From ebff39353a17903a856afb04bd381638dd735e69 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Fri, 31 Jul 2026 02:35:49 +0000 Subject: [PATCH 1/6] chore(deps): bump github/codeql-action/upload-sarif Bumps [github/codeql-action/upload-sarif](https://github.com/github/codeql-action) from 4.36.2 to 4.37.3. - [Release notes](https://github.com/github/codeql-action/releases) - [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md) - [Commits](https://github.com/github/codeql-action/compare/8aad20d150bbac5944a9f9d289da16a4b0d87c1e...e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81) --- updated-dependencies: - dependency-name: github/codeql-action/upload-sarif dependency-version: 4.37.3 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] --- .github/workflows/scorecard.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml index 5889fd3219..a37427b4c8 100644 --- a/.github/workflows/scorecard.yml +++ b/.github/workflows/scorecard.yml @@ -55,6 +55,6 @@ jobs: retention-days: 5 - name: "Upload to code-scanning" - uses: github/codeql-action/upload-sarif@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2 + uses: github/codeql-action/upload-sarif@e4fba868fa4b1b91e1fdab776edc8cfbe6e9fb81 # v4.37.3 with: sarif_file: results.sarif From 9009e2e03349cd746901fd5bfa7feaa99fba1c80 Mon Sep 17 00:00:00 2001 From: honeyverma1 Date: Fri, 31 Jul 2026 13:57:12 +0530 Subject: [PATCH 2/6] refactor(fossology): replaced field injection with construction injection --- .../main/java/org/eclipse/sw360/fossology/FossologyHandler.java | 2 +- .../main/java/org/eclipse/sw360/fossology/FossologyServlet.java | 2 +- .../org/eclipse/sw360/fossology/config/FossologyRestConfig.java | 2 +- .../org/eclipse/sw360/fossology/rest/FossologyRestClient.java | 2 +- 4 files changed, 4 insertions(+), 4 deletions(-) diff --git a/backend/fossology/src/main/java/org/eclipse/sw360/fossology/FossologyHandler.java b/backend/fossology/src/main/java/org/eclipse/sw360/fossology/FossologyHandler.java index 91069c531f..ce792455d6 100644 --- a/backend/fossology/src/main/java/org/eclipse/sw360/fossology/FossologyHandler.java +++ b/backend/fossology/src/main/java/org/eclipse/sw360/fossology/FossologyHandler.java @@ -70,7 +70,7 @@ public class FossologyHandler implements FossologyService.Iface { boolean reportStep = false; - @Autowired + public FossologyHandler( FossologyRestConfig fossologyRestConfig, FossologyRestClient fossologyRestClient, AttachmentConnector attachmentConnector) { diff --git a/backend/fossology/src/main/java/org/eclipse/sw360/fossology/FossologyServlet.java b/backend/fossology/src/main/java/org/eclipse/sw360/fossology/FossologyServlet.java index 6a6b122269..ea5fc17690 100644 --- a/backend/fossology/src/main/java/org/eclipse/sw360/fossology/FossologyServlet.java +++ b/backend/fossology/src/main/java/org/eclipse/sw360/fossology/FossologyServlet.java @@ -25,7 +25,7 @@ @Controller public class FossologyServlet extends SpringTServlet { - @Autowired + public FossologyServlet(FossologyHandler fossologyHandler) throws MalformedURLException { // Create a service processor using the provided handler super(new FossologyService.Processor<>(fossologyHandler), new TCompactProtocol.Factory()); diff --git a/backend/fossology/src/main/java/org/eclipse/sw360/fossology/config/FossologyRestConfig.java b/backend/fossology/src/main/java/org/eclipse/sw360/fossology/config/FossologyRestConfig.java index abf36e09bf..b74d9bf6d5 100644 --- a/backend/fossology/src/main/java/org/eclipse/sw360/fossology/config/FossologyRestConfig.java +++ b/backend/fossology/src/main/java/org/eclipse/sw360/fossology/config/FossologyRestConfig.java @@ -52,7 +52,7 @@ public class FossologyRestConfig { private static final String BASEURL_VERSION_SUFFIX = "/api/v2"; - @Autowired + public FossologyRestConfig(ConfigContainerRepository repository) throws SW360Exception { this.repository = repository; // eager loading (or initial insert) diff --git a/backend/fossology/src/main/java/org/eclipse/sw360/fossology/rest/FossologyRestClient.java b/backend/fossology/src/main/java/org/eclipse/sw360/fossology/rest/FossologyRestClient.java