Skip to content

Commit 86eea92

Browse files
nardilnardil
authored
Merge pull request #754 from link-it/3.7.x
Rilascio 3.7.8
2 parents 2d86925 + 18fff3b commit 86eea92

File tree

23 files changed

+378
-65
lines changed

23 files changed

+378
-65
lines changed

‎docs/validazione/index.rst

+80-56
Large diffs are not rendered by default.

‎jars/core/pom.xml

+20
Original file line numberDiff line numberDiff line change
@@ -248,6 +248,26 @@
248248
<groupId>org.springframework</groupId>
249249
<artifactId>spring-context</artifactId>
250250
</dependency>
251+
<dependency>
252+
<groupId>org.springframework</groupId>
253+
<artifactId>spring-core</artifactId>
254+
</dependency>
255+
<dependency>
256+
<groupId>org.springframework</groupId>
257+
<artifactId>spring-beans</artifactId>
258+
</dependency>
259+
<dependency>
260+
<groupId>org.springframework</groupId>
261+
<artifactId>spring-aop</artifactId>
262+
</dependency>
263+
<dependency>
264+
<groupId>org.springframework</groupId>
265+
<artifactId>spring-expression</artifactId>
266+
</dependency>
267+
<dependency>
268+
<groupId>org.springframework</groupId>
269+
<artifactId>spring-jcl</artifactId>
270+
</dependency>
251271

252272
<!-- Spring Security -->
253273
<dependency>

‎pom.xml

+103-4
Original file line numberDiff line numberDiff line change
@@ -64,10 +64,11 @@
6464
<jersey.version>2.38</jersey.version>
6565

6666
<!-- Spring -->
67+
<spring.gov4j.version>5.3.39-gov4j-1</spring.gov4j.version>
6768
<spring.version>5.3.39</spring.version>
6869

6970
<!-- Spring Security -->
70-
<spring.security.version>5.8.13</spring.security.version>
71+
<spring.security.version>5.8.15</spring.security.version>
7172

7273
<!-- Spring Security Ldap plugin -->
7374
<spring.ldap.version>2.4.1</spring.ldap.version>
@@ -1111,12 +1112,42 @@
11111112
<dependency>
11121113
<groupId>org.springframework</groupId>
11131114
<artifactId>spring-web</artifactId>
1114-
<version>${spring.version}</version>
1115+
<version>${spring.gov4j.version}</version>
11151116
</dependency>
11161117

11171118
<dependency>
11181119
<groupId>org.springframework</groupId>
11191120
<artifactId>spring-context</artifactId>
1121+
<version>${spring.gov4j.version}</version>
1122+
</dependency>
1123+
1124+
<dependency>
1125+
<groupId>org.springframework</groupId>
1126+
<artifactId>spring-core</artifactId>
1127+
<version>${spring.gov4j.version}</version>
1128+
</dependency>
1129+
1130+
<dependency>
1131+
<groupId>org.springframework</groupId>
1132+
<artifactId>spring-beans</artifactId>
1133+
<version>${spring.gov4j.version}</version>
1134+
</dependency>
1135+
1136+
<dependency>
1137+
<groupId>org.springframework</groupId>
1138+
<artifactId>spring-aop</artifactId>
1139+
<version>${spring.version}</version>
1140+
</dependency>
1141+
1142+
<dependency>
1143+
<groupId>org.springframework</groupId>
1144+
<artifactId>spring-expression</artifactId>
1145+
<version>${spring.gov4j.version}</version>
1146+
</dependency>
1147+
1148+
<dependency>
1149+
<groupId>org.springframework</groupId>
1150+
<artifactId>spring-jcl</artifactId>
11201151
<version>${spring.version}</version>
11211152
</dependency>
11221153

@@ -1125,6 +1156,24 @@
11251156
<groupId>org.springframework.security</groupId>
11261157
<artifactId>spring-security-web</artifactId>
11271158
<version>${spring.security.version}</version>
1159+
<exclusions>
1160+
<exclusion>
1161+
<groupId>org.springframework</groupId>
1162+
<artifactId>spring-aop</artifactId>
1163+
</exclusion>
1164+
<exclusion>
1165+
<groupId>org.springframework</groupId>
1166+
<artifactId>spring-beans</artifactId>
1167+
</exclusion>
1168+
<exclusion>
1169+
<groupId>org.springframework</groupId>
1170+
<artifactId>spring-core</artifactId>
1171+
</exclusion>
1172+
<exclusion>
1173+
<groupId>org.springframework</groupId>
1174+
<artifactId>spring-expression</artifactId>
1175+
</exclusion>
1176+
</exclusions>
11281177
</dependency>
11291178

