<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">

<modelVersion>4.0.0</modelVersion>

<groupId>org.owasp</groupId>

<artifactId>benchmark</artifactId>

<version>1.2</version>

<packaging>war</packaging>

<name>OWASP Benchmark for Java</name>

<description>OWASP Benchmark is a Java test suite designed to evaluate the accuracy, coverage, and speed of automated software vulnerability detection tools.</description>

<url>https://owasp.org/www-project-benchmark/</url>

<developers>

<developer>

<id>davewichers</id>

<name>Dave Wichers</name>

<email>dave.wichers@owasp.org</email>

</developer>

</developers>

<licenses>

<license>

<name>GNU General Public License, version 2 (GPL2)</name>

<url>https://choosealicense.com/licenses/gpl-2.0/</url>

</license>

</licenses>

<profiles>

<profile>

<id>findsecbugs</id>

<build>

<plugins>

<plugin>

<groupId>com.github.spotbugs</groupId>

<artifactId>spotbugs-maven-plugin</artifactId>

<executions>

<execution>

<phase>compile</phase>

<goals>

<goal>spotbugs</goal>

</goals>

</execution>

</executions>

<configuration>

<effort>Max</effort>

<threshold>Low</threshold>

<failOnError>true</failOnError>

<includeFilterFile>${basedir}/src/main/resources/findbugs-security-include.xml</includeFilterFile>

<excludeFilterFile>${basedir}/src/main/resources/findbugs-security-exclude.xml</excludeFilterFile>

<plugins>

<plugin>

<groupId>com.h3xstream.findsecbugs</groupId>

<artifactId>findsecbugs-plugin</artifactId>

<version>1.11.0</version>

</plugin>

</plugins>

</configuration>

</plugin>

</plugins>

</build>

</profile>

<profile>

<id>deploy</id>

<build>

<plugins>

<plugin>

<artifactId>maven-antrun-plugin</artifactId>

<executions>

<execution>

<id>ldap-server</id>

<phase>package</phase>

<goals>

<goal>run</goal>

</goals>

<configuration>

<target>

<ant target="run" antfile="${basedir}/src/config/build.xml">

<reference torefid="maven.compile.classpath" refid="maven.compile.classpath" />

</ant>

</target>

</configuration>

</execution>

<execution>

<id>database-server</id>

<phase>package</phase>

<goals>

<goal>run</goal>

</goals>

<configuration>

<target>

<ant target="databaseServer" antfile="${basedir}/src/config/build.xml">

<reference torefid="maven.compile.classpath" refid="maven.compile.classpath" />

</ant>

</target>

</configuration>

</execution>

<execution>

<id>database-init</id>

<phase>package</phase>

<goals>

<goal>run</goal>

</goals>

<configuration>

<target>

<ant target="databaseInit" antfile="${basedir}/src/config/build.xml">

<reference torefid="maven.compile.classpath" refid="maven.compile.classpath" />

</ant>

</target>

</configuration>

</execution>

</executions>

</plugin>

<plugin>

<groupId>org.codehaus.cargo</groupId>

<artifactId>cargo-maven3-plugin</artifactId>

<configuration>

<!-- Container configuration -->

<container>

<timeout>300000</timeout>

<containerId>tomcat${tomcat.major.version}x</containerId>

<zipUrlInstaller>

<url>${tomcat.url}</url>

</zipUrlInstaller>

<output>${log.directory}/cargo-output.log</output>

<append>false</append>

<log>${log.directory}/cargo.log</log>

</container>

<!-- Configuration to use with the container or the deployer -->

<configuration>

<configfiles>

<configfile>

<file>${basedir}/src/config/${runenv}/server.xml</file>

<todir>conf</todir>

<overwrite>true</overwrite>

</configfile>

<configfile>

<file>${basedir}/src/config/${runenv}/context.xml</file>

<todir>conf</todir>

<overwrite>true</overwrite>

</configfile>

</configfiles>

<home>${project.build.directory}/tomcat${tomcat.major.version}x</home>

<properties>

<cargo.servlet.port>8443</cargo.servlet.port>

<cargo.protocol>https</cargo.protocol>

<cargo.tomcat.connector.protocolClass>HTTP/1.1</cargo.tomcat.connector.protocolClass>

