Merge branch 'master' into issue-2357-upgrade-k8s-1.35

commjoen · web-flow · commit 3cb98dfcdd27 · 2026-03-06T12:10:05.000+01:00
diff --git a/.github/scripts/.bash_history b/.github/scripts/.bash_history
@@ -347,7 +347,7 @@ rm -rf jdk-18_linux-x64_bin.deb
 git rebase -i main
 git rebase -i master
 git stash
-export tempPassword="OeyxzcLdUbln0KxnhlQaT2wQKfpJpV/A7/ach+erH4M="
+export tempPassword="mVskm4vj9tBf4BqqQEyPaFtTAFJ+K9csVbQkwF3Kj04="
 mvn run tempPassword
 k6
 npx k6
diff --git a/.github/scripts/docker-create.sh b/.github/scripts/docker-create.sh
@@ -64,8 +64,7 @@ Heroku_publish_demo() {
     heroku container:login
     echo "heroku deployment to demo"
     cd ../..
-    # heroku container:push --recursive --arg argBasedVersion=${tag}heroku --app arcane-scrubland-42646
-    heroku container:push --arg argBasedVersion=${tag}heroku --app arcane-scrubland-42646
+    heroku container:push web --arg argBasedVersion=${tag} --app arcane-scrubland-42646
     heroku container:release web --app arcane-scrubland-42646
     # heroku container:push --recursive --arg argBasedVersion=${tag}heroku,CTF_ENABLED=true,HINTS_ENABLED=false --app wrongsecrets-ctf
     # heroku container:release web --app wrongsecrets-ctf
diff --git a/Dockerfile b/Dockerfile
@@ -1,7 +1,7 @@
 FROM bellsoft/liberica-openjre-debian:25-cds AS builder
 WORKDIR /builder
 
-ARG argBasedVersion="1.13.1-alpha5"
+ARG argBasedVersion="1.13.1-alpha6"
 
 COPY --chown=wrongsecrets target/wrongsecrets-${argBasedVersion}-SNAPSHOT.jar application.jar
 RUN java -Djarmode=tools -jar application.jar extract --layers --destination extracted
@@ -59,7 +59,7 @@ RUN mkdir -p /var/run/secrets/kubernetes.io/serviceaccount && \
     chmod 600 /var/run/secrets/kubernetes.io/serviceaccount/token
 
 # Create a dynamic archive
-RUN java --add-modules=jdk.unsupported -XX:ArchiveClassesAtExit=application.jsa -Dspring.context.exit=onRefresh -jar application.jar
+RUN java -XX:ArchiveClassesAtExit=application.jsa -Dspring.context.exit=onRefresh -jar application.jar
 
 # Clean up the mocked token
 RUN rm -rf /var/run/secrets/kubernetes.io
@@ -71,5 +71,4 @@ RUN rm -rf /var/run/secrets/kubernetes.io
 RUN adduser -u 2000 -D wrongsecrets
 USER wrongsecrets
 