index 0fdc819668..3a115e12e2 100644 --- a/backend/fossology/src/main/java/org/eclipse/sw360/fossology/rest/FossologyRestClient.java +++ b/backend/fossology/src/main/java/org/eclipse/sw360/fossology/rest/FossologyRestClient.java @@ -92,7 +92,7 @@ public class FossologyRestClient { private final String expectedVersionPrefix = "2."; - @Autowired + public FossologyRestClient(ObjectMapper objectMapper, FossologyRestConfig restConfig, RestTemplate restTemplate) { this.objectMapper = objectMapper; this.restConfig = restConfig; From 3247068211ae8f6699fa5579e4b8cae6cf349748 Mon Sep 17 00:00:00 2001 From: honeyverma1 Date: Fri, 31 Jul 2026 18:47:30 +0530 Subject: [PATCH 3/6] refactor(rest): remove redundant @Autowired annotations and implemented Contructor injections. Signed-off-by: honeyverma1 --- .../client/rest/OAuthClientController.java | 17 +++++++++++------ .../service/Sw360ClientDetailsService.java | 7 +++++-- .../cache/CacheAdminController.java | 6 +++++- .../changelog/ChangeLogController.java | 4 ++-- .../ClearingRequestController.java | 4 ++-- .../ModerationRequestController.java | 4 ++-- .../resourceserver/search/SearchController.java | 4 ++-- .../jwt/Sw360JWTAccessTokenConverter.java | 8 +++++--- .../Sw360AuthorizationServerConfiguration.java | 1 - .../service/Sw360OidcUserInfoService.java | 8 ++++++-- .../client/service/Sw360UserDetailsService.java | 12 ++++++++---- .../security/Sw360TokenCustomizerConfig.java | 8 ++++++-- .../Sw360UserAuthenticationProvider.java | 11 +++++++---- 13 files changed, 61 insertions(+), 33 deletions(-) diff --git a/rest/authorization-server/src/main/java/org/eclipse/sw360/rest/authserver/client/rest/OAuthClientController.java b/rest/authorization-server/src/main/java/org/eclipse/sw360/rest/authserver/client/rest/OAuthClientController.java index edee10ebea..4226db7294 100644 --- a/rest/authorization-server/src/main/java/org/eclipse/sw360/rest/authserver/client/rest/OAuthClientController.java +++ b/rest/authorization-server/src/main/java/org/eclipse/sw360/rest/authserver/client/rest/OAuthClientController.java @@ -68,17 +68,22 @@ public class OAuthClientController { */ public static final String UNUSED_REDIRECT_URI = "https://localhost/unused-redirect"; - @Autowired - private PasswordEncoder passwordEncoder; + + private final PasswordEncoder passwordEncoder; @Value("${security.oauth2.resource.id}") private String resourceId; - @Autowired - private OAuthClientRepository repo; - @Autowired - private Sw360UserMirrorService userMirrorService; + private final OAuthClientRepository repo; + + private final Sw360UserMirrorService userMirrorService; + + OAuthClientController(PasswordEncoder passwordEncoder, OAuthClientRepository oAuthClientRepository, Sw360UserMirrorService sw360UserMirrorService) { + this.passwordEncoder = passwordEncoder; + this.repo = oAuthClientRepository; + this.userMirrorService = sw360UserMirrorService; + } /** * Normalize a caller-supplied {@code scope} set to the canonical diff --git a/rest/authorization-server/src/main/java/org/eclipse/sw360/rest/authserver/client/service/Sw360ClientDetailsService.java b/rest/authorization-server/src/main/java/org/eclipse/sw360/rest/authserver/client/service/Sw360ClientDetailsService.java index a516197767..b8ada0e299 100644 --- a/rest/authorization-server/src/main/java/org/eclipse/sw360/rest/authserver/client/service/Sw360ClientDetailsService.java +++ b/rest/authorization-server/src/main/java/org/eclipse/sw360/rest/authserver/client/service/Sw360ClientDetailsService.java @@ -49,8 +49,11 @@ public class Sw360ClientDetailsService implements RegisteredClientRepository { @Value("${security.refreshtoken.validity:360}") private Integer defaultRefreshTokenValiditySeconds; - @Autowired - private OAuthClientRepository clientRepo; + private final OAuthClientRepository clientRepo; + + Sw360ClientDetailsService(OAuthClientRepository oAuthClientRepository) { + this.clientRepo = oAuthClientRepository; + } @Override public RegisteredClient findByClientId(@Nonnull String clientId) { diff --git a/rest/resource-server/src/main/java/org/eclipse/sw360/rest/resourceserver/cache/CacheAdminController.java b/rest/resource-server/src/main/java/org/eclipse/sw360/rest/resourceserver/cache/CacheAdminController.java index 86fba41a5f..30291d0a0a 100644 --- a/rest/resource-server/src/main/java/org/eclipse/sw360/rest/resourceserver/cache/CacheAdminController.java +++ b/rest/resource-server/src/main/java/org/eclipse/sw360/rest/resourceserver/cache/CacheAdminController.java @@ -47,7 +47,6 @@ * for all READ-only users on all endpoints — not just admin endpoints.

