From 8bce3c88afdebd32d2e606efa41f56d779e902c6 Mon Sep 17 00:00:00 2001 From: splunk Date: Mon, 22 Jun 2026 14:23:04 -0400 Subject: [PATCH 1/6] build: add OWASP dependency-check with CVSS 7.0 gate --- owasp-suppressions.xml | 4 ++++ pom.xml | 12 ++++++++++++ 2 files changed, 16 insertions(+) create mode 100644 owasp-suppressions.xml diff --git a/owasp-suppressions.xml b/owasp-suppressions.xml new file mode 100644 index 0000000..4b21688 --- /dev/null +++ b/owasp-suppressions.xml @@ -0,0 +1,4 @@ + + + + diff --git a/pom.xml b/pom.xml index bd12947..d3cae56 100644 --- a/pom.xml +++ b/pom.xml @@ -62,6 +62,18 @@ 1.8 + + org.owasp + dependency-check-maven + 12.1.0 + + 7.0 + false + + ${maven.multiModuleProjectDirectory}/owasp-suppressions.xml + + + From 40d67a494b01fb9b398e2da774f3c7dbdc8a39ca Mon Sep 17 00:00:00 2001 From: splunk Date: Mon, 22 Jun 2026 14:25:23 -0400 Subject: [PATCH 2/6] build: target Java 21 and bump maven-compiler-plugin to 3.14.0 --- pom.xml | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/pom.xml b/pom.xml index d3cae56..396b42e 100644 --- a/pom.xml +++ b/pom.xml @@ -12,7 +12,12 @@ logtosplunk-plugin pom - + + + 21 + UTF-8 + + mvnrepository-central @@ -56,10 +61,9 @@ org.apache.maven.plugins maven-compiler-plugin - 2.3.2 + 3.14.0 - 1.8 - 1.8 + 21 From a2e7dcd43205e19eb80e60a17f063e3ca6b7e54a Mon Sep 17 00:00:00 2001 From: splunk Date: Mon, 22 Jun 2026 14:30:59 -0400 Subject: [PATCH 3/6] refactor: replace json-simple with gson for HEC envelope Extract buildHecEnvelope() helper in SingleSplunkConnection using gson (already a shared-mc dependency) instead of the unmaintained json-simple 1.1 library. Wire format is unchanged: {"event": }. Adds unit tests covering basic wrapping and quote escaping, and removes the json-simple dependency from shared-mc/pom.xml and the parent pom's dependencyManagement. --- pom.xml | 5 ---- shared-mc/pom.xml | 6 ----- .../sharedmc/SingleSplunkConnection.java | 18 ++++++++----- .../sharedmc/SingleSplunkConnectionTest.java | 26 +++++++++++++++++++ 4 files changed, 37 insertions(+), 18 deletions(-) create mode 100644 shared-mc/src/test/java/com/splunk/sharedmc/SingleSplunkConnectionTest.java diff --git a/pom.xml b/pom.xml index 396b42e..82b4fb8 100644 --- a/pom.xml +++ b/pom.xml @@ -49,11 +49,6 @@ 4.8.2 test - - com.googlecode.json-simple - json-simple - 1.1 - diff --git a/shared-mc/pom.xml b/shared-mc/pom.xml index 5e0ba66..9d051b5 100644 --- a/shared-mc/pom.xml +++ b/shared-mc/pom.xml @@ -57,12 +57,6 @@ splunk-library-javalogging 1.11.8 - - com.googlecode.json-simple - json-simple - 1.1 - - junit junit diff --git a/shared-mc/src/main/java/com/splunk/sharedmc/SingleSplunkConnection.java b/shared-mc/src/main/java/com/splunk/sharedmc/SingleSplunkConnection.java index 0f4af0b..b756448 100644 --- a/shared-mc/src/main/java/com/splunk/sharedmc/SingleSplunkConnection.java +++ b/shared-mc/src/main/java/com/splunk/sharedmc/SingleSplunkConnection.java @@ -24,8 +24,6 @@ import org.apache.hc.client5.http.impl.classic.CloseableHttpResponse; import org.apache.hc.core5.io.CloseMode; -import org.json.simple.JSONObject; - /** * Knows a single Splunk instance by its host:port and forwards data to it. */ @@ -84,6 +82,16 @@ public void run() { } } + /** + * Wraps a raw event message in the Splunk HEC envelope: {"event": }. + * Package-private for testing. + */ + static String buildHecEnvelope(String message) { + com.google.gson.JsonObject event = new com.google.gson.JsonObject(); + event.addProperty("event", message); + return event.toString(); + } + /** * Queues up a message to send to this Spunk