##### Coverage Report - org.owasp.dependencycheck.maven.DependencyCheckMojo

Classes in this File | Line Coverage | Branch Coverage | Complexity
DependencyCheckMojo |
0% | 0/318
0% | 0/122
| 3.5185185185185186;3.519

1 |  |
     /*
2 |  |
      * This file is part of dependency-check-maven.
3 |  |
      *
4 |  |
      * Dependency-check-maven is free software: you can redistribute it and/or modify it
5 |  |
      * under the terms of the GNU General Public License as published by the Free
6 |  |
      * Software Foundation, either version 3 of the License, or (at your option) any
7 |  |
      * later version.
8 |  |
      *
9 |  |
      * Dependency-check-maven is distributed in the hope that it will be useful, but
10 |  |
      * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
11 |  |
      * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
12 |  |
      * details.
13 |  |
      *
14 |  |
      * You should have received a copy of the GNU General Public License along with
15 |  |
      * dependency-check-maven. If not, see http://www.gnu.org/licenses/.
16 |  |
      *
17 |  |
      * Copyright (c) 2013 Jeremy Long. All Rights Reserved.
18 |  |
      */
19 |  |
     package org.owasp.dependencycheck.maven;
20 |  |
21 |  |
     import java.io.File;
22 |  |
     import java.io.IOException;
23 |  |
     import java.io.InputStream;
24 |  |
     import java.io.UnsupportedEncodingException;
25 |  |
     import java.net.URLEncoder;
26 |  |
     import java.text.DateFormat;
27 |  |
     import java.util.Date;
28 |  |
     import java.util.List;
29 |  |
     import java.util.Locale;
30 |  |
     import java.util.logging.Level;
31 |  |
     import java.util.logging.Logger;
32 |  |
     import org.apache.maven.doxia.sink.SinkFactory;
33 |  |
     import org.apache.maven.plugin.AbstractMojo;
34 |  |
     import org.apache.maven.plugin.MojoExecutionException;
35 |  |
     import org.apache.maven.project.MavenProject;
36 |  |
     import java.util.Set;
37 |  |
     import org.apache.maven.artifact.Artifact;
38 |  |
     import org.apache.maven.plugins.annotations.Component;
39 |  |
     import org.apache.maven.plugins.annotations.LifecyclePhase;
40 |  |
     import org.apache.maven.plugins.annotations.Mojo;
41 |  |
     import org.apache.maven.plugins.annotations.Parameter;
42 |  |
     import org.apache.maven.plugins.annotations.ResolutionScope;
43 |  |
     import org.apache.maven.reporting.MavenMultiPageReport;
44 |  |
     import org.apache.maven.reporting.MavenReport;
45 |  |
     import org.apache.maven.reporting.MavenReportException;
46 |  |
     import org.apache.maven.doxia.sink.Sink;
47 |  |
     import org.apache.maven.plugin.MojoFailureException;
48 |  |
     import org.owasp.dependencycheck.Engine;
49 |  |
     import org.owasp.dependencycheck.dependency.Dependency;
50 |  |
     import org.owasp.dependencycheck.dependency.Evidence;
51 |  |
     import org.owasp.dependencycheck.dependency.Identifier;
52 |  |
     import org.owasp.dependencycheck.dependency.Reference;
53 |  |
     import org.owasp.dependencycheck.dependency.Vulnerability;
54 |  |
     import org.owasp.dependencycheck.dependency.VulnerableSoftware;
55 |  |
     import org.owasp.dependencycheck.reporting.ReportGenerator;
56 |  |
     import org.owasp.dependencycheck.utils.LogUtils;
57 |  |
     import org.owasp.dependencycheck.utils.Settings;
58 |  |
59 |  |
     /**
60 |  |
      * Maven Plugin that checks project dependencies to see if they have any known
61 |  |
      * published vulnerabilities.
62 |  |
      *
63 |  |
      * @author Jeremy Long (jeremy.long@owasp.org)
64 |  |
      */
65 |  |
     @Mojo(name = "check", defaultPhase = LifecyclePhase.COMPILE, threadSafe = true,
66 |  |
             requiresDependencyResolution = ResolutionScope.RUNTIME_PLUS_SYSTEM,
67 |  |
             requiresOnline = true)
68 | 0 |
     public class DependencyCheckMojo extends AbstractMojo implements MavenMultiPageReport {
69 |  |
70 |  |
         /**
71 |  |
          * The properties file location.
72 |  |
          */
73 |  |
         private static final String PROPERTIES_FILE = "mojo.properties";
74 |  |
         /**
75 |  |
          * Name of the logging properties file.
76 |  |
          */
77 |  |
         private static final String LOG_PROPERTIES_FILE = "log.properties";
78 |  |
         /**
79 |  |
          * The name of the test scope.
80 |  |
          */
81 |  |
         public static final String TEST_SCOPE = "test";
82 |  |
         // <editor-fold defaultstate="collapsed" desc="Maven bound parameters and components">
83 |  |
         /**
84 |  |
          * The Maven Project Object.
85 |  |
          */
86 |  |
         @Component
87 |  |
         private MavenProject project;
88 |  |
         /**
89 |  |
          * The name of the site report destination.
