<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>
    <groupId>org.owasp</groupId>
    <artifactId>benchmark</artifactId>
    <version>1.2</version>
    <packaging>war</packaging>

    <name>OWASP Benchmark for Java</name>
    <description>OWASP Benchmark is a Java test suite designed to evaluate the accuracy, coverage, and speed of automated software vulnerability detection tools.</description>
    <url>https://owasp.org/www-project-benchmark/</url>

    <developers>
        <developer>
            <id>davewichers</id>
            <name>Dave Wichers</name>
            <email>dave.wichers@owasp.org</email>
        </developer>
    </developers>

    <licenses>
        <license>
            <name>GNU General Public License, version 2 (GPL2)</name>
            <url>https://choosealicense.com/licenses/gpl-2.0/</url>
        </license>
    </licenses>

    <profiles>

        <profile>
            <id>findsecbugs</id>
            <build>
                <plugins>
                    <plugin>
                        <groupId>com.github.spotbugs</groupId>
                        <artifactId>spotbugs-maven-plugin</artifactId>
                        <executions>
                            <execution>
                                <phase>compile</phase>
                                <goals>
                                    <goal>spotbugs</goal>
                                </goals>
                            </execution>
                        </executions>
                        <configuration>
                            <effort>Max</effort>
                            <threshold>Low</threshold>
                            <failOnError>true</failOnError>
                            <includeFilterFile>${basedir}/src/main/resources/findbugs-security-include.xml</includeFilterFile>
                            <excludeFilterFile>${basedir}/src/main/resources/findbugs-security-exclude.xml</excludeFilterFile>
                            <plugins>
                                <plugin>
                                    <groupId>com.h3xstream.findsecbugs</groupId>
                                    <artifactId>findsecbugs-plugin</artifactId>
                                    <version>1.12.0</version>
                                </plugin>
                            </plugins>
                        </configuration>
                    </plugin>
                </plugins>
            </build>
        </profile>

        <profile>
            <id>deploy</id>
            <build>
                <plugins>
                    <plugin>
                        <artifactId>maven-antrun-plugin</artifactId>
                        <executions>
                            <execution>
                                <id>ldap-server</id>
                                <phase>package</phase>
                                <goals>
                                    <goal>run</goal>
                                </goals>
                                <configuration>
                                    <target>
                                        <ant target="run" antfile="${basedir}/src/config/build.xml">
                                            <reference torefid="maven.compile.classpath" refid="maven.compile.classpath" />
                                        </ant>
                                    </target>
                                </configuration>
                            </execution>
                            <execution>
                                <id>database-server</id>
                                <phase>package</phase>
                                <goals>
                                    <goal>run</goal>
                                </goals>
                                <configuration>
                                    <target>
                                        <ant target="databaseServer" antfile="${basedir}/src/config/build.xml">
                                            <reference torefid="maven.compile.classpath" refid="maven.compile.classpath" />
                                        </ant>
                                    </target>
                                </configuration>
                            </execution>
                            <execution>
                                <id>database-init</id>
                                <phase>package</phase>
                                <goals>
                                    <goal>run</goal>
                                </goals>
                                <configuration>
                                    <target>
                                        <ant target="databaseInit" antfile="${basedir}/src/config/build.xml">
                                            <reference torefid="maven.compile.classpath" refid="maven.compile.classpath" />
                                        </ant>
                                    </target>
                                </configuration>
                            </execution>
                        </executions>
                    </plugin>
                    <plugin>
                        <groupId>org.codehaus.cargo</groupId>
                        <artifactId>cargo-maven3-plugin</artifactId>
                        <configuration>

                            <!-- Container configuration -->
                            <container>
                                <timeout>300000</timeout>
                                <containerId>tomcat${tomcat.major.version}x</containerId>
                                <zipUrlInstaller>
                                    <url>${tomcat.url}</url>
                                </zipUrlInstaller>
                                <output>${log.directory}/cargo-output.log</output>
                                <append>false</append>
                                <log>${log.directory}/cargo.log</log>
                            </container>

                            <!-- Configuration to use with the container or the deployer -->
                            <configuration>
                                <configfiles>
                                    <configfile>
                                        <file>${basedir}/src/config/${runenv}/server.xml</file>
                                        <todir>conf</todir>
                                        <overwrite>true</overwrite>
                                    </configfile>
                                    <configfile>
                                        <file>${basedir}/src/config/${runenv}/context.xml</file>
                                        <todir>conf</todir>
                                        <overwrite>true</overwrite>
                                    </configfile>
                                </configfiles>
                                <home>${project.build.directory}/tomcat${tomcat.major.version}x</home>
                                <properties>
                                    <cargo.servlet.port>8443</cargo.servlet.port>
                                    <cargo.protocol>https</cargo.protocol>
                                    <cargo.tomcat.connector.protocolClass>HTTP/1.1</cargo.tomcat.connector.protocolClass>
                                    <cargo.tomcat.connector.uriEncoding>ISO-8859-1</cargo.tomcat.connector.uriEncoding>
                                    <cargo.tomcat.connector.clientAuth>false</cargo.tomcat.connector.clientAuth>
                                    <cargo.tomcat.connector.sslProtocol>TLS</cargo.tomcat.connector.sslProtocol>
                                    <cargo.tomcat.connector.keystoreFile>${project.basedir}/.keystore</cargo.tomcat.connector.keystoreFile>
                                    <cargo.tomcat.connector.keystorePass>changeit</cargo.tomcat.connector.keystorePass>
                                    <cargo.tomcat.connector.keyAlias>tomcat</cargo.tomcat.connector.keyAlias>
                                    <cargo.tomcat.httpSecure>true</cargo.tomcat.httpSecure>
                                    <cargo.start.jvmargs>
                                        ${tomcat.jvmargs}
                                        ${tomcat.jvmargs.debug}
                                    </cargo.start.jvmargs>
                                </properties>
                            </configuration>
                        </configuration>
                    </plugin>
                </plugins>
            </build>
        </profile>

