Resolved vulnerable dependecies (AST-188461)

.github/workflows/ci.yml

@@ -32,12 +32,22 @@ jobs:
           path: ~/.m2/repository
           key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
           restore-keys: ${{ runner.os }}-maven-
+      - name: Install pinned Maven
+        env:
+          ECHO_LIBRARIES_ACCESS_KEY: ${{ secrets.ECHO_LIBRARIES_ACCESS_KEY }}
+        run: |
+          MAVEN_VERSION=3.9.16 # Resolved through the echo mirror configured in .mvn/settings.xml
+          # Run outside the repo: the root pom loads the Tycho extension, which fails on the runner's Maven
+          (cd "${RUNNER_TEMP}" && mvn -B -q -gs "${GITHUB_WORKSPACE}/.mvn/settings.xml" dependency:copy -Dartifact=org.apache.maven:apache-maven:${MAVEN_VERSION}:tar.gz:bin -DoutputDirectory=/tmp/maven-dist)
+          sudo tar -xzf /tmp/maven-dist/apache-maven-${MAVEN_VERSION}-bin.tar.gz -C /opt
+          echo "/opt/apache-maven-${MAVEN_VERSION}/bin" >> "$GITHUB_PATH"
       - name: Run UI Tests
         env:
           CX_BASE_URI: ${{ secrets.CX_BASE_URI }}
           CX_TENANT: ${{ secrets.CX_TENANT }}
           CX_APIKEY: ${{ secrets.CX_APIKEY }}
           CX_TEST_SCAN: ${{ secrets.CX_TEST_SCAN }}
+          ECHO_LIBRARIES_ACCESS_KEY: ${{ secrets.ECHO_LIBRARIES_ACCESS_KEY }}
           DISPLAY: :99.0
         run: |
           Xvfb -ac :99 -screen 0 1920x1080x16 &
@@ -71,12 +81,22 @@ jobs:
           path: ~/.m2/repository
           key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
           restore-keys: ${{ runner.os }}-maven-
+      - name: Install pinned Maven
+        env:
+          ECHO_LIBRARIES_ACCESS_KEY: ${{ secrets.ECHO_LIBRARIES_ACCESS_KEY }}
+        run: |
+          MAVEN_VERSION=3.9.16 # Resolved through the echo mirror configured in .mvn/settings.xml
+          # Run outside the repo: the root pom loads the Tycho extension, which fails on the runner's Maven
+          (cd "${RUNNER_TEMP}" && mvn -B -q -gs "${GITHUB_WORKSPACE}/.mvn/settings.xml" dependency:copy -Dartifact=org.apache.maven:apache-maven:${MAVEN_VERSION}:tar.gz:bin -DoutputDirectory=/tmp/maven-dist)
+          sudo tar -xzf /tmp/maven-dist/apache-maven-${MAVEN_VERSION}-bin.tar.gz -C /opt
+          echo "/opt/apache-maven-${MAVEN_VERSION}/bin" >> "$GITHUB_PATH"
       - name: Run Integration Tests
         env:
           CX_BASE_URI: ${{ secrets.CX_BASE_URI }}
           CX_TENANT: ${{ secrets.CX_TENANT }}
           CX_APIKEY: ${{ secrets.CX_APIKEY }}
           CX_TEST_SCAN: ${{ secrets.CX_TEST_SCAN }}
+          ECHO_LIBRARIES_ACCESS_KEY: ${{ secrets.ECHO_LIBRARIES_ACCESS_KEY }}
           DISPLAY: :99.0
         run: |
           Xvfb -ac :99 -screen 0 1920x1080x16 &
@@ -110,12 +130,22 @@ jobs:
           path: ~/.m2/repository
           key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
           restore-keys: ${{ runner.os }}-maven-
+      - name: Install pinned Maven
+        env:
+          ECHO_LIBRARIES_ACCESS_KEY: ${{ secrets.ECHO_LIBRARIES_ACCESS_KEY }}
+        run: |
+          MAVEN_VERSION=3.9.16 # Resolved through the echo mirror configured in .mvn/settings.xml
+          # Run outside the repo: the root pom loads the Tycho extension, which fails on the runner's Maven
+          (cd "${RUNNER_TEMP}" && mvn -B -q -gs "${GITHUB_WORKSPACE}/.mvn/settings.xml" dependency:copy -Dartifact=org.apache.maven:apache-maven:${MAVEN_VERSION}:tar.gz:bin -DoutputDirectory=/tmp/maven-dist)
+          sudo tar -xzf /tmp/maven-dist/apache-maven-${MAVEN_VERSION}-bin.tar.gz -C /opt
+          echo "/opt/apache-maven-${MAVEN_VERSION}/bin" >> "$GITHUB_PATH"
       - name: Run Unit Tests with Coverage
         env:
           CX_BASE_URI: ${{ secrets.CX_BASE_URI }}
           CX_TENANT: ${{ secrets.CX_TENANT }}
           CX_APIKEY: ${{ secrets.CX_APIKEY }}
           CX_TEST_SCAN: ${{ secrets.CX_TEST_SCAN }}
+          ECHO_LIBRARIES_ACCESS_KEY: ${{ secrets.ECHO_LIBRARIES_ACCESS_KEY }}
           DISPLAY: :99.0
         run: |
           Xvfb -ac :99 -screen 0 1920x1080x16 &

