Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 6 additions & 1 deletion .github/workflows/codeql.yml
Original file line number Diff line number Diff line change
Expand Up @@ -63,13 +63,18 @@ jobs:
steps:
- name: Checkout repository
uses: actions/checkout@v5

- name: Set up JDK
uses: actions/setup-java@v5
with:
java-version: '25'
distribution: 'temurin'
# Initializes the CodeQL tools for scanning.
- name: Initialize CodeQL
uses: github/codeql-action/init@v3
with:
languages: ${{ matrix.language }}
build-mode: ${{ matrix.build-mode }}

# If you wish to specify custom queries, you can do so here or in a config file.
# By default, queries listed here will override any specified in a config file.
# Prefix the list here with "+" to use these queries and those in the config file.
Expand Down
22 changes: 20 additions & 2 deletions .github/workflows/gradle-build.yml
Original file line number Diff line number Diff line change
Expand Up @@ -60,7 +60,7 @@ jobs:
- name: Set up JDK
uses: actions/setup-java@v5
with:
java-version: '21'
java-version: '25'
distribution: 'temurin'
- name: Setup Gradle
uses: gradle/actions/setup-gradle@v4
Expand Down Expand Up @@ -89,6 +89,24 @@ jobs:
name: build-artifacts
path: '**/build/'

dependecy-submission:
name: Dependency Submission
runs-on: ubuntu-latest
steps:
- name: Checkout sources
uses: actions/checkout@v5
- name: Setup Java
uses: actions/setup-java@v5
with:
distribution: 'temurin'
java-version: 25
- name: Generate and submit dependency graph
uses: gradle/actions/dependency-submission@v4
with:
build-scan-publish: true
build-scan-terms-of-use-url: "https://gradle.com/terms-of-service"
build-scan-terms-of-use-agree: "yes"

code-quality:
name: Code Quality with Sonar
needs: [gradle-build, check-changes]
Expand All @@ -101,7 +119,7 @@ jobs:
- name: Set up JDK
uses: actions/setup-java@v5
with:
java-version: '21'
java-version: '25'
distribution: 'temurin'
- name: Setup Gradle
uses: gradle/actions/setup-gradle@v4
Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/gradle-wrapper-updater.yml
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@ jobs:
- name: Set up JDK
uses: actions/setup-java@v5
with:
java-version: '21'
java-version: '25'
distribution: 'temurin'

- name: Update Gradle Wrapper
Expand Down
8 changes: 4 additions & 4 deletions README.adoc
Original file line number Diff line number Diff line change
Expand Up @@ -8,8 +8,8 @@ Samples and tutorials for https://spring.io/projects/spring-boot[Spring Boot] mo
Spring Data, Spring Batch, Spring Cloud, Spring Security, Spring GraphQL, and Spring Test. Each tutorial is equipped
with source code in individual submodules and can be found on {url-quickref}[GitHub].

image:https://img.shields.io/badge/Java_-21-blue?style=flat-square[Static Badge]
image:https://img.shields.io/badge/Spring_Boot-3.5.5-blue?style=flat-square&logo=springboot[Spring Boot version]
image:https://img.shields.io/badge/Java_-25-blue?style=flat-square[Static Badge]
image:https://img.shields.io/badge/Spring_Boot-3.5.6-blue?style=flat-square&logo=springboot[Spring Boot version]
image:https://img.shields.io/github/actions/workflow/status/rashidi/spring-boot-tutorials/gradle-build.yml?style=flat-square&logo=githubactions&color=blue[Gradle Build]
image:https://img.shields.io/github/actions/workflow/status/rashidi/spring-boot-tutorials/build-and-publish-antora.yml?style=flat-square&logo=antora&label=Antora&color=blue[Antora Site Status, link={url-docs}]
image:https://img.shields.io/sonar/coverage/rashidi_spring-boot-tutorials?server=https%3A%2F%2Fsonarcloud.io&style=flat-square&color=blue[Sonar Coverage]
Expand All @@ -27,8 +27,8 @@ best practices and keeping all dependencies up-to-date. The quality of these tut
and always will be, my primary goal.

