mirror of
https://github.com/ysoftdevs/DependencyCheck.git
synced 2026-03-20 16:24:11 +01:00
@@ -1054,7 +1054,7 @@ public class Check extends Update {
|
|||||||
*
|
*
|
||||||
* @param dependencies the list of dependency objects
|
* @param dependencies the list of dependency objects
|
||||||
* @throws BuildException thrown if a CVSS score is found that is higher
|
* @throws BuildException thrown if a CVSS score is found that is higher
|
||||||
* then the threshold set
|
* than the threshold set
|
||||||
*/
|
*/
|
||||||
private void checkForFailure(List<Dependency> dependencies) throws BuildException {
|
private void checkForFailure(List<Dependency> dependencies) throws BuildException {
|
||||||
final StringBuilder ids = new StringBuilder();
|
final StringBuilder ids = new StringBuilder();
|
||||||
@@ -1071,7 +1071,7 @@ public class Check extends Update {
|
|||||||
}
|
}
|
||||||
if (ids.length() > 0) {
|
if (ids.length() > 0) {
|
||||||
final String msg = String.format("%n%nDependency-Check Failure:%n"
|
final String msg = String.format("%n%nDependency-Check Failure:%n"
|
||||||
+ "One or more dependencies were identified with vulnerabilities that have a CVSS score greater then '%.1f': %s%n"
|
+ "One or more dependencies were identified with vulnerabilities that have a CVSS score greater than '%.1f': %s%n"
|
||||||
+ "See the dependency-check report for more details.%n%n", failBuildOnCVSS, ids.toString());
|
+ "See the dependency-check report for more details.%n%n", failBuildOnCVSS, ids.toString());
|
||||||
throw new BuildException(msg);
|
throw new BuildException(msg);
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -3,7 +3,7 @@ Configuration
|
|||||||
The dependency-check-update task downloads and updates the local copy of the NVD.
|
The dependency-check-update task downloads and updates the local copy of the NVD.
|
||||||
There are several reasons that one may want to use this task; primarily, creating
|
There are several reasons that one may want to use this task; primarily, creating
|
||||||
an update that will be run only once a day or once every few days (but not greater
|
an update that will be run only once a day or once every few days (but not greater
|
||||||
then 7 days) and then use the `autoUpdate="false"` setting on individual
|
than 7 days) and then use the `autoUpdate="false"` setting on individual
|
||||||
dependency-check scans. See [Internet Access Required](https://jeremylong.github.io/DependencyCheck/data/index.html)
|
dependency-check scans. See [Internet Access Required](https://jeremylong.github.io/DependencyCheck/data/index.html)
|
||||||
for more information on why this task would be used.
|
for more information on why this task would be used.
|
||||||
|
|
||||||
|
|||||||
@@ -998,7 +998,7 @@ public class DependencyCheckScanAgent {
|
|||||||
}
|
}
|
||||||
if (ids.length() > 0) {
|
if (ids.length() > 0) {
|
||||||
final String msg = String.format("%n%nDependency-Check Failure:%n"
|
final String msg = String.format("%n%nDependency-Check Failure:%n"
|
||||||
+ "One or more dependencies were identified with vulnerabilities that have a CVSS score greater then '%.1f': %s%n"
|
+ "One or more dependencies were identified with vulnerabilities that have a CVSS score greater than '%.1f': %s%n"
|
||||||
+ "See the dependency-check report for more details.%n%n", failBuildOnCVSS, ids.toString());
|
+ "See the dependency-check report for more details.%n%n", failBuildOnCVSS, ids.toString());
|
||||||
|
|
||||||
throw new ScanAgentException(msg);
|
throw new ScanAgentException(msg);
|
||||||
|
|||||||
@@ -37,7 +37,7 @@ import org.slf4j.LoggerFactory;
|
|||||||
|
|
||||||
/**
|
/**
|
||||||
* Checks the gh-pages dependency-check site to determine the current released
|
* Checks the gh-pages dependency-check site to determine the current released
|
||||||
* version number. If the released version number is greater then the running
|
* version number. If the released version number is greater than the running
|
||||||
* version number a warning is printed recommending that an upgrade be
|
* version number a warning is printed recommending that an upgrade be
|
||||||
* performed.
|
* performed.
|
||||||
*
|
*
|
||||||
|
|||||||
@@ -280,9 +280,9 @@ public class Evidence implements Serializable, Comparable<Evidence> {
|
|||||||
if (me == null && other == null) {
|
if (me == null && other == null) {
|
||||||
return 0;
|
return 0;
|
||||||
} else if (me == null) {
|
} else if (me == null) {
|
||||||
return -1; //the other string is greater then me
|
return -1; //the other string is greater than me
|
||||||
} else if (other == null) {
|
} else if (other == null) {
|
||||||
return 1; //me is greater then the other string
|
return 1; //me is greater than the other string
|
||||||
}
|
}
|
||||||
return me.compareToIgnoreCase(other);
|
return me.compareToIgnoreCase(other);
|
||||||
}
|
}
|
||||||
|
|||||||
@@ -679,7 +679,7 @@ public abstract class BaseDependencyCheckMojo extends AbstractMojo implements Ma
|
|||||||
}
|
}
|
||||||
}
|
}
|
||||||
} else if (getLog().isDebugEnabled()) {
|
} else if (getLog().isDebugEnabled()) {
|
||||||
final String msg = String.format("More then 1 dependency was identified in first pass scan of '%s' in project %s",
|
final String msg = String.format("More than 1 dependency was identified in first pass scan of '%s' in project %s",
|
||||||
dependencyNode.getArtifact().getId(), project.getName());
|
dependencyNode.getArtifact().getId(), project.getName());
|
||||||
getLog().debug(msg);
|
getLog().debug(msg);
|
||||||
}
|
}
|
||||||
@@ -1087,7 +1087,7 @@ public abstract class BaseDependencyCheckMojo extends AbstractMojo implements Ma
|
|||||||
msg = String.format("%n%nOne or more dependencies were identified with vulnerabilities: %n%s%n%n"
|
msg = String.format("%n%nOne or more dependencies were identified with vulnerabilities: %n%s%n%n"
|
||||||
+ "See the dependency-check report for more details.%n%n", ids.toString());
|
+ "See the dependency-check report for more details.%n%n", ids.toString());
|
||||||
} else {
|
} else {
|
||||||
msg = String.format("%n%nOne or more dependencies were identified with vulnerabilities that have a CVSS score greater then '%.1f': %n%s%n%n"
|
msg = String.format("%n%nOne or more dependencies were identified with vulnerabilities that have a CVSS score greater than '%.1f': %n%s%n%n"
|
||||||
+ "See the dependency-check report for more details.%n%n", failBuildOnCVSS, ids.toString());
|
+ "See the dependency-check report for more details.%n%n", failBuildOnCVSS, ids.toString());
|
||||||
}
|
}
|
||||||
|
|
||||||
|
|||||||
@@ -73,7 +73,7 @@ Create an aggregated dependency-check report within the site.
|
|||||||
```
|
```
|
||||||
|
|
||||||
$H$H$H Example 3:
|
$H$H$H Example 3:
|
||||||
Create the DependencyCheck-report.html and fail the build for CVSS greater then 8.
|
Create the DependencyCheck-report.html and fail the build for CVSS greater than 8.
|
||||||
|
|
||||||
```xml
|
```xml
|
||||||
<project>
|
<project>
|
||||||
|
|||||||
Reference in New Issue
Block a user