Feat/us47299 vulnerabilities

Dockerfile

@@ -9,7 +9,6 @@ ENV PIP_INSTALL="python3 -m pip install"
 ADD https://deb.nodesource.com/setup_14.x /tmp
 ADD https://dl.google.com/linux/direct/google-chrome-stable_current_amd64.deb /tmp
 ADD https://packages.microsoft.com/config/ubuntu/21.04/packages-microsoft-prod.deb /tmp
-ADD http://archive.ubuntu.com/ubuntu/pool/main/o/openssl/libssl1.1_1.1.1f-1ubuntu2_amd64.deb /tmp
 COPY dist/bzt*whl /tmp
 
 WORKDIR /tmp
@@ -26,7 +25,7 @@ RUN $PIP_INSTALL --user --upgrade pip pillow oauthlib pyjwt httplib2 numpy
 
 RUN $APT_UPDATE && $APT_INSTALL \
     unzip software-properties-common apt-transport-https \
-    openjdk-11-jdk xvfb siege apache2-utils ruby ruby-dev make nodejs locales tsung
+    openjdk-11-jdk xvfb siege apache2-utils ruby ruby-dev make nodejs locales tsung dotnet-sdk-6.0
 
 # firefox repo - do not use snap
 RUN printf '%s\n' 'Package: firefox*' 'Pin: release o=Ubuntu*' 'Pin-Priority: -1' > /etc/apt/preferences.d/firefox-no-snap
@@ -37,7 +36,7 @@ RUN $APT_UPDATE && $APT_INSTALL firefox
 RUN locale-gen "en_US.UTF-8" && update-locale LANG=en_US.UTF-8 LC_ALL=en_US.UTF-8
 
 # Force cgi version to fix CVE-2021-41816 -> updated to 0.2.1
-RUN gem install rspec rake selenium-webdriver cgi:0.2.1 && gem update bundler date && gem cleanup \
+RUN gem install rspec rake selenium-webdriver cgi:0.3.5 && gem update bundler date && gem cleanup \
     && rm /usr/lib/ruby/gems/3.0.0/specifications/default/cgi-0.2.0.gemspec \
     && rm /usr/lib/ruby/gems/3.0.0/specifications/default/bundler-2.2.22.gemspec \
     && rm /usr/lib/ruby/gems/3.0.0/specifications/default/date-3.1.0.gemspec
@@ -47,13 +46,6 @@ RUN gem install rspec rake selenium-webdriver cgi:0.2.1 && gem update bundler da
 RUN $APT_INSTALL ./google-chrome-stable_current_amd64.deb \
   && mv /opt/google/chrome/google-chrome /opt/google/chrome/_google-chrome
 
-# Get .NET Core
-RUN dpkg -i libssl1.1_1.1.1f-1ubuntu2_amd64.deb
-RUN $APT_INSTALL ./packages-microsoft-prod.deb \
-   # Update is required because packages-microsoft-prod.deb installation add repositories for dotnet
-   && $APT_UPDATE \
-   && $APT_INSTALL dotnet-sdk-3.1
-
 # Install K6
 RUN $APT_INSTALL gpg-agent \
   && gpg -k \

bzt/modules/java/executors.py

@@ -23,7 +23,7 @@
 from bzt.modules.functional import FuncSamplesReader
 from bzt.modules.jmeter import JTLReader
 from bzt.utils import get_full_path, shell_exec, TclLibrary, JavaVM, BetterDict, get_assembled_value
-from .tools import SeleniumServer, Hamcrest, Json, TaurusJavaHelper, JavaC, JUnitJupiterApi, JUnitJupiterEngine
+from .tools import Hamcrest, Json, TaurusJavaHelper, JavaC, JUnitJupiterApi, JUnitJupiterEngine
 from .tools import JUnitPlatformCommons, JUnitPlatformLauncher, JUnitPlatformEngine, JUnitPlatformRunner
 from .tools import JUnitPlatformSuiteApi, JUnitVintageEngine, ApiGuardian, JUnit, OpenTest4j, TestNG
 