With the help of https://github.com/dependabot[Dependabot], each tutorial is also kept up-to-date with the latest
dependencies. Currently, we are using Java https://adoptium.net/en-GB/temurin/releases/?version=21[Temurin 21]
with https://plugins.gradle.org/plugin/org.springframework.boot/3.5.5[Spring Boot 3.5.5].
dependencies. Currently, we are using Java https://adoptium.net/en-GB/temurin/releases?version=25[Temurin 25]
with https://plugins.gradle.org/plugin/org.springframework.boot/3.5.6[Spring Boot 3.5.6].

== Documentation

Expand Down
2 changes: 1 addition & 1 deletion batch-rest-repository/build.gradle.kts
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ version = "0.0.1-SNAPSHOT"

java {
toolchain {
languageVersion.set(JavaLanguageVersion.of(21))
languageVersion.set(JavaLanguageVersion.of(25))
}
}

Expand Down
2 changes: 1 addition & 1 deletion batch-skip-step/build.gradle.kts
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ version = "0.0.1-SNAPSHOT"

java {
toolchain {
languageVersion.set(JavaLanguageVersion.of(21))
languageVersion.set(JavaLanguageVersion.of(25))
}
}

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -68,7 +68,7 @@ void findAll() {
assertThat(execution.getExitStatus()).isEqualTo(COMPLETED);
});

var users = jdbc.query("SELECT * FROM users", (rs, rowNum) ->
var users = jdbc.query("SELECT * FROM users", (rs, _) ->
new User(rs.getLong("id"), rs.getString("name"), rs.getString("username"))
);

Expand Down
2 changes: 1 addition & 1 deletion build.gradle.kts
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@ version = "0.0.1-SNAPSHOT"

java {
toolchain {
languageVersion.set(JavaLanguageVersion.of(21))
languageVersion.set(JavaLanguageVersion.of(25))
}
}

Expand Down
2 changes: 1 addition & 1 deletion cloud-jdbc-env-repo/build.gradle.kts
Original file line number Diff line number Diff line change
Expand Up @@ -11,7 +11,7 @@ val springCloudVersion = "2025.0.0"

java {
toolchain {
languageVersion.set(JavaLanguageVersion.of(21))
languageVersion.set(JavaLanguageVersion.of(25))
}
}

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@

@GetMapping("/greet")
public String greet(@RequestParam String greeting) {
return String.format("%s, my name is %s", greeting, properties.name());
return "%s, my name is %s".formatted(greeting, properties.name());

Check warning

Code scanning / CodeQL

Cross-site scripting Medium

Cross-site scripting vulnerability due to a
user-provided value
.

Copilot Autofix

AI 7 months ago

To prevent XSS, all user input included in a response that could ever be interpreted as HTML should be properly escaped or encoded. In this context, even though the method returns a string, and not a rendered HTML template, best practice is to encode/escape the greeting parameter before returning it. The safest and most standard way in Java is to use the StringEscapeUtils.escapeHtml4 utility from Apache Commons Text, which encodes special characters so that any HTML/JavaScript code passed via the user input will not be executed when rendered in a browser.

To implement this fix:

  • Import org.apache.commons.text.StringEscapeUtils at the top.
  • Escape the greeting parameter using StringEscapeUtils.escapeHtml4(greeting) before interpolating/injecting it into the returned string.
  • No change is needed for properties.name() as it's presumably static-safe configuration, but if user-controlled, it should likewise be escaped.

Change placement:

  • File: cloud-jdbc-env-repo/src/main/java/zin/rashidi/boot/cloud/jdbcenvrepo/greet/GreetResource.java
  • Lines: Add an import for StringEscapeUtils and update the response construction in the greet method.

Suggested changeset 2
cloud-jdbc-env-repo/src/main/java/zin/rashidi/boot/cloud/jdbcenvrepo/greet/GreetResource.java

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/cloud-jdbc-env-repo/src/main/java/zin/rashidi/boot/cloud/jdbcenvrepo/greet/GreetResource.java b/cloud-jdbc-env-repo/src/main/java/zin/rashidi/boot/cloud/jdbcenvrepo/greet/GreetResource.java
--- a/cloud-jdbc-env-repo/src/main/java/zin/rashidi/boot/cloud/jdbcenvrepo/greet/GreetResource.java
+++ b/cloud-jdbc-env-repo/src/main/java/zin/rashidi/boot/cloud/jdbcenvrepo/greet/GreetResource.java
@@ -3,6 +3,7 @@
 import org.springframework.web.bind.annotation.GetMapping;
 import org.springframework.web.bind.annotation.RequestParam;
 import org.springframework.web.bind.annotation.RestController;
+import org.apache.commons.text.StringEscapeUtils;
 
