General: Show dependencies and vulnerabilities in an admin page (#11982)

Author: krusche

.gitignore

@@ -204,6 +204,12 @@ data-exports/
 /src/main/webapp/app/core/environments/environment.*.ts
 /src/main/webapp/i18n/*.json
 
+######################
+# TypeScript output (should go to build/, but gitignore as safeguard)
+######################
+/src/main/webapp/**/*.js
+/src/main/webapp/**/*.js.map
+
 ######################
 # Artemis resources
 ######################

SECURITY.md

@@ -116,13 +116,22 @@ Transport security:
 
 Artemis actively protects against supply chain risks:
 
+- The Artemis development team carefully reviews new dependencies before including them in the project to avoid introducing vulnerabilities in the first place
 - Automated dependency vulnerability scanning using **Mend (formerly WhiteSource)**
 - Regular updates to the latest stable versions of:
   - **Spring Boot**
   - **Angular**
 - Prompt application of security patches
 - Avoidance of unmaintained or low-trust dependencies
 
+**Vulnerability Monitoring and SBOM Support:**
+
+Artemis provides built-in tools to help administrators monitor and manage dependency security:
+
+- **Software Dependencies Page:** Administrators can view and check for known vulnerabilities directly in the application via the Admin area, allowing for quick assessment of the current security posture
+- **Software Bill of Materials (SBOM):** A downloadable SBOM is available for advanced security analysis in external systems, enabling integration with enterprise vulnerability management tools
+- **Automated Weekly Security Scan:** Artemis performs regular security analysis of all dependencies and proactively notifies administrators via email when issues are detected, ensuring timely awareness of potential vulnerabilities
+
 
 
 ### Monitoring, Incident Response, and Security Operations

build.gradle

@@ -29,6 +29,7 @@ plugins {
     id "org.springdoc.openapi-gradle-plugin" version "1.9.0"
     id "org.openapi.generator" version "7.18.0"
     id "com.google.osdetector" version "1.7.3"
+    id "org.cyclonedx.bom" version "3.1.0"
 }
 
 group = "de.tum.cit.aet.artemis"
@@ -53,6 +54,7 @@ node {
 
 apply from: "gradle/liquibase.gradle"
 apply from: "gradle/spotless.gradle"
+apply from: "gradle/sbom.gradle"
 
 if (project.hasProperty("prod")) {
     apply from: "gradle/profile_prod.gradle"
@@ -157,6 +159,15 @@ configurations.configureEach {
     // required by JPlag, but not used in this project
     exclude group: "xalan", module: "serializer"
 
+    // we use jackson and want to exclude gson to avoid conflicts and security vulnerabilities
+    exclude group: "com.google.code.gson", module: "gson"
+
+    // we do not really use kotlin libraries, exclude to avoid conflicts and security vulnerabilities
+    exclude group: "org.jetbrains.kotlin", module: "kotlin-stdlib"
+    exclude group: "org.jetbrains.kotlin", module: "kotlin-stdlib-jdk7"
+    exclude group: "org.jetbrains.kotlin", module: "kotlin-stdlib-jdk8"
+    exclude group: "org.jetbrains.kotlin", module: "kotlin-stdlib-common"
+
     exclude group: "org.springframework.boot", module: "spring-boot-starter-cache"
     exclude group: "net.logstash.logback", module: "logstash-logback-encoder"
 
@@ -304,7 +315,7 @@ dependencies {
     // Support YML serialization and deserialization
     implementation "com.fasterxml.jackson.dataformat:jackson-dataformat-yaml:${fasterxml_version}"
 
-    // Avoid outdated version of netty to prevent security issues
+    // Avoid outdated version of json-smart to prevent security issues, we only use this as transitive dependency for third party dependencies
     implementation("net.minidev:json-smart") { version {strictly "2.6.0" } }
 
 
@@ -330,9 +341,6 @@ dependencies {
     implementation "org.apache.commons:commons-lang3:${commons_lang3_version}"
     implementation "org.apache.commons:commons-collections4:4.5.0"
 
-    // required by eureka, but actually superseded by commons-lang3 above
-    implementation "commons-lang:commons-lang:2.6"
-
     implementation("org.liquibase:liquibase-core:${liquibase_version}") {
         exclude group: "com.opencsv", module: "opencsv"
     }
@@ -371,7 +379,6 @@ dependencies {
     implementation "com.webauthn4j:webauthn4j-spring-security-core:0.11.2.RELEASE"
     implementation "com.webauthn4j:webauthn4j-core:0.30.2.RELEASE"
 
-//    implementation "org.springframework.security:spring-security-data"
     implementation "org.springframework.security:spring-security-messaging"
     implementation "org.springframework.security:spring-security-ldap"
     // use newest version of nimbus-jose-jwt to avoid security issues through outdated dependencies
@@ -396,6 +403,7 @@ dependencies {
     implementation "org.bouncycastle:bcpkix-jdk18on:1.83"
     implementation "org.bouncycastle:bcprov-jdk18on:1.83"
 
+    // required for database connections
     implementation "com.mysql:mysql-connector-j:${mysql_version}"
     implementation "org.postgresql:postgresql:42.7.9"
 
@@ -416,11 +424,6 @@ dependencies {
 
     // use newest version of guava to avoid security issues through outdated dependencies
     implementation "com.google.guava:guava:33.5.0-jre"
-    implementation "com.sun.activation:jakarta.activation:2.0.1"
-
-    // use newest version of gson to avoid security issues through outdated dependencies
-    // NOTE: gson itself is not allowed in the Artemis code (based on architecture tests), but is used by dependencies (e.g. spring cloud eureka netflix)
-    implementation "com.google.code.gson:gson:2.13.2"
 
     // explicitly only use this at runtime (required by liquibase, because developers should prefer org.apache.commons:csv
     runtimeOnly "com.opencsv:opencsv:5.12.0"
@@ -579,3 +582,4 @@ tasks.named("dependencyUpdates").configure {
 // 13) Find unused dependencies                     ./gradlew lintGradle -x webapp
 // 14) Generate OpenAPI client services & DTOs:     ./gradlew openApiGenerate -x webapp (only relevant for tutorial groups and hyperion at the moment)
 // 15) Generate OpenAPI spec:                       ./gradlew generateApiDocs -x webapp (only relevant for tutorial groups and hyperion at the moment)
+// 16) Generate SBOM (Software Bill of Materials):  ./gradlew cyclonedxBom -x webapp

docker/broker-registry.yml

@@ -5,7 +5,7 @@
 services:
     jhipster-registry:
         container_name: artemis-jhipster-registry
-        image: docker.io/jhipster/jhipster-registry:v7.4.0
+        image: docker.io/jhipster/jhipster-registry:v7.5.0
         pull_policy: missing
         volumes:
             - ./registry:/central-config

gradle/sbom.gradle

@@ -0,0 +1,75 @@
+// CycloneDX SBOM Configuration
+// Plugin "org.cyclonedx.bom" must be declared in build.gradle plugins block
+
+// CycloneDX SBOM Configuration (v3.x API)
+tasks.cyclonedxDirectBom {
+    includeConfigs = ["runtimeClasspath"]
+    skipConfigs = ["testCompileClasspath", "testRuntimeClasspath", "checkstyle", "mockitoAgent", "liquibaseRuntime"]
+    projectType = "application"
+    includeBomSerialNumber = true
+    includeLicenseText = false
+    // Output configuration for v3.x - use file properties instead of destination/outputName/outputFormat
+    jsonOutput = file("build/reports/sbom/server-sbom.json")
+    // Disable XML output
+    xmlOutput.unsetConvention()
+}
+
+// Task to generate client SBOM using @cyclonedx/cyclonedx-npm
+tasks.register("generateClientSbom", NpmTask) {
+    dependsOn "npm_install"
+    args = ["run", "sbom:generate"]
+    description = "Generate CycloneDX SBOM for client-side npm dependencies"
+    group = "reporting"
+}
+
+// Task to generate both server and client SBOMs
+tasks.register("generateAllSbom") {
+    dependsOn "cyclonedxBom", "generateClientSbom"
+    description = "Generate CycloneDX SBOMs for both server and client dependencies"
+    group = "reporting"
+}
+
+// Copy SBOMs to resources for runtime access (if they exist)
+// This task copies pre-generated SBOMs without forcing regeneration
+tasks.register("copySbomsToResources") {
+    description = "Copy SBOM files to resources if they exist"
+    group = "build"
+
+    // If cyclonedxBom runs, it must run before this task
+    mustRunAfter "cyclonedxBom"
+
+    doLast {
+        def sbomDir = file("build/resources/main/sbom")
+        sbomDir.mkdirs()
+
+        def serverSbom = file("build/reports/sbom/server-sbom.json")
+        if (serverSbom.exists()) {
+            copy {
+                from serverSbom
+                into sbomDir
+            }
+            logger.lifecycle("Copied server SBOM to resources")
+        }
+
+        def clientSbom = file("build/reports/client-sbom.json")
+        if (clientSbom.exists()) {
+            copy {
+                from clientSbom
+                into sbomDir
+            }
+            logger.lifecycle("Copied client SBOM to resources")
+        }
+    }
+}
+
+// Ensure copySbomsToResources runs after processResources
+tasks.named("processResources") {
+    finalizedBy "copySbomsToResources"
+}
+
+// For production builds, generate both server and client SBOMs before copying
+if (project.hasProperty("prod")) {
+    tasks.named("copySbomsToResources") {
+        dependsOn "cyclonedxBom", "generateClientSbom"
+    }
+}