Skip to content

refactor: Migrate from JUnit 4 to JUnit 5#276

Open
matyik wants to merge 1 commit into
hms-dbmi:mainfrom
matyik:main
Open

refactor: Migrate from JUnit 4 to JUnit 5#276
matyik wants to merge 1 commit into
hms-dbmi:mainfrom
matyik:main

Conversation

@matyik

@matyik matyik commented Jul 17, 2026

Copy link
Copy Markdown

Upgrading to JUnit 5 offers a more standard architecture while not requiring a Java version bump like JUnit 6. This refactor will make future development cleaner without intruding on the project's original compatibility.

  • Enhancement made or issue fixed in the project: Migrated repo's testing from JUnit 4 to JUnit 5
  • Description of changes made to the project:
    Removed junit:junit (JUnit 4) dependencies. Added org.junit.jupiter:junit-jupiter (JUnit 5). Replaced JUnit 4 annotations with JUnit 5 annotations accordingly (@BeforeClass, @Before -> @BeforeAll, @BeforeEach)
    Upgraded wiremock-standalone to wiremock-jre8 to support modern JUnit 5 extensions. This introduced some minimal changes to the matching syntax in JWTFilterTest.java.
    Upgraded mockito-core and added mockito-junit-jupiter for JUnit 5 mockito integration
    Migrated @Rule WireMockClassRule usages to @RegisterExtension WireMockExtension
    Swapped .port() to .getPort()
  • Unit test implemented/performed: Tests refactored; functionality not changed

Summary by CodeRabbit

  • Tests
    • Migrated automated tests across the platform from legacy JUnit versions to JUnit 5.
    • Updated test lifecycle, assertions, mocking, and WireMock integration while preserving existing coverage.
    • Added validation for additional successful query-status response fields.
  • Chores
    • Updated testing libraries and build tooling.
    • Removed legacy JUnit 4 support and refreshed WireMock test components.

@coderabbitai

coderabbitai Bot commented Jul 17, 2026

Copy link
Copy Markdown

Review Change Stack

📝 Walkthrough

Walkthrough

The pull request migrates tests across API and resource modules from JUnit 3/4 to JUnit 5, updates Mockito and WireMock integrations, adjusts assertion signatures, removes legacy JUnit dependencies, and upgrades related Maven tooling and WireMock versions.

Changes

JUnit 5 test migration

Layer / File(s) Summary
Test toolchain dependencies
pom.xml, */pom.xml
JUnit Jupiter, Mockito JUnit Jupiter, updated Surefire, and newer WireMock dependencies are added or upgraded while legacy JUnit dependencies are removed.
Resource API test migration
pic-sure-api-data/src/test/**, pic-sure-resources/pic-sure-resource-api/src/test/**
Tests adopt JUnit 5 annotations and assertions, Mockito extensions, and WireMock extensions while retaining existing test behavior.
API WAR test migration
pic-sure-api-war/src/test/**
JUnit 4 lifecycle, runner, assertion, and expected-exception usage is migrated to JUnit 5 equivalents; WireMock verification paths are updated where required.
Aggregate resource test migration
pic-sure-resources/pic-sure-aggregate-data-sharing-resource/src/test/**
Acceptance and count-shape tests use JUnit 5 and WireMock extensions, with explicit exception assertions and equivalent request-body validations.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Possibly related PRs

Suggested labels: enhancement

Suggested reviewers: ramari16

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 3.28% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title accurately summarizes the main change: migrating tests from JUnit 4 to JUnit 5.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@gitguardian

gitguardian Bot commented Jul 17, 2026

Copy link
Copy Markdown

⚠️ GitGuardian has uncovered 1 secret following the scan of your pull request.

Please consider investigating the findings and remediating the incidents. Failure to do so may lead to compromising the associated services or software components.

Since your pull request originates from a forked repository, GitGuardian is not able to associate the secrets uncovered with secret incidents on your GitGuardian dashboard.
Skipping this check run and merging your pull request will create secret incidents on your GitGuardian dashboard.

🔎 Detected hardcoded secret in your pull request
GitGuardian id GitGuardian status Secret Commit Filename
19901527 Triggered JSON Web Token 66aa5f2 pic-sure-api-war/src/test/java/edu/harvard/dbmi/avillach/LoggerReaderInterceptorTest.java View secret
🛠 Guidelines to remediate hardcoded secrets
  1. Understand the implications of revoking this secret by investigating where it is used in your code.
  2. Replace and store your secret safely. Learn here the best practices. AWS Best Practice
  3. Revoke and rotate this secret.
  4. If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.

To avoid such incidents in the future consider


🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.

