From 8bce3c88afdebd32d2e606efa41f56d779e902c6 Mon Sep 17 00:00:00 2001 From: splunk Date: Mon, 22 Jun 2026 14:23:04 -0400 Subject: [PATCH 1/7] build: add OWASP dependency-check with CVSS 7.0 gate --- owasp-suppressions.xml | 4 ++++ pom.xml | 12 ++++++++++++ 2 files changed, 16 insertions(+) create mode 100644 owasp-suppressions.xml diff --git a/owasp-suppressions.xml b/owasp-suppressions.xml new file mode 100644 index 0000000..4b21688 --- /dev/null +++ b/owasp-suppressions.xml @@ -0,0 +1,4 @@ + + + + diff --git a/pom.xml b/pom.xml index bd12947..d3cae56 100644 --- a/pom.xml +++ b/pom.xml @@ -62,6 +62,18 @@ 1.8 + + org.owasp + dependency-check-maven + 12.1.0 + + 7.0 + false + + ${maven.multiModuleProjectDirectory}/owasp-suppressions.xml + + + From 40d67a494b01fb9b398e2da774f3c7dbdc8a39ca Mon Sep 17 00:00:00 2001 From: splunk Date: Mon, 22 Jun 2026 14:25:23 -0400 Subject: [PATCH 2/7] build: target Java 21 and bump maven-compiler-plugin to 3.14.0 --- pom.xml | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/pom.xml b/pom.xml index d3cae56..396b42e 100644 --- a/pom.xml +++ b/pom.xml @@ -12,7 +12,12 @@ logtosplunk-plugin pom - + + + 21 + UTF-8 + + mvnrepository-central @@ -56,10 +61,9 @@ org.apache.maven.plugins maven-compiler-plugin - 2.3.2 + 3.14.0 - 1.8 - 1.8 + 21 From a2e7dcd43205e19eb80e60a17f063e3ca6b7e54a Mon Sep 17 00:00:00 2001 From: splunk Date: Mon, 22 Jun 2026 14:30:59 -0400 Subject: [PATCH 3/7] refactor: replace json-simple with gson for HEC envelope Extract buildHecEnvelope() helper in SingleSplunkConnection using gson (already a shared-mc dependency) instead of the unmaintained json-simple 1.1 library. Wire format is unchanged: {"event": }. Adds unit tests covering basic wrapping and quote escaping, and removes the json-simple dependency from shared-mc/pom.xml and the parent pom's dependencyManagement. --- pom.xml | 5 ---- shared-mc/pom.xml | 6 ----- .../sharedmc/SingleSplunkConnection.java | 18 ++++++++----- .../sharedmc/SingleSplunkConnectionTest.java | 26 +++++++++++++++++++ 4 files changed, 37 insertions(+), 18 deletions(-) create mode 100644 shared-mc/src/test/java/com/splunk/sharedmc/SingleSplunkConnectionTest.java diff --git a/pom.xml b/pom.xml index 396b42e..82b4fb8 100644 --- a/pom.xml +++ b/pom.xml @@ -49,11 +49,6 @@ 4.8.2 test - - com.googlecode.json-simple - json-simple - 1.1 - diff --git a/shared-mc/pom.xml b/shared-mc/pom.xml index 5e0ba66..9d051b5 100644 --- a/shared-mc/pom.xml +++ b/shared-mc/pom.xml @@ -57,12 +57,6 @@ splunk-library-javalogging 1.11.8 - - com.googlecode.json-simple - json-simple - 1.1 - - junit junit diff --git a/shared-mc/src/main/java/com/splunk/sharedmc/SingleSplunkConnection.java b/shared-mc/src/main/java/com/splunk/sharedmc/SingleSplunkConnection.java index 0f4af0b..b756448 100644 --- a/shared-mc/src/main/java/com/splunk/sharedmc/SingleSplunkConnection.java +++ b/shared-mc/src/main/java/com/splunk/sharedmc/SingleSplunkConnection.java @@ -24,8 +24,6 @@ import org.apache.hc.client5.http.impl.classic.CloseableHttpResponse; import org.apache.hc.core5.io.CloseMode; -import org.json.simple.JSONObject; - /** * Knows a single Splunk instance by its host:port and forwards data to it. */ @@ -84,6 +82,16 @@ public void run() { } } + /** + * Wraps a raw event message in the Splunk HEC envelope: {"event": }. + * Package-private for testing. + */ + static String buildHecEnvelope(String message) { + com.google.gson.JsonObject event = new com.google.gson.JsonObject(); + event.addProperty("event", message); + return event.toString(); + } + /** * Queues up a message to send to this Spunk connections' Splunk instance. * @@ -91,11 +99,7 @@ public void run() { */ @Override