11301179
<dependency>
@@ -1159,12 +1208,36 @@
11591208
<groupId>org.springframework.security</groupId>
11601209
<artifactId>spring-security-config</artifactId>
11611210
<version>${spring.security.version}</version>
1211+
<exclusions>
1212+
<exclusion>
1213+
<groupId>org.springframework</groupId>
1214+
<artifactId>spring-aop</artifactId>
1215+
</exclusion>
1216+
<exclusion>
1217+
<groupId>org.springframework</groupId>
1218+
<artifactId>spring-beans</artifactId>
1219+
</exclusion>
1220+
<exclusion>
1221+
<groupId>org.springframework</groupId>
1222+
<artifactId>spring-core</artifactId>
1223+
</exclusion>
1224+
</exclusions>
11621225
</dependency>
11631226

11641227
<dependency>
11651228
<groupId>org.springframework.security</groupId>
11661229
<artifactId>spring-security-ldap</artifactId>
11671230
<version>${spring.security.version}</version>
1231+
<exclusions>
1232+
<exclusion>
1233+
<groupId>org.springframework</groupId>
1234+
<artifactId>spring-beans</artifactId>
1235+
</exclusion>
1236+
<exclusion>
1237+
<groupId>org.springframework</groupId>
1238+
<artifactId>spring-core</artifactId>
1239+
</exclusion>
1240+
</exclusions>
11681241
</dependency>
11691242

11701243
<!-- Spring Security OAuth2 -->
@@ -1177,26 +1250,52 @@
11771250
<groupId>com.nimbusds</groupId>
11781251
<artifactId>nimbus-jose-jwt</artifactId>
11791252
</exclusion>
1253+
<exclusion>
1254+
<groupId>org.springframework</groupId>
1255+
<artifactId>spring-core</artifactId>
1256+
</exclusion>
11801257
</exclusions>
11811258
</dependency>
11821259

11831260
<dependency>
11841261
<groupId>org.springframework.security</groupId>
11851262
<artifactId>spring-security-oauth2-client</artifactId>
11861263
<version>${spring.security.version}</version>
1264+
<exclusions>
1265+
<exclusion>
1266+
<groupId>org.springframework</groupId>
1267+
<artifactId>spring-core</artifactId>
1268+
</exclusion>
1269+
</exclusions>
11871270
</dependency>
11881271

11891272
<dependency>
11901273
<groupId>org.springframework.security</groupId>
11911274
<artifactId>spring-security-oauth2-resource-server</artifactId>
11921275
<version>${spring.security.version}</version>
1276+
<exclusions>
1277+
<exclusion>
1278+
<groupId>org.springframework</groupId>
1279+
<artifactId>spring-core</artifactId>
1280+
</exclusion>
1281+
</exclusions>
11931282
</dependency>
11941283

11951284
<!-- Spring Security Ldap Plugin -->
11961285
<dependency>
11971286
<groupId>org.springframework.ldap</groupId>
11981287
<artifactId>spring-ldap-core</artifactId>
11991288
<version>${spring.ldap.version}</version>
1289+
<exclusions>
1290+
<exclusion>
1291+
<groupId>org.springframework</groupId>
1292+
<artifactId>spring-beans</artifactId>
1293+
</exclusion>
1294+
<exclusion>
1295+
<groupId>org.springframework</groupId>
1296+
<artifactId>spring-core</artifactId>
1297+
</exclusion>
1298+
</exclusions>
12001299
</dependency>
12011300

12021301
<!-- nimbus jose jwt-->
@@ -1466,6 +1565,8 @@
14661565
<!-- <jarAnalyzerEnabled>false</jarAnalyzerEnabled> -->
14671566
<format>ALL</format>
14681567
<suppressionFiles>
1568+
<suppressionFile>${owasp.falsePositives.dir}/CVE-2023-30614.xml</suppressionFile>
1569+
<suppressionFile>${owasp.falsePositives.dir}/CVE-2024-38820.xml</suppressionFile>
14691570
<suppressionFile>${owasp.falsePositives.dir}/spring-web.xml</suppressionFile>
14701571
<suppressionFile>${owasp.falsePositives.dir}/spring-security-crypto.xml</suppressionFile>
14711572
<suppressionFile>${owasp.falsePositives.dir}/xercesImpl.xml</suppressionFile>
@@ -1485,8 +1586,6 @@
14851586
<artifactId>spotbugs-maven-plugin</artifactId>
14861587
<version>4.8.6.0</version>
14871588
<configuration>
1488-
<!-- <includeFilterFile>spotbugs-security-include.xml</includeFilterFile>-->
1489-
<!-- <excludeFilterFile>spotbugs-security-exclude.xml</excludeFilterFile>-->
14901589
<plugins>
14911590
<plugin>
14921591
<groupId>com.h3xstream.findsecbugs</groupId>

