🔒 Fix information exposure vulnerability by using secure logging

.github/dependabot.yml

@@ -1,7 +1,7 @@
 version: 2
 updates:
 - package-ecosystem: maven
-  directory: /
+  directory: /org.moreunit.build
   schedule:
     interval: daily
   open-pull-requests-limit: 10

.github/workflows/coverage.yml

@@ -15,10 +15,10 @@ jobs:
 
     steps:
       - name: Checkout 🛎
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Set up Java ☕️
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v5
         with:
           distribution: 'temurin'
           java-version: '21'
@@ -33,7 +33,7 @@ jobs:
         run: mvn -file org.moreunit.build/pom.xml clean install -Pcoverage "-Dtarget.platform.classifier=eclipse-latest" --fail-at-end --batch-mode --strict-checksums --update-snapshots "-Dorg.slf4j.simpleLogger.log.org.apache.maven.cli.transfer.Slf4jMavenTransferListener=warn"
 
       - name: Upload coverage to Codecov
-        uses: codecov/codecov-action@v5
+        uses: codecov/codecov-action@v6
         with:
           files: ./org.moreunit.build/target/site/jacoco-aggregate/jacoco.xml
           verbose: true

.github/workflows/maven.yml

@@ -21,10 +21,10 @@ jobs:
 
     steps:
       - name: Checkout 🛎
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Set up Java ☕️
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@v5
         with:
           distribution: 'temurin'
           java-version: '21'
@@ -37,6 +37,9 @@ jobs:
       - name: Build and verify
         run: mvn -file org.moreunit.build/pom.xml clean install "-Dtarget.platform.classifier=eclipse-latest" --fail-at-end --batch-mode --strict-checksums --update-snapshots "-Dorg.slf4j.simpleLogger.log.org.apache.maven.cli.transfer.Slf4jMavenTransferListener=warn"
 
+      - name: Run PMD and CPD checks
+        run: mvn -file org.moreunit.build/pom.xml pmd:check pmd:cpd-check
+
       - name: Publish Surefire Test Results for  🖨
         if: ${{ always() }}
         uses: ScaCap/action-surefire-report@v1
@@ -62,7 +65,7 @@ jobs:
 
       - name: Release RELEASE
         if: startsWith(github.ref, 'refs/tags/')
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@v3
         with:
           files: |
             ./org.moreunit.updatesite/target/org.moreunit.updatesite-*.zip

README.md

@@ -1,3 +1,4 @@
+[![MoreUnit Build](https://github.com/MoreUnit/MoreUnit-Eclipse/actions/workflows/maven.yml/badge.svg)](https://github.com/MoreUnit/MoreUnit-Eclipse/actions/workflows/maven.yml)
 [![CodeQL](https://github.com/MoreUnit/MoreUnit-Eclipse/actions/workflows/codeql-analysis.yml/badge.svg)](https://github.com/MoreUnit/MoreUnit-Eclipse/actions/workflows/codeql-analysis.yml)
 [![codecov](https://codecov.io/gh/MoreUnit/MoreUnit-Eclipse/branch/master/graph/badge.svg)](https://codecov.io/gh/MoreUnit/MoreUnit-Eclipse)
 

org.moreunit.build/pom.xml

@@ -27,7 +27,7 @@
     <maven.compiler.release>21</maven.compiler.release>
     <tycho-version>5.0.2</tycho-version>
     <exec-maven-version>3.5.0</exec-maven-version>
-    <surefire-version>3.5.3</surefire-version>
+    <surefire-version>3.5.5</surefire-version>
     <jacoco.version>0.8.14</jacoco.version>
 
     <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
@@ -123,12 +123,12 @@
         <plugin>
           <groupId>org.apache.maven.plugins</groupId>
           <artifactId>maven-assembly-plugin</artifactId>
-          <version>3.6.0</version>
+          <version>3.8.0</version>
         </plugin>
         <plugin>
           <groupId>org.apache.maven.plugins</groupId>
           <artifactId>maven-deploy-plugin</artifactId>
-          <version>3.1.1</version>
+          <version>3.1.4</version>
         </plugin>
         <plugin>
           <groupId>org.eclipse.tycho</groupId>
@@ -138,7 +138,7 @@
         <plugin>
           <groupId>org.apache.maven.plugins</groupId>
           <artifactId>maven-antrun-plugin</artifactId>
-          <version>3.1.0</version>
+          <version>3.2.0</version>
         </plugin>
         <!--This plugin's configuration is used to store Eclipse m2e settings only. It has no influence on the Maven build itself.-->
         <plugin>

org.moreunit.core.test/test/org/moreunit/core/commands/JumpActionHandlerTest.java