        <profile>
            <id>deploywcontrast</id>
            <build>
                <plugins>
                    <plugin>
                        <artifactId>maven-antrun-plugin</artifactId>
                        <executions>
                            <execution>
                                <id>ldap-server</id>
                                <phase>package</phase>
                                <goals>
                                    <goal>run</goal>
                                </goals>
                                <configuration>
                                    <target>
                                        <ant target="run" antfile="${basedir}/src/config/build.xml">
                                            <reference torefid="maven.compile.classpath" refid="maven.compile.classpath" />
                                        </ant>
                                    </target>
                                </configuration>
                            </execution>
                            <execution>
                                <id>database-server</id>
                                <phase>package</phase>
                                <goals>
                                    <goal>run</goal>
                                </goals>
                                <configuration>
                                    <target>
                                        <ant target="databaseServer" antfile="${basedir}/src/config/build.xml">
                                            <reference torefid="maven.compile.classpath" refid="maven.compile.classpath" />
                                        </ant>
                                    </target>
                                </configuration>
                            </execution>
                            <execution>
                                <id>database-init</id>
                                <phase>package</phase>
                                <goals>
                                    <goal>run</goal>
                                </goals>
                                <configuration>
                                    <target>
                                        <ant target="databaseInit" antfile="${basedir}/src/config/build.xml">
                                            <reference torefid="maven.compile.classpath" refid="maven.compile.classpath" />
                                        </ant>
                                    </target>
                                </configuration>
                            </execution>
                        </executions>
                    </plugin>
                    <plugin>
                        <groupId>org.codehaus.cargo</groupId>
                        <artifactId>cargo-maven3-plugin</artifactId>
                        <configuration>

                            <!-- Container configuration -->
                            <container>
                                <timeout>300000</timeout>
                                <containerId>tomcat${tomcat.major.version}x</containerId>
                                <zipUrlInstaller>
                                    <url>${tomcat.url}</url>
                                </zipUrlInstaller>
                                <output>${log.directory}/cargo-output.log</output>
                                <append>false</append>
                                <log>${log.directory}/cargo.log</log>
                            </container>

                            <!-- Configuration to use with the container or the deployer -->
                            <configuration>
                                <configfiles>
                                    <configfile>
                                        <file>${basedir}/src/config/${runenv}/server.xml</file>
                                        <todir>conf</todir>
                                        <overwrite>true</overwrite>
                                    </configfile>
                                    <configfile>
                                        <file>${basedir}/src/config/${runenv}/context.xml</file>
                                        <todir>conf</todir>
                                        <overwrite>true</overwrite>
                                    </configfile>
                                </configfiles>
                                <home>${project.build.directory}/tomcat${tomcat.major.version}x</home>
                                <properties>
                                    <cargo.jvmargs>
                                        -Xmx8G
                                        -javaagent:${basedir}/tools/Contrast/contrast.jar
                                        -Dcontrast.dir=${basedir}/tools/Contrast/working
                                        -Dcontrast.config.path=${basedir}/tools/Contrast/contrast.yaml
                                    </cargo.jvmargs>
                                    <cargo.servlet.port>8443</cargo.servlet.port>
                                    <cargo.protocol>https</cargo.protocol>
                                    <cargo.tomcat.connector.protocolClass>HTTP/1.1</cargo.tomcat.connector.protocolClass>
                                    <cargo.tomcat.connector.uriEncoding>ISO-8859-1</cargo.tomcat.connector.uriEncoding>
                                    <cargo.tomcat.connector.clientAuth>false</cargo.tomcat.connector.clientAuth>
                                    <cargo.tomcat.connector.sslProtocol>TLS</cargo.tomcat.connector.sslProtocol>
                                    <cargo.tomcat.connector.keystoreFile>${project.basedir}/.keystore</cargo.tomcat.connector.keystoreFile>
                                    <cargo.tomcat.connector.keystorePass>changeit</cargo.tomcat.connector.keystorePass>
                                    <cargo.tomcat.connector.keyAlias>tomcat</cargo.tomcat.connector.keyAlias>
                                    <cargo.tomcat.httpSecure>true</cargo.tomcat.httpSecure>
                                </properties>
                            </configuration>
                        </configuration>
                    </plugin>
                </plugins>
            </build>
        </profile>

