Merge pull request #116 from hmcts/feature/us-owasp-encode

feature: use owasp encoder to sanitize urls

Author: coling01

Dockerfile

@@ -1,37 +1,17 @@
-# ---- Base image (default fallback) ----
-ARG BASE_IMAGE
-FROM ${BASE_IMAGE:-eclipse-temurin:21}
+FROM eclipse-temurin:21
 
-# ---- Runtime arguments ----
-ARG SERVER_PORT
-ARG JAR_FILENAME
-ARG JAR_FILE_PATH
-ARG CP_BACKEND_URL
-ARG CJSCPPUID
-
-ENV JAR_FILENAME=${JAR_FILENAME:-app.jar}
-ENV JAR_FILE_PATH=${JAR_FILE_PATH:-build/libs}
-ENV JAR_FULL_PATH=$JAR_FILE_PATH/$JAR_FILENAME
-
-ENV CP_BACKEND_URL=$CP_BACKEND_URL
-ENV CJSCPPUID=$CJSCPPUID
-
-# ---- Set runtime ENV for Spring Boot to bind port
-ENV SERVER_PORT=${SERVER_PORT:-4550}
+WORKDIR /app
 
 # ---- Dependencies ----
 RUN apt-get update \
     && apt-get install -y curl \
     && rm -rf /var/lib/apt/lists/*
 
 # ---- Application files ----
-COPY $JAR_FULL_PATH /opt/app/app.jar
-COPY lib/applicationinsights.json /opt/app/
-
-# ---- Permissions ----
-RUN chmod 755 /opt/app/app.jar
+COPY build/libs/*.jar /app/
+COPY lib/applicationinsights.json /app/
 
 # ---- Runtime ----
 EXPOSE 4550
 
-CMD ["java", "-jar", "/opt/app/app.jar"]
+ENTRYPOINT ["sh","-c","exec java -jar $(ls /app/*.jar | grep -v 'plain' | head -n1)"]

build.gradle

@@ -1,77 +1,45 @@
 plugins {
-    id 'application'
-    id 'java'
-    id 'io.spring.dependency-management' version '1.1.7'
-    id 'org.springframework.boot' version '4.0.0'
-    id 'jacoco'
-    id 'maven-publish'
-    id "com.github.ben-manes.versions" version "0.53.0"
-    id "org.cyclonedx.bom" version "3.1.0"
+  id 'application'
+  id 'java'
+  id 'org.springframework.boot' version '4.0.0'
+  id 'io.spring.dependency-management' version '1.1.7'
+  id 'jacoco'
+  id 'maven-publish'
+  id "com.github.ben-manes.versions" version "0.53.0"
+  id "org.cyclonedx.bom" version "3.1.0"
+  id 'com.avast.gradle.docker-compose' version '0.17.20'
 }
 
 group = 'uk.gov.hmcts.cp'
 version = System.getProperty('ARTEFACT_VERSION') ?: '0.0.999'
 
 apply {
-    from("$rootDir/gradle/dependency.gradle")
-    from("$rootDir/gradle/buildinfo.gradle")
-    from("$rootDir/gradle/integration.gradle")
-    from("$rootDir/gradle/jar.gradle")
-    from("$rootDir/gradle/java.gradle")
-    from("$rootDir/gradle/pmd.gradle")
-    from("$rootDir/gradle/repositories.gradle")
-    from("$rootDir/gradle/test.gradle")
+  from("$rootDir/gradle/dependencies/java-core.gradle")
+  from("$rootDir/gradle/dependencies/spring-core.gradle")
+
+  from("$rootDir/gradle/github/repositories.gradle")
+  from("$rootDir/gradle/github/java.gradle")
+  from("$rootDir/gradle/github/dependency.gradle")
+  from("$rootDir/gradle/github/pmd.gradle")
+  from("$rootDir/gradle/github/test.gradle")
+  from("$rootDir/gradle/github/jar.gradle")
+
+  from("$rootDir/gradle/tasks/apitest.gradle")
 }
 
 ext {
-    apiCaseUrnMapperVersion = "1.0.4"
-    log4JVersion = "2.24.3"
-    logbackVersion = "1.5.18"
-    lombokVersion = "1.18.38"
+  apiCaseUrnMapperVersion = "1.0.5"
 }
-cyclonedxBom {
-    schemaVersion = org.cyclonedx.Version.VERSION_16
-    componentVersion = project.version.toString()
-}
-dependencies {
-    implementation "uk.gov.hmcts.cp:api-cp-caseadmin-case-urn-mapper:$apiCaseUrnMapperVersion"
-    implementation 'org.springdoc:springdoc-openapi-starter-webmvc-ui:3.0.0'
-    implementation 'io.swagger.core.v3:swagger-core:2.2.41'
-    implementation 'javax.xml.bind:jaxb-api:2.3.1'
-    implementation 'org.springframework.boot:spring-boot-starter-cache'
 
