From 8733a85ebb9f3240aa3fa5fbbc02560f7af0edc8 Mon Sep 17 00:00:00 2001 From: Jeremy Long Date: Fri, 13 Jan 2017 06:53:26 -0500 Subject: [PATCH] patch per issue#642 --- .../dependencycheck-base-suppression.xml | 16 +++++++ .../src/it/false-positives/invoker.properties | 19 +++++++++ .../src/it/false-positives/pom.xml | 34 +++++++++++++++ .../src/it/false-positives/postbuild.groovy | 42 +++++++++++++++++++ .../src/it/false-positives/prebuild.groovy | 28 +++++++++++++ 5 files changed, 139 insertions(+) create mode 100644 dependency-check-maven/src/it/false-positives/invoker.properties create mode 100644 dependency-check-maven/src/it/false-positives/pom.xml create mode 100644 dependency-check-maven/src/it/false-positives/postbuild.groovy create mode 100644 dependency-check-maven/src/it/false-positives/prebuild.groovy diff --git a/dependency-check-core/src/main/resources/dependencycheck-base-suppression.xml b/dependency-check-core/src/main/resources/dependencycheck-base-suppression.xml index 61041a9f1..5c29f5cba 100644 --- a/dependency-check-core/src/main/resources/dependencycheck-base-suppression.xml +++ b/dependency-check-core/src/main/resources/dependencycheck-base-suppression.xml @@ -474,4 +474,20 @@ com\.fasterxml\.jackson\.dataformat:jackson(?!\-dataformat\-xml).* CVE-2016-3720 + + + ^org\.springframework\.boot:spring-boot.*$ + cpe:/a:pivotal_software:spring_framework + cpe:/a:pivotal:spring_framework + cpe:/a:vmware:springsource_spring_framework + + + + ^org\.springframework:spring-context:.*$ + cpe:/a:context_project:context + diff --git a/dependency-check-maven/src/it/false-positives/invoker.properties b/dependency-check-maven/src/it/false-positives/invoker.properties new file mode 100644 index 000000000..3fc1810a0 --- /dev/null +++ b/dependency-check-maven/src/it/false-positives/invoker.properties @@ -0,0 +1,19 @@ +# +# This file is part of dependency-check-maven. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +# Copyright (c) 2014 Jeremy Long. All Rights Reserved. +# + +invoker.goals = install ${project.groupId}:${project.artifactId}:${project.version}:check -e -Dformat=ALL diff --git a/dependency-check-maven/src/it/false-positives/pom.xml b/dependency-check-maven/src/it/false-positives/pom.xml new file mode 100644 index 000000000..646ca1a47 --- /dev/null +++ b/dependency-check-maven/src/it/false-positives/pom.xml @@ -0,0 +1,34 @@ + + + + 4.0.0 + org.owasp.test + test-dataformat-jackson + 1.0.0-SNAPSHOT + jar + + + + org.springframework.boot + spring-boot + 1.4.3.RELEASE + + + + \ No newline at end of file diff --git a/dependency-check-maven/src/it/false-positives/postbuild.groovy b/dependency-check-maven/src/it/false-positives/postbuild.groovy new file mode 100644 index 000000000..4ce83a609 --- /dev/null +++ b/dependency-check-maven/src/it/false-positives/postbuild.groovy @@ -0,0 +1,42 @@ +/* + * This file is part of dependency-check-maven. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * + * Copyright (c) 2014 Jeremy Long. All Rights Reserved. + */ + +import org.apache.commons.io.FileUtils; +import org.apache.commons.lang.StringUtils; +import java.nio.charset.Charset; + +// Save NVD-CVE for next IT (if not already done) +File datasDwl = new File("target/local-repo/org/owasp/dependency-check-data/3.0", "dc.h2.db"); +File datasSave = new File("target/nvd-cve-backup", "dc.h2.db"); +if (datasDwl.exists() && !datasSave.exists()){ + System.out.println("Save NVD-CVE into backup"); + FileUtils.copyFile(datasDwl, datasSave); +} + + + + +// Check to see if jackson-dataformat-xml-2.4.5.jar was identified. +//TODO change this to xpath and check for CVE-2016-3720 +String log = FileUtils.readFileToString(new File(basedir, "target/dependency-check-report.xml"), Charset.defaultCharset().name()); +int count = StringUtils.countMatches(log, "CVE-2016-9878"); +if (count > 0){ + System.out.println(String.format("CVE-2016-9878 was identified and should be suppressed")); + return false; + //throw new Exception(String.format("The update should be unique, it is %s", count)); +} diff --git a/dependency-check-maven/src/it/false-positives/prebuild.groovy b/dependency-check-maven/src/it/false-positives/prebuild.groovy new file mode 100644 index 000000000..c1e9eda11 --- /dev/null +++ b/dependency-check-maven/src/it/false-positives/prebuild.groovy @@ -0,0 +1,28 @@ +/* + * This file is part of dependency-check-maven. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + * + * Copyright (c) 2014 Jeremy Long. All Rights Reserved. + */ + +import org.apache.commons.io.FileUtils; + +// Load NVD-CVE if not exist and had been saved in a previous IT +File datasDwl = new File("target/local-repo/org/owasp/dependency-check-data/3.0", "dc.h2.db"); +File datasSave = new File("target/nvd-cve-backup", "dc.h2.db"); + +if (!datasDwl.exists() && datasSave.exists()){ + System.out.println("Load NVD-CVE from backup"); + FileUtils.copyFile(datasSave, datasDwl); +}