feat(spigot): extended event logging framework

.gitignore

@@ -1,18 +1,30 @@
-*.pyo
-*.pyc
-*.swp
-build
-.gradle
-bin/
-.project
-*.iml
-.idea/
-eclipse/
-.classpath
-logs/
-.settings
-target/
+*.pyo
+*.pyc
+*.swp
+build
+.gradle
+bin/
+.project
+*.iml
+.idea/
+eclipse/
+.classpath
+logs/
+.settings
+target/
+
+#forge .idea things:
+*.ipr
+*.iws
+# Editor/tooling droppings
+.vscode/
+.cursor/
+.codegraph/
+graphify-out/
+*.code-workspace
 
-#forge .idea things:
-*.ipr
-*.iws
+# Local tool installs / build output not meant for version control
+mvn-bin/
+dist/
+node_modules/
+*.tar.gz

default/app.conf

@@ -1,21 +1,22 @@
-#
-# Splunk app configuration file
-#
-
-[install]
-state = enabled
-state_change_requires_restart = 0
-is_configured = 0
-build = 1
-
-[ui]
-is_visible = 1
-label = Minecraft
-
-[launcher]
-author = mpapale@splunk.com
-description = The Splunk App for Minecraft let's you visualize your Minecraft server data.
-version = 1.0
-
-[package]
-id = minecraft-app
+#
+# Splunk app configuration file
+#
+
+[install]
+state = enabled
+state_change_requires_restart = 0
+is_configured = 0
+build = 1
+
+[ui]
+is_visible = 1
+label = Minecraft
+supported_themes = light, dark
+
+[launcher]
+author = mpapale@splunk.com
+description = The Splunk App for Minecraft let's you visualize your Minecraft server data.
+version = 1.0
+
+[package]
+id = minecraft-app

logtosplunk-plugin/pom.xml

@@ -8,108 +8,75 @@
     </parent>
     <modelVersion>4.0.0</modelVersion>
 
+    <!--
+      Dist aggregator. Each platform module (spigot, paper) produces its own shaded JAR
+      named logtosplunk-<mc.version>-<loader>-<loader.version>.jar in its own target/.
+      This module collects all of those JARs plus Gradle-built artifacts (forge, neoforge,
+      fabric) into a single dist/ folder at the project root.
+
+      Run after a full build:
+        mvn package           (default MC 1.21.1 spigot + paper)
+        mvn package -P mc-1201
+        ./gradlew shadowJar   (from forge/, neoforge/, fabric/ separately)
+    -->
     <artifactId>logtosplunk-plugin</artifactId>
-
-    <repositories>
-        <repository>
-            <id>mvnrepository-central</id>
-            <name>mvnrepository.com Central</name>
-            <url>https://repo1.maven.org/maven2/</url>
-        </repository>
-        <repository>
-            <id>splunk-artifactory</id>
-            <name>Splunk Releases</name>
-            <url>https://splunk.jfrog.io/splunk/ext-releases-local</url>
-        </repository>
-    </repositories>
-
-    <dependencies>
-        <dependency>
-            <groupId>org.apache.logging.log4j</groupId>
-            <artifactId>log4j-api</artifactId>
-            <version>2.25.1</version>
-        </dependency>
-        <dependency>
-            <groupId>org.apache.logging.log4j</groupId>
-            <artifactId>log4j-core</artifactId>
-            <version>2.25.1</version>
-        </dependency>
-        <dependency>
-            <groupId>com.splunk.logging</groupId>
-            <artifactId>splunk-library-javalogging</artifactId>
-            <version>1.11.8</version>
-        </dependency>
-        <dependency>
-            <groupId>com.splunk</groupId>
-            <artifactId>shared-mc</artifactId>
-            <version>${project.version}</version>
-        </dependency>
-        <dependency>
-            <groupId>com.splunk</groupId>
-            <artifactId>spigot</artifactId>
-            <version>${project.version}</version>
-        </dependency>
-    </dependencies>
+    <packaging>pom</packaging>
 