-    implementation 'org.springframework.boot:spring-boot-starter-web'
-    implementation 'org.springframework.boot:spring-boot-starter-actuator'
-    implementation 'org.springframework.boot:spring-boot-starter-aop:3.5.8'
-    implementation 'org.springframework.boot:spring-boot-starter-json'
-
-    // micrometer
-    implementation platform('io.micrometer:micrometer-tracing-bom:latest.release')
-    implementation 'io.micrometer:micrometer-tracing'
-    implementation 'io.micrometer:micrometer-tracing-bridge-otel'
-    // Spring Boot 4 will auto-configure OpenTelemetry when management.tracing.enabled=true
-    implementation 'com.azure:azure-monitor-opentelemetry-autoconfigure:1.4.0'
-    implementation 'net.logstash.logback:logstash-logback-encoder:9.0'
-    implementation group: 'io.rest-assured', name: 'rest-assured', version: '6.0.0'
-    implementation 'org.hibernate.validator:hibernate-validator:9.1.0.Final'
-
-    implementation 'org.apache.commons:commons-text:1.15.0'
-    implementation 'com.fasterxml.jackson.core:jackson-databind:2.20.1'
-    implementation("org.owasp.encoder:encoder:1.4.0")
-    compileOnly group: 'org.projectlombok', name: 'lombok', version: lombokVersion
-    annotationProcessor group: 'org.projectlombok', name: 'lombok', version: lombokVersion
-    testCompileOnly group: 'org.projectlombok', name: 'lombok', version: lombokVersion
-    testAnnotationProcessor group: 'org.projectlombok', name: 'lombok', version: lombokVersion
-    integrationTestCompileOnly group: 'org.projectlombok', name: 'lombok', version: lombokVersion
-    integrationTestAnnotationProcessor group: 'org.projectlombok', name: 'lombok', version: lombokVersion
+dependencies {
+  implementation "uk.gov.hmcts.cp:api-cp-caseadmin-case-urn-mapper:$apiCaseUrnMapperVersion"
+  implementation "io.swagger.core.v3:swagger-annotations:2.2.41"
 
-    testImplementation(platform('org.junit:junit-bom:6.0.1'))
-    testRuntimeOnly 'org.junit.jupiter:junit-jupiter-engine'
-    testImplementation group: 'org.springframework.boot', name: 'spring-boot-starter-test', version: '4.0.0', {
-        exclude group: 'junit', module: 'junit'
-        exclude group: 'org.junit.vintage', module: 'junit-vintage-engine'
-    }
-    testImplementation group: 'org.springframework.boot', name: 'spring-boot-test-autoconfigure', version: '4.0.0'
-    testRuntimeOnly 'org.junit.platform:junit-platform-launcher'
+  implementation 'org.springframework.boot:spring-boot-starter-actuator'
+  implementation 'org.hibernate.validator:hibernate-validator'
+  implementation 'org.springframework.boot:spring-boot-starter-opentelemetry'
+  implementation 'io.jsonwebtoken:jjwt:0.13.0'
+  testRuntimeOnly 'org.junit.platform:junit-platform-launcher'
 
+  implementation 'org.springframework.boot:spring-boot-starter-cache'
 }

docker-compose.yml

@@ -1,35 +1,6 @@
-version: '3.8'
-
 services:
-  service-cp-caseadmin-case-urn-mapper:
-    env_file:
-      - .env
+  app:
     build:
-      context: .
       dockerfile: Dockerfile
-      args:
-        http_proxy: ${http_proxy}
-        https_proxy: ${https_proxy}
-        no_proxy: ${no_proxy}
-        BASE_IMAGE: ${BASE_IMAGE}
-        SERVER_PORT: ${SERVER_PORT}
-        JAR_FILENAME: ${JAR_FILENAME}
-        JAR_FILE_PATH: ${JAR_FILE_PATH}
-        CP_BACKEND_URL: ${CP_BACKEND_URL}
-        CJSCPPUID: ${CJSCPPUID}
-    environment:
-      - SERVER_PORT=${SERVER_PORT:-4550}
     ports:
-      - "${SERVER_PORT:-4550}:${SERVER_PORT:-4550}"
-    networks:
-      - service-network
-    healthcheck:
-      test: [ "CMD", "curl", "-f", "http://localhost:${SERVER_PORT}/health" ]
-      interval: 30s
-      timeout: 10s
-      retries: 3
-      start_period: 5s
-
-networks:
-  service-network:
-    name: service-cp-caseadmin-case-urn-mapper-network
+      - "4550:4550"

gradle/buildinfo.gradle

@@ -0,0 +1,22 @@
+ext {
+  log4JVersion = "2.24.3"
+  logbackVersion = "1.5.18"
+  lombokVersion = "1.18.38"
+  mapstructVersion = "1.5.5.Final"
+}
+
+dependencies {
+  implementation 'net.logstash.logback:logstash-logback-encoder:8.1'
+  implementation 'org.apache.logging.log4j:log4j-to-slf4j'
+  implementation 'ch.qos.logback:logback-classic'
+  implementation 'ch.qos.logback:logback-core'
+  implementation "org.owasp.encoder:encoder:1.2.3"
+
+  compileOnly group: 'org.projectlombok', name: 'lombok', version: lombokVersion
+  annotationProcessor group: 'org.projectlombok', name: 'lombok', version: lombokVersion
+  testCompileOnly group: 'org.projectlombok', name: 'lombok', version: lombokVersion
+  testAnnotationProcessor group: 'org.projectlombok', name: 'lombok', version: lombokVersion
+
+  implementation "org.mapstruct:mapstruct:$mapstructVersion"
+  annotationProcessor "org.mapstruct:mapstruct-processor:$mapstructVersion"
+}

gradle/dependencies/java-core.gradle

@@ -0,0 +1,9 @@
+dependencies {
+  implementation "org.springframework.boot:spring-boot-starter-web"
+  implementation "org.springframework.boot:spring-boot-starter-aspectj"
+  implementation "org.springframework.boot:spring-boot-starter-actuator"
+  implementation "org.springframework.boot:spring-boot-starter-validation"
+
+  testImplementation "org.springframework.boot:spring-boot-starter-webmvc-test"
+  testImplementation "org.springframework.boot:spring-boot-starter-test"
+}

gradle/dependencies/spring-core.gradle

@@ -0,0 +1,11 @@
+// check dependencies upon release ONLY
+tasks.named("dependencyUpdates").configure {
+  def isNonStable = { String version ->
+    def stableKeyword = ['RELEASE', 'FINAL', 'GA'].any { qualifier -> version.toUpperCase().contains(qualifier) }
+    def regex = /^[0-9,.v-]+$/
+    return !stableKeyword && !(version ==~ regex)
+  }
+  rejectVersionIf {
+    isNonStable(it.candidate.version) && !isNonStable(it.currentVersion)
+  }
+}

gradle/dependency.gradle

@@ -0,0 +1,34 @@
+jar {
+  enabled = true
+  archiveClassifier.set('plain')
+  manifest {
+    attributes(
+      'Implementation-Title': project.name,
+      'Implementation-Version': project.version.toString()
+    )
+  }
+  if (file("CHANGELOG.md").exists()) {
+    from('CHANGELOG.md') {
+      into 'META-INF'
+    }
+  } else {
+    println "⚠️  CHANGELOG.md not found, skipping inclusion in JAR"
+  }
+}
+
+bootJar {
+  archiveFileName = "${rootProject.name}-${project.version}.jar"
+
+  manifest {
+    attributes('Implementation-Version': project.version.toString())
+  }
+}
+
+tasks.named('composeBuild') {
+  dependsOn tasks.named('bootJar')
+}
+
+tasks.withType(AbstractArchiveTask).configureEach {
+  preserveFileTimestamps = false
+  reproducibleFileOrder = true
+}

gradle/github/dependency.gradle

@@ -0,0 +1,12 @@
+java {
+  sourceCompatibility = JavaVersion.VERSION_21
+  targetCompatibility = JavaVersion.VERSION_21
+}
+tasks.withType(JavaCompile).configureEach {
+  options.compilerArgs << "-Xlint:unchecked" << "-Werror"
+}
+
+// https://github.com/gradle/gradle/issues/16791
+tasks.withType(JavaExec).configureEach {
+  javaLauncher.set(javaToolchains.launcherFor(java.toolchain))
+}