CVE-2020-26230 (Java, published 2020-11-13T19:15Z)
Description: value: Radar COVID is the official COVID-19 exposure notification app for Spain. In affected versions of Radar COVID, identification and de-anonymization of COVID-19 positive users that upload Radar COVID TEKs to the Radar COVID server is possible. This vulnerability enables the identification and de-anonymization of COVID-19 positive users when using Radar COVID. The vulnerability is caused by the fact that Radar COVID connections to the server (uploading of TEKs to the backend) are only made by COVID-19 positives. Therefore, any on-path observer with the ability to monitor traffic between the app and the server can identify which users had a positive test. Such an adversary can be the mobile network operator (MNO) if the connection is done through a mobile network, the Internet Service Provider (ISP) if the connection is done through the Internet (e.g., a home network), a VPN provider used by the user, the local network operator in the case of enterprise networks, or any eavesdropper with access to the same network (WiFi or Ethernet) as the user as could be the case of public WiFi hotspots deployed at shopping centers, airports, hotels, and coffee shops. The attacker may also de-anonymize the user. For this additional stage to succeed, the adversary needs to correlate Radar COVID traffic to other identifiable information from the victim. This could be achieved by associating the connection to a contract with the name of the victim or by associating Radar COVID traffic to other user-generated flows containing identifiers in the clear (e.g., HTTP cookies or other mobile flows sending unique identifiers like the IMEI or the AAID without encryption). The former can be executed, for instance, by the Internet Service Provider or the MNO. The latter can be executed by any on-path adversary, such as the network provider or even the cloud provider that hosts more than one service accessed by the victim. The farther the adversary is either from the victim (the client) or the end-point (the server), the less likely it may be that the adversary has access to re-identification information. The vulnerability has been mitigated with the injection of dummy traffic from the application to the backend. Dummy traffic is generated by all users independently of whether they are COVID-19 positive or not. The issue was fixed in iOS in version 1.0.8 (uniform distribution), 1.1.0 (exponential distribution), Android in version 1.0.7 (uniform distribution), 1.1.0 (exponential distribution), Backend in version 1.1.2-RELEASE. For more information see the referenced GitHub Security Advisory.
Severity: LOW (CVSS v3 base score: 5.3)
Weakness: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
Repository: https://github.com/RadarCOVID/radar-covid-backend-dp3t-server
Files changed:
CHANGELOG.md
dpppt-backend-sdk/dpppt-backend-sdk-ws/pom.xml
dpppt-backend-sdk/dpppt-backend-sdk-ws/src/main/docker/application.yml
dpppt-backend-sdk/dpppt-backend-sdk-ws/src/main/java/org/dpppt/backend/sdk/ws/controller/GaenController.java
dpppt-backend-sdk/dpppt-backend-sdk-ws/src/main/java/org/dpppt/backend/sdk/ws/radarcovid/config/ControllerLoggerAspectConfiguration.java
dpppt-backend-sdk/dpppt-backend-sdk-ws/src/main/java/org/dpppt/backend/sdk/ws/radarcovid/config/MethodLoggerAspectConfiguration.java
dpppt-backend-sdk/dpppt-backend-sdk-ws/src/main/java/org/dpppt/backend/sdk/ws/radarcovid/config/ResponseRetentionAspectConfiguration.java
dpppt-backend-sdk/dpppt-backend-sdk-ws/src/main/resources/application.yaml
dpppt-backend-sdk/pom.xml
Commit message: [MAPR] AOP aspects ordering


Vulnerable code:
- Setted responses retention time on fake requests
- Added aspect configuration
- Added license
- Updated TestContainers version
		<dependency>
			<groupId>org.springframework.cloud</groupId>
			<artifactId>spring-cloud-starter-aws-parameter-store-config</artifactId>
		</dependency>
management.endpoints.enabled-by-default: false
    <modelVersion>4.0.0</modelVersion>
    <groupId>org.dpppt</groupId>
    <artifactId>dpppt-backend-sdk</artifactId>
    <packaging>pom</packaging>
    <version>1.0.0-SNAPSHOT</version>
    <name>DP3T Backend SDK</name>
    <properties>
        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
        <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
        <java-version>11</java-version>
        <maven.compiler.source>${java-version}</maven.compiler.source>
        <maven.compiler.target>${java-version}</maven.compiler.target>
        <spring-boot-version>2.2.9.RELEASE</spring-boot-version>
        <spring-cloud-version>Hoxton.SR8</spring-cloud-version>
        <spring-cloud-starter-aws.version>2.2.4.RELEASE</spring-cloud-starter-aws.version>
        <spring-framework-version>5.2.8.RELEASE</spring-framework-version>
        <itCoverageAgent></itCoverageAgent>
        <aspectj-version>1.9.6</aspectj-version>
        <build-helper-maven-plugin.version>1.9.1</build-helper-maven-plugin.version>
        <jackson-version>2.11.1</jackson-version>
        <jsonwebtoken-version>0.11.2</jsonwebtoken-version>
        <postgresql-version>42.2.13</postgresql-version>
        <protobuf-java-version>3.12.1</protobuf-java-version>
        <snakeyaml-version>1.26</snakeyaml-version>
        <springdoc-openapi-version>1.4.0</springdoc-openapi-version>
        <tomcat-version>9.0.36</tomcat-version>
        <sonar.host.url>https://sonarcloud.io</sonar.host.url>
        <!--suppress UnresolvedMavenProperty -->
        <sonar.organization>${env.SONAR_ORGANIZATION}</sonar.organization>
        <!--suppress UnresolvedMavenProperty -->
        <sonar.login>${env.SONAR_TOKEN}</sonar.login>
        <sonar.coverage.jacoco.xmlReportPaths>
