diff --git a/.github/workflows/ci-cd.yml b/.github/workflows/ci-cd.yml new file mode 100644 index 0000000..22da6be --- /dev/null +++ b/.github/workflows/ci-cd.yml @@ -0,0 +1,119 @@ +name: CI/CD Pipeline + +on: + push: + branches: + - main + pull_request: + branches: + - main + +jobs: + sonarqube: + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@v3 + - name: Set up JDK 21 + uses: actions/setup-java@v3 + with: + java-version: "21" + distribution: "temurin" + - name: Compile the project + run: | + chmod +x ./mvnw + ./mvnw clean compile + - name: Run SonarQube analysis + run: | + ./mvnw sonar:sonar \ + -Dsonar.projectKey=MSPRProject_Api \ + -Dsonar.host.url=${{ secrets.SONAR_HOST_URL }} \ + -Dsonar.login=${{ secrets.SONAR_TOKEN }} \ + -Dsonar.organization=msprproject + + test: + runs-on: ubuntu-latest + services: + postgres: + image: postgres:latest + env: + POSTGRES_USER: sanalyz + POSTGRES_PASSWORD: sanalyz + POSTGRES_DB: sanalyz + ports: + - 5432:5432 + options: --health-cmd pg_isready --health-interval 10s + steps: + - uses: actions/checkout@v3 + - name: Set up JDK 21 + uses: actions/setup-java@v3 + with: + java-version: "21" + distribution: "temurin" + - name: Run tests + run: | + chmod +x ./mvnw + ./mvnw test + + owasp-zap: + permissions: write-all + runs-on: ubuntu-latest + services: + postgres: + image: postgres:latest + env: + POSTGRES_USER: sanalyz + POSTGRES_PASSWORD: sanalyz + POSTGRES_DB: sanalyz + ports: + - 5432:5432 + options: --health-cmd pg_isready --health-interval 10s + + steps: + - uses: actions/checkout@v3 + - name: Set up JDK 21 + uses: actions/setup-java@v3 + with: + java-version: "21" + distribution: "temurin" + - name: Start the application + run: | + chmod +x ./mvnw + nohup ./mvnw spring-boot:run & + echo "Waiting for the application to start..." + sleep 30 + - name: Run OWASP ZAP + uses: zaproxy/action-full-scan@v0.12.0 + with: + target: "http://localhost:8080" + rules_file_name: ".zap/rules.tsv" + docker_name: zaproxy/zap-stable + fail_action: true + - name: Stop the application + run: | + echo "Stopping the application..." + pkill -f 'spring-boot:run' + + # e2e-tests: + # runs-on: ubuntu-latest + # steps: + # - uses: actions/checkout@v3 + # - name: Clone E2E Scripting Repo + # run: git clone https://github.com/your-org/e2e-scripting-repo.git + # - name: Run E2E Tests + # run: | + # echo "Running E2E tests..." + + deploy: + runs-on: ubuntu-latest + # needs: [sonarqube, test, owasp-zap, e2e-tests] + needs: [sonarqube, test, owasp-zap] + steps: + - uses: actions/checkout@v3 + - name: Set up JDK 21 + uses: actions/setup-java@v3 + with: + java-version: "21" + distribution: "temurin" + - name: Deploy + run: | + echo "Deploying application..." diff --git a/.gitignore b/.gitignore index 798a56c..0142ae7 100644 --- a/.gitignore +++ b/.gitignore @@ -1,10 +1,10 @@ HELP.md target/ +.mvn/ !.mvn/wrapper/maven-wrapper.jar !**/src/main/**/target/ !**/src/test/**/target/ !**/src/main/resources/ -.mvn/ ### STS ### .apt_generated diff --git a/.mvn/wrapper/maven-wrapper.properties b/.mvn/wrapper/maven-wrapper.properties new file mode 100644 index 0000000..d58dfb7 --- /dev/null +++ b/.mvn/wrapper/maven-wrapper.properties @@ -0,0 +1,19 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. +wrapperVersion=3.3.2 +distributionType=only-script +distributionUrl=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.9.9/apache-maven-3.9.9-bin.zip diff --git a/.zap/rules.tsv b/.zap/rules.tsv new file mode 100644 index 0000000..e3fa6db --- /dev/null +++ b/.zap/rules.tsv @@ -0,0 +1,2 @@ +10105 IGNORE (Weak Authentication Method) +90004 IGNORE (Insufficient Site Isolation Against Spectre Vulnerability) diff --git a/mvnw b/mvnw old mode 100644 new mode 100755 diff --git a/pom.xml b/pom.xml index 98370b2..a3e9358 100644 --- a/pom.xml +++ b/pom.xml @@ -1,30 +1,33 @@ - - + + 4.0.0 org.springframework.boot spring-boot-starter-parent 3.1.3 - + fr mspr_api 0.0.1-SNAPSHOT mspr_api Demo project for Spring Boot - + - + - + - - - - + + + + 21 @@ -52,6 +55,11 @@ spring-boot-starter-validation + + org.springframework.boot + spring-boot-starter-security + + org.postgresql postgresql diff --git a/src/main/java/fr/mspr_api/config/SecurityConfig.java b/src/main/java/fr/mspr_api/config/SecurityConfig.java new file mode 100644 index 0000000..acb721b --- /dev/null +++ b/src/main/java/fr/mspr_api/config/SecurityConfig.java @@ -0,0 +1,37 @@ +package fr.mspr_api.config; + +import org.springframework.context.annotation.Bean; +import org.springframework.context.annotation.Configuration; +import org.springframework.security.config.annotation.web.builders.HttpSecurity; +import org.springframework.security.web.SecurityFilterChain; +import org.springframework.security.web.header.writers.StaticHeadersWriter; + +@Configuration +public class SecurityConfig { + + @Bean + public SecurityFilterChain filterChain(HttpSecurity http) throws Exception { + http + .authorizeHttpRequests( + authorize -> authorize.anyRequest().permitAll() // Allow all requests without authentication + ) + .headers(headers -> + headers + .contentTypeOptions(contentTypeOptions -> {}) + .addHeaderWriter( + new StaticHeadersWriter( + "Cross-Origin-Opener-Policy", + "same-origin" + ) + ) + .addHeaderWriter( + new StaticHeadersWriter( + "Cross-Origin-Embedder-Policy", + "require-corp" + ) + ) + ); + + return http.build(); + } +} diff --git a/src/main/resources/application.properties b/src/main/resources/application.properties index 5e7597d..73317f0 100644 --- a/src/main/resources/application.properties +++ b/src/main/resources/application.properties @@ -4,6 +4,13 @@ spring.datasource.username=sanalyz spring.datasource.password=sanalyz spring.datasource.driver-class-name=org.postgresql.Driver +server.port=8080 +server.servlet.session.cookie.same-site=strict +server.servlet.session.cookie.secure=true +server.servlet.session.cookie.http-only=true + +security.ignored=/** + # Hibernate & JPA settings spring.jpa.hibernate.ddl-auto=update spring.jpa.show-sql=true