<cargo.tomcat.connector.uriEncoding>ISO-8859-1</cargo.tomcat.connector.uriEncoding>

<cargo.tomcat.connector.clientAuth>false</cargo.tomcat.connector.clientAuth>

<cargo.tomcat.connector.sslProtocol>TLS</cargo.tomcat.connector.sslProtocol>

<cargo.tomcat.connector.keystoreFile>${project.basedir}/.keystore</cargo.tomcat.connector.keystoreFile>

<cargo.tomcat.connector.keystorePass>changeit</cargo.tomcat.connector.keystorePass>

<cargo.tomcat.connector.keyAlias>tomcat</cargo.tomcat.connector.keyAlias>

<cargo.tomcat.httpSecure>true</cargo.tomcat.httpSecure>

<cargo.start.jvmargs>

${tomcat.jvmargs}

${tomcat.jvmargs.debug}

</cargo.start.jvmargs>

</properties>

</configuration>

</configuration>

</plugin>

</plugins>

</build>

</profile>

<profile>

<id>deploywcontrast</id>

<build>

<plugins>

<plugin>

<artifactId>maven-antrun-plugin</artifactId>

<executions>

<execution>

<id>ldap-server</id>

<phase>package</phase>

<goals>

<goal>run</goal>

</goals>

<configuration>

<target>

<ant target="run" antfile="${basedir}/src/config/build.xml">

<reference torefid="maven.compile.classpath" refid="maven.compile.classpath" />

</ant>

</target>

</configuration>

</execution>

<execution>

<id>database-server</id>

<phase>package</phase>

<goals>

<goal>run</goal>

</goals>

<configuration>

<target>

<ant target="databaseServer" antfile="${basedir}/src/config/build.xml">

<reference torefid="maven.compile.classpath" refid="maven.compile.classpath" />

</ant>

</target>

</configuration>

</execution>

<execution>

<id>database-init</id>

<phase>package</phase>

<goals>

<goal>run</goal>

</goals>

<configuration>

<target>

<ant target="databaseInit" antfile="${basedir}/src/config/build.xml">

<reference torefid="maven.compile.classpath" refid="maven.compile.classpath" />

</ant>

</target>

</configuration>

</execution>

</executions>

</plugin>

<plugin>

<groupId>org.codehaus.cargo</groupId>

<artifactId>cargo-maven3-plugin</artifactId>

<configuration>

<!-- Container configuration -->

<container>

<timeout>300000</timeout>

<containerId>tomcat${tomcat.major.version}x</containerId>

<zipUrlInstaller>

<url>${tomcat.url}</url>

</zipUrlInstaller>

<output>${log.directory}/cargo-output.log</output>

<append>false</append>

<log>${log.directory}/cargo.log</log>

</container>

<!-- Configuration to use with the container or the deployer -->

<configuration>

<configfiles>

<configfile>

<file>${basedir}/src/config/${runenv}/server.xml</file>

<todir>conf</todir>

<overwrite>true</overwrite>

</configfile>

<configfile>

<file>${basedir}/src/config/${runenv}/context.xml</file>

<todir>conf</todir>

<overwrite>true</overwrite>

</configfile>

</configfiles>

<home>${project.build.directory}/tomcat${tomcat.major.version}x</home>

<properties>

<cargo.jvmargs>

-Xmx8G

-javaagent:${basedir}/tools/Contrast/contrast.jar

-Dcontrast.dir=${basedir}/tools/Contrast/working

-Dcontrast.config.path=${basedir}/tools/Contrast/contrast.yaml

</cargo.jvmargs>

<cargo.servlet.port>8443</cargo.servlet.port>

<cargo.protocol>https</cargo.protocol>

<cargo.tomcat.connector.protocolClass>HTTP/1.1</cargo.tomcat.connector.protocolClass>

<cargo.tomcat.connector.uriEncoding>ISO-8859-1</cargo.tomcat.connector.uriEncoding>

<cargo.tomcat.connector.clientAuth>false</cargo.tomcat.connector.clientAuth>

<cargo.tomcat.connector.sslProtocol>TLS</cargo.tomcat.connector.sslProtocol>

<cargo.tomcat.connector.keystoreFile>${project.basedir}/.keystore</cargo.tomcat.connector.keystoreFile>

<cargo.tomcat.connector.keystorePass>changeit</cargo.tomcat.connector.keystorePass>

<cargo.tomcat.connector.keyAlias>tomcat</cargo.tomcat.connector.keyAlias>

<cargo.tomcat.httpSecure>true</cargo.tomcat.httpSecure>

</properties>

</configuration>

</configuration>

</plugin>

</plugins>

</build>

</profile>

<profile>

<id>deploywseeker</id>

<properties>

<seeker.javaagent>-javaagent:${basedir}/tools/seeker/seeker-agent.jar</seeker.javaagent>

<seeker.server.url>-Dseeker.server.url=https://server.example.com:8888</seeker.server.url>

<seeker.project.key>-Dseeker.project.key=Benchmark</seeker.project.key>

</properties>

<build>

<plugins>

<plugin>

<artifactId>maven-antrun-plugin</artifactId>

<executions>

<execution>

<id>ldap-server</id>

<phase>package</phase>

<goals>

<goal>run</goal>

</goals>

<configuration>

<target>

<ant target="run" antfile="${basedir}/src/config/build.xml">

<reference torefid="maven.compile.classpath" refid="maven.compile.classpath" />

</ant>

</target>

</configuration>

</execution>

<execution>

<id>database-server</id>

<phase>package</phase>

<goals>

<goal>run</goal>

</goals>

<configuration>

<target>

<ant target="databaseServer" antfile="${basedir}/src/config/build.xml">

<reference torefid="maven.compile.classpath" refid="maven.compile.classpath" />

</ant>

</target>

</configuration>

</execution>

<execution>

<id>database-init</id>

<phase>package</phase>

<goals>

<goal>run</goal>

</goals>

<configuration>

<target>

<ant target="databaseInit" antfile="${basedir}/src/config/build.xml">

<reference torefid="maven.compile.classpath" refid="maven.compile.classpath" />

</ant>

</target>

</configuration>

</execution>

</executions>

</plugin>

<plugin>

<groupId>org.codehaus.cargo</groupId>

<artifactId>cargo-maven3-plugin</artifactId>

<configuration>

<!-- Container configuration -->

<container>

<timeout>300000</timeout>

<containerId>tomcat${tomcat.major.version}x</containerId>

<zipUrlInstaller>

<url>${tomcat.url}</url>

</zipUrlInstaller>

<output>${log.directory}/cargo-output.log</output>

<append>false</append>

<log>${log.directory}/cargo.log</log>

</container>

<!-- Configuration to use with the container or the deployer -->

<configuration>

<configfiles>

<configfile>

<file>${basedir}/src/config/${runenv}/server.xml</file>

<todir>conf</todir>

<overwrite>true</overwrite>

</configfile>

<configfile>

<file>${basedir}/src/config/${runenv}/context.xml</file>

<todir>conf</todir>

<overwrite>true</overwrite>

</configfile>

</configfiles>

<home>${project.build.directory}/tomcat${tomcat.major.version}x</home>

<properties>

<cargo.jvmargs>

${seeker.javaagent} ${seeker.server.url} ${seeker.project.key} -Xss2m -Xmx8G

</cargo.jvmargs>

<cargo.servlet.port>8443</cargo.servlet.port>

<cargo.protocol>https</cargo.protocol>

<cargo.tomcat.connector.protocolClass>HTTP/1.1</cargo.tomcat.connector.protocolClass>

<cargo.tomcat.connector.uriEncoding>ISO-8859-1</cargo.tomcat.connector.uriEncoding>

<cargo.tomcat.connector.clientAuth>false</cargo.tomcat.connector.clientAuth>

<cargo.tomcat.connector.sslProtocol>TLS</cargo.tomcat.connector.sslProtocol>

<cargo.tomcat.connector.keystoreFile>${project.basedir}/.keystore</cargo.tomcat.connector.keystoreFile>

<cargo.tomcat.connector.keystorePass>changeit</cargo.tomcat.connector.keystorePass>

<cargo.tomcat.connector.keyAlias>tomcat</cargo.tomcat.connector.keyAlias>

<cargo.tomcat.httpSecure>true</cargo.tomcat.httpSecure>

</properties>

</configuration>

</configuration>

</plugin>

</plugins>

</build>

</profile>

<profile>

<id>deploywcxiast</id>

<build>

<plugins>

<plugin>

<artifactId>maven-antrun-plugin</artifactId>

<executions>

<execution>

<id>ldap-server</id>

<phase>package</phase>

<goals>

<goal>run</goal>

</goals>

<configuration>

<target>

<ant target="run" antfile="${basedir}/src/config/build.xml">

<reference torefid="maven.compile.classpath" refid="maven.compile.classpath" />

</ant>

</target>

</configuration>

</execution>

<execution>

<id>database-server</id>

<phase>package</phase>

<goals>

<goal>run</goal>

</goals>

<configuration>

<target>

<ant target="databaseServer" antfile="${basedir}/src/config/build.xml">

<reference torefid="maven.compile.classpath" refid="maven.compile.classpath" />

</ant>

</target>

</configuration>

</execution>

<execution>

<id>database-init</id>

<phase>package</phase>

<goals>

<goal>run</goal>

</goals>

<configuration>

<target>

<ant target="databaseInit" antfile="${basedir}/src/config/build.xml">

<reference torefid="maven.compile.classpath" refid="maven.compile.classpath" />

</ant>

</target>

</configuration>

</execution>

</executions>

</plugin>

<plugin>

<groupId>org.codehaus.cargo</groupId>

<artifactId>cargo-maven3-plugin</artifactId>

<configuration>

<!-- Container configuration -->

<container>

<timeout>300000</timeout>

<containerId>tomcat${tomcat.major.version}x</containerId>

<zipUrlInstaller>

<url>${tomcat.url}</url>

</zipUrlInstaller>

<output>${log.directory}/cargo-output.log</output>

<append>false</append>

<log>${log.directory}/cargo.log</log>

</container>

<!-- Configuration to use with the container or the deployer -->

<configuration>

<configfiles>

<configfile>

<file>${basedir}/src/config/${runenv}/server.xml</file>

<todir>conf</todir>

<overwrite>true</overwrite>

</configfile>

<configfile>

<file>${basedir}/src/config/${runenv}/context.xml</file>

<todir>conf</todir>

<overwrite>true</overwrite>

</configfile>

</configfiles>

<properties>

<cargo.jvmargs>

-Xmx8G

-javaagent:${basedir}/tools/CxIAST/cx-launcher.jar

-Diast.home=${basedir}/tools/CxIAST/

-Xverify:none

</cargo.jvmargs>

<cargo.servlet.port>8443</cargo.servlet.port>

<cargo.protocol>https</cargo.protocol>

<cargo.tomcat.connector.protocolClass>HTTP/1.1</cargo.tomcat.connector.protocolClass>

<cargo.tomcat.connector.uriEncoding>ISO-8859-1</cargo.tomcat.connector.uriEncoding>

<cargo.tomcat.connector.clientAuth>false</cargo.tomcat.connector.clientAuth>

<cargo.tomcat.connector.sslProtocol>TLS</cargo.tomcat.connector.sslProtocol>

<cargo.tomcat.connector.keystoreFile>${project.basedir}/.keystore</cargo.tomcat.connector.keystoreFile>

<cargo.tomcat.connector.keystorePass>changeit</cargo.tomcat.connector.keystorePass>

<cargo.tomcat.connector.keyAlias>tomcat</cargo.tomcat.connector.keyAlias>

<cargo.tomcat.httpSecure>true</cargo.tomcat.httpSecure>

</properties>

</configuration>

</configuration>

</plugin>

</plugins>

</build>

</profile>

<profile>

<id>deploywhcl</id>

<build>

<plugins>

<plugin>

<artifactId>maven-antrun-plugin</artifactId>

<executions>

<execution>

<id>ldap-server</id>

<phase>package</phase>

<goals>

<goal>run</goal>

</goals>

<configuration>

<target>

<ant target="run" antfile="${basedir}/src/config/build.xml">

<reference torefid="maven.compile.classpath" refid="maven.compile.classpath" />

</ant>

</target>

</configuration>

</execution>

<execution>

<id>database-server</id>

<phase>package</phase>

<goals>

<goal>run</goal>

</goals>

<configuration>

<target>

<ant target="databaseServer" antfile="${basedir}/src/config/build.xml">

<reference torefid="maven.compile.classpath" refid="maven.compile.classpath" />

</ant>

</target>

</configuration>

</execution>

<execution>

<id>database-init</id>

<phase>package</phase>

<goals>

<goal>run</goal>

</goals>

<configuration>

<target>

<ant target="databaseInit" antfile="${basedir}/src/config/build.xml">

<reference torefid="maven.compile.classpath" refid="maven.compile.classpath" />

</ant>

</target>

</configuration>

</execution>

</executions>

</plugin>

<plugin>

<groupId>org.codehaus.cargo</groupId>

<artifactId>cargo-maven3-plugin</artifactId>

<configuration>

<!-- Container configuration -->

<container>

<timeout>400000</timeout>

<containerId>tomcat${tomcat.major.version}x</containerId>

<zipUrlInstaller>

<url>${tomcat.url}</url>

</zipUrlInstaller>

<output>${log.directory}/cargo-output.log</output>

<append>false</append>

<log>${log.directory}/cargo.log</log>

</container>

<!-- Configuration to use with the container or the deployer -->

<configuration>

<configfiles>

<configfile>

<file>${basedir}/src/config/${runenv}/server.xml</file>

<todir>conf</todir>

<overwrite>true</overwrite>

</configfile>

<configfile>

<file>${basedir}/src/config/${runenv}/context.xml</file>

<todir>conf</todir>

<overwrite>true</overwrite>

</configfile>

</configfiles>

<properties>

<cargo.jvmargs>

-Xmx8G

-javaagent:${basedir}/tools/HCL/secagent.jar=agent_path=${basedir}/tools/HCL/secagent.jar

-Dsecagent.log=${basedir}/tools/HCL/working/HCL-IAST.hcl

</cargo.jvmargs>

<cargo.servlet.port>8443</cargo.servlet.port>

<cargo.protocol>https</cargo.protocol>

<cargo.tomcat.connector.protocolClass>HTTP/1.1</cargo.tomcat.connector.protocolClass>

<cargo.tomcat.connector.uriEncoding>ISO-8859-1</cargo.tomcat.connector.uriEncoding>

<cargo.tomcat.connector.clientAuth>false</cargo.tomcat.connector.clientAuth>

<cargo.tomcat.connector.sslProtocol>TLS</cargo.tomcat.connector.sslProtocol>

<cargo.tomcat.connector.keystoreFile>${project.basedir}/.keystore</cargo.tomcat.connector.keystoreFile>

<cargo.tomcat.connector.keystorePass>changeit</cargo.tomcat.connector.keystorePass>

<cargo.tomcat.connector.keyAlias>tomcat</cargo.tomcat.connector.keyAlias>

<cargo.tomcat.httpSecure>true</cargo.tomcat.httpSecure>

</properties>

</configuration>

</configuration>

</plugin>

</plugins>

</build>

</profile>

</profiles>

<dependencies>

<dependency>

<groupId>javax</groupId>

<artifactId>javaee-api</artifactId>

<version>7.0</version>

<scope>provided</scope>

</dependency>

<!-- mvn dependency:analyze says this is an unused declared dependency, but its wrong. I think the webapp needs it somehow. -->

<dependency>

<groupId>com.sun.jersey</groupId>

<artifactId>jersey-servlet</artifactId>

<version>1.19.4</version>

</dependency>

<dependency>

<groupId>commons-codec</groupId>

<artifactId>commons-codec</artifactId>

<version>1.15</version>

</dependency>

<!-- mvn dependency:analyze says this is an unused declared dependency, but its wrong. Get this runtime error if it's not included: Caused by: org.springframework.beans.factory.CannotLoadBeanClassException: Cannot find class [org.apache.commons.dbcp.BasicDataSource] for bean with name 'dataSource' defined in class path resource [context.xml]; nested exception is java.lang.ClassNotFoundException: org.apache.commons.dbcp.BasicDataSource -->

<dependency>

<groupId>commons-dbcp</groupId>

<artifactId>commons-dbcp</artifactId>

<version>1.4</version>

</dependency>

<dependency>

<groupId>commons-lang</groupId>

<artifactId>commons-lang</artifactId>

<version>2.6</version>

</dependency>

<!-- Including slf4j lib to avoid warning: SLF4J: Defaulting to no-operation (NOP) logger implementation -->

<!-- Have to include early in the pom like this so this version takes precendence over the old version used by the apacheds libs. -->

<dependency>

<groupId>org.slf4j</groupId>

<artifactId>slf4j-log4j12</artifactId>

<version>1.7.32</version>

</dependency>

<dependency>

<groupId>org.apache.directory.server</groupId>

<artifactId>apacheds-core</artifactId>

<!-- Upgrading to 2.0.0-M24 is an API breaking change. But it might be needed for Java

<version>${version.apacheds}</version>

<exclusions>

<!-- Excluded because its old, and there is a bug in it causing an exception when using it. -->

<exclusion>

<groupId>bouncycastle</groupId>

<artifactId>bcprov-jdk15</artifactId>

</exclusion>

<!-- Excluded because it conflicts with esapi's dependency, which is newer -->

<exclusion>

<groupId>commons-collections</groupId>

<artifactId>commons-collections</artifactId>

</exclusion>

</exclusions>

</dependency>

<dependency>

<groupId>org.apache.directory.server</groupId>

<artifactId>apacheds-core-api</artifactId>

<version>${version.apacheds}</version>

</dependency>

<dependency>

<groupId>org.apache.directory.server</groupId>

<artifactId>apacheds-core-constants</artifactId>

<version>${version.apacheds}</version>

</dependency>

<dependency>

<groupId>org.apache.directory.server</groupId>

<artifactId>apacheds-jdbm-partition</artifactId>

<version>${version.apacheds}</version>

</dependency>

<dependency>

<groupId>org.apache.directory.server</groupId>

<artifactId>apacheds-jdbm-store</artifactId>

<version>${version.apacheds}</version>

</dependency>

<dependency>

<groupId>org.apache.directory.server</groupId>

<artifactId>apacheds-ldif-partition</artifactId>

<version>${version.apacheds}</version>

</dependency>

<dependency>

<groupId>org.apache.directory.server</groupId>

<artifactId>apacheds-protocol-ldap</artifactId>

<version>${version.apacheds}</version>

</dependency>

<dependency>

<groupId>org.apache.directory.server</groupId>

<artifactId>apacheds-protocol-shared</artifactId>

<version>${version.apacheds}</version>

</dependency>

<dependency>

<groupId>org.apache.directory.server</groupId>

<artifactId>apacheds-xdbm-base</artifactId>

<version>${version.apacheds}</version>

</dependency>

<dependency>

<groupId>org.apache.directory.shared</groupId>

<artifactId>shared-ldap</artifactId>

<version>${version.apache-shared-ldap}</version>

<exclusions>

<!-- Excluded because it conflicts with esapi's dependency, which is newer -->

<exclusion>

<groupId>commons-collections</groupId>

<artifactId>commons-collections</artifactId>

</exclusion>

</exclusions>

</dependency>

<dependency>

<groupId>org.apache.directory.shared</groupId>

<artifactId>shared-ldap-schema</artifactId>

<version>${version.apache-shared-ldap}</version>

</dependency>

<dependency>

<groupId>org.apache.directory.shared</groupId>

<artifactId>shared-ldap-schema-loader</artifactId>

<version>${version.apache-shared-ldap}</version>

</dependency>

<dependency>

<groupId>org.apache.directory.shared</groupId>

<artifactId>shared-ldap-schema-manager</artifactId>

<version>${version.apache-shared-ldap}</version>

</dependency>

<dependency>

<groupId>org.apache.httpcomponents</groupId>

<artifactId>httpclient</artifactId>

<version>4.5.13</version>

</dependency>

<dependency>

<groupId>org.apache.httpcomponents</groupId>

<artifactId>httpcore</artifactId>

<version>4.4.14</version>

</dependency>

<dependency>

<groupId>org.bouncycastle</groupId>

<artifactId>bcprov-jdk15on</artifactId>

<version>1.69</version>

</dependency>

<!-- Kevin's fix for jar version conflicts. For future Benchmark 1.3 -->

<dependency>

<groupId>org.hibernate</groupId>

<artifactId>hibernate-core</artifactId>

<version>${version.hibernate}</version>

<exclusions>

<!-- Excluded because it conflicts with esapi's dependency, which is newer -->

<exclusion>

<groupId>commons-collections</groupId>

<artifactId>commons-collections</artifactId>

</exclusion>

</exclusions>

</dependency>

<dependency>

<groupId>org.hibernate</groupId>

<artifactId>hibernate-entitymanager</artifactId>

<version>${version.hibernate}</version>

</dependency>

<dependency>

<groupId>org.jdom</groupId>

<artifactId>jdom2</artifactId>

<version>2.0.6</version>

</dependency>

<!-- mvn dependency:analyze says this is an unused declared dependency, but its wrong. Get a runtime error if it's not included -->

<dependency>

<groupId>org.hsqldb</groupId>

<artifactId>hsqldb</artifactId>

<!-- <version>2.5.1</version> This is latest version, but requires Java 8. 2.3.6 is last version to support Java 7. -->

<version>2.3.6</version>

</dependency>

<dependency>

<groupId>org.owasp.esapi</groupId>

<artifactId>esapi</artifactId>

<version>2.2.3.1</version>

</dependency>

<dependency>

<groupId>org.springframework</groupId>

<artifactId>spring-context</artifactId>

<version>${version.springframework}</version>

</dependency>

<dependency>

<groupId>org.springframework</groupId>

<artifactId>spring-jdbc</artifactId>

<version>${version.springframework}</version>

</dependency>

<dependency>

<groupId>org.springframework</groupId>

<artifactId>spring-tx</artifactId>

<version>${version.springframework}</version>

</dependency>

<dependency>

<groupId>org.springframework</groupId>

<artifactId>spring-web</artifactId>

<version>${version.springframework}</version>

</dependency>

<!-- mvn dependency:analyze says this is an unused declared dependency, but its wrong. It's needed by Spring somehow. -->