.github/workflows/release.yml

@@ -108,12 +108,25 @@ jobs:
           restore-keys: |
             ${{ runner.os }}-maven-      
 
+      - name: Install pinned Maven
+        env:
+          ECHO_LIBRARIES_ACCESS_KEY: ${{ secrets.ECHO_LIBRARIES_ACCESS_KEY }}
+        run: |
+          MAVEN_VERSION=3.9.16 # Resolved through the echo mirror configured in .mvn/settings.xml
+          # Run outside the repo: the root pom loads the Tycho extension, which fails on the runner's Maven
+          (cd "${RUNNER_TEMP}" && mvn -B -q -gs "${GITHUB_WORKSPACE}/.mvn/settings.xml" dependency:copy -Dartifact=org.apache.maven:apache-maven:${MAVEN_VERSION}:tar.gz:bin -DoutputDirectory=/tmp/maven-dist)
+          sudo tar -xzf /tmp/maven-dist/apache-maven-${MAVEN_VERSION}-bin.tar.gz -C /opt
+          echo "/opt/apache-maven-${MAVEN_VERSION}/bin" >> "$GITHUB_PATH"
+
       - name: Update the POM version
         env:
           VERSION: ${{ inputs.tag }}
+          ECHO_LIBRARIES_ACCESS_KEY: ${{ secrets.ECHO_LIBRARIES_ACCESS_KEY }}
         run: mvn -B org.eclipse.tycho:tycho-versions-plugin:set-version -DnewVersion="${VERSION}" --file pom.xml
 
       - name: Create release
+        env:
+          ECHO_LIBRARIES_ACCESS_KEY: ${{ secrets.ECHO_LIBRARIES_ACCESS_KEY }}
         run: mvn -B clean install --file pom.xml  -DskipTests -pl "!checkmarx-ast-eclipse-plugin-tests"
 
       - name: Extract CLI version
@@ -241,4 +254,3 @@ jobs:
   #     release_url: https://github.com/Checkmarx/ast-eclipse-plugin/releases/tag/${{ needs.release.outputs.TAG_NAME }}
   #     jira_product_name: ECLIPSE
   #   secrets: inherit
-

.mvn/maven.config

@@ -0,0 +1 @@
+--global-settings=.mvn/settings.xml

.mvn/settings.xml

@@ -0,0 +1,37 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+	Project-level Maven settings, loaded as global settings via .mvn/maven.config.
+	User settings (~/.m2/settings.xml) are still applied on top of this file.
+
+	All Maven Central traffic is routed through the Echo HQ repository, which serves
+	CVE-patched builds of open-source libraries. Authentication requires the
+	ECHO_LIBRARIES_ACCESS_KEY environment variable (set from a secret in CI).
+	Never hardcode the key in this file.
+-->
+<settings xmlns="http://maven.apache.org/SETTINGS/1.2.0"
+	xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+	xsi:schemaLocation="http://maven.apache.org/SETTINGS/1.2.0 https://maven.apache.org/xsd/settings-1.2.0.xsd">
+	<servers>
+		<!-- Echo rejects basic auth unless the username is empty, which Maven does not send,
+			so the access key is passed as a Bearer token instead. -->
+		<server>
+			<id>echo</id>
+			<configuration>
+				<httpHeaders>
+					<property>
+						<name>Authorization</name>
+						<value>Bearer ${env.ECHO_LIBRARIES_ACCESS_KEY}</value>
+					</property>
+				</httpHeaders>
+			</configuration>
+		</server>
+	</servers>
+	<mirrors>
+		<mirror>
+			<id>echo</id>
+			<mirrorOf>central</mirrorOf>
+			<name>Echo HQ Maven Repository</name>
+			<url>https://maven.echohq.com</url>
+		</mirror>
+	</mirrors>
+</settings>

