Merge pull request #127 from ProteGO-Safe/release/4.6.0

Release/4.6.0
ProteGO-Safe · Dec 8, 2021 · c66db26 · c66db26
2 parents a8013d3 + 463e869
commit c66db26
Show file tree

Hide file tree

Showing 36 changed files with 712 additions and 850 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -4,6 +4,18 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](http://keepachangelog.com/)
 and this project adheres to [Semantic Versioning](http://semver.org/).
 
+## 4.6.0
+
+### Added
+- Send slack information with the application push status on iOS and Android 
+
+### Changed
+- Add better parsing og the .csv files with COVID-19 and vaccination statistics
+- Notifications status divided into two operating systems
+
+### Fixed
+- Fix vulnerabilities
+
 ## 4.5.1
 
 ### Added

diff --git a/README.md b/README.md
@@ -128,4 +128,7 @@ Please check the following: [CERTIFICATIONS.md](./doc/certifications.md)
 
 TIPS:
 - Function name you can get from `src/index.ts` file. For example: `exports.generateCode = cloudFunctions.https(generateCode);` `generateCode` is function name. 
-- You can deploy many functions at once time. You must separate function names with `,`. Example: `firebase deploy --only functions:functionName1,functionName2` 
+- You can deploy many functions at once time. You must separate function names with `,`. Example: `firebase deploy --only functions:functionName1,functionName2` 
+
+## Running tests locally ##
+1) set env CLOUD_RUNTIME_CONFIG: '{"config":{"region":"europe-west1"}}', for example in the ~/.profile add `CLOUD_RUNTIME_CONFIG="{\"config\":{\"region\":\"europe-west1\"}}"; export CLOUD_RUNTIME_CONFIG`
diff --git a/efgs/downloader/owasp/suppressions.xml b/efgs/downloader/owasp/suppressions.xml
@@ -35,6 +35,7 @@
         <cve>CVE-2021-25329</cve>
         <cve>CVE-2020-9484</cve>
         <cve>CVE-2021-33037</cve>
+        <cve>CVE-2021-42340</cve>
     </suppress>
     <suppress>
         <packageUrl regex="true">^pkg:maven/org\.apache\.tomcat\.embed/tomcat\-embed\-websocket.*$</packageUrl>
@@ -45,36 +46,61 @@
         <cve>CVE-2021-25329</cve>
         <cve>CVE-2020-9484</cve>
         <cve>CVE-2021-33037</cve>
+        <cve>CVE-2021-42340</cve>
     </suppress>
     <suppress>
         <packageUrl regex="true">^pkg:maven/io\.netty/netty\-transport.*$</packageUrl>
         <cve>CVE-2021-21295</cve>
         <cve>CVE-2021-21409</cve>
+        <cve>CVE-2021-37136</cve>
+        <cve>CVE-2021-37137</cve>
     </suppress>
     <suppress>
         <packageUrl regex="true">^pkg:maven/io\.netty/netty\-codec.*$</packageUrl>
         <cve>CVE-2021-21295</cve>
         <cve>CVE-2021-21409</cve>
+        <cve>CVE-2021-37136</cve>
+        <cve>CVE-2021-37137</cve>
     </suppress>
     <suppress>
         <packageUrl regex="true">^pkg:maven/io\.netty/netty\-buffer.*$</packageUrl>
         <cve>CVE-2021-21295</cve>
         <cve>CVE-2021-21409</cve>
+        <cve>CVE-2021-37136</cve>
+        <cve>CVE-2021-37137</cve>
     </suppress>
     <suppress>
         <packageUrl regex="true">^pkg:maven/io\.netty/netty\-common.*$</packageUrl>
         <cve>CVE-2021-21295</cve>
         <cve>CVE-2021-21409</cve>
+        <cve>CVE-2021-37136</cve>
+        <cve>CVE-2021-37137</cve>
     </suppress>
     <suppress>
         <packageUrl regex="true">^pkg:maven/io\.netty/netty\-handler.*$</packageUrl>
         <cve>CVE-2021-21295</cve>
         <cve>CVE-2021-21409</cve>
+        <cve>CVE-2021-37136</cve>
+        <cve>CVE-2021-37137</cve>
+    </suppress>
+    <suppress>
+        <packageUrl regex="true">^pkg:maven/io\.netty\.incubator/netty\-incubator\-codec\-quic.*$</packageUrl>
+        <cve>CVE-2019-16869</cve>
+        <cve>CVE-2015-2156</cve>
+        <cve>CVE-2021-37136</cve>
+        <cve>CVE-2014-3488</cve>
+        <cve>CVE-2021-37137</cve>
+        <cve>CVE-2019-20445</cve>
+        <cve>CVE-2019-20444</cve>
+        <cve>CVE-2021-21295</cve>
+        <cve>CVE-2021-21409</cve>
     </suppress>
     <suppress>
         <packageUrl regex="true">^pkg:maven/io\.netty/netty\-resolver.*$</packageUrl>
         <cve>CVE-2021-21295</cve>
         <cve>CVE-2021-21409</cve>
+        <cve>CVE-2021-37136</cve>
+        <cve>CVE-2021-37137</cve>
     </suppress>
     <suppress>
         <packageUrl regex="true">^pkg:maven/ch\.qos\.logback\.contrib/logback\-json\-core.*$</packageUrl>

diff --git a/efgs/downloader/pom.xml b/efgs/downloader/pom.xml
@@ -18,7 +18,7 @@
         <dependency>
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-starter-web</artifactId>
-            <version>2.5.2</version>
+            <version>2.5.6</version>
         </dependency>
         <dependency>
             <groupId>org.springframework.cloud</groupId>
@@ -28,27 +28,27 @@
         <dependency>
             <groupId>org.springframework.cloud</groupId>
             <artifactId>spring-cloud-function-adapter-gcp</artifactId>
-            <version>3.1.3</version>
+            <version>3.1.4</version>
         </dependency>
         <dependency>
             <groupId>com.fasterxml.jackson.core</groupId>
             <artifactId>jackson-databind</artifactId>
-            <version>2.12.0</version>
+            <version>2.13.0</version>
         </dependency>
         <dependency>
             <groupId>com.fasterxml.jackson.core</groupId>
             <artifactId>jackson-core</artifactId>
-            <version>2.12.0</version>
+            <version>2.13.0</version>
         </dependency>
         <dependency>
             <groupId>com.fasterxml.jackson.core</groupId>
             <artifactId>jackson-annotations</artifactId>
-            <version>2.12.0</version>
+            <version>2.13.0</version>
         </dependency>
         <dependency>
             <groupId>com.fasterxml.jackson.module</groupId>
             <artifactId>jackson-module-parameter-names</artifactId>
-            <version>2.12.0</version>
+            <version>2.13.0</version>
         </dependency>
         <dependency>
             <groupId>com.google.guava</groupId>
@@ -73,27 +73,27 @@
         <dependency>
             <groupId>org.springframework</groupId>
             <artifactId>spring-web</artifactId>
-            <version>5.3.9</version>
+            <version>5.3.12</version>
         </dependency>
         <dependency>
             <groupId>org.springframework</groupId>
             <artifactId>spring-webflux</artifactId>
-            <version>5.3.9</version>
+            <version>5.3.12</version>
         </dependency>
         <dependency>
             <groupId>io.projectreactor.netty</groupId>
             <artifactId>reactor-netty</artifactId>
-            <version>0.9.8.RELEASE</version>
+            <version>1.0.12</version>
         </dependency>
         <dependency>
             <groupId>com.google.cloud</groupId>
             <artifactId>google-cloud-pubsub</artifactId>
-            <version>1.113.5</version>
+            <version>1.114.7</version>
         </dependency>
         <dependency>
             <groupId>com.fasterxml.jackson.datatype</groupId>
             <artifactId>jackson-datatype-jsr310</artifactId>
-            <version>2.12.0</version>
+            <version>2.13.0</version>
         </dependency>
         <dependency>
             <groupId>org.slf4j</groupId>
@@ -103,17 +103,17 @@
         <dependency>
             <groupId>com.google.cloud</groupId>
             <artifactId>google-cloud-firestore</artifactId>
-            <version>2.6.1</version>
+            <version>3.0.6</version>
         </dependency>
         <dependency>
             <groupId>io.opencensus</groupId>
             <artifactId>opencensus-contrib-grpc-util</artifactId>
-            <version>0.28.2</version>
+            <version>0.28.3</version>
         </dependency>
         <dependency>
             <groupId>com.google.cloud</groupId>
             <artifactId>google-cloud-secretmanager</artifactId>
-            <version>1.6.4</version>
+            <version>2.0.4</version>
         </dependency>
         <dependency>
             <groupId>commons-io</groupId>
@@ -123,7 +123,7 @@
         <dependency>
             <groupId>org.springframework.security</groupId>
             <artifactId>spring-security-crypto</artifactId>
-            <version>5.5.1</version>
+            <version>5.5.3</version>
         </dependency>
         <dependency>
             <groupId>org.projectlombok</groupId>

diff --git a/efgs/uploader/owasp/suppressions.xml b/efgs/uploader/owasp/suppressions.xml
@@ -35,6 +35,7 @@
         <cve>CVE-2021-25329</cve>
         <cve>CVE-2020-9484</cve>
         <cve>CVE-2021-33037</cve>
+        <cve>CVE-2021-42340</cve>
     </suppress>
     <suppress>
         <packageUrl regex="true">^pkg:maven/org\.apache\.tomcat\.embed/tomcat\-embed\-websocket.*$</packageUrl>
@@ -45,36 +46,61 @@
         <cve>CVE-2021-25329</cve>
         <cve>CVE-2020-9484</cve>
         <cve>CVE-2021-33037</cve>
+        <cve>CVE-2021-42340</cve>
     </suppress>
     <suppress>
         <packageUrl regex="true">^pkg:maven/io\.netty/netty\-transport.*$</packageUrl>
         <cve>CVE-2021-21295</cve>
         <cve>CVE-2021-21409</cve>
+        <cve>CVE-2021-37136</cve>
+        <cve>CVE-2021-37137</cve>
     </suppress>
     <suppress>
         <packageUrl regex="true">^pkg:maven/io\.netty/netty\-codec.*$</packageUrl>
         <cve>CVE-2021-21295</cve>
         <cve>CVE-2021-21409</cve>
+        <cve>CVE-2021-37136</cve>
+        <cve>CVE-2021-37137</cve>
     </suppress>
     <suppress>
         <packageUrl regex="true">^pkg:maven/io\.netty/netty\-buffer.*$</packageUrl>
         <cve>CVE-2021-21295</cve>
         <cve>CVE-2021-21409</cve>
+        <cve>CVE-2021-37136</cve>
+        <cve>CVE-2021-37137</cve>
     </suppress>
     <suppress>
         <packageUrl regex="true">^pkg:maven/io\.netty/netty\-common.*$</packageUrl>
         <cve>CVE-2021-21295</cve>
         <cve>CVE-2021-21409</cve>
+        <cve>CVE-2021-37136</cve>
+        <cve>CVE-2021-37137</cve>
     </suppress>
     <suppress>
         <packageUrl regex="true">^pkg:maven/io\.netty/netty\-handler.*$</packageUrl>
         <cve>CVE-2021-21295</cve>
         <cve>CVE-2021-21409</cve>
+        <cve>CVE-2021-37136</cve>
+        <cve>CVE-2021-37137</cve>
+    </suppress>
+    <suppress>
+        <packageUrl regex="true">^pkg:maven/io\.netty\.incubator/netty\-incubator\-codec\-quic.*$</packageUrl>
+        <cve>CVE-2019-16869</cve>
+        <cve>CVE-2015-2156</cve>
+        <cve>CVE-2021-37136</cve>
+        <cve>CVE-2014-3488</cve>
+        <cve>CVE-2021-37137</cve>
+        <cve>CVE-2019-20445</cve>
+        <cve>CVE-2019-20444</cve>
+        <cve>CVE-2021-21295</cve>
+        <cve>CVE-2021-21409</cve>
     </suppress>
     <suppress>
         <packageUrl regex="true">^pkg:maven/io\.netty/netty\-resolver.*$</packageUrl>
         <cve>CVE-2021-21295</cve>
         <cve>CVE-2021-21409</cve>
+        <cve>CVE-2021-37136</cve>
+        <cve>CVE-2021-37137</cve>
     </suppress>
     <suppress>
         <packageUrl regex="true">^pkg:maven/ch\.qos\.logback\.contrib/logback\-json\-core.*$</packageUrl>