@@ -46,7 +46,6 @@ def __init__(self):
         self.report_file_suffix = ".ldjson"
 
     def install_required_tools(self):
-        self._add_jar_tool(SeleniumServer, config=self.settings.get("selenium-server"))
         self._add_jar_tool(Hamcrest, config=self.settings.get("hamcrest-core"))
         self._add_jar_tool(Json, config=self.settings.get("json-jar"))
         self._add_jar_tool(TaurusJavaHelper)

bzt/modules/java/tools.py

@@ -76,55 +76,6 @@ def check_if_installed(self):
         return True
 
 
-class SeleniumServer(RequiredTool):
-    VERSION = "3.141"
-    REMOTE_ADDR = "http://selenium-release.storage.googleapis.com/"
-    REMOTE_PATH = "{short_version}/selenium-server-standalone-{full_version}.jar"
-    TOOL_FILE = "selenium-server-{version}.jar"
-
-    def __init__(self, config, **kwargs):
-        if not isinstance(config, dict):
-            config = BetterDict.from_dict({"path": config})
-
-        version = config.get("version", self.VERSION)
-        version = str(version).split('.')
-        # 3.141.59 version
-        version.extend(['59'] * (3 - len(version)))
-        short_version = '.'.join(version[:2])   # 2 elements
-        full_version = '.'.join(version)        # 3+ elements
-
-        remote_path = config.get("remote-path", self.REMOTE_PATH)
-        remote_path = remote_path.format(short_version=short_version, full_version=full_version)
-
-        tool_file = config.get("tool-file", self.TOOL_FILE)
-        tool_file = tool_file.format(version=full_version)
-
-        local_path = config.get("path", JarTool.LOCAL_PATH)
-        local_path = local_path.format(tool_file=tool_file)
-
-        download_link = config.get("download-link", JarTool.URL)
-        download_link = download_link.format(remote_addr=self.REMOTE_ADDR, remote_path=remote_path)
-
-        super(SeleniumServer, self).__init__(
-            tool_path=local_path,
-            download_link=download_link,
-            version=full_version,
-            **kwargs)
-
-    def check_if_installed(self):
-        self.log.debug("Trying %s: %s", self.tool_name, self.tool_path)
-        try:
-            out, err = self.call(["java", "-jar", self.tool_path, "-help"])
-        except CALL_PROBLEMS as exc:
-            self.log.warning("%s check failed: %s", self.tool_name, exc)
-            return False
-
-        if err:
-            out += err
-        self.log.debug("%s output: %s", self.tool_name, out)
-        return True
-
-
 class Json(JarTool):
     REMOTE_PATH = "org/json/json/20160810/json-20160810.jar"
     TOOL_FILE = "json.jar"

bzt/modules/javascript.py

@@ -330,7 +330,7 @@ def install(self):
 
 
 class Mocha(NPMPackage):
-    PACKAGE_NAME = "mocha@9.2.2"
+    PACKAGE_NAME = "mocha@10.1.0"
 
 
 class JSSeleniumWebdriver(NPMPackage):