‎publiccode.yml

+1-1
Original file line numberDiff line numberDiff line change
@@ -207,7 +207,7 @@ outputTypes:
207207
- application/pdf
208208
platforms:
209209
- web
210-
releaseDate: '2024-10-25'
210+
releaseDate: '2024-10-31'
211211
roadmap: 'https://github.com/link-it/govpay/milestones'
212212
softwareType: standalone/web
213213
softwareVersion: 3.7.8

‎src/main/resources/owasp/falsePositives/CVE-2023-30614.xml

+102
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,102 @@
1+
<suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">
2+
<suppress>
3+
<notes><![CDATA[
4+
file name: pom.xml
5+
6+
Pay is a payments engine for Ruby on Rails 6.0 and higher. In versions prior to 6.3.2 a payments info page of Pay is susceptible to reflected Cross-site scripting. An attacker could create a working URL that renders a javascript link to a user on a Rails application that integrates Pay. This URL could be distributed via email to specifically target certain individuals. If the targeted application contains a functionality to submit user-generated content (such as comments) the attacker could even distribute the URL using that functionality. This has been patched in version 6.3.2 and above. Users are advised to upgrade. There are no known workarounds for this vulnerability.
7+
8+
La libreria 'pay_project' non e' utilizzata in GovPay
9+
]]></notes>
10+
<packageUrl regex="true">^pkg:maven/it\.govpay/api-backoffice@.*$</packageUrl>
11+
<cve>CVE-2023-30614</cve>
12+
</suppress>
13+
<suppress>
14+
<notes><![CDATA[
15+
file name: pom.xml
16+
17+
Pay is a payments engine for Ruby on Rails 6.0 and higher. In versions prior to 6.3.2 a payments info page of Pay is susceptible to reflected Cross-site scripting. An attacker could create a working URL that renders a javascript link to a user on a Rails application that integrates Pay. This URL could be distributed via email to specifically target certain individuals. If the targeted application contains a functionality to submit user-generated content (such as comments) the attacker could even distribute the URL using that functionality. This has been patched in version 6.3.2 and above. Users are advised to upgrade. There are no known workarounds for this vulnerability.
18+
19+
La libreria 'pay_project' non e' utilizzata in GovPay
20+
]]></notes>
21+
<packageUrl regex="true">^pkg:maven/it\.govpay/api-jppapdp@.*$</packageUrl>
22+
<cve>CVE-2023-30614</cve>
23+
</suppress>
24+
<suppress>
25+
<notes><![CDATA[
26+
file name: pom.xml
27+
28+
Pay is a payments engine for Ruby on Rails 6.0 and higher. In versions prior to 6.3.2 a payments info page of Pay is susceptible to reflected Cross-site scripting. An attacker could create a working URL that renders a javascript link to a user on a Rails application that integrates Pay. This URL could be distributed via email to specifically target certain individuals. If the targeted application contains a functionality to submit user-generated content (such as comments) the attacker could even distribute the URL using that functionality. This has been patched in version 6.3.2 and above. Users are advised to upgrade. There are no known workarounds for this vulnerability.
29+
30+
La libreria 'pay_project' non e' utilizzata in GovPay
31+
]]></notes>
32+
<packageUrl regex="true">^pkg:maven/it\.govpay/api-pagamento@.*$</packageUrl>
33+
<cve>CVE-2023-30614</cve>
34+
</suppress>
35+
<suppress>
36+
<notes><![CDATA[
37+
file name: pom.xml
38+
39+
Pay is a payments engine for Ruby on Rails 6.0 and higher. In versions prior to 6.3.2 a payments info page of Pay is susceptible to reflected Cross-site scripting. An attacker could create a working URL that renders a javascript link to a user on a Rails application that integrates Pay. This URL could be distributed via email to specifically target certain individuals. If the targeted application contains a functionality to submit user-generated content (such as comments) the attacker could even distribute the URL using that functionality. This has been patched in version 6.3.2 and above. Users are advised to upgrade. There are no known workarounds for this vulnerability.
40+
41+
La libreria 'pay_project' non e' utilizzata in GovPay
42+
]]></notes>
43+
<packageUrl regex="true">^pkg:maven/it\.govpay/api-pagopa@.*$</packageUrl>
44+
<cve>CVE-2023-30614</cve>
45+
</suppress>
46+
<suppress>
47+
<notes><![CDATA[
48+
file name: pom.xml
49+
50+
