first issue"](https://img.shields.io/github/issues/WebGoat/WebGoat/good%20first%20issue.svg)
+
+This document describes how you can contribute to WebGoat. Please read it carefully.
+
+**Table of Contents**
+
+* [How to Contribute to the Project](#how-to-contribute-to-the-project)
+* [How to set up your Contributor Environment](#how-to-set-up-your-contributor-environment)
+* [How to get your PR Accepted](#how-to-get-your-pr-accepted)
+
+## How to Contribute to the project
+
+There are a couple of ways on how you can contribute to the project:
+
+* **File [issues](https://github.com/WebGoat/WebGoat/issues "Webgoat Issues")** for missing content or errors. Explain what you think is missing and give a suggestion as to where it could be added.
+* **Create a [pull request (PR)](https://github.com/WebGoat/WebGoat/pulls "Create a pull request")**. This is a direct contribution to the project and may be merged after review. You should ideally [create an issue](https://github.com/WebGoat/WebGoat/issues "WebGoat Issues") for any PR you would like to submit, as we can first review the merit of the PR and avoid any unnecessary work. This is of course not needed for small modifications such as correcting typos.
+* **Help out financially** by donating via [OWASP donations](https://owasp.org/donate/?reponame=www-project-webgoat&title=OWASP+WebGoat).
+
+## How to get your PR accepted
+
+Your PR is valuable to us, and to make sure we can integrate it smoothly, we have a few items for you to consider. In short:
+The minimum requirements for code contributions are:
+
+1. The code _must_ be compliant with the configured Java Google Formatter, Checkstyle and PMD rules.
+2. All new and changed code _should_ have a corresponding unit and/or integration test.
+3. New and changed lessons _must_ have a corresponding integration test.
+4. [Status checks](https://docs.github.com/en/github/collaborating-with-pull-requests/collaborating-on-repositories-with-code-quality-features/about-status-checks) should pass for your last commit.
+
+Additionally, the following guidelines can help:
+
+### Keep your pull requests limited to a single issue
+
+Pull requests should be as small/atomic as possible. Large, wide-sweeping changes in a pull request will be **rejected**, with comments to isolate the specific code in your pull request. Some examples:
+
+* If you are making spelling corrections in the docs, don't modify other files.
+* If you are adding new functions don't '*cleanup*' unrelated functions. That cleanup belongs in another pull request.
+
+### Write a good commit message
+
+* Explain why you make the changes. [More infos about a good commit message.](https://betterprogramming.pub/stop-writing-bad-commit-messages-8df79517177d)
+
+* If you fix an issue with your commit, please close the issue by [adding one of the keywords and the issue number](https://docs.github.com/en/issues/tracking-your-work-with-issues/linking-a-pull-request-to-an-issue) to your commit message.
+
+For example: `Fix #545` or `Closes #10`
+
+## How to set up your Contributor Environment
+
+1. Create a GitHub account. Multiple different GitHub subscription plans are available, but you only need a free one. Follow [these steps](https://help.github.com/en/articles/signing-up-for-a-new-github-account "Signing up for a new GitHub account") to set up your account.
+2. Fork the repository. Creating a fork means creating a copy of the repository on your own account, which you can modify without any impact on this repository. GitHub has an [article that describes all the needed steps](https://help.github.com/en/articles/fork-a-repo "Fork a repo").
+3. Clone your own repository to your host computer so that you can make modifications. If you followed the GitHub tutorial from step 2, you have already done this.
+4. Go to the newly cloned directory "WebGoat" and add the remote upstream repository:
+
+   ```bash
+   	$ git remote -v
+   	origin [email protected]:<your Github handle>/WebGoat.git (fetch)
+   	origin [email protected]:<your Github handle>/WebGoat.git (push)
+
+   	$ git remote add upstream [email protected]:WebGoat/WebGoat.git
+
+   	$ git remote -v
+   	origin [email protected]:<your Github handle>/WebGoat.git (fetch)
+   	origin [email protected]:<your Github handle>/WebGoat.git (push)
+   	upstream [email protected]:OWASP/WebGoat.git (fetch)
+   	upstream [email protected]:OWASP/WebGoat.git (push)
+   ```
+
+   See also the GitHub documentation on "[Configuring a remote for a fork](https://docs.github.com/en/free-pro-team@latest/github/collaborating-with-issues-and-pull-requests/configuring-a-remote-for-a-fork "Configuring a remote for a fork")".
+
+5. Choose what to work on, based on any of the outstanding [issues](https://github.com/WebGoat/WebGoat/issues "WebGoat Issues").
+
+6. Create a branch so that you can cleanly work on the chosen issue: `git checkout -b FixingIssue66`
+
+7. Open your favorite editor and start making modifications. We recommend using the [IntelliJ Idea](https://www.jetbrains.com/idea/).
+
+8. After your modifications are done, push them to your forked repository. This can be done by executing the command `git add MYFILE` for every file you have modified, followed by `git commit -m 'your commit message here'` to commit the modifications and `git push` to push your modifications to GitHub.
+
+9. Create a Pull Request (PR) by going to your fork, <https://github.com/Your_Github_Handle/WebGoat> and click on the "New Pull Request" button. The target branch should typically be the Master branch. When submitting a PR, be sure to follow the checklist that is provided in the PR template. The checklist itself will be filled out by the reviewer.
+
+10. Your PR will be reviewed and comments may be given. In order to process a comment, simply make modifications to the same branch as before and push them to your repository. GitHub will automatically detect these changes and add them to your existing PR.
+
+11. When starting on a new PR in the future, make sure to always keep your local repo up to date:
+
+    ```bash
+    $ git fetch upstream
+    $ git merge upstream/main
+    ```
+
+    See also the following article for further explanation on "[How to Keep a Downstream git Repository Current with Upstream Repository Changes](https://medium.com/sweetmeat/how-to-keep-a-downstream-git-repository-current-with-upstream-repository-changes-10b76fad6d97 "How to Keep a Downstream git Repository Current with Upstream Repository Changes")".
+
+If at any time you want to work on a different issue, you can simply switch to a different branch, as explained in step 5.
+
+> Tip: Don't try to work on too many issues at once though, as it will be a lot more difficult to merge branches the longer they are open.
+
+## What not to do
+
+Although we greatly appreciate any and all contributions to the project, there are a few things that you should take into consideration:
+
+* The WebGoat project should not be used as a platform for advertisement for commercial tools, companies or individuals. Write-ups should be written with free and open-source tools in mind and commercial tools are typically not accepted, unless as a reference in the security tools section.
+* Unnecessary self-promotion of tools or blog posts is frowned upon. If you have a relation with on of the URLs or tools you are referencing, please state so in the PR so that we can verify that the reference is in line with the rest of the guide.
+
+Please be sure to take a careful look at our [Code of Conduct](https://github.com/WebGoat/WebGoat/blob/master/CODE_OF_CONDUCT.md) for all the details.

