Skip to content

Create simple Java application for dependency scanning and static analysis

Conley Rogersrequested to merge
feature/simple-java-app into main

This merge request implements the requirements from issue #1 (closed) to create the simplest Java application possible for showcasing dependency scanning and static reachability analysis with GitLab.

What's included:

Application Code

  • App.java: Main application class with basic functionality (Hello World, time formatting, list operations, calculations)
  • Utils.java: Utility class that uses external dependencies for dependency scanning analysis
  • UtilsTest.java: Unit tests using JUnit to ensure code quality

Build Configuration

  • pom.xml: Maven configuration with common dependencies including:
    • Jackson Databind 2.12.3 (JSON processing - may have vulnerabilities)
    • Apache Commons Lang3 3.12.0 (utility functions)
    • SLF4J + Logback (logging framework)
    • JUnit 4.13.2 (testing)

CI/CD & Security

  • .gitlab-ci.yml: GitLab CI/CD pipeline with security scanning enabled:
    • Dependency Scanning
    • SAST (Static Application Security Testing)
    • Secret Detection
    • Build and test stages

Documentation

  • README.md: Updated with project documentation, build instructions, and security scanning information

Security Analysis Ready

This application is specifically designed to trigger GitLab's security features:

  • Uses dependencies with potential vulnerabilities for dependency scanning
  • Multiple classes and method calls for static reachability analysis
  • Java code patterns for SAST analysis

Closes #1 (closed)

Merge request reports