Release/3.5.9

.github/workflows/codeql.yml

@@ -0,0 +1,83 @@
+name: "CodeQL"
+
+on:
+  push:
+    branches: [ 'develop', 'master' ]
+  pull_request:
+    branches: [ 'develop', 'master' ]
+  schedule:
+    - cron: '19 6 * * 2'
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    # Runner size impacts CodeQL analysis time. To learn more, please see:
+    #   - https://gh.io/recommended-hardware-resources-for-running-codeql
+    #   - https://gh.io/supported-runners-and-hardware-resources
+    #   - https://gh.io/using-larger-runners (GitHub.com only)
+    # Consider using larger runners or machines with greater resources for possible analysis time improvements.
+    runs-on: ${{ (matrix.language == 'swift' && 'macos-latest') || 'ubuntu-latest' }}
+    timeout-minutes: ${{ (matrix.language == 'swift' && 120) || 360 }}
+    permissions:
+      # required for all workflows
+      security-events: write
+
+      # required to fetch internal or private CodeQL packs
+      packages: read
+
+      # only required for workflows in private repositories
+      actions: read
+      contents: read
+
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+        - language: 'java-kotlin'
+          build-mode: none
+        - language: 'python'
+        - language: 'javascript'
+        # CodeQL supports the following values keywords for 'language': 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby'
+        # Use `c-cpp` to analyze code written in C, C++ or both
+        # Use 'java-kotlin' to analyze code written in Java, Kotlin or both
+        # Use 'javascript-typescript' to analyze code written in JavaScript, TypeScript or both
+        # To learn more about changing the languages that are analyzed or customizing the build mode for your analysis,
+        # see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/customizing-your-advanced-setup-for-code-scanning.
+        # If you are analyzing a compiled language, you can modify the 'build-mode' for that language to customize how
+        # your codebase is analyzed, see https://docs.github.com/en/code-security/code-scanning/creating-an-advanced-setup-for-code-scanning/codeql-code-scanning-for-compiled-languages
+    steps:
+    - name: Checkout repository
+      uses: actions/checkout@v4
+
+    # Initializes the CodeQL tools for scanning.
+    - name: Initialize CodeQL
+      uses: github/codeql-action/init@v3
+      with:
+        languages: ${{ matrix.language }}
+        build-mode: ${{ matrix.build-mode }}
+        # If you wish to specify custom queries, you can do so here or in a config file.
+        # By default, queries listed here will override any specified in a config file.
+        # Prefix the list here with "+" to use these queries and those in the config file.
+
+        # For more details on CodeQL's query packs, refer to: https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
+        queries: security-extended
+
+    # If the analyze step fails for one of the languages you are analyzing with
+    # "We were unable to automatically build your code", modify the matrix above
+    # to set the build mode to "manual" for that language. Then modify this step
+    # to build your code.
+    # ℹ️ Command-line programs to run using the OS shell.
+    # 📚 See https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsrun
+    - if: matrix.build-mode == 'manual'
+      run: |
+        echo 'If you are using a "manual" build mode for one or more of the' \
+          'languages you are analyzing, replace this with the commands to build' \
+          'your code, for example:'
+        echo '  make bootstrap'
+        echo '  make release'
+        exit 1
+
+    - name: Perform CodeQL Analysis
+      uses: github/codeql-action/analyze@v3
+      with:
+        category: "/language:${{matrix.language}}"

.github/workflows/run-build-with-test-on-pr.yml

@@ -21,11 +21,11 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v3
 
-      - name: Setup JDK 8
+      - name: Setup JDK 11
         uses: actions/setup-java@v3
         with:
           distribution: 'zulu'
-          java-version: '8.0.345'
+          java-version: '11.0.22'
           architecture: x64
           cache: 'gradle'
 

NOTICE

@@ -581,3 +581,15 @@ See the License for the specific language governing permissions and
 limitations under the License.
 
 =====
+
+Copyright (c) 2008, SnakeYAML
+
+Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except
+in compliance with the License. You may obtain a copy of the License at
+
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software distributed under the License
+is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express
+or implied. See the License for the specific language governing permissions and limitations under
+the License.

README.md

@@ -1,5 +1,5 @@
 * Please post questions in [Discussions](https://github.com/naver/ngrinder/discussions) not Issues.
-* nGrinder 3.5.8 has been released. See https://github.com/naver/ngrinder/releases
+* nGrinder 3.5.9 has been released. See https://github.com/naver/ngrinder/releases
 * Currently, we are working on the internal project not ngrinder. We will resume ngrinder dev from July, 2022.
 