@dmpillion

Copy link
Copy Markdown
Contributor

Logo
Checkmarx One – Scan Summary & Detailse78ef7f3-2be2-478b-aeab-625195a76f48


New Issues (65) Checkmarx found the following issues in this Pull Request
# Severity Issue Source File / Package Checkmarx Insight
1 CRITICAL CVE-2022-1471 Maven-org.yaml:snakeyaml-1.33
detailsRecommended version: 2.0
Description: SnakeYaml's "Constructor()" class does not restrict types which can be instantiated during deserialization. Deserializing yaml content provided by ...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
2 CRITICAL CVE-2022-46364 Maven-org.apache.cxf:cxf-core-3.4.1
detailsRecommended version: 3.4.8.redhat-00043
Description: Apache CXF versions through 3.4.9 and 3.5.x through 3.5.4 are vulnerable to Server-Side Request Forgery (SSRF) while parsing the "href" attribute o...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
3 CRITICAL CVE-2024-28752 Maven-org.apache.cxf:cxf-core-3.4.1
detailsRecommended version: 3.5.5.redhat-00059
Description: A SSRF vulnerability using the Aegis DataBinding in versions of Apache CXF versions prior to 3.5.8, 3.6.x prior 3.6.3, 4.0.x prior to 4.0.4, allows...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
4 CRITICAL CVE-2024-31573 Maven-org.xmlunit:xmlunit-core-2.9.0
detailsRecommended version: 2.10.0
Description: XMLUnit for Java has Insecure Defaults when Processing XSLT Stylesheets. This issue affects the package org.xmlunit:xmlunit-core versions prior to ...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
5 CRITICAL CVE-2026-2332 Maven-org.eclipse.jetty:jetty-http-9.4.49.v20220914
detailsRecommended version: 12.0.30.redhat-00001
Description: In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used, similar to the "funky chunks" techniques o...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
6 CRITICAL CVE-2026-42581 Maven-io.netty:netty-codec-http-4.1.86.Final
detailsRecommended version: 4.1.133.Final
Description: Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.133.Final and 4.2.x prior to 4.2.13.Final, `HttpObje...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
7 CRITICAL CVE-2026-42584 Maven-io.netty:netty-codec-http-4.1.86.Final
detailsRecommended version: 4.1.133.Final
Description: Netty is an asynchronous, event-driven network application framework. Prior to 4.1.133.Final and 4.2.x prior to 4.2.13.Final and 5.0.0.Alpha1 and 5...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
8 CRITICAL CVE-2026-44249 Maven-io.netty:netty-handler-4.1.86.Final
detailsRecommended version: 4.1.135.Final
Description: Netty is a network application framework for development of protocol servers and clients. In netty-handler versions through 4.1.134.Final, 4.2.x th...
Attack Vector: NETWORK
Attack Complexity: HIGH
Vulnerable Package
9 CRITICAL CVE-2026-49875 Maven-org.apache.cxf:cxf-core-3.4.1
detailsRecommended version: 4.1.6.rhbac-redhat-00006
Description: Apache CXF's "EndpointReferenceUtils" and "W3CMultiSchemaFactory" classes construct a "SAXParserFactory" without the necessary JAXP hardening confi...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
10 HIGH CVE-2022-40152 Maven-com.fasterxml.woodstox:woodstox-core-6.2.1
detailsRecommended version: 6.4.0
Description: Those using woodstox to serialise XML data may be vulnerable to Denial-of-Service attacks (DOS). If the parser is running on user supplied input, a...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
11 HIGH CVE-2022-46363 Maven-org.apache.cxf:cxf-rt-transports-http-3.4.1
detailsRecommended version: 3.4.8.redhat-00043
Description: Apache CXF versions prior to 3.4.10 and 3.5.x prior to 3.5.5 allows an attacker to perform a remote Directory Listing or Code Exfiltration. The vul...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
12 HIGH CVE-2023-1370 Maven-net.minidev:json-smart-2.4.8
detailsRecommended version: 2.4.9
Description: Json-smart is a performance-focused, JSON processor lib. When reaching a '[' or '{' character in the JSON input, the code parses an array or an obj...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
13 HIGH CVE-2023-24998 Maven-commons-fileupload:commons-fileupload-1.4
detailsRecommended version: 1.5
Description: Apache Commons FileUpload prior to 1.5 does not limit the number of request parts to be processed, resulting in the possibility of an attacker trig...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
14 HIGH CVE-2023-2976 Maven-com.google.guava:guava-31.1-jre
detailsRecommended version: 32.0.0.jre-redhat-00001
Description: Use of Java's default temporary directory for file creation in `FileBackedOutputStream` in Google Guava versions 1.0 through 31.1-jre on Unix syste...
Attack Vector: LOCAL
Attack Complexity: LOW
Vulnerable Package
15 HIGH CVE-2023-36478 Maven-org.eclipse.jetty.http2:http2-hpack-9.4.49.v20220914
detailsRecommended version: 9.4.53.v20231009
Description: Eclipse Jetty provides a web server and servlet container.An integer overflow in `MetaDataBuilder.checkSize` allows for HTTP/2 HPACK header values ...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
16 HIGH CVE-2023-36478 Maven-org.eclipse.jetty:jetty-http-9.4.49.v20220914
detailsRecommended version: 9.4.53.v20231009
