fix: scope Chen runtime image and Java/JDBC vulnerability fixes

.github/workflows/build-base-image.yml

@@ -38,6 +38,20 @@ jobs:
         id: repo
         run: echo "REPO=$(basename ${{ github.repository }})" >> $GITHUB_ENV
 
+      - name: Debug Maven download URL
+        run: |
+          set -eux
+
+          MAVEN_VERSION=3.9.12
+          BASE_URL="https://downloads.apache.org/maven/maven-3/${MAVEN_VERSION}/binaries"
+          MAVEN_URL="${BASE_URL}/apache-maven-${MAVEN_VERSION}-bin.tar.gz"
+
+          echo "MAVEN_VERSION=${MAVEN_VERSION}"
+          echo "BASE_URL=${BASE_URL}"
+          echo "MAVEN_URL=${MAVEN_URL}"
+
+          curl -fSLI "${MAVEN_URL}"
+
       - name: Build and push multi-arch image
         uses: docker/build-push-action@v6
         with:

Dockerfile

@@ -13,7 +13,7 @@ FROM debian:trixie-slim
 
 ARG DEPENDENCIES="                    \
         ca-certificates               \
-        openjdk-21-jdk-headless"
+        openjdk-21-jre-headless"
 
 ARG APT_MIRROR=http://deb.debian.org
 
@@ -23,7 +23,7 @@ RUN set -ex \
     && apt-get update \
     && apt-get install -y --no-install-recommends ${DEPENDENCIES} \
     && echo "no" | dpkg-reconfigure dash \
-    && sed -i "s@jdk.tls.disabledAlgorithms=SSLv3, TLSv1, TLSv1.1@jdk.tls.disabledAlgorithms=SSLv3@" /etc/java-21-openjdk/security/java.security
+    && sed -i "s@jdk.tls.disabledAlgorithms=SSLv3, TLSv1, TLSv1.1@jdk.tls.disabledAlgorithms=SSLv3@" /etc/java-21-openjdk/security/java.security \
 
 WORKDIR /opt/chen
 

Dockerfile-ee

@@ -4,14 +4,13 @@ FROM jumpserver/chen:${VERSION}-ce
 ARG TARGETARCH
 
 ARG DEPENDENCIES="                    \
-        curl                          \
         iputils-ping                  \
         telnet                        \
-        vim                           \
         wget"
 
 RUN --mount=type=cache,target=/var/cache/apt,sharing=locked,id=chen \
     --mount=type=cache,target=/var/lib/apt,sharing=locked,id=chen \
     set -ex \
     && apt-get update \
     && apt-get install -y --no-install-recommends ${DEPENDENCIES}
+

backend/modules/src/main/java/org.jumpserver.chen.modules/sqlserver/SQLServerConnectionManager.java

@@ -10,14 +10,15 @@
 import java.lang.reflect.InvocationTargetException;
 import java.sql.Driver;
 import java.sql.SQLException;
+import java.util.List;
 
 @Slf4j
 public class SQLServerConnectionManager extends BaseConnectionManager {
 
     private static final String jdbcUrlTemplate = "jdbc:sqlserver://${host}:${port};DatabaseName=${db};trustServerCertificate=true;";
     private String jdbcUrl;
 
-    private String driverClassloaderName = "mssql-jdbc-12.2.0.jre11.jar";
+    private String driverClassloaderName = "mssql-jdbc-12.10.2.jre11.jar";
 
     public SQLServerConnectionManager(DBConnectInfo connectInfo, Datasource datasource) {
         super(connectInfo, datasource);
@@ -44,12 +45,17 @@ public Driver getDriver() {
                 this.driverClassloaderName = "mssql-jdbc-6.4.0.jre9.jar";
             }
         }
+        var candidateJarNames = List.of(
+                this.driverClassloaderName,
+                "mssql-jdbc-12.2.1.jre11.jar",
+                "mssql-jdbc-12.2.0.jre11.jar"
+        );
         for (DriverClassLoader classLoader : driverClassLoaders) {
-            if (!classLoader.getJarName().equals(this.driverClassloaderName)) {
+            if (!candidateJarNames.contains(classLoader.getJarName())) {
                 continue;
             }
             try {
-                log.info("select driver jar: {}", this.driverClassloaderName);
+                log.info("select driver jar: {}", classLoader.getJarName());
                 return (Driver) classLoader.loadClass(this.getDriverClassName()).getDeclaredConstructor().newInstance();
             } catch (InstantiationException | IllegalAccessException | ClassNotFoundException |
                      InvocationTargetException | NoSuchMethodException e) {

backend/modules/src/test/java/mysql/TestMysqlDriver.java

@@ -16,7 +16,7 @@ public static void main(String[] args) {
         try {
 
 
-            ClassLoader classLoader = new URLClassLoader(new URL[]{new URL("file:/Users/shenchenyang/IdeaProjects/chen/drivers/mysql/mysql-connector-java-8.0.28.jar")});
+            ClassLoader classLoader = new URLClassLoader(new URL[]{new URL("file:/Users/shenchenyang/IdeaProjects/chen/drivers/mysql/mysql-connector-j-8.4.0.jar")});
 
             Driver driver = (Driver) classLoader.loadClass("com.mysql.cj.jdbc.Driver").getDeclaredConstructor().newInstance();
             DruidDataSource ds = new DruidDataSource();

backend/web/pom.xml

@@ -61,6 +61,18 @@
             <version>2.13.1.RELEASE</version>
         </dependency>
 
+        <dependency>
+            <groupId>io.grpc</groupId>
+            <artifactId>grpc-netty-shaded</artifactId>
+            <version>${grpc.version}</version>
+        </dependency>
+
+        <dependency>
+            <groupId>io.grpc</groupId>
+            <artifactId>grpc-inprocess</artifactId>
+            <version>${grpc.version}</version>
+        </dependency>
+
         <dependency>
             <groupId>org.springframework.boot</groupId>
             <artifactId>spring-boot-starter-web</artifactId>

backend/wisp/pom.xml

@@ -15,7 +15,7 @@
         <dependency>
             <groupId>io.grpc</groupId>
             <artifactId>grpc-all</artifactId>
-            <version>1.55.1</version>
+            <version>${grpc.version}</version>
         </dependency>
         <dependency>
             <groupId>com.google.protobuf</groupId>

pom.xml

@@ -30,7 +30,9 @@
         <frontend-maven-plugin.version>1.12.1</frontend-maven-plugin.version>
         <node.version>v14.18.0</node.version>
         <npm.version>6.14.15</npm.version>
-        <tomcat.version>10.1.47</tomcat.version>
+        <tomcat.version>10.1.54</tomcat.version>
+        <grpc.version>1.75.0</grpc.version>
+        <netty.version>4.1.132.Final</netty.version>
     </properties>
 
     <build>
@@ -41,6 +43,13 @@
                 <configuration>
                     <source>${java.version}</source>
                     <target>${java.version}</target>
+                    <annotationProcessorPaths>
+                        <path>
+                            <groupId>org.projectlombok</groupId>
+                            <artifactId>lombok</artifactId>
+                            <version>1.18.38</version>
+                        </path>
+                    </annotationProcessorPaths>
                 </configuration>
             </plugin>
         </plugins>