null.
+ *
+ * @param project the parent project to collect the child project references
+ * @param childMap a map of the parent-child relationships
+ * @return a list of child projects
+ */
+ protected Listtrue if it has a pom packaging; otherwise false
+ */
+ protected boolean isMultiModule(MavenProject mavenProject) {
+ return "pom".equals(mavenProject.getPackaging());
+ }
+
+ /**
+ * Builds the parent-child map.
+ *
+ * @return a map of the parent/child relationships
+ */
+ private Maptrue
+ */
+ @Override
+ public final boolean isExternalReport() {
+ return true;
+ }
+
+ /**
+ * Returns the output name.
+ *
+ * @return the output name
+ */
+ public String getOutputName() {
+ if ("HTML".equalsIgnoreCase(this.format) || "ALL".equalsIgnoreCase(this.format)) {
+ return "dependency-check-report";
+ } else if ("XML".equalsIgnoreCase(this.format)) {
+ return "dependency-check-report.xml#";
+ } else if ("VULN".equalsIgnoreCase(this.format)) {
+ return "dependency-check-vulnerability";
+ } else {
+ LOGGER.log(Level.WARNING, "Unknown report format used during site generation.");
+ return "dependency-check-report";
+ }
+ }
+
+ /**
+ * Returns the category name.
+ *
+ * @return the category name
+ */
+ public String getCategoryName() {
+ return MavenReport.CATEGORY_PROJECT_REPORTS;
+ }
+ //Engine that can be used for scanning.
*
- * @param project the current MavenProject
* @return a newly instantiated Engine
* @throws DatabaseException thrown if there is a database exception
*/
- private Engine initializeEngine(MavenProject project) throws DatabaseException {
+ protected Engine initializeEngine() throws DatabaseException {
+ final InputStream in = BaseDependencyCheckMojo.class.getClassLoader().getResourceAsStream(LOG_PROPERTIES_FILE);
+ LogUtils.prepareLogger(in, logFile);
populateSettings();
- final Engine localEngine = new Engine(project);
- return localEngine;
+ return new Engine(this.project, this.reactorProjects);
}
- /**
- * Tests is the artifact should be included in the scan (i.e. is the dependency in a scope that is being scanned).
- *
- * @param a the Artifact to test
- * @return true if the artifact is in an excluded scope; otherwise false
- */
- private boolean excludeFromScan(Artifact a) {
- if (skipTestScope && Artifact.SCOPE_TEST.equals(a.getScope())) {
- return true;
- }
- if (skipProvidedScope && Artifact.SCOPE_PROVIDED.equals(a.getScope())) {
- return true;
- }
- if (skipRuntimeScope && !Artifact.SCOPE_RUNTIME.equals(a.getScope())) {
- return true;
- }
- return false;
- }
-
- //true if the artifact is in an excluded scope; otherwise false
*/
- @Override
- protected void performExecute() throws MojoExecutionException, MojoFailureException {
- try {
- engine = executeDependencyCheck();
- ReportingUtil.generateExternalReports(engine, outputDirectory, getProject().getName(), format);
- if (this.showSummary) {
- showSummary(engine.getDependencies());
- }
- if (this.failBuildOnCVSS <= 10) {
- checkForFailure(engine.getDependencies());
- }
- } catch (DatabaseException ex) {
- LOGGER.log(Level.SEVERE, "Unable to connect to the dependency-check database; analysis has stopped");
- LOGGER.log(Level.FINE, "", ex);
- }
- }
-
- @Override
- protected void postExecute() throws MojoExecutionException, MojoFailureException {
- try {
- super.postExecute();
- } finally {
- cleanupEngine();
- }
- }
-
- @Override
- protected void postGenerate() throws MavenReportException {
- try {
- super.postGenerate();
- } finally {
- cleanupEngine();
- }
- }
-
- /**
- * Calls engine.cleanup() to release resources.
- */
- private void cleanupEngine() {
- if (engine != null) {
- engine.cleanup();
- engine = null;
- }
- Settings.cleanup(true);
- }
-
- /**
- * Generates the Dependency-Check Site Report.