        <profile>
            <id>deploywseeker</id>
            <properties>
                <seeker.javaagent>-javaagent:${basedir}/tools/seeker/seeker-agent.jar</seeker.javaagent>
                <seeker.server.url>-Dseeker.server.url=https://server.example.com:8888</seeker.server.url>
                <seeker.project.key>-Dseeker.project.key=Benchmark</seeker.project.key>
            </properties>
            <build>
                <plugins>
                    <plugin>
                        <artifactId>maven-antrun-plugin</artifactId>
                        <executions>
                            <execution>
                                <id>ldap-server</id>
                                <phase>package</phase>
                                <goals>
                                    <goal>run</goal>
                                </goals>
                                <configuration>
                                    <target>
                                        <ant target="run" antfile="${basedir}/src/config/build.xml">
                                            <reference torefid="maven.compile.classpath" refid="maven.compile.classpath" />
                                        </ant>
                                    </target>
                                </configuration>
                            </execution>
                            <execution>
                                <id>database-server</id>
                                <phase>package</phase>
                                <goals>
                                    <goal>run</goal>
                                </goals>
                                <configuration>
                                    <target>
                                        <ant target="databaseServer" antfile="${basedir}/src/config/build.xml">
                                            <reference torefid="maven.compile.classpath" refid="maven.compile.classpath" />
                                        </ant>
                                    </target>
                                </configuration>
                            </execution>
                            <execution>
                                <id>database-init</id>
                                <phase>package</phase>
                                <goals>
                                    <goal>run</goal>
                                </goals>
                                <configuration>
                                    <target>
                                        <ant target="databaseInit" antfile="${basedir}/src/config/build.xml">
                                            <reference torefid="maven.compile.classpath" refid="maven.compile.classpath" />
                                        </ant>
                                    </target>
                                </configuration>
                            </execution>
                        </executions>
                    </plugin>
                    <plugin>
                        <groupId>org.codehaus.cargo</groupId>
                        <artifactId>cargo-maven3-plugin</artifactId>
                        <configuration>

                            <!-- Container configuration -->
                            <container>
                                <timeout>300000</timeout>
                                <containerId>tomcat${tomcat.major.version}x</containerId>
                                <zipUrlInstaller>
                                    <url>${tomcat.url}</url>
                                </zipUrlInstaller>
                                <output>${log.directory}/cargo-output.log</output>
                                <append>false</append>
                                <log>${log.directory}/cargo.log</log>
                            </container>

                            <!-- Configuration to use with the container or the deployer -->
                            <configuration>
                                <configfiles>
                                    <configfile>
                                        <file>${basedir}/src/config/${runenv}/server.xml</file>
                                        <todir>conf</todir>
                                        <overwrite>true</overwrite>
                                    </configfile>
                                    <configfile>
                                        <file>${basedir}/src/config/${runenv}/context.xml</file>
                                        <todir>conf</todir>
                                        <overwrite>true</overwrite>
                                    </configfile>
                                </configfiles>
                                <home>${project.build.directory}/tomcat${tomcat.major.version}x</home>

                                <properties>
                                    <cargo.jvmargs>
                                        ${seeker.javaagent} ${seeker.server.url} ${seeker.project.key} -Xss2m -Xmx8G
                                    </cargo.jvmargs>
                                    <cargo.servlet.port>8443</cargo.servlet.port>
                                    <cargo.protocol>https</cargo.protocol>
                                    <cargo.tomcat.connector.protocolClass>HTTP/1.1</cargo.tomcat.connector.protocolClass>
                                    <cargo.tomcat.connector.uriEncoding>ISO-8859-1</cargo.tomcat.connector.uriEncoding>
                                    <cargo.tomcat.connector.clientAuth>false</cargo.tomcat.connector.clientAuth>
                                    <cargo.tomcat.connector.sslProtocol>TLS</cargo.tomcat.connector.sslProtocol>
                                    <cargo.tomcat.connector.keystoreFile>${project.basedir}/.keystore</cargo.tomcat.connector.keystoreFile>
                                    <cargo.tomcat.connector.keystorePass>changeit</cargo.tomcat.connector.keystorePass>
                                    <cargo.tomcat.connector.keyAlias>tomcat</cargo.tomcat.connector.keyAlias>
                                    <cargo.tomcat.httpSecure>true</cargo.tomcat.httpSecure>
                                </properties>
                            </configuration>
                        </configuration>
                    </plugin>
                </plugins>
            </build>
        </profile>

        <profile>
            <id>deploywcxiast</id>
            <build>
                <plugins>
                    <plugin>
                        <artifactId>maven-antrun-plugin</artifactId>
                        <executions>
                            <execution>
                                <id>ldap-server</id>
                                <phase>package</phase>
                                <goals>
                                    <goal>run</goal>
                                </goals>
                                <configuration>
                                    <target>
                                        <ant target="run" antfile="${basedir}/src/config/build.xml">
                                            <reference torefid="maven.compile.classpath" refid="maven.compile.classpath" />
                                        </ant>
                                    </target>
                                </configuration>
                            </execution>
                            <execution>
                                <id>database-server</id>
                                <phase>package</phase>
                                <goals>
                                    <goal>run</goal>
                                </goals>
                                <configuration>
                                    <target>
                                        <ant target="databaseServer" antfile="${basedir}/src/config/build.xml">
                                            <reference torefid="maven.compile.classpath" refid="maven.compile.classpath" />
                                        </ant>
                                    </target>
                                </configuration>
                            </execution>
                            <execution>
                                <id>database-init</id>
                                <phase>package</phase>
                                <goals>
                                    <goal>run</goal>
                                </goals>
                                <configuration>
                                    <target>
                                        <ant target="databaseInit" antfile="${basedir}/src/config/build.xml">
                                            <reference torefid="maven.compile.classpath" refid="maven.compile.classpath" />
                                        </ant>
                                    </target>
                                </configuration>
                            </execution>
                        </executions>
                    </plugin>
                    <plugin>
                        <groupId>org.codehaus.cargo</groupId>
                        <artifactId>cargo-maven3-plugin</artifactId>
                        <configuration>

