ibm / cics-bundle-common Goto Github PK

The program can potentially fail to release a system resource.

A lot of consumers are likely to have self-signed certificates. Support some kind of --insecure option in the end tooling.

This option will allow certificates regardless of provenance or trust, and will not verify that the hostname matches the certificate name.

CodeQL analysis is failing. Snippet from the exception:

Caused by: java.lang.ClassNotFoundException: com.sun.tools.javac.code.TypeTags
  [2021-03-28 18:58:03] [autobuild]     at java.lang.ClassLoader.findClass (ClassLoader.java:719)
  [2021-03-28 18:58:03] [autobuild]     at java.lang.ClassLoader.loadClass (ClassLoader.java:589)
  [2021-03-28 18:58:03] [autobuild]     at lombok.launch.ShadowClassLoader.loadClass (ShadowClassLoader.java:422)

The CodeQL build has started using Java 11 (up from 8) which is incompatible with the version of Lombok we currently use.

@davenice commented on Thu Jun 27 2019

Validate during build to match existing validation in CICS Explorer where possible.

• name of generated bundle part (valid characters, no spaces)
• jvmserver name validity ... probably don't want to mandate because of option to allow default JVM server for the region
• verify behaviour if dependent Java project doesn't build cleanly
• ...?

The cics-bundle-common library pulls in javax.ws.rs. I noticed this when working on the Gradle plugin, as the repositories you select plugins from can be very specific.

It's only used for the AUTHORIZATION header constant. I'm sure we can spell that ourselves. 😉

In order to use appscan to penetration test the endpoint I need to record the interactions between the maven plugin and CICS. To achieve this I need a version of the tool that can support proxied requests

There's a newer version of httpmime available, however it is now provided in httpclient5 (rather than as a separate dependency).

They are not quite API compatible so a bit of rework will be needed within the BundleDeployHelper.

A vulnerability means that jackson-databind needs to be at version 2.9.10 or higher