mirror of
https://github.com/ysoftdevs/DependencyCheck.git
synced 2026-01-11 22:41:00 +01:00
Merge branch 'master' into updateJsonReport
This commit is contained in:
Jeremy Long
@@ -93,8 +93,8 @@ $ ./dependency-check-cli/target/release/bin/dependency-check.sh --project Testin
|
||||
On Windows
|
||||
```
|
||||
> mvn install
|
||||
> dependency-check-cli/target/release/bin/dependency-check.bat -h
|
||||
> dependency-check-cli/target/release/bin/dependency-check.bat --project Testing --out . --scan ./src/test/resources
|
||||
> .\dependency-check-cli\target\release\bin\dependency-check.bat -h
|
||||
> .\dependency-check-cli\target\release\bin\dependency-check.bat --project Testing --out . --scan ./src/test/resources
|
||||
```
|
||||
|
||||
Then load the resulting 'DependencyCheck-Report.html' into your favorite browser.
|
||||
|
||||
@@ -146,7 +146,7 @@ public class Check extends Update {
|
||||
private boolean updateOnly = false;
|
||||
|
||||
/**
|
||||
* The report format to be generated (HTML, XML, VULN, ALL). Default is
|
||||
* The report format to be generated (HTML, XML, VULN, CSV, JSON, ALL). Default is
|
||||
* HTML.
|
||||
*/
|
||||
private String reportFormat = "HTML";
|
||||
@@ -1102,7 +1102,7 @@ public class Check extends Update {
|
||||
}
|
||||
|
||||
/**
|
||||
* An enumeration of supported report formats: "ALL", "HTML", "XML", "VULN",
|
||||
* An enumeration of supported report formats: "ALL", "HTML", "XML", "CSV", "JSON", "VULN",
|
||||
* etc..
|
||||
*/
|
||||
public static class ReportFormats extends EnumeratedAttribute {
|
||||
|
||||
@@ -36,11 +36,11 @@ cveValidForHours | Sets the number of hours to wait before checking for new
|
||||
failBuildOnCVSS | Specifies if the build should be failed if a CVSS score above a specified level is identified. The default is 11 which means since the CVSS scores are 0-10, by default the build will never fail. | 11
|
||||
failOnError | Whether the build should fail if there is an error executing the dependency-check analysis | true
|
||||
projectName | The name of the project being scanned. | Dependency-Check
|
||||
reportFormat | The report format to be generated (HTML, XML, VULN, ALL). This configuration option has no affect if using this within the Site plugin unless the externalReport is set to true. | HTML
|
||||
reportFormat | The report format to be generated (HTML, XML, CSV, JSON, VULN, ALL). This configuration option has no affect if using this within the Site plugin unless the externalReport is set to true. | HTML
|
||||
reportOutputDirectory | The location to write the report(s). Note, this is not used if generating the report as part of a `mvn site` build | 'target'
|
||||
suppressionFile | The file path to the XML suppression file \- used to suppress [false positives](../general/suppression.html) |
|
||||
hintsFile | The file path to the XML hints file \- used to resolve [false negatives](../general/hints.html) |
|
||||
proxyServer | The Proxy Server; see the [proxy configuration](../data/proxy.html) page for more information. |
|
||||
hintsFile | The file path to the XML hints file \- used to resolve [false negatives](../general/hints.html) |
|
||||
proxyServer | The Proxy Server; see the [proxy configuration](../data/proxy.html) page for more information. |
|
||||
proxyPort | The Proxy Port. |
|
||||
proxyUsername | Defines the proxy user name. |
|
||||
proxyPassword | Defines the proxy password. |
|
||||
|
||||
@@ -120,7 +120,7 @@ public final class CliParser {
|
||||
Format.valueOf(format);
|
||||
} catch (IllegalArgumentException ex) {
|
||||
final String msg = String.format("An invalid 'format' of '%s' was specified. "
|
||||
+ "Supported output formats are XML, JSON, HTML, VULN, or ALL", format);
|
||||
+ "Supported output formats are HTML, XML, CSV, JSON, VULN, or ALL", format);
|
||||
throw new ParseException(msg);
|
||||
}
|
||||
}
|
||||
|
||||
@@ -10,7 +10,7 @@ Short | Argument Name | Parameter | Description | Requir
|
||||
| \-\-exclude | \<pattern\> | The path patterns to exclude from the scan \- this option can be specified multiple times. This accepts Ant style path patterns (e.g. **/exclude/**). | Optional
|
||||
| \-\-symLink | \<depth\> | The depth that symbolic links will be followed; the default is 0 meaning symbolic links will not be followed. | Optional
|
||||
\-o | \-\-out | \<path\> | The folder to write reports to. This defaults to the current directory. If the format is not set to ALL one could specify a specific file name. | Optional
|
||||
\-f | \-\-format | \<format\> | The output format to write to (XML, HTML, VULN, ALL). The default is HTML. | Required
|
||||
\-f | \-\-format | \<format\> | The output format to write to (XML, HTML, CSV, JSON, VULN, ALL). The default is HTML. | Required
|
||||
| \-\-failOnCvss | \<score\> | If the score set between 0 and 10 the exit code from dependency-check will indicate if a vulnerability with a CVSS score equal to or higher was identified. | Optional
|
||||
\-l | \-\-log | \<file\> | The file path to write verbose logging information. | Optional
|
||||
\-n | \-\-noupdate | | Disables the automatic updating of the CPE data. | Optional
|
||||
|
||||
@@ -19,7 +19,9 @@ package org.owasp.dependencycheck.reporting;
|
||||
|
||||
import java.io.UnsupportedEncodingException;
|
||||
import java.net.URLEncoder;
|
||||
import java.util.Set;
|
||||
import org.apache.commons.lang3.StringEscapeUtils;
|
||||
import org.owasp.dependencycheck.dependency.Identifier;
|
||||
import org.slf4j.Logger;
|
||||
import org.slf4j.LoggerFactory;
|
||||
|
||||
@@ -94,4 +96,71 @@ public class EscapeTool {
|
||||
}
|
||||
return StringEscapeUtils.escapeJson(text);
|
||||
}
|
||||
|
||||
/**
|
||||
* Formats text for CSV format. This includes trimming whitespace, replace
|
||||
* line breaks with spaces, and if necessary quotes the text and/or escapes
|
||||
* contained quotes.
