From 6a67397b7b688bd71bc06a8decaf7cf32c2193e2 Mon Sep 17 00:00:00 2001
From: Antonin Stoklasek <antonin.stoklasek@bsc-ideas.com>
Date: Sun, 4 Aug 2019 09:58:12 +0200
Subject: [PATCH] upgrade kafka-clients library to 2.3.0 because of
 CVE-2018-17196, upgrade docker images in example, added OWASP dependency
 check

---
 README.md                                     |  2 +-
 examples/00-installation.md                   |  7 ++++---
 examples/01-todolist/README.md                |  2 +-
 examples/01-todolist/pom.xml                  |  4 ++--
 .../src/main/webapp/WEB-INF/jboss-webx.xml    |  4 ++++
 pom.xml                                       | 21 ++++++++++++++++++-
 src/main/resources/META-INF/beans.xml         |  6 ------
 7 files changed, 32 insertions(+), 14 deletions(-)
 create mode 100644 examples/01-todolist/src/main/webapp/WEB-INF/jboss-webx.xml
 delete mode 100644 src/main/resources/META-INF/beans.xml

diff --git a/README.md b/README.md
index 68657a9..970cc9a 100644
--- a/README.md
+++ b/README.md
@@ -12,7 +12,7 @@ How to quickly start using the Event Store Kafka with your Java EE 8 project.
     <dependency>
         <groupId>net.osomahe</groupId>
         <artifactId>eventstore-kafka</artifactId>
-        <version>0.4.0</version>
+        <version>0.4.3</version>
     </dependency>
     ```
 2. Added extensions `src/main/resources/META-INF/services/javax.enterprise.inject.spi.Extension`
diff --git a/examples/00-installation.md b/examples/00-installation.md
index a6ac463..98f7ea5 100644
--- a/examples/00-installation.md
+++ b/examples/00-installation.md
@@ -21,13 +21,14 @@ Installation steps needs to be done prior the development.
 ```bash
 docker network create eventstore
 
-docker run -d --name es-zk --net eventstore -p 7072:7072 zookeeper:3.4.12
+docker run -d --name es-zk --net eventstore -p 7072:7072 zookeeper:3.5.5
 
 docker run -d --name es-kafka --net eventstore -p 9092:9092 -e KAFKA_ZOOKEEPER_CONNECT=es-zk:2181 \
 -e KAFKA_ADVERTISED_LISTENERS=PLAINTEXT://localhost:9092 -e KAFKA_BROKER_ID=0 \
 -e KAFKA_NUM_PARTITIONS=32 -e KAFKA_LOG_RETENTION_MS=-1 -e KAFKA_COMPRESSION_TYPE=gzip \
 -e KAFKA_DELETE_TOPIC_ENABLE=false -e KAFKA_LOG_CLEANUP_POLICY=compact \
--e KAFKA_OFFSETS_TOPIC_REPLICATION_FACTOR=1 -e KAFKA_HEAP_OPTS="-Xmx512m -Xms512m" confluentinc/cp-kafka:4.1.1
+-e KAFKA_OFFSETS_TOPIC_REPLICATION_FACTOR=1 -e KAFKA_HEAP_OPTS="-Xmx512m -Xms512m" \
+-e CONFLUENT_SUPPORT_METRICS_ENABLE=false confluentinc/cp-kafka:5.3.0
 
 docker exec es-kafka kafka-topics --zookeeper=es-zk:2181 --list
 
@@ -36,4 +37,4 @@ docker exec es-kafka kafka-streams-application-reset --application-id client-app
 
 docker exec es-kafka kafka-run-class kafka.tools.GetOffsetShell --broker-list localhost:9092 --topic eventstore
 
-```
\ No newline at end of file
+```
diff --git a/examples/01-todolist/README.md b/examples/01-todolist/README.md
index 884999e..d30effb 100644
--- a/examples/01-todolist/README.md
+++ b/examples/01-todolist/README.md
@@ -22,4 +22,4 @@ Queries:
 * Get all ToDos
     ```bash
     curl http://localhost:9080/api/todo
-    ```
\ No newline at end of file
+    ```
diff --git a/examples/01-todolist/pom.xml b/examples/01-todolist/pom.xml
index 5281559..3a89877 100644
--- a/examples/01-todolist/pom.xml
+++ b/examples/01-todolist/pom.xml
@@ -15,7 +15,7 @@
         <dependency>
             <groupId>net.osomahe</groupId>
             <artifactId>eventstore-kafka</artifactId>
-            <version>0.4.0-SNAPSHOT</version>
+            <version>0.5.0-SNAPSHOT</version>
         </dependency>
     </dependencies>
     <build>
@@ -26,4 +26,4 @@
         <maven.compiler.target>1.8</maven.compiler.target>
         <failOnMissingWebXml>false</failOnMissingWebXml>
     </properties>
-</project>
\ No newline at end of file
+</project>
diff --git a/examples/01-todolist/src/main/webapp/WEB-INF/jboss-webx.xml b/examples/01-todolist/src/main/webapp/WEB-INF/jboss-webx.xml
new file mode 100644
index 0000000..8a24b22
--- /dev/null
+++ b/examples/01-todolist/src/main/webapp/WEB-INF/jboss-webx.xml
@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<jboss-web>
+    <context-root>/</context-root>
+</jboss-web>
\ No newline at end of file
diff --git a/pom.xml b/pom.xml
index b171a46..bef0633 100644
--- a/pom.xml
+++ b/pom.xml
@@ -42,7 +42,7 @@
         <dependency>
             <groupId>org.apache.kafka</groupId>
             <artifactId>kafka-clients</artifactId>
-            <version>2.0.0</version>
+            <version>2.3.0</version>
         </dependency>
 
         <dependency>
@@ -130,4 +130,23 @@
             </build>
         </profile>
     </profiles>
+    <build>
+        <plugins>
+            <plugin>
+                <groupId>org.owasp</groupId>
+                <artifactId>dependency-check-maven</artifactId>
+                <version>5.2.0</version>
+                <configuration>
+                    <failBuildOnCVSS>8</failBuildOnCVSS>
+                </configuration>
+                <executions>
+                    <execution>
+                        <goals>
+                            <goal>check</goal>
+                        </goals>
+                    </execution>
+                </executions>
+            </plugin>
+        </plugins>
+    </build>
 </project>
diff --git a/src/main/resources/META-INF/beans.xml b/src/main/resources/META-INF/beans.xml
deleted file mode 100644
index 2777559..0000000
--- a/src/main/resources/META-INF/beans.xml
+++ /dev/null
@@ -1,6 +0,0 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<beans xmlns="http://xmlns.jcp.org/xml/ns/javaee"
-       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
-       xsi:schemaLocation="http://xmlns.jcp.org/xml/ns/javaee http://xmlns.jcp.org/xml/ns/javaee/beans_1_1.xsd"
-       bean-discovery-mode="all">
-</beans>