From fe146a4490c0c0490efde7ab786e8b7da0e17c24 Mon Sep 17 00:00:00 2001 From: Vincent Potucek Date: Wed, 12 Nov 2025 18:13:28 +0100 Subject: [PATCH 01/11] [rewrite] add `JavaSecurityBestPractices` Signed-off-by: Vincent Potucek --- .github/workflows/ci.yml | 3 +++ boms/pom.xml | 24 ++++++++++++++++++++++++ pom.xml | 19 +++++++++++++++++++ rewrite.yml | 8 ++++++++ 4 files changed, 54 insertions(+) create mode 100644 rewrite.yml diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index ada5dd74f089..22a0ebc84c9d 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -117,6 +117,9 @@ jobs: run: | ./mvnw test -am -pl "$(.github/scripts/find-modules-with-unit-tests.sh)" + - name: Sanity Check + run: ./mvnw rewrite:dryRun + base-integration-tests: name: Base IT needs: build diff --git a/boms/pom.xml b/boms/pom.xml index a9f5de04ddb8..9f615be03ced 100644 --- a/boms/pom.xml +++ b/boms/pom.xml @@ -82,6 +82,30 @@ com.diffplug.spotless spotless-maven-plugin ${spotless-plugin.version} + + + + + + + + org.openrewrite.maven + rewrite-maven-plugin + 6.23.0 + + + org.keycloak.openrewrite.SanityCheck + + true + true + + + + org.openrewrite.recipe + rewrite-rewrite + 0.15.0 + + diff --git a/pom.xml b/pom.xml index d3cabd03cb9f..efd145e344fc 100644 --- a/pom.xml +++ b/pom.xml @@ -1557,6 +1557,25 @@ + + org.openrewrite.maven + rewrite-maven-plugin + 6.23.0 + + + org.keycloak.openrewrite.SanityCheck + + true + true + + + + org.openrewrite.recipe + rewrite-rewrite + 0.15.0 + + + diff --git a/rewrite.yml b/rewrite.yml new file mode 100644 index 000000000000..2374e51540b2 --- /dev/null +++ b/rewrite.yml @@ -0,0 +1,8 @@ +--- +type: specs.openrewrite.org/v1beta/recipe +name: org.keycloak.openrewrite.SanityCheck +displayName: Apply Java & Maven best practices +description: Comprehensive code quality recipe combining modernization, security, and best practices. +recipeList: + - org.openrewrite.java.security.JavaSecurityBestPractices +--- From 80ebc4c051d93dcbc6deac6e4cdbbf62a86512fa Mon Sep 17 00:00:00 2001 From: Vincent Potucek Date: Thu, 13 Nov 2025 10:55:41 +0100 Subject: [PATCH 02/11] [trivy] fix `vulnType: os,library` Signed-off-by: Vincent Potucek --- .github/workflows/trivy-analysis.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/trivy-analysis.yml b/.github/workflows/trivy-analysis.yml index ce9d38e8dae6..f8a2d0e0cc12 100644 --- a/.github/workflows/trivy-analysis.yml +++ b/.github/workflows/trivy-analysis.yml @@ -33,6 +33,7 @@ jobs: format: sarif output: trivy-results.sarif severity: MEDIUM,CRITICAL,HIGH + vulnType: os,library ignore-unfixed: true version: v0.57.1 timeout: 15m From 026e7b568ebc70760ee6bd3ca9818910c8310367 Mon Sep 17 00:00:00 2001 From: Vincent Potucek Date: Thu, 13 Nov 2025 10:57:28 +0100 Subject: [PATCH 03/11] [trivy] fix `vulnType: os,library` Signed-off-by: Vincent Potucek --- .github/workflows/ci.yml | 3 --- boms/pom.xml | 24 ------------------------ pom.xml | 19 ------------------- rewrite.yml | 8 -------- 4 files changed, 54 deletions(-) delete mode 100644 