                            <!-- Container configuration -->
                            <container>
                                <timeout>300000</timeout>
                                <containerId>tomcat${tomcat.major.version}x</containerId>
                                <zipUrlInstaller>
                                    <url>${tomcat.url}</url>
                                </zipUrlInstaller>
                                <output>${log.directory}/cargo-output.log</output>
                                <append>false</append>
                                <log>${log.directory}/cargo.log</log>
                            </container>

                            <!-- Configuration to use with the container or the deployer -->
                            <configuration>
                                <configfiles>
                                    <configfile>
                                        <file>${basedir}/src/config/${runenv}/server.xml</file>
                                        <todir>conf</todir>
                                        <overwrite>true</overwrite>
                                    </configfile>
                                    <configfile>
                                        <file>${basedir}/src/config/${runenv}/context.xml</file>
                                        <todir>conf</todir>
                                        <overwrite>true</overwrite>
                                    </configfile>
                                </configfiles>
                                <properties>
                                    <cargo.jvmargs>
                                        -Xmx8G
                                        -javaagent:${basedir}/tools/CxIAST/cx-launcher.jar
                                        -Diast.home=${basedir}/tools/CxIAST/
                                        -Xverify:none
                                    </cargo.jvmargs>
                                    <cargo.servlet.port>8443</cargo.servlet.port>
                                    <cargo.protocol>https</cargo.protocol>
                                    <cargo.tomcat.connector.protocolClass>HTTP/1.1</cargo.tomcat.connector.protocolClass>
                                    <cargo.tomcat.connector.uriEncoding>ISO-8859-1</cargo.tomcat.connector.uriEncoding>
                                    <cargo.tomcat.connector.clientAuth>false</cargo.tomcat.connector.clientAuth>
                                    <cargo.tomcat.connector.sslProtocol>TLS</cargo.tomcat.connector.sslProtocol>
                                    <cargo.tomcat.connector.keystoreFile>${project.basedir}/.keystore</cargo.tomcat.connector.keystoreFile>
                                    <cargo.tomcat.connector.keystorePass>changeit</cargo.tomcat.connector.keystorePass>
                                    <cargo.tomcat.connector.keyAlias>tomcat</cargo.tomcat.connector.keyAlias>
                                    <cargo.tomcat.httpSecure>true</cargo.tomcat.httpSecure>
                                </properties>
                            </configuration>
                        </configuration>
                    </plugin>
                </plugins>
            </build>
        </profile>

        <profile>
            <id>deploywhcl</id>
            <build>
                <plugins>
                    <plugin>
                        <artifactId>maven-antrun-plugin</artifactId>
                        <executions>
                            <execution>
                                <id>ldap-server</id>
                                <phase>package</phase>
                                <goals>
                                    <goal>run</goal>
                                </goals>
                                <configuration>
                                    <target>
                                        <ant target="run" antfile="${basedir}/src/config/build.xml">
                                            <reference torefid="maven.compile.classpath" refid="maven.compile.classpath" />
                                        </ant>
                                    </target>
                                </configuration>
                            </execution>
                            <execution>
                                <id>database-server</id>
                                <phase>package</phase>
                                <goals>
                                    <goal>run</goal>
                                </goals>
                                <configuration>
                                    <target>
                                        <ant target="databaseServer" antfile="${basedir}/src/config/build.xml">
                                            <reference torefid="maven.compile.classpath" refid="maven.compile.classpath" />
                                        </ant>
                                    </target>
                                </configuration>
                            </execution>
                            <execution>
                                <id>database-init</id>
                                <phase>package</phase>
                                <goals>
                                    <goal>run</goal>
                                </goals>
                                <configuration>
                                    <target>
                                        <ant target="databaseInit" antfile="${basedir}/src/config/build.xml">
                                            <reference torefid="maven.compile.classpath" refid="maven.compile.classpath" />
                                        </ant>
                                    </target>
                                </configuration>
                            </execution>
                        </executions>
                    </plugin>
                    <plugin>
                        <groupId>org.codehaus.cargo</groupId>
                        <artifactId>cargo-maven3-plugin</artifactId>
                        <configuration>

                            <!-- Container configuration -->
                            <container>
                                <timeout>400000</timeout>
                                <containerId>tomcat${tomcat.major.version}x</containerId>
                                <zipUrlInstaller>
                                    <url>${tomcat.url}</url>
                                </zipUrlInstaller>
                                <output>${log.directory}/cargo-output.log</output>
                                <append>false</append>
                                <log>${log.directory}/cargo.log</log>
                            </container>