Pay is a payments engine for Ruby on Rails 6.0 and higher. In versions prior to 6.3.2 a payments info page of Pay is susceptible to reflected Cross-site scripting. An attacker could create a working URL that renders a javascript link to a user on a Rails application that integrates Pay. This URL could be distributed via email to specifically target certain individuals. If the targeted application contains a functionality to submit user-generated content (such as comments) the attacker could even distribute the URL using that functionality. This has been patched in version 6.3.2 and above. Users are advised to upgrade. There are no known workarounds for this vulnerability.
51+
52+
La libreria 'pay_project' non e' utilizzata in GovPay
53+
]]></notes>
54+
<packageUrl regex="true">^pkg:maven/it\.govpay/api-pendenze@.*$</packageUrl>
55+
<cve>CVE-2023-30614</cve>
56+
</suppress>
57+
<suppress>
58+
<notes><![CDATA[
59+
file name: pom.xml
60+
61+
Pay is a payments engine for Ruby on Rails 6.0 and higher. In versions prior to 6.3.2 a payments info page of Pay is susceptible to reflected Cross-site scripting. An attacker could create a working URL that renders a javascript link to a user on a Rails application that integrates Pay. This URL could be distributed via email to specifically target certain individuals. If the targeted application contains a functionality to submit user-generated content (such as comments) the attacker could even distribute the URL using that functionality. This has been patched in version 6.3.2 and above. Users are advised to upgrade. There are no known workarounds for this vulnerability.
62+
63+
La libreria 'pay_project' non e' utilizzata in GovPay
64+
]]></notes>
65+
<packageUrl regex="true">^pkg:maven/it\.govpay/api-ragioneria@.*$</packageUrl>
66+
<cve>CVE-2023-30614</cve>
67+
</suppress>
68+
<suppress>
69+
<notes><![CDATA[
70+
file name: pom.xml
71+
72+
Pay is a payments engine for Ruby on Rails 6.0 and higher. In versions prior to 6.3.2 a payments info page of Pay is susceptible to reflected Cross-site scripting. An attacker could create a working URL that renders a javascript link to a user on a Rails application that integrates Pay. This URL could be distributed via email to specifically target certain individuals. If the targeted application contains a functionality to submit user-generated content (such as comments) the attacker could even distribute the URL using that functionality. This has been patched in version 6.3.2 and above. Users are advised to upgrade. There are no known workarounds for this vulnerability.
73+
74+
La libreria 'pay_project' non e' utilizzata in GovPay
75+
]]></notes>
76+
<packageUrl regex="true">^pkg:maven/it\.govpay/api-user@.*$</packageUrl>
77+
<cve>CVE-2023-30614</cve>
78+
</suppress>
79+
<suppress>
80+
<notes><![CDATA[
81+
file name: pom.xml
82+
83+
Pay is a payments engine for Ruby on Rails 6.0 and higher. In versions prior to 6.3.2 a payments info page of Pay is susceptible to reflected Cross-site scripting. An attacker could create a working URL that renders a javascript link to a user on a Rails application that integrates Pay. This URL could be distributed via email to specifically target certain individuals. If the targeted application contains a functionality to submit user-generated content (such as comments) the attacker could even distribute the URL using that functionality. This has been patched in version 6.3.2 and above. Users are advised to upgrade. There are no known workarounds for this vulnerability.
84+
85+
La libreria 'pay_project' non e' utilizzata in GovPay
86+
]]></notes>
87+
<packageUrl regex="true">^pkg:maven/it\.govpay/web-connector@.*$</packageUrl>
88+
<cve>CVE-2023-30614</cve>
89+
</suppress>
90+
<suppress>
91+
<notes><![CDATA[
92+
file name: pom.xml
93+
94+
Pay is a payments engine for Ruby on Rails 6.0 and higher. In versions prior to 6.3.2 a payments info page of Pay is susceptible to reflected Cross-site scripting. An attacker could create a working URL that renders a javascript link to a user on a Rails application that integrates Pay. This URL could be distributed via email to specifically target certain individuals. If the targeted application contains a functionality to submit user-generated content (such as comments) the attacker could even distribute the URL using that functionality. This has been patched in version 6.3.2 and above. Users are advised to upgrade. There are no known workarounds for this vulnerability.
95+
96+
La libreria 'pay_project' non e' utilizzata in GovPay
97+
]]></notes>
98+
<packageUrl regex="true">^pkg:maven/it\.govpay/web-console@.*$</packageUrl>
99+
<cve>CVE-2023-30614</cve>
100+
</suppress>
101+
</suppressions>
102+

0 commit comments

Comments
 (0)