     <build>
         <plugins>
+            <!--
+              Collect all logtosplunk-*.jar artifacts from sibling Maven module targets
+              and Gradle build/libs directories into ${maven.multiModuleProjectDirectory}/dist/.
+              Runs during the package phase, after all sibling modules have packaged.
+            -->
             <plugin>
                 <groupId>org.apache.maven.plugins</groupId>
-                <artifactId>maven-shade-plugin</artifactId>
-                <configuration>
-                    <dependencyReducedPomLocation>
-                        ${project.build.directory}/dependency-reduced-pom.xml
-                    </dependencyReducedPomLocation>
-                </configuration>
-
-                <version>2.4.1</version>
+                <artifactId>maven-antrun-plugin</artifactId>
+                <version>3.1.0</version>
                 <executions>
                     <execution>
+                        <id>collect-dist</id>
                         <phase>package</phase>
                         <goals>
-                            <goal>shade</goal>
+                            <goal>run</goal>
                         </goals>
+                        <configuration>
+                            <target>
+                                <mkdir dir="${maven.multiModuleProjectDirectory}/dist"/>
+                                <!-- Maven-built platform JARs (spigot, paper) -->
+                                <copy todir="${maven.multiModuleProjectDirectory}/dist" failonerror="false">
+                                    <fileset dir="${maven.multiModuleProjectDirectory}/spigot/target"
+                                             includes="logtosplunk-*.jar"/>
+                                </copy>
+                                <copy todir="${maven.multiModuleProjectDirectory}/dist" failonerror="false">
+                                    <fileset dir="${maven.multiModuleProjectDirectory}/paper/target"
+                                             includes="logtosplunk-*.jar"/>
+                                </copy>
+                                <!-- Gradle-built platform JARs (forge, neoforge, fabric) -->
+                                <copy todir="${maven.multiModuleProjectDirectory}/dist" failonerror="false">
+                                    <fileset dir="${maven.multiModuleProjectDirectory}/forge/build/libs"
+                                             includes="logtosplunk-*.jar"/>
+                                </copy>
+                                <copy todir="${maven.multiModuleProjectDirectory}/dist" failonerror="false">
+                                    <fileset dir="${maven.multiModuleProjectDirectory}/neoforge/build/libs"
+                                             includes="logtosplunk-*.jar"/>
+                                </copy>
+                                <copy todir="${maven.multiModuleProjectDirectory}/dist" failonerror="false">
+                                    <fileset dir="${maven.multiModuleProjectDirectory}/fabric/build/libs"
+                                             includes="logtosplunk-*.jar"
+                                             excludes="*-sources.jar"/>
+                                </copy>
+                                <echo message="dist/ contents:"/>
+                                <fileset id="dist.files" dir="${maven.multiModuleProjectDirectory}/dist"
+                                         includes="*.jar"/>
+                                <pathconvert pathsep="${line.separator}  " property="dist.list"
+                                             refid="dist.files"/>
+                                <echo message="  ${dist.list}"/>
+                            </target>
+                        </configuration>
                     </execution>
                 </executions>
-
             </plugin>
         </plugins>
     </build>
-
-    <profiles>
-        <profile>
-            <id>include-forge</id>
-            <dependencies>
-                <dependency>
-                    <groupId>com.splunk</groupId>
-                    <artifactId>logtosplunk-forge</artifactId>
-                    <version>${project.version}</version>
-                </dependency>
-                <dependency>
-                    <groupId>org.apache.logging.log4j</groupId>
-                    <artifactId>log4j-api</artifactId>
-                </dependency>
-                <dependency>
-                    <groupId>org.apache.logging.log4j</groupId>
-                    <artifactId>log4j-core</artifactId>
-                </dependency>
-                <dependency>
-                    <groupId>com.splunk</groupId>
-                    <artifactId>splunk-library-javalogging</artifactId>
-                    <version>1.0.1</version>
-                </dependency>
-                <dependency>
-                    <groupId>com.splunk</groupId>
-                    <artifactId>shared-mc</artifactId>
-                    <version>${project.version}</version>
-                </dependency>
-                <dependency>
-                    <groupId>com.splunk</groupId>
-                    <artifactId>spigot</artifactId>
-                    <version>${project.version}</version>
-                </dependency>
-            </dependencies>
-        </profile>
-    </profiles>
-    <!--TODO: Package all plugin componenents into one uberjar here-->
 </project>