                            <!-- Configuration to use with the container or the deployer -->
                            <configuration>
                                <configfiles>
                                    <configfile>
                                        <file>${basedir}/src/config/${runenv}/server.xml</file>
                                        <todir>conf</todir>
                                        <overwrite>true</overwrite>
                                    </configfile>
                                    <configfile>
                                        <file>${basedir}/src/config/${runenv}/context.xml</file>
                                        <todir>conf</todir>
                                        <overwrite>true</overwrite>
                                    </configfile>
                                </configfiles>
                                <properties>
                                    <cargo.jvmargs>
                                        -Xmx8G
                                        -javaagent:${basedir}/tools/HCL/secagent.jar=agent_path=${basedir}/tools/HCL/secagent.jar
                                        -Dsecagent.log=${basedir}/tools/HCL/working/HCL-IAST.hcl
                                    </cargo.jvmargs>
                                    <cargo.servlet.port>8443</cargo.servlet.port>
                                    <cargo.protocol>https</cargo.protocol>
                                    <cargo.tomcat.connector.protocolClass>HTTP/1.1</cargo.tomcat.connector.protocolClass>
                                    <cargo.tomcat.connector.uriEncoding>ISO-8859-1</cargo.tomcat.connector.uriEncoding>
                                    <cargo.tomcat.connector.clientAuth>false</cargo.tomcat.connector.clientAuth>
                                    <cargo.tomcat.connector.sslProtocol>TLS</cargo.tomcat.connector.sslProtocol>
                                    <cargo.tomcat.connector.keystoreFile>${project.basedir}/.keystore</cargo.tomcat.connector.keystoreFile>
                                    <cargo.tomcat.connector.keystorePass>changeit</cargo.tomcat.connector.keystorePass>
                                    <cargo.tomcat.connector.keyAlias>tomcat</cargo.tomcat.connector.keyAlias>
                                    <cargo.tomcat.httpSecure>true</cargo.tomcat.httpSecure>
                                </properties>
                            </configuration>
                        </configuration>
                    </plugin>
                </plugins>
            </build>
        </profile>

    </profiles>

    <dependencies>
        <dependency>
            <groupId>javax</groupId>
            <artifactId>javaee-api</artifactId>
            <version>7.0</version>
            <scope>provided</scope>
        </dependency>

        <!-- mvn dependency:analyze says this is an unused declared dependency, but its wrong. I think the webapp needs it somehow. -->
        <dependency>
            <groupId>com.sun.jersey</groupId>
            <artifactId>jersey-servlet</artifactId>
            <version>1.19.4</version>
        </dependency>

        <dependency>
            <groupId>commons-codec</groupId>
            <artifactId>commons-codec</artifactId>
            <version>1.15</version>
        </dependency>

        <!-- mvn dependency:analyze says this is an unused declared dependency, but its wrong. Get this runtime error if it's not included: Caused by: org.springframework.beans.factory.CannotLoadBeanClassException: Cannot find class [org.apache.commons.dbcp.BasicDataSource] for bean with name 'dataSource' defined in class path resource [context.xml]; nested exception is java.lang.ClassNotFoundException: org.apache.commons.dbcp.BasicDataSource -->
        <dependency>
            <groupId>commons-dbcp</groupId>
            <artifactId>commons-dbcp</artifactId>
            <version>1.4</version>
        </dependency>

        <dependency>
            <groupId>commons-lang</groupId>
            <artifactId>commons-lang</artifactId>
            <version>2.6</version>
        </dependency>

        <!-- Including slf4j lib to avoid warning: SLF4J: Defaulting to no-operation (NOP) logger implementation -->
        <!-- Have to include early in the pom like this so this version takes precendence over the old version used by the apacheds libs. -->
        <dependency>
            <groupId>org.slf4j</groupId>
            <artifactId>slf4j-reload4j</artifactId>
            <version>1.7.36</version>
        </dependency>

        <dependency>
            <groupId>org.apache.directory.server</groupId>
            <artifactId>apacheds-core</artifactId>
            <!-- Upgrading to 2.0.0-M24 is an API breaking change. But it might be needed for Java 10, because I get this error, that I don't get with Java 8: [java] at org.apache.directory.server.core.DefaultDirectoryService.initialize(DefaultDirectoryService.java:1426) [java] at org.apache.directory.server.core.DefaultDirectoryService.startup(DefaultDirectoryService.java:907) [java] at org.owasp.benchmark.helpers.LDAPServer.initDirectoryService(LDAPServer.java:148) [java] at org.owasp.benchmark.helpers.LDAPServer.<init>(LDAPServer.java:42) [java] at org.owasp.benchmark.helpers.LDAPServer.main(LDAPServer.java:320) [java] Caused by: java.lang.NumberFormatException: multiple points [java] at java.base/jdk.internal.math.FloatingDecimal.readJavaFormatString(FloatingDecimal.java:1914) -->
            <version>${version.apacheds}</version>
            <exclusions>
                <!-- Excluded because its old, and there is a bug in it causing an exception when using it. -->
                <exclusion>
                    <groupId>bouncycastle</groupId>
                    <artifactId>bcprov-jdk15</artifactId>
                </exclusion>
                <!-- Excluded because it conflicts with esapi's dependency, which is newer -->
                <exclusion>
                    <groupId>commons-collections</groupId>
                    <artifactId>commons-collections</artifactId>
                </exclusion>
            </exclusions>
        </dependency>

        <dependency>
            <groupId>org.apache.directory.server</groupId>
            <artifactId>apacheds-core-api</artifactId>
            <version>${version.apacheds}</version>
        </dependency>

        <dependency>
            <groupId>org.apache.directory.server</groupId>
            <artifactId>apacheds-core-constants</artifactId>
            <version>${version.apacheds}</version>
        </dependency>

        <dependency>
            <groupId>org.apache.directory.server</groupId>
            <artifactId>apacheds-jdbm-partition</artifactId>
            <version>${version.apacheds}</version>
        </dependency>

        <dependency>
            <groupId>org.apache.directory.server</groupId>
            <artifactId>apacheds-jdbm-store</artifactId>
            <version>${version.apacheds}</version>
        </dependency>

        <dependency>
            <groupId>org.apache.directory.server</groupId>
            <artifactId>apacheds-ldif-partition</artifactId>
            <version>${version.apacheds}</version>
        </dependency>

