diff --git a/dependency-check-maven/src/it/815-broken-suppression-aggregate/broken-suppression.xml b/dependency-check-maven/src/it/815-broken-suppression-aggregate/broken-suppression.xml new file mode 100644 index 000000000..598a56cae --- /dev/null +++ b/dependency-check-maven/src/it/815-broken-suppression-aggregate/broken-suppression.xml @@ -0,0 +1,27 @@ + + + + + + ^com\.vaadin\.external\.google:android-json:.*$ + cpe:/a:google:android + + diff --git a/dependency-check-maven/src/it/815-broken-suppression-aggregate/invoker.properties b/dependency-check-maven/src/it/815-broken-suppression-aggregate/invoker.properties new file mode 100644 index 000000000..8d65ccd95 --- /dev/null +++ b/dependency-check-maven/src/it/815-broken-suppression-aggregate/invoker.properties @@ -0,0 +1,19 @@ +# +# This file is part of dependency-check-core. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +# Copyright (c) 2017 The OWASP Foundation. All Rights Reserved. +# +invoker.buildResult = failure +invoker.goals = install ${project.groupId}:${project.artifactId}:${project.version}:aggregate diff --git a/dependency-check-maven/src/it/815-broken-suppression-aggregate/pom.xml b/dependency-check-maven/src/it/815-broken-suppression-aggregate/pom.xml new file mode 100644 index 000000000..e37076fd1 --- /dev/null +++ b/dependency-check-maven/src/it/815-broken-suppression-aggregate/pom.xml @@ -0,0 +1,53 @@ + + + + 4.0.0 + org.owasp.test + test-broken-suppression-files + 1.0.0-SNAPSHOT + jar + + + + + com.vaadin.external.google + android-json + 0.0.20131108.vaadin1 + + + com.fasterxml.jackson.dataformat + jackson-dataformat-xml + 2.4.5 + + + + + + + org.owasp + dependency-check-maven + + + ${project.basedir}/broken-suppression.xml + + + + + + diff --git a/dependency-check-maven/src/main/java/org/owasp/dependencycheck/maven/AggregateMojo.java b/dependency-check-maven/src/main/java/org/owasp/dependencycheck/maven/AggregateMojo.java index baac31aed..b64e0b489 100644 --- a/dependency-check-maven/src/main/java/org/owasp/dependencycheck/maven/AggregateMojo.java +++ b/dependency-check-maven/src/main/java/org/owasp/dependencycheck/maven/AggregateMojo.java @@ -147,6 +147,9 @@ public class AggregateMojo extends BaseDependencyCheckMojo { } showSummary(this.getProject(), engine.getDependencies()); checkForFailure(engine.getDependencies()); + if (exCol != null && this.isFailOnError()) { + throw new MojoExecutionException("One or more exceptions occurred during dependency-check analysis", exCol); + } engine.cleanup(); Settings.cleanup(); }