            ${project.basedir}/../dpppt-backend-sdk-report/target/site/jacoco-aggregate/jacoco.xml
        </sonar.coverage.jacoco.xmlReportPaths>
    </properties>
    <modules>
        <module>dpppt-backend-sdk-model</module>
        <module>dpppt-backend-sdk-data</module>
        <module>dpppt-backend-sdk-ws</module>
        <module>dpppt-backend-sdk-report</module>
    </modules>
    <dependencies>
        <dependency>
            <groupId>org.springframework</groupId>
            <artifactId>spring-context</artifactId>
        </dependency>
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-test</artifactId>
            <scope>test</scope>
        </dependency>
        <!-- Apache Commons -->
        <dependency>
            <groupId>org.apache.commons</groupId>
            <artifactId>commons-lang3</artifactId>
        </dependency>
        <dependency>
            <groupId>commons-io</groupId>
            <artifactId>commons-io</artifactId>
            <version>2.7</version>
        </dependency>
        <dependency>
            <groupId>junit</groupId>
            <artifactId>junit</artifactId>
            <scope>test</scope>
        </dependency>
        <!-- Logging -->
        <dependency>
            <groupId>org.springframework.boot</groupId>
            <artifactId>spring-boot-starter-logging</artifactId>
        </dependency>
        <dependency>
            <groupId>org.slf4j</groupId>
            <artifactId>jcl-over-slf4j</artifactId>
        </dependency>
        <dependency>
            <groupId>com.google.protobuf</groupId>
            <artifactId>protobuf-java</artifactId>
            <version>${protobuf-java-version}</version>
        </dependency>
    </dependencies>
    <dependencyManagement>
        <dependencies>
            <dependency>
                <groupId>org.springframework.boot</groupId>
                <artifactId>spring-boot-dependencies</artifactId>
                <type>pom</type>
                <version>${spring-boot-version}</version>
                <scope>import</scope>
            </dependency>
            <dependency>
                <groupId>org.springframework.cloud</groupId>
                <artifactId>spring-cloud-dependencies</artifactId>
                <type>pom</type>
                <version>${spring-cloud-version}</version>
                <scope>import</scope>
            </dependency>
            <dependency>
		<groupId>org.springframework.cloud</groupId>
		<artifactId>spring-cloud-starter-aws-parameter-store-config</artifactId>
		<version>${spring-cloud-starter-aws.version}</version>
	    </dependency>   
            <dependency>
                <groupId>org.springframework</groupId>
                <artifactId>spring-core</artifactId>
                <version>${spring-framework-version}</version>
                <exclusions>
                    <exclusion>
                        <groupId>commons-logging</groupId>
                        <artifactId>commons-logging</artifactId>
                    </exclusion>
                </exclusions>
            </dependency>
            <dependency>
                <groupId>io.jsonwebtoken</groupId>
                <artifactId>jjwt-api</artifactId>
                <version>${jsonwebtoken-version}</version>
            </dependency>
            <dependency>
                <groupId>io.jsonwebtoken</groupId>
                <artifactId>jjwt-jackson</artifactId>
                <version>${jsonwebtoken-version}</version>
            </dependency>
            <dependency>
                <groupId>io.jsonwebtoken</groupId>
                <artifactId>jjwt-impl</artifactId>
                <version>${jsonwebtoken-version}</version>
            </dependency>
            <dependency>
                <groupId>org.postgresql</groupId>
                <artifactId>postgresql</artifactId>
                <version>${postgresql-version}</version>
            </dependency>
            <dependency>
                <groupId>org.springdoc</groupId>
                <artifactId>springdoc-openapi-webmvc-core</artifactId>
                <version>${springdoc-openapi-version}</version>
            </dependency>
            <dependency>
                <groupId>org.springdoc</groupId>
                <artifactId>springdoc-openapi-ui</artifactId>
                <version>${springdoc-openapi-version}</version>
            </dependency>
            <dependency>
                <groupId>org.springdoc</groupId>
                <artifactId>springdoc-openapi-security</artifactId>
                <version>${springdoc-openapi-version}</version>
            </dependency>
            <dependency>
                <groupId>org.yaml</groupId>
                <artifactId>snakeyaml</artifactId>
                <version>${snakeyaml-version}</version>
            </dependency>
            <dependency>
                <groupId>org.apache.tomcat.embed</groupId>
                <artifactId>tomcat-embed-core</artifactId>
                <version>${tomcat-version}</version>
            </dependency>
            <dependency>
                <groupId>org.apache.tomcat.embed</groupId>
                <artifactId>tomcat-embed-el</artifactId>
                <version>${tomcat-version}</version>
            </dependency>
            <dependency>
                <groupId>org.apache.tomcat.embed</groupId>
                <artifactId>tomcat-embed-websocket</artifactId>
                <version>${tomcat-version}</version>
            </dependency>
            <dependency>
                <groupId>com.fasterxml.jackson.core</groupId>
                <artifactId>jackson-annotations</artifactId>
                <version>${jackson-version}</version>
            </dependency>
