{"id":18609551,"url":"https://github.com/secure-software-engineering/spring-petclinic-kotlin","last_synced_at":"2025-11-02T20:30:25.369Z","repository":{"id":148704568,"uuid":"434587993","full_name":"secure-software-engineering/spring-petclinic-kotlin","owner":"secure-software-engineering","description":"Vulnerable version of the Spring PetClinic application in Kotlin","archived":false,"fork":false,"pushed_at":"2022-05-19T09:16:55.000Z","size":449,"stargazers_count":2,"open_issues_count":0,"forks_count":1,"subscribers_count":6,"default_branch":"main","last_synced_at":"2024-12-27T01:25:18.430Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Kotlin","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/secure-software-engineering.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2021-12-03T12:26:26.000Z","updated_at":"2023-03-01T00:13:34.000Z","dependencies_parsed_at":"2023-05-28T17:00:11.967Z","dependency_job_id":null,"html_url":"https://github.com/secure-software-engineering/spring-petclinic-kotlin","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/secure-software-engineering%2Fspring-petclinic-kotlin","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/secure-software-engineering%2Fspring-petclinic-kotlin/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/secure-software-engineering%2Fspring-petclinic-kotlin/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/secure-software-engineering%2Fspring-petclinic-kotlin/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/secure-software-engineering","download_url":"https://codeload.github.com/secure-software-engineering/spring-petclinic-kotlin/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":239400596,"owners_count":19632049,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-07T03:06:24.390Z","updated_at":"2025-11-02T20:30:25.337Z","avatar_url":"https://github.com/secure-software-engineering.png","language":"Kotlin","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Vulnerable Spring PetClinic in Kotlin \n\nThis is a vulnerable version of the [spring-petclinic-kotlin](https://github.com/spring-petclinic/spring-petclinic-kotlin) application. \nThis application contains security vulnerabilities (hibernate injection, cross-site scripting, use of MD5, etc.) and can be used as an example project to test/compare vulnerability detection tools, such as static and/or dynamic analysis security testing tools (SAST/DAST). \n\n\n## How did we create this vulnerable version?\n\nWe built the vulnerable version of the [spring-petclinic-kotlin](https://github.com/spring-petclinic/spring-petclinic-kotlin) similar to the vulnerable [spring-petclinic](https://github.com/contrast-community/spring-petclinic) Java project. For this purpose, we added three additional classes (CustomRepositoryFactory, CustomRepositoryFactoryBean, and OwnerRepositoryCustomImpl) to the existing [spring-petclinic-kotlin](https://github.com/spring-petclinic/spring-petclinic-kotlin) project. We followed the steps below to build the vulnerable spring-petclinic-kotlin benchmark project.\n\n1. We first opened the existing [spring-petclinic-kotlin](https://github.com/spring-petclinic/spring-petclinic-kotlin) project in the IntelliJ IDEA IDE.\n2. We created an empty Kotlin class named CustomRepositoryFactory.\n3. We copied the Java source code of the class CustomRepositoryFactory from the vulnerable [spring-petclinic](https://github.com/contrast-community/spring-petclinic) Java project.\n4. We pasted the copied Java source code to the Kotlin class CustomRepositoryFactory in our vulnerable spring-petclinic-kotlin project. Then, the IntelliJ IDEA IDE automatically translates the pasted Java source code to the Kotlin source code.\n5. We repeated steps 2 to 4 for creating the classes CustomRepositoryFactoryBean, and OwnerRepositoryCustomImpl.\n6. Finally, we added the annotation @NoRepositoryBean to the existing OwnerRepository class, similar to the vulnerable [spring-petclinic](https://github.com/contrast-community/spring-petclinic) Java project.\n\nAfter the automatic translation from the Java code to the Kotlin code, \nwe found an error in the CustomRepositoryFactory class. \nIn the Java [spring-petclinic](https://github.com/contrast-community/spring-petclinic) \nvulnerable version, there is a method call to \nthe getRepositoryInformation with the second parameter as null value. \nHowever, in the Kotlin version, the method getRepositoryInformation \nrequires both parameters to be non-null values. \nTherefore, the Kotlin compiler gave an error \"Null can not be a value\nof a non-null type\". We fixed this issue by passing the appropriate object\nto the second parameter.\n\n## Technologies used\n\n* Language: Kotlin\n* Core framework: Spring Boot 2 with Spring Framework 5 Kotlin support\n* Server: Apache Tomcat\n* Web framework: Spring MVC\n* Templates: Thymeleaf and Bootstrap\n* Persistence : Spring Data JPA\n* Databases: H2 and MySQL both supported\n* Build: Gradle Script with the Kotlin DSL\n* Testing: Junit 5, Mockito and AssertJ\n\n## Running petclinic locally\n\n### With gradle command line\n\n```\ngit clone https://github.com/spring-petclinic/spring-petclinic-kotlin.git\ncd spring-petclinic-kotlin\n./gradlew bootRun\n```\n\n### With Docker\n\n```\ndocker run -p 8080:8080 springcommunity/spring-petclinic-kotlin\n```\n\n\nYou can then access petclinic here: [http://localhost:8080/]()\n\n\u003cimg width=\"1042\" alt=\"petclinic-screenshot\" src=\"https://user-images.githubusercontent.com/838318/29994372-7f85f6da-8fce-11e7-8896-b5aa075ac0d7.png\"\u003e\n\n\n## Database configuration\n\nIn its default configuration, Petclinic uses an in-memory database (H2) which gets populated at startup with data.