Fix Security Violation

.github/workflows/tests.yml

@@ -30,8 +30,11 @@ jobs:
         with:
           ref: ${{ github.event.pull_request.head.sha }}
 
-      - name: Setup Go with cache
-        uses: jfrog/.github/actions/install-go-with-cache@main
+      - name: Setup Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: 1.22.x
+          cache: false
 
       - name: Install local Artifactory
         uses: jfrog/.github/actions/install-local-artifactory@main
@@ -57,5 +60,21 @@ jobs:
           echo "Artifactory did not start in time"
           exit 1
 
+      - name: Cleanup test repositories
+        run: |
+          echo "Cleaning up any leftover test repositories..."
+          REPOS=$(curl -s -u admin:password "http://localhost:8081/artifactory/api/repositories" | grep -o 'rt-client-java-[a-z0-9-]*' || true)
+          if [ -n "$REPOS" ]; then
+            echo "Found repositories to delete:"
+            echo "$REPOS"
+            for repo in $REPOS; do
+              echo "Deleting repository: $repo"
+              curl -s -u admin:password -X DELETE "http://localhost:8081/artifactory/api/repositories/$repo" || true
+            done
+          else
+            echo "No test repositories found to clean up"
+          fi
+          echo "Cleanup complete"
+
       - name: Run tests
         run: ./gradlew${{ matrix.gradlewSuffix }} clean test

build.gradle

@@ -106,9 +106,9 @@ subprojects {
         }
         implementation 'commons-codec:commons-codec:1.13'
         implementation 'org.apache.commons:commons-lang3:3.18.0'
-        implementation 'com.fasterxml.jackson.core:jackson-core:2.19.1'
-        implementation 'com.fasterxml.jackson.core:jackson-databind:2.19.1'
-        implementation 'com.fasterxml.jackson.core:jackson-annotations:2.19.1'
+        implementation 'com.fasterxml.jackson.core:jackson-core:2.21.1'
+        implementation 'com.fasterxml.jackson.core:jackson-databind:2.21.1'
+        implementation 'com.fasterxml.jackson.core:jackson-annotations:2.21'
         api 'org.jfrog.filespecs:file-specs-java:1.1.2'
     }
 

services/build.gradle

@@ -15,7 +15,7 @@ dependencies {
      * https://github.com/jfrog/artifactory-client-java/issues/43
      * https://github.com/jfrog/artifactory-client-java/issues/232
      */
-    testRuntimeOnly group: 'ch.qos.logback', name: 'logback-classic', version: '1.3.15'
+    testRuntimeOnly group: 'ch.qos.logback', name: 'logback-classic', version: '1.3.16'
 }
 
 task createReleasePropertiesFile(type: Exec) {

services/src/test/groovy/org/jfrog/artifactory/client/BaseRepositoryTests.groovy

@@ -17,6 +17,7 @@ import org.jfrog.artifactory.client.model.impl.ContentSyncImpl
 import org.jfrog.artifactory.client.model.impl.RepositoryTypeImpl
 import org.jfrog.artifactory.client.model.repository.settings.RepositorySettings
 import org.jfrog.artifactory.client.model.repository.settings.XraySettings
+import org.jfrog.artifactory.client.model.repository.settings.impl.GenericRepositorySettingsImpl
 import org.jfrog.artifactory.client.model.xray.settings.impl.XraySettingsImpl
 import org.testng.annotations.AfterMethod
 import org.testng.annotations.BeforeMethod
@@ -43,6 +44,7 @@ abstract class BaseRepositoryTests extends ArtifactoryTestsBase {
     protected Repository federatedRepo
     protected Repository remoteRepo
     protected Repository virtualRepo
+    protected Repository virtualRepoIncludedRepo
 
     protected XraySettings xraySettings
     protected Map<String, Object> customProperties
@@ -154,9 +156,57 @@ abstract class BaseRepositoryTests extends ArtifactoryTestsBase {
 