-CMD java -Xms128m -Xmx128m -Xss512k -jar -Dserver.port=$PORT -XX:MaxRAMPercentage=75 -XX:MinRAMPercentage=25 -Dspring.profiles.active=without-vault -Dspringdoc.swagger-ui.enabled=${SPRINGDOC_UI} -Dspringdoc.api-docs.enabled=${SPRINGDOC_DOC} application.jar
-# CMD java -jar -XX:SharedArchiveFile=application.jsa -Dspring.profiles.active=$(echo ${SPRING_PROFILES_ACTIVE}) -Dspringdoc.swagger-ui.enabled=${SPRINGDOC_UI} -Dspringdoc.api-docs.enabled=${SPRINGDOC_DOC} -D application.jar
+CMD java -jar -XX:SharedArchiveFile=application.jsa -Dspring.profiles.active=$(echo ${SPRING_PROFILES_ACTIVE}) -Dspringdoc.swagger-ui.enabled=${SPRINGDOC_UI} -Dspringdoc.api-docs.enabled=${SPRINGDOC_DOC} -D application.jar
diff --git a/Dockerfile.web b/Dockerfile.web
@@ -1,5 +1,5 @@
-FROM jeroenwillemsen/wrongsecrets:1.13.1-alpha5-no-vault
-ARG argBasedVersion="1.13.1-alpha5-no-vault"
+FROM jeroenwillemsen/wrongsecrets:1.13.1-alpha6-no-vault
+ARG argBasedVersion="1.13.1-alpha6-no-vault"
 ARG CANARY_URLS="http://canarytokens.com/terms/about/s7cfbdakys13246ewd8ivuvku/post.jsp,http://canarytokens.com/terms/about/y0all60b627gzp19ahqh7rl6j/post.jsp"
 ARG CTF_ENABLED=false
 ARG HINTS_ENABLED=true
@@ -21,6 +21,7 @@ ENV K8S_ENV=Heroku(Docker)
 ENV canarytokenURLs=$CANARY_URLS
 ENV ctf_enabled=$CTF_ENABLED
 ENV ctf_key=$CTF_KEY
+ENV SPRING_PROFILES_ACTIVE=without-vault
 ENV hints_enabled=$HINTS_ENABLED
 ENV challengedockermtpath="/var/helpers"
 ENV keepasspath="/var/helpers/alibabacreds.kdbx"
@@ -36,8 +37,9 @@ ENV default_aws_value_challenge_10=$CHALLENGE_10_VALUE
 ENV default_aws_value_challenge_11=$CHALLENGE_11_VALUE
 ENV BASTIONHOSTPATH="/home/wrongsecrets/.ssh"
 ENV PROJECTSPECPATH="/var/helpers/project-specification.mdc"
+ENV funnybunny="This is a funny bunny"
 COPY .github/scripts/ /var/helpers
 COPY src/test/resources/alibabacreds.kdbx /var/helpers
 COPY src/test/resources/RSAprivatekey.pem /var/helpers
 COPY .ssh/ /home/wrongsecrets/.ssh/
-CMD java -jar -XX:SharedArchiveFile=application.jsa -Dspring.profiles.active=$(echo ${SPRING_PROFILES_ACTIVE}) -Dspringdoc.swagger-ui.enabled=${SPRINGDOC_UI} -Dspringdoc.api-docs.enabled=${SPRINGDOC_DOC} -D  application.jar
+CMD java -jar -XX:SharedArchiveFile=application.jsa -Dspring.profiles.active=without-vault -Dserver.port=${PORT} -Dspringdoc.swagger-ui.enabled=${SPRINGDOC_UI} -Dspringdoc.api-docs.enabled=${SPRINGDOC_DOC} application.jar
diff --git a/aws/k8s/secret-challenge-vault-deployment.yml b/aws/k8s/secret-challenge-vault-deployment.yml
@@ -58,7 +58,7 @@ spec:
             volumeAttributes:
               secretProviderClass: "wrongsecrets-aws-secretsmanager"
       containers:
-        - image: jeroenwillemsen/wrongsecrets:1.13.1-alpha5-k8s-vault
+        - image: jeroenwillemsen/wrongsecrets:1.13.1-alpha6-k8s-vault
           imagePullPolicy: IfNotPresent
           name: secret-challenge
           command: ["/bin/sh"]
diff --git a/azure/k8s/secret-challenge-vault-deployment.yml.tpl b/azure/k8s/secret-challenge-vault-deployment.yml.tpl
@@ -61,7 +61,7 @@ spec:
             volumeAttributes:
               secretProviderClass: "azure-wrongsecrets-vault"
       containers:
-        - image: jeroenwillemsen/wrongsecrets:1.13.1-alpha5-k8s-vault
+        - image: jeroenwillemsen/wrongsecrets:1.13.1-alpha6-k8s-vault
           imagePullPolicy: IfNotPresent
           name: secret-challenge
           command: ["/bin/sh"]
diff --git a/docs/SPRING_BOOT_4_ADOPTION_CHECKLIST.md b/docs/SPRING_BOOT_4_ADOPTION_CHECKLIST.md
@@ -21,24 +21,24 @@ This checklist is tailored to the current `wrongsecrets` codebase (Spring Boot `
 