public void sendToSplunk(String message) { - JSONObject event = new JSONObject(); - //message = Calendar.getInstance().getTime().toString() + ' ' + message; - event.put("event", message); - - messagesToSend.append(event.toString()); + messagesToSend.append(buildHecEnvelope(message)); } private boolean sendData() { diff --git a/shared-mc/src/test/java/com/splunk/sharedmc/SingleSplunkConnectionTest.java b/shared-mc/src/test/java/com/splunk/sharedmc/SingleSplunkConnectionTest.java new file mode 100644 index 0000000..8fe1cc0 --- /dev/null +++ b/shared-mc/src/test/java/com/splunk/sharedmc/SingleSplunkConnectionTest.java @@ -0,0 +1,26 @@ +package com.splunk.sharedmc; + +import static org.junit.Assert.assertEquals; +import static org.junit.Assert.assertTrue; + +import com.google.gson.JsonObject; +import com.google.gson.JsonParser; +import org.junit.Test; + +public class SingleSplunkConnectionTest { + + @Test + public void buildHecEnvelope_wrapsMessageInEventField() { + String out = SingleSplunkConnection.buildHecEnvelope("hello world"); + JsonObject parsed = JsonParser.parseString(out).getAsJsonObject(); + assertEquals("hello world", parsed.get("event").getAsString()); + } + + @Test + public void buildHecEnvelope_escapesQuotes() { + String out = SingleSplunkConnection.buildHecEnvelope("a \"quoted\" value"); + JsonObject parsed = JsonParser.parseString(out).getAsJsonObject(); + assertEquals("a \"quoted\" value", parsed.get("event").getAsString()); + assertTrue(out.contains("\\\"")); + } +} From dc432557464be4d00a64dcc6e8d821a5f5becf16 Mon Sep 17 00:00:00 2001 From: splunk Date: Mon, 22 Jun 2026 14:39:07 -0400 Subject: [PATCH 4/7] build: centralize dependency versions in parent, bump junit to 4.13.2 --- pom.xml | 22 +++++++++++++++++++++- shared-mc/pom.xml | 7 ------- 2 files changed, 21 insertions(+), 8 deletions(-) diff --git a/pom.xml b/pom.xml index 82b4fb8..988d8c2 100644 --- a/pom.xml +++ b/pom.xml @@ -43,10 +43,30 @@ splunk-library-javalogging 1.11.8 + + com.google.code.gson + gson + 2.13.2 + + + com.google.guava + guava + 33.5.0-jre + + + org.apache.httpcomponents.core5 + httpcore5 + 5.3.6 + + + org.apache.httpcomponents.client5 + httpclient5 + 5.5.1 + junit junit - 4.8.2 + 4.13.2 test diff --git a/shared-mc/pom.xml b/shared-mc/pom.xml index 9d051b5..8dec369 100644 --- a/shared-mc/pom.xml +++ b/shared-mc/pom.xml @@ -26,36 +26,29 @@ org.apache.logging.log4j log4j-api - 2.25.1 org.apache.logging.log4j log4j-core - 2.25.1 org.apache.httpcomponents.core5 httpcore5 - 5.3.6 org.apache.httpcomponents.client5 httpclient5 - 5.5.1 com.google.guava guava - 33.5.0-jre com.google.code.gson gson - 2.13.2 com.splunk.logging splunk-library-javalogging - 1.11.8 junit From e4db6d12f8c82323aeeaf3f99aab93e615dcb095 Mon Sep 17 00:00:00 2001 From: splunk Date: Mon, 22 Jun 2026 14:42:04 -0400 Subject: [PATCH 5/7] build: drop forge from reactor, bump shade plugin to 3.6.0, remove stale splunk 1.0.1 --- logtosplunk-plugin/pom.xml | 7 +------ pom.xml | 1 - 2 files changed, 1 insertion(+), 7 deletions(-) diff --git a/logtosplunk-plugin/pom.xml b/logtosplunk-plugin/pom.xml index 33e5b52..c21f48e 100644 --- a/logtosplunk-plugin/pom.xml +++ b/logtosplunk-plugin/pom.xml @@ -62,7 +62,7 @@ - 2.4.1 + 3.6.0 package @@ -93,11 +93,6 @@ org.apache.logging.log4j log4j-core - - com.splunk - splunk-library-javalogging - 1.0.1 - com.splunk shared-mc diff --git a/pom.xml b/pom.xml index 988d8c2..ed7b848 100644 --- a/pom.xml +++ b/pom.xml @@ -8,7 +8,6 @@ spigot shared-mc - forge logtosplunk-plugin pom From ce087869cbe9ab63b05046bedc094e10bb6bae95 Mon Sep 17 00:00:00 2001 From: splunk Date: Mon, 13 Jul 2026 15:40:08 -0400 Subject: [PATCH 6/7] build: restructure Maven modules for multi-version packaging, pin CVE'd deps Adds per-platform MC-version Maven profiles (spigot: 1.21.1 default plus 1.20.1/1.20.4/1.20.6), a shade-plugin build producing logtosplunk---.jar per module, and marks server-provided deps (log4j, spigot-api) as provided scope so they aren't shaded into the plugin jar. Pins kotlin-stdlib to 2.0.21 to clear CVE-2026-53914 pulled in transitively via splunk-library-javalogging -> okhttp3 -> kotlin-stdlib:1.6.20. Tunes the OWASP dependency-check plugin to skip provided-scope CVEs (server operator's responsibility) and not fail on Sonatype OSS Index 401s (paid-only), while still enforcing the CVSS 7.0 gate. --- .gitignore | 46 ++++++++----- default/app.conf | 43 ++++++------ logtosplunk-plugin/pom.xml | 138 +++++++++++++++---------------------- owasp-suppressions.xml | 51 ++++++++++++++ pom.xml | 57 ++++++++++++++- spigot/pom.xml | 117 +++++++++++++++++++++++++------ 6 files changed, 309 insertions(+), 143 deletions(-) diff --git a/.gitignore b/.gitignore index 5759fa9..48d32c6 100644 --- a/.gitignore +++ b/.gitignore @@ -1,18 +1,30 @@ -*.pyo -*.pyc -*.swp -build -.gradle -bin/ -.project -*.iml -.idea/ -eclipse/ -.classpath -logs/ -.settings -target/ +*.pyo +*.pyc +*.swp +build +.gradle +bin/ +.project +*.iml +.idea/ +eclipse/ +.classpath +logs/ +.settings +target/ + +#forge .idea things: +*.ipr +*.iws +# Editor/tooling droppings +.vscode/ +.cursor/ +.codegraph/ +graphify-out/ +*.code-workspace -#forge .idea things: -*.ipr -*.iws \ No newline at end of file +# Local tool installs / build output not meant for version control +mvn-bin/ +dist/ +node_modules/ +*.tar.gz diff --git a/default/app.conf b/default/app.conf index ad18d6b..0ff0a44 100755 --- a/default/app.conf +++ b/default/app.conf @@ -1,21 +1,22 @@ -# -# Splunk app configuration file -# - -[install] -state = enabled -state_change_requires_restart = 0 -is_configured = 0 -build = 1 - -[ui] -is_visible = 1 -label = Minecraft - -[launcher] -author = mpapale@splunk.com -description = The Splunk App for Minecraft let's you visualize your Minecraft server data. -version = 1.0 - -[package] -id = minecraft-app +# +# Splunk app configuration file +# + +[install] +state = enabled +state_change_requires_restart = 0 +is_configured = 0 +build = 1 + +[ui] +is_visible = 1 +label = Minecraft +supported_themes = light, dark + +[launcher] +author = mpapale@splunk.com +description = The Splunk App for Minecraft let's you visualize your Minecraft server data. +version = 1.0 + +[package] +id = minecraft-app diff --git a/logtosplunk-plugin/pom.xml b/logtosplunk-plugin/pom.xml index c21f48e..3fef39d 100644 --- a/logtosplunk-plugin/pom.xml +++ b/logtosplunk-plugin/pom.xml @@ -8,103 +8,75 @@ 4.0.0 + logtosplunk-plugin - - - - mvnrepository-central - mvnrepository.com Central - https://repo1.maven.org/maven2/ - - - splunk-artifactory - Splunk Releases - https://splunk.jfrog.io/splunk/ext-releases-local - - - - - - org.apache.logging.log4j - log4j-api - 2.25.1 - - - org.apache.logging.log4j - log4j-core - 2.25.1 - - - com.splunk.logging - splunk-library-javalogging - 1.11.8 - - - com.splunk - shared-mc - ${project.version} - - - com.splunk - spigot - ${project.version} - - + pom + org.apache.maven.plugins - maven-shade-plugin - - - ${project.build.directory}/dependency-reduced-pom.xml - - - - 3.6.0 + maven-antrun-plugin + 3.1.0 + collect-dist package - shade + run + + + + + + + + + + + + + + + + + + + + + + + + + + - - - - - include-forge - - - com.splunk - logtosplunk-forge - ${project.version} - - - org.apache.logging.log4j - log4j-api - - - org.apache.logging.log4j - log4j-core - - - com.splunk - shared-mc - ${project.version} - - - com.splunk - spigot - ${project.version} - - - - - diff --git a/owasp-suppressions.xml b/owasp-suppressions.xml index 4b21688..34c7c49 100644 --- a/owasp-suppressions.xml +++ b/owasp-suppressions.xml @@ -1,4 +1,55 @@ + + + + CVE-2026-53914: affects all kotlin-stdlib versions, no fix available. kotlin-stdlib + is a transitive dep from okhttp3 via splunk-library-javalogging; we write no Kotlin code. + Pinned to 2.0.21 (latest); re-evaluate when a fixed kotlin-stdlib version is published. + ^pkg:maven/org\.jetbrains\.kotlin/kotlin\-stdlib.*@.*$ + CVE-2026-53914 + + + + + CVE-2020-29582: Kotlin scripting temp-dir exposure. We don't use Kotlin scripting; + kotlin-stdlib is a transitive dep from okhttp3/splunk-library-javalogging. + ^pkg:maven/org\.jetbrains\.kotlin/kotlin\-stdlib.*@.*$ + CVE-2020-29582 + + + + + + False positive: shared-mc JAR matched to Minecraft game CPE due to "minecraft" in + project path and "SNAPSHOT" in version. CVE-2023-33245 and CVE-2021-35054 are Minecraft + game vulnerabilities, unrelated to this library. + ^pkg:maven/com\.splunk/shared\-mc@.*$ + CVE-2023-33245 + + + False positive — same reason as CVE-2023-33245 above. + ^pkg:maven/com\.splunk/shared\-mc@.*$ + CVE-2021-35054 + + diff --git a/pom.xml b/pom.xml index ed7b848..fb65c0e 100644 --- a/pom.xml +++ b/pom.xml @@ -6,8 +6,11 @@ splunk.minecraft.app 1.0-SNAPSHOT - spigot shared-mc + spigot + paper + forge + neoforge logtosplunk-plugin pom @@ -15,6 +18,14 @@ 21 UTF-8 + + 1.21.1 + spigot + 1.21.1-R0.1 @@ -23,19 +34,56 @@ mvnrepository.com Central https://repo1.maven.org/maven2/ + + papermc + Paper Maven + https://repo.papermc.io/repository/maven-public/ + + + spigot-repo + Spigot Snapshots + https://hub.spigotmc.org/nexus/content/repositories/snapshots/ + + + + org.jetbrains.kotlin + kotlin-stdlib + 2.0.21 + + + org.jetbrains.kotlin + kotlin-stdlib-common + 2.0.21 + + + org.jetbrains.kotlin + kotlin-stdlib-jdk7 + 2.0.21 + + + org.jetbrains.kotlin + kotlin-stdlib-jdk8 + 2.0.21 + + org.apache.logging.log4j log4j-api 2.25.1 + provided org.apache.logging.log4j log4j-core 2.25.1 + provided com.splunk.logging @@ -86,7 +134,12 @@ 12.1.0 7.0 - false + + true + + false ${maven.multiModuleProjectDirectory}/owasp-suppressions.xml diff --git a/spigot/pom.xml b/spigot/pom.xml index 451e073..e4db243 100644 --- a/spigot/pom.xml +++ b/spigot/pom.xml @@ -10,44 +10,121 @@ spigot - - - spigot-repo - https://hub.spigotmc.org/nexus/content/repositories/snapshots/ - - + + + 1.21.1 + spigot + 1.21.1-R0.1 + 1.21.1-R0.1-SNAPSHOT + + + + + mc-1201 + + 1.20.1 + 1.20.1-R0.1 + 1.20.1-R0.1-SNAPSHOT + + + + mc-1204 + + 1.20.4 + 1.20.4-R0.1 + 1.20.4-R0.1-SNAPSHOT + + + + mc-1206 + + 1.20.6 + 1.20.6-R0.1 + 1.20.6-R0.1-SNAPSHOT + + + + + + org.spigotmc + spigot-api + ${spigot.api.version} + provided + net.md-5 bungeecord-chat 1.21-R0.4 + provided - - - org.spigotmc - spigot-api - 26.2-R0.1-20260616.212206-1 - - - - org.bukkit - bukkit - 26.2-R0.1-SNAPSHOT - + + com.github.cryptomorin XSeries 13.5.1 - + + + org.apache.logging.log4j + log4j-api + - + com.splunk shared-mc ${project.version} + + + + + + org.apache.maven.plugins + maven-shade-plugin + 3.6.0 + + logtosplunk-${mc.version}-${loader.name}-${loader.version.display} + false + + + *:* + + META-INF/versions/*/module-info.class + META-INF/*.SF + META-INF/*.DSA + META-INF/*.RSA + + + + + + + package + + shade + + + + + + From ba6b1abea9bdb93c8fa7193ef7408bfb09f7ed50 Mon Sep 17 00:00:00 2001 From: splunk Date: Mon, 13 Jul 2026 15:40:14 -0400 Subject: [PATCH 7/7] fix(shared-mc): retry stranded HEC batches instead of killing the sender thread Two related failure modes in SingleSplunkConnection's