Added security check profile and fixed some issues

DP-3T / dp3t-sdk-backend

The backend implementation for DP3T

Mozilla Public License 2.0

198 stars 88 forks source link

Added security check profile and fixed some issues #259

Open iCesofT opened 3 years ago

iCesofT commented 3 years ago

Added dependendency-check-maven to check security.
Added log4j2 dependencies to 2.13.3 because of CVE-2020-9488.

martinalig commented 3 years ago

Thanks for the input. We currently use logback as logger. Does this even work if we just add log4j2? Can we have both loggers side by side?

iCesofT commented 3 years ago

I know that you are using logback but the spring logging s using log4j-api to catch all log4j2 logging and set them to slf4j.

Take into account that the added dependency is included in dependencyManagement not as dependency. See that log4-api is included when you create the war/jar.