@@ -13,10 +13,8 @@
 import org.junit.After;
 import org.junit.Assume;
 import org.junit.Before;
-import org.junit.Ignore;
 import org.junit.Test;
 import org.moreunit.core.CoreTestModule;
-import org.moreunit.core.extension.ExtensionPoints;
 import org.moreunit.core.extension.jump.IJumpContext;
 import org.moreunit.core.extension.jump.IJumper;
 import org.moreunit.core.extension.jump.JumpResult;

org.moreunit.core.test/test/org/moreunit/core/util/ExtendedSafeRunnerTest.java

@@ -3,7 +3,6 @@
 import static org.assertj.core.api.Assertions.assertThat;
 
 import java.util.Arrays;
-import java.util.List;
 
 import org.junit.Test;
 import org.moreunit.core.util.ExtendedSafeRunner.GenericRunnable;

org.moreunit.core.test/test/org/moreunit/core/util/IOUtilsTest.java

@@ -9,7 +9,6 @@
 import java.io.Closeable;
 import java.io.IOException;
 
-import org.junit.Ignore;
 import org.junit.Test;
 
 public class IOUtilsTest

org.moreunit.core.test/test/org/moreunit/core/util/PreconditionsTest.java

@@ -5,7 +5,6 @@
 
 import java.util.ArrayList;
 import java.util.Arrays;
-import java.util.Collection;
 import java.util.List;
 
 import org.junit.Test;

org.moreunit.core/src/org/moreunit/core/decorators/TestedFileDecorator.java

@@ -8,7 +8,6 @@
 import org.eclipse.jface.viewers.LabelProvider;
 import org.eclipse.jface.viewers.LabelProviderChangedEvent;
 import org.eclipse.ui.PlatformUI;
-import org.moreunit.core.MoreUnitCore;
 import org.moreunit.core.log.Logger;
 import org.moreunit.core.matching.DoesNotMatchConfigurationException;
 import org.moreunit.core.resources.SrcFile;

org.moreunit.core/src/org/moreunit/core/matching/FileMatcher.java

@@ -8,6 +8,16 @@
 
 public class FileMatcher
 {
+    // Use an LRU cache to prevent memory leaks from unbounded growth
+    private static final int MAX_CACHE_SIZE = 1000;
+    private static final java.util.Map<String, Pattern> PATTERN_CACHE = java.util.Collections.synchronizedMap(
+        new java.util.LinkedHashMap<String, Pattern>(16, 0.75f, true) {
+            @Override
+            protected boolean removeEldestEntry(java.util.Map.Entry<String, Pattern> eldest) {
+                return size() > MAX_CACHE_SIZE;
+            }
+        });
+
     private final SrcFile file;
     private final SearchEngine searchEngine;
     private final FileMatchSelector matchSelector;
@@ -77,6 +87,13 @@ private Pattern createFileNamePattern(SrcFile file, Collection<String> correspon
         .append("|").append(extension.toUpperCase()) //
         .append(")");
 
-        return Pattern.compile(sb.toString());
+        String regex = sb.toString();
+        Pattern pattern = PATTERN_CACHE.get(regex);
+        if (pattern == null)
+        {
+            pattern = Pattern.compile(regex);
+            PATTERN_CACHE.put(regex, pattern);
+        }
+        return pattern;
     }
 }

org.moreunit.core/src/org/moreunit/core/matching/TestFolderPathPattern.java

@@ -16,10 +16,13 @@
 import java.util.regex.Pattern;
 
 import org.moreunit.core.resources.Path;
+import org.moreunit.core.util.LRUCache;
 import org.moreunit.core.util.Strings;
 
 public class TestFolderPathPattern
 {
+    private static final Map<String, Pattern> PATTERN_CACHE = new LRUCache<String, Pattern>(500);
+
     public static final String SRC_PROJECT_VARIABLE = "${srcProject}";
 
     private static final int MAX_GROUPS = 9;
@@ -48,6 +51,8 @@ public class TestFolderPathPattern
         TEST_PATH_VALIDATOR = compile("^/?[^/\\*\\(\\)]*" + quote(SRC_PROJECT_VARIABLE) + "[^\\*\\(\\)]*$");
     }
 
+    private static final Pattern GROUP_PATTERN = Pattern.compile("\\([^\\)]+\\)");
+
     private final String srcPathTemplate;
     private final String testPathTemplate;
     private final Pattern testProjectPattern;
@@ -198,12 +203,28 @@ private String resolveGroups(String path, String tplWithGroups, String tplWithRe
     {
         String result = tplWithRefs;
 
-        Matcher matcher = Pattern.compile(tplWithGroups).matcher(path);
+        Pattern pattern;
+        synchronized (PATTERN_CACHE)
+        {
+            pattern = PATTERN_CACHE.get(tplWithGroups);
+        }
+
+        if(pattern == null)
+        {
+            pattern = Pattern.compile(tplWithGroups);
+            synchronized (PATTERN_CACHE)
+            {
+                PATTERN_CACHE.put(tplWithGroups, pattern);
+            }
+        }
+
+        Matcher matcher = pattern.matcher(path);
         if(matcher.matches())
         {
             List<GroupRef> groupRefs = getGroupRefs(result);
             reverse(groupRefs);
 