 nGrinder 

RELEASE-NOTE.md

@@ -1,3 +1,12 @@
+3.5.9 (2023.02.28)
+=================
+- Changes
+  - Fix security vulnerabilities
+  - Bump base JDK version up to 11
+- Bug fix
+  - #998 Fix failing to call mvn and gradle command in Windows
+  - #1004 Fix script validation error in docker env
+
 3.5.8 (2022.12.30)
 =================
 - Changes

build.gradle

@@ -2,7 +2,7 @@ allprojects  {
   apply plugin: "idea"
 
   group = "org.ngrinder"
-  version = "3.5.8"
+  version = "3.5.9"
 
   idea {
     module {
@@ -28,8 +28,8 @@ subprojects {
   compileJava.options.encoding = "UTF-8"
   compileTestJava.options.encoding = "UTF-8"
 
-  sourceCompatibility = 1.8
-  targetCompatibility = 1.8
+  sourceCompatibility = 11
+  targetCompatibility = 11
 
   ext {
     profile = project.hasProperty("profile") ? profile : "production"

docker/README.md

@@ -16,7 +16,7 @@ nGrinder consists of two major components.
 
 Version
 ---------
-Current Version: 3.4
+Current Version: 3.5.9
 
 How to run nGrinder with dockers
 ===========================
@@ -27,13 +27,13 @@ Install docker 1.5.0 or above  on your host.
 Pull the ngrinder/controller image.
 
 ```
-$ docker pull ngrinder/controller:3.5.8
+$ docker pull ngrinder/controller:3.5.9
 ```
 
 Start controller.
 
 ```
-docker run -d -v ~/ngrinder-controller:/opt/ngrinder-controller -p 80:80 -p 16001:16001 -p 12000-12009:12000-12009 ngrinder/controller:3.5.8
+docker run -d -v ~/ngrinder-controller:/opt/ngrinder-controller -p 80:80 -p 16001:16001 -p 12000-12009:12000-12009 ngrinder/controller:3.5.9
 ``` 
 
 The controller creates a data folder under /opt/ngrinder-controller to maintain test history and configuration data. In order to keep the data persistently, you should map the folder /opt/ngrinder-controller on the container to a folder on your host . 
@@ -42,6 +42,8 @@ Port information:
 
 * __80__: Default controller web UI port.
 
+* __16001__: Controller port for agent connection.
+
 * __9010-9019__: agents connect to the controller cluster through these ports.
 
 * __12000-12029__: controllers allocate stress tests through these ports.
@@ -54,11 +56,11 @@ Install docker 1.5.0 or above on your another host. You should run your agent on
 Pull the ngrinder/agent image.
 
 ```
-$ docker pull ngrinder/agent:3.5.8
+$ docker pull ngrinder/agent:3.5.9
 ```
 
 Start agent.
 
 ```
-docker run -v ~/ngrinder-agent:/opt/ngrinder-agent -d ngrinder/agent:3.5.8 controller_ip:controller_web_port
+docker run -v ~/ngrinder-agent:/opt/ngrinder-agent -d ngrinder/agent:3.5.9 controller_ip:controller_web_port
 ``` 

docker/agent/Dockerfile

@@ -1,4 +1,4 @@
-FROM jeanblanchard/java:serverjre-8
+FROM azul/zulu-openjdk-alpine:11.0.22-jre
 MAINTAINER JunHo Yoon "[email protected]"
 
 RUN apk update; apk add curl bash udev

docker/controller/Dockerfile

@@ -1,9 +1,9 @@
-FROM jeanblanchard/java:serverjre-8
+FROM azul/zulu-openjdk-alpine:11.0.22-jre
 MAINTAINER JunHo Yoon "[email protected]"
 
 RUN apk update; apk add curl bash tar
 
-ARG MAVEN_VERSION=3.6.3
+ARG MAVEN_VERSION=3.9.6
 ARG MAVEN_DOWNLOAD_BASE_URL=https://apache.osuosl.org/maven/maven-3/${MAVEN_VERSION}/binaries
 
 ARG GRADLE_VERSION=6.7.1

ngrinder-controller/build.gradle

@@ -59,7 +59,7 @@ dependencies {
     implementation (group: "jaxen", name: "jaxen", version: "1.1.4")
     implementation (group: "com.beust", name: "jcommander", version: "1.32")
     implementation (group: "org.pf4j", name: "pf4j", version: "3.0.1")
-    implementation (group: "org.yaml", name: "snakeyaml", version: "1.25")
+    implementation (group: "com.esotericsoftware.yamlbeans", name: "yamlbeans", version: "1.17")
     implementation (group: "commons-collections", name: "commons-collections", version: "3.2.1")
     implementation (group: "org.reflections", name: "reflections", version: "0.9.9")
     implementation (group: "com.hazelcast", name: "hazelcast", version: hazelcast_version)

ngrinder-controller/src/main/java/org/ngrinder/agent/controller/MonitorManagerApiController.java

@@ -13,6 +13,7 @@
  */
 package org.ngrinder.agent.controller;
 