connections' Splunk instance. * @@ -91,11 +99,7 @@ public void run() { */ @Override public void sendToSplunk(String message) { - JSONObject event = new JSONObject(); - //message = Calendar.getInstance().getTime().toString() + ' ' + message; - event.put("event", message); - - messagesToSend.append(event.toString()); + messagesToSend.append(buildHecEnvelope(message)); } private boolean sendData() { diff --git a/shared-mc/src/test/java/com/splunk/sharedmc/SingleSplunkConnectionTest.java b/shared-mc/src/test/java/com/splunk/sharedmc/SingleSplunkConnectionTest.java new file mode 100644 index 0000000..8fe1cc0 --- /dev/null +++ b/shared-mc/src/test/java/com/splunk/sharedmc/SingleSplunkConnectionTest.java @@ -0,0 +1,26 @@ +package com.splunk.sharedmc; + +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.assertTrue; + +import com.google.gson.JsonObject; +import com.google.gson.JsonParser; +import org.junit.Test; + +public class SingleSplunkConnectionTest { + + @Test + public void buildHecEnvelope_wrapsMessageInEventField() { + String out = SingleSplunkConnection.buildHecEnvelope("hello world"); + JsonObject parsed = JsonParser.parseString(out).getAsJsonObject(); + assertEquals("hello world", parsed.get("event").getAsString()); + } + + @Test + public void buildHecEnvelope_escapesQuotes() { + String out = SingleSplunkConnection.buildHecEnvelope("a \"quoted\" value"); + JsonObject parsed = JsonParser.parseString(out).getAsJsonObject(); + assertEquals("a \"quoted\" value", parsed.get("event").getAsString()); + assertTrue(out.contains("\\\"")); + } +} From dc432557464be4d00a64dcc6e8d821a5f5becf16 Mon Sep 17 00:00:00 2001 From: splunk Date: Mon, 22 Jun 2026 14:39:07 -0400 Subject: [PATCH 4/6] build: centralize dependency versions in parent, bump junit to 4.13.2 --- pom.xml | 22 +++++++++++++++++++++- shared-mc/pom.xml | 7 ------- 2 files changed, 21 insertions(+), 8 deletions(-) diff --git a/pom.xml b/pom.xml index 82b4fb8..988d8c2 100644 --- a/pom.xml +++ b/pom.xml @@ -43,10 +43,30 @@ splunk-library-javalogging 1.11.8 + + com.google.code.gson + gson + 2.13.2 + + + com.google.guava + guava + 33.5.0-jre + + + org.apache.httpcomponents.core5 + httpcore5 + 5.3.6 + + + org.apache.httpcomponents.client5 + httpclient5 + 5.5.1 + junit junit - 4.8.2 + 4.13.2 test diff --git a/shared-mc/pom.xml b/shared-mc/pom.xml index 9d051b5..8dec369 100644 --- a/shared-mc/pom.xml +++ b/shared-mc/pom.xml @@ -26,36 +26,29 @@ org.apache.logging.log4j log4j-api - 2.25.1 org.apache.logging.log4j log4j-core - 2.25.1 org.apache.httpcomponents.core5 httpcore5 - 5.3.6 org.apache.httpcomponents.client5 httpclient5 - 5.5.1 com.google.guava guava - 33.5.0-jre com.google.code.gson gson - 2.13.2 com.splunk.logging splunk-library-javalogging - 1.11.8 junit From e4db6d12f8c82323aeeaf3f99aab93e615dcb095 Mon Sep 17 00:00:00 2001 From: splunk Date: Mon, 22 Jun 2026 14:42:04 -0400 Subject: [PATCH 5/6] build: drop forge from reactor, bump shade plugin to 3.6.0, remove stale splunk 1.0.1 --- logtosplunk-plugin/pom.xml | 7 +------ pom.xml | 1 - 2 files changed, 1 insertion(+), 7 deletions(-) diff --git a/logtosplunk-plugin/pom.xml b/logtosplunk-plugin/pom.xml index 33e5b52..c21f48e 100644 --- a/logtosplunk-plugin/pom.xml +++ b/logtosplunk-plugin/pom.xml @@ -62,7 +62,7 @@ - 2.4.1 + 3.6.0 package @@ -93,11 +93,6 @@ org.apache.logging.log4j log4j-core - - com.splunk - splunk-library-javalogging - 1.0.1 - com.splunk shared-mc diff --git a/pom.xml b/pom.xml index 988d8c2..ed7b848 100644 --- a/pom.xml +++ b/pom.xml @@ -8,7 +8,6 @@ spigot shared-mc - forge logtosplunk-plugin pom From