*/ @BasePathAwareController -@RequiredArgsConstructor(onConstructor = @__(@Autowired)) @RestController @SecurityRequirement(name = "tokenAuth") @SecurityRequirement(name = "basic") @@ -63,6 +62,11 @@ public class CacheAdminController implements RepresentationModelProcessor tokenCustomizer() { diff --git a/rest/rest-common/src/main/java/org/eclipse/sw360/rest/common/security/authproviders/Sw360UserAuthenticationProvider.java b/rest/rest-common/src/main/java/org/eclipse/sw360/rest/common/security/authproviders/Sw360UserAuthenticationProvider.java index 05528b19a8..6399b93908 100644 --- a/rest/rest-common/src/main/java/org/eclipse/sw360/rest/common/security/authproviders/Sw360UserAuthenticationProvider.java +++ b/rest/rest-common/src/main/java/org/eclipse/sw360/rest/common/security/authproviders/Sw360UserAuthenticationProvider.java @@ -23,11 +23,14 @@ @Service public class Sw360UserAuthenticationProvider implements AuthenticationProvider { - @Autowired - private Sw360UserDetailsService userDetailsService; + private final Sw360UserDetailsService userDetailsService; - @Autowired - private PasswordEncoder passwordEncoder; + private final PasswordEncoder passwordEncoder; + + Sw360UserAuthenticationProvider(PasswordEncoder passwordEncoder, Sw360UserDetailsService sw360UserDetailsService) { + this.passwordEncoder = passwordEncoder; + this.userDetailsService = sw360UserDetailsService; + } /** * @param authentication the authentication request object. From 9b4bc3f0e08f8f5974d2d4e24983c5e8b02f3128 Mon Sep 17 00:00:00 2001 From: honeyverma1 Date: Sat, 1 Aug 2026 18:27:43 +0530 Subject: [PATCH 4/6] refactor(tests): removed @Autowired annotations from tests and implemented constructor injections --- .../security/jwt/Sw360JWTAccessTokenConverterTest.java | 2 +- .../authproviders/Sw360UserAuthenticationProvider.java | 2 +- .../authproviders/Sw360UserAuthenticationProviderTest.java | 3 ++- 3 files changed, 4 insertions(+), 3 deletions(-) diff --git a/rest/resource-server/src/test/java/org/eclipse/sw360/rest/resourceserver/security/jwt/Sw360JWTAccessTokenConverterTest.java b/rest/resource-server/src/test/java/org/eclipse/sw360/rest/resourceserver/security/jwt/Sw360JWTAccessTokenConverterTest.java index 90867fd3d5..800beac4fc 100644 --- a/rest/resource-server/src/test/java/org/eclipse/sw360/rest/resourceserver/security/jwt/Sw360JWTAccessTokenConverterTest.java +++ b/rest/resource-server/src/test/java/org/eclipse/sw360/rest/resourceserver/security/jwt/Sw360JWTAccessTokenConverterTest.java @@ -44,7 +44,7 @@ public class Sw360JWTAccessTokenConverterTest { @BeforeEach public void setUp() { - converter = new Sw360JWTAccessTokenConverter(); + converter = new Sw360JWTAccessTokenConverter(userService); ReflectionTestUtils.setField(converter, "userService", userService); ReflectionTestUtils.setField(converter, "principleAttribute", "email"); } diff --git a/rest/rest-common/src/main/java/org/eclipse/sw360/rest/common/security/authproviders/Sw360UserAuthenticationProvider.java b/rest/rest-common/src/main/java/org/eclipse/sw360/rest/common/security/authproviders/Sw360UserAuthenticationProvider.java index 6399b93908..77aff95dce 100644 --- a/rest/rest-common/src/main/java/org/eclipse/sw360/rest/common/security/authproviders/Sw360UserAuthenticationProvider.java +++ b/rest/rest-common/src/main/java/org/eclipse/sw360/rest/common/security/authproviders/Sw360UserAuthenticationProvider.java @@ -27,7 +27,7 @@ public class Sw360UserAuthenticationProvider implements AuthenticationProvider { private final PasswordEncoder passwordEncoder; - Sw360UserAuthenticationProvider(PasswordEncoder passwordEncoder, Sw360UserDetailsService