        <dependency>
            <groupId>org.apache.directory.server</groupId>
            <artifactId>apacheds-protocol-ldap</artifactId>
            <version>${version.apacheds}</version>
        </dependency>

        <dependency>
            <groupId>org.apache.directory.server</groupId>
            <artifactId>apacheds-protocol-shared</artifactId>
            <version>${version.apacheds}</version>
        </dependency>

        <dependency>
            <groupId>org.apache.directory.server</groupId>
            <artifactId>apacheds-xdbm-base</artifactId>
            <version>${version.apacheds}</version>
        </dependency>

        <dependency>
            <groupId>org.apache.directory.shared</groupId>
            <artifactId>shared-ldap</artifactId>
            <version>${version.apache-shared-ldap}</version>
            <exclusions>
                <!-- Excluded because it conflicts with esapi's dependency, which is newer -->
                <exclusion>
                    <groupId>commons-collections</groupId>
                    <artifactId>commons-collections</artifactId>
                </exclusion>
            </exclusions>
        </dependency>

        <dependency>
            <groupId>org.apache.directory.shared</groupId>
            <artifactId>shared-ldap-schema</artifactId>
            <version>${version.apache-shared-ldap}</version>
        </dependency>

        <dependency>
            <groupId>org.apache.directory.shared</groupId>
            <artifactId>shared-ldap-schema-loader</artifactId>
            <version>${version.apache-shared-ldap}</version>
        </dependency>

        <dependency>
            <groupId>org.apache.directory.shared</groupId>
            <artifactId>shared-ldap-schema-manager</artifactId>
            <version>${version.apache-shared-ldap}</version>
        </dependency>

        <dependency>
            <groupId>org.apache.httpcomponents.client5</groupId>
            <artifactId>httpclient5</artifactId>
            <version>5.1.3</version>
        </dependency>

        <dependency>
            <groupId>org.apache.httpcomponents.core5</groupId>
            <artifactId>httpcore5</artifactId>
            <version>5.1.3</version>
        </dependency>

        <dependency>
            <groupId>org.bouncycastle</groupId>
            <artifactId>bcprov-jdk15on</artifactId>
            <version>1.70</version>
        </dependency>

        <!-- Kevin's fix for jar version conflicts. For future Benchmark 1.3 -->
        <dependency>
            <groupId>org.hibernate</groupId>
            <artifactId>hibernate-core</artifactId>
            <version>${version.hibernate}</version>
            <exclusions>
                <!-- Excluded because it conflicts with esapi's dependency, which is newer -->
                <exclusion>
                    <groupId>commons-collections</groupId>
                    <artifactId>commons-collections</artifactId>
                </exclusion>
            </exclusions>
        </dependency>

        <dependency>
            <groupId>org.hibernate</groupId>
            <artifactId>hibernate-entitymanager</artifactId>
            <version>${version.hibernate}</version>
        </dependency>

        <!-- mvn dependency:analyze says this is an unused declared dependency, but its wrong. Get a runtime error if it's not included -->
        <dependency>
            <groupId>org.hsqldb</groupId>
            <artifactId>hsqldb</artifactId>
            <!-- <version>2.5.1</version> This is latest version, but requires Java 8. 2.3.6 is last version to support Java 7. -->
            <version>2.3.6</version>
        </dependency>

        <dependency>
            <groupId>org.owasp.esapi</groupId>
            <artifactId>esapi</artifactId>
            <version>2.2.3.1</version>
        </dependency>

        <dependency>
            <groupId>org.springframework</groupId>
            <artifactId>spring-context</artifactId>
            <version>${version.springframework}</version>
        </dependency>

        <dependency>
            <groupId>org.springframework</groupId>
            <artifactId>spring-jdbc</artifactId>
            <version>${version.springframework}</version>
        </dependency>

        <dependency>
            <groupId>org.springframework</groupId>
            <artifactId>spring-tx</artifactId>
            <version>${version.springframework}</version>
        </dependency>

        <dependency>
            <groupId>org.springframework</groupId>
            <artifactId>spring-web</artifactId>
            <version>${version.springframework}</version>
        </dependency>

        <!-- mvn dependency:analyze says this is an unused declared dependency, but its wrong. It's needed by Spring somehow. -->
        <dependency>
            <groupId>org.springframework</groupId>
            <artifactId>spring-webmvc</artifactId>
            <version>${version.springframework}</version>
        </dependency>

        <dependency>
            <groupId>xml-apis</groupId>
            <artifactId>xml-apis</artifactId>
            <version>1.4.01</version>
        </dependency>

    </dependencies>

    <build>
        <finalName>benchmark</finalName>

        <extensions>
            <extension>
                <groupId>co.leantechniques</groupId>
                <artifactId>maven-buildtime-extension</artifactId>
                <version>3.0.3</version>
            </extension>
        </extensions>

        <resources>
            <resource>
                <directory>${basedir}/src/main/resources</directory>
            </resource>
        </resources>