90 |  |
          */
91 |  |
         @Parameter(property = "report-name", defaultValue = "dependency-check-report")
92 |  |
         private String reportName;
93 |  |
         /**
94 |  |
          * The path to the verbose log
95 |  |
          */
96 |  |
         @Parameter(property = "logfile", defaultValue = "")
97 |  |
         private String logFile;
98 |  |
         /**
99 |  |
          * The name of the report to be displayed in the Maven Generated Reports
100 |  |
          * page
101 |  |
          */
102 |  |
         @Parameter(property = "name", defaultValue = "Dependency-Check")
103 |  |
         private String name;
104 |  |
         /**
105 |  |
          * The description of the Dependency-Check report to be displayed in the
106 |  |
          * Maven Generated Reports page
107 |  |
          */
108 |  |
         @Parameter(property = "description", defaultValue = "A report providing details on any published "
109 |  |
                 + "vulnerabilities within project dependencies. This report is a best effort but may contain "
110 |  |
                 + "false positives and false negatives.")
111 |  |
         private String description;
112 |  |
         /**
113 |  |
          * Specifies the destination directory for the generated Dependency-Check
114 |  |
          * report.
115 |  |
          */
116 |  |
         @Parameter(property = "reportOutputDirectory", defaultValue = "${project.reporting.outputDirectory}", required = true)
117 |  |
         private File reportOutputDirectory;
118 |  |
         /**
119 |  |
          * Specifies if the build should be failed if a CVSS score above a specified
120 |  |
          * level is identified. The default is 11 which means since the CVSS scores
121 |  |
          * are 0-10, by default the build will never fail.
122 |  |
          */
123 | 0 |
         @Parameter(property = "failBuildOnCVSS", defaultValue = "11", required = true)
124 |  |
         private float failBuildOnCVSS = 11;
125 |  |
         /**
126 |  |
          * The output directory.
127 |  |
          */
128 |  |
         @Parameter(defaultValue = "${project.build.directory}", required = true)
129 |  |
         private File outputDirectory;
130 |  |
         /**
131 |  |
          * Sets whether auto-updating of the NVD CVE/CPE data is enabled. It is not
132 |  |
          * recommended that this be turned to false. Default is true.
133 |  |
          */
134 | 0 |
         @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"})
135 |  |
         @Parameter(property = "autoupdate", defaultValue = "true", required = true)
136 |  |
         private boolean autoUpdate = true;
137 |  |
         /**
138 |  |
          * The report format to be generated (HTML, XML, VULN, ALL). This
139 |  |
          * configuration option has no affect if using this within the Site plugin
140 |  |
          * unless the externalReport is set to true. Default is HTML.
141 |  |
          */
142 | 0 |
         @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"})
143 |  |
         @Parameter(property = "format", defaultValue = "HTML", required = true)
144 |  |
         private String format = "HTML";
145 |  |
         /**
146 |  |
          * Sets whether or not the external report format should be used.
147 |  |
          */
148 | 0 |
         @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"})
149 |  |
         @Parameter(property = "externalReport", defaultValue = "false", required = true)
150 |  |
         private boolean externalReport = false;
151 |  |
         /**
152 |  |
          * The Proxy URL.
153 |  |
          */
154 | 0 |
         @SuppressWarnings("CanBeFinal")
155 |  |
         @Parameter(property = "proxyUrl", defaultValue = "", required = false)
156 |  |
         private String proxyUrl = null;
157 |  |
         /**
158 |  |
          * The Proxy Port.
159 |  |
          */
160 | 0 |
         @SuppressWarnings("CanBeFinal")
161 |  |
         @Parameter(property = "proxyPort", defaultValue = "", required = false)
162 |  |
         private String proxyPort = null;
163 |  |
         /**
164 |  |
          * The Proxy username.
165 |  |
          */
166 | 0 |
         @SuppressWarnings("CanBeFinal")
167 |  |
         @Parameter(property = "proxyUsername", defaultValue = "", required = false)
168 |  |
         private String proxyUsername = null;
169 |  |
         /**
170 |  |
          * The Proxy password.
171 |  |
          */
172 | 0 |
         @SuppressWarnings("CanBeFinal")
173 |  |
         @Parameter(property = "proxyPassword", defaultValue = "", required = false)
174 |  |
         private String proxyPassword = null;
175 |  |
         /**
176 |  |
          * The Connection Timeout.
177 |  |
          */
178 | 0 |
         @SuppressWarnings("CanBeFinal")
179 |  |
         @Parameter(property = "connectionTimeout", defaultValue = "", required = false)
180 |  |
         private String connectionTimeout = null;
181 |  |
182 |  |
         // </editor-fold>
183 |  |
         /**
184 |  |
          * Executes the Dependency-Check on the dependent libraries.
185 |  |
          *
186 |  |
          * @return the Engine used to scan the dependencies.
