Merge pull request #7 from oauth-io/fix/address-log4j-rce

fix(security): ensure updated transitive dep for log4j

Author: Victor Adossi

pom.xml

@@ -150,8 +150,8 @@
         <artifactId>maven-compiler-plugin</artifactId>
         <version>2.3.2</version>
         <configuration>
-          <source>1.6</source>
-          <target>1.6</target>
+          <source>1.7</source>
+          <target>1.7</target>
         </configuration>
       </plugin>
       <plugin>
@@ -164,7 +164,31 @@
           <nodeprecated>true</nodeprecated>
         </configuration>
       </plugin>
-    </plugins>
+
+      <!-- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44228 -->
+      <plugin>
+        <groupId>org.apache.maven.plugins</groupId>
+        <artifactId>maven-enforcer-plugin</artifactId>
+        <version>3.0.0</version>
+        <executions>
+          <execution>
+            <id>enforce</id>
+            <goals>
+              <goal>enforce</goal>
+            </goals>
+            <configuration>
+              <rules>
+                <bannedDependencies>
+                  <excludes>
+                    <exclude>org.apache.logging.log4j:log4j-core:(,2.16.0)</exclude>
+                  </excludes>
+                </bannedDependencies>
+              </rules>
+            </configuration>
+          </execution>
+        </executions>
+      </plugin>
+  </plugins>
   </build>
   <dependencies>
     <dependency>
@@ -221,13 +245,28 @@
       <scope>test</scope>
     </dependency>
   </dependencies>
+
+  <dependencyManagement>
+    <dependencies>
+      <dependency>
+        <groupId>org.apache.logging.log4j</groupId>
+        <artifactId>log4j-bom</artifactId>
+        <version>${log4j-version}</version>
+        <scope>import</scope>
+        <type>pom</type>
+      </dependency>
+    </dependencies>
+  </dependencyManagement>
+
   <properties>
     <swagger-annotations-version>1.5.3-M1</swagger-annotations-version>
     <jersey-version>1.18</jersey-version>
     <jackson-version>2.10.0.pr1</jackson-version>
     <jodatime-version>2.3</jodatime-version>
     <maven-plugin-version>1.0.0</maven-plugin-version>
     <junit-version>4.8.1</junit-version>
+    <!-- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44228 -->
+    <log4j-version>2.16.0</log4j-version>
     <!-- github server corresponds to entry in ~/.m2/settings.xml -->
     <github.global.server>github</github.global.server>
   </properties>