src/test/resources/applicability/testProjects/maven/COPYRIGHT.txt

@@ -0,0 +1,19 @@
+This file is part of WebGoat, an Open Web Application Security Project utility. For details, please see http://www.owasp.org/
+
+Copyright (c) 2002 - $today.year Bruce Mayhew
+
+This program is free software; you can redistribute it and/or modify it under the terms of the
+GNU General Public License as published by the Free Software Foundation; either version 2 of the
+License, or (at your option) any later version.
+
+This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
+even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+General Public License for more details.
+
+You should have received a copy of the GNU General Public License along with this program; if
+not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
+02111-1307, USA.
+
+Getting Source ==============
+
+Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository for free software projects.

src/test/resources/applicability/testProjects/maven/CREATE_RELEASE.md

@@ -0,0 +1,20 @@
+## Release WebGoat
+
+### Version numbers
+
+For WebGoat we use milestone releases first before we release the official version, we use `v2023.01` while tagging
+and 2023.01 in the `pom.xml`.
+
+### Release notes:
+
+Update the release notes with the correct version. Use `git shortlog -s -n --since "JAN 06 2023"` for the list of
+committers.
+
+```
+mvn versions:set 
+<< update release notes >>
+git commit ....
+git tag v2023.01 
+git push --tags
+```
+

src/test/resources/applicability/testProjects/maven/Dockerfile

@@ -0,0 +1,32 @@
+FROM docker.io/eclipse-temurin:17-jre-focal
+
+RUN useradd -ms /bin/bash webgoat
+RUN chgrp -R 0 /home/webgoat
+RUN chmod -R g=u /home/webgoat
+
+USER webgoat
+
+COPY --chown=webgoat target/webgoat-*.jar /home/webgoat/webgoat.jar
+
+EXPOSE 8080
+EXPOSE 9090
+
+WORKDIR /home/webgoat
+ENTRYPOINT [ "java", \
+   "-Duser.home=/home/webgoat", \
+   "-Dfile.encoding=UTF-8", \
+   "--add-opens", "java.base/java.lang=ALL-UNNAMED", \
+   "--add-opens", "java.base/java.util=ALL-UNNAMED", \
+   "--add-opens", "java.base/java.lang.reflect=ALL-UNNAMED", \
+   "--add-opens", "java.base/java.text=ALL-UNNAMED", \
+   "--add-opens", "java.desktop/java.beans=ALL-UNNAMED", \
+   "--add-opens", "java.desktop/java.awt.font=ALL-UNNAMED", \
+   "--add-opens", "java.base/sun.nio.ch=ALL-UNNAMED", \
+   "--add-opens", "java.base/java.io=ALL-UNNAMED", \
+   "--add-opens", "java.base/java.util=ALL-UNNAMED", \
+   "-Drunning.in.docker=true", \
+   "-Dwebgoat.host=0.0.0.0", \
+   "-Dwebwolf.host=0.0.0.0", \
+   "-Dwebgoat.port=8080", \
+   "-Dwebwolf.port=9090", \
+   "-jar", "webgoat.jar" ]

src/test/resources/applicability/testProjects/maven/LICENSE.txt

@@ -0,0 +1,19 @@
+This file is part of WebGoat, an Open Web Application Security Project utility. For details, please see http://www.owasp.org/
+
+Copyright (c) 2002 - 2019 Bruce Mayhew
+
+This program is free software; you can redistribute it and/or modify it under the terms of the
+GNU General Public License as published by the Free Software Foundation; either version 2 of the
+License, or (at your option) any later version.
+
+This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without
+even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
+General Public License for more details.
+
+You should have received a copy of the GNU General Public License along with this program; if
+not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA
+02111-1307, USA.
+
+Getting Source ==============
+
+Source for this application is maintained at https://github.com/WebGoat/WebGoat, a repository for free software projects.

src/test/resources/applicability/testProjects/maven/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1 @@
+Thank you for submitting a pull request to the WebGoat!