hantsy / quarkus-sandbox

Quarkus playground

Quarkus Sandbox

A personal sandbox project to experience the new features of the Quarkus framework.

Docs

• Kickstart your first Quarkus application
• Building a Spring web application with Quarkus
• Interacting with REST APIs
• Building reactive APIs with Quarkus
• Building GraphQL APIs with Quarkus
• Consuming GraphQL APIs with Quarkus

Sample Codes

Name	Description
resteasy-classic	Simple CURD RESTful APIs using tranditional Resteasy, Hibernate/JPA
resteasy-reactive-pgclient	Resteasy Reactive and Reactive Postgre client
resteasy-reactive	Resteasy Reactive, Hibernate Reactive Repository, Smallrye Mutiny example.
resteasy-kotlin-co	Resteasy Reactive/Kotlin Coroutines, Hibernate Reactive Repository, Smallrye Mutiny example.
resteasy-reactive-hibernate	Resteasy Reactive, Hibernate Reactive Session API, Smallrye Mutiny example.
vertx-routes	Simple CRUD RESTful APIs using Vertx Router and Reactive PgClient with Mutiny APIs.
spring	CRUD RESTful APIs using Spring DI, Spring Data JPA, Spring WebMvc
multipart	Multipart examples
amqp	Reactive Messaging with AMQP connector and JAXRS SSE examples
GraphQL	GraphQL example using MP GraphQL/Smallrye GraphQL
GraphQL Client	GraphQL Client example using MP GraphQL/Smallrye GraphQL
mongodb-kotlin	MongoDb/Resteasy/Kotlin/Mockk example
mongodb-kotlin-co	MongoDb Reactive/Resteasy Reactive/Kotlin Coroutines example
restclient-classic	Rest Client Classic Example
restclient-mutiny	Rest Client Classic with Mutiny Example
restclient-reactive	Rest Client Reactive Example
restclient-kotlin	Rest Client using MP RestClient spec, but written in Kotlin
restclient-kotlin-co	Rest Client Reactive/Kotlin Coroutines
restclient-jaxrs	Rest Client using classic Jaxrs Client API
restclient-java11	Rest Client using Java 11 HttpClient API
restclient-vertx	Rest Client using Vertx Mutiny WebClient API

The following examples used Java 8 or RxJava 2 based Reactive Postgres Client which is depreacted and not available in the latest Qukarus.

Name	Description
java8	Simple CRUD RESTful APIs but using Java 8 CompletionStage and Reactive Postgre Client
rxjava2	CRUD RESTful APIs using RxJava 2 and Reactive Postgre client
vertx-routes	Simple CRUD RESTful APIs using Vertx Router .
java8-hibernate-reactive	Java 8 CompletablFuture, Hibernate Reactive Example.

References

• Quarkus Workshop
• Quarkus beginners guide by Jaxcenter
• DZone Refcard : Quarkus
• Configuring a Quarkus application
• Thoughts on Quarkus

quarkus-sandbox's Issues

Default port usage and hard-coded secrets

Greetings,

We are researchers and we are looking for insecure coding patterns and configurations in the microservice architecture repositories. In your repository, we have found instances of default port and hard-coded usernames and passwords.

According to a recent report default port usages must be avoided: https://www.bleepingcomputer.com/news/security/most-cyber-attacks-focus-on-just-three-tcp-ports/#:~:text=According%20to%20the%20report%2C%20the,(Hypertext%20Transfer%20Protocol%20Secure). We also found hard-coded usernames and passwords

Source: https://github.com/hantsy/quarkus-sample/blob/master/docker-compose.yml

Fix: #1

I am interested to know if you agree with the findings. Any feedback is appreciated.

Further details on default ports:

Data storage,  MySQL 3306, reff: https://dev.mysql.com/doc/mysql-port-reference/en/mysql-ports-reference-tables.html
Data storage,  Postgres 5432, reff: https://www.postgresql.org/docs/8.3/app-postgres.html 
Data storage,  MongoDB 27017, reff: https://docs.mongodb.com/manual/reference/default-mongodb-port/
Data transfer, rabbitMQ 5672, reff: https://www.rabbitmq.com/networking.html
Data transfer, Kafka 9092, reff: https://kafka.apache.org/07/documentation.html
Data transfer, HTTP, http 80 , 443 , reff: https://geekflare.com/default-port-numbers/  
Data storage,  Zookeeper 2181, reff: https://zookeeper.apache.org/doc/r3.1.2/zookeeperStarted.html
Monitoring,    zipkin 9411    , reff: https://zipkin.io/pages/extensions_choices