sw360UserDetailsService) { + public Sw360UserAuthenticationProvider(PasswordEncoder passwordEncoder, Sw360UserDetailsService sw360UserDetailsService) { this.passwordEncoder = passwordEncoder; this.userDetailsService = sw360UserDetailsService; } diff --git a/rest/rest-common/src/test/java/org/eclipse/sw360/rest/authserver/security/authproviders/Sw360UserAuthenticationProviderTest.java b/rest/rest-common/src/test/java/org/eclipse/sw360/rest/authserver/security/authproviders/Sw360UserAuthenticationProviderTest.java index 63ca548084..bb9970f03a 100644 --- a/rest/rest-common/src/test/java/org/eclipse/sw360/rest/authserver/security/authproviders/Sw360UserAuthenticationProviderTest.java +++ b/rest/rest-common/src/test/java/org/eclipse/sw360/rest/authserver/security/authproviders/Sw360UserAuthenticationProviderTest.java @@ -33,11 +33,12 @@ public class Sw360UserAuthenticationProviderTest { @Test public void shouldAddPasswordFactorAuthority_onSuccessfulAuthentication() { - Sw360UserAuthenticationProvider provider = new Sw360UserAuthenticationProvider(); Sw360UserDetailsService userDetailsService = mock(Sw360UserDetailsService.class); PasswordEncoder passwordEncoder = mock(PasswordEncoder.class); + Sw360UserAuthenticationProvider provider = new Sw360UserAuthenticationProvider(passwordEncoder, userDetailsService); + ReflectionTestUtils.setField(provider, "userDetailsService", userDetailsService); ReflectionTestUtils.setField(provider, "passwordEncoder", passwordEncoder); From f5d8e8df87bb6221f208b49e7ba8b6e4114c3e59 Mon Sep 17 00:00:00 2001 From: honeyverma1 Date: Sat, 1 Aug 2026 18:35:12 +0530 Subject: [PATCH 5/6] refactor(tests): removed @Autowired annotations from import statements --- .../security/authproviders/Sw360UserAuthenticationProvider.java | 1 - 1 file changed, 1 deletion(-) diff --git a/rest/rest-common/src/main/java/org/eclipse/sw360/rest/common/security/authproviders/Sw360UserAuthenticationProvider.java b/rest/rest-common/src/main/java/org/eclipse/sw360/rest/common/security/authproviders/Sw360UserAuthenticationProvider.java index 77aff95dce..71497a309d 100644 --- a/rest/rest-common/src/main/java/org/eclipse/sw360/rest/common/security/authproviders/Sw360UserAuthenticationProvider.java +++ b/rest/rest-common/src/main/java/org/eclipse/sw360/rest/common/security/authproviders/Sw360UserAuthenticationProvider.java @@ -5,7 +5,6 @@ package org.eclipse.sw360.rest.common.security.authproviders; import org.eclipse.sw360.rest.common.client.service.Sw360UserDetailsService; -import org.springframework.beans.factory.annotation.Autowired; import org.springframework.security.authentication.AuthenticationProvider; import org.springframework.security.authentication.BadCredentialsException; import org.springframework.security.authentication.UsernamePasswordAuthenticationToken; From 4eff9a7ba4463d4e18e25d7d19892fe30c6a0755 Mon Sep 17 00:00:00 2001 From: honeyverma1 Date: Tue, 4 Aug 2026 09:22:59 +0530 Subject: [PATCH 6/6] refactor(Sw360AuthorizationServerConfiguration): added @Autowired annotations back --- .../security/Sw360AuthorizationServerConfiguration.java | 1 + 1 file changed, 1 insertion(+) diff --git a/rest/resource-server/src/test/java/org/eclipse/sw360/rest/resourceserver/configuration/security/Sw360AuthorizationServerConfiguration.java b/rest/resource-server/src/test/java/org/eclipse/sw360/rest/resourceserver/configuration/security/Sw360AuthorizationServerConfiguration.java index 8cbce9b421..db293284d8 100644 --- a/rest/resource-server/src/test/java/org/eclipse/sw360/rest/resourceserver/configuration/security/Sw360AuthorizationServerConfiguration.java +++ b/rest/resource-server/src/test/java/org/eclipse/sw360/rest/resourceserver/configuration/security/Sw360AuthorizationServerConfiguration.java @@ -49,6 +49,7 @@ public SecurityFilterChain appSecurity(HttpSecurity httpSecurity) { return httpSecurity.build(); } + @Autowired public void authenticationManagerBuilder(AuthenticationManagerBuilder authenticationManagerBuilder, PasswordEncoder passwordEncoder, Sw360CustomUserDetailsService userDetailsService) { authenticationManagerBuilder.authenticationProvider(