security: CVE fixes (#854)

security: Upgraded to Jetty 12 to resolve CVE issues

Signed-off-by: dhoard <doug.hoard@gmail.com>
Co-authored-by: Ben Kochie <superq@gmail.com>

Author: dhoard

pom.xml

@@ -98,8 +98,13 @@
     </dependency>
     <dependency>
       <groupId>org.eclipse.jetty</groupId>
-      <artifactId>jetty-servlet</artifactId>
-      <version>11.0.26</version>
+      <artifactId>jetty-server</artifactId>
+      <version>12.0.36</version>
+    </dependency>
+    <dependency>
+      <groupId>org.eclipse.jetty.ee10</groupId>
+      <artifactId>jetty-ee10-servlet</artifactId>
+      <version>12.0.36</version>
     </dependency>
     <dependency>
       <groupId>com.github.ben-manes.caffeine</groupId>
@@ -141,7 +146,7 @@
         <artifactId>maven-compiler-plugin</artifactId>
         <version>3.15.0</version>
         <configuration>
-          <release>11</release>
+          <release>17</release>
         </configuration>
       </plugin>
       <!-- Build a full jar with dependencies -->
@@ -195,7 +200,7 @@
         <artifactId>maven-surefire-plugin</artifactId>
         <version>3.5.6</version>
         <configuration>
-          <argLine>-Djdk.net.URLClassPath.disableClassPathURLCheck=true</argLine>
+          <argLine>-javaagent:${settings.localRepository}/org/mockito/mockito-core/5.23.0/mockito-core-5.23.0.jar -XX:+EnableDynamicAgentLoading -Djdk.net.URLClassPath.disableClassPathURLCheck=true</argLine>
         </configuration>
       </plugin>
       <plugin>

src/main/java/io/prometheus/cloudwatch/DisallowHttpMethods.java

@@ -3,23 +3,25 @@
 import java.util.EnumSet;
 import org.eclipse.jetty.http.HttpMethod;
 import org.eclipse.jetty.http.HttpStatus;
-import org.eclipse.jetty.server.Connector;
-import org.eclipse.jetty.server.HttpConfiguration;
+import org.eclipse.jetty.server.Handler;
 import org.eclipse.jetty.server.Request;
+import org.eclipse.jetty.server.Response;
+import org.eclipse.jetty.util.Callback;
 
-class DisallowHttpMethods implements HttpConfiguration.Customizer {
+class DisallowHttpMethods extends Handler.Wrapper {
   private final EnumSet<HttpMethod> disallowedMethods;
 
   public DisallowHttpMethods(EnumSet<HttpMethod> disallowedMethods) {
     this.disallowedMethods = disallowedMethods;
   }
 
   @Override
-  public void customize(Connector connector, HttpConfiguration channelConfig, Request request) {
-    HttpMethod httpMethod = HttpMethod.fromString(request.getMethod());
-    if (disallowedMethods.contains(httpMethod)) {
-      request.setHandled(true);
-      request.getResponse().setStatus(HttpStatus.METHOD_NOT_ALLOWED_405);
+  public boolean handle(Request request, Response response, Callback callback) throws Exception {
+    if (disallowedMethods.contains(HttpMethod.fromString(request.getMethod()))) {
+      response.setStatus(HttpStatus.METHOD_NOT_ALLOWED_405);
+      callback.succeeded();
+      return true;
     }
+    return super.handle(request, response, callback);
   }
 }

src/main/java/io/prometheus/cloudwatch/WebServer.java

@@ -4,13 +4,13 @@
 import io.prometheus.client.servlet.jakarta.exporter.MetricsServlet;
 import java.io.FileReader;
 import java.util.EnumSet;
+import org.eclipse.jetty.ee10.servlet.ServletContextHandler;
+import org.eclipse.jetty.ee10.servlet.ServletHolder;
 import org.eclipse.jetty.http.HttpMethod;
 import org.eclipse.jetty.server.HttpConfiguration;
 import org.eclipse.jetty.server.HttpConnectionFactory;
 import org.eclipse.jetty.server.Server;
 import org.eclipse.jetty.server.ServerConnector;
-import org.eclipse.jetty.servlet.ServletContextHandler;
-import org.eclipse.jetty.servlet.ServletHolder;
 
 public class WebServer {
 
@@ -35,19 +35,22 @@ public static void main(String[] args) throws Exception {
     int port = Integer.parseInt(args[0]);
     Server server = new Server();
     HttpConfiguration httpConfig = new HttpConfiguration();
-    httpConfig.addCustomizer(new DisallowHttpMethods(EnumSet.of(HttpMethod.TRACE)));
     ServerConnector connector = new ServerConnector(server, new HttpConnectionFactory(httpConfig));
     connector.setPort(port);
     server.addConnector(connector);
 
     ServletContextHandler context = new ServletContextHandler();
     context.setContextPath("/");
-    server.setHandler(context);
     context.addServlet(new ServletHolder(new MetricsServlet()), "/metrics");
     context.addServlet(new ServletHolder(new DynamicReloadServlet(collector)), "/-/reload");
     context.addServlet(new ServletHolder(new HealthServlet()), "/-/healthy");
     context.addServlet(new ServletHolder(new HealthServlet()), "/-/ready");
     context.addServlet(new ServletHolder(new HomePageServlet()), "/");
+
+    DisallowHttpMethods disallowHandler = new DisallowHttpMethods(EnumSet.of(HttpMethod.TRACE));
+    disallowHandler.setHandler(context);
+    server.setHandler(disallowHandler);
+
     server.start();
     server.join();
   }