ce087869cbe9ab63b05046bedc094e10bb6bae95 Mon Sep 17 00:00:00 2001 From: splunk Date: Mon, 13 Jul 2026 15:40:08 -0400 Subject: [PATCH 6/6] build: restructure Maven modules for multi-version packaging, pin CVE'd deps Adds per-platform MC-version Maven profiles (spigot: 1.21.1 default plus 1.20.1/1.20.4/1.20.6), a shade-plugin build producing logtosplunk---.jar per module, and marks server-provided deps (log4j, spigot-api) as provided scope so they aren't shaded into the plugin jar. Pins kotlin-stdlib to 2.0.21 to clear CVE-2026-53914 pulled in transitively via splunk-library-javalogging -> okhttp3 -> kotlin-stdlib:1.6.20. Tunes the OWASP dependency-check plugin to skip provided-scope CVEs (server operator's responsibility) and not fail on Sonatype OSS Index 401s (paid-only), while still enforcing the CVSS 7.0 gate. --- .gitignore | 46 ++++++++----- default/app.conf | 43 ++++++------ logtosplunk-plugin/pom.xml | 138 +++++++++++++++---------------------- owasp-suppressions.xml | 51 ++++++++++++++ pom.xml | 57 ++++++++++++++- spigot/pom.xml | 117 +++++++++++++++++++++++++------ 6 files changed, 309 insertions(+), 143 deletions(-) diff --git a/.gitignore b/.gitignore index 5759fa9..48d32c6 100644 --- a/.gitignore +++ b/.gitignore @@ -1,18 +1,30 @@ -*.pyo -*.pyc -*.swp -build -.gradle -bin/ -.project -*.iml -.idea/ -eclipse/ -.classpath -logs/ -.settings -target/ +*.pyo +*.pyc +*.swp +build +.gradle +bin/ +.project +*.iml +.idea/ +eclipse/ +.classpath +logs/ +.settings +target/ + +#forge .idea things: +*.ipr +*.iws +# Editor/tooling droppings +.vscode/ +.cursor/ +.codegraph/ +graphify-out/ +*.code-workspace -#forge .idea things: -*.ipr -*.iws \ No newline at end of file +# Local tool installs / build output not meant for version control +mvn-bin/ +dist/ +node_modules/ +*.tar.gz diff --git a/default/app.conf b/default/app.conf index ad18d6b..0ff0a44 100755 --- a/default/app.conf +++ b/default/app.conf @@ -1,21 +1,22 @@ -# -# Splunk app configuration file -# - -[install] -state = enabled -state_change_requires_restart = 0 -is_configured = 0 -build = 1 - -[ui] -is_visible = 1 -label = Minecraft - -[launcher] -author = mpapale@splunk.com -description = The Splunk App for Minecraft let's you visualize your Minecraft server data. -version = 1.0 - -[package] -id = minecraft-app +# +# Splunk app configuration file +# + +[install] +state = enabled +state_change_requires_restart = 0 +is_configured = 0 +build = 1 + +[ui] +is_visible = 1 +label = Minecraft +supported_themes = light, dark + +[launcher] +author = mpapale@splunk.com +description = The Splunk App for Minecraft let's you visualize your Minecraft server data. +version = 1.0 + +[package] +id = minecraft-app diff --git a/logtosplunk-plugin/pom.xml b/logtosplunk-plugin/pom.xml index c21f48e..3fef39d 100644 --- a/logtosplunk-plugin/pom.xml +++ b/logtosplunk-plugin/pom.xml @@ -8,103 +8,75 @@ 4.0.0 + logtosplunk-plugin - - - - mvnrepository-central - mvnrepository.com Central - https://repo1.maven.org/maven2/ - - - splunk-artifactory - Splunk Releases - https://splunk.jfrog.io/splunk/ext-releases-local - - - - - - org.apache.logging.log4j - log4j-api - 2.25.1 - - - org.apache.logging.log4j - log4j-core - 2.25.1 - - - com.splunk.logging - splunk-library-javalogging - 1.11.8 - - - com.splunk - shared-mc - ${project.version} - - - com.splunk - spigot - ${project.version} - - + pom + org.apache.maven.plugins - maven-shade-plugin - - - ${project.build.directory}/dependency-reduced-pom.xml - - - - 3.6.0 + maven-antrun-plugin + 3.1.0 + collect-dist package - shade + run + + + + + + + + + + + + + + + + + + + + + + + + + + - - - - - include-forge - - - com.splunk - logtosplunk-forge - ${project.version} - - - org.apache.logging.log4j - log4j-api - - - org.apache.logging.log4j - log4j-core - - - com.splunk - shared-mc - ${project.version} - - - com.splunk - spigot - ${project.version} - - - - - diff --git a/owasp-suppressions.xml b/owasp-suppressions.xml index 4b21688..34c7c49 100644 --- a/owasp-suppressions.xml +++ b/owasp-suppressions.xml @@ -1,4 +1,55 @@ + + + + CVE-2026-53914: affects all kotlin-stdlib versions, no fix available. kotlin-stdlib + is a transitive dep from okhttp3 via splunk-library-javalogging; we write no Kotlin code. + Pinned to 2.0.21 (latest); re-evaluate when a fixed kotlin-stdlib version is published. + ^pkg:maven/org\.jetbrains\.kotlin/kotlin\-stdlib.*@.*$ + CVE-2026-53914 + + + + + CVE-2020-29582: Kotlin scripting temp-dir exposure. We don't use Kotlin scripting; + kotlin-stdlib is a transitive dep from okhttp3/splunk-library-javalogging. + ^pkg:maven/org\.jetbrains\.kotlin/kotlin\-stdlib.*@.*$ + CVE-2020-29582 + + + + + + False positive: shared-mc JAR matched to Minecraft game CPE due to "minecraft" in + project path and "SNAPSHOT" in version. CVE-2023-33245 and CVE-2021-35054 are Minecraft + game vulnerabilities, unrelated to this library. + ^pkg:maven/com\.splunk/shared\-mc@.*$ + CVE-2023-33245 + + + False positive — same reason as CVE-2023-33245 above. + ^pkg:maven/com\.splunk/shared\-mc@.*$ + CVE-2021-35054 + + diff --git a/pom.xml b/pom.xml index ed7b848..fb65c0e 100644 --- a/pom.xml +++ b/pom.xml @@ -6,8 +6,11 @@ splunk.minecraft.app 1.0-SNAPSHOT - spigot shared-mc + spigot + paper + forge + neoforge logtosplunk-plugin pom @@ -15,6 +18,14 @@ 21 UTF-8 + + 1.21.1 + spigot + 1.21.1-R0.1 @@ -23,19 +34,56 @@ mvnrepository.com Central https://repo1.maven.org/maven2/ + + papermc + Paper Maven + https://repo.papermc.io/repository/maven-public/ + + + spigot-repo + Spigot Snapshots + https://hub.spigotmc.org/nexus/content/repositories/snapshots/ + + + + org.jetbrains.kotlin + kotlin-stdlib + 2.0.21 + + + org.jetbrains.kotlin + kotlin-stdlib-common + 2.0.21 + + + org.jetbrains.kotlin + kotlin-stdlib-jdk7 + 2.0.21 + + + org.jetbrains.kotlin + kotlin-stdlib-jdk8 + 2.0.21 + + org.apache.logging.log4j log4j-api 2.25.1 + provided org.apache.logging.log4j log4j-core 2.25.1 + provided com.splunk.logging @@ -86,7 +134,12 @@ 12.1.0 7.0 - false + + true + + false ${maven.multiModuleProjectDirectory}/owasp-suppressions.xml diff --git a/spigot/pom.xml b/spigot/pom.xml index 451e073..e4db243 100644 --- a/spigot/pom.xml +++ b/spigot/pom.xml @@ -10,44 +10,121 @@ spigot - - - spigot-repo - https://hub.spigotmc.org/nexus/content/repositories/snapshots/ - - + + + 1.21.1 + spigot + 1.21.1-R0.1 + 1.21.1-R0.1-SNAPSHOT + + + + + mc-1201 + + 1.20.1 + 1.20.1-R0.1 + 1.20.1-R0.1-SNAPSHOT + + + + mc-1204 + + 1.20.4 + 1.20.4-R0.1 + 1.20.4-R0.1-SNAPSHOT + + + + mc-1206 + + 1.20.6 + 1.20.6-R0.1 + 1.20.6-R0.1-SNAPSHOT + + + + + + org.spigotmc + spigot-api + ${spigot.api.version} + provided + net.md-5 bungeecord-chat 1.21-R0.4 + provided - - - org.spigotmc - spigot-api - 26.2-R0.1-20260616.212206-1 - - - - org.bukkit - bukkit - 26.2-R0.1-SNAPSHOT - + + com.github.cryptomorin XSeries 13.5.1 - + + + org.apache.logging.log4j + log4j-api + - + com.splunk shared-mc ${project.version} + + + + + + org.apache.maven.plugins + maven-shade-plugin + 3.6.0 + + logtosplunk-${mc.version}-${loader.name}-${loader.version.display} + false + + + *:* + + META-INF/versions/*/module-info.class + META-INF/*.SF + META-INF/*.DSA + META-INF/*.RSA + + + + + + + package + + shade + + + + + +