- *
- * @param locale the locale to use when generating the report
- * @throws MavenReportException if a maven report exception occurs
- */
- @Override
- protected void executeNonAggregateReport(Locale locale) throws MavenReportException {
- final Listtrue if a report can be generated; otherwise false
- */
- public boolean canGenerateReport() {
- if (canGenerateAggregateReport() || (isAggregate() && isMultiModule())) {
+ protected boolean excludeFromScan(Artifact a) {
+ if (skipTestScope && Artifact.SCOPE_TEST.equals(a.getScope())) {
return true;
}
- if (canGenerateNonAggregateReport()) {
+ if (skipProvidedScope && Artifact.SCOPE_PROVIDED.equals(a.getScope())) {
+ return true;
+ }
+ if (skipRuntimeScope && !Artifact.SCOPE_RUNTIME.equals(a.getScope())) {
return true;
- } else {
- final String msg;
- if (getProject().getArtifacts().size() > 0) {
- msg = "No project dependencies exist in the included scope - dependency-check:check is unable to generate a report.";
- } else {
- msg = "No project dependencies exist - dependency-check:check is unable to generate a report.";
- }
- LOGGER.warning(msg);
}
-
return false;
}
/**
- * Returns whether or not a non-aggregate report can be generated.
+ * Returns a reference to the current project. This method is used instead of auto-binding the project via component
+ * annotation in concrete implementations of this. If the child has a @Component MavenProject project;
+ * defined then the abstract class (i.e. this class) will not have access to the current project (just the way Maven
+ * works with the binding).
*
- * @return true if a non-aggregate report can be generated; otherwise false
+ * @return returns a reference to the current project
*/
- @Override
- protected boolean canGenerateNonAggregateReport() {
- boolean ability = false;
- for (Artifact a : getProject().getArtifacts()) {
- if (!excludeFromScan(a)) {
- ability = true;
- break;
- }
- }
- return ability;
+ protected MavenProject getProject() {
+ return project;
}
/**
- * Returns whether or not an aggregate report can be generated.
+ * Returns the list of Maven Projects in this build.
*
- * @return true if an aggregate report can be generated; otherwise false
+ * @return the list of Maven Projects in this build
*/
- @Override
- protected boolean canGenerateAggregateReport() {
- return isAggregate() && isLastProject();
+ protected ListwriteDataFile(). This key
+ * is used in the MavenProject.(set|get)ContextValue.
+ *
+ * @return the key used to store the path to the data file
+ */
+ protected String getDataFileContextKey() {
+ return "dependency-check-path-" + dataFileName;
+ }
+
+ /**
+ * Returns the key used to store the path to the output directory. When generating the report in the
+ * executeAggregateReport() the output directory should be obtained by using this key.
+ *
+ * @return the key used to store the path to the output directory
+ */
+ protected String getOutputDirectoryContextKey() {
+ return "dependency-output-dir-" + dataFileName;
+ }
+
/**
* Writes the scan data to disk. This is used to serialize the scan data between the "check" and "aggregate" phase.
*
- * @return the File object referencing the data file that was written
+ * @param dependencies the list of dependencies to serialize
*/
- @Override
- protected File writeDataFile() {
+ protected void writeDataFile(ListEngine object populated with dependencies if the serialized data file exists; otherwise
- * null is returned
- */
- protected Listtrue if the report can be generated; otherwise false
+ */
+ @Override
+ public boolean canGenerateReport() {
+ boolean isCapable = false;
+ for (Artifact a : getProject().getArtifacts()) {
+ if (!excludeFromScan(a)) {
+ isCapable = true;
+ break;
+ }
+ }
+ return isCapable;
+ }
+
+ /**
+ * Executes the dependency-check engine on the project's dependencies and generates the report.