 ### 1) Standardize HTTP error responses with `ProblemDetail`
 
-- [ ] Add a global `@RestControllerAdvice` for API endpoints that returns `ProblemDetail`.
-- [ ] Keep MVC HTML error handling as-is for Thymeleaf pages; only modernize JSON API errors.
-- [ ] Add tests that assert RFC 9457-style payload fields (`type`, `title`, `status`, `detail`, `instance`).
+- [x] Add a global `@RestControllerAdvice` for API endpoints that returns `ProblemDetail`.
+- [x] Keep MVC HTML error handling as-is for Thymeleaf pages; only modernize JSON API errors.
+- [x] Add tests that assert RFC 9457-style payload fields (`type`, `title`, `status`, `detail`, `instance`).
 
 **Why now:** Reduces custom exception payload drift and improves API consistency.
 
 ### 2) Replace new `RestTemplate` usage with `RestClient`
 
-- [ ] Stop introducing any new `RestTemplate` usage.
-- [ ] Migrate existing bean in `WrongSecretsApplication` from `RestTemplate` to `RestClient.Builder`.
-- [ ] Migrate call sites incrementally (start with `SlackNotificationService`).
-- [ ] Add timeout and retry policy explicitly for outbound calls.
+- [x] Stop introducing any new `RestTemplate` usage.
+- [x] Migrate existing bean in `WrongSecretsApplication` from `RestTemplate` to `RestClient.Builder`.
+- [x] Migrate call sites incrementally (start with `SlackNotificationService`).
+- [x] Add timeout and retry policy explicitly for outbound calls.
 
 **Current state:** `RestTemplate` bean and usage exist and can be migrated safely in phases.
 
 ### 3) Add/verify deprecation gate in CI
 
-- [ ] Run compile with deprecation warnings enabled in CI (`-Xlint:deprecation`).
+- [x] Run compile with deprecation warnings enabled in CI (`-Xlint:deprecation`).
 - [ ] Fail build on newly introduced deprecations (can be soft-fail initially).
 - [ ] Track remaining suppressions/deprecations as explicit TODOs.
 
@@ -139,8 +139,8 @@ This checklist is tailored to the current `wrongsecrets` codebase (Spring Boot `
 
 ## Definition of done for Boot 4 adoption
 
-- [ ] No new `RestTemplate` code introduced.
-- [ ] API errors are standardized on `ProblemDetail`.
-- [ ] Deprecation warnings are tracked and controlled in CI.
+- [x] No new `RestTemplate` code introduced.
+- [x] API errors are standardized on `ProblemDetail`.
+- [x] Deprecation warnings are tracked and controlled in CI.
 - [ ] Observability baseline (metrics, traces, log correlation) is active in non-local profiles.
 - [ ] Migration choices and rollout decisions are documented in `docs/`.
diff --git a/docs/VERSION_MANAGEMENT.md b/docs/VERSION_MANAGEMENT.md
@@ -12,9 +12,9 @@ The project maintains version consistency between:
 ## Version Schema
 
 ```
-pom.xml version:        1.13.1-alpha5-SNAPSHOT
-Dockerfile version:     1.13.1-alpha5
-Dockerfile.web version: 1.13.1-alpha5-no-vault
+pom.xml version:        1.13.1-alpha6-SNAPSHOT
+Dockerfile version:     1.13.1-alpha6
+Dockerfile.web version: 1.13.1-alpha6-no-vault
 ```
 
 ## Automated Solutions
diff --git a/fly.toml b/fly.toml
@@ -8,7 +8,7 @@ app = "wrongsecrets"
 primary_region = "ams"
 
 [build]
-  image = "docker.io/jeroenwillemsen/wrongsecrets:1.13.1-alpha5-no-vault"
+  image = "docker.io/jeroenwillemsen/wrongsecrets:1.13.1-alpha6-no-vault"
 
 [env]
   K8S_ENV = "Fly(Docker)"
diff --git a/gcp/k8s/secret-challenge-vault-deployment.yml.tpl b/gcp/k8s/secret-challenge-vault-deployment.yml.tpl
@@ -58,7 +58,7 @@ spec:
             volumeAttributes:
               secretProviderClass: "wrongsecrets-gcp-secretsmanager"
       containers:
-        - image: jeroenwillemsen/wrongsecrets:1.13.1-alpha5-k8s-vault
+        - image: jeroenwillemsen/wrongsecrets:1.13.1-alpha6-k8s-vault
           imagePullPolicy: IfNotPresent
           name: secret-challenge
           command: ["/bin/sh"]
diff --git a/heroku.yml b/heroku.yml
@@ -1,4 +1,3 @@
 build:
   docker:
     web: Dockerfile.web
-    worker: Dockerfile
diff --git a/js/index.js b/js/index.js
@@ -1,5 +1,5 @@
 
  function secret() {
- var password = "t5K69iQ=" + 9 + "IoOL" + 6 + "jYE=" + 2 + "/i5I" + 7;
+ var password = "m2/lkfE=" + 9 + "DsPI" + 6 + "2yc=" + 2 + "BcHo" + 7;
  return password;
  }
diff --git a/k8s/challenge53/secret-challenge53-sidecar.yml b/k8s/challenge53/secret-challenge53-sidecar.yml
@@ -21,7 +21,7 @@ spec:
         runAsGroup: 2000
         fsGroup: 2000
       containers:
-      - image: jeroenwillemsen/wrongsecrets-challenge53:1.13.1-alpha5
+      - image: jeroenwillemsen/wrongsecrets-challenge53:1.13.1-alpha6
         name: secret-challenge-53
         imagePullPolicy: IfNotPresent
         resources:
@@ -45,7 +45,7 @@ spec:
         command: ["/bin/sh", "-c"]
         args:
           - cp /home/wrongsecrets/* /shared-data/ && exec /home/wrongsecrets/start-on-arch.sh
-      - image: jeroenwillemsen/wrongsecrets-challenge53-debug:1.13.1-alpha5
+      - image: jeroenwillemsen/wrongsecrets-challenge53-debug:1.13.1-alpha6
         name: sidecar
         imagePullPolicy: IfNotPresent
         command: ["/bin/sh", "-c", "while true; do ls /shared-data; sleep 10; done"]
diff --git a/k8s/challenge53/secret-challenge53.yml b/k8s/challenge53/secret-challenge53.yml
@@ -21,7 +21,7 @@ spec:
         runAsGroup: 2000
         fsGroup: 2000
       containers:
-      - image: jeroenwillemsen/wrongsecrets-challenge53:1.13.1-alpha5
+      - image: jeroenwillemsen/wrongsecrets-challenge53:1.13.1-alpha6
         name: secret-challenge-53
         imagePullPolicy: IfNotPresent
         resources:
diff --git a/k8s/secret-challenge-deployment.yml b/k8s/secret-challenge-deployment.yml
@@ -28,7 +28,7 @@ spec:
         runAsGroup: 2000
         fsGroup: 2000
       containers:
-        - image: jeroenwillemsen/wrongsecrets:1.13.1-alpha5-no-vault
+        - image: jeroenwillemsen/wrongsecrets:1.13.1-alpha6-no-vault
           imagePullPolicy: IfNotPresent
           name: secret-challenge
           ports:
diff --git a/k8s/secret-challenge-vault-deployment.yml b/k8s/secret-challenge-vault-deployment.yml
@@ -50,7 +50,7 @@ spec:
           type: RuntimeDefault
       serviceAccountName: vault
       containers:
-        - image: jeroenwillemsen/wrongsecrets:1.13.1-alpha5-k8s-vault
+        - image: jeroenwillemsen/wrongsecrets:1.13.1-alpha6-k8s-vault
           imagePullPolicy: IfNotPresent
           name: secret-challenge
           command: ["/bin/sh"]
diff --git a/okteto/k8s/secret-challenge-ctf-deployment.yml b/okteto/k8s/secret-challenge-ctf-deployment.yml
@@ -28,7 +28,7 @@ spec:
         runAsGroup: 2000
         fsGroup: 2000
       containers:
-        - image: jeroenwillemsen/wrongsecrets:1.13.1-alpha5-no-vault
+        - image: jeroenwillemsen/wrongsecrets:1.13.1-alpha6-no-vault
           name: secret-challenge-ctf
           imagePullPolicy: IfNotPresent
           securityContext:
diff --git a/okteto/k8s/secret-challenge-deployment.yml b/okteto/k8s/secret-challenge-deployment.yml
@@ -28,7 +28,7 @@ spec:
         runAsGroup: 2000
         fsGroup: 2000
       containers:
-        - image: jeroenwillemsen/wrongsecrets:1.13.1-alpha5-no-vault
+        - image: jeroenwillemsen/wrongsecrets:1.13.1-alpha6-no-vault
           name: secret-challenge
           imagePullPolicy: IfNotPresent
           securityContext:
diff --git a/pom.xml b/pom.xml
@@ -11,7 +11,7 @@
 
   <groupId>org.owasp</groupId>
   <artifactId>wrongsecrets</artifactId>
-  <version>1.13.1-alpha5-SNAPSHOT</version>
+  <version>1.13.1-alpha6-SNAPSHOT</version>
 
   <name>OWASP WrongSecrets</name>
   <description>Examples with how to not use secrets</description>
@@ -591,6 +591,9 @@
         <configuration>
           <source>25</source>
           <target>25</target>
+          <compilerArgs>
+            <arg>-Xlint:deprecation</arg>
+          </compilerArgs>
         </configuration>
       </plugin>
       <plugin>
diff --git a/src/main/java/org/owasp/wrongsecrets/ApiExceptionAdvice.java b/src/main/java/org/owasp/wrongsecrets/ApiExceptionAdvice.java
@@ -0,0 +1,54 @@
+package org.owasp.wrongsecrets;
+
+import jakarta.servlet.http.HttpServletRequest;
+import java.net.URI;
+import org.springframework.http.HttpStatus;
+import org.springframework.http.ProblemDetail;
+import org.springframework.web.bind.annotation.ExceptionHandler;
+import org.springframework.web.bind.annotation.RestController;
+import org.springframework.web.bind.annotation.RestControllerAdvice;
+import org.springframework.web.server.ResponseStatusException;
+
+/**
+ * Global exception handler for REST API endpoints. Returns RFC 9457-style {@link ProblemDetail}
+ * responses. Scoped to {@link RestController} annotated beans only; Thymeleaf controllers are
+ * unaffected.
+ */
+@RestControllerAdvice(annotations = RestController.class)
+public class ApiExceptionAdvice {
+
+  /**
+   * Handles {@link ResponseStatusException} thrown from REST controllers and maps it to an RFC
+   * 9457-compliant {@link ProblemDetail} response.
+   *
+   * @param ex the exception to handle
+   * @param request the current HTTP request
+   * @return a {@link ProblemDetail} with status, title, detail and instance populated
+   */
+  @ExceptionHandler(ResponseStatusException.class)
+  public ProblemDetail handleResponseStatus(
+      ResponseStatusException ex, HttpServletRequest request) {
+    ProblemDetail pd = ProblemDetail.forStatus(ex.getStatusCode());
+    pd.setTitle(ex.getReason() != null ? ex.getReason() : ex.getStatusCode().toString());
+    pd.setDetail(ex.getMessage());
+    pd.setInstance(URI.create(request.getRequestURI()));
+    return pd;
+  }
+
+  /**
+   * Handles unexpected exceptions thrown from REST controllers and maps them to an RFC 9457-
+   * compliant {@link ProblemDetail} response with HTTP 500 status.
+   *
+   * @param ex the exception to handle
+   * @param request the current HTTP request
+   * @return a {@link ProblemDetail} with status 500, title and detail populated
+   */
+  @ExceptionHandler(Exception.class)
+  public ProblemDetail handleGenericException(Exception ex, HttpServletRequest request) {
+    ProblemDetail pd = ProblemDetail.forStatus(HttpStatus.INTERNAL_SERVER_ERROR);
+    pd.setTitle("Internal Server Error");
+    pd.setDetail(ex.getMessage());
+    pd.setInstance(URI.create(request.getRequestURI()));
+    return pd;
+  }
+}
diff --git a/src/main/java/org/owasp/wrongsecrets/WrongSecretsApplication.java b/src/main/java/org/owasp/wrongsecrets/WrongSecretsApplication.java
@@ -1,5 +1,6 @@
 package org.owasp.wrongsecrets;
 
+import java.time.Duration;
 import org.owasp.wrongsecrets.challenges.kubernetes.Vaultinjected;
 import org.owasp.wrongsecrets.challenges.kubernetes.Vaultpassword;
 import org.owasp.wrongsecrets.definitions.ChallengeDefinitionsConfiguration;
@@ -10,7 +11,8 @@
 import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Scope;
 import org.springframework.context.annotation.ScopedProxyMode;
-import org.springframework.web.client.RestTemplate;
+import org.springframework.http.client.SimpleClientHttpRequestFactory;
+import org.springframework.web.client.RestClient;
 
 @SpringBootApplication
 @EnableConfigurationProperties({Vaultpassword.class, Vaultinjected.class})
@@ -34,7 +36,10 @@ public RuntimeEnvironment runtimeEnvironment(
   }
 
   @Bean
-  public RestTemplate restTemplate() {
-    return new RestTemplate();
+  public RestClient restClient(RestClient.Builder builder) {
+    SimpleClientHttpRequestFactory factory = new SimpleClientHttpRequestFactory();
+    factory.setConnectTimeout(Duration.ofSeconds(5));
+    factory.setReadTimeout(Duration.ofSeconds(10));
+    return builder.requestFactory(factory).build();
   }
 }
diff --git a/src/main/java/org/owasp/wrongsecrets/challenges/docker/Challenge14.java b/src/main/java/org/owasp/wrongsecrets/challenges/docker/Challenge14.java
@@ -45,13 +45,13 @@ public String getAnswer() {
 
     try (InputStream inputStream = Files.newInputStream(Paths.get(filePath))) {
       database = SimpleDatabase.load(creds, inputStream);
-      return database.findEntries("alibaba").get(0).getPassword();
+      return database.findEntries("alibaba").getFirst().getPassword();
     } catch (Exception | Error e) {
       log.error("Exception or Error with Challenge 14", e);
       try (InputStream inputStream =
           Files.newInputStream(Paths.get("src/test/resources/alibabacreds.kdbx"))) {
         database = SimpleDatabase.load(creds, inputStream);
-        return database.findEntries("alibaba").get(0).getPassword();
+        return database.findEntries("alibaba").getFirst().getPassword();
       } catch (Exception | Error e2) {
         log.error("Exception or Error with Challenge 14 second time", e2);
         return defaultKeepassValue;
diff --git a/src/main/java/org/owasp/wrongsecrets/challenges/docker/Challenge61.java b/src/main/java/org/owasp/wrongsecrets/challenges/docker/Challenge61.java
diff --git a/src/main/java/org/owasp/wrongsecrets/challenges/docker/SlackNotificationService.java b/src/main/java/org/owasp/wrongsecrets/challenges/docker/SlackNotificationService.java
diff --git a/src/main/resources/explanations/challenge61.adoc b/src/main/resources/explanations/challenge61.adoc
diff --git a/src/main/resources/explanations/challenge61_hint.adoc b/src/main/resources/explanations/challenge61_hint.adoc
diff --git a/src/main/resources/explanations/challenge61_reason.adoc b/src/main/resources/explanations/challenge61_reason.adoc
diff --git a/src/main/resources/wrong-secrets-configuration.yaml b/src/main/resources/wrong-secrets-configuration.yaml
diff --git a/src/test/java/org/owasp/wrongsecrets/ApiExceptionAdviceTest.java b/src/test/java/org/owasp/wrongsecrets/ApiExceptionAdviceTest.java
diff --git a/src/test/java/org/owasp/wrongsecrets/challenges/docker/Challenge61Test.java b/src/test/java/org/owasp/wrongsecrets/challenges/docker/Challenge61Test.java
diff --git a/src/test/java/org/owasp/wrongsecrets/challenges/docker/SlackNotificationServiceTest.java b/src/test/java/org/owasp/wrongsecrets/challenges/docker/SlackNotificationServiceTest.java
diff --git a/static-site/pr-2125/pages/about.html b/static-site/pr-2125/pages/about.html