Description: Eclipse Jetty provides a web server and servlet container.An integer overflow in `MetaDataBuilder.checkSize` allows for HTTP/2 HPACK header values ...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
17 HIGH CVE-2023-44487 Maven-org.eclipse.jetty.http2:http2-common-9.4.49.v20220914
detailsRecommended version: 9.4.52.v20230823
Description: The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploi...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
18 HIGH CVE-2023-44487 Maven-io.netty:netty-codec-http2-4.1.86.Final
detailsRecommended version: 4.1.100.Final
Description: The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploi...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
19 HIGH CVE-2024-13009 Maven-org.eclipse.jetty:jetty-server-9.4.49.v20220914
detailsRecommended version: 9.4.57.v20241219
Description: In Eclipse Jetty versions 9.4.0.M0 prior to 9.4.57.v20241219, a buffer may be incorrectly released when a gzip error occurs during the inflation of...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
20 HIGH CVE-2024-22201 Maven-org.eclipse.jetty.http2:http2-common-9.4.49.v20220914
detailsRecommended version: 9.4.53.v20231009-redhat-00002
Description: Jetty is a Java based web server and servlet engine. An HTTP/2 SSL connection that is established and TCP congested will be leaked when it times ou...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
21 HIGH CVE-2024-7254 Maven-com.google.protobuf:protobuf-java-3.21.9
detailsRecommended version: 3.25.5
Description: Any project that parses untrusted Protocol Buffers data containing an arbitrary number of nested groups/series of SGROUP tags can corrupted by exce...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
22 HIGH CVE-2024-9823 Maven-org.eclipse.jetty:jetty-servlets-9.4.49.v20220914
detailsRecommended version: 9.4.54.v20240208
Description: There exists a security vulnerability in Jetty's "DosFilter" which can be exploited by unauthorized users to cause remote Denial-of-Service (DoS) a...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
23 HIGH CVE-2025-1948 Maven-org.eclipse.jetty.http2:http2-common-9.4.49.v20220914
detailsRecommended version: 9.4.58.v20250814
Description: In Eclipse Jetty, an HTTP/2 client can specify a very large value for the HTTP/2 settings parameter "SETTINGS_MAX_HEADER_LIST_SIZE". The Jetty HTTP...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
24 HIGH CVE-2025-23184 Maven-org.apache.cxf:cxf-core-3.4.1
detailsRecommended version: 3.5.10
Description: A potential Denial-of-Service (DoS) vulnerability is present in Apache CXF versions prior to 3.5.10, 3.6.5 and 4.0.6. In some edge cases, the `Cach...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
25 HIGH CVE-2025-48976 Maven-commons-fileupload:commons-fileupload-1.4
detailsRecommended version: 1.6.0
Description: Allocation of resources for multipart headers with insufficient limits enabled a Denial of Service (DoS) vulnerability in Apache Commons FileUpload...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
26 HIGH CVE-2025-5115 Maven-org.eclipse.jetty.http2:http2-common-9.4.49.v20220914
detailsRecommended version: 9.4.58.v20250814
Description: In Eclipse Jetty, an HTTP/2 client may trigger the server to send "RST_STREAM" frames, for example, by sending frames that are malformed or that sh...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
27 HIGH CVE-2025-55163 Maven-io.netty:netty-codec-http2-4.1.86.Final
detailsRecommended version: 4.1.121.Final-redhat-00003
Description: Netty is an asynchronous, event-driven network application framework. Netty is vulnerable to the "MadeYouReset" DDoS attack. This is a logical vuln...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
28 HIGH CVE-2026-33870 Maven-io.netty:netty-codec-http-4.1.86.Final
detailsRecommended version: 4.1.132.Final
Description: Netty is an asynchronous, event-driven network application framework. In 'netty-microbench' versions through 4.1.131.Final and 4.2.x through 4.2.10...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
29 HIGH CVE-2026-33871 Maven-io.netty:netty-codec-http2-4.1.86.Final
detailsRecommended version: 4.1.132.Final
Description: A remote user can trigger a Denial of Service (DoS) against a Netty HTTP/2 server by sending a flood of `CONTINUATION` frames. The server's lack of...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
30 HIGH CVE-2026-42583 Maven-io.netty:netty-codec-4.1.86.Final
detailsRecommended version: 4.1.97.Final-redhat-00004
Description: Netty is an asynchronous, event-driven network application framework. Prior to 4.1.133.Final and io.netty:netty-codec-compression versions prior t...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
31 HIGH CVE-2026-42585 Maven-io.netty:netty-codec-http-4.1.86.Final
detailsRecommended version: 4.1.133.Final
Description: Netty is an asynchronous, event-driven network application framework. Prior to 4.1.133.Final, 4.2.x prior to 4.2.13.Final and 5.0.0.Alpha1 and 5.0....
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
32 HIGH CVE-2026-42587 Maven-io.netty:netty-codec-http2-4.1.86.Final
detailsRecommended version: 4.1.133.Final
Description: `HttpContentDecompressor` accepts a `maxAllocation` parameter to limit decompression buffer size and prevent decompression bomb attacks. This limit...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