187 |  |
          */
188 |  |
         private Engine executeDependencyCheck() {
189 |  |
190 | 0 |
             final InputStream in = DependencyCheckMojo.class.getClassLoader().getResourceAsStream(LOG_PROPERTIES_FILE);
191 | 0 |
             LogUtils.prepareLogger(in, logFile);
192 |  |
193 | 0 |
             populateSettings();
194 | 0 |
             final Engine engine = new Engine();
195 | 0 |
             final Set<Artifact> artifacts = project.getArtifacts();
196 | 0 |
             for (Artifact a : artifacts) {
197 | 0 |
                 if (!TEST_SCOPE.equals(a.getScope())) {
198 | 0 |
                     engine.scan(a.getFile().getAbsolutePath());
199 |  |
                 }
200 |  |
             }
201 | 0 |
             engine.analyzeDependencies();
202 | 0 |
             return engine;
203 |  |
         }
204 |  |
205 |  |
         /**
206 |  |
          * Generates the reports for a given dependency-check engine.
207 |  |
          *
208 |  |
          * @param engine a dependency-check engine
209 |  |
          */
210 |  |
         private void generateExternalReports(Engine engine) {
211 | 0 |
             final ReportGenerator r = new ReportGenerator(project.getName(), engine.getDependencies(), engine.getAnalyzers());
212 |  |
             try {
213 | 0 |
                 r.generateReports(outputDirectory.getCanonicalPath(), format);
214 | 0 |
             } catch (IOException ex) {
215 | 0 |
                 Logger.getLogger(DependencyCheckMojo.class.getName()).log(Level.SEVERE, null, ex);
216 | 0 |
             } catch (Exception ex) {
217 | 0 |
                 Logger.getLogger(DependencyCheckMojo.class.getName()).log(Level.SEVERE, null, ex);
218 | 0 |
             }
219 | 0 |
         }
220 |  |
221 |  |
         /**
222 |  |
          * Generates a dependency-check report using the Maven Site format.
223 |  |
          *
224 |  |
          * @param engine the engine used to scan the dependencies
225 |  |
          * @param sink the sink to write the data to
226 |  |
          */
227 |  |
         private void generateMavenSiteReport(final Engine engine, Sink sink) {
228 | 0 |
             final List<Dependency> dependencies = engine.getDependencies();
229 |  |
230 | 0 |
             writeSiteReportHeader(sink, project.getName());
231 | 0 |
             writeSiteReportTOC(sink, dependencies);
232 |  |
233 | 0 |
             int cnt = 0;
234 | 0 |
             for (Dependency d : dependencies) {
235 | 0 |
                 writeSiteReportDependencyHeader(sink, d);
236 | 0 |
                 cnt = writeSiteReportDependencyAnalysisExceptions(d, cnt, sink);
237 | 0 |
                 cnt = writeSiteReportDependencyEvidenceUsed(d, cnt, sink);
238 | 0 |
                 cnt = writeSiteReportDependencyRelatedDependencies(d, cnt, sink);
239 | 0 |
                 writeSiteReportDependencyIdentifiers(d, sink);
240 | 0 |
                 writeSiteReportDependencyVulnerabilities(d, sink, cnt);
241 |  |
             }
242 | 0 |
             sink.body_();
243 | 0 |
         }
244 |  |
245 |  |
         // <editor-fold defaultstate="collapsed" desc="various writeXXXXX methods to generate the Site Report">
246 |  |
         /**
247 |  |
          * Writes the vulnerabilities to the site report.
248 |  |
          *
249 |  |
          * @param d the dependency
250 |  |
          * @param sink the sink to write the data to
251 |  |
          * @param collapsibleHeaderCount the collapsible header count
252 |  |
          */
253 |  |
         private void writeSiteReportDependencyVulnerabilities(Dependency d, Sink sink, int collapsibleHeaderCount) {
254 | 0 |
             int cnt = collapsibleHeaderCount;
255 | 0 |
             if (d.getVulnerabilities() != null && !d.getVulnerabilities().isEmpty()) {
256 | 0 |
                 for (Vulnerability v : d.getVulnerabilities()) {
257 |  |
258 | 0 |
                     sink.paragraph();
259 | 0 |
                     sink.bold();
260 |  |
                     try {
261 | 0 |
                         sink.link("http://web.nvd.nist.gov/view/vuln/detail?vulnId=" + URLEncoder.encode(v.getName(), "US-ASCII"));
262 | 0 |
                         sink.text(v.getName());
263 | 0 |
                         sink.link_();
264 | 0 |
                         sink.bold_();
265 | 0 |
                     } catch (UnsupportedEncodingException ex) {
266 | 0 |
                         sink.text(v.getName());
267 | 0 |
                         sink.bold_();
268 | 0 |
                         sink.lineBreak();
269 | 0 |
                         sink.text("http://web.nvd.nist.gov/view/vuln/detail?vulnId=" + v.getName());
270 | 0 |
                     }
271 | 0 |
                     sink.paragraph_();
272 | 0 |
                     sink.paragraph();
273 | 0 |
                     sink.text("Severity: ");
274 | 0 |
                     if (v.getCvssScore() < 4.0) {
275 | 0 |
                         sink.text("Low");
276 |  |
                     } else {
277 | 0 |
                         if (v.getCvssScore() >= 7.0) {
278 | 0 |
                             sink.text("High");
279 |  |
                         } else {
280 | 0 |
                             sink.text("Medium");
281 |  |
                         }
282 |  |
