STRLCPY/wrongsecrets

Merge pull request #499 from OWASP/gcp-287

GCP: Migrate to new springboot SDK & update azure identity to 1.7.0 and mvn dependency-check 7.3.0

Jeroen Willemsen committed with GitHub 2 years ago

bd3c008d

2 parents
d9f3242e
438a0132

Revision indexing in progress... (symbol navigation in revisions will be accurate after indexed)

Total 4 files Show one by one

■ ■ ■ ■ ■ ■

gcp/k8s/secret-challenge-vault-deployment.yml.tpl

		skipped 38 lines
39	39		volumeAttributes:
40	40		secretProviderClass: "wrongsecrets-gcp-secretsmanager"
41	41		containers:
42		-	- image: jeroenwillemsen/wrongsecrets:1.5.10-k8s-vault
	42	+	- image: jeroenwillemsen/wrongsecrets:gcp-287-2-k8s-vault
43	43		imagePullPolicy: IfNotPresent
44	44		name: secret-challenge
45	45		ports:
		skipped 31 lines
77	77		terminationMessagePath: /dev/termination-log
78	78		terminationMessagePolicy: File
79	79		env:
80		-	- name: GCP_PROJECT_ID
	80	+	- name: GCP_PROJECT
	81	+	value: ${GCP_PROJECT}
	82	+	- name: GOOGLE_CLOUD_PROJECT
81	83		value: ${GCP_PROJECT}
82	84		- name: K8S_ENV
83	85		value: gcp
		skipped 25 lines

■ ■ ■ ■ ■ ■

pom.xml

		skipped 42 lines
43	43		<maven.compiler.target>19</maven.compiler.target>
44	44		<spring.cloud-version>2021.0.4</spring.cloud-version>
45	45		<lombok.version>1.18.24</lombok.version>
46		-	<aws.sdk.version>2.18.7</aws.sdk.version>
	46	+	<aws.sdk.version>2.18.11</aws.sdk.version>
47	47		<asciidoctorj.version>2.5.7</asciidoctorj.version>
48	48		<jruby.version>9.3.9.0</jruby.version>
49	49		<bootstrap.version>5.2.2</bootstrap.version>
50	50		<github.button.version>2.14.1</github.button.version>
51		-	<gcp.sdk.version>26.1.4</gcp.sdk.version>
	51	+	<gcp.sdk.version>3.4.0</gcp.sdk.version>
52	52		<thymeleaf-spring5.version>3.0.15.RELEASE</thymeleaf-spring5.version>
53	53		<thymeleaf.version>3.0.15.RELEASE</thymeleaf.version>
54	54		<thymeleaf.layout>3.1.0</thymeleaf.layout>
55	55		<asciidoctor.maven.plugin.version>2.2.2</asciidoctor.maven.plugin.version>
56	56		<azure.keyvault.version>4.5.1</azure.keyvault.version>
57		-	<azure.identity.version>1.6.1</azure.identity.version>
	57	+	<azure.identity.version>1.7.0</azure.identity.version>
58	58		<azure.keyvault.spring.version>2.3.5</azure.keyvault.spring.version>
59	59		<spring.security.version>5.7.5</spring.security.version>
60	60		<cyclonedx.core.version>7.2.0</cyclonedx.core.version>
61	61		<KeePassJava2.version>2.1.4</KeePassJava2.version>
62	62		<system-stubs-jupiter.version>2.0.1</system-stubs-jupiter.version>
63		-	<dependency-check-maven.version>7.0.4</dependency-check-maven.version>
	63	+	<dependency-check-maven.version>7.3.0</dependency-check-maven.version>
64	64		</properties>
65	65
66	66		<dependencies>
		skipped 160 lines
227	227		</dependency>
228	228		<dependency>
229	229		<groupId>com.google.cloud</groupId>
230		-	<artifactId>libraries-bom</artifactId>
	230	+	<artifactId>spring-cloud-gcp-dependencies</artifactId>
231	231		<version>${gcp.sdk.version}</version>
232	232		<type>pom</type>
233	233		<scope>import</scope>
		skipped 212 lines

■ ■ ■ ■ ■ ■

src/main/java/org/owasp/wrongsecrets/challenges/cloud/Challenge11.java

		skipped 59 lines
60	60		@Value("${default_azure_value}") String azureDefaultValue,
61	61		@Value("${azure.keyvault.uri}") String azureVaultUri,
62	62		@Value("${wrongsecret-3}") String azureWrongSecret3, // Exclusively auto-wired for Azure
63		-	@Value("${GCP_PROJECT_ID}") String projectId,
	63	+	@Value("${GOOGLE_CLOUD_PROJECT}") String projectId,
64	64		@Value("${default_aws_value_challenge_11}") String ctfValue,
65	65		@Value("${ctf_enabled}") boolean ctfEnabled,
66	66		RuntimeEnvironment runtimeEnvironment) {
		skipped 137 lines

■ ■ ■ ■ ■ ■

src/main/resources/application.properties

		skipped 23 lines
24	24		secretmountpath=/mnt/secrets-store
25	25		challengedockermtpath=/var/tmp/helpers
26	26		AWS_REGION=if_you_see_this_please_use_AWS_Setup
27		-	GCP_PROJECT_ID=if_you_see_this_please_use_GCP_Setup
	27	+	GOOGLE_CLOUD_PROJECT=if_you_see_this_please_use_GCP_Setup
28	28		K8S_ENV=DOCKER
29	29		[email protected]@
30	30		logging.level.root=INFO
		skipped 71 lines