33 HIGH CVE-2026-42587 Maven-io.netty:netty-codec-http-4.1.86.Final
detailsRecommended version: 4.1.133.Final
Description: `HttpContentDecompressor` accepts a `maxAllocation` parameter to limit decompression buffer size and prevent decompression bomb attacks. This limit...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
34 HIGH CVE-2026-45416 Maven-io.netty:netty-handler-4.1.86.Final
detailsRecommended version: 4.1.135.Final
Description: Netty is a network application framework for development of protocol servers and clients. In netty-handler versions through 4.1.134.Final, 4.2.x th...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
35 HIGH CVE-2026-48043 Maven-io.netty:netty-codec-http2-4.1.86.Final
detailsRecommended version: 4.1.135.Final
Description: Netty is a network application framework for development of protocol servers and clients. In netty-codec-http2 prior to versions 4.1.135.Final and ...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
36 HIGH CVE-2026-50010 Maven-io.netty:netty-handler-4.1.86.Final
detailsRecommended version: 4.1.135.Final
Description: Netty is a network application framework for development of protocol servers and clients. Prior to version 4.1.135.Final and 4.2.x prior to 4.2.15....
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
37 HIGH CVE-2026-50645 Maven-org.apache.cxf:cxf-core-3.4.1
detailsRecommended version: 4.1.6.rhbac-redhat-00006
Description: There is no restriction on the amount of attachment headers that a message can contain when being deserialized by Apache CXF, which can lead to unc...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
38 HIGH CVE-2026-55760 Maven-com.github.jknack:handlebars-4.3.1
detailsRecommended version: 4.5.2
Description: Any application that passes user-controlled input to 'Handlebars.compile()' using a 'FileTemplateLoader' (or 'ClassPathTemplateLoader') is vulnerab...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
39 HIGH Cxfa47c4e4-5ef9 Maven-com.fasterxml.jackson.core:jackson-core-2.15.2
detailsRecommended version: 2.18.6
Description: The non-blocking (async) JSON parser in jackson-core bypasses the "maxNumberLength" constraint (default: 1000 characters) defined in "StreamReadCon...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
40 MEDIUM CVE-2023-26048 Maven-org.eclipse.jetty:jetty-server-9.4.49.v20220914
detailsRecommended version: 9.4.51.v20230217
Description: Jetty is a java-based web server and servlet engine. In affected versions prior to 9.4.51, 10.0.x prior to 10.0.14,11.0.x prior to 11.0.14, and 12....
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
41 MEDIUM CVE-2023-26048 Maven-org.eclipse.jetty:jetty-http-9.4.49.v20220914
detailsRecommended version: 9.4.51.v20230217
Description: Jetty is a java-based web server and servlet engine. In affected versions prior to 9.4.51, 10.0.x prior to 10.0.14,11.0.x prior to 11.0.14, and 12....
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
42 MEDIUM CVE-2023-26048 Maven-org.eclipse.jetty:jetty-util-9.4.49.v20220914
detailsRecommended version: 9.4.51.v20230217
Description: Jetty is a java-based web server and servlet engine. In affected versions prior to 9.4.51, 10.0.x prior to 10.0.14,11.0.x prior to 11.0.14, and 12....
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
43 MEDIUM CVE-2023-26049 Maven-org.eclipse.jetty:jetty-server-9.4.49.v20220914
detailsRecommended version: 9.4.51.v20230217
Description: Jetty is a java based web server and servlet engine. Nonstandard cookie parsing in Jetty may allow an attacker to smuggle cookies within other cook...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
44 MEDIUM CVE-2023-26049 Maven-org.eclipse.jetty:jetty-http-9.4.49.v20220914
detailsRecommended version: 9.4.51.v20230217
Description: Jetty is a java based web server and servlet engine. Nonstandard cookie parsing in Jetty may allow an attacker to smuggle cookies within other cook...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
45 MEDIUM CVE-2023-34462 Maven-io.netty:netty-handler-4.1.86.Final
detailsRecommended version: 4.1.94.Final
Description: Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clien...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
46 MEDIUM CVE-2023-40167 Maven-org.eclipse.jetty:jetty-http-9.4.49.v20220914
detailsRecommended version: 9.4.52.v20230823
Description: The package Jetty in versions 9.0.x prior to 9.4.52.v20230823, 10.0.x prior to 10.0.16, 11.0.x prior to 11.0.16 and 12.0.x prior to 12.0.1 accepts ...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
47 MEDIUM CVE-2023-51074 Maven-com.jayway.jsonpath:json-path-2.7.0
detailsRecommended version: 2.9.0
Description: The package json-path was discovered to contain a stack overflow via the "Criteria.parse()" method. This issue affects com.jayway.jsonpath:json-pat...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
48 MEDIUM CVE-2024-29025 Maven-io.netty:netty-codec-http-4.1.86.Final
detailsRecommended version: 4.1.97.Final-redhat-00004
Description: Netty is an asynchronous event-driven network application framework for the rapid development of maintainable high-performance protocol servers & c...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
49 MEDIUM CVE-2024-47535 Maven-io.netty:netty-common-4.1.86.Final
detailsRecommended version: 4.1.108.Final-redhat-00002
