mirror of
https://github.com/ysoftdevs/DependencyCheck.git
synced 2026-01-13 15:23:40 +01:00
updated site information
Former-commit-id: acb1ea4ba2e719b198465eb5b3dba1dd7bd38509
This commit is contained in:
Jeremy Long
@@ -1,47 +1,23 @@
|
||||
Dependency-Check
|
||||
Dependency-Check Ant Task
|
||||
=========
|
||||
|
||||
Dependency-Check is a utility that attempts to detect publicly disclosed vulnerabilities contained within project dependencies. It does this by determining if there is a Common Platform Enumeration (CPE) identifier for a given dependency. If found, it will generate a report linking to the associated CVE entries.
|
||||
|
||||
More information can be found on the [wiki].
|
||||
|
||||
Notice
|
||||
-
|
||||
|
||||
A very big release of new functionality and plugins will be made available during the BlackHat Arsenal on July 31st, 2013. If you are at BlackHat stop by and see the demos!
|
||||
|
||||
Usage
|
||||
-
|
||||
|
||||
> $ mvn package
|
||||
|
||||
> $ cd target
|
||||
|
||||
> $ java -jar dependency-check-[version].jar -h
|
||||
|
||||
> $ java -jar dependency-check-[version].jar -a Testing -out . -scan ./test-classes -scan ./lib
|
||||
|
||||
Then load the resulting 'DependencyCheck-Report.html' into your favorite browser.
|
||||
Dependency-Check Ant Task can be used to check the project dependencies for published security vulnerabilities. The checks
|
||||
performed are a "best effort" and as such, there could be false positives as well as false negatives. However,
|
||||
vulnerabilities in 3rd party components is a well-known problem and is currently documented in the 2013 OWASP
|
||||
Top 10 as [A9 - Using Components with Known Vulnerabilities](https://www.owasp.org/index.php/Top_10_2013-A9-Using_Components_with_Known_Vulnerabilities).
|
||||
|
||||
Mailing List
|
||||
-
|
||||
------------
|
||||
|
||||
Subscribe: [dependency-check+subscribe@googlegroups.com] [subscribe]
|
||||
Subscribe: [dependency-check+subscribe@googlegroups.com](mailto:dependency-check+subscribe@googlegroups.com)
|
||||
|
||||
Post: [dependency-check@googlegroups.com] [post]
|
||||
Post: [dependency-check@googlegroups.com](mailto:dependency-check@googlegroups.com)
|
||||
|
||||
Copyright & License
|
||||
-
|
||||
-------------------
|
||||
|
||||
Dependency-Check is Copyright (c) 2012-2013 Jeremy Long. All Rights Reserved.
|
||||
|
||||
Permission to modify and redistribute is granted under the terms of the GPLv3 license. See the [LICENSE.txt] [GPLv3] file for the full license.
|
||||
Permission to modify and redistribute is granted under the terms of the GPLv3 license. See the [LICENSE.txt](https://github.com/jeremylong/DependencyCheck/dependency-check-ant/blob/master/LICENSE.txt) file for the full license.
|
||||
|
||||
Dependency-Check makes use of several other open source libraries. Please see the [NOTICE.txt] [notices] file for more information.
|
||||
|
||||
|
||||
[wiki]: https://github.com/jeremylong/DependencyCheck/wiki
|
||||
[subscribe]: mailto:dependency-check+subscribe@googlegroups.com
|
||||
[post]: mailto:dependency-check@googlegroups.com
|
||||
[GPLv3]: https://github.com/jeremylong/DependencyCheck/blob/master/LICENSE.txt
|
||||
[notices]: https://github.com/jeremylong/DependencyCheck/blob/master/NOTICES.txt
|
||||
Dependency-Check-Ant makes use of other open source libraries. Please see the [NOTICE.txt](https://github.com/jeremylong/DependencyCheck/dependency-check-ant/blob/master/NOTICES.txt) file for more information.
|
||||
|
||||
@@ -1,41 +1,23 @@
|
||||
Dependency-Check
|
||||
Dependency-Check Command Line
|
||||
================
|
||||
|
||||
Dependency-Check is a utility that attempts to detect publicly disclosed vulnerabilities contained within project dependencies. It does this by determining if there is a Common Platform Enumeration (CPE) identifier for a given dependency. If found, it will generate a report linking to the associated CVE entries.
|
||||
|
||||
More information can be found on the [wiki].
|
||||
|
||||
Usage
|
||||
------------
|
||||
|
||||
```
|
||||
$ mvn package
|
||||
$ cd target/release/bin
|
||||
$ dependency-check-[version].sh -h
|
||||
$ dependency-check-[version].sh -a Testing -scan ../../test-classes
|
||||
```
|
||||
|
||||
Then load the resulting 'DependencyCheck-Report.html' into your favorite browser.
|
||||
Dependency-Check Command Line can be used to check project dependencies for published security vulnerabilities. The checks
|
||||
performed are a "best effort" and as such, there could be false positives as well as false negatives. However,
|
||||
vulnerabilities in 3rd party components is a well-known problem and is currently documented in the 2013 OWASP
|
||||
Top 10 as [A9 - Using Components with Known Vulnerabilities](https://www.owasp.org/index.php/Top_10_2013-A9-Using_Components_with_Known_Vulnerabilities).
|
||||
|
||||
Mailing List
|
||||
------------
|
||||
|
||||
Subscribe: [dependency-check+subscribe@googlegroups.com] [subscribe]
|
||||
Subscribe: [dependency-check+subscribe@googlegroups.com](mailto:dependency-check+subscribe@googlegroups.com)
|
||||
|
||||
Post: [dependency-check@googlegroups.com] [post]
|
||||
Post: [dependency-check@googlegroups.com](mailto:dependency-check@googlegroups.com)
|
||||
|
||||
Copyright & License
|
||||
------------
|
||||
|
||||
Dependency-Check is Copyright (c) 2012-2013 Jeremy Long. All Rights Reserved.
|
||||
|
||||
Permission to modify and redistribute is granted under the terms of the GPLv3 license. See the [LICENSE.txt] [GPLv3] file for the full license.
|
||||
Permission to modify and redistribute is granted under the terms of the GPLv3 license. See the [LICENSE.txt](https://github.com/jeremylong/DependencyCheck/dependency-check-cli/blob/master/LICENSE.txt) file for the full license.
|
||||
|
||||
Dependency-Check makes use of several other open source libraries. Please see the [NOTICE.txt] [notices] file for more information.
|
||||
|
||||
|
||||
[wiki]: https://github.com/jeremylong/DependencyCheck/wiki
|
||||
[subscribe]: mailto:dependency-check+subscribe@googlegroups.com
|
||||
[post]: mailto:dependency-check@googlegroups.com
|
||||
[GPLv3]: https://github.com/jeremylong/DependencyCheck/blob/master/LICENSE.txt
|
||||
[notices]: https://github.com/jeremylong/DependencyCheck/blob/master/NOTICES.txt
|
||||
Dependency-Check Command Line makes use of other open source libraries. Please see the [NOTICE.txt](https://github.com/jeremylong/DependencyCheck/dependency-check-cli/blob/master/NOTICES.txt) file for more information.
|
||||
|
||||
@@ -13,4 +13,4 @@ The engine is currently exposed via:
|
||||
- [Command Line Tool](../dependency-check-cli/installation.html)
|
||||
- [Maven Plugin](../dependency-check-maven/usage.html)
|
||||
- [Ant Task](../dependency-check-ant/installation.html)
|
||||
- Jenkins Plugin
|
||||
- [Jenkins Plugin](../dependency-check-jenkins/index.html)
|
||||
|
||||
@@ -1,34 +1,33 @@
|
||||
Dependency-Check Jenkins Plugin
|
||||
==============================
|
||||
|
||||
Dependency-Check is a utility that attempts to detect publicly disclosed vulnerabilities contained within project dependencies. It does this by determining if there is a Common Platform Enumeration (CPE) identifier for a given dependency. If found, it will generate a report linking to the associated CVE entries.
|
||||
The Dependency-Check Jenkins Plugin features the ability to perform a dependency
|
||||
analysis build and later view results post build. The plugin is built using [analysis-core]
|
||||
and features many of the same features that Jenkins static analysis plugins offer,
|
||||
including thresholds, charts and the ability to view vulnerability information should
|
||||
a dependency have one identified.
