github-mirrors/DependencyCheck
1
0
Fork 0
mirror of https://github.com/ysoftdevs/DependencyCheck.git synced 2026-01-14 15:53:36 +01:00
Code Issues Packages Projects Releases Wiki Activity

Fix #752 where skipping runtime-scoped maven artifacts also skipped compile-time artifacts

Browse Source
This commit is contained in:
Josh Cain
2017-05-30 14:58:47 -05:00
parent 217b08b571
commit 69f39d4dfe
4 changed files with 207 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files

61
dependency-check-maven/src/main/java/org/owasp/dependencycheck/maven/ArtifactScopeExcluded.java Normal file
View File

@@ -0,0 +1,61 @@
/*
* This file is part of dependency-check-maven.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*
* Copyright (c) 2017 Josh Cain. All Rights Reserved.
*/
package org.owasp.dependencycheck.maven;
import org.owasp.dependencycheck.utils.Filter;
/**
* Tests is the artifact should be included in the scan (i.e. is the
* dependency in a scope that is being scanned).
*
* @param scope the scope of the artifact to test
* @return <code>true</code> if the artifact is in an excluded scope;
* otherwise <code>false</code>
*/
public class ArtifactScopeExcluded extends Filter<String> {
private final boolean skipTestScope;
private final boolean skipProvidedScope;
private final boolean skipSystemScope;
private final boolean skipRuntimeScope;
public ArtifactScopeExcluded(final boolean skipTestScope, final boolean skipProvidedScope, final boolean skipSystemScope, final boolean skipRuntimeScope) {
this.skipTestScope = skipTestScope;
this.skipProvidedScope = skipProvidedScope;
this.skipSystemScope = skipSystemScope;
this.skipRuntimeScope = skipRuntimeScope;
}
@Override
public boolean passes(final String scope) {
if (skipTestScope && org.apache.maven.artifact.Artifact.SCOPE_TEST.equals(scope)) {
return true;
}
if (skipProvidedScope && org.apache.maven.artifact.Artifact.SCOPE_PROVIDED.equals(scope)) {
return true;
}
if (skipSystemScope && org.apache.maven.artifact.Artifact.SCOPE_SYSTEM.equals(scope)) {
return true;
}
if (skipRuntimeScope && org.apache.maven.artifact.Artifact.SCOPE_RUNTIME.equals(scope)) {
return true;
}
return false;
}
}

31
dependency-check-maven/src/main/java/org/owasp/dependencycheck/maven/BaseDependencyCheckMojo.java
View File

@@ -48,17 +48,14 @@ import org.apache.maven.shared.dependency.graph.DependencyGraphBuilderException;
import org.apache.maven.shared.dependency.graph.DependencyNode;
import org.owasp.dependencycheck.Engine;
import org.owasp.dependencycheck.data.nexus.MavenArtifact;
import org.owasp.dependencycheck.data.nvdcve.CveDB;
import org.owasp.dependencycheck.data.nvdcve.DatabaseException;
import org.owasp.dependencycheck.data.nvdcve.DatabaseProperties;
import org.owasp.dependencycheck.dependency.Confidence;
import org.owasp.dependencycheck.dependency.Dependency;
import org.owasp.dependencycheck.dependency.Identifier;
import org.owasp.dependencycheck.dependency.Vulnerability;
import org.owasp.dependencycheck.exception.DependencyNotFoundException;
import org.owasp.dependencycheck.exception.ExceptionCollection;
import org.owasp.dependencycheck.exception.ReportException;
import org.owasp.dependencycheck.reporting.ReportGenerator;
import org.owasp.dependencycheck.utils.Filter;
import org.owasp.dependencycheck.utils.Settings;
import org.sonatype.plexus.components.sec.dispatcher.DefaultSecDispatcher;
import org.sonatype.plexus.components.sec.dispatcher.SecDispatcher;
@@ -468,6 +465,8 @@ public abstract class BaseDependencyCheckMojo extends AbstractMojo implements Ma
@Deprecated
private String externalReport = null;
protected Filter<String> artifactScopeExcluded;
// </editor-fold>
//<editor-fold defaultstate="collapsed" desc="Base Maven implementation">
/**
@@ -639,7 +638,7 @@ public abstract class BaseDependencyCheckMojo extends AbstractMojo implements Ma
List<DependencyNode> nodes, ProjectBuildingRequest buildingRequest) {
ExceptionCollection exCol = null;
for (DependencyNode dependencyNode : nodes) {
if (excludeFromScan(dependencyNode.getArtifact().getScope())) {
if (artifactScopeExcluded.passes(dependencyNode.getArtifact().getScope())) {
continue;
}
exCol = collectDependencies(engine, project, dependencyNode.getChildren(), buildingRequest);
@@ -987,6 +986,7 @@ public abstract class BaseDependencyCheckMojo extends AbstractMojo implements Ma
Settings.setStringIfNotEmpty(Settings.KEYS.CVE_SCHEMA_2_0, cveUrl20Base);
Settings.setIntIfNotNull(Settings.KEYS.CVE_CHECK_VALID_FOR_HOURS, cveValidForHours);
artifactScopeExcluded = new ArtifactScopeExcluded(skipTestScope, skipProvidedScope, skipSystemScope, skipRuntimeScope);
}
/**
@@ -1016,27 +1016,6 @@ public abstract class BaseDependencyCheckMojo extends AbstractMojo implements Ma
return null;
}
/**
* Tests is the artifact should be included in the scan (i.e. is the
* dependency in a scope that is being scanned).
*
* @param scope the scope of the artifact to test
* @return <code>true</code> if the artifact is in an excluded scope;
* otherwise <code>false</code>
*/
protected boolean excludeFromScan(String scope) {
if (skipTestScope && org.apache.maven.artifact.Artifact.SCOPE_TEST.equals(scope)) {
return true;
}
if (skipProvidedScope && org.apache.maven.artifact.Artifact.SCOPE_PROVIDED.equals(scope)) {
return true;
}
if (skipSystemScope && org.apache.maven.artifact.Artifact.SCOPE_SYSTEM.equals(scope)) {
return true;
}
return skipRuntimeScope && !org.apache.maven.artifact.Artifact.SCOPE_RUNTIME.equals(scope);
}
/**
* Returns a reference to the current project. This method is used instead
* of auto-binding the project via component annotation in concrete

2
dependency-check-maven/src/main/java/org/owasp/dependencycheck/maven/CheckMojo.java
View File

@@ -64,7 +64,7 @@ public class CheckMojo extends BaseDependencyCheckMojo {
public boolean canGenerateReport() {
boolean isCapable = false;
for (Artifact a : getProject().getArtifacts()) {
if (!excludeFromScan(a.getScope())) {
if (!artifactScopeExcluded.passes(a.getScope())) {
isCapable = true;
break;
}

140
dependency-check-maven/src/test/java/org/owasp/dependencycheck/maven/ArtifactScopeExcludedTest.java Normal file
View File

