ww

.github/workflows/main.yml

@@ -0,0 +1,11 @@
+name: Example workflow for Maven using Snyk
+on: push
+jobs:
+  security:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@master
+      - name: Run Snyk to check for vulnerabilities
+        uses: snyk/actions/maven@master
+        env:
+          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}

README.md

@@ -1,9 +1,9 @@
 ## Java Goof
 
-This is a collection of Java demo apps that are vulnerable in different ways.
+This is a collection of Java demo apps that are vulnerable in different ways..
 
 It's divided into modules, each one having its own README:
 
 * [Todolist Goof](todolist-goof/README.md)
 * [Log4Shell Goof](log4shell-goof/README.md)
-* [Quickstart for running both Todolist with Log4Shell in Kubernetes](README-K8S.md)
+* [Quickstart for running both Todolist with Log4Shell in Kubernetes](README-K8S.md)

todolist-goof/Dockerfile

@@ -10,7 +10,7 @@ COPY todolist-web-common todolist-web-common
 COPY todolist-web-struts todolist-web-struts
 RUN --mount=target=$HOME/.m2,type=cache mvn install
 
-FROM tomcat:8.5.21
+FROM tomcat:9.0.95-jdk8-corretto-al2
 
 RUN mkdir /tmp/extracted_files
 COPY web.xml /usr/local/tomcat/conf/web.xml

todolist-goof/todolist-web-struts/pom.xml

@@ -27,7 +27,7 @@
         <dependency>
             <groupId>org.apache.logging.log4j</groupId>
             <artifactId>log4j-core</artifactId>
-            <version>2.7</version>
+            <version>2.12.2</version>
         </dependency>
         <dependency>
             <groupId>org.apache.logging.log4j</groupId>