checkmarx-ast-eclipse-plugin-tests/src/test/java/checkmarx/ast/eclipse/plugin/tests/unit/enums/SeverityExtendedTest.java

@@ -79,7 +79,7 @@ void testEnumOrdinal_correctSequence() {
 	@Test
 	void testValues_returnsAllConstants() {
 		Severity[] values = Severity.values();
-		assertEquals(8, values.length);
+		assertEquals(6, values.length);
 	}
 
 	@Test
@@ -88,7 +88,6 @@ void testValues_containsAllExpected() {
 		boolean hasCritical = false;
 		boolean hasHigh = false;
 		boolean hasLow = false;
-		boolean hasGroupBy = false;
 
 		for (Severity s : values) {
 			if (s == Severity.CRITICAL) hasCritical = true;
@@ -99,7 +98,6 @@ void testValues_containsAllExpected() {
 		assertTrue(hasCritical);
 		assertTrue(hasHigh);
 		assertTrue(hasLow);
-		assertTrue(hasGroupBy);
 	}
 
 	@Test

checkmarx-ast-eclipse-plugin-tests/src/test/java/checkmarx/ast/eclipse/plugin/tests/unit/enums/SeverityTest.java

@@ -47,6 +47,6 @@ void testGetSeverity_roundTrip_allValues() {
 
     @Test
     void testEnumValues_count() {
-        assertEquals(8, Severity.values().length);
+        assertEquals(6, Severity.values().length);
     }
 }

checkmarx-ast-eclipse-plugin-tests/src/test/java/checkmarx/ast/eclipse/plugin/tests/unit/properties/PreferencesTest.java

@@ -5,45 +5,40 @@
 
 import org.eclipse.core.runtime.Platform;
 import org.eclipse.core.runtime.preferences.IPreferencesService;
-import org.eclipse.jface.preference.IPreferenceStore;
 import org.junit.jupiter.api.AfterEach;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
 import org.mockito.Mock;
 import org.mockito.MockedStatic;
 import org.mockito.MockitoAnnotations;
 
-import com.checkmarx.eclipse.Activator;
 import com.checkmarx.eclipse.common.preferences.Preferences;
 
 class PreferencesTest {
 
-	@Mock
-	private IPreferencesService mockPreferencesService;
-
-	@Mock
-	private IPreferenceStore mockPreferenceStore;
+	private static final String[] STORED_TEST_KEYS = { "testKey", "key1", "key2" };
 
 	@Mock
-	private Activator mockActivator;
+	private IPreferencesService mockPreferencesService;
 
 	private MockedStatic<Platform> platformMock;
-	private MockedStatic<Activator> activatorMock;
+	private IPreferencesService realPreferencesService;
 
 	@BeforeEach
 	void setUp() {
 		MockitoAnnotations.openMocks(this);
+		// Captured before Platform is mocked: reading values back through Preferences.STORE needs the real service
+		realPreferencesService = Platform.getPreferencesService();
 		platformMock = mockStatic(Platform.class);
-		activatorMock = mockStatic(Activator.class);
 	}
 
 	@AfterEach
 	void tearDown() {
 		if (platformMock != null) {
 			platformMock.close();
 		}
-		if (activatorMock != null) {
-			activatorMock.close();
+		for (String key : STORED_TEST_KEYS) {
+			Preferences.STORE.setToDefault(key);
 		}
 	}
 
@@ -118,33 +113,19 @@ void testGetAdditionalOptions_returnNull_whenNotSet() {
 
 	@Test
 	void testStore_setsValueInPreferenceStore() {
-		activatorMock.when(Activator::getDefault).thenReturn(mockActivator);
-		when(mockActivator.getPreferenceStore()).thenReturn(mockPreferenceStore);
-
+		useRealPreferencesService();
 		Preferences.store("testKey", "testValue");
 
-		verify(mockActivator).getPreferenceStore();
-		verify(mockPreferenceStore).setValue("testKey", "testValue");
+		assertEquals("testValue", Preferences.STORE.getString("testKey"));
 	}
 
 	@Test
 	void testStore_withEmptyValue() {
-		activatorMock.when(Activator::getDefault).thenReturn(mockActivator);
-		when(mockActivator.getPreferenceStore()).thenReturn(mockPreferenceStore);
-
+		useRealPreferencesService();
+		Preferences.store("testKey", "value");
 		Preferences.store("testKey", "");
 
-		verify(mockPreferenceStore).setValue("testKey", "");
-	}
-
-	@Test
-	void testStore_withNullValue() {
-		activatorMock.when(Activator::getDefault).thenReturn(mockActivator);
-		when(mockActivator.getPreferenceStore()).thenReturn(mockPreferenceStore);
-
-		Preferences.store("testKey", null);
-
-		verify(mockPreferenceStore).setValue("testKey", null);
+		assertEquals("", Preferences.STORE.getString("testKey"));
 	}
 
 	@Test
@@ -179,13 +160,15 @@ void testGetPref_multipleCallsWithDifferentKeys() {
 
 	@Test
 	void testStore_multipleValuesSequentially() {
-		activatorMock.when(Activator::getDefault).thenReturn(mockActivator);
-		when(mockActivator.getPreferenceStore()).thenReturn(mockPreferenceStore);
-
+		useRealPreferencesService();
 		Preferences.store("key1", "value1");
 		Preferences.store("key2", "value2");
 
-		verify(mockPreferenceStore).setValue("key1", "value1");
-		verify(mockPreferenceStore).setValue("key2", "value2");
+		assertEquals("value1", Preferences.STORE.getString("key1"));
+		assertEquals("value2", Preferences.STORE.getString("key2"));
+	}
+
+	private void useRealPreferencesService() {
+		platformMock.when(Platform::getPreferencesService).thenReturn(realPreferencesService);
 	}
 }

checkmarx-ast-eclipse-plugin-tests/src/test/java/checkmarx/ast/eclipse/plugin/tests/unit/views/DataProviderTest.java

@@ -43,6 +43,12 @@ void setUp() {
         FilterState.resetFilters();
     }
 
+    /** These tests call the real CLI, so they can only run when CX_APIKEY is provided (e.g. not on fork PRs). */
+    private static void assumeCredentialsConfigured() {
+        Assumptions.assumeTrue(Environment.API_KEY != null && !Environment.API_KEY.isBlank(),
+                "CX_APIKEY is not set; skipping test that needs a live Checkmarx server");
+    }
+
     @Test
     void testSingletonInstance() {
         DataProvider instance1 = DataProvider.getInstance();
@@ -66,12 +72,14 @@ void testSetAndGetCurrentResults() {
 
     @Test
     void testGetProjectsReturnsList() throws Exception {
+        assumeCredentialsConfigured();
         List<Project> projects = dataProvider.getProjects();
         assertNotNull(projects);
     }
 
     @Test
     void testGetProjectsByNameReturnsList() throws Exception {
+        assumeCredentialsConfigured();
         List<Project> projects = dataProvider.getProjects(TEST_PROJECT);
         assertNotNull(projects);
     }

checkmarx-ast-eclipse-plugin-tests/src/test/java/checkmarx/ast/eclipse/plugin/tests/unit/views/actions/ToolBarActionsTest.java

@@ -23,7 +23,9 @@
 import org.mockito.Mockito;
 
 import com.checkmarx.eclipse.enums.ActionName;
+import com.checkmarx.eclipse.enums.GroupingMode;
 import com.checkmarx.eclipse.views.DataProvider;
+import com.checkmarx.eclipse.views.GlobalSettings;
 
 import com.checkmarx.eclipse.enums.PluginListenerType;
 import com.checkmarx.eclipse.common.enums.Severity;
@@ -137,6 +139,9 @@ void testRefreshToolbarRecreatesActions() {
     void testGroupBySeverityAction() {
         // createGroupByActions() runs inside a background Job so we test the toggle directly.
         FilterState.groupBySeverity = false;
+        try (MockedStatic<GlobalSettings> gs = Mockito.mockStatic(GlobalSettings.class)) {
+            FilterState.setGroupingMode(GroupingMode.SEVERITY);
+        }
         assertTrue(FilterState.groupBySeverity);
     }
 

checkmarx-ast-eclipse-plugin-tests/src/test/java/checkmarx/ast/eclipse/plugin/tests/unit/views/filters/FilterStateExtendedTest.java

