Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Resolve Technical Debt- Upgrade from JDK-8 to JDK21 and Spring Boot from 2.3.12.RELEASE to 3.3.2 #346

Open
wants to merge 53 commits into
base: main
Choose a base branch
from

Conversation

gmkumar2005
Copy link

@gmkumar2005 gmkumar2005 commented Sep 3, 2024

RFC: Resolve Technical Debt of JDK and Spring Boot in Sunbird-RC-core #1053

This PR has changes needed to address the technical debt described in #1053

Following is the summary of changes

  1. JDK upgraded to LTS version 21
  2. Spring boot upgrade to latest version 3.3.2
  3. POM dependencies simplified. Dependencies like Lombok are pre-defined in spring-boot-starter
  4. Version numbers are configured in the parent pom for consistency
  5. javax package replaced with jakarata
  6. Junit test case refactored to work with Junit5
  7. Removed RegistryTestSuite which has dependency on non-standard test environment which is not compatible with junit5
  8. MessageProtos generated with latest protoc
  9. profiles tag in application.yml changed to work with spring 3.3.2
  10. Fixed cyclic dependencies
  11. Fixed classes and test cases which are broken after version upgrades
  12. Upgraded to version 2.0.4-SNAPSHOT
  13. Fixed github actions

Copy link

@amarts amarts left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@gmkumar2005
Copy link
Author

Fixed all functional test scenarios with sync scope in karate-test-cases

.anyMatch(requestUri::matches)) {
servletRequest.getRequestDispatcher(((HttpServletRequest) servletRequest).getServletPath()).forward(servletRequest, servletResponse);
servletRequest.getRequestDispatcher(servletRequest.getServletPath()).forward(servletRequest, servletResponse);

Check failure

Code scanning / CodeQL

URL forward from a remote source High

Untrusted URL forward depends on a
user-provided value
.
.map(d -> String.format("/api/v1/%s([^/]+)?(((\\?)|(\\%s)).*)?", d, "%3F"))
.anyMatch(requestUri::matches)) {
logger.debug("Forwarded NON Invite and Anonymous to : {} anonymousSchemas {} ", servletRequest.getServletPath(), anonymousSchemas);
servletRequest.getRequestDispatcher(servletRequest.getServletPath()).forward(servletRequest, servletResponse);

Check failure

Code scanning / CodeQL

URL forward from a remote source High

Untrusted URL forward depends on a
user-provided value
.
public SecurityFilterChain securityFilterChain(HttpSecurity http) throws Exception {
Map<String, AuthenticationManager> authenticationManagers = new HashMap<>();
oAuth2Configuration.getResources().forEach(issuer -> addManager(authenticationManagers, issuer));
http.csrf(AbstractHttpConfigurer::disable)

Check failure

Code scanning / CodeQL

Disabled Spring CSRF protection High

CSRF vulnerability due to protection being disabled.
@gmkumar2005
Copy link
Author

The build is failing because the projects under services did not receive JDK upgrade.
The pipeline has to be refactored in a way that it will use JDK11 for projects under services and JDk21 for projects under java folder.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants