Can SonarQube be used for SAST for a dot net core version 3.2 application? - jenkins

For a dot net core 3.2 application, can we use SonarQube for Static Application Security Testing (SAST)? If not, then what could be the alternatives.
I am from the Java background and I am aware that plugins like FindSecBugs can be used with SonarQube for Java source code.
Thanks.

SonarQube does SAST for a number of languages, including C# and Java.
Links to the security-related rules for C#: Vulnerabilities and Security Hotspots.
Other useful links:
https://docs.sonarqube.org/latest/user-guide/security-rules/
https://www.sonarqube.org/features/security/

Related

Is vaadin Java UI framework is supported by quarkus framework

I want to use the vaadin UI java framework in my quarkus framework, But I am unsuccessful in that. when I am loading any static resources(CSS, js, etc..) files it is not getting loaded And I guess not even default CSS is getting applied to the UI components, I am new to this framework, If anyone wants to suggest, please.
Here is the sample demo UI project which I am trying to implement.
[https://harshithpawarg#bitbucket.org/harshithpawarg/quarkus_vaadin.git][1]
run Command: $. mvn clean install && mvn compile quarkus:dev -pl ui
Vaadin is working on an integration with Quarkus. The target version is Vaadin 22. They might already have something running on Vaadin 21.
The current work can be seen in the GitHub repository of the extension and the repository of the project base.
Update: Vaadin 22 is released as a non-LTS version and integrates Quarkus.
As far as I know, Vaadin doesn't yet support Quarkus (see https://github.com/vaadin/flow/issues/5485).
However, experimental Quarkus extensions to use Vaadin with Quarkus are available here and here.
Why don’t you make a Quarkus backend and another Java project with Vaadin which communicates via Rest with the backend ?
I was able to get Vaadin 14 (vaadin-demo-business-app) working as native image in production mode using the quarkus-vaadin-lib example.
I did use the native-image-agent to generate the META-INF/native-image json files and added wildcard entries in resource-config.json
{
"resources":[
{"pattern":"META-INF/VAADIN.*"},
{"pattern":"META-INF/resources.*"},
Only dev mode is harder, when running in Quarkus the browser can't resolve the frontend through webpack:// and webpack-internal:// and I do not know how to achieve this.
But this can work as long as you can keep the modules using Vaadin compatible to run as normal war, and compile the end product into a Quarkus+GraalVM executable. Only you can't use Quarkus specific code in the web ui modules then which still makes it all a bit hacky.

JMX Monitoring using jboss-cli

We have an application which used JBoss 4.2.3.GA and we are migrating it to WildFly 8.2. In the old implementation, the JMX monitoring was done using twiddle. Since twiddle doesn't exist in WildFly, we are using the JBoss CLI for JMX monitoring.
Is it the right approach to use the JBoss CLI for JMX monitoring? Are there any command line tools similar to twiddle which can be used for JMX monitoring in WildFly?
One option to get something similar would be to simply query the JMX MBeans programmatically yourself. The advantage here is that your solution can be reused without depending on things like Twiddle which may be discontinued and also are compatible with other app servers.
Here is an example using Groovy to query an MBean in Tomcat and here is an example using Java to query an MBean in ActiveMQ.
If you choose to go with Groovy, you should be aware that there is a way to use Groovy (or Javascript or Python) to wrap the CLI and have more of a control flow. The CLI is great for simple declarative things, but lacks the versatility of a proper scripting language.
If you want to use pure CLI, then that's fine too, but I would suggest you create files which you can then call through bash e.g.:
$JBOSS_HOME/bin/jboss-cli.sh -c --file="my-jvm-monitoring.cli"
You might find this CLI model reference useful and also this blog about monitoring WildFly with the CLI

Does standard library refer to the whole API or just a package? [duplicate]

This question's answers are a community effort. Edit existing answers to improve this post. It is not currently accepting new answers or interactions.
Which one should I install when I want to start learning Java? I'm going to start with some basics, so I will write simple programs that create files, directories, edit XML files and so on, nothing too complex for now.
I guess Java SE (Standard Edition) is the one I should install on my Windows 7 desktop. I already have Komodo IDE which I will use to write the Java code.
Java SE = Standard Edition. This is the core Java programming platform. It contains all of the libraries and APIs that any Java programmer should learn (java.lang, java.io, java.math, java.net, java.util, etc...).
Java EE = Enterprise Edition. From Wikipedia:
The Java platform (Enterprise Edition) differs from the Java Standard
Edition Platform (Java SE) in that it adds libraries which provide
functionality to deploy fault-tolerant, distributed, multi-tier Java
software, based largely on modular components running on an
application server.
In other words, if your application demands a very large scale, distributed system, then you should consider using Java EE. Built on top of Java SE, it provides libraries for database access (JDBC, JPA), remote method invocation (RMI), messaging (JMS), web services, XML processing, and defines standard APIs for Enterprise JavaBeans, servlets, portlets, Java Server Pages, etc...
Java ME = Micro Edition. This is the platform for developing applications for mobile devices and embedded systems such as set-top boxes. Java ME provides a subset of the functionality of Java SE, but also introduces libraries specific to mobile devices. Because Java ME is based on an earlier version of Java SE, some of the new language features introduced in Java 1.5 (e.g. generics) are not available.
If you are new to Java, definitely start with Java SE.
Here are some differences in terms of APIs
Java SE includes has the following APIs and many more
applet
awt
rmi
jdbc
swing
collections
xml binding
JavaFX (Merged to Java SE 8)
Java 8 Collections Streaming API
Java 9 Reactive Streams API
Java 9 HTTP/2 API
Java EE includes the following APIs and many more
servlet
websocket
java faces
dependency injection
ejb
persistence
transaction
jms
batch api
Java ME includes the following APIs and many more
Wireless Messaging
Java ME Web Services
Security and Trust Services API
Location
Mobile XML API
Hope this helps.
Java SE is the foundation on which Java EE is built.
Java ME is a subset of SE for mobile devices.
So you should install Java SE for your project.
According to the Oracle's documentation, there are actually four Java platforms:
Java Platform, Standard Edition (Java SE)
Java Platform, Enterprise Edition (Java EE)
Java Platform, Micro Edition (Java ME)
JavaFX
Java SE is for developing desktop applications and it is the foundation for developing in Java language. It consists of development tools, deployment technologies, and other class libraries and toolkits used in Java applications. Java EE is built on top of Java SE, and it is used for developing web applications and large-scale enterprise applications. Java ME is a subset of the Java SE. It provides an API and a small-footprint virtual machine for running Java applications on small devices. JavaFX is a platform for creating rich internet applications using a lightweight user-interface API. It is a recent addition to the family of Java platforms.
Strictly speaking, these platforms are specifications; they are norms, not software.
The Java Platform, Standard Edition Development Kit (JDK) is an official implementation
of the Java SE specification, provided by Oracle. There are also other implementations, like OpenJDK and IBM's J9.
People new to Java download a JDK for their platform and operating system (Oracle's JDK is available for download
here.)
As I come across this question, I found the information provided on the Oracle's tutorial very complete and worth to share:
The Java Programming Language Platforms
There are four platforms of the Java programming language:
Java Platform, Standard Edition (Java SE)
Java Platform, Enterprise Edition (Java EE)
Java Platform, Micro Edition (Java ME)
JavaFX
All Java platforms consist of a Java Virtual Machine (VM) and an
application programming interface (API). The Java Virtual Machine is a
program, for a particular hardware and software platform, that runs
Java technology applications. An API is a collection of software
components that you can use to create other software components or
applications. Each Java platform provides a virtual machine and an
API, and this allows applications written for that platform to run on
any compatible system with all the advantages of the Java programming
language: platform-independence, power, stability,
ease-of-development, and security.
Java SE
When most people think of the Java programming language, they think of
the Java SE API. Java SE's API provides the core functionality of the
Java programming language. It defines everything from the basic types
and objects of the Java programming language to high-level classes
that are used for networking, security, database access, graphical
user interface (GUI) development, and XML parsing.
In addition to the core API, the Java SE platform consists of a
virtual machine, development tools, deployment technologies, and other
class libraries and toolkits commonly used in Java technology
applications.
Java EE
The Java EE platform is built on top of the Java SE platform. The Java
EE platform provides an API and runtime environment for developing and
running large-scale, multi-tiered, scalable, reliable, and secure
network applications.
Java ME
The Java ME platform provides an API and a small-footprint virtual
machine for running Java programming language applications on small
devices, like mobile phones. The API is a subset of the Java SE API,
along with special class libraries useful for small device application
development. Java ME applications are often clients of Java EE
platform services.
JavaFX
JavaFX is a platform for creating rich internet applications using a
lightweight user-interface API. JavaFX applications use
hardware-accelerated graphics and media engines to take advantage of
higher-performance clients and a modern look-and-feel as well as
high-level APIs for connecting to networked data sources. JavaFX
applications may be clients of Java EE platform services.
I guess Java SE (Standard Edition) is the one I should install on my
Windows 7 desktop
Yes, of course. Java SE is the best one to start with. BTW you must learn Java basics. That means you must learn some of the libraries and APIs in Java SE.
Difference between Java Platform Editions:
Java Micro Edition (Java ME):
Highly optimized runtime environment.
Target consumer products (Pagers, cell phones).
Java ME was formerly known as Java 2 Platform, Micro Edition or
J2ME.
Java Standard Edition (Java SE):
Java tools, runtimes, and APIs for developers writing, deploying, and running applets and applications. Java SE was formerly known as Java 2 Platform, Standard Edition or J2SE. (everyone/beginners starting from this)
Java Enterprise Edition(Java EE):
Targets enterprise-class server-side applications. Java EE was formerly known as Java 2 Platform, Enterprise Edition or J2EE.
Another duplicated question for this question.
Lastly, about J.. confusion
JVM (Java Virtual Machine):
JVM is a part of both the JDK and JRE that translates Java byte codes and executes them as native code on the client machine.
JRE (Java Runtime Environment):
It is the environment provided for the java programs to get executed. It contains a JVM, class libraries, and other supporting files. It does not contain any development tools such as compiler, debugger and so on.
JDK (Java Development Kit):
JDK contains tools needed to develop the java programs (javac, java, javadoc, appletviewer, jdb, javap, rmic,...) and JRE to run the program.
Java SDK (Java Software Development Kit):
SDK comprises a JDK and extra software, such as application servers, debuggers, and documentation.
Java SE:
Java platform, Standard Edition (Java SE) lets you develop and deploy Java applications on desktops and servers (same as SDK).
J2SE, J2ME, J2EE
Any Java edition from 1.2 to 1.5
Read more about these topics:
Differences between JDK and Java SDK
Java JDK, SDK, SE?
What is the difference between JVM, JDK, JRE & OpenJDK?
Yes, Java SE is where to start. All the tasks you mention can be handled with it.
Java ME is the Mobile Edition, and EE is Enterprise Edition; these are specialized / extended versions of Standard Edition.
Java SE (Standard Edition) is for building desktop apps.
Java ME (Micro Edition) is for old mobile devices.
Java EE (Enterprise Edition) is for developing web based applications.
Yes, you should start with Java SE. Java EE is for web applications and Java ME is for mobile applications--both of these build off of SE.
Developers use different editions of the Java platform to create Java programs that run on desktop
computers, web browsers, web servers, mobile information devices (such as feature phones), and
embedded devices (such as television set-top boxes).
Java Platform, Standard Edition (Java SE): The Java platform for developing
applications, which are stand-alone programs that run on desktops. Java SE is
also used to develop applets, which are programs that run in web browsers.
Java Platform, Enterprise Edition (Java EE): The Java platform for developing
enterprise-oriented applications and servlets, which are server programs that
conform to Java EE’s Servlet API. Java EE is built on top of Java SE.
Java Platform, Micro Edition (Java ME): The Java platform for developing
MIDlets, which are programs that run on mobile information devices, and Xlets,
which are programs that run on embedded devices.
If I were you I would install the Java SE SDK. Once it is installed make sure you have the JAVA_HOME environment variable set and add the %JAVA_HOME%\bin dir to your path.
Java SE is use for the desktop applications and simple core functions. Java EE is used for desktop, but also web development, networking, and advanced things.
EE:- Enterprise Edition:- This Java edition is specifically designed for enterprise applications/business where we have to deal with number of different servers with importance on security, transaction management etc.
SE:- Standard Edition:- This edition is for standard applications.
ME:- Micro Edition:- This java edition is specifically designed for mobile phone platforms. Where more importance is given on memory management as there is limited memory resources in mobiles .
So basically JAVA has different editions for different requirements.
The SE(JDK) has all the libraries you will ever need to cut your teeth on Java.
I recommend the Netbeans IDE as this comes bundled with the SE(JDK) straight from Oracle.
Don't forget to set "path" and "classpath" variables especially if you are going to try command line.
With a 64 bit system insert the "System Path" e.g. C:\Program Files (x86)\Java\jdk1.7.0 variable before the C:\Windows\system32; to direct the system to your JDK.
hope this helps.