bzt/modules/jmeter.py

@@ -1582,9 +1582,9 @@ def _get_jar_fixes(self, lib_dir):
         affected_components = {
             # Needs to be <1.4.18 for old Jmeters https://stackoverflow.com/questions/30812293/com-thoughtworks-xstream-security-forbiddenclassexception
             "xstream": "com/thoughtworks/xstream/xstream/1.4.20/xstream-1.4.20.jar",
-            "jackson-annotations": "com/fasterxml/jackson/core/jackson-annotations/2.14.1/jackson-annotations-2.14.1.jar",
-            "jackson-core": "com/fasterxml/jackson/core/jackson-core/2.14.1/jackson-core-2.14.1.jar",
-            "jackson-databind": "com/fasterxml/jackson/core/jackson-databind/2.14.1/jackson-databind-2.14.1.jar",
+            "jackson-annotations": "com/fasterxml/jackson/core/jackson-annotations/2.15.0/jackson-annotations-2.15.0.jar",
+            "jackson-core": "com/fasterxml/jackson/core/jackson-core/2.15.0/jackson-core-2.15.0.jar",
+            "jackson-databind": "com/fasterxml/jackson/core/jackson-databind/2.15.0/jackson-databind-2.15.0.jar",
             "json-smart": "net/minidev/json-smart/2.4.8/json-smart-2.4.8.jar",
             "jsoup": "org/jsoup/jsoup/1.15.3/jsoup-1.15.3.jar",
             "snakeyaml": "org/yaml/snakeyaml/2.0/snakeyaml-2.0.jar",

examples/all-executors.yml

@@ -39,22 +39,6 @@ execution:
       - url: http://localhost:8000/
         label: Selenium Chrome
 
-- executor: selenium  # Selenium_JUnit
-  concurrency: 1
-  hold-for: 10s
-  iterations: 10
-  runner: junit
-  scenario:
-    script: BOOTH1/Blazedemo.java
-
-- executor: selenium  # Selenium_TestNG
-  concurrency: 1
-  hold-for: 10s
-  iterations: 10
-  runner: testng
-  scenario:
-    script: selenium/TestNGExample.java
-
 ---
 execution:
 - executor: selenium  # Selenium Ruby
@@ -78,13 +62,6 @@ execution:
   scenario:
     script: functional/JUnitTest.java
 
-- executor: testng  # testTestNG
-  concurrency: 1
-  hold-for: 10s
-  iterations: 10
-  scenario:
-    script: functional/TestNGTest.java
-
 - executor: rspec  # Ruby test
   concurrency: 1
   hold-for: 10s
@@ -106,20 +83,6 @@ execution:
   scenario:
     script: functional/test_nose.py
 
-- executor: nunit  # IsFive_ExistingVariable_ReturnFive - 10 samples
-  concurrency: 1
-  hold-for: 10s
-  iterations: 10
-  scenario:
-    script: selenium/dotnet/NUnitTests.dll
-
-- executor: xunit  # IsFive_ExistingVariable_ReturnFive - 10 more samples
-  concurrency: 1
-  hold-for: 10s
-  iterations: 10
-  scenario:
-    script: selenium/dotnet/XUnitTests.dll
-
 - executor: pytest  # test_Pytest x2
   concurrency: 1
   hold-for: 10s

tests/resources/selenium/invalid/NotJUnittest.java

@@ -1,8 +1,3 @@
-import org.openqa.selenium.By;
-import org.openqa.selenium.WebDriver;
-import org.openqa.selenium.WebElement;
-import org.openqa.selenium.firefox.FirefoxDriver;
-
 public class NotJUnittest  {
     public static void main(String[] args) {
     }

tests/unit/modules/_selenium/test_java.py

@@ -9,7 +9,7 @@
 from bzt.modules.functional import FunctionalAggregator, FuncSamplesReader
 from bzt.modules.java import JUnitTester, TestNGTester
 from bzt.modules.java.executors import JavaTestRunner
-from bzt.modules.java.tools import JavaC, JarTool, Hamcrest, SeleniumServer
+from bzt.modules.java.tools import JavaC, JarTool, Hamcrest
 from bzt.modules.jmeter import JTLReader
 from bzt.modules._selenium import SeleniumExecutor
 from bzt.utils import ToolError
@@ -87,8 +87,6 @@ def test_install_tools(self):
         for tool in jar_tools:
             msg = "Wrong path to {tool}: {path}".format(tool=str(tool), path=str(tool.tool_path))
             self.assertTrue(os.path.isfile(tool.tool_path), msg)
-            if isinstance(tool, SeleniumServer):
-                self.assertEqual(tool.version, "9.9.0")
 
 
 class TestJavaC(BZTestCase):