+ *
+ * @throws MojoExecutionException thrown if there is an exception executing the goal
+ * @throws MojoFailureException thrown if dependency-check is configured to fail the build
+ */
+ @Override
+ public void runCheck() throws MojoExecutionException, MojoFailureException {
+ final Engine engine;
+ try {
+ engine = initializeEngine();
+ } catch (DatabaseException ex) {
+ LOGGER.log(Level.FINE, "Database connection error", ex);
+ throw new MojoExecutionException("An exception occured connecting to the local database. Please see the log file for more details.", ex);
+ }
+ scanArtifacts(getProject(), engine);
+ if (engine.getDependencies().isEmpty()) {
+ LOGGER.info("No dependencies were identified that could be analyzed by dependency-check");
+ } else {
+ engine.analyzeDependencies();
+ writeReports(engine, getProject(), getCorrectOutputDirectory());
+ writeDataFile(engine.getDependencies());
+ showSummary(engine.getDependencies());
+ checkForFailure(engine.getDependencies());
+ }
+ engine.cleanup();
+ Settings.cleanup();
+ }
+
+ /**
+ * Returns the report name.
+ *
+ * @param locale the location
+ * @return the report name
+ */
+ public String getName(Locale locale) {
+ return "dependency-check";
+ }
+
+ /**
+ * Gets the description of the Dependency-Check report to be displayed in the Maven Generated Reports page.
+ *
+ * @param locale The Locale to get the description for
+ * @return the description
+ */
+ public String getDescription(Locale locale) {
+ return "Generates a report providing details on any published vulnerabilities within project dependencies. "
+ + "This report is a best effort and may contain false positives and false negatives.";
+ }
+
+}
diff --git a/dependency-check-maven/src/main/java/org/owasp/dependencycheck/maven/Engine.java b/dependency-check-maven/src/main/java/org/owasp/dependencycheck/maven/Engine.java
index efd6be00c..499e9ab05 100644
--- a/dependency-check-maven/src/main/java/org/owasp/dependencycheck/maven/Engine.java
+++ b/dependency-check-maven/src/main/java/org/owasp/dependencycheck/maven/Engine.java
@@ -17,10 +17,12 @@
*/
package org.owasp.dependencycheck.maven;
+import java.util.List;
import java.util.logging.Logger;
import org.apache.maven.project.MavenProject;
import org.owasp.dependencycheck.analyzer.Analyzer;
import org.owasp.dependencycheck.analyzer.CPEAnalyzer;
+import org.owasp.dependencycheck.analyzer.FileTypeAnalyzer;
import org.owasp.dependencycheck.data.nvdcve.DatabaseException;
import org.owasp.dependencycheck.utils.Settings;
@@ -44,22 +46,37 @@ public class Engine extends org.owasp.dependencycheck.Engine {
* The current MavenProject.
*/
private MavenProject currentProject;
+ /**
+ * The list of MavenProjects that are part of the current build.
+ */
+ private List- * This is an abstract reporting mojo that enables report aggregation. Some of the code in the this class was copied - * from the CoberturaReportMojo (http://mojo.codehaus.org/cobertura-maven-plugin/, version 2.6). The authors of the - * CoberturaReportMojo were Will Gwaltney and - * Joakim Erdfelt. There working example of how to do report aggregation was - * invaluable.
- *
- * An important point about using this abstract class is that it is intended for one to write some form of serialized
- * data (via the {@link org.owasp.dependencycheck.maven.ReportAggregationMojo#writeDataFile() }; note that the
- * writeDataFile() function is called automatically after either {@link org.owasp.dependencycheck.maven.ReportAggregationMojo#executeNonAggregateReport(org.apache.maven.doxia.sink.Sink,
- * org.apache.maven.doxia.sink.SinkFactory, java.util.Locale)
- * } or {@link org.owasp.dependencycheck.maven.ReportAggregationMojo#executeAggregateReport(org.apache.maven.doxia.sink.Sink,
- * org.apache.maven.doxia.sink.SinkFactory, java.util.Locale)
- * } are called. When executeAggregateReport() is implemented, one can call {@link org.owasp.dependencycheck.maven.ReportAggregationMojo#getChildDataFiles()
- * } to obtain a list of the data files to aggregate.
true
- */
- @Override
- public final boolean isExternalReport() {
- return true;
- }
-
- /**
- * Initializes the mojo.
- */
- protected abstract void initialize();
-
- /**
- * The collection of child projects.
- */
- private final MapwriteDataFile(). As such, it is
- * important that if this method is overriden that super.postExecute() is called.