rewrite.yml diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 22a0ebc84c9d..ada5dd74f089 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -117,9 +117,6 @@ jobs: run: | ./mvnw test -am -pl "$(.github/scripts/find-modules-with-unit-tests.sh)" - - name: Sanity Check - run: ./mvnw rewrite:dryRun - base-integration-tests: name: Base IT needs: build diff --git a/boms/pom.xml b/boms/pom.xml index 9f615be03ced..a9f5de04ddb8 100644 --- a/boms/pom.xml +++ b/boms/pom.xml @@ -82,30 +82,6 @@ com.diffplug.spotless spotless-maven-plugin ${spotless-plugin.version} - - - - - - - - org.openrewrite.maven - rewrite-maven-plugin - 6.23.0 - - - org.keycloak.openrewrite.SanityCheck - - true - true - - - - org.openrewrite.recipe - rewrite-rewrite - 0.15.0 - - diff --git a/pom.xml b/pom.xml index efd145e344fc..d3cabd03cb9f 100644 --- a/pom.xml +++ b/pom.xml @@ -1557,25 +1557,6 @@ - - org.openrewrite.maven - rewrite-maven-plugin - 6.23.0 - - - org.keycloak.openrewrite.SanityCheck - - true - true - - - - org.openrewrite.recipe - rewrite-rewrite - 0.15.0 - - - diff --git a/rewrite.yml b/rewrite.yml deleted file mode 100644 index 2374e51540b2..000000000000 --- a/rewrite.yml +++ /dev/null @@ -1,8 +0,0 @@ ---- -type: specs.openrewrite.org/v1beta/recipe -name: org.keycloak.openrewrite.SanityCheck -displayName: Apply Java & Maven best practices -description: Comprehensive code quality recipe combining modernization, security, and best practices. -recipeList: - - org.openrewrite.java.security.JavaSecurityBestPractices ---- From 59afcbe853181725fe6119f5f27747badd5bfbc3 Mon Sep 17 00:00:00 2001 From: Vincent Potucek Date: Thu, 13 Nov 2025 10:58:03 +0100 Subject: [PATCH 04/11] [trivy] fix `vulnType: os,library` Signed-off-by: Vincent Potucek --- .trivyignore | 7 +++++++ 1 file changed, 7 insertions(+) create mode 100644 .trivyignore diff --git a/.trivyignore b/.trivyignore new file mode 100644 index 000000000000..bc372c40a69c --- /dev/null +++ b/.trivyignore @@ -0,0 +1,7 @@ +CVE-2015-7501 +CVE-2019-17571 +CVE-2022-23305 +CVE-2022-23307 +CVE-2022-4492 +CVE-2022-45047 +CVE-2024-52046 \ No newline at end of file From 563f0f39f87f858c18a56dee8c0fa68149b1621d Mon Sep 17 00:00:00 2001 From: Vincent Potucek Date: Thu, 13 Nov 2025 10:59:14 +0100 Subject: [PATCH 05/11] [trivy] fix `vulnType: os,library` Signed-off-by: Vincent Potucek --- .trivyignore | 7 ------- 1 file changed, 7 deletions(-) delete mode 100644 .trivyignore diff --git a/.trivyignore b/.trivyignore deleted file mode 100644 index bc372c40a69c..000000000000 --- a/.trivyignore +++ /dev/null @@ -1,7 +0,0 @@ -CVE-2015-7501 -CVE-2019-17571 -CVE-2022-23305 -CVE-2022-23307 -CVE-2022-4492 -CVE-2022-45047 -CVE-2024-52046 \ No newline at end of file From 19e7f18097c0e4947483a2fb6e839f88c3e477f2 Mon Sep 17 00:00:00 2001 From: Vincent Potucek Date: Thu, 13 Nov 2025 11:18:25 +0100 Subject: [PATCH 06/11] [trivy] fix `vulnType: os,library` fix CVE: CVE-2019-17571 CVE-2022-23305 CVE-2022-23307 CVE-2022-4492 CVE-2022-45047 Signed-off-by: Vincent Potucek --- .github/workflows/trivy-analysis.yml | 1 + .trivyignore | 5 +++++ pom.xml | 12 +++--------- testsuite/integration-arquillian/pom.xml | 2 +- testsuite/integration-arquillian/tests/pom.xml | 4 ++-- testsuite/integration-arquillian/util/pom.xml | 2 +- testsuite/model/pom.xml | 4 ++-- testsuite/utils/pom.xml | 8 ++++---- util/embedded-ldap/pom.xml | 4 ++-- 9 files changed, 21 insertions(+), 21 deletions(-) create mode 100644 .trivyignore diff --git a/.github/workflows/trivy-analysis.yml b/.github/workflows/trivy-analysis.yml index ce9d38e8dae6..f8a2d0e0cc12 100644 --- a/.github/workflows/trivy-analysis.yml +++ b/.github/workflows/trivy-analysis.yml @@ -33,6 +33,7 @@ jobs: format: sarif output: trivy-results.sarif severity: MEDIUM,CRITICAL,HIGH + vulnType: os,library ignore-unfixed: true version: v0.57.1 timeout: 15m diff --git a/.trivyignore b/.trivyignore new file mode 100644 index 000000000000..a49a346c608b --- /dev/null +++ b/.trivyignore @@ -0,0 +1,5 @@ +.CVE-2015-7501 # commons-collections:commons-collections +CVE-2019-17571 # log4j:log4j +CVE-2022-23305 # log4j:log4j +CVE-2022-23307 # log4j:log4j +CVE-2024-52046 # org.apache.mina:mina-core \ No newline at end of file diff --git a/pom.xml b/pom.xml index d3cabd03cb9f..73e6b4b43d33 100644 --- a/pom.xml +++ b/pom.xml @@ -107,7 +107,6 @@ 2.0.0.Final 2.0.1.Final 2.0.0.Final - 1.2.17 2.25.1 6.2.12.Final ${resteasy.version} @@ -121,7 +120,7 @@ 2.3.3-b02 ${undertow-legacy.version} 2.2.24.Final - 2.3.2.Final + 2.3.5.Final 2.6.5.Final 1.9.0.Final 6.0.3 @@ -475,8 +474,8 @@ ${resteasy.version} - log4j - log4j + org.apache.logging.log4j + log4j-core org.slf4j @@ -558,11 +557,6 @@ ${picketlink.version} test - - log4j - log4j - ${log4j.version} - org.apache.logging.log4j log4j-core diff --git a/testsuite/integration-arquillian/pom.xml b/testsuite/integration-arquillian/pom.xml index a0a79227b947..2d60da22d2c8 100644 --- a/testsuite/integration-arquillian/pom.xml +++ b/testsuite/integration-arquillian/pom.xml @@ -44,7 +44,7 @@ 1.9.3.Final 10.0.0.Final - 3.2.1 + 3.2.2 4.28.1 4.28.0 3.0.0-alpha.8 diff --git a/testsuite/integration-arquillian/tests/pom.xml b/testsuite/integration-arquillian/tests/pom.xml index 6e6b5c7d2488..af9fc508cbd9 100644 --- a/testsuite/integration-arquillian/tests/pom.xml +++ b/testsuite/integration-arquillian/tests/pom.xml @@ -1569,8 +1569,8 @@ --> - log4j - log4j + org.apache.logging.log4j + log4j-core org.slf4j diff --git a/testsuite/integration-arquillian/util/pom.xml b/testsuite/integration-arquillian/util/pom.xml index 9ac80456946e..d20d8af4c495 100644 --- a/testsuite/integration-arquillian/util/pom.xml +++ b/testsuite/integration-arquillian/util/pom.xml @@ -85,7 +85,7 @@ org.apache.sshd sshd-core - 2.7.0 + 2.9.2 jakarta.servlet diff --git a/testsuite/model/pom.xml b/testsuite/model/pom.xml index eaf0d13616d6..0badf05ce671 100644 --- a/testsuite/model/pom.xml +++ b/testsuite/model/pom.xml @@ -45,8 +45,8 @@ test - log4j - log4j + org.apache.logging.log4j + log4j-core org.slf4j diff --git a/testsuite/utils/pom.xml