@@ -0,0 +1,140 @@
/*
* This file is part of dependency-check-maven.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*
* Copyright (c) 2017 Josh Cain. All Rights Reserved.
*/
package org.owasp.dependencycheck.maven;
import org.junit.Test;
import org.junit.runner.RunWith;
import org.junit.runners.Parameterized;
import org.owasp.dependencycheck.utils.Filter;
import java.util.Arrays;
import java.util.Collection;
import static org.apache.maven.artifact.Artifact.SCOPE_COMPILE;
import static org.apache.maven.artifact.Artifact.SCOPE_COMPILE_PLUS_RUNTIME;
import static org.apache.maven.artifact.Artifact.SCOPE_IMPORT;
import static org.apache.maven.artifact.Artifact.SCOPE_PROVIDED;
import static org.apache.maven.artifact.Artifact.SCOPE_RUNTIME;
import static org.apache.maven.artifact.Artifact.SCOPE_RUNTIME_PLUS_SYSTEM;
import static org.apache.maven.artifact.Artifact.SCOPE_SYSTEM;
import static org.apache.maven.artifact.Artifact.SCOPE_TEST;
import static org.hamcrest.MatcherAssert.assertThat;
import static org.hamcrest.core.Is.is;
import static org.hamcrest.core.IsEqual.equalTo;
import static org.owasp.dependencycheck.maven.ArtifactScopeExcludedTest.ArtifactScopeExcludedTestBuilder.pluginDefaults;
@RunWith(Parameterized.class)
public class ArtifactScopeExcludedTest {
private final boolean skipTestScope;
private final boolean skipProvidedScope;
private final boolean skipSystemScope;
private final boolean skipRuntimeScope;
private final String testString;
private final boolean expectedResult;
@Parameterized.Parameters(name = "{0}")
public static Collection<Object[]> getParameters() {
return Arrays.asList(new Object[][]{
{pluginDefaults().withTestString(SCOPE_COMPILE).withExpectedResult(false)},
{pluginDefaults().withTestString(SCOPE_COMPILE_PLUS_RUNTIME).withExpectedResult(false)},
{pluginDefaults().withTestString(SCOPE_TEST).withExpectedResult(true)},
{pluginDefaults().withTestString(SCOPE_RUNTIME).withExpectedResult(false)},
{pluginDefaults().withTestString(SCOPE_RUNTIME_PLUS_SYSTEM).withExpectedResult(false)},
{pluginDefaults().withTestString(SCOPE_PROVIDED).withExpectedResult(false)},
{pluginDefaults().withTestString(SCOPE_SYSTEM).withExpectedResult(false)},
{pluginDefaults().withTestString(SCOPE_IMPORT).withExpectedResult(false)},
// Runtime scope was having some issues... let's fix.
{pluginDefaults().withSkipRuntimeScope(true).withTestString(SCOPE_COMPILE).withExpectedResult(false)},
{pluginDefaults().withSkipRuntimeScope(true).withTestString(SCOPE_RUNTIME).withExpectedResult(true)},
});
}
public ArtifactScopeExcludedTest(final ArtifactScopeExcludedTestBuilder builder) {
this.skipTestScope = builder.skipTestScope;
this.skipProvidedScope = builder.skipProvidedScope;
this.skipSystemScope = builder.skipSystemScope;
this.skipRuntimeScope = builder.skipRuntimeScope;
this.testString = builder.testString;
this.expectedResult = builder.expectedResult;
}
@Test
public void shouldExcludeArtifact() {
final Filter<String> artifactScopeExcluded = new ArtifactScopeExcluded(skipTestScope, skipProvidedScope, skipSystemScope, skipRuntimeScope);
assertThat(expectedResult, is(equalTo(artifactScopeExcluded.passes(testString))));
}
public static final class ArtifactScopeExcludedTestBuilder {
private boolean skipTestScope;
private boolean skipProvidedScope;
private boolean skipSystemScope;
private boolean skipRuntimeScope;
private String testString;
private boolean expectedResult;
private ArtifactScopeExcludedTestBuilder() {
}
public static ArtifactScopeExcludedTestBuilder pluginDefaults() {
return new ArtifactScopeExcludedTestBuilder()
.withSkipTestScope(true)
.withSkipProvidedScope(false)
.withSkipRuntimeScope(false)
.withSkipSystemScope(false);
}
public ArtifactScopeExcludedTestBuilder withSkipTestScope(final boolean skipTestScope) {
this.skipTestScope = skipTestScope;
return this;
}
public ArtifactScopeExcludedTestBuilder withSkipProvidedScope(final boolean skipProvidedScope) {
this.skipProvidedScope = skipProvidedScope;
return this;
}
public ArtifactScopeExcludedTestBuilder withSkipSystemScope(final boolean skipSystemScope) {
this.skipSystemScope = skipSystemScope;
return this;
}
public ArtifactScopeExcludedTestBuilder withSkipRuntimeScope(final boolean skipRuntimeScope) {
this.skipRuntimeScope = skipRuntimeScope;
return this;
}
public ArtifactScopeExcludedTestBuilder withTestString(final String testString) {
this.testString = testString;
return this;
}
public ArtifactScopeExcludedTestBuilder withExpectedResult(final boolean expectedResult) {
this.expectedResult = expectedResult;
return this;
}
@Override
public String toString() {
return String.format("new ArtifactScopeExcluded(%s, %s, %s, %s).passes(\"%s\") == %s;",
skipTestScope, skipProvidedScope, skipSystemScope, skipRuntimeScope, testString, expectedResult);
}
}
}