|
||||
|
||||
The Dependency-Check Jenkins Plugin features the ability to perform a dependency analysis build and later view results post build. The plugin is built using [analysis-core] and features many of the same features that Jenkins static analysis plugins offer, including thresholds, charts and the ability to view vulnerability information should a dependency have one identified.
|
||||
The main repository is located at [jenkins-cli/dependency-check-jenkins](https://github.com/jenkinsci/dependency-check-jenkins).
|
||||
|
||||
The main site for documentation is located at [OWASP Dependency-Check-Jenkins](https://wiki.jenkins-ci.org/display/JENKINS/OWASP+Dependency-Check+Plugin).
|
||||
|
||||
More information can be found on the [wiki].
|
||||
|
||||
Mailing List
|
||||
------------
|
||||
|
||||
Subscribe: [dependency-check+subscribe@googlegroups.com] [subscribe]
|
||||
Subscribe: [dependency-check+subscribe@googlegroups.com](mailto:dependency-check+subscribe@googlegroups.com)
|
||||
|
||||
Post: [dependency-check@googlegroups.com] [post]
|
||||
Post: [dependency-check@googlegroups.com](mailto:dependency-check@googlegroups.com)
|
||||
|
||||
Copyright & License
|
||||
-------------------
|
||||
|
||||
Dependency-Check is Copyright (c) 2012-2013 Jeremy Long. All Rights Reserved.
|
||||
|
||||
Dependency-Check Jenkins Plugin is Copyright (c) 2013 Steve Springett. All Rights Reserved.
|
||||
|
||||
Permission to modify and redistribute is granted under the terms of the GPLv3 license. See the [LICENSE.txt] [GPLv3] file for the full license.
|
||||
|
||||
Dependency-Check makes use of several other open source libraries. Please see the [NOTICE.txt] [notices] file for more information.
|
||||
|
||||
|
||||
[wiki]: https://github.com/jeremylong/dependency-check-jenkins/wiki
|
||||
[wiki]: https://github.com/jenkinsci/dependency-check-jenkins/wiki
|
||||
[analysis-core]: http://wiki.jenkins-ci.org/x/CwDgAQ
|
||||
[subscribe]: mailto:dependency-check+subscribe@googlegroups.com
|
||||
[post]: mailto:dependency-check@googlegroups.com
|
||||
[GPLv3]: https://github.com/jeremylong/dependency-check-jenkins/blob/master/LICENSE.txt
|
||||
[notices]: https://github.com/jeremylong/dependency-check-jenkins/blob/master/NOTICES.txt
|
||||
[GPLv3]: https://github.com/jenkinsci/dependency-check-jenkins/blob/master/LICENSE.txt
|
||||
[notices]: https://github.com/jenkinsci/dependency-check-jenkins/blob/master/NOTICES.txt
|
||||
|
||||
@@ -10,8 +10,8 @@
|
||||
</parent>
|
||||
|
||||
<groupId>org.owasp</groupId>
|
||||
<artifactId>dependency-check-jenkins</artifactId>
|
||||
<name>Dependency-Check Jenkins Plugin</name>
|
||||
<artifactId>dependency-check-jenkins</artifactId>
|
||||
<name>Dependency-Check Jenkins Plugin</name>
|
||||
<packaging>jar</packaging>
|
||||
<inceptionYear>2012</inceptionYear>
|
||||
<organization>
|
||||
@@ -33,22 +33,13 @@
|
||||
</developers>
|
||||
<scm>
|
||||
<connection>scm:git:git@github.com:jenkinsci/dependency-check-jenkins.git</connection>
|
||||
<url>https://github.com/jenkinsci/dependency-check-jenkins.git</url>
|
||||
<url>https://github.com/jenkinsci/dependency-check-jenkins</url>
|
||||
<developerConnection>scm:git:git@github.com:jenkinsci/dependency-check-jenkins.git</developerConnection>
|
||||
</scm>
|
||||
<issueManagement>
|
||||
<system>github</system>
|
||||
<url>https://github.com/jenkinsci/dependency-check-jenkins/issues</url>
|
||||
</issueManagement>
|
||||
<mailingLists>
|
||||
<mailingList>
|
||||
<name>Dependency Check</name>
|
||||
<subscribe>dependency-check+subscribe@googlegroups.com</subscribe>
|
||||
<unsubscribe>dependency-check+unsubscribe@googlegroups.com</unsubscribe>
|
||||
<post>dependency-check@googlegroups.com</post>
|
||||
<archive>https://groups.google.com/forum/?fromgroups#!forum/dependency-check</archive>
|
||||
</mailingList>
|
||||
</mailingLists>
|
||||
<licenses>
|
||||
<license>
|
||||
<name>GNU General Public License version 3</name>
|
||||
|
||||
30
dependency-check-jenkins/src/site/site.xml
Normal file
30
dependency-check-jenkins/src/site/site.xml
Normal file
@@ -0,0 +1,30 @@
|
||||
<?xml version="1.0" encoding="ISO-8859-1"?>
|
||||
<!--
|
||||
This file is part of dependency-check-core.