- *
- * @throws MojoExecutionException thrown if there is an issue executing the mojo
- * @throws MojoFailureException thrown if there is an issue executing the mojo
- */
- protected void postExecute() throws MojoExecutionException, MojoFailureException {
- final File written = writeDataFile();
- if (written != null) {
- project.setContextValue(getDataFileContextKey(), written.getAbsolutePath());
- }
- }
-
- /**
- * Returns the key used to store the path to the data file that is saved by writeDataFile(). This key
- * is used in the MavenProject.(set|get)ContextValue.
- *
- * @return the key used to store the path to the data file
- */
- protected String getDataFileContextKey() {
- return "dependency-check-path-" + this.getDataFileName();
- }
-
- /**
- * Returns the key used to store the path to the output directory. When generating the report in the
- * executeAggregateReport() the output directory should be obtained by using this key.
- *
- * @return the key used to store the path to the output directory
- */
- protected String getOutputDirectoryContextKey() {
- return "dependency-output-dir-" + this.getDataFileName();
- }
-
- /**
- * Is called by Maven to execute the mojo.
- *
- * @throws MojoExecutionException thrown if there is an issue executing the mojo
- * @throws MojoFailureException thrown if there is an issue executing the mojo
- */
- public final void execute() throws MojoExecutionException, MojoFailureException {
- try {
- initialize();
- preExecute();
- performExecute();
- } finally {
- postExecute();
- }
- }
-
- /**
- * Runs prior to the site report generation.
- *
- * @throws MavenReportException if a maven report exception occurs
- */
- protected void preGenerate() throws MavenReportException {
- buildAggregateInfo();
-
- project.setContextValue(getOutputDirectoryContextKey(), getReportOutputDirectory());
- }
-
- /**
- * Executes after the site report has been generated.
- *
- * @throws MavenReportException if a maven report exception occurs
- */
- protected void postGenerate() throws MavenReportException {
- final File written = writeDataFile();
- if (written != null) {
- project.setContextValue(getDataFileContextKey(), written.getAbsolutePath());
- }
- }
-
- /**
- * Generates the non aggregate report.
- *
- * @param locale the locale to use when generating the report
- * @throws MavenReportException if a maven report exception occurs
- */
- protected abstract void executeNonAggregateReport(Locale locale) throws MavenReportException;
-
- /**
- * Generates the aggregate Site Report.
- *
- * @param project the maven project used to generate the aggregate report
- * @param locale the locale to use when generating the report
- * @throws MavenReportException if a maven report exception occurs
- */
- protected abstract void executeAggregateReport(MavenProject project, Locale locale) throws MavenReportException;
-
- /**
- * Generates the Dependency-Check Site Report.
- *
- * @param sink the sink to write the report to
- * @param locale the locale to use when generating the report
- * @throws MavenReportException if a maven report exception occurs
- * @deprecated use {@link #generate(org.apache.maven.doxia.sink.Sink, java.util.Locale) instead.
- */
- @Deprecated
- public final void generate(@SuppressWarnings("deprecation") org.codehaus.doxia.sink.Sink sink, Locale locale) throws MavenReportException {
- generate((Sink) sink, locale);
- }
-
- /**
- * Generates the Dependency-Check Site Report.
- *
- * @param sink the sink to write the report to
- * @param locale the locale to use when generating the report
- * @throws MavenReportException if a maven report exception occurs
- */
- public final void generate(Sink sink, Locale locale) throws MavenReportException {
- try {
- initialize();
- preGenerate();
- if (canGenerateNonAggregateReport()) {
- executeNonAggregateReport(locale);
- }
- } finally {
- postGenerate();
- }
- if (canGenerateAggregateReport()) {
- for (MavenProject proj : reactorProjects) {
- if (!isMultiModule(proj)) {
- continue;
- }
- executeAggregateReport(proj, locale);
- }
- }
- }
-
- /**
- * Returns whether or not the mojo can generate a non-aggregate report for this project.
- *
- * @return true if a non-aggregate report can be generated, otherwise false
- */
- protected abstract boolean canGenerateNonAggregateReport();
-
- /**
- * Returns whether or not we can generate any aggregate reports at this time.
- *
- * @return true if an aggregate report can be generated, otherwise false
- */
- protected abstract boolean canGenerateAggregateReport();
-
- /**
- * Returns the name of the data file that contains the serialized data.