 /**
  * @author Rashidi Zin
@@ -18,7 +19,8 @@
 
     @GetMapping("/greet")
     public String greet(@RequestParam String greeting) {
-        return "%s, my name is %s".formatted(greeting, properties.name());
+        String safeGreeting = StringEscapeUtils.escapeHtml4(greeting);
+        return "%s, my name is %s".formatted(safeGreeting, properties.name());
     }
 
 }
EOF
@@ -3,6 +3,7 @@
import org.springframework.web.bind.annotation.GetMapping;
import org.springframework.web.bind.annotation.RequestParam;
import org.springframework.web.bind.annotation.RestController;
import org.apache.commons.text.StringEscapeUtils;

/**
* @author Rashidi Zin
@@ -18,7 +19,8 @@

@GetMapping("/greet")
public String greet(@RequestParam String greeting) {
return "%s, my name is %s".formatted(greeting, properties.name());
String safeGreeting = StringEscapeUtils.escapeHtml4(greeting);
return "%s, my name is %s".formatted(safeGreeting, properties.name());
}

}
cloud-jdbc-env-repo/build.gradle.kts
Outside changed files

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/cloud-jdbc-env-repo/build.gradle.kts b/cloud-jdbc-env-repo/build.gradle.kts
--- a/cloud-jdbc-env-repo/build.gradle.kts
+++ b/cloud-jdbc-env-repo/build.gradle.kts
@@ -26,7 +26,9 @@
 }
 
 dependencies {
-    implementation(platform("org.springframework.cloud:spring-cloud-dependencies:${springCloudVersion}"))
+    implementation(platform("org.springframework.cloud:spring-cloud-dependencies:${springCloudVersion
+    implementation("org.apache.commons:commons-text:1.14.0")
+}"))
 
     implementation("org.springframework.boot:spring-boot-starter-data-jdbc")
     implementation("org.springframework.cloud:spring-cloud-starter-bootstrap")
EOF
@@ -26,7 +26,9 @@
}

dependencies {
implementation(platform("org.springframework.cloud:spring-cloud-dependencies:${springCloudVersion}"))
implementation(platform("org.springframework.cloud:spring-cloud-dependencies:${springCloudVersion
implementation("org.apache.commons:commons-text:1.14.0")
}"))

implementation("org.springframework.boot:spring-boot-starter-data-jdbc")
implementation("org.springframework.cloud:spring-cloud-starter-bootstrap")
This fix introduces these dependencies
Package Version Security advisories
org.apache.commons:commons-text (maven) 1.14.0 None
Copilot is powered by AI and may make mistakes. Always verify output.
}

}
2 changes: 1 addition & 1 deletion data-domain-events/build.gradle.kts
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ version = "0.0.1-SNAPSHOT"

java {
toolchain {
languageVersion.set(JavaLanguageVersion.of(21))
languageVersion.set(JavaLanguageVersion.of(25))
}
}

Expand Down
2 changes: 1 addition & 1 deletion data-envers-audit/build.gradle.kts
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ version = "0.0.1-SNAPSHOT"

java {
toolchain {
languageVersion.set(JavaLanguageVersion.of(21))
languageVersion.set(JavaLanguageVersion.of(25))
}
}

Expand Down
2 changes: 1 addition & 1 deletion data-jdbc-audit/build.gradle.kts
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ version = "0.0.1-SNAPSHOT"

java {
toolchain {
languageVersion.set(JavaLanguageVersion.of(21))
languageVersion.set(JavaLanguageVersion.of(25))
}
}

Expand Down
2 changes: 1 addition & 1 deletion data-jdbc-schema-generation/build.gradle.kts
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ version = "0.0.1-SNAPSHOT"

java {
toolchain {
languageVersion.set(JavaLanguageVersion.of(21))
languageVersion.set(JavaLanguageVersion.of(25))
}
}