        <pluginManagement>
            <plugins>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-antrun-plugin</artifactId>
                    <version>3.0.0</version>
                </plugin>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-assembly-plugin</artifactId>
                    <version>3.3.0</version>
                </plugin>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-dependency-plugin</artifactId>
                    <version>3.3.0</version>
                    <configuration>
                        <usedDependencies>
                            <dependency>com.sun.jersey:jersey-servlet</dependency>
                            <dependency>commons-dbcp:commons-dbcp</dependency>
                            <dependency>org.hibernate:hibernate-entitymanager</dependency>
                            <dependency>org.slf4j:slf4j-reload4j</dependency>
                            <dependency>org.springframework:spring-webmvc</dependency>
                        </usedDependencies>
                    </configuration>
                </plugin>
                <plugin>
                    <groupId>org.apache.maven.plugins</groupId>
                    <artifactId>maven-release-plugin</artifactId>
                    <version>3.0.0-M5</version>
                </plugin>
            </plugins>
        </pluginManagement>

        <plugins>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-antrun-plugin</artifactId>
            </plugin>

            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-clean-plugin</artifactId>
                <version>3.2.0</version>
            </plugin>

            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-compiler-plugin</artifactId>
                <version>3.10.1</version>
                <configuration>
                    <fork>true</fork>
                    <meminitial>1000m</meminitial>
                    <maxmem>2000m</maxmem>
                </configuration>
            </plugin>

            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-deploy-plugin</artifactId>
                <version>3.0.0-M2</version>
            </plugin>

            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-enforcer-plugin</artifactId>
                <version>3.0.0</version>
                <dependencies>
                    <dependency>
                        <groupId>org.codehaus.mojo</groupId>
                        <artifactId>extra-enforcer-rules</artifactId>
                        <version>1.5.1</version>
                    </dependency>
                </dependencies>
                <executions>
                    <execution>
                        <id>enforce-bytecode-version</id>
                        <goals>
                            <goal>enforce</goal>
                        </goals>
                        <configuration>
                            <rules>
                                <enforceBytecodeVersion>
                                    <maxJdkVersion>${project.java.target}</maxJdkVersion>
                                    <excludes>
                                        <!-- guava includes backports for Java 7 compatibility -->
                                        <exclude>com.google.guava:guava</exclude>
                                    </excludes>
                                    <message>Dependencies shouldn't require Java 8+.</message>
                                </enforceBytecodeVersion>
                            </rules>
                            <fail>warn</fail>
                        </configuration>
                    </execution>
                    <execution>
                        <id>enforce-jdk-version</id>
                        <goals>
                            <goal>enforce</goal>
                        </goals>
                        <configuration>
                            <rules>
                                <requireJavaVersion>
                                    <version>${project.java.target}</version>
                                    <message>Benchmark is currently written to support Java 7 and 8.</message>
                                </requireJavaVersion>
                            </rules>
                        </configuration>
                    </execution>
                </executions>
            </plugin>

            <!-- used by some of the scripts. This forces the plugin to be downloaded, so it doesn't need to when the script runs. -->
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-help-plugin</artifactId>
                <version>3.2.0</version>
            </plugin>

            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-install-plugin</artifactId>
                <version>3.0.0-M1</version>
            </plugin>

            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-jxr-plugin</artifactId>
                <version>3.2.0</version>
            </plugin>

            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-pmd-plugin</artifactId>
                <version>3.16.0</version>
                <configuration>
                    <linkXref>true</linkXref>
                    <targetJdk>${project.java.target}</targetJdk>
                </configuration>
            </plugin>

            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-project-info-reports-plugin</artifactId>
                <version>3.2.2</version>
            </plugin>

            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-resources-plugin</artifactId>
                <version>3.2.0</version>
            </plugin>

            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-site-plugin</artifactId>
                <version>3.11.0</version>
            </plugin>

            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-surefire-plugin</artifactId>
                <version>3.0.0-M6</version>
            </plugin>

            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-war-plugin</artifactId>
                <version>3.3.2</version>
                <configuration>
                    <webXml>${maven.war.webxml}</webXml>
                </configuration>
            </plugin>

            <plugin>
                <groupId>org.codehaus.cargo</groupId>
                <artifactId>cargo-maven3-plugin</artifactId>
                <version>1.9.10</version>
            </plugin>

            <plugin>
                <groupId>org.codehaus.mojo</groupId>
                <artifactId>versions-maven-plugin</artifactId>
                <version>2.10.0</version>
            </plugin>

            <!-- SpotBugs Static Analysis - the successor to FindBugs -->
            <plugin>
                <groupId>com.github.spotbugs</groupId>
                <artifactId>spotbugs-maven-plugin</artifactId>
                <version>${version.spotbugs.maven}</version>
                <configuration>
                    <effort>Max</effort>
                    <threshold>Low</threshold>
                    <failOnError>true</failOnError>
                </configuration>
                <dependencies>
                    <!-- Overwrite dependency on SpotBugs if you want to specify the version of SpotBugs. SpotBugs itself is frequently several versions ahead of the spotbugs-maven-plugin -->
                    <dependency>
                        <groupId>com.github.spotbugs</groupId>
                        <artifactId>spotbugs</artifactId>
                        <version>${version.spotbugs}</version>
                    </dependency>
                </dependencies>
            </plugin>

            <plugin>
                <groupId>com.h3xstream.findsecbugs</groupId>
                <artifactId>findsecbugs-plugin</artifactId>
                <!-- You MUST update the plugin version used in findsecbugs profile, so these versions match. You can't define/use a versions.findsecbugs property because it breaks the naming of the findsecbugs results file. -->
                <version>1.12.0</version>
            </plugin>

            <plugin>
                <groupId>com.internetitem</groupId>
                <artifactId>write-properties-file-maven-plugin</artifactId>
                <version>1.0.1</version>
            </plugin>