Description: Netty is an asynchronous event-driven network application framework for rapidly developing maintainable high-performance protocol servers & clients...
Attack Vector: LOCAL
Attack Complexity: LOW
Vulnerable Package
50 MEDIUM CVE-2024-6762 Maven-org.eclipse.jetty:jetty-servlets-9.4.49.v20220914
detailsRecommended version: 9.4.52.v20230823
Description: Unauthenticated users can exploit Jetty PushSessionCacheFilter to launch remote Denial-of-Service (DoS) attacks by exhausting the server's memory. ...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
51 MEDIUM CVE-2024-6763 Maven-org.eclipse.jetty:jetty-http-9.4.49.v20220914
detailsRecommended version: 9.4.57.v20241219
Description: Eclipse Jetty is a lightweight, highly scalable, Java-based web server and Servlet engine. It includes a utility class, 'HttpURI', for URI/URL pars...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
52 MEDIUM CVE-2024-6763 Maven-org.eclipse.jetty:jetty-server-9.4.49.v20220914
detailsRecommended version: 9.4.57.v20241219
Description: Eclipse Jetty is a lightweight, highly scalable, Java-based web server and Servlet engine. It includes a utility class, 'HttpURI', for URI/URL pars...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
53 MEDIUM CVE-2024-8184 Maven-org.eclipse.jetty:jetty-server-9.4.49.v20220914
detailsRecommended version: 9.4.56.v20240826
Description: There exists a security vulnerability in Jetty's "ThreadLimitHandler.getRemote()" which can be exploited by unauthorized users to cause a remote De...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
54 MEDIUM CVE-2025-58057 Maven-io.netty:netty-codec-http-4.1.86.Final
detailsRecommended version: 4.1.123.Final-redhat-00001
Description: Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clien...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
55 MEDIUM CVE-2025-58057 Maven-io.netty:netty-codec-4.1.86.Final
detailsRecommended version: 4.1.97.Final-redhat-00004
Description: Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clien...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
56 MEDIUM CVE-2025-58057 Maven-io.netty:netty-codec-http2-4.1.86.Final
detailsRecommended version: 4.1.123.Final-redhat-00001
Description: Netty is an asynchronous event-driven network application framework for rapid development of maintainable high performance protocol servers & clien...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
57 MEDIUM CVE-2025-67735 Maven-io.netty:netty-codec-http-4.1.86.Final
detailsRecommended version: 4.1.129.Final
Description: Netty is an asynchronous, event-driven network application framework. In versions prior to 4.1.129.Final and 4.2.x prior to 4.2.8.Final, the `io.ne...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
58 MEDIUM CVE-2026-59888 Maven-com.fasterxml.jackson.core:jackson-databind-2.15.2
detailsRecommended version: 2.18.8
Description: jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.15.0 until 2.18.8, 2.21....
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
59 MEDIUM CVE-2026-59888 Maven-com.fasterxml.jackson.core:jackson-databind-2.18.6
detailsRecommended version: 2.18.8
Description: jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.15.0 until 2.18.8, 2.21....
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
60 MEDIUM CVE-2026-59889 Maven-com.fasterxml.jackson.core:jackson-databind-2.18.6
detailsRecommended version: 2.21.1.redhat-00013
Description: jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.18.0 until 2.18.9, 2.21....
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
61 LOW CVE-2020-8908 Maven-com.google.guava:guava-31.1-jre
detailsRecommended version: 32.0.0.jre-redhat-00001
Description: A temp directory creation vulnerability exist in Guava versions prior to 30.0 allowing an attacker with access to the machine to potentially access...
Attack Vector: LOCAL
Attack Complexity: LOW
Vulnerable Package
62 LOW CVE-2023-36479 Maven-org.eclipse.jetty:jetty-servlets-9.4.49.v20220914
detailsRecommended version: 9.4.52.v20230823
Description: Eclipse Jetty Canonical Repository is the canonical repository for the Jetty project. Users of the "CGIServlet" with a very specific command struct...
Attack Vector: NETWORK
Attack Complexity: HIGH
Vulnerable Package
63 LOW CVE-2025-58056 Maven-io.netty:netty-codec-http-4.1.86.Final
detailsRecommended version: 4.1.123.Final-redhat-00001
Description: Netty is an asynchronous event-driven network application framework for development of maintainable high performance protocol servers and clients. ...
Attack Vector: NETWORK
Attack Complexity: LOW
Vulnerable Package
64 LOW Cx3718d76a-e8e1 Maven-org.eclipse.jetty:jetty-xml-9.4.49.v20220914
detailsRecommended version: 9.4.52.v20230823
Description: The package org.eclipse.jetty:jetty-xml in versions prior to 9.4.52, 10.0.x prior to 10.0.16, 11.0.x prior to 11.0.16 and 12.0.x prior to 12.0.0.be...
Attack Vector: LOCAL
Attack Complexity: HIGH
Vulnerable Package
65 LOW Cxeb68d52e-5509 Maven-commons-codec:commons-codec-1.11
detailsRecommended version: 1.13
Description: Apache commons-codec before 1.13 is vulnerable to information exposure. The Base32 and Base64 implementation blindly decode invalid string, which c...
Attack Vector: NETWORK
Attack Complexity: HIGH
Vulnerable Package