Expand Down
2 changes: 1 addition & 1 deletion data-jpa-audit/build.gradle.kts
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ version = "0.0.1-SNAPSHOT"

java {
toolchain {
languageVersion.set(JavaLanguageVersion.of(21))
languageVersion.set(JavaLanguageVersion.of(25))
}
}

Expand Down
2 changes: 1 addition & 1 deletion data-jpa-event/build.gradle.kts
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ version = "0.0.1-SNAPSHOT"

java {
toolchain {
languageVersion.set(JavaLanguageVersion.of(21))
languageVersion.set(JavaLanguageVersion.of(25))
}
}

Expand Down
2 changes: 1 addition & 1 deletion data-jpa-filtered-query/build.gradle.kts
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ version = "0.0.1-SNAPSHOT"

java {
toolchain {
languageVersion.set(JavaLanguageVersion.of(21))
languageVersion.set(JavaLanguageVersion.of(25))
}
}

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@ public JpaCustomBaseRepository(JpaEntityInformation<T, ?> entityInformation, Ent
@Override
public List<T> findAll() {
var hasStatusField = Stream.of(ReflectionUtils.getDeclaredMethods(getDomainClass())).anyMatch(field -> field.getName().equals("status"));
return hasStatusField ? findAll((root, query, criteriaBuilder) -> root.get("status").in(ACTIVE)) : super.findAll();
return hasStatusField ? findAll((root, _, _) -> root.get("status").in(ACTIVE)) : super.findAll();
}

}
2 changes: 1 addition & 1 deletion data-jpa-hibernate-cache/build.gradle.kts
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ version = "0.0.1-SNAPSHOT"

java {
toolchain {
languageVersion = JavaLanguageVersion.of(21)
languageVersion = JavaLanguageVersion.of(25)
}
}

Expand Down
2 changes: 1 addition & 1 deletion data-mongodb-audit/build.gradle.kts
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ version = "0.0.1-SNAPSHOT"

java {
toolchain {
languageVersion.set(JavaLanguageVersion.of(21))
languageVersion.set(JavaLanguageVersion.of(25))
}
}

Expand Down
2 changes: 1 addition & 1 deletion data-mongodb-full-text-search/build.gradle.kts
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ version = "0.0.1-SNAPSHOT"

java {
toolchain {
languageVersion.set(JavaLanguageVersion.of(21))
languageVersion.set(JavaLanguageVersion.of(25))
}
}

Expand Down
2 changes: 1 addition & 1 deletion data-mongodb-tc-data-load/build.gradle.kts
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ version = "0.0.1-SNAPSHOT"

java {
toolchain {
languageVersion.set(JavaLanguageVersion.of(21))
languageVersion.set(JavaLanguageVersion.of(25))
}
}

Expand Down
2 changes: 1 addition & 1 deletion data-mongodb-transactional/build.gradle.kts
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ version = "0.0.1-SNAPSHOT"

java {
toolchain {
languageVersion.set(JavaLanguageVersion.of(21))
languageVersion.set(JavaLanguageVersion.of(25))
}
}

Expand Down
2 changes: 1 addition & 1 deletion data-redis-cache/build.gradle.kts
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ version = "0.0.1-SNAPSHOT"

java {
toolchain {
languageVersion = JavaLanguageVersion.of(21)
languageVersion = JavaLanguageVersion.of(25)
}
}

Expand Down
2 changes: 1 addition & 1 deletion data-repository-definition/build.gradle.kts
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ version = "0.0.1-SNAPSHOT"

java {
toolchain {
languageVersion.set(JavaLanguageVersion.of(21))
languageVersion.set(JavaLanguageVersion.of(25))
}
}

Expand Down
2 changes: 1 addition & 1 deletion data-rest-composite-id/build.gradle.kts
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ version = "0.0.1-SNAPSHOT"

java {
toolchain {
languageVersion = JavaLanguageVersion.of(21)
languageVersion = JavaLanguageVersion.of(25)
}
}

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -56,7 +56,7 @@ public Isbn(String isbn) {

@Override
public String toString() {
return String.format("%d%d%d%d%d", prefix, group, registrant, publication, check);
return "%d%d%d%d%d".formatted(prefix, group, registrant, publication, check);
}

}
Expand Down
2 changes: 1 addition & 1 deletion data-rest-validation/build.gradle.kts
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ version = "0.0.1-SNAPSHOT"

java {
toolchain {
languageVersion.set(JavaLanguageVersion.of(21))
languageVersion.set(JavaLanguageVersion.of(25))
}
}

Expand Down
2 changes: 1 addition & 1 deletion docs/modules/ROOT/pages/index.adoc
Original file line number Diff line number Diff line change
Expand Up @@ -20,4 +20,4 @@ best practices and keeping all dependencies up-to-date. The quality of these tut
and always will be, my primary goal.