<dependency>

<groupId>org.springframework</groupId>

<artifactId>spring-webmvc</artifactId>

<version>${version.springframework}</version>

</dependency>

<dependency>

<groupId>xml-apis</groupId>

<artifactId>xml-apis</artifactId>

<version>1.4.01</version>

</dependency>

</dependencies>

<build>

<finalName>benchmark</finalName>

<extensions>

<extension>

<groupId>co.leantechniques</groupId>

<artifactId>maven-buildtime-extension</artifactId>

<version>3.0.3</version>

</extension>

</extensions>

<resources>

<resource>

<directory>${basedir}/src/main/resources</directory>

</resource>

</resources>

<pluginManagement>

<plugins>

<plugin>

<groupId>org.apache.maven.plugins</groupId>

<artifactId>maven-antrun-plugin</artifactId>

<version>3.0.0</version>

</plugin>

<plugin>

<groupId>org.apache.maven.plugins</groupId>

<artifactId>maven-assembly-plugin</artifactId>

<version>3.3.0</version>

</plugin>

<plugin>

<groupId>org.apache.maven.plugins</groupId>

<artifactId>maven-dependency-plugin</artifactId>

<version>3.2.0</version>

<configuration>

<usedDependencies>

<dependency>com.sun.jersey:jersey-servlet</dependency>

<dependency>commons-dbcp:commons-dbcp</dependency>

<dependency>org.hibernate:hibernate-entitymanager</dependency>

<dependency>org.slf4j:slf4j-log4j12</dependency>

<dependency>org.springframework:spring-webmvc</dependency>

</usedDependencies>

</configuration>

</plugin>

</plugins>

</pluginManagement>

<plugins>

<plugin>

<groupId>org.apache.maven.plugins</groupId>

<artifactId>maven-antrun-plugin</artifactId>

</plugin>

<plugin>

<groupId>org.apache.maven.plugins</groupId>

<artifactId>maven-clean-plugin</artifactId>

<version>3.1.0</version>

</plugin>

<plugin>

<groupId>org.apache.maven.plugins</groupId>

<artifactId>maven-compiler-plugin</artifactId>

<version>3.8.1</version>

<configuration>

<fork>true</fork>

<meminitial>1000m</meminitial>

<maxmem>2000m</maxmem>

</configuration>

</plugin>

<plugin>

<groupId>org.apache.maven.plugins</groupId>

<artifactId>maven-deploy-plugin</artifactId>

<version>3.0.0-M1</version>

</plugin>

<plugin>

<groupId>org.apache.maven.plugins</groupId>

<artifactId>maven-enforcer-plugin</artifactId>

<version>3.0.0-M3</version>

<dependencies>

<dependency>

<groupId>org.codehaus.mojo</groupId>

<artifactId>extra-enforcer-rules</artifactId>

<version>1.3</version>

</dependency>

</dependencies>

<executions>

<execution>

<id>enforce-bytecode-version</id>

<goals>

<goal>enforce</goal>

</goals>

<configuration>

<rules>

<enforceBytecodeVersion>

<maxJdkVersion>1.7</maxJdkVersion>

<excludes>

<!-- guava includes backports for Java 7 compatibility -->

<exclude>com.google.guava:guava</exclude>

</excludes>

<message>Dependencies shouldn't require Java 8+.</message>

</enforceBytecodeVersion>

</rules>

<fail>warn</fail>

</configuration>

</execution>

<execution>

<id>enforce-jdk-version</id>

<goals>

<goal>enforce</goal>

</goals>

<configuration>

<rules>

<requireJavaVersion>

<version>1.7</version>

<message>Benchmark is currently written to support Java 7 and 8.</message>

</requireJavaVersion>

</rules>

</configuration>

</execution>

</executions>

</plugin>

<!-- used by some of the scripts. This forces the plugin to be downloaded, so it doesn't need to when the script runs. -->

<plugin>

<groupId>org.apache.maven.plugins</groupId>

<artifactId>maven-help-plugin</artifactId>

<version>3.2.0</version>

</plugin>

<plugin>

<groupId>org.apache.maven.plugins</groupId>

<artifactId>maven-install-plugin</artifactId>

<version>3.0.0-M1</version>

</plugin>

<plugin>

<groupId>org.apache.maven.plugins</groupId>

<artifactId>maven-pmd-plugin</artifactId>

<version>3.14.0</version>

<configuration>

<linkXref>true</linkXref>

<targetJdk>1.7</targetJdk>

</configuration>

</plugin>

<plugin>

<groupId>org.apache.maven.plugins</groupId>

<artifactId>maven-project-info-reports-plugin</artifactId>

<version>3.1.2</version>

</plugin>

<plugin>