                     }
283 | 0 |
                     sink.lineBreak();
284 | 0 |
                     sink.text("CVSS Score: " + v.getCvssScore());
285 | 0 |
                     if (v.getCwe() != null && !v.getCwe().isEmpty()) {
286 | 0 |
                         sink.lineBreak();
287 | 0 |
                         sink.text("CWE: ");
288 | 0 |
                         sink.text(v.getCwe());
289 |  |
                     }
290 | 0 |
                     sink.paragraph_();
291 | 0 |
                     sink.paragraph();
292 | 0 |
                     sink.text(v.getDescription());
293 | 0 |
                     if (v.getReferences() != null && !v.getReferences().isEmpty()) {
294 | 0 |
                         sink.list();
295 | 0 |
                         for (Reference ref : v.getReferences()) {
296 | 0 |
                             sink.listItem();
297 | 0 |
                             sink.text(ref.getSource());
298 | 0 |
                             sink.text(" - ");
299 | 0 |
                             sink.link(ref.getUrl());
300 | 0 |
                             sink.text(ref.getName());
301 | 0 |
                             sink.link_();
302 | 0 |
                             sink.listItem_();
303 |  |
                         }
304 | 0 |
                         sink.list_();
305 |  |
                     }
306 | 0 |
                     sink.paragraph_();
307 | 0 |
                     if (v.getVulnerableSoftware() != null && !v.getVulnerableSoftware().isEmpty()) {
308 | 0 |
                         sink.paragraph();
309 |  |
310 | 0 |
                         cnt += 1;
311 | 0 |
                         sink.rawText("Vulnerable Software <a href=\"javascript:toggleElement(this, 'vulnSoft" + cnt + "')\">[-]</a>");
312 | 0 |
                         sink.rawText("<div id=\"vulnSoft" + cnt + "\" style=\"display:block\">");
313 | 0 |
                         sink.list();
314 | 0 |
                         for (VulnerableSoftware vs : v.getVulnerableSoftware()) {
315 | 0 |
                             sink.listItem();
316 |  |
                             try {
317 | 0 |
                                 sink.link("http://web.nvd.nist.gov/view/vuln/search-results?cpe=" + URLEncoder.encode(vs.getName(), "US-ASCII"));
318 | 0 |
                                 sink.text(vs.getName());
319 | 0 |
                                 sink.link_();
320 | 0 |
                                 if (vs.hasPreviousVersion()) {
321 | 0 |
                                     sink.text(" and all previous versions.");
322 |  |
                                 }
323 | 0 |
                             } catch (UnsupportedEncodingException ex) {
324 | 0 |
                                 sink.text(vs.getName());
325 | 0 |
                                 if (vs.hasPreviousVersion()) {
326 | 0 |
                                     sink.text(" and all previous versions.");
327 |  |
                                 }
328 | 0 |
                                 sink.text(" (http://web.nvd.nist.gov/view/vuln/search-results?cpe=" + vs.getName() + ")");
329 | 0 |
                             }
330 |  |
331 | 0 |
                             sink.listItem_();
332 |  |
                         }
333 | 0 |
                         sink.list_();
334 | 0 |
                         sink.rawText("</div>");
335 | 0 |
                         sink.paragraph_();
336 |  |
                     }
337 |  |
                 }
338 |  |
             }
339 | 0 |
         }
340 |  |
341 |  |
         /**
342 |  |
          * Writes the identifiers to the site report.
343 |  |
          *
344 |  |
          * @param d the dependency
345 |  |
          * @param sink the sink to write the data to
346 |  |
          */
347 |  |
         private void writeSiteReportDependencyIdentifiers(Dependency d, Sink sink) {
348 | 0 |
             if (d.getIdentifiers() != null && !d.getIdentifiers().isEmpty()) {
349 | 0 |
                 sink.sectionTitle4();
350 | 0 |
                 sink.text("Identifiers");
351 | 0 |
                 sink.sectionTitle4_();
352 | 0 |
                 sink.list();
353 | 0 |
                 for (Identifier i : d.getIdentifiers()) {
354 | 0 |
                     sink.listItem();
355 | 0 |
                     sink.text(i.getType());
356 | 0 |
                     sink.text(": ");
357 | 0 |
                     if (i.getUrl() != null && i.getUrl().length() > 0) {
358 | 0 |
                         sink.link(i.getUrl());
359 | 0 |
                         sink.text(i.getValue());
360 | 0 |
                         sink.link_();
361 |  |
                     } else {
362 | 0 |
                         sink.text(i.getValue());
363 |  |
                     }
364 | 0 |
                     if (i.getDescription() != null && i.getDescription().length() > 0) {
365 | 0 |
                         sink.lineBreak();
366 | 0 |
                         sink.text(i.getDescription());
367 |  |
                     }
368 | 0 |
                     sink.listItem_();
369 |  |
                 }
370 | 0 |
                 sink.list_();
371 |  |
             }
372 | 0 |
         }
373 |  |
374 |  |
         /**
375 |  |
          * Writes the related dependencies to the site report.