            <plugin>
                <groupId>org.jasig.mojo.jspc</groupId>
                <artifactId>jspc-maven-plugin</artifactId>
                <version>2.0.2</version>
            </plugin>

            <plugin>
                <groupId>com.diffplug.spotless</groupId>
                <artifactId>spotless-maven-plugin</artifactId>
                <version>2.22.1</version>
                <configuration>
                    <!-- optional: limit format enforcement to just the files changed by this feature branch -->
                    <ratchetFrom>origin/master</ratchetFrom>
                    <formats>
                        <!-- you can define as many formats as you want, each is independent -->
                        <format>
                            <!-- define the files to apply to -->
                            <includes>
                                <include>*.md</include>
                            </includes>
                            <excludes>
                                <exclude>data/**/*.*</exclude>
                                <exclude>*results/**/*.*</exclude>
                                <exclude>scorecard/**/*.*</exclude>
                                <exclude>target/**/*.*</exclude>
                            </excludes>
                            <!-- define the steps to apply to those files -->
                            <trimTrailingWhitespace />
                            <endWithNewline />
                            <indent>
                                <tabs>false</tabs>
                                <spaces>true</spaces>
                                <spacesPerTab>4</spacesPerTab>
                            </indent>
                        </format>

                        <format>
                            <includes>
                                <include>**/*.html</include>
                            </includes>
                            <excludes>
                                <exclude>data/**/*.*</exclude>
                                <exclude>*results/**/*.*</exclude>
                                <exclude>target/**/*.*</exclude>
                            </excludes>
                            <eclipseWtp>
                                <type>HTML</type>
                                <files>
                                    <file>${basedir}/DevStyleHtml.prefs</file>
                                </files>
                            </eclipseWtp>
                        </format>

                        <format>
                            <includes>
                                <include>src/config/**/*.xml</include>
                                <include>pom.xml</include>
                            </includes>
                            <eclipseWtp>
                                <type>XML</type>
                                <files>
                                    <file>${basedir}/DevStyleXml.prefs</file>
                                </files>
                            </eclipseWtp>
                        </format>
                    </formats>

                    <!-- define a language-specific format -->
                    <java>
                        <importOrder /> <!-- standard import order -->
                        <removeUnusedImports /> <!-- self-explanatory -->

                        <!-- apply a specific flavor of google-java-format -->
                        <googleJavaFormat>
                            <version>${project.java.target}</version>
                            <style>AOSP</style>
                        </googleJavaFormat>
                    </java>
                </configuration>

                <executions>
                    <execution>
                        <id>spotless-apply</id>
                        <phase>compile</phase>
                        <goals>
                            <goal>apply</goal>
                        </goals>
                    </execution>
                </executions>

            </plugin>

        </plugins>
    </build>

    <reporting>
        <plugins>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-jxr-plugin</artifactId>
            </plugin>
            <plugin>
                <groupId>org.codehaus.mojo</groupId>
                <artifactId>versions-maven-plugin</artifactId>
                <reportSets>
                    <reportSet>
                        <reports>
                            <report>dependency-updates-report</report>
                            <report>plugin-updates-report</report>
                            <report>property-updates-report</report>
                        </reports>
                    </reportSet>
                </reportSets>
            </plugin>
            <plugin>
                <groupId>org.apache.maven.plugins</groupId>
                <artifactId>maven-project-info-reports-plugin</artifactId>
                <reportSets>
                    <reportSet>
                        <reports>
                            <report>index</report>
                            <report>dependency-convergence</report>
                        </reports>
                    </reportSet>
                </reportSets>
            </plugin>
        </plugins>
    </reporting>

    <properties>
        <failOnMissingWebXml>false</failOnMissingWebXml>
        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
        <project.java.target>1.7</project.java.target>
        <project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
        <maven.war.webxml>${basedir}/src/config/web.xml</maven.war.webxml>
        <!-- runenv defaults to local here. But scripts can set this to 'remote' to launch remotely accessible Benchmark. e.g., mvn clean package cargo:run -Pdeploy1.2 -Drunenv=remote -->
        <runenv>local</runenv>
        <tomcat.jvmargs>
            -Xms1G
            -Xmx8G
        </tomcat.jvmargs>
        <tomcat.jvmargs.debug>
            -Xdebug
            -Xrunjdwp:transport=dt_socket,server=y,suspend=n,address=5050
            -Xnoagent
            -Djava.compiler=NONE
        </tomcat.jvmargs.debug>
        <log.directory>${project.build.directory}/log</log.directory>

        <version.apacheds>1.5.7</version.apacheds>
        <version.apache-shared-ldap>0.9.19</version.apache-shared-ldap>
        <version.exec.maven>1.6.0</version.exec.maven>
        <version.hibernate>3.6.10.Final</version.hibernate>
        <version.spotbugs.maven>4.6.0.0</version.spotbugs.maven>
        <version.spotbugs>4.6.0</version.spotbugs>
        <version.springframework>4.3.30.RELEASE</version.springframework>
        <!-- tomcat 8.5 is last version to support Java 7. Tomcat 9+ requires Java 8. -->
        <tomcat.major.version>8</tomcat.major.version>
        <version.tomcat>8.5.70</version.tomcat>
        <tomcat.url>https://archive.apache.org/dist/tomcat/tomcat-${tomcat.major.version}/v${version.tomcat}/bin/apache-tomcat-${version.tomcat}.zip</tomcat.url>
    </properties>
</project>