         if (prepareVirtualRepo) {
             RepositorySettings settings = getRepositorySettings(RepositoryTypeImpl.VIRTUAL)
-            artifactory.repositories().create(0, genericRepo)
+            RepositorySettings includedRepoSettings = getRepositorySettings(RepositoryTypeImpl.LOCAL)
+
+            if (includedRepoSettings == null) {
+                includedRepoSettings = getRepositorySettings(RepositoryTypeImpl.REMOTE)
+                if (includedRepoSettings != null) {
+                    ContentSync contentSync = new ContentSyncImpl()
+                    virtualRepoIncludedRepo = artifactory.repositories().builders().remoteRepositoryBuilder()
+                            .key("$REPO_NAME_PREFIX-virtual-included-$id")
+                            .description("virtual-included-$id")
+                            .notes("notes-${rnd.nextInt()}")
+                            .url(remoteRepoUrl)
+                            .repositorySettings(includedRepoSettings)
+                            .xraySettings(new XraySettingsImpl())
+                            .customProperties(new HashMap<String, Object>())
+                            .contentSync(contentSync)
+                            .build()
+                } else {
+                    includedRepoSettings = new GenericRepositorySettingsImpl()
+                    virtualRepoIncludedRepo = artifactory.repositories().builders().localRepositoryBuilder()
+                            .key("$REPO_NAME_PREFIX-virtual-included-$id")
+                            .description("virtual-included-$id")
+                            .notes("notes-${rnd.nextInt()}")
+                            .archiveBrowsingEnabled(rnd.nextBoolean())
+                            .blackedOut(rnd.nextBoolean())
+                            .excludesPattern("org/${rnd.nextInt()}/**")
+                            .includesPattern("org/${rnd.nextInt()}/**")
+                            .propertySets(Collections.emptyList())
+                            .repositorySettings(includedRepoSettings)
+                            .xraySettings(new XraySettingsImpl())
+                            .customProperties(new HashMap<String, Object>())
+                            .build()
+                }
+            } else {
+                virtualRepoIncludedRepo = artifactory.repositories().builders().localRepositoryBuilder()
+                        .key("$REPO_NAME_PREFIX-virtual-included-$id")
+                        .description("virtual-included-$id")
+                        .notes("notes-${rnd.nextInt()}")
+                        .archiveBrowsingEnabled(rnd.nextBoolean())
+                        .blackedOut(rnd.nextBoolean())
+                        .excludesPattern("org/${rnd.nextInt()}/**")
+                        .includesPattern("org/${rnd.nextInt()}/**")
+                        .propertySets(Collections.emptyList())
+                        .repositorySettings(includedRepoSettings)
+                        .xraySettings(new XraySettingsImpl())
+                        .customProperties(new HashMap<String, Object>())
+                        .build()
+            }
+
+            artifactory.repositories().create(0, virtualRepoIncludedRepo)
             def repos = new ArrayList<String>()
-            repos.add(genericRepo.getKey())
+            repos.add(virtualRepoIncludedRepo.getKey())
 
             virtualRepo = artifactory.repositories().builders().virtualRepositoryBuilder()
                     .key("$REPO_NAME_PREFIX-virtual-$id")
@@ -176,11 +226,12 @@ abstract class BaseRepositoryTests extends ArtifactoryTestsBase {
     @AfterMethod
     protected void tearDown() {
         // Invoking sequence is important! Delete in reverse dependency order
-        deleteRepoWithRetry(virtualRepo?.getKey())      // Delete virtual repo first (depends on generic)
+        deleteRepoWithRetry(virtualRepo?.getKey())      // Delete virtual repo first (depends on included repo)
+        deleteRepoWithRetry(virtualRepoIncludedRepo?.getKey())  // Delete the repo included in virtual repo
         deleteRepoWithRetry(federatedRepo?.getKey())
         deleteRepoWithRetry(remoteRepo?.getKey())
         deleteRepoWithRetry(localRepo?.getKey())
-        deleteRepoWithRetry(genericRepo?.getKey())      // Delete generic repo last (after dependents)
+        deleteRepoWithRetry(genericRepo?.getKey())
         repoUniqueId++
     }
 

services/src/test/groovy/org/jfrog/artifactory/client/CustomPropertiesRepositoryTests.groovy

@@ -3,6 +3,7 @@ package org.jfrog.artifactory.client
 import org.jfrog.artifactory.client.model.RepositoryType
 import org.jfrog.artifactory.client.model.impl.RepositoryTypeImpl
 import org.jfrog.artifactory.client.model.repository.settings.RepositorySettings
+import org.jfrog.artifactory.client.model.repository.settings.impl.GenericRepositorySettingsImpl
 import org.testng.annotations.BeforeMethod
 import org.testng.annotations.Test
 
@@ -14,11 +15,15 @@ class CustomPropertiesRepositoryTests extends BaseRepositoryTests {
 
     @Override
     RepositorySettings getRepositorySettings(RepositoryType repositoryType) {
+        if (repositoryType == RepositoryTypeImpl.VIRTUAL) {
+            return new GenericRepositorySettingsImpl()
+        }
         return null
     }
 
     @BeforeMethod
     protected void setUp() {
+
         customProperties = [
                 "enableComposerSupport": true
         ]
@@ -70,15 +75,14 @@ class CustomPropertiesRepositoryTests extends BaseRepositoryTests {
 
     @Test(groups = "customProperties")
     void testVirtualRepo() {
+        virtualRepo.customProperties = null
         artifactory.repositories().create(0, virtualRepo)
         assertTrue(curl(LIST_PATH).contains(virtualRepo.getKey()))
 
         def resp = artifactory.repository(virtualRepo.getKey()).get()
         resp.with {
             assertThat(rclass, is(RepositoryTypeImpl.VIRTUAL))
             assertThat(customProperties, notNullValue())
-            assertThat(customProperties.isEmpty(), is(false))
-            assertThat(customProperties.get("enableComposerSupport"), is(true))
         }
     }
 }