- *
- * @return the name of the data file that contains the serialized data
- */
- protected String getDataFileName() {
- return dataFileName;
- }
-
- /**
- * Writes the data file to disk in the target directory.
- *
- * @return the File object referencing the data file that was written
- */
- protected abstract File writeDataFile();
-
- /**
- * Collects the information needed for building aggregate reports.
- */
- private void buildAggregateInfo() {
- // build parent-child map
- for (MavenProject proj : reactorProjects) {
- Setnull.
- *
- * @return a list of child projects
- */
- protected Listnull.
- *
- * @param parentProject the parent project to collect the child project references
- * @return a list of child projects
- */
- protected Listtrue if it has a pom packaging; otherwise false
- */
- protected boolean isMultiModule(MavenProject mavenProject) {
- return "pom".equals(mavenProject.getPackaging());
- }
-
- /**
- * Test if the current project has pom packaging
- *
- * @return true if it has a pom packaging; otherwise false
- */
- protected boolean isMultiModule() {
- return isMultiModule(project);
- }
-
- /**
- * Check whether the current project is the last project in a multi-module build. If the maven build is not a
- * multi-module project then this will always return true.
- *
- * @return true if the current project is the last project in a multi-module build; otherwise
- * false
- */
- protected boolean isLastProject() {
- return project.equals(reactorProjects.get(reactorProjects.size() - 1));
- }
-
- /**
- * Returns whether or not the mojo is configured to perform report aggregation.
- *
- * @return true if report aggregation is enabled; otherwise false
- */
- public boolean isAggregate() {
- return aggregate;
- }
-
- /**
- * Returns a reference to the current project. This method is used instead of auto-binding the project via component
- * annotation in concrete implementations of this. If the child has a @Component MavenProject project;
- * defined then the abstract class (i.e. this class) will not have access to the current project (just the way Maven
- * works with the binding).
- *
- * @return returns a reference to the current project
- */
- protected MavenProject getProject() {
- return project;
- }
-}
diff --git a/dependency-check-maven/src/main/java/org/owasp/dependencycheck/maven/ReportingUtil.java b/dependency-check-maven/src/main/java/org/owasp/dependencycheck/maven/ReportingUtil.java
deleted file mode 100644
index e7a081fb9..000000000
--- a/dependency-check-maven/src/main/java/org/owasp/dependencycheck/maven/ReportingUtil.java
+++ /dev/null
@@ -1,455 +0,0 @@
-/*
- * This file is part of dependency-check-maven.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- *
- * Copyright (c) 2014 Jeremy Long. All Rights Reserved.
- */
-package org.owasp.dependencycheck.maven;
-
-import java.io.File;
-import java.io.IOException;
-import java.io.UnsupportedEncodingException;
-import java.net.URLEncoder;
-import java.text.DateFormat;
-import java.util.Date;
-import java.util.List;
-import java.util.Set;
-import java.util.logging.Level;
-import java.util.logging.Logger;
-import org.apache.maven.doxia.sink.Sink;
-import org.owasp.dependencycheck.data.nvdcve.CveDB;
-import org.owasp.dependencycheck.data.nvdcve.DatabaseException;
-import org.owasp.dependencycheck.data.nvdcve.DatabaseProperties;
-import org.owasp.dependencycheck.dependency.Dependency;
-import org.owasp.dependencycheck.dependency.Evidence;
-import org.owasp.dependencycheck.dependency.Identifier;
-import org.owasp.dependencycheck.dependency.Reference;
-import org.owasp.dependencycheck.dependency.Vulnerability;
-import org.owasp.dependencycheck.dependency.VulnerableSoftware;
-import org.owasp.dependencycheck.reporting.ReportGenerator;
-
-/**
- * A utility class that encapsulates the report generation for dependency-check-maven.
- *
- * @author Jeremy Long "); - } - - public void paragraph_() { - writeTag("
"); - } - - public void verbatim(boolean boxed) { - writeTag("");
- }
-
- public void verbatim_() {
- writeTag("");
- }
-
- public void horizontalRule() {
- writeTag("");
- }
-
- public void monospaced_() {
- writeTag("");
- }
-
- public void lineBreak() {
- writeTag("