|
||||
|
||||
Dependency-check-core is free software: you can redistribute it and/or modify it
|
||||
under the terms of the GNU General Public License as published by the Free
|
||||
Software Foundation, either version 3 of the License, or (at your option) any
|
||||
later version.
|
||||
|
||||
Dependency-check-core is distributed in the hope that it will be useful, but
|
||||
WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
||||
FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
|
||||
details.
|
||||
|
||||
You should have received a copy of the GNU General Public License along with
|
||||
dependency-check-core. If not, see http://www.gnu.org/licenses/.
|
||||
|
||||
Copyright (c) 2012 Jeremy Long. All Rights Reserved.
|
||||
-->
|
||||
<project name="dependency-check-core">
|
||||
<bannerLeft>
|
||||
<name>dependency-check-jenkins</name>
|
||||
</bannerLeft>
|
||||
<body>
|
||||
<breadcrumbs>
|
||||
<item name="dependency-check" href="../index.html"/>
|
||||
</breadcrumbs>
|
||||
<menu ref="Project Documentation" />
|
||||
</body>
|
||||
</project>
|
||||
2
pom.xml
2
pom.xml
@@ -78,7 +78,7 @@ along with Dependency-Check. If not, see <http://www.gnu.org/licenses />.
|
||||
</contributors>
|
||||
<scm>
|
||||
<connection>scm:git:git@github.com:jeremylong/DependencyCheck.git</connection>
|
||||
<url>https://github.com/jeremylong/DependencyCheck.git</url>
|
||||
<url>https://github.com/jeremylong/DependencyCheck</url>
|
||||
<developerConnection>scm:git:git@github.com:jeremylong/DependencyCheck.git</developerConnection>
|
||||
<tag>dependency-check-1.0.1</tag>
|
||||
</scm>
|
||||
|
||||
@@ -28,4 +28,4 @@ Dependency-check's core analysis library is exposed in various forms:
|
||||
- [Command Line Tool](dependency-check-cli/index.html)
|
||||
- [Maven Plugin](dependency-check-maven/usage.html)
|
||||
- [Ant Task](dependency-check-ant/installation.html)
|
||||
- Jenkins Plugin
|
||||
- [Jenkins Plugin](dependency-check-jenkins/index.html)
|
||||
|
||||
@@ -61,15 +61,18 @@ Copyright (c) 2013 Jeremy Long. All Rights Reserved.
|
||||
<item name="dependency-check-core" href="./dependency-check-core/index.html">
|
||||
<description>The core dependency-check library</description>
|
||||
</item>
|
||||
<item name="dependency-check-cli" href="./dependency-check-cli/index.html">
|
||||
<item name="dependency-check-cli" href="./dependency-check-cli/installation.html">
|
||||
<description>The command line interface for dependency-check.</description>
|
||||
</item>
|
||||
<item name="dependency-check-ant" href="./dependency-check-ant/index.html">
|
||||
<item name="dependency-check-ant" href="./dependency-check-ant/installation.html">
|
||||
<description>An Ant task to run dependency-check.</description>
|
||||
</item>
|
||||
<item name="dependency-check-maven" href="./dependency-check-maven/index.html">
|
||||
<item name="dependency-check-maven" href="./dependency-check-maven/usage.html">
|
||||
<description>A Maven plugin for dependency-check.</description>
|
||||
</item>
|
||||
<item name="dependency-check-maven" href="./dependency-check-jenkins/index.html">
|
||||
<description>A Jenkins plugin for dependency-check.</description>
|
||||
</item>
|
||||
</menu>
|
||||
<footer/>
|
||||
</body>
|
||||
|
||||
Reference in New Issue
Block a user