376 |  |
          *
377 |  |
          * @param d the dependency
378 |  |
          * @param sink the sink to write the data to
379 |  |
          * @param collapsibleHeaderCount the collapsible header count
380 |  |
          * @return the collapsible header count
381 |  |
          */
382 |  |
         private int writeSiteReportDependencyRelatedDependencies(Dependency d, int collapsibleHeaderCount, Sink sink) {
383 | 0 |
             int cnt = collapsibleHeaderCount;
384 | 0 |
             if (d.getRelatedDependencies() != null && !d.getRelatedDependencies().isEmpty()) {
385 | 0 |
                 cnt += 1;
386 | 0 |
                 sink.sectionTitle4();
387 | 0 |
                 sink.rawText("Related Dependencies <a href=\"javascript:toggleElement(this, 'related" + cnt + "')\">[+]</a>");
388 | 0 |
                 sink.sectionTitle4_();
389 | 0 |
                 sink.rawText("<div id=\"related" + cnt + "\" style=\"display:none\">");
390 | 0 |
                 sink.list();
391 | 0 |
                 for (Dependency r : d.getRelatedDependencies()) {
392 | 0 |
                     sink.listItem();
393 | 0 |
                     sink.text(r.getFileName());
394 | 0 |
                     sink.list();
395 | 0 |
                     writeListItem(sink, "File Path: " + r.getFilePath());
396 | 0 |
                     writeListItem(sink, "SHA1: " + r.getSha1sum());
397 | 0 |
                     writeListItem(sink, "MD5: " + r.getMd5sum());
398 | 0 |
                     sink.list_();
399 | 0 |
                     sink.listItem_();
400 |  |
                 }
401 | 0 |
                 sink.list_();
402 | 0 |
                 sink.rawText("</div>");
403 |  |
             }
404 | 0 |
             return cnt;
405 |  |
         }
406 |  |
407 |  |
         /**
408 |  |
          * Writes the evidence used to the site report.
409 |  |
          *
410 |  |
          * @param d the dependency
411 |  |
          * @param sink the sink to write the data to
412 |  |
          * @param collapsibleHeaderCount the collapsible header count
413 |  |
          * @return the collapsible header count
414 |  |
          */
415 |  |
         private int writeSiteReportDependencyEvidenceUsed(Dependency d, int collapsibleHeaderCount, Sink sink) {
416 | 0 |
             int cnt = collapsibleHeaderCount;
417 | 0 |
             if (d.getEvidenceUsed() != null && d.getEvidenceUsed().size() > 0) {
418 | 0 |
                 cnt += 1;
419 | 0 |
                 sink.sectionTitle4();
420 | 0 |
                 sink.rawText("Evidence Collected <a href=\"javascript:toggleElement(this, 'evidence" + cnt + "')\">[+]</a>");
421 | 0 |
                 sink.sectionTitle4_();
422 | 0 |
                 sink.rawText("<div id=\"evidence" + cnt + "\" style=\"display:none\">");
423 | 0 |
                 sink.table();
424 | 0 |
                 sink.tableRow();
425 | 0 |
                 writeTableHeaderCell(sink, "Source");
426 | 0 |
                 writeTableHeaderCell(sink, "Name");
427 | 0 |
                 writeTableHeaderCell(sink, "Value");
428 | 0 |
                 sink.tableRow_();
429 | 0 |
                 for (Evidence e : d.getEvidenceUsed()) {
430 | 0 |
                     sink.tableRow();
431 | 0 |
                     writeTableCell(sink, e.getSource());
432 | 0 |
                     writeTableCell(sink, e.getName());
433 | 0 |
                     writeTableCell(sink, e.getValue());
434 | 0 |
                     sink.tableRow_();
435 |  |
                 }
436 | 0 |
                 sink.table_();
437 | 0 |
                 sink.rawText("</div>");
438 |  |
             }
439 | 0 |
             return cnt;
440 |  |
         }
441 |  |
442 |  |
         /**
443 |  |
          * Writes the analysis exceptions generated during analysis to the site
444 |  |
          * report.
445 |  |
          *
446 |  |
          * @param d the dependency
447 |  |
          * @param sink the sink to write the data to
448 |  |
          * @param collapsibleHeaderCount the collapsible header count
449 |  |
          * @return the collapsible header count
450 |  |
          */
451 |  |
         private int writeSiteReportDependencyAnalysisExceptions(Dependency d, int collapsibleHeaderCount, Sink sink) {
452 | 0 |
             int cnt = collapsibleHeaderCount;
453 | 0 |
             if (d.getAnalysisExceptions() != null && !d.getAnalysisExceptions().isEmpty()) {
454 | 0 |
                 cnt += 1;
455 | 0 |
                 sink.sectionTitle4();
456 | 0 |
                 sink.rawText("<font style=\"color:red\">Errors occurred during analysis:</font> <a href=\"javascript:toggleElement(this, 'errors"
457 |  |
                         + cnt + "')\">[+]</a>");
458 | 0 |
                 sink.sectionTitle4_();
459 | 0 |
                 sink.rawText("<div id=\"errors" + cnt + "\">");
460 | 0 |
                 sink.list();
461 | 0 |
                 for (Exception e : d.getAnalysisExceptions()) {
462 | 0 |
                     sink.listItem();
463 | 0 |
                     sink.text(e.getMessage());
464 | 0 |
                     sink.listItem_();
465 |  |
                 }
466 | 0 |
                 sink.list_();
467 | 0 |
                 sink.rawText("</div>");
468 |  |
             }
469 | 0 |
             return cnt;
470 |  |
         }
471 |  |
472 |  |
         /**
473 |  |
          * Writes the dependency header to the site report.
474 |  |
          *
475 |  |
          * @param d the dependency
476 |  |
          * @param sink the sink to write the data to
477 |  |
          */
478 |  |
         private void writeSiteReportDependencyHeader(Sink sink, Dependency d) {
479 | 0 |
             sink.sectionTitle2();
480 | 0 |
             sink.anchor("sha1" + d.getSha1sum());
481 | 0 |
             sink.text(d.getFileName());
482 | 0 |
             sink.anchor_();
483 | 0 |
             sink.sectionTitle2_();
484 | 0 |
             if (d.getDescription() != null && d.getDescription().length() > 0) {
485 | 0 |
                 sink.paragraph();
486 | 0 |
                 sink.bold();
487 | 0 |
                 sink.text("Description: ");
488 | 0 |
                 sink.bold_();
489 | 0 |
                 sink.text(d.getDescription());
490 | 0 |
                 sink.paragraph_();
491 |  |
             }
492 | 0 |
             if (d.getLicense() != null && d.getLicense().length() > 0) {
493 | 0 |
                 sink.paragraph();
494 | 0 |
                 sink.bold();
495 | 0 |
                 sink.text("License: ");
496 | 0 |
                 sink.bold_();
497 | 0 |
                 if (d.getLicense().startsWith("http://") && !d.getLicense().contains(" ")) {
498 | 0 |
                     sink.link(d.getLicense());
499 | 0 |
                     sink.text(d.getLicense());
500 | 0 |
                     sink.link_();
501 |  |
                 } else {
502 | 0 |
                     sink.text(d.getLicense());
503 |  |
                 }
504 | 0 |
                 sink.paragraph_();
505 |  |
             }
506 | 0 |
         }
507 |  |
508 |  |
         /**
509 |  |
          * Adds a list item to the site report.
510 |  |
          *
511 |  |
          * @param sink the sink to write the data to
512 |  |
          * @param text the text to write
513 |  |
          */
514 |  |
         private void writeListItem(Sink sink, String text) {
515 | 0 |
             sink.listItem();
516 | 0 |
             sink.text(text);
517 | 0 |
             sink.listItem_();
518 | 0 |
         }
519 |  |
520 |  |
         /**
521 |  |
          * Adds a table cell to the site report.
522 |  |
          *
523 |  |
          * @param sink the sink to write the data to
524 |  |
          * @param text the text to write
525 |  |
          */
526 |  |
         private void writeTableCell(Sink sink, String text) {
527 | 0 |
             sink.tableCell();
528 | 0 |
             sink.text(text);
529 | 0 |
             sink.tableCell_();
530 | 0 |
         }
531 |  |
532 |  |
         /**
533 |  |
          * Adds a table header cell to the site report.
534 |  |
          *
535 |  |
          * @param sink the sink to write the data to
536 |  |
          * @param text the text to write
537 |  |
          */
538 |  |
         private void writeTableHeaderCell(Sink sink, String text) {
539 | 0 |
             sink.tableHeaderCell();
540 | 0 |
             sink.text(text);
541 | 0 |
             sink.tableHeaderCell_();
542 | 0 |
         }
543 |  |
544 |  |
         /**
545 |  |
          * Writes the TOC for the site report.
546 |  |
          *
547 |  |
          * @param sink the sink to write the data to
548 |  |
          * @param dependencies the dependencies that are being reported on
549 |  |
          */
550 |  |
         private void writeSiteReportTOC(Sink sink, final List<Dependency> dependencies) {
551 | 0 |
             sink.list();
552 | 0 |
             for (Dependency d : dependencies) {
553 | 0 |
                 sink.listItem();
554 | 0 |
                 sink.link("#sha1" + d.getSha1sum());
555 | 0 |
                 sink.text(d.getFileName());
556 | 0 |
                 sink.link_();
557 | 0 |
                 if (!d.getVulnerabilities().isEmpty()) {
558 | 0 |
                     sink.rawText(" <font style=\"color:red\">•</font>");
559 |  |
                 }
560 | 0 |
                 if (!d.getRelatedDependencies().isEmpty()) {
561 | 0 |
                     sink.list();
562 | 0 |
                     for (Dependency r : d.getRelatedDependencies()) {
563 | 0 |
                         writeListItem(sink, r.getFileName());
564 |  |
                     }
565 | 0 |
                     sink.list_();
566 |  |
                 }
567 | 0 |
                 sink.listItem_();
568 |  |
             }
569 | 0 |
             sink.list_();
570 | 0 |
         }
571 |  |
572 |  |
         /**
573 |  |
          * Writes the site report header.