|
||||
*
|
||||
* @param text the text to escape and quote
|
||||
* @return the escaped and quoted text
|
||||
*/
|
||||
public String csv(String text) {
|
||||
if (text == null || text.isEmpty()) {
|
||||
return text;
|
||||
}
|
||||
return StringEscapeUtils.escapeCsv(text.trim().replace("\n", " "));
|
||||
}
|
||||
|
||||
/**
|
||||
* Takes a set of Identifiers, filters them to none CPE, and formats them
|
||||
* for display in a CSV.
|
||||
*
|
||||
* @param ids the set of identifiers
|
||||
* @return the formated list of none CPE identifiers
|
||||
*/
|
||||
public String csvIdentifiers(Set<Identifier> ids) {
|
||||
if (ids == null || ids.isEmpty()) {
|
||||
return "";
|
||||
}
|
||||
boolean addComma = false;
|
||||
StringBuilder sb = new StringBuilder();
|
||||
for (Identifier id : ids) {
|
||||
if (!"cpe".equals(id.getType())) {
|
||||
if (addComma) {
|
||||
sb.append(", ");
|
||||
} else {
|
||||
addComma = true;
|
||||
}
|
||||
sb.append(id.getValue());
|
||||
}
|
||||
}
|
||||
return StringEscapeUtils.escapeCsv(sb.toString());
|
||||
}
|
||||
|
||||
/**
|
||||
* Takes a set of Identifiers, filters them to just CPEs, and formats them
|
||||
* for display in a CSV.
|
||||
*
|
||||
* @param ids the set of identifiers
|
||||
* @return the formated list of CPE identifiers
|
||||
*/
|
||||
public String csvCpe(Set<Identifier> ids) {
|
||||
if (ids == null || ids.isEmpty()) {
|
||||
return "";
|
||||
}
|
||||
boolean addComma = false;
|
||||
StringBuilder sb = new StringBuilder();
|
||||
for (Identifier id : ids) {
|
||||
if ("cpe".equals(id.getType())) {
|
||||
if (addComma) {
|
||||
sb.append(", ");
|
||||
} else {
|
||||
addComma = true;
|
||||
}
|
||||
sb.append(id.getValue());
|
||||
}
|
||||
}
|
||||
return StringEscapeUtils.escapeCsv(sb.toString());
|
||||
}
|
||||
}
|
||||
|
||||
@@ -81,7 +81,11 @@ public class ReportGenerator {
|
||||
/**
|
||||
* Generate JSON report.
|
||||
*/
|
||||
JSON
|
||||
JSON,
|
||||
/**
|
||||
* Generate CSV report.
|
||||
*/
|
||||
CSV
|
||||
}
|
||||
/**
|
||||
* The Velocity Engine.
|
||||
@@ -191,6 +195,9 @@ public class ReportGenerator {
|
||||
if (format == Format.JSON || format == Format.ALL) {
|
||||
generateReport("JsonReport", outputStream);
|
||||
}
|
||||
if (format == Format.CSV || format == Format.ALL) {
|
||||
generateReport("CsvReport", outputStream);
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
@@ -209,6 +216,9 @@ public class ReportGenerator {
|
||||
generateReport("JsonReport", outputDir + File.separator + "dependency-check-report.json");
|
||||
pretifyJson(outputDir + File.separator + "dependency-check-report.json");
|
||||
}
|
||||
if (format == Format.CSV || format == Format.ALL) {
|
||||
generateReport("CsvReport", outputDir + File.separator + "dependency-check-report.csv");
|
||||
}
|
||||
if (format == Format.HTML || format == Format.ALL) {
|
||||
generateReport("HtmlReport", outputDir + File.separator + "dependency-check-report.html");
|
||||
}
|
||||
@@ -344,6 +354,13 @@ public class ReportGenerator {
|
||||
generateReports(outputDir, Format.JSON);
|
||||
}
|
||||
}
|
||||
if ("CSV".equalsIgnoreCase(format)) {
|
||||
if (pathToCheck.endsWith(".csv")) {
|
||||
generateReport("CsvReport", outputDir);
|
||||
} else {
|
||||
generateReports(outputDir, Format.JSON);
|
||||
}
|
||||
}
|
||||
if ("ALL".equalsIgnoreCase(format)) {
|
||||
generateReports(outputDir, Format.ALL);
|
||||
}
|
||||
|
||||
@@ -1,5 +1,13 @@
|
||||
<?xml version="1.0" encoding="UTF-8"?>
|
||||
<suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.1.xsd">
|
||||
<suppress base="true">
|
||||
<notes><![CDATA[
|
||||
This suppresses false positives for EntityFramework.SqlServer.dll.
|
||||
]]></notes>
|
||||
<filePath regex="true">.*EntityFramework\.SqlServer*\.dll</filePath>
|
||||
<cpe>cpe:/a:microsoft:server:6.0.0.0</cpe>
|
||||
<cpe>cpe:/a:microsoft:sql_server:6.0</cpe>
|
||||
</suppress>
|
||||
<suppress base="true">
|
||||
<notes>< |
|
||||
|
||||
Reference in New Issue
Block a user