+            StringBuilder resultBuilder = new StringBuilder(result);
             for (int i = 0; i < groupRefs.size(); i++)
             {
                 GroupRef ref = groupRefs.get(i);
@@ -218,8 +239,9 @@ private String resolveGroups(String path, String tplWithGroups, String tplWithRe
                     throw new DoesNotMatchConfigurationException(analizedPath);
                 }
 
-                result = result.substring(0, ref.startIdx) + groupContent + result.substring(ref.endIdx);
+                resultBuilder.replace(ref.startIdx, ref.endIdx, groupContent);
             }
+            result = resultBuilder.toString();
         }
         return result;
     }
@@ -251,6 +273,11 @@ public SourceFolderPath getSrcPathFor(Path testPath) throws DoesNotMatchConfigur
 
     private String replaceGroupsWithRefs(String template, List<GroupRef> groupRefs)
     {
+        if (groupRefs.isEmpty())
+        {
+            return template;
+        }
+
         Map<Integer, Integer> refIndices = new HashMap<Integer, Integer>();
         int idx = 1;
         for (GroupRef ref : groupRefs)
@@ -259,12 +286,16 @@ private String replaceGroupsWithRefs(String template, List<GroupRef> groupRefs)
             idx++;
         }
 
-        String result = template;
-        for (int i = 0; i < groupRefs.size(); i++)
+        Matcher matcher = GROUP_PATTERN.matcher(template);
+        StringBuffer sb = new StringBuffer();
+        int i = 0;
+        while (matcher.find() && i < groupRefs.size())
         {
-            result = result.replaceFirst("\\([^\\)]+\\)", "\\\\" + refIndices.get(i));
+            matcher.appendReplacement(sb, Matcher.quoteReplacement("\\" + refIndices.get(i)));
+            i++;
         }
-        return result;
+        matcher.appendTail(sb);
+        return sb.toString();
     }
 
     private String getSrcProjectName(String tstProjectName, Path tstPath) throws DoesNotMatchConfigurationException

org.moreunit.core/src/org/moreunit/core/preferences/GenericPreferencePage.java

@@ -8,7 +8,6 @@
 import org.eclipse.swt.widgets.Composite;
 import org.moreunit.core.languages.Language;
 import org.moreunit.core.languages.LanguageRepository;
-import org.moreunit.core.ui.Labels;
 
 public class GenericPreferencePage extends PreferencePageBase
 {

org.moreunit.core/src/org/moreunit/core/resources/Resources.java

@@ -2,6 +2,12 @@
 
 import org.eclipse.core.resources.IFolder;
 import org.eclipse.core.resources.IProject;
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.List;
+
+import org.eclipse.core.resources.IContainer;
+import org.eclipse.core.resources.IResource;
 import org.eclipse.core.resources.ResourcesPlugin;
 import org.eclipse.core.runtime.CoreException;
 import org.eclipse.core.runtime.IPath;
@@ -27,36 +33,38 @@ public static CreatedFolder createFolder(IProject project, IPath folderPath)
             return new CreatedFolder(srcFolder);
         }
 
-        IFolder folder = null;
-        CreatedFolderPath createdFolderPath = null;
+        List<IFolder> foldersToCreate = new ArrayList<IFolder>();
+        IFolder current = srcFolder;
 
-        for (String segment : folderPath.segments())
+        while (!current.exists())
         {
-            if(folder == null)
+            foldersToCreate.add(current);
+            IContainer parent = current.getParent();
+            if(parent == null || parent.getType() != IResource.FOLDER)
             {
-                folder = project.getFolder(segment);
+                break;
             }
-            else
+            current = (IFolder) parent;
+        }
+
+        Collections.reverse(foldersToCreate);
+
+        CreatedFolderPath createdFolderPath = null;
+        for (IFolder folder : foldersToCreate)
+        {
+            try
             {
-                folder = folder.getFolder(segment);
+                folder.create(false, true, null);
             }
-
-            if(! folder.exists())
+            catch (CoreException e)
             {
-                try
-                {
-                    folder.create(false, true, null);
-                }
-                catch (CoreException e)
-                {
-                    throw new FolderCreationException(e, folder);
-                }
-
-                createdFolderPath = new CreatedFolderPath(createdFolderPath, folder);
+                throw new FolderCreationException(e, folder);
             }
+
+            createdFolderPath = new CreatedFolderPath(createdFolderPath, folder);
         }
 
-        return new CreatedFolder(folder, createdFolderPath);
+        return new CreatedFolder(srcFolder, createdFolderPath);
     }
 
     public static class CreatedFolder