            <dependency>
                <groupId>com.fasterxml.jackson.core</groupId>
                <artifactId>jackson-core</artifactId>
                <version>${jackson-version}</version>
            </dependency>
            <dependency>
                <groupId>com.fasterxml.jackson.core</groupId>
                <artifactId>jackson-databind</artifactId>
                <version>${jackson-version}</version>
            </dependency>
            <dependency>
                <groupId>org.springframework.cloud</groupId>
                <artifactId>spring-cloud-starter-circuitbreaker-spring-retry</artifactId>
                <version>1.0.3.RELEASE</version>
            </dependency>
            <dependency>
                <groupId>org.springframework.cloud</groupId>
                <artifactId>spring-cloud-starter-circuitbreaker-resilience4j</artifactId>
                <version>1.0.3.RELEASE</version>
            </dependency>
            <dependency>
                <groupId>joda-time</groupId>
                <artifactId>joda-time</artifactId>
                <version>2.10.6</version>
            </dependency>
            <dependency>
                <groupId>org.aspectj</groupId>
                <artifactId>aspectjrt</artifactId>
                <version>${aspectj-version}</version>
                <scope>compile</scope>
            </dependency>
            <dependency>
                <groupId>org.aspectj</groupId>
                <artifactId>aspectjweaver</artifactId>
                <version>${aspectj-version}</version>
                <scope>compile</scope>
            </dependency>
        </dependencies>
    </dependencyManagement>
    <!--
        <repositories>
            <repository>
                <id>spring-snapshots</id>
                <name>Spring Snapshots</name>
                <url>https://repo.spring.io/snapshot</url>
                <snapshots>
                    <enabled>true</enabled>
                </snapshots>
            </repository>
        </repositories>
    -->
    <build>
        <plugins>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-compiler-plugin</artifactId>
                <configuration>
                    <source>${java-version}</source>
                    <target>${java-version}</target>
                </configuration>
            </plugin>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-enforcer-plugin</artifactId>
                <executions>
                    <execution>
                        <id>enforce-versions</id>
                        <goals>
                            <goal>enforce</goal>
                        </goals>
                        <configuration>
                            <rules>
                                <requireJavaVersion>
                                    <version>${java-version}</version>
                                </requireJavaVersion>
                                <bannedDependencies>
                                    <excludes>
                                        <exclude>log4j:log4j</exclude>
                                        <exclude>commons-logging:commons-logging</exclude>
                                        <exclude>org.apache.logging.log4j:log4j-core</exclude>
                                    </excludes>
                                </bannedDependencies>
                            </rules>
                            <fail>true</fail>
                        </configuration>
                    </execution>
                </executions>
            </plugin>
            <plugin>
                <groupId>org.jacoco</groupId>
                <artifactId>jacoco-maven-plugin</artifactId>
                <executions>
                    <!-- set arg line property for surefire -->
                    <execution>
                        <id>prepare-agent</id>
                        <goals>
                            <goal>prepare-agent</goal>
                        </goals>
                        <configuration>
                            <propertyName>surefireArgLine</propertyName>
                        </configuration>
                    </execution>
                    <!-- set arg line property for failsafe -->
                    <execution>
                        <id>prepare-agent-integration</id>
                        <goals>
                            <goal>prepare-agent-integration</goal>
                        </goals>
                        <configuration>
                            <propertyName>failsafeArgLine</propertyName>
                        </configuration>
                    </execution>
                    <execution>
                        <id>prepare-unit-tests</id>
                        <goals>
                            <goal>prepare-agent</goal>
                        </goals>
                        <!--<configuration>-->
                        <!--<destFile>${sonar.jacoco.reportPath}</destFile>-->
                        <!--</configuration>-->
                    </execution>
                    <!-- prepare agent for measuring integration tests -->
                    <execution>
                        <id>prepare-agent-coverage</id>
                        <goals>
                            <goal>prepare-agent</goal>
                        </goals>
                        <phase>pre-integration-test</phase>
                        <configuration>
                            <!--<destFile>${sonar.jacoco.itReportPath}</destFile>-->
                            <propertyName>itCoverageAgent</propertyName>
                        </configuration>
                    </execution>
                </executions>
            </plugin>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-surefire-plugin</artifactId>
                <configuration>
                    <forkCount>1</forkCount>
                </configuration>
            </plugin>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-failsafe-plugin</artifactId>
                <executions>
                    <execution>
                        <id>integration-tests</id>
                        <goals>
                            <goal>integration-test</goal>
                            <goal>verify</goal>
                        </goals>
                        <configuration>
                            <argLine>${itCoverageAgent}</argLine>
                        </configuration>
                    </execution>
                </executions>
            </plugin>
            <plugin>
                <groupId>org.codehaus.mojo</groupId>
                <artifactId>build-helper-maven-plugin</artifactId>
                <executions>
                    <execution>
                        <id>add-classes</id>
                        <phase>generate-sources</phase>
                        <goals>
                            <goal>add-source</goal>
                        </goals>
                        <configuration>
                            <sources>
                                <source>${project.build.directory}/generated-sources</source>
                            </sources>
                        </configuration>
                    </execution>
                </executions>
            </plugin>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-help-plugin</artifactId>
                <inherited>false</inherited>
                <executions>
                    <execution>
                        <id>show-profiles</id>
                        <phase>clean</phase>
                        <goals>
                            <goal>active-profiles</goal>
                        </goals>
                    </execution>
                </executions>
            </plugin>
            
				  <execution>
					<id>retrieve-git-info</id>
					<phase>prepare-package</phase>
					<goals>
					  <goal>revision</goal>
					</goals>
				  </execution>
				  <injectAllReactorProjects>true</injectAllReactorProjects>
				  <runOnlyOnce>true</runOnlyOnce>
				  <skipPoms>false</skipPoms>
				  <dateFormat>yyyyMMddHHmmss</dateFormat>
				  <dateFormatTimeZone>UTC</dateFormatTimeZone>
				  <failOnNoGitDirectory>false</failOnNoGitDirectory>
			  </plugin>
			  <plugin>
				  <archive>
					<manifestEntries>
					  <Last-Commit-Id>${git.commit.id}</Last-Commit-Id>
					  <Last-Commit-Time>${git.commit.time}</Last-Commit-Time>
					  <Reproducible-Build>true</Reproducible-Build>
					</manifestEntries>
				  </archive>
			  </plugin>
			  <plugin>
				  <execution>
					<id>strip-jaxb</id>
					<goals>
					  <goal>strip-jaxb</goal>
					</goals>
				  </execution>
				  <execution>
					<id>strip-jar</id>
					<goals>
					  <goal>strip-jar</goal>
					</goals>
					  <zipDateTime>${git.commit.time}</zipDateTime>
					  <!-- Set custom date/time format pattern, "yyyyMMddHHmmss" by default -->
					  <!-- <zipDateTimeFormatPattern>yyyyMMddHHmmss</zipDateTimeFormatPattern> -->
				  </execution>
				</executions>
			  </plugin>
        </plugins>
        <pluginManagement>
            <plugins>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-compiler-plugin</artifactId>
                    <version>3.8.1</version>
                    <configuration>
                        <source>${java-version}</source>
                        <target>${java-version}</target>
                        <compilerArgs>
                            <arg>-parameters</arg>
                        </compilerArgs>
                    </configuration>
                </plugin>
                <plugin>
                    <groupId>org.jacoco</groupId>
                    <artifactId>jacoco-maven-plugin</artifactId>
                    <version>0.8.5</version>
                </plugin>
                <plugin>
                    <groupId>org.sonarsource.scanner.maven</groupId>
                    <artifactId>sonar-maven-plugin</artifactId>
                    <version>3.7.0.1746</version>
                </plugin>
                <plugin>
                    <groupId>com.github.os72</groupId>
                    <artifactId>protoc-jar-maven-plugin</artifactId>
                    <version>3.11.4</version>
                </plugin>
                <plugin>
                    <groupId>org.codehaus.mojo</groupId>
                    <artifactId>build-helper-maven-plugin</artifactId>
                    <version>3.2.0</version>
                </plugin>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-help-plugin</artifactId>
                    <version>3.2.0</version>
                </plugin>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-failsafe-plugin</artifactId>
                    <version>2.22.2</version>
                </plugin>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-surefire-plugin</artifactId>
                    <version>2.22.2</version>
                </plugin>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-enforcer-plugin</artifactId>
                    <version>3.0.0-M3</version>
                </plugin>
            </plugins>
        </pluginManagement>
    </build>
    <!--
        <distributionManagement>
            <repository>
                <id>github</id>
                <name>GitHub Packages</name>
                <url>https://maven.pkg.github.com/DP-3T/dp3t-sdk-backend</url>
            </repository>
        </distributionManagement>
    -->

Fixed code:
- Setted responses retention time on fake requests.
- Added aspect configuration.
- AOP aspects ordering.
- Added license.
- Updated TestContainers version.
        <profile>
            <id>aws-metrics</id>
            <dependencies>
                <dependency>
                    <groupId>org.springframework.cloud</groupId>
                    <artifactId>spring-cloud-starter-aws</artifactId>
                </dependency>
                <dependency>
                    <groupId>org.springframework.cloud</groupId>
                    <artifactId>spring-cloud-aws-actuator</artifactId>
                </dependency>
                <dependency>
                    <groupId>io.micrometer</groupId>
                    <artifactId>micrometer-registry-cloudwatch2</artifactId>
                </dependency>
            </dependencies>
        </profile>
            <dependencies>
                <dependency>
                    <groupId>org.springframework.cloud</groupId>
                    <artifactId>spring-cloud-starter-aws-parameter-store-config</artifactId>
                </dependency>
            </dependencies>
            <dependencies>
                <dependency>
                    <groupId>org.springframework.cloud</groupId>
                    <artifactId>spring-cloud-starter-aws-parameter-store-config</artifactId>
                </dependency>
            </dependencies>
management:
  endpoints.enabled-by-default: false
  metrics:
    export:
      cloudwatch:
        namespace: dpppt
        batch-size: 20
    org.dpppt.backend.sdk.ws.radarcovid.annotation: info
    org.dpppt.backend.sdk.ws.radarcovid.config: info
    com.zaxxer.hikari.pool.HikariPool: debug
    com.zaxxer.hikari.HikariConfig: debug
    com.zaxxer.hikari: debug
        exposednextday: ${RESPONSE_RETENTION_TIME_EXPOSEDNEXTDAY:1000} # milliseconds

	@ResponseRetention(time = "application.response.retention.time.exposednextday")
import org.springframework.core.annotation.Order;
    @Order(1)
import org.springframework.core.annotation.Order;
    @Order(2)
import org.springframework.core.annotation.Order;
    @Order(0)
    org.dpppt.backend.sdk.ws.radarcovid.config: info
    org.dpppt.backend.sdk.ws.radarcovid.annotation: info
        exposednextday: ${RESPONSE_RETENTION_TIME_EXPOSEDNEXTDAY:1000} # milliseconds

	<modelVersion>4.0.0</modelVersion>
	<groupId>org.dpppt</groupId>
	<artifactId>dpppt-backend-sdk</artifactId>
	<packaging>pom</packaging>
	<version>1.0.0-SNAPSHOT</version>
	<name>DP3T Backend SDK</name>
	<properties>
		<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
		<project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
		<java-version>11</java-version>
		<maven.compiler.source>${java-version}</maven.compiler.source>
		<maven.compiler.target>${java-version}</maven.compiler.target>
		<spring-boot-version>2.2.9.RELEASE</spring-boot-version>
		<spring-cloud-version>Hoxton.SR8</spring-cloud-version>
		<spring-cloud-starter-aws.version>2.2.4.RELEASE</spring-cloud-starter-aws.version>
		<spring-framework-version>5.2.8.RELEASE</spring-framework-version>
		<itCoverageAgent></itCoverageAgent>
		<aspectj-version>1.9.6</aspectj-version>
		<build-helper-maven-plugin.version>1.9.1</build-helper-maven-plugin.version>
		<jackson-version>2.11.1</jackson-version>
		<jsonwebtoken-version>0.11.2</jsonwebtoken-version>
		<micrometer-registry-cloudwatch2.version>1.5.5</micrometer-registry-cloudwatch2.version>
		<postgresql-version>42.2.13</postgresql-version>
		<protobuf-java-version>3.12.1</protobuf-java-version>
		<snakeyaml-version>1.26</snakeyaml-version>
		<springdoc-openapi-version>1.4.0</springdoc-openapi-version>
		<tomcat-version>9.0.36</tomcat-version>
		<sonar.host.url>https://sonarcloud.io</sonar.host.url>
		<!--suppress UnresolvedMavenProperty -->
		<sonar.organization>${env.SONAR_ORGANIZATION}</sonar.organization>
		<!--suppress UnresolvedMavenProperty -->
		<sonar.login>${env.SONAR_TOKEN}</sonar.login>
		<sonar.coverage.jacoco.xmlReportPaths>
			${project.basedir}/../dpppt-backend-sdk-report/target/site/jacoco-aggregate/jacoco.xml
		</sonar.coverage.jacoco.xmlReportPaths>
	</properties>
	<modules>
		<module>dpppt-backend-sdk-model</module>
		<module>dpppt-backend-sdk-data</module>
		<module>dpppt-backend-sdk-ws</module>
		<module>dpppt-backend-sdk-report</module>
	</modules>
	<dependencies>
		<dependency>
			<groupId>org.springframework</groupId>
			<artifactId>spring-context</artifactId>
		</dependency>
		<dependency>
			<groupId>org.springframework.boot</groupId>
			<artifactId>spring-boot-starter-test</artifactId>
			<scope>test</scope>
		</dependency>
		<!-- Apache Commons -->
		<dependency>
			<groupId>org.apache.commons</groupId>
			<artifactId>commons-lang3</artifactId>
		</dependency>
		<dependency>
			<groupId>commons-io</groupId>
			<artifactId>commons-io</artifactId>
			<version>2.7</version>
		</dependency>
		<dependency>
			<groupId>junit</groupId>
			<artifactId>junit</artifactId>
			<scope>test</scope>
		</dependency>
		<!-- Logging -->
		<dependency>
			<groupId>org.springframework.boot</groupId>
			<artifactId>spring-boot-starter-logging</artifactId>
		</dependency>
		<dependency>
			<groupId>org.slf4j</groupId>
			<artifactId>jcl-over-slf4j</artifactId>
		</dependency>
		<dependency>
			<groupId>com.google.protobuf</groupId>
			<artifactId>protobuf-java</artifactId>
			<version>${protobuf-java-version}</version>
		</dependency>
	</dependencies>
	<dependencyManagement>
		<dependencies>
			<dependency>
				<groupId>org.springframework.boot</groupId>
				<artifactId>spring-boot-dependencies</artifactId>
				<type>pom</type>
				<version>${spring-boot-version}</version>
				<scope>import</scope>
			</dependency>
			<dependency>
				<groupId>org.springframework.cloud</groupId>
				<artifactId>spring-cloud-dependencies</artifactId>
				<type>pom</type>
				<version>${spring-cloud-version}</version>
				<scope>import</scope>
			</dependency>
			<dependency>
				<groupId>org.springframework</groupId>
				<artifactId>spring-core</artifactId>
				<version>${spring-framework-version}</version>
				<exclusions>
					<exclusion>
						<groupId>commons-logging</groupId>
						<artifactId>commons-logging</artifactId>
					</exclusion>
				</exclusions>
			</dependency>
			<!-- AWS -->
			<dependency>
				<groupId>org.springframework.cloud</groupId>
				<artifactId>spring-cloud-aws-actuator</artifactId>
				<version>${spring-cloud-starter-aws.version}</version>
			</dependency>
			<dependency>
				<groupId>org.springframework.cloud</groupId>
				<artifactId>spring-cloud-starter-aws-parameter-store-config</artifactId>
				<version>${spring-cloud-starter-aws.version}</version>
			</dependency>
			<dependency>
				<groupId>io.micrometer</groupId>
				<artifactId>micrometer-registry-cloudwatch2</artifactId>
				<version>${micrometer-registry-cloudwatch2.version}</version>
			</dependency>
			<dependency>
				<groupId>io.jsonwebtoken</groupId>
				<artifactId>jjwt-api</artifactId>
				<version>${jsonwebtoken-version}</version>
			</dependency>
			<dependency>
				<groupId>io.jsonwebtoken</groupId>
				<artifactId>jjwt-jackson</artifactId>
				<version>${jsonwebtoken-version}</version>
			</dependency>
			<dependency>
				<groupId>io.jsonwebtoken</groupId>
				<artifactId>jjwt-impl</artifactId>
				<version>${jsonwebtoken-version}</version>
			</dependency>
			<dependency>
				<groupId>org.postgresql</groupId>
				<artifactId>postgresql</artifactId>
				<version>${postgresql-version}</version>
			</dependency>
			<dependency>
				<groupId>org.springdoc</groupId>
				<artifactId>springdoc-openapi-webmvc-core</artifactId>
				<version>${springdoc-openapi-version}</version>
			</dependency>
			<dependency>
				<groupId>org.springdoc</groupId>
				<artifactId>springdoc-openapi-ui</artifactId>
				<version>${springdoc-openapi-version}</version>
			</dependency>
			<dependency>
				<groupId>org.springdoc</groupId>
				<artifactId>springdoc-openapi-security</artifactId>
				<version>${springdoc-openapi-version}</version>
			</dependency>
			<dependency>
				<groupId>org.yaml</groupId>
				<artifactId>snakeyaml</artifactId>
				<version>${snakeyaml-version}</version>
			</dependency>
			<dependency>
				<groupId>org.apache.tomcat.embed</groupId>
				<artifactId>tomcat-embed-core</artifactId>
				<version>${tomcat-version}</version>
			</dependency>
			<dependency>
				<groupId>org.apache.tomcat.embed</groupId>
				<artifactId>tomcat-embed-el</artifactId>
				<version>${tomcat-version}</version>
			</dependency>
			<dependency>
				<groupId>org.apache.tomcat.embed</groupId>
				<artifactId>tomcat-embed-websocket</artifactId>
				<version>${tomcat-version}</version>
