Skip to content

Commit 3f281ed

Browse files
samikshya-dbsamikshya-db
authored
Fix CVEs and add owasp security check (#789)
* Fix CVEs and add owasp security check * Add vulnerability scan every week on the repository * run vulnerability scan during validate phase only * remove phase * Address comments
1 parent b8e7cc5 commit 3f281ed

File tree

2 files changed

+112
-2
lines changed

2 files changed

+112
-2
lines changed

‎.github/workflows/vulnerabilityCatcher.yml‎

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
name: Weekly Security Scan
2+
3+
on:
4+
schedule:
5+
- cron: '0 0 * * 0' # Run every Sunday at midnight UTC
6+
workflow_dispatch: # Allow manual triggering
7+
8+
jobs:
9+
security-scan:
10+
runs-on: ubuntu-latest
11+
12+
steps:
13+
- name: Checkout repository
14+
uses: actions/checkout@v4
15+
with:
16+
ref: main # Explicitly check out main branch
17+
18+
- name: Set up JDK 11
19+
uses: actions/setup-java@v4
20+
with:
21+
java-version: '11'
22+
distribution: 'temurin'
23+
cache: maven
24+
25+
- name: Run OWASP Dependency Check
26+
run: mvn org.owasp:dependency-check-maven:check
27+
28+
- name: Check for vulnerabilities
29+
id: check_vulnerabilities
30+
run: |
31+
if grep -q "CVSS score >= 7" target/dependency-check-report.html; then
32+
echo "has_vulnerabilities=true" >> $GITHUB_OUTPUT
33+
echo "Critical or high vulnerabilities found (CVSS score >= 7)"
34+
# Generate a simple HTML report for email
35+
echo "<!DOCTYPE html><html><head><title>JDBC Driver Security Scan Results</title></head><body>" > security-scan-report.html
36+
echo "<h1>Security Vulnerabilities Found</h1>" >> security-scan-report.html
37+
echo "<p>Critical or high vulnerabilities (CVSS score >= 7) were found in the weekly scan of the JDBC driver.</p>" >> security-scan-report.html
38+
echo "<p>Please check the full report in the GitHub Actions artifacts: <a href='https://github.com/${{ github.repository }}/actions/runs/${{ github.run_id }}'>View Artifacts</a></p>" >> security-scan-report.html
39+
echo "</body></html>" >> security-scan-report.html
40+
exit 1
41+
else
42+
echo "has_vulnerabilities=false" >> $GITHUB_OUTPUT
43+
echo "No critical or high vulnerabilities found"
44+
fi
45+
46+
- name: Send Email
47+
if: steps.check_vulnerabilities.outputs.has_vulnerabilities == 'true'
48+
uses: dawidd6/action-send-mail@v3
49+
with:
50+
server_address: smtp.gmail.com
51+
server_port: 465
52+
username: ${{ secrets.SMTP_USERNAME }}
53+
password: ${{ secrets.SMTP_PASSWORD }}
54+
subject: OSS JDBC Driver Security Scan - 🚨 Vulnerabilities Found
55+
html_body: file://security-scan-report.html
56+
to: ${{ secrets.EMAIL_RECIPIENTS }}
57+
from: JDBC Security Scanner
58+
content_type: text/html
59+
60+
- name: Upload Report as Artifact
61+
uses: actions/upload-artifact@v4
62+
with:
63+
name: security-scan-reports
64+
path: |
65+
target/dependency-check-report.html
66+
target/dependency-check-report.json
67+
security-scan-report.html

‎pom.xml‎

Lines changed: 45 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -44,7 +44,7 @@
4444
<maven.compiler.source>11</maven.compiler.source>
4545
<maven.compiler.target>11</maven.compiler.target>
4646
<mockito.version>5.2.0</mockito.version>
47-
<jackson.version>2.15.1</jackson.version>
47+
<jackson.version>2.18.3</jackson.version>
4848
<log4j.version>2.22.1</log4j.version>
4949
<slf4j.version>2.0.13</slf4j.version>
5050
<google.guava.version>33.0.0-jre</google.guava.version>
@@ -54,7 +54,7 @@
5454
<httpclient.version>4.5.14</httpclient.version>
5555
<commons-configuration.version>2.10.1</commons-configuration.version>
5656
<commons-io.version>2.14.0</commons-io.version>
57-
<databricks-sdk.version>0.43.0</databricks-sdk.version>
57+
<databricks-sdk.version>0.44.0</databricks-sdk.version>
5858
<maven-surefire-plugin.version>3.1.2</maven-surefire-plugin.version>
5959
<sql-logic-test.version>0.3</sql-logic-test.version>
6060
<lz4-compression.version>1.8.0</lz4-compression.version>
@@ -66,6 +66,8 @@
6666
<nimbusjose.version>9.40</nimbusjose.version>
6767
<bouncycastle.version>1.78.1</bouncycastle.version>
6868
<async-httpclient.version>5.3.1</async-httpclient.version>
69+
<netty.version>4.2.0.Final</netty.version>
70+
<grpc.version>1.71.0</grpc.version>
6971
</properties>
7072
<dependencies>
7173
<dependency>
@@ -211,6 +213,24 @@
211213
<artifactId>lz4-java</artifactId>
212214
<version>${lz4-compression.version}</version>
213215
</dependency>
216+
<!-- The following dependency is added as a workaround to CVE-2023-33953-->
217+
<dependency>
218+
<groupId>io.grpc</groupId>
219+
<artifactId>grpc-context</artifactId>
220+
<version>${grpc.version}</version>
221+
</dependency>
222+
<!-- The following dependency is added as a workaround to CVE-2025-25193-->
223+
<dependency>
224+
<groupId>io.netty</groupId>
225+
<artifactId>netty-common</artifactId>
226+
<version>${netty.version}</version>
227+
</dependency>
228+
<!-- The following dependency is added as a workaround to CVE-2024-49194-->
229+
<dependency>
230+
<groupId>io.netty</groupId>
231+
<artifactId>netty-buffer</artifactId>
232+
<version>${netty.version}</version>
233+
</dependency>
214234
<dependency>
215235
<groupId>jakarta.annotation</groupId>
216236
<artifactId>jakarta.annotation-api</artifactId>
@@ -337,6 +357,29 @@
337357
</annotationProcessorPaths>
338358
</configuration>
339359
</plugin>
360+
<plugin>
361+
<groupId>org.owasp</groupId>
362+
<artifactId>dependency-check-maven</artifactId>
363+
<version>12.1.1</version>
364+
<configuration>
365+
<formats>
366+
<format>HTML</format>
367+
<format>JSON</format>
368+
</formats>
369+
<!--
370+
Setting threshold to 7.0 to catch both Critical (8.0-10.0) and High (7.0-7.9) severity vulnerabilities.
371+
This helps us identify and address significant security risks early in the development process.
372+
-->
373+
<failBuildOnCVSS>7</failBuildOnCVSS>
374+
</configuration>
375+
<executions>
376+
<execution>
377+
<goals>
378+
<goal>check</goal>
379+
</goals>
380+
</execution>
381+
</executions>
382+
</plugin>
340383
<plugin>
341384
<groupId>com.diffplug.spotless</groupId>
342385
<artifactId>spotless-maven-plugin</artifactId>

0 commit comments

Comments
 (0)