574 |  |
          *
575 |  |
          * @param sink the sink to write the data to
576 |  |
          * @param projectName the name of the project
577 |  |
          */
578 |  |
         private void writeSiteReportHeader(Sink sink, String projectName) {
579 | 0 |
             sink.head();
580 | 0 |
             sink.title();
581 | 0 |
             sink.text("Dependency-Check Report: " + projectName);
582 | 0 |
             sink.title_();
583 | 0 |
             sink.head_();
584 | 0 |
             sink.body();
585 | 0 |
             sink.rawText("<script type=\"text/javascript\">");
586 | 0 |
             sink.rawText("function toggleElement(el, targetId) {");
587 | 0 |
             sink.rawText("if (el.innerText == '[+]') {");
588 | 0 |
             sink.rawText("    el.innerText = '[-]';");
589 | 0 |
             sink.rawText("    document.getElementById(targetId).style.display='block';");
590 | 0 |
             sink.rawText("} else {");
591 | 0 |
             sink.rawText("    el.innerText = '[+]';");
592 | 0 |
             sink.rawText("    document.getElementById(targetId).style.display='none';");
593 | 0 |
             sink.rawText("}");
594 |  |
595 | 0 |
             sink.rawText("}");
596 | 0 |
             sink.rawText("</script>");
597 | 0 |
             sink.section1();
598 | 0 |
             sink.sectionTitle1();
599 | 0 |
             sink.text("Project: " + projectName);
600 | 0 |
             sink.sectionTitle1_();
601 | 0 |
             sink.date();
602 | 0 |
             final Date now = new Date();
603 | 0 |
             sink.text(DateFormat.getDateTimeInstance().format(now));
604 | 0 |
             sink.date_();
605 | 0 |
             sink.section1_();
606 | 0 |
         }
607 |  |
         // </editor-fold>
608 |  |
609 |  |
         /**
610 |  |
          * Takes the properties supplied and updates the dependency-check settings.
611 |  |
          * Additionally, this sets the system properties required to change the
612 |  |
          * proxy url, port, and connection timeout.
613 |  |
          */
614 |  |
         private void populateSettings() {
615 | 0 |
             InputStream mojoProperties = null;
616 |  |
             try {
617 | 0 |
                 mojoProperties = this.getClass().getClassLoader().getResourceAsStream(PROPERTIES_FILE);
618 | 0 |
                 Settings.mergeProperties(mojoProperties);
619 | 0 |
             } catch (IOException ex) {
620 | 0 |
                 Logger.getLogger(DependencyCheckMojo.class.getName()).log(Level.WARNING, "Unable to load the dependency-check ant task.properties file.");
621 | 0 |
                 Logger.getLogger(DependencyCheckMojo.class.getName()).log(Level.FINE, null, ex);
622 |  |
             } finally {
623 | 0 |
                 if (mojoProperties != null) {
624 |  |
                     try {
625 | 0 |
                         mojoProperties.close();
626 | 0 |
                     } catch (IOException ex) {
627 | 0 |
                         Logger.getLogger(DependencyCheckMojo.class.getName()).log(Level.FINEST, null, ex);
628 | 0 |
                     }
629 |  |
                 }
630 |  |
             }
631 |  |
632 | 0 |
             Settings.setBoolean(Settings.KEYS.AUTO_UPDATE, autoUpdate);
633 |  |
634 | 0 |
             if (proxyUrl != null && !proxyUrl.isEmpty()) {
635 | 0 |
                 Settings.setString(Settings.KEYS.PROXY_URL, proxyUrl);
636 |  |
             }
637 | 0 |
             if (proxyPort != null && !proxyPort.isEmpty()) {
638 | 0 |
                 Settings.setString(Settings.KEYS.PROXY_PORT, proxyPort);
639 |  |
             }
640 | 0 |
             if (proxyUsername != null && !proxyUsername.isEmpty()) {
641 | 0 |
                 Settings.setString(Settings.KEYS.PROXY_USERNAME, proxyUsername);
642 |  |
             }
643 | 0 |
             if (proxyPassword != null && !proxyPassword.isEmpty()) {
644 | 0 |
                 Settings.setString(Settings.KEYS.PROXY_PASSWORD, proxyPassword);
645 |  |
             }
646 | 0 |
             if (connectionTimeout != null && !connectionTimeout.isEmpty()) {
647 | 0 |
                 Settings.setString(Settings.KEYS.CONNECTION_TIMEOUT, connectionTimeout);
648 |  |
             }
649 | 0 |
         }
650 |  |
651 |  |
         /**
652 |  |
          * Executes the dependency-check and generates the report.
653 |  |
          *
654 |  |
          * @throws MojoExecutionException if a maven exception occurs
655 |  |
          * @throws MojoFailureException thrown if a CVSS score is found that is
656 |  |
          * higher then the configured level
657 |  |
          */
658 |  |
         public void execute() throws MojoExecutionException, MojoFailureException {
659 | 0 |
             final Engine engine = executeDependencyCheck();
660 | 0 |
             generateExternalReports(engine);
661 | 0 |
             if (this.failBuildOnCVSS <= 10) {
662 | 0 |
                 checkForFailure(engine.getDependencies());
663 |  |
             }
664 | 0 |
         }
665 |  |
666 |  |
         /**
667 |  |
          * Generates the Dependency-Check Site Report.