Fixed Issues (4) Great job! The following issues were fixed in this Pull Request
Severity Issue Source File / Package
CRITICAL CVE-2018-9116 Maven-com.github.tomakehurst:wiremock-standalone-2.14.0
MEDIUM CVE-2018-9117 Maven-com.github.tomakehurst:wiremock-standalone-2.14.0
MEDIUM CVE-2023-41329 Maven-com.github.tomakehurst:wiremock-jre8-2.27.2
MEDIUM CVE-2023-41329 Maven-com.github.tomakehurst:wiremock-standalone-2.14.0

Use @Checkmarx to interact with Checkmarx PR Assistant.
Examples:
@Checkmarx how are you able to help me?
@Checkmarx rescan this PR

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick comments (5)
pic-sure-resources/pic-sure-aggregate-data-sharing-resource/src/test/java/edu/harvard/hms/dbmi/avillach/ObfuscatedCountShapeTest.java (1)

123-123: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Use assertNull instead of assertEquals(null, ...)

For improved readability and idiomatic JUnit 5 usage, consider using assertNull rather than assertEquals with a null expected value. (Be sure to statically import assertNull if applying this change).

♻️ Proposed refactor
-        assertEquals(null, result.variance(), "Exact (authorized) values carry no uncertainty band");
+        assertNull(result.variance(), "Exact (authorized) values carry no uncertainty band");
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@pic-sure-resources/pic-sure-aggregate-data-sharing-resource/src/test/java/edu/harvard/hms/dbmi/avillach/ObfuscatedCountShapeTest.java`
at line 123, Replace the null comparison in ObfuscatedCountShapeTest with JUnit
5’s assertNull, preserving the existing variance() assertion message and adding
the corresponding static import if needed.
pic-sure-resources/pic-sure-resource-api/src/test/java/edu/harvard/dbmi/avillach/service/ResourceWebClientTest.java (1)

345-345: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Format the array in the assertion message.

Implicitly concatenating an array like mockResult with a string calls its default toString() method, which outputs its memory reference (e.g., [B@1f2b3c4) rather than its actual contents. Consider using java.util.Arrays.toString() to include the readable values in the failure message.

♻️ Proposed refactor
-        assertArrayEquals(mockResult, resultContent, "Result should match " + mockResult);
+        assertArrayEquals(mockResult, resultContent, "Result should match " + java.util.Arrays.toString(mockResult));
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@pic-sure-resources/pic-sure-resource-api/src/test/java/edu/harvard/dbmi/avillach/service/ResourceWebClientTest.java`
at line 345, Update the assertion message in ResourceWebClientTest around
assertArrayEquals to format mockResult with java.util.Arrays.toString() instead
of implicit array-to-string concatenation, so failures display the array
contents.
pic-sure-api-war/src/test/java/edu/harvard/dbmi/avillach/security/JWTFilterTest.java (1)

184-185: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Remove duplicated comments. It looks like the inline comment was duplicated into the outer scope when the calls were wrapped in assertThrows lambdas during the JUnit 5 refactoring.

  • pic-sure-api-war/src/test/java/edu/harvard/dbmi/avillach/security/JWTFilterTest.java#L184-L185: Remove the redundant // Test passes if NotAuthorizedException is thrown comment inside the lambda block.
  • pic-sure-api-war/src/test/java/edu/harvard/dbmi/avillach/security/JWTFilterTest.java#L197-L198: Remove the redundant // Test passes if NotAuthorizedException is thrown comment inside the lambda block.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@pic-sure-api-war/src/test/java/edu/harvard/dbmi/avillach/security/JWTFilterTest.java`
around lines 184 - 185, Remove the redundant “Test passes if
NotAuthorizedException is thrown” inline comment from both assertThrows lambda
blocks in JWTFilterTest at the anchor site (lines 184-185) and sibling site
(lines 197-198); leave the test behavior unchanged.
pic-sure-api-war/src/test/java/edu/harvard/dbmi/avillach/service/SystemServiceTest.java (2)

4-33: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Import fully qualified annotations and classes.