+import org.ngrinder.common.exception.NGrinderRuntimeException;
 import org.ngrinder.common.util.AopUtils;
 import org.ngrinder.infra.config.Config;
 import org.ngrinder.monitor.controller.model.SystemDataModel;
@@ -53,6 +54,13 @@ public class MonitorManagerApiController {
 	 */
 	@GetMapping("/state")
 	public SystemDataModel getRealTimeMonitorData(@RequestParam final String ip) throws InterruptedException, ExecutionException, TimeoutException {
+		if (!config.isMonitorEnabled()) {
+			throw new NGrinderRuntimeException(
+				"Monitoring is disabled. If you want to enable monitoring feature," +
+					" modify system settings. but there is a risk of attack from the monitoring server."
+			);
+		}
+
 		int port = config.getMonitorPort();
 		Future<SystemInfo> systemInfoFuture = AopUtils.proxy(this).getAsyncSystemInfo(ip, port);
 		SystemInfo systemInfo = checkNotNull(systemInfoFuture.get(2, TimeUnit.SECONDS), "Monitoring data is not available.");

ngrinder-controller/src/main/java/org/ngrinder/common/constant/ControllerConstants.java

@@ -53,13 +53,14 @@ public interface ControllerConstants {
 	String PROP_CONTROLLER_FRONT_PAGE_QNA_RSS = "controller.front_page_qna_rss";
 	String PROP_CONTROLLER_FRONT_PAGE_RESOURCES_MORE_URL = "controller.front_page_resources_more_url";
 	String PROP_CONTROLLER_HELP_URL = "controller.help_url";
-	String PROP_CONTROLLER_IP = "controller.ip";
+	String PROP_CONTROLLER_HOST = "controller.host";
 	String PROP_CONTROLLER_MAX_AGENT_PER_TEST = "controller.max_agent_per_test";
 	String PROP_CONTROLLER_MAX_CONCURRENT_TEST = "controller.max_concurrent_test";
 	String PROP_CONTROLLER_MAX_RUN_COUNT = "controller.max_run_count";
 	String PROP_CONTROLLER_MAX_RUN_HOUR = "controller.max_run_hour";
 	String PROP_CONTROLLER_MAX_VUSER_PER_AGENT = "controller.max_vuser_per_agent";
 	String PROP_CONTROLLER_MONITOR_PORT = "controller.monitor_port";
+	String PROP_CONTROLLER_ENABLE_MONITOR = "controller.enable_monitor";
 	String PROP_CONTROLLER_PLUGIN_SUPPORT = "controller.plugin_support";
 	String PROP_CONTROLLER_SAFE_DIST = "controller.safe_dist";
 	String PROP_CONTROLLER_SAFE_DIST_THRESHOLD = "controller.safe_dist_threshold";

ngrinder-controller/src/main/java/org/ngrinder/common/model/Home.java

@@ -16,8 +16,8 @@
 import org.apache.commons.io.FileUtils;
 import org.ngrinder.common.constants.GrinderConstants;
 import org.ngrinder.common.exception.ConfigurationException;
-import org.ngrinder.common.util.EncodingUtils;
 import org.ngrinder.common.util.NoOp;
+import org.ngrinder.common.util.PropertyUtils;
 import org.ngrinder.model.PerfTest;
 import org.ngrinder.model.User;
 import org.slf4j.Logger;
@@ -26,7 +26,6 @@
 
 import java.io.File;
 import java.io.IOException;
-import java.io.StringReader;
 import java.util.Properties;
 
 import static java.util.Objects.requireNonNull;
@@ -55,8 +54,8 @@ public class Home {
 	private static final String PATH_DIST = "dist";
 	private static final String PATH_STAT = "stat";
 	private final static Logger LOGGER = LoggerFactory.getLogger(Home.class);
-	private final File directory;
 	private static final String REPORT_CSV = "output.csv";
+	private final File directory;
 
 	/**
 	 * Constructor.
@@ -81,8 +80,7 @@ public Home(File directory, boolean create) {
 			}
 		}
 		if (directory.exists() && !directory.canWrite()) {
-			throw new ConfigurationException(String.format(" ngrinder home directory %s is not writable.", directory),
-					null);
+			throw new ConfigurationException(String.format(" ngrinder home directory %s is not writable.", directory), null);
 		}
 		this.directory = directory;
 	}
@@ -140,22 +138,8 @@ public void makeSubPath(String subPathName) {
 	 * @return loaded {@link Properties}
 	 */
 	public Properties getProperties(String confFileName) {
-		try {
-			File configFile = getSubFile(confFileName);
-			if (configFile.exists()) {
-				byte[] propByte = FileUtils.readFileToByteArray(configFile);
-				String propString = EncodingUtils.getAutoDecodedString(propByte, "UTF-8");
-				Properties prop = new Properties();
-				prop.load(new StringReader(propString));
-				return prop;
-			} else {
-				// default empty properties.
-				return new Properties();
-			}
-
-		} catch (IOException e) {
-			throw processException("Fail to load property file " + confFileName, e);
-		}
+		File configFile = getSubFile(confFileName);
+		return PropertyUtils.loadProperties(configFile);
 	}
 
 	/**