@@ -9,6 +9,7 @@
 import org.mockito.MockitoAnnotations;
 
 import com.checkmarx.eclipse.common.enums.Severity;
+import com.checkmarx.eclipse.enums.GroupingMode;
 import com.checkmarx.eclipse.enums.State;
 import com.checkmarx.eclipse.views.GlobalSettings;
 import com.checkmarx.eclipse.views.filters.FilterState;
@@ -87,6 +88,7 @@ void testSetState_groupBySeverityToggle() {
 		boolean beforeState = FilterState.groupBySeverity;
 
 		try (MockedStatic<GlobalSettings> mockSettings = mockStatic(GlobalSettings.class)) {
+			FilterState.setGroupingMode(GroupingMode.SEVERITY);
 			assertNotEquals(beforeState, FilterState.groupBySeverity);
 		}
 	}

checkmarx-ast-eclipse-plugin-tests/src/test/java/checkmarx/ast/eclipse/plugin/tests/unit/views/filters/FilterStateTest.java

@@ -13,6 +13,7 @@
 import org.mockito.Mockito;
 
 import com.checkmarx.eclipse.common.enums.Severity;
+import com.checkmarx.eclipse.enums.GroupingMode;
 import com.checkmarx.eclipse.enums.State;
 import com.checkmarx.eclipse.views.GlobalSettings;
 import com.checkmarx.eclipse.views.filters.FilterState;
@@ -136,6 +137,7 @@ void testSetState_info_togglesFromFalse() {
     void testSetState_groupBySeverity_toggles() {
         FilterState.groupBySeverity = true;
         try (MockedStatic<GlobalSettings> gs = Mockito.mockStatic(GlobalSettings.class)) {
+            FilterState.setGroupingMode(GroupingMode.SEVERITY);
         }
         assertFalse(FilterState.groupBySeverity);
     }
@@ -144,6 +146,7 @@ void testSetState_groupBySeverity_toggles() {
     void testSetState_groupByQueryName_toggles() {
         FilterState.groupByQueryName = false;
         try (MockedStatic<GlobalSettings> gs = Mockito.mockStatic(GlobalSettings.class)) {
+            FilterState.setGroupingMode(GroupingMode.QUERY_NAME);
         }
         assertTrue(FilterState.groupByQueryName);
     }
@@ -152,6 +155,7 @@ void testSetState_groupByQueryName_toggles() {
     void testSetState_groupByStateName_toggles() {
         FilterState.groupByStateName = false;
         try (MockedStatic<GlobalSettings> gs = Mockito.mockStatic(GlobalSettings.class)) {
+            FilterState.setGroupingMode(GroupingMode.STATE_NAME);
         }
         assertTrue(FilterState.groupByStateName);
     }

checkmarx-ast-eclipse-plugin/.classpath

@@ -15,8 +15,8 @@
 	</classpathentry>
 	<classpathentry exported="true" kind="lib" path="../common-lib/lib/ast-cli-java-wrapper-2.4.31.jar"/>
 	<classpathentry kind="lib" path="../common-lib/lib/commons-lang3-3.18.0.jar"/>
-	<classpathentry kind="lib" path="../common-lib/lib/jackson-core-2.21.4.jar"/>
-	<classpathentry kind="lib" path="../common-lib/lib/jackson-databind-2.21.5.jar"/>
+	<classpathentry kind="lib" path="../common-lib/lib/jackson-core-2.22.3.jar"/>
+	<classpathentry kind="lib" path="../common-lib/lib/jackson-databind-2.22.3.jar"/>
 	<classpathentry kind="lib" path="../common-lib/lib/jackson-annotations-2.21.jar"/>
 	<classpathentry kind="lib" path="../common-lib/lib/slf4j-api-2.0.17.jar"/>
 	<classpathentry kind="lib" path="../common-lib/lib/slf4j-simple-2.0.17.jar"/>