668 |  |
          *
669 |  |
          * @param sink the sink to write the report to
670 |  |
          * @param locale the locale to use when generating the report
671 |  |
          * @throws MavenReportException if a Maven report exception occurs
672 |  |
          */
673 |  |
         public void generate(@SuppressWarnings("deprecation") org.codehaus.doxia.sink.Sink sink,
674 |  |
                 Locale locale) throws MavenReportException {
675 | 0 |
             generate((Sink) sink, null, locale);
676 | 0 |
         }
677 |  |
678 |  |
         /**
679 |  |
          * Generates the Dependency-Check Site Report.
680 |  |
          *
681 |  |
          * @param sink the sink to write the report to
682 |  |
          * @param sinkFactory the sink factory
683 |  |
          * @param locale the locale to use when generating the report
684 |  |
          * @throws MavenReportException if a maven report exception occurs
685 |  |
          */
686 |  |
         public void generate(Sink sink, SinkFactory sinkFactory, Locale locale) throws MavenReportException {
687 | 0 |
             final Engine engine = executeDependencyCheck();
688 | 0 |
             generateMavenSiteReport(engine, sink);
689 | 0 |
         }
690 |  |
691 |  |
         // <editor-fold defaultstate="collapsed" desc="required setter/getter methods">
692 |  |
         /**
693 |  |
          * Returns the output name.
694 |  |
          *
695 |  |
          * @return the output name
696 |  |
          */
697 |  |
         public String getOutputName() {
698 | 0 |
             return reportName;
699 |  |
         }
700 |  |
701 |  |
         /**
702 |  |
          * Returns the category name.
703 |  |
          *
704 |  |
          * @return the category name
705 |  |
          */
706 |  |
         public String getCategoryName() {
707 | 0 |
             return MavenReport.CATEGORY_PROJECT_REPORTS;
708 |  |
         }
709 |  |
710 |  |
         /**
711 |  |
          * Returns the report name.
712 |  |
          *
713 |  |
          * @param locale the location
714 |  |
          * @return the report name
715 |  |
          */
716 |  |
         public String getName(Locale locale) {
717 | 0 |
             return name;
718 |  |
         }
719 |  |
720 |  |
         /**
721 |  |
          * Sets the Reporting output directory.
722 |  |
          *
723 |  |
          * @param directory the output directory
724 |  |
          */
725 |  |
         public void setReportOutputDirectory(File directory) {
726 | 0 |
             reportOutputDirectory = directory;
727 | 0 |
         }
728 |  |
729 |  |
         /**
730 |  |
          * Returns the output directory.
731 |  |
          *
732 |  |
          * @return the output directory
733 |  |
          */
734 |  |
         public File getReportOutputDirectory() {
735 | 0 |
             return reportOutputDirectory;
736 |  |
         }
737 |  |
738 |  |
         /**
739 |  |
          * Gets the description of the Dependency-Check report to be displayed in
740 |  |
          * the Maven Generated Reports page.
741 |  |
          *
742 |  |
          * @param locale The Locale to get the description for
743 |  |
          * @return the description
744 |  |
          */
745 |  |
         public String getDescription(Locale locale) {
746 | 0 |
             return description;
747 |  |
         }
748 |  |
749 |  |
         /**
750 |  |
          * Returns whether this is an external report.
751 |  |
          *
752 |  |
          * @return true or false;
753 |  |
          */
754 |  |
         public boolean isExternalReport() {
755 | 0 |
             return externalReport;
756 |  |
         }
757 |  |
758 |  |
         /**
759 |  |
          * Returns whether or not the plugin can generate a report.
760 |  |
          *
761 |  |
          * @return true
762 |  |
          */
763 |  |
         public boolean canGenerateReport() {
764 | 0 |
             return true;
765 |  |
         }
766 |  |
         // </editor-fold>
767 |  |
768 |  |
         /**
769 |  |
          * Checks to see if a vulnerability has been identified with a CVSS score
770 |  |
          * that is above the threshold set in the configuration.
771 |  |
          *
772 |  |
          * @param dependencies the list of dependency objects
773 |  |
          * @throws MojoFailureException thrown if a CVSS score is found that is
774 |  |
          * higher then the threshold set
775 |  |
          */
776 |  |
         private void checkForFailure(List<Dependency> dependencies) throws MojoFailureException {
777 | 0 |
             final StringBuilder ids = new StringBuilder();
778 | 0 |
             for (Dependency d : dependencies) {
779 | 0 |
                 for (Vulnerability v : d.getVulnerabilities()) {
780 | 0 |
                     if (v.getCvssScore() >= failBuildOnCVSS) {
781 | 0 |
                         if (ids.length() == 0) {
782 | 0 |
                             ids.append(v.getName());
783 |  |
                         } else {
784 | 0 |
                             ids.append(", ").append(v.getName());
785 |  |
                         }
786 |  |
                     }
787 |  |
                 }
788 |  |
             }
789 | 0 |
             if (ids.length() > 0) {
790 | 0 |
                 final String msg = String.format("%n%nDependency-Check Failure:%n"
791 |  |
                         + "One or more dependencies were identified with vulnerabilities that have a CVSS score greater then '%.1f': %s%n"
792 |  |
                         + "See the dependency-check report for more details.%n%n", failBuildOnCVSS, ids.toString());
793 | 0 |
                 throw new MojoFailureException(msg);
794 |  |
             }
795 | 0 |
         }
796 |  |
     }