Repository: provectus/kafka-ui
Issue: A number of CVEs is present
Labels: scope/backend
type/security
status/accepted

it seems like the latest release 0.3.3 is very vulnerable 
https://artifacthub.io/packages/helm/kafka-ui/kafka-ui?modal=security-report
when can we get a version with those issues fixed? 


Issue comments:
Hello there David-hod! 👋

Thank you and congratulations 🎉 for opening your very first issue in this project! 💖

In case you want to claim this issue, please comment down below! We will try to get back to you as soon as we can. 👀
Hi, thanks for reaching out.

Will take a look.
Still have to get rid of ZK to get a clean scan #1663

Pull request review comments:

Patch that resolved the issue:
diff --git a/kafka-ui-api/src/main/java/com/provectus/kafka/ui/exception/GlobalErrorWebExceptionHandler.java b/kafka-ui-api/src/main/java/com/provectus/kafka/ui/exception/GlobalErrorWebExceptionHandler.java
index d96432ffdce..394e2aa730b 100644
--- a/kafka-ui-api/src/main/java/com/provectus/kafka/ui/exception/GlobalErrorWebExceptionHandler.java
+++ b/kafka-ui-api/src/main/java/com/provectus/kafka/ui/exception/GlobalErrorWebExceptionHandler.java
@@ -10,7 +10,7 @@
 import java.util.Set;
 import java.util.stream.Collectors;
 import java.util.stream.Stream;
-import org.springframework.boot.autoconfigure.web.ResourceProperties;
+import org.springframework.boot.autoconfigure.web.WebProperties;
 import org.springframework.boot.autoconfigure.web.reactive.error.AbstractErrorWebExceptionHandler;
 import org.springframework.boot.web.reactive.error.ErrorAttributes;
 import org.springframework.context.ApplicationContext;
@@ -36,10 +36,9 @@
 public class GlobalErrorWebExceptionHandler extends AbstractErrorWebExceptionHandler {
 
   public GlobalErrorWebExceptionHandler(ErrorAttributes errorAttributes,
-                                        ResourceProperties resourceProperties,
                                         ApplicationContext applicationContext,
                                         ServerCodecConfigurer codecConfigurer) {
-    super(errorAttributes, resourceProperties, applicationContext);
+    super(errorAttributes, new WebProperties.Resources(), applicationContext);
     this.setMessageWriters(codecConfigurer.getWriters());
   }
 
diff --git a/pom.xml b/pom.xml
index b08a67743a4..2a599a5ad24 100644
--- a/pom.xml
+++ b/pom.xml
@@ -14,7 +14,7 @@
         <maven.compiler.target>13</maven.compiler.target>
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
 
-        <spring-boot.version>2.5.6</spring-boot.version>
+        <spring-boot.version>2.6.3</spring-boot.version>
         <jackson-databind-nullable.version>0.2.2</jackson-databind-nullable.version>
         <org.mapstruct.version>1.4.2.Final</org.mapstruct.version>
         <org.projectlombok.version>1.18.20</org.projectlombok.version>
@@ -33,7 +33,7 @@
         <swagger-annotations.version>1.6.0</swagger-annotations.version>
         <springdoc-openapi-webflux-ui.version>1.2.32</springdoc-openapi-webflux-ui.version>
         <avro.version>1.11.0</avro.version>
-        <confluent.version>5.5.1</confluent.version>
+        <confluent.version>7.0.1</confluent.version>
         <apache.commons.version>2.2</apache.commons.version>
         <test.containers.version>1.16.2</test.containers.version>
         <junit-jupiter-engine.version>5.7.2</junit-jupiter-engine.version>


Test patch:
diff --git a/kafka-ui-api/src/test/java/com/provectus/kafka/ui/serde/schemaregistry/SchemaRegistryAwareRecordSerDeTest.java b/kafka-ui-api/src/test/java/com/provectus/kafka/ui/serde/schemaregistry/SchemaRegistryAwareRecordSerDeTest.java
index af4b8351d73..65929e6be2b 100644
--- a/kafka-ui-api/src/test/java/com/provectus/kafka/ui/serde/schemaregistry/SchemaRegistryAwareRecordSerDeTest.java
+++ b/kafka-ui-api/src/test/java/com/provectus/kafka/ui/serde/schemaregistry/SchemaRegistryAwareRecordSerDeTest.java
@@ -60,6 +60,7 @@ void callsSchemaFormatterWhenValueHasMagicByteAndValidSchemaId() throws Exceptio
 
       int schemaId = 1234;
       when(registryClient.getSchemaById(schemaId)).thenReturn(schema);
+      when(registryClient.getSchemaBySubjectAndId(null, schemaId)).thenReturn(schema);
 
       var result = serde.deserialize(
           new ConsumerRecord<>(
@@ -71,8 +72,10 @@ void callsSchemaFormatterWhenValueHasMagicByteAndValidSchemaId() throws Exceptio
           )
       );
 
-      // called twice: once by serde code, once by formatter (will be cached)
-      verify(registryClient, times(2)).getSchemaById(schemaId);
+      // called once by serde code
+      verify(registryClient, times(1)).getSchemaById(schemaId);
+      //called once by formatter (will be cached)
+      verify(registryClient, times(1)).getSchemaBySubjectAndId(null, schemaId);
 
       assertThat(result.getKeySchemaId()).isNull();
       assertThat(result.getKeyFormat()).isEqualTo(MessageFormat.UNKNOWN);
@@ -115,23 +118,29 @@ void fallsBackToStringFormatterIfValueContainsMagicByteButSchemaNotFound() throw
     @Test
     void fallsBackToStringFormatterIfMagicByteAndSchemaIdFoundButFormatterFailed() throws Exception {
       int schemaId = 1234;
+
+      final var schema = new AvroSchema("{ \"type\": \"string\" }");
+
       when(registryClient.getSchemaById(schemaId))
-          .thenReturn(new AvroSchema("{ \"type\": \"string\" }"));
+          .thenReturn(schema);
+      when(registryClient.getSchemaBySubjectAndId(null, schemaId)).thenReturn(schema);
 
       // will cause exception in avro deserializer
-      Bytes nonAvroValue =  bytesWithMagicByteAndSchemaId(schemaId, "123".getBytes());
+      Bytes nonAvroValue = bytesWithMagicByteAndSchemaId(schemaId, "123".getBytes());
       var result = serde.deserialize(
           new ConsumerRecord<>(
               "test-topic",
               1,
               100,
               Bytes.wrap("key".getBytes()),
-             nonAvroValue
+              nonAvroValue
           )
       );
 
-      // called twice: once by serde code, once by formatter (will be cached)
-      verify(registryClient, times(2)).getSchemaById(schemaId);
+      // called once by serde code
+      verify(registryClient, times(1)).getSchemaById(schemaId);
+      //called once by formatter (will be cached)
+      verify(registryClient, times(1)).getSchemaBySubjectAndId(null, schemaId);
 
       assertThat(result.getKeySchemaId()).isNull();
       assertThat(result.getKeyFormat()).isEqualTo(MessageFormat.UNKNOWN);