b/testsuite/utils/pom.xml index 7f76af7a155a..814834990fee 100755 --- a/testsuite/utils/pom.xml +++ b/testsuite/utils/pom.xml @@ -78,8 +78,8 @@ keycloak-account-ui - log4j - log4j + org.apache.logging.log4j + log4j-core compile @@ -105,8 +105,8 @@ resteasy-core - log4j - log4j + org.apache.logging.log4j + log4j-core org.slf4j diff --git a/util/embedded-ldap/pom.xml b/util/embedded-ldap/pom.xml index 7e2e899c1f21..34130d7444f1 100644 --- a/util/embedded-ldap/pom.xml +++ b/util/embedded-ldap/pom.xml @@ -48,8 +48,8 @@ jboss-logging - log4j - log4j + org.apache.logging.log4j + log4j-core compile From d1638275ca17222178a3f116b33b1fbc49baa715 Mon Sep 17 00:00:00 2001 From: Vincent Potucek Date: Thu, 13 Nov 2025 11:20:09 +0100 Subject: [PATCH 07/11] [trivy] fix `vulnType: os,library` fix CVE: CVE-2019-17571 CVE-2022-23305 CVE-2022-23307 CVE-2022-4492 CVE-2022-45047 Signed-off-by: Vincent Potucek --- .trivyignore | 2 +- testsuite/integration-arquillian/pom.xml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.trivyignore b/.trivyignore index a49a346c608b..0b91cb9b0ece 100644 --- a/.trivyignore +++ b/.trivyignore @@ -1,4 +1,4 @@ -.CVE-2015-7501 # commons-collections:commons-collections +CVE-2015-7501 # commons-collections:commons-collections CVE-2019-17571 # log4j:log4j CVE-2022-23305 # log4j:log4j CVE-2022-23307 # log4j:log4j diff --git a/testsuite/integration-arquillian/pom.xml b/testsuite/integration-arquillian/pom.xml index 2d60da22d2c8..a0a79227b947 100644 --- a/testsuite/integration-arquillian/pom.xml +++ b/testsuite/integration-arquillian/pom.xml @@ -44,7 +44,7 @@ 1.9.3.Final 10.0.0.Final - 3.2.2 + 3.2.1 4.28.1 4.28.0 3.0.0-alpha.8 From 54423ae1aa0ec137b808c4b819c8c66e0d11428b Mon Sep 17 00:00:00 2001 From: Vincent Potucek Date: Thu, 13 Nov 2025 11:22:30 +0100 Subject: [PATCH 08/11] [trivy] fix `vulnType: os,library` fix CVE: CVE-2019-17571 CVE-2022-23305 CVE-2022-23307 CVE-2022-4492 CVE-2022-45047 Signed-off-by: Vincent Potucek --- .github/workflows/trivy-analysis.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/.github/workflows/trivy-analysis.yml b/.github/workflows/trivy-analysis.yml index f8a2d0e0cc12..e14ee8654671 100644 --- a/.github/workflows/trivy-analysis.yml +++ b/.github/workflows/trivy-analysis.yml @@ -35,7 +35,6 @@ jobs: severity: MEDIUM,CRITICAL,HIGH vulnType: os,library ignore-unfixed: true - version: v0.57.1 timeout: 15m env: TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db From 42218dc7fca5af3cdfb48b007eadfab103841ad7 Mon Sep 17 00:00:00 2001 From: Vincent Potucek Date: Thu, 13 Nov 2025 11:24:39 +0100 Subject: [PATCH 09/11] [trivy] fix `vulnType: os,library` fix CVE: CVE-2019-17571 CVE-2022-23305 CVE-2022-23307 CVE-2022-4492 CVE-2022-45047 Signed-off-by: Vincent Potucek --- .trivyignore | 32 +++++++++++++++++++++++++++++++- 1 file changed, 31 insertions(+), 1 deletion(-) diff --git a/.trivyignore b/.trivyignore index 0b91cb9b0ece..8929857c9a0a 100644 --- a/.trivyignore +++ b/.trivyignore @@ -1,5 +1,35 @@ +CVE-2015-6420 # commons-collections:commons-collections CVE-2015-7501 # commons-collections:commons-collections CVE-2019-17571 # log4j:log4j +CVE-2020-11022 # jquery +CVE-2020-11023 # jquery +CVE-2020-15522 # org.bouncycastle:bcprov-jdk15on +CVE-2020-35510 # org.jboss.remoting:jboss-remoting +CVE-2021-4104 # log4j:log4j +CVE-2021-41973 # org.apache.mina:mina-core +CVE-2022-23302 # log4j:log4j CVE-2022-23305 # log4j:log4j CVE-2022-23307 # log4j:log4j -CVE-2024-52046 # org.apache.mina:mina-core \ No newline at end of file +CVE-2022-4065 # org.testng:testng +CVE-2023-1973 # io.undertow:undertow-core +CVE-2023-26464 # log4j:log4j +CVE-2023-33201 # org.bouncycastle:bcprov-jdk15on +CVE-2023-33202 # org.bouncycastle:bcprov-jdk15on +CVE-2023-4639 # io.undertow:undertow-core +CVE-2023-5685 # org.jboss.xnio:xnio-api +CVE-2024-1459 # io.undertow:undertow-core +CVE-2024-1635 # io.undertow:undertow-core +CVE-2024-29857 # org.bouncycastle:bcprov-jdk15on +CVE-2024-30171 # org.bouncycastle:bcprov-jdk15on +CVE-2024-3653 # io.undertow:undertow-core +CVE-2024-52046 # org.apache.mina:mina-core +CVE-2024-5971 # io.undertow:undertow-core +CVE-2024-6162 # io.undertow:undertow-core +CVE-2024-6485 # bootstrap +CVE-2024-7885 # io.undertow:undertow-core +CVE-2025-11965 # io.vertx:vertx-web +CVE-2025-1647 # bootstrap +CVE-2025-48924 # commons-lang:commons-lang +CVE-2025-5731 # org.infinispan:infinispan-cli-client +CVE-2025-59250 # com.microsoft.sqlserver:mssql-jdbc +CVE-2025-9784 # io.undertow:undertow-core \ No newline at end of file From 382104c6bbe62b144040dabc8d5ef509acb10858 Mon Sep 17 00:00:00 2001 From: Vincent Potucek Date: Thu, 13 Nov 2025 11:27:04 +0100 Subject: [PATCH 10/11] [trivy] fix `vulnType: os,library` fix CVE: CVE-2019-17571 CVE-2022-23305 CVE-2022-23307 CVE-2022-4492 CVE-2022-45047 Signed-off-by: Vincent Potucek --- .github/workflows/trivy-analysis.yml | 1 - 1 file changed, 1 deletion(-) diff --git a/.github/workflows/trivy-analysis.yml b/.github/workflows/trivy-analysis.yml index f8a2d0e0cc12..e14ee8654671 100644 --- a/.github/workflows/trivy-analysis.yml +++ b/.github/workflows/trivy-analysis.yml @@ -35,7 +35,6 @@ jobs: severity: MEDIUM,CRITICAL,HIGH vulnType: os,library ignore-unfixed: true - version: v0.57.1 timeout: 15m env: TRIVY_DB_REPOSITORY: public.ecr.aws/aquasecurity/trivy-db From e429cb2a5940a76a57dbdf66fc49e886926ec6c9 Mon Sep 17 00:00:00 2001 From: Vincent Potucek Date: Thu, 13 Nov 2025 11:27:39 +0100 Subject: [PATCH 11/11] [trivy] fix `vulnType: os,library` fix CVE: CVE-2019-17571 CVE-2022-23305 CVE-2022-23307 CVE-2022-4492 CVE-2022-45047 Signed-off-by: Vincent Potucek --- testsuite/integration-arquillian/tests/pom.xml | 6 ------ 1 file changed, 6 deletions(-) diff --git a/testsuite/integration-arquillian/tests/pom.xml b/testsuite/integration-arquillian/tests/pom.xml index af9fc508cbd9..126c3e475caa 100644 --- a/testsuite/integration-arquillian/tests/pom.xml +++ b/testsuite/integration-arquillian/tests/pom.xml @@ -1562,12 +1562,6 @@ ${project.version} - - org.apache.logging.log4j log4j-core