			</dependency>
			<dependency>
				<groupId>com.fasterxml.jackson.core</groupId>
				<artifactId>jackson-annotations</artifactId>
				<version>${jackson-version}</version>
			</dependency>
			<dependency>
				<groupId>com.fasterxml.jackson.core</groupId>
				<artifactId>jackson-core</artifactId>
				<version>${jackson-version}</version>
			</dependency>
			<dependency>
				<groupId>com.fasterxml.jackson.core</groupId>
				<artifactId>jackson-databind</artifactId>
				<version>${jackson-version}</version>
			</dependency>
			<dependency>
				<groupId>org.springframework.cloud</groupId>
				<artifactId>spring-cloud-starter-circuitbreaker-spring-retry</artifactId>
				<version>1.0.3.RELEASE</version>
			</dependency>
			<dependency>
				<groupId>org.springframework.cloud</groupId>
				<artifactId>spring-cloud-starter-circuitbreaker-resilience4j</artifactId>
				<version>1.0.3.RELEASE</version>
			</dependency>
			<dependency>
				<groupId>joda-time</groupId>
				<artifactId>joda-time</artifactId>
				<version>2.10.6</version>
			</dependency>
			<dependency>
				<groupId>org.aspectj</groupId>
				<artifactId>aspectjrt</artifactId>
				<version>${aspectj-version}</version>
				<scope>compile</scope>
			</dependency>
			<dependency>
				<groupId>org.aspectj</groupId>
				<artifactId>aspectjweaver</artifactId>
				<version>${aspectj-version}</version>
				<scope>compile</scope>
			</dependency>
		</dependencies>
	</dependencyManagement>
	<!--
		<repositories>
			<repository>
				<id>spring-snapshots</id>
				<name>Spring Snapshots</name>
				<url>https://repo.spring.io/snapshot</url>
				<snapshots>
					<enabled>true</enabled>
				</snapshots>
			</repository>
		</repositories>
	-->

	<build>

		<plugins>
			<plugin>
				<groupId>org.apache.maven.plugins</groupId>
				<artifactId>maven-compiler-plugin</artifactId>
				<configuration>
					<source>${java-version}</source>
					<target>${java-version}</target>
				</configuration>
			</plugin>
			<plugin>
				<groupId>org.apache.maven.plugins</groupId>
				<artifactId>maven-enforcer-plugin</artifactId>
				<executions>
					<execution>
						<id>enforce-versions</id>
						<goals>
							<goal>enforce</goal>
						</goals>
						<configuration>
							<rules>
								<requireJavaVersion>
									<version>${java-version}</version>
								</requireJavaVersion>
								<bannedDependencies>
									<excludes>
										<exclude>log4j:log4j</exclude>
										<exclude>commons-logging:commons-logging</exclude>
										<exclude>org.apache.logging.log4j:log4j-core</exclude>
									</excludes>
								</bannedDependencies>
							</rules>
							<fail>true</fail>
						</configuration>
					</execution>
				</executions>
			</plugin>
			<plugin>
				<groupId>org.jacoco</groupId>
				<artifactId>jacoco-maven-plugin</artifactId>
				<executions>
					<!-- set arg line property for surefire -->
					<execution>
						<id>prepare-agent</id>
						<goals>
							<goal>prepare-agent</goal>
						</goals>
						<configuration>
							<propertyName>surefireArgLine</propertyName>
						</configuration>
					</execution>
					<!-- set arg line property for failsafe -->
					<execution>
						<id>prepare-agent-integration</id>
						<goals>
							<goal>prepare-agent-integration</goal>
						</goals>
						<configuration>
							<propertyName>failsafeArgLine</propertyName>
						</configuration>
					</execution>
					<execution>
						<id>prepare-unit-tests</id>
						<goals>
							<goal>prepare-agent</goal>
						</goals>
						<!--<configuration>-->
						<!--<destFile>${sonar.jacoco.reportPath}</destFile>-->
						<!--</configuration>-->
					</execution>

					<!-- prepare agent for measuring integration tests -->
					<execution>
						<id>prepare-agent-coverage</id>
						<goals>
							<goal>prepare-agent</goal>
						</goals>
						<phase>pre-integration-test</phase>
						<configuration>
							<!--<destFile>${sonar.jacoco.itReportPath}</destFile>-->
							<propertyName>itCoverageAgent</propertyName>
						</configuration>
					</execution>
				</executions>
			</plugin>
			<plugin>
				<groupId>org.apache.maven.plugins</groupId>
				<artifactId>maven-surefire-plugin</artifactId>
				<configuration>
					<forkCount>1</forkCount>
				</configuration>
			</plugin>

			<plugin>
				<groupId>org.apache.maven.plugins</groupId>
