Sonarqube正在着手进行核心漏洞发现怎么解决

问题描述

Sonarqube正在引发人们对核心漏洞的了解。解决方法。

   "textRange": {
      "startLine": 1,"endLine": 1,"startOffset": 0,"endOffset": 38
    },"flows": [],"status": "OPEN","message": "Filename: test-0.0.1-SNAPSHOT.jar: undertow-core-2.0.29.Final.jar 
| Reference: CVE-2020-1745 | CVSS score: 9.8 | Category: CWE-200 | A file inclusion 
vulnerability was found 
in the AJP connector enabled with a default AJP configuration port of 8009 in 
Undertow version 2.0.29.Final and before and was fixed in 2.0.30.Final. A remote,unauthenticated attacker Could exploit this vulnerability to read web application files 
from a vulnerable server. In instances where the vulnerable server allows file uploads,an attacker Could upload malicIoUs JavaServer Pages (JSP) code within a variety of file 
types and trigger this vulnerability to gain remote code execution.",

Undertow在pom上不可用，因为它是另一个依赖项的子项（spring-boot-starter-undertow，已更新为最新版本2.3.3 RELEASE）。有什么方法可以使spring-boot-starter具有特定版本的undertow？



[INFO] +- org.springframework.boot:spring-boot-starter-undertow:jar:2.3.3.RELEASE:compile
[INFO] |  +- io.undertow:undertow-core:jar:2.0.29.Final:compile
[INFO] |  |  +- org.jboss.xnio:xnio-api:jar:3.3.8.Final:compile
[INFO] |  |  \- org.jboss.xnio:xnio-nio:jar:3.3.8.Final:runtime

[INFO] |  +- io.undertow:undertow-servlet:jar:2.0.29.Final:compile
[INFO] |  +- io.undertow:undertow-websockets-jsr:jar:2.0.29.Final:compile
[INFO] |  |  \- org.jboss.spec.javax.websocket:jboss-websocket-api_1.1_spec:jar:1.1.4.Final:compile
[INFO] |  +- jakarta.servlet:jakarta.servlet-api:jar:4.0.3:compile
[INFO] |  \- org.glassfish:jakarta.el:jar:3.0.3:compile

解决方法

如果需要特定版本的Undertow，只需将其包含在pom.xml中即可。

<dependency>
  <groupId>io.undertow</groupId>
  <artifactId>undertow-core</artifactId>
  <version>2.0.30.Final</version>
</dependency>

这样做，您将覆盖通过其他依赖项（包括Spring依赖项）可能获得的任何其他版本。

如果其他软件包的依赖项中已经包含了您需要的版本，并且您希望Spring使用该版本（而不是手动覆盖pom中的每个Undertow依赖项），则可以尝试exclude入门者提供的一个：

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-actuator</artifactId>
    <version>2.3.3.RELEASE</version> <!-- already includes undertow 2.0.30 -->
</dependency>
<dependency>
  <groupId>org.springframework.boot</groupId>
  <artifactId>spring-boot-starter-undertow</artifactId>
  <version>2.3.3.RELEASE</version>
  <exclusions>
    <exclusion>
      <groupId>io.undertow</groupId>
      <artifactId>undertow-core</artifactId>
    </exclusion>
  </exclusions>
</dependency>

如果执行上述操作，Spring将选择spring-boot-actuator提供的undertow-core版本，而不是spring-boot-starter-undertow提供的版本。

java java security security sonarqube spring spring