With the help of https://github.com/dependabot[Dependabot], each tutorial is also kept up-to-date with the latest
dependencies. Currently, we are using Java https://adoptium.net/en-GB/temurin/releases/?version=21[Temurin 21]
dependencies. Currently, we are using Java https://adoptium.net/en-GB/temurin/releases/?version=25[Temurin 25]
2 changes: 1 addition & 1 deletion graphql/build.gradle.kts
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ version = "0.0.1-SNAPSHOT"

java {
toolchain {
languageVersion.set(JavaLanguageVersion.of(21))
languageVersion.set(JavaLanguageVersion.of(25))
}
}

Expand Down
2 changes: 1 addition & 1 deletion jooq/build.gradle.kts
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@ version = "0.0.1-SNAPSHOT"

java {
toolchain {
languageVersion.set(JavaLanguageVersion.of(21))
languageVersion.set(JavaLanguageVersion.of(25))
}
}

Expand Down
2 changes: 1 addition & 1 deletion modulith/build.gradle.kts
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ version = "0.0.1-SNAPSHOT"

java {
toolchain {
languageVersion.set(JavaLanguageVersion.of(21))
languageVersion.set(JavaLanguageVersion.of(25))
}
}

Expand Down
4 changes: 2 additions & 2 deletions supplemental-ui/partials/footer-content.hbs
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
<footer class="footer">
<p>Spring Boot Tutorials by <a href="https://about.me/rashidi.zin">Rashidi Zin</a></p>
<p id="badges">
<img alt="Java version" src="https://img.shields.io/badge/Java_-21-blue?style=flat-square" />
<img alt="Spring Boot version" src="https://img.shields.io/badge/Spring_Boot-3.5.5-blue?style=flat-square&logo=springboot" />
<img alt="Java version" src="https://img.shields.io/badge/Java_-25-blue?style=flat-square" />
<img alt="Spring Boot version" src="https://img.shields.io/badge/Spring_Boot-3.5.6-blue?style=flat-square&logo=springboot" />
<img alt="License - Unlicense" src="https://img.shields.io/github/license/rashidi/spring-boot-tutorials?style=flat-square&color=blue" />
</footer>
2 changes: 1 addition & 1 deletion test-execution-listeners/build.gradle.kts
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ version = "0.0.1-SNAPSHOT"

java {
toolchain {
languageVersion.set(JavaLanguageVersion.of(21))
languageVersion.set(JavaLanguageVersion.of(25))
}
}

Expand Down
2 changes: 1 addition & 1 deletion test-rest-assured/build.gradle.kts
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ version = "0.0.1-SNAPSHOT"

java {
toolchain {
languageVersion.set(JavaLanguageVersion.of(21))
languageVersion.set(JavaLanguageVersion.of(25))
}
}

Expand Down
2 changes: 1 addition & 1 deletion test-slice-tests-rest/build.gradle.kts
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ version = "0.0.1-SNAPSHOT"

java {
toolchain {
languageVersion.set(JavaLanguageVersion.of(21))
languageVersion.set(JavaLanguageVersion.of(25))
}
}

Expand Down
2 changes: 1 addition & 1 deletion web-rest-client/build.gradle.kts
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ version = "0.0.1-SNAPSHOT"

java {
toolchain {
languageVersion.set(JavaLanguageVersion.of(21))
languageVersion.set(JavaLanguageVersion.of(25))
}
}

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -36,7 +36,7 @@ public List<User> findAll() {
public User findById(Long id) {
return restClient.get().uri("/{id}", id)
.retrieve()
.onStatus(HttpStatusCode::is4xxClientError, ((request, response) -> {
.onStatus(HttpStatusCode::is4xxClientError, ((_, _) -> {
throw new UserNotFoundException();
}))
.body(User.class);
Expand Down
Loading
Loading