tidy up staging branch

README.md

@@ -0,0 +1,4 @@
+# base-image-pipeline-poc
+CodePipeline PoC to scan and build images before pushing to ECR
+
+Testing with known vulnerable image for log4j - [source](https://github.com/jatinmehrotra/log4jpoc)

app/pom.xml

@@ -0,0 +1,54 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+    <modelVersion>4.0.0</modelVersion>
+
+    <groupId>org.example</groupId>
+    <artifactId>log4j-rce</artifactId>
+    <version>1.0-SNAPSHOT</version>
+    <packaging>jar</packaging>
+
+    <dependencies>
+        <dependency>
+            <groupId>org.apache.logging.log4j</groupId>
+            <artifactId>log4j-core</artifactId>
+            <version>2.14.1</version>
+<!-- Swap with the below to prove it's fixed -->            
+<!--         <version>2.15.0</version>-->
+        </dependency>
+        <dependency>
+            <groupId>org.apache.logging.log4j</groupId>
+            <artifactId>log4j-api</artifactId>
+            <version>2.14.1</version>
+<!-- Swap with the below to prove it's fixed -->       
+<!--         <version>2.15.0</version>-->
+        </dependency>
+    </dependencies>
+     <build>
+    <plugins>
+<plugin>
+  <artifactId>maven-assembly-plugin</artifactId>
+  <configuration>
+    <archive>
+      <manifest>
+        <mainClass>MyExample</mainClass>
+      </manifest>
+    </archive>
+    <descriptorRefs>
+      <descriptorRef>jar-with-dependencies</descriptorRef>
+    </descriptorRefs>
+  </configuration>
+  <executions>
+    <execution>
+      <id>make-assembly</id>
+      <phase>package</phase>
+      <goals>
+        <goal>single</goal>
+      </goals>
+    </execution>
+  </executions>
+</plugin>
+</plugins>
+</build>
+</project>

app/src/main/java/MyExample.java

@@ -0,0 +1,10 @@
+import org.apache.logging.log4j.LogManager;
+import org.apache.logging.log4j.Logger;
+
+public class MyExample {
+    private static final Logger logger = LogManager.getLogger(MyExample.class);
+
+    public static void main(String[] args) {
+        logger.error("${env:SECRET_VALUE:-:}");
+    }
+}