				<artifactId>maven-failsafe-plugin</artifactId>
				<executions>
					<execution>
						<id>integration-tests</id>
						<goals>
							<goal>integration-test</goal>
							<goal>verify</goal>
						</goals>
						<configuration>
							<argLine>${itCoverageAgent}</argLine>
						</configuration>
					</execution>
				</executions>
			</plugin>
			<plugin>
				<groupId>org.codehaus.mojo</groupId>
				<artifactId>build-helper-maven-plugin</artifactId>
				<executions>
					<execution>
						<id>add-classes</id>
						<phase>generate-sources</phase>
						<goals>
							<goal>add-source</goal>
						</goals>
						<configuration>
							<sources>
								<source>${project.build.directory}/generated-sources</source>
							</sources>
						</configuration>
					</execution>
				</executions>
			</plugin>
			<plugin>
				<groupId>org.apache.maven.plugins</groupId>
				<artifactId>maven-help-plugin</artifactId>
				<inherited>false</inherited>
				<executions>
					<execution>
						<id>show-profiles</id>
						<phase>clean</phase>
						<goals>
							<goal>active-profiles</goal>
						</goals>
					</execution>
				</executions>
			</plugin>
					<execution>
						<id>retrieve-git-info</id>
						<phase>prepare-package</phase>
						<goals>
							<goal>revision</goal>
						</goals>
					</execution>
					<injectAllReactorProjects>true</injectAllReactorProjects>
					<runOnlyOnce>true</runOnlyOnce>
					<skipPoms>false</skipPoms>
					<dateFormat>yyyyMMddHHmmss</dateFormat>
					<dateFormatTimeZone>UTC</dateFormatTimeZone>
					<failOnNoGitDirectory>false</failOnNoGitDirectory>
			</plugin>
			<plugin>
					<archive>
						<manifestEntries>
							<Last-Commit-Id>${git.commit.id}</Last-Commit-Id>
							<Last-Commit-Time>${git.commit.time}</Last-Commit-Time>
							<Reproducible-Build>true</Reproducible-Build>
						</manifestEntries>
					</archive>
			</plugin>
			<plugin>
					<execution>
						<id>strip-jaxb</id>
						<goals>
							<goal>strip-jaxb</goal>
						</goals>
					</execution>
					<execution>
						<id>strip-jar</id>
						<goals>
							<goal>strip-jar</goal>
						</goals>
						<configuration>
							<zipDateTime>${git.commit.time}</zipDateTime>
							<!-- Set custom date/time format pattern, "yyyyMMddHHmmss" by default -->
							<!-- <zipDateTimeFormatPattern>yyyyMMddHHmmss</zipDateTimeFormatPattern> -->
						</configuration>
					</execution>
				</executions>
			</plugin>
		</plugins>
		<pluginManagement>
			<plugins>
				<plugin>
					<groupId>org.apache.maven.plugins</groupId>
					<artifactId>maven-compiler-plugin</artifactId>
					<version>3.8.1</version>
						<source>${java-version}</source>
						<target>${java-version}</target>
						<compilerArgs>
							<arg>-parameters</arg>
						</compilerArgs>
				</plugin>
				<plugin>
					<groupId>org.jacoco</groupId>
					<artifactId>jacoco-maven-plugin</artifactId>
					<version>0.8.5</version>
				</plugin>
				<plugin>
					<groupId>org.sonarsource.scanner.maven</groupId>
					<artifactId>sonar-maven-plugin</artifactId>
					<version>3.7.0.1746</version>
				</plugin>
				<plugin>
					<groupId>com.github.os72</groupId>
					<artifactId>protoc-jar-maven-plugin</artifactId>
					<version>3.11.4</version>
				</plugin>
				<plugin>
					<groupId>org.codehaus.mojo</groupId>
					<artifactId>build-helper-maven-plugin</artifactId>
					<version>3.2.0</version>
				</plugin>
				<plugin>
					<groupId>org.apache.maven.plugins</groupId>
					<artifactId>maven-help-plugin</artifactId>
					<version>3.2.0</version>
				</plugin>
				<plugin>
					<groupId>org.apache.maven.plugins</groupId>
					<artifactId>maven-failsafe-plugin</artifactId>
					<version>2.22.2</version>
				</plugin>
				<plugin>
					<groupId>org.apache.maven.plugins</groupId>
					<artifactId>maven-surefire-plugin</artifactId>
					<version>2.22.2</version>
				</plugin>
				<plugin>
					<groupId>org.apache.maven.plugins</groupId>
					<artifactId>maven-enforcer-plugin</artifactId>
					<version>3.0.0-M3</version>
				</plugin>
			</plugins>
		</pluginManagement>
	</build>
	<!--
		<distributionManagement>
			<repository>
				<id>github</id>
				<name>GitHub Packages</name>
				<url>https://maven.pkg.github.com/DP-3T/dp3t-sdk-backend</url>
			</repository>
		</distributionManagement>
	-->