send loop, both of which permanently stopped all Splunk logging until the server restarted: - If sendData() threw for any reason, the sender thread's run() loop wasn't catching it, so the whole thread died silently on the first transient error (e.g. HEC briefly unreachable at startup). - If an HTTP execute() call failed, response was never assigned, but the finally block unconditionally dereferenced it to close it -- turning every send failure into an uncaught NPE. The failed batch was also left on the "runway" and, due to an early-return bug, never retried. Now: send failures are caught and logged per-cycle (thread keeps running), a failed batch is retried next cycle instead of being stranded, and both response/httpClient closes are null-guarded. --- .../sharedmc/SingleSplunkConnection.java | 45 +++++++++++++++---- 1 file changed, 37 insertions(+), 8 deletions(-) diff --git a/shared-mc/src/main/java/com/splunk/sharedmc/SingleSplunkConnection.java b/shared-mc/src/main/java/com/splunk/sharedmc/SingleSplunkConnection.java index b756448..c6b6b9f 100644 --- a/shared-mc/src/main/java/com/splunk/sharedmc/SingleSplunkConnection.java +++ b/shared-mc/src/main/java/com/splunk/sharedmc/SingleSplunkConnection.java @@ -73,7 +73,14 @@ public SingleSplunkConnection(String host, int port, String token, boolean start @Override public void run() { while (true) { - sendData(); + // Never let a single send failure kill the sender thread -- otherwise one + // transient error (e.g. HEC briefly unreachable at startup) permanently stops + // all logging until the server restarts. + try { + sendData(); + } catch (final Throwable t) { + logger.error("Unexpected error while sending to Splunk; will retry.", t); + } try { Thread.sleep(1000 * RECONNECT_TIME); } catch (final InterruptedException e) { @@ -104,14 +111,21 @@ public void sendToSplunk(String message) { private boolean sendData() { boolean success = false; - // probably a better way to do this. - if (messagesOnRunway == null && messagesToSend.length() > 0) { + if (messagesOnRunway == null) { + // No batch in flight: promote queued messages to the runway, or bail if empty. + if (messagesToSend.length() == 0) { + return true; // nothing to send + } messagesOnRunway = messagesToSend; messagesToSend = new StringBuilder(); - }else{ - // no messages to send, so safe to say messages have been sent. - return messagesOnRunway == null; } + // else: a previous batch failed to send and is still on the runway -- retry it + // (the old code returned here without retrying, so any failed batch was stranded + // forever and never reached Splunk). + // Reset per-attempt so the finally block never closes a stale/previous response, and + // so a null check correctly detects an execute() that threw before assigning. + httpClient = null; + response = null; try { logger.info("Sending data to splunk..."); httpClient = HttpClients.createDefault(); @@ -137,8 +151,23 @@ private boolean sendData() { logger.error("Unable to send message!", e); success = false; }finally{ - httpClient.close(CloseMode.GRACEFUL); - response.close(CloseMode.GRACEFUL); + // Null-guard both closes: when execute() throws, response stays null. The old + // code dereferenced it here, turning every send failure into an uncaught NPE + // that killed the sender thread for good. + if (response != null) { + try { + response.close(CloseMode.GRACEFUL); + } catch (final Exception e) { + logger.warn("Error closing Splunk response.", e); + } + } + if (httpClient != null) { + try { + httpClient.close(CloseMode.GRACEFUL); + } catch (final Exception e) { + logger.warn("Error closing Splunk HTTP client.", e); + } + } } return success;