The @BeforeEach annotation and the WireMock class are used with their fully qualified names. You can import them at the top of the file to improve readability.

♻️ Proposed refactor
 import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.extension.RegisterExtension;
 
 import edu.harvard.dbmi.avillach.PicSureWarInit;
 
 import com.github.tomakehurst.wiremock.core.WireMockConfiguration;
 import com.github.tomakehurst.wiremock.junit5.WireMockExtension;
+import com.github.tomakehurst.wiremock.client.WireMock;
 import edu.harvard.dbmi.avillach.data.entity.Resource;
 import edu.harvard.dbmi.avillach.data.repository.ResourceRepository;
 
 public class SystemServiceTest {
 
     `@RegisterExtension`
     public WireMockExtension wireMockRule = WireMockExtension.newInstance().options(WireMockConfiguration.options().port(0)).build();
 
     private int port;
 
-    `@org.junit.jupiter.api.BeforeEach`
+    `@BeforeEach`
     public void setup() {
         this.port = wireMockRule.getPort();
-        com.github.tomakehurst.wiremock.client.WireMock.configureFor(this.port);
+        WireMock.configureFor(this.port);
     }
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@pic-sure-api-war/src/test/java/edu/harvard/dbmi/avillach/service/SystemServiceTest.java`
around lines 4 - 33, Update SystemServiceTest imports to include BeforeEach and
WireMock, then replace their fully qualified usages in setup() with the imported
symbols while preserving existing behavior.

87-112: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Prefer assertThrows over try-catch with assertTrue(false, ...) in JUnit 5.

Using assertThrows is the idiomatic way to test expected exceptions in JUnit 5. It eliminates the need for try-catch blocks and avoids the assertTrue(false) anti-pattern.

♻️ Proposed refactor

Ensure you add the assertThrows import alongside the other assertions at the top of the file:

import static org.junit.jupiter.api.Assertions.assertThrows;
     `@Test`
     public void testThrowsExceptionOnStartupIfTokenIntrospectionTokenNotConfigured() {
         SystemService service = basicService();
         when(service.picSureWarInit.getToken_introspection_token()).thenReturn(null);
-        try {
-            service.token_introspection_token = null;
-            service.init();
-        } catch (Exception e) {
-            return;
-        }
-        assertTrue(false, "Expected an exception to be thrown.");
+        service.token_introspection_token = null;
+        assertThrows(Exception.class, service::init, "Expected an exception to be thrown.");
     }
 
     `@Test`
     public void testThrowsExceptionOnStartupIfTokenIntrospectionUrlNotConfigured() {
         SystemService service = basicService();
         when(service.picSureWarInit.getToken_introspection_url()).thenReturn(null);
-        try {
-            service.token_introspection_url = null;
-            service.init();
-        } catch (Exception e) {
-            return;
-        }
-        assertTrue(false, "Expected an exception to be thrown.");
+        service.token_introspection_url = null;
+        assertThrows(Exception.class, service::init, "Expected an exception to be thrown.");
     }
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@pic-sure-api-war/src/test/java/edu/harvard/dbmi/avillach/service/SystemServiceTest.java`
around lines 87 - 112, Refactor
testThrowsExceptionOnStartupIfTokenIntrospectionTokenNotConfigured and
testThrowsExceptionOnStartupIfTokenIntrospectionUrlNotConfigured to use JUnit 5
assertThrows around service.init() instead of try-catch with assertTrue(false).
Add the corresponding static assertThrows import and preserve each test’s
existing setup.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In
`@pic-sure-api-war/src/test/java/edu/harvard/dbmi/avillach/security/JWTFilterTest.java`:
- Around line 184-185: Remove the redundant “Test passes if
NotAuthorizedException is thrown” inline comment from both assertThrows lambda
blocks in JWTFilterTest at the anchor site (lines 184-185) and sibling site
(lines 197-198); leave the test behavior unchanged.

In
`@pic-sure-api-war/src/test/java/edu/harvard/dbmi/avillach/service/SystemServiceTest.java`:
- Around line 4-33: Update SystemServiceTest imports to include BeforeEach and
WireMock, then replace their fully qualified usages in setup() with the imported
symbols while preserving existing behavior.
- Around line 87-112: Refactor
testThrowsExceptionOnStartupIfTokenIntrospectionTokenNotConfigured and
testThrowsExceptionOnStartupIfTokenIntrospectionUrlNotConfigured to use JUnit 5
assertThrows around service.init() instead of try-catch with assertTrue(false).
Add the corresponding static assertThrows import and preserve each test’s
existing setup.

