Skip to content

Commit 8efd631

Browse files
CarlTernCarlTern
authored
Merge pull request #7 from CarlTern/main
Add more open source obstacles and improve scan setup
2 parents 9966ece + 5676364 commit 8efd631

File tree

13 files changed

+172
-16
lines changed

13 files changed

+172
-16
lines changed

‎.github/workflows/debricked.yml‎

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -7,9 +7,8 @@ jobs:
77
runs-on: ubuntu-latest
88

99
steps:
10-
- uses: actions/checkout@v3
11-
- uses: debricked/actions/callgraph@v3
12-
- uses: debricked/actions/fingerprint@v3
13-
- uses: debricked/actions@v3
10+
- uses: actions/checkout@v4
11+
- uses: debricked/actions/callgraph@v4
12+
- uses: debricked/actions@v4
1413
env:
15-
DEBRICKED_TOKEN: ${{ secrets.DEBRICKED_TOKEN }}
14+
DEBRICKED_TOKEN: ${{ secrets.DEBRICKED_TOKEN }}

‎LICENSE‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,3 +19,8 @@ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
1919
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
2020
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
2121
SOFTWARE.
22+
23+
24+
Includes other software related under the MIT license:
25+
- jasypt-spring-boot-starter-3.0.5, Copyright (c) 2021 Sergio Ulises Bocchio. For licensing see /src/main/libs/LICENSE-jasypt-spring-boot-starter-3.0.5.txt
26+
- vite-plugin-purgecss, Copyright (c) 2023 Joe Stanley. For licensing see /web/app/src/LICENSE-vite-plugin-purgecss.txt

‎README.md‎

Lines changed: 64 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,64 @@
1-
# demo
2-
Demo project with various Open Source obstacles
1+
# Debricked Demo Repository
2+
3+
This is an intentionally vulnerable demo repository by [Debricked](https://debricked.com) that showcases common obstacles and risks related to open source dependencies. It demonstrates how our tool helps you analyze, detect, manage and remediate open source risks.
4+
5+
## Getting Started
6+
7+
### 1. Get a copy of the Repository
8+
9+
> [!NOTE]
10+
>This repository comes with a pre-configured GitHub Actions workflow located at [.github/workflows/debricked.yml](.github/workflows/debricked.yml), but it is also possible to use your CI/CD tool of choice or download/clone the repository and scan it locally using the [Debricked CLI](https://github.com/debricked/cli/tree/main). For more information on integrating with other tools, visit [the documentation](https://docs.debricked.com/tools-and-integrations/integrations).
11+
12+
The easiest way to get set up is to simply fork or import this repository to your own GitHub account, making use of the existing GitHub Actions workflow.
13+
14+
#### 1.1 (If forking the repository) Enable GitHub Actions in Forked Repositories
15+
16+
If you've forked this repository, please note that GitHub disables running workflows by default. To enable them:
17+
18+
1. Navigate to the **Actions** tab in your forked repository.
19+
2. Click the button labeled **"I understand my workflows, go ahead and enable them"**.
20+
21+
This step is necessary for the workflows to run as expected.
22+
23+
### 2. Configure Your Debricked Access Token
24+
25+
To enable the dependency scans with GitHub actions, set up your Debricked Access Token as a GitHub secret:
26+
27+
1. Generate an Access Token through the Debricked UI (instructions can be found [here](https://docs.debricked.com/product/administration/generate-access-token))
28+
2. Navigate to the repository on GitHub.
29+
3. Go to **Settings** > **Secrets and variables** > **Actions**.
30+
4. Click **New repository secret**.
31+
5. Name the secret `DEBRICKED_API_KEY` and paste your Access Token as the value.
32+
33+
### 3. Run a scan
34+
35+
Once the API key is configured, the workflow will automatically scan your repository for dependency issues on:
36+
* Every push to any branch.
37+
* [Manually triggering the workflow](https://docs.github.com/en/actions/managing-workflow-runs-and-deployments/managing-workflow-runs/manually-running-a-workflow#running-a-workflow)
38+
39+
## Repository Structure
40+
41+
- **[.github/workflows/debricked.yml](.github/workflows/debricked.yml)**:
42+
Contains the GitHub Actions workflow that triggers the Debricked dependency scan.
43+
- **[README.md](README.md)**:
44+
This documentation file.
45+
- **[LICENSE](LICENSE)**:
46+
The repository license.
47+
- **[web/](web/)**:
48+
Folder with code related to the frontend, using various vulnerable open source dependencies
49+
- **[src/](src/)**:
50+
Folder with code related to the backend, which is set up using a vulnerable version of the [Spring Framework](https://spring.io/projects/spring-framework).
51+
52+
## Additional Resources
53+
54+
- [Debricked Website](https://debricked.com)
55+
- [Debricked Documentation](https://docs.debricked.com)
56+
- [GitHub Actions Documentation](https://docs.github.com/en/actions)
57+
58+
## Contributing
59+
60+
Contributions to improve this demo are welcome! Please open an issue or submit a pull request with your suggestions.
61+
62+
## License
63+
64+
This repository is licensed under the MIT License. See the [LICENSE](LICENSE) file for more details.

‎pom.xml‎

Lines changed: 19 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -16,24 +16,40 @@
1616
<dependency>
1717
<groupId>org.springframework.boot</groupId>
1818
<artifactId>spring-boot-starter-web</artifactId>
19-
<version>2.7.6</version>
19+
<version>3.3.7</version>
2020
</dependency>
2121
<dependency>
2222
<groupId>org.apache.zookeeper</groupId>
2323
<artifactId>zookeeper</artifactId>
24-
<version>3.4.11</version>
24+
<version>3.5.10</version>
2525
</dependency>
2626
<dependency>
2727
<groupId>org.kitchen-eel</groupId>
2828
<artifactId>json-schema-validator</artifactId>
2929
<version>1.5.2</version>
3030
</dependency>
31+
<dependency>
32+
<groupId> org.apache.logging.log4j</groupId>
33+
<artifactId>log4j-core</artifactId>
34+
<version>2.13.0</version>
35+
</dependency>
36+
<dependency>
37+
<groupId>org.jsoup</groupId>
38+
<artifactId>jsoup</artifactId>
39+
<version>1.8.3</version>
40+
</dependency>
3141
<dependency>
3242
<groupId>org.springframework.boot</groupId>
3343
<artifactId>spring-boot-starter-test</artifactId>
34-
<version>2.7.6</version>
44+
<version>3.3.7</version>
3545
<scope>test</scope>
3646
</dependency>
47+
<dependency>
48+
<groupId>org.jboss.spec.javax.rmi</groupId>
49+
<artifactId>jboss-rmi-api_1.0_spec</artifactId>
50+
<version>1.0.6.Final</version>
51+
<scope>test</scope>
52+
</dependency>
3753
</dependencies>
3854
<build>
3955
<plugins>

‎src/main/java/com/github/debricked/demo/DemoController.java‎

Lines changed: 13 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,12 +3,22 @@
33
import org.springframework.web.bind.annotation.GetMapping;
44
import org.springframework.web.bind.annotation.RestController;
55

6+
import org.jsoup.Jsoup;
7+
import org.jsoup.nodes.Document;
8+
import org.jsoup.nodes.Element;
9+
import org.jsoup.select.Elements;
10+
11+
import java.io.IOException;
12+
613
@RestController
714
public class DemoController {
815

916
@GetMapping("/")
10-
public String index() {
11-
return "Greetings from Spring Boot!";
12-
}
17+
public String index() throws IOException {
18+
Document doc = Jsoup.connect("https://debricked.com/").get();
19+
20+
Elements loginButton = doc.select("div[class^=journey-button] > *:contains(Log in)");
1321

22+
return "Please visit %s to log into Debricked!".formatted(loginButton.attr("href"));
23+
}
1424
}

‎src/main/libs/LICENSE-jasypt-spring-boot-starter-3.0.5.txt‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
MIT License
2+
3+
Copyright (c) 2021 Sergio Ulises Bocchio
4+
5+
Permission is hereby granted, free of charge, to any person obtaining a copy
6+
of this software and associated documentation files (the "Software"), to deal
7+
in the Software without restriction, including without limitation the rights
8+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9+
copies of the Software, and to permit persons to whom the Software is
10+
furnished to do so, subject to the following conditions:
11+
12+
The above copyright notice and this permission notice shall be included in all
13+
copies or substantial portions of the Software.
14+
15+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21+
SOFTWARE.

‎src/main/libs/jasypt-spring-boot-starter-3.0.5.jar‎

4.09 KB
Binary file not shown.

‎web/app/src/App.vue‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ import HelloWorld from './components/HelloWorld.vue'
1313
<img src="./assets/vue.svg" class="logo vue" alt="Vue logo" />
1414
</a>
1515
</div>
16-
<HelloWorld msg="Vite + Vue" />
16+
<HelloWorld msg="Vite + Vue examples" />
1717
</template>
1818

1919
<style scoped>

‎web/app/src/LICENSE-vite-plugin-purgecss.txt‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
MIT License
2+
3+
Copyright (c) 2023 Joe Stanley
4+
5+
Permission is hereby granted, free of charge, to any person obtaining a copy
6+
of this software and associated documentation files (the "Software"), to deal
7+
in the Software without restriction, including without limitation the rights
8+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9+
copies of the Software, and to permit persons to whom the Software is
10+
furnished to do so, subject to the following conditions:
11+
12+
The above copyright notice and this permission notice shall be included in all
13+
copies or substantial portions of the Software.
14+
15+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21+
SOFTWARE.

‎web/app/src/components/HelloWorld.vue‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ const count = ref(0)
2323
Check out
2424
<a href="https://vuejs.org/guide/quick-start.html#local" target="_blank"
2525
>create-vue</a
26-
>, the official Vue + Vite starter
26+
>, the official Vue + Vite starter guide
2727
</p>
2828
<p>
2929
Install

0 commit comments

Comments
 (0)