logtosplunk-plugin/src/main/config/splunk.properties

@@ -1,4 +1,22 @@
 splunk.craft.connection.host=127.0.0.1
 splunk.craft.connection.port=8088
 splunk.craft.token=CHANGEME-1234-5678-1234-123456789012
-splunk.craft.enable.consolelog=true
+splunk.craft.enable.consolelog=true
+
+# --- Extended logging categories (all opt-in; default off) ---
+# Combat & survival: damage, kills, healing, hunger, respawn (throttled per player)
+splunk.craft.enable.combat=false
+# Item economy: pickup, drop
+splunk.craft.enable.item=false
+# Progression: xp, level, enchant, craft, fish, command
+splunk.craft.enable.progression=false
+# Server lifecycle: start, weather change
+splunk.craft.enable.server=false
+# Performance sampler: online players, loaded chunks (TPS/MSPT require Paper API)
+splunk.craft.enable.performance=false
+# How often (in server ticks, 20 ticks = 1s) to sample performance
+splunk.craft.performance.interval_ticks=600
+# Session detail: log client IP on connect (PII -- opt in deliberately)
+splunk.craft.enable.session_ip=false
+# Session detail: teleport, gamemode change, bed enter, world change
+splunk.craft.enable.session_detail=false

owasp-suppressions.xml

@@ -0,0 +1,55 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">
+    <!-- Add <suppress> entries here only for verified false positives, with a justifying comment. -->
+
+    <!--
+      CVE-2026-53914 (CVSS 9.8) — affects kotlin-stdlib across all versions including 2.0.21.
+      We do not ship any Kotlin code. kotlin-stdlib is a transitive compile-time dep pulled in
+      by okhttp3:4.11.0 (itself a dep of splunk-library-javalogging). We've pinned kotlin-stdlib
+      to 2.0.21 in <dependencyManagement> which is the latest available; the CVE has no
+      published fix version as of this writing. Suppress pending a Kotlin or OkHttp release
+      that resolves this CVE. Re-evaluate when splunk-library-javalogging ships with a newer
+      okhttp3 that drops or upgrades kotlin-stdlib to a fixed version.
+    -->
+    <suppress>
+        <notes>CVE-2026-53914: affects all kotlin-stdlib versions, no fix available. kotlin-stdlib
+        is a transitive dep from okhttp3 via splunk-library-javalogging; we write no Kotlin code.
+        Pinned to 2.0.21 (latest); re-evaluate when a fixed kotlin-stdlib version is published.</notes>
+        <packageUrl regex="true">^pkg:maven/org\.jetbrains\.kotlin/kotlin\-stdlib.*@.*$</packageUrl>
+        <cve>CVE-2026-53914</cve>
+    </suppress>
+
+    <!--
+      CVE-2020-29582 — Kotlin scripting engine writes artifacts to a world-readable temp directory.
+      We do not use Kotlin scripting (no script engine invocation anywhere in this codebase).
+      kotlin-stdlib is only present as a transitive runtime dep from OkHttp.
+    -->
+    <suppress>
+        <notes>CVE-2020-29582: Kotlin scripting temp-dir exposure. We don't use Kotlin scripting;
+        kotlin-stdlib is a transitive dep from okhttp3/splunk-library-javalogging.</notes>
+        <packageUrl regex="true">^pkg:maven/org\.jetbrains\.kotlin/kotlin\-stdlib.*@.*$</packageUrl>
+        <cve>CVE-2020-29582</cve>
+    </suppress>
+
+
+    <!--
+      CVE-2023-33245 (8.8) and CVE-2021-35054 (7.5) — false positives on shared-mc-1.0-SNAPSHOT.jar.
+      OWASP matched the JAR to cpe:2.3:a:minecraft:minecraft:1.0:snapshot because the project
+      directory contains "minecraft" in its path and the version string is "1.0-SNAPSHOT". These
+      CVEs describe vulnerabilities in the Minecraft game client/server, not in this library.
+      shared-mc is our own code (Splunk HEC/KV transport logic), not the Mojang Minecraft product.
+    -->
+    <suppress>
+        <notes>False positive: shared-mc JAR matched to Minecraft game CPE due to "minecraft" in
+        project path and "SNAPSHOT" in version. CVE-2023-33245 and CVE-2021-35054 are Minecraft
+        game vulnerabilities, unrelated to this library.</notes>
+        <packageUrl regex="true">^pkg:maven/com\.splunk/shared\-mc@.*$</packageUrl>
+        <cve>CVE-2023-33245</cve>
+    </suppress>
+    <suppress>
+        <notes>False positive — same reason as CVE-2023-33245 above.</notes>
+        <packageUrl regex="true">^pkg:maven/com\.splunk/shared\-mc@.*$</packageUrl>
+        <cve>CVE-2021-35054</cve>
+    </suppress>
+
+</suppressions>