How to correctly export a JSF 2.0 web application into war?

I have a JSF 2.0 web project and I use Glassfish 3.1.2 server. In this project, I have among other things :
a class called AjaxServlet annotated with #javax.servlet.annotation.WebServlet
a class called Session annotated with #javax.ejb.Stateful
When I deploy this project to Glassfish from eclipse, everything runs perfectly : in the administration console of Glassfish, the engines associated with the application are [ejb, jpa, web, weld]. But when I first export the project as a war, then from the admin console I deploy the war, the application doesn't work : the engines associated to the application are then [web] only.
How can I export an application to a war without loosing any information (all the engines)? I didn't declare my Servlet in web.xml because in JSF 2.0, we don't need that: the annotations are enough. Does anyone have an idea about what is going on here? I'm quite sure it is not a problem of Glassfish distributions (Web Profile Vs Full Platform) as the same Glassfish server is used for the 2 scenarios above.
Note for those who erroneously think my question is off-topic : Jsf is a framework for programming Java EE web applications. war is a way to package a Jsf application, in the same as jar is a way to package java classes. So my question is totally a programming topic! It is totally legitimate to have it here in StackOverflow. If exporting JSF application into war is not a programming issue, then compiling java classes into .class should not be a programming topic neither! So Pleaze don't downgrade for this reason!
You have to understand the difference between your eclipse environment and your glassfish environment. Not all your libraries that are available in eclipse might be included in your external environment. There are cases where programs compile in eclipse, but not when run from console.
Here's a tip:
Right click on project -> Navigate to Properties > Java Build Path > Order and Export, and ensure that all libraries you require are going to be exported.

Is there a simpler way to deploy to WebSphere?

I have seen this question about deploying to WebSphere using the WAS ant tasks.
Is there a simpler way to do this? In the past I have deployed to Tomcat by dropping a war file into a directory. I was hoping there would be a similar mechanism for WebSphere that doesn't involve calling the IBM libraries or rely on RAD to be installed on your workstation.
Just a hint: if you activate "Log command assistance commands" in System Administration / Console preferences, you will get a logfile in the server log directory that contains the jython scripts for all actions you did on the console. So you can just deploy your stuff per console the first time, and then grab the commands for later and feed them into wsadmin.bat -lang jython "thecommandscomehere" for the next deployment.
There is the concept of WebSphere Rapid Deployment. It's supposed to be the same experience as what you describe for Tomcat.
One way to do it could be using Jython or jacl scripts. See those samples at IBM site.
[EDIT] Especially the wsadminlib.py.zip download near the bottom of the page contains a huge set of examples and helper functions to get you started.
WAS does provide a client jar containing some custom ant tasks. However they seem to be extremely bugy and dont work with remote servers.
IBM ANT TASK Javadoc
Netbeans also has support for was 6 and 6.1 but this again is still quite buggy, however it can be useful for generating some the bindings files etc.

Resources