\nThe h2 console is automatically exposed at `http://localhost:8080/h2-console`\nand it is possible to inspect the content of the database using the `jdbc:h2:mem:{uuid}` url (the `uuid` param could be find in the startup logs).\n\nA similar setup is provided for MySql in case a persistent database configuration is needed.\nNote that whenever the database type is changed, the data-access.properties file needs to be updated and the mysql-connector-java artifact from the pom.xml needs to be uncommented.\n\nYou could start a MySql database with docker:\n\n```\ndocker run -e MYSQL_USER=petclinic -e MYSQL_PASSWORD=petclinic -e MYSQL_ROOT_PASSWORD=root -e MYSQL_DATABASE=petclinic -p 3306:3306 mysql:5.7.8\n```\n\nFurther documentation is provided [here](https://github.com/spring-projects/spring-petclinic/blob/master/src/main/resources/db/mysql/petclinic_db_setup_mysql.txt).\n\n\n## Looking for something in particular?\n\n| Features                           | Class, files or Java property files  |\n|------------------------------------|---|\n|The Main Class                      | [PetClinicApplication](https://github.com/spring-petclinic/spring-petclinic-kotlin/blob/master/src/main/kotlin/org/springframework/samples/petclinic/PetClinicApplication.kt) |\n|Properties configuration file       | [application.properties](https://github.com/spring-petclinic/spring-petclinic-kotlin/blob/master/src/main/resources) |\n|Gradle build script with Kotlin DSL | [build.gradle.kts](https://github.com/spring-petclinic/spring-petclinic-kotlin/blob/master/build.gradle.kts) |\n|Caching Configuration               | [CacheConfig](https://github.com/spring-petclinic/spring-petclinic-kotlin/blob/master/src/main/kotlin/org/springframework/samples/petclinic/system/CacheConfig.kt) |\n\n\n## Import and run the project in IntelliJ IDEA\n   \n* Make sure you have at least IntelliJ IDEA 2017.2 and IDEA Kotlin plugin 1.1.60+ (menu Tools -\u003e Kotlin -\u003e configure Kotlin Plugin Updates -\u003e make sure \"Stable\" channel is selected -\u003e check for updates now -\u003e restart IDE after the update)\n* Import it in IDEA as a Gradle project\n  * Go to the menu \"File -\u003e New -\u003e Project from Existing Sources... \"\n  * Select the spring-petclinic-kotlin directory then choose \"Import the project from Gradle\"\n  * Select the \"Use gradle wrapper task configuration\" radio button\n* In IntelliJ IDEA, right click on PetClinicApplication.kt then \"Run...\" or \"Debug...\"\n* Open http://localhost:8080/ in your browser\n\n\n## Documentation\n\n* [Migrez une application Java Spring Boot vers kotlin](http://javaetmoi.com/2017/09/migrez-application-java-spring-boot-vers-kotlin/) (french)\n* [Migration Spring Web MVC vers Spring WebFlux](http://javaetmoi.com/2017/12/migration-spring-web-mvc-vers-spring-webflux/) (french)\n\n\n## Publishing a Docker image\n\nThis application uses [Google Jib]([https://github.com/GoogleContainerTools/jib) to build an optimized Docker image\ninto the [Docker Hub](https://cloud.docker.com/u/springcommunity/repository/docker/springcommunity/spring-petclinic-kotlin/)\nrepository.\nThe [build.gradle.kts](build.gradle.kts) has been configured to publish the image with a the `springcommunity/spring-petclinic-kotlin` image name.\n\nBuild and push the container image of Petclinic to the Docker Hub registry:\n```\ngradle jib -Djib.to.auth.username=\u003cusername\u003e -Djib.to.auth.password=\u003cpassword\u003e\n```\n\n\n## Interesting Spring Petclinic forks\n\nThe Spring Petclinic master branch in the main [spring-projects](https://github.com/spring-projects/spring-petclinic)\nGitHub org is the \"canonical\" implementation, currently based on Spring Boot and Thymeleaf.\n\nThis [spring-petclinic-kotlin][] project is one of the [several forks](https://spring-petclinic.github.io/docs/forks.html) \nhosted in a special GitHub org: [spring-petclinic](https://github.com/spring-petclinic).\nIf you have a special interest in a different technology stack\nthat could be used to implement the Pet Clinic then please join the community there.\n\n\n## Interaction with other open source projects\n\nOne of the best parts about working on the Spring Petclinic application is that we have the opportunity to work in direct contact with many Open Source projects. We found some bugs/suggested improvements on various topics such as Spring, Spring Data, Bean Validation and even Eclipse! In many cases, they've been fixed/implemented in just a few days.\nHere is a list of them:\n\n| Name | Issue |\n|------|-------|\n| Spring JDBC: simplify usage of NamedParameterJdbcTemplate | [SPR-10256](https://jira.springsource.org/browse/SPR-10256) and [SPR-10257](https://jira.springsource.org/browse/SPR-10257) |\n| Bean Validation / Hibernate Validator: simplify Maven dependencies and backward compatibility |[HV-790](https://hibernate.atlassian.net/browse/HV-790) and [HV-792](https://hibernate.atlassian.net/browse/HV-792) |\n| Spring Data: provide more flexibility when working with JPQL queries | [DATAJPA-292](https://jira.springsource.org/browse/DATAJPA-292) |\n\n\n# Contributing\n\nContributions with code that injects new vulnerabilities are welcomed. Please create a pull request for that purpuse. \n\n\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsecure-software-engineering%2Fspring-petclinic-kotlin","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsecure-software-engineering%2Fspring-petclinic-kotlin","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsecure-software-engineering%2Fspring-petclinic-kotlin/lists"}