In
`@pic-sure-resources/pic-sure-aggregate-data-sharing-resource/src/test/java/edu/harvard/hms/dbmi/avillach/ObfuscatedCountShapeTest.java`:
- Line 123: Replace the null comparison in ObfuscatedCountShapeTest with JUnit
5’s assertNull, preserving the existing variance() assertion message and adding
the corresponding static import if needed.

In
`@pic-sure-resources/pic-sure-resource-api/src/test/java/edu/harvard/dbmi/avillach/service/ResourceWebClientTest.java`:
- Line 345: Update the assertion message in ResourceWebClientTest around
assertArrayEquals to format mockResult with java.util.Arrays.toString() instead
of implicit array-to-string concatenation, so failures display the array
contents.

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: df5a5eab-4039-4350-88c6-2d4b573eb4bd

📥 Commits

Reviewing files that changed from the base of the PR and between f081c7d and 66aa5f2.

📒 Files selected for processing (30)
  • pic-sure-api-data/pom.xml
  • pic-sure-api-data/src/test/java/edu/harvard/dbmi/avillach/DataTest.java
  • pic-sure-api-war/pom.xml
  • pic-sure-api-war/src/test/java/edu/harvard/dbmi/avillach/BaseServiceTest.java
  • pic-sure-api-war/src/test/java/edu/harvard/dbmi/avillach/ConfigurationRSTest.java
  • pic-sure-api-war/src/test/java/edu/harvard/dbmi/avillach/LoggerReaderInterceptorTest.java
  • pic-sure-api-war/src/test/java/edu/harvard/dbmi/avillach/PicsureInfoServiceTest.java
  • pic-sure-api-war/src/test/java/edu/harvard/dbmi/avillach/PicsureQueryServiceTest.java
  • pic-sure-api-war/src/test/java/edu/harvard/dbmi/avillach/PicsureSearchServiceTest.java
  • pic-sure-api-war/src/test/java/edu/harvard/dbmi/avillach/security/AuditLoggingFilterTest.java
  • pic-sure-api-war/src/test/java/edu/harvard/dbmi/avillach/security/JWTFilterTest.java
  • pic-sure-api-war/src/test/java/edu/harvard/dbmi/avillach/service/ConfigurationServiceTest.java
  • pic-sure-api-war/src/test/java/edu/harvard/dbmi/avillach/service/LoggingClientProducerTest.java
  • pic-sure-api-war/src/test/java/edu/harvard/dbmi/avillach/service/NamedDatasetServiceTest.java
  • pic-sure-api-war/src/test/java/edu/harvard/dbmi/avillach/service/SiteParsingServiceTest.java
  • pic-sure-api-war/src/test/java/edu/harvard/dbmi/avillach/service/SystemServiceTest.java
  • pic-sure-resources/pic-sure-aggregate-data-sharing-resource/pom.xml
  • pic-sure-resources/pic-sure-aggregate-data-sharing-resource/src/test/java/edu/harvard/hms/dbmi/avillach/AggregateDataSharingResourceRSAcceptanceTests.java
  • pic-sure-resources/pic-sure-aggregate-data-sharing-resource/src/test/java/edu/harvard/hms/dbmi/avillach/ObfuscatedCountShapeTest.java
  • pic-sure-resources/pic-sure-aggregate-data-sharing-resource/src/test/java/edu/harvard/hms/dbmi/avillach/ProxyPostEndpointMocker.java
  • pic-sure-resources/pic-sure-passthrough-resource/src/test/java/edu/harvard/hms/dbmi/avillach/resource/passthru/PassThroughResourceRSTest.java
  • pic-sure-resources/pic-sure-resource-api/pom.xml
  • pic-sure-resources/pic-sure-resource-api/src/test/java/edu/harvard/dbmi/avillach/AppTest.java
  • pic-sure-resources/pic-sure-resource-api/src/test/java/edu/harvard/dbmi/avillach/domain/PaginatedSearchResultTest.java
  • pic-sure-resources/pic-sure-resource-api/src/test/java/edu/harvard/dbmi/avillach/domain/QueryRequestTest.java
  • pic-sure-resources/pic-sure-resource-api/src/test/java/edu/harvard/dbmi/avillach/domain/SignedUrlResponseTest.java
  • pic-sure-resources/pic-sure-resource-api/src/test/java/edu/harvard/dbmi/avillach/service/HttpClientUtilTest.java
  • pic-sure-resources/pic-sure-resource-api/src/test/java/edu/harvard/dbmi/avillach/service/ProxyWebClientTest.java
  • pic-sure-resources/pic-sure-resource-api/src/test/java/edu/harvard/dbmi/avillach/service/ResourceWebClientTest.java
  • pom.xml

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants