mirror of
https://github.com/ysoftdevs/DependencyCheck.git
synced 2026-01-14 15:53:36 +01:00
moved dependency-check-gradle to a new repo
This commit is contained in:
Jeremy Long
13
dependency-check-gradle/.gitignore
vendored
13
dependency-check-gradle/.gitignore
vendored
@@ -1,13 +0,0 @@
|
||||
.idea/
|
||||
.gradle
|
||||
gradle/
|
||||
|
||||
*.iml
|
||||
*.ipr
|
||||
*.iws
|
||||
|
||||
out/
|
||||
build/
|
||||
|
||||
gradle-app.setting
|
||||
gradle.properties
|
||||
@@ -1,202 +0,0 @@
|
||||
|
||||
Apache License
|
||||
Version 2.0, January 2004
|
||||
http://www.apache.org/licenses/
|
||||
|
||||
TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
|
||||
|
||||
1. Definitions.
|
||||
|
||||
"License" shall mean the terms and conditions for use, reproduction,
|
||||
and distribution as defined by Sections 1 through 9 of this document.
|
||||
|
||||
"Licensor" shall mean the copyright owner or entity authorized by
|
||||
the copyright owner that is granting the License.
|
||||
|
||||
"Legal Entity" shall mean the union of the acting entity and all
|
||||
other entities that control, are controlled by, or are under common
|
||||
control with that entity. For the purposes of this definition,
|
||||
"control" means (i) the power, direct or indirect, to cause the
|
||||
direction or management of such entity, whether by contract or
|
||||
otherwise, or (ii) ownership of fifty percent (50%) or more of the
|
||||
outstanding shares, or (iii) beneficial ownership of such entity.
|
||||
|
||||
"You" (or "Your") shall mean an individual or Legal Entity
|
||||
exercising permissions granted by this License.
|
||||
|
||||
"Source" form shall mean the preferred form for making modifications,
|
||||
including but not limited to software source code, documentation
|
||||
source, and configuration files.
|
||||
|
||||
"Object" form shall mean any form resulting from mechanical
|
||||
transformation or translation of a Source form, including but
|
||||
not limited to compiled object code, generated documentation,
|
||||
and conversions to other media types.
|
||||
|
||||
"Work" shall mean the work of authorship, whether in Source or
|
||||
Object form, made available under the License, as indicated by a
|
||||
copyright notice that is included in or attached to the work
|
||||
(an example is provided in the Appendix below).
|
||||
|
||||
"Derivative Works" shall mean any work, whether in Source or Object
|
||||
form, that is based on (or derived from) the Work and for which the
|
||||
editorial revisions, annotations, elaborations, or other modifications
|
||||
represent, as a whole, an original work of authorship. For the purposes
|
||||
of this License, Derivative Works shall not include works that remain
|
||||
separable from, or merely link (or bind by name) to the interfaces of,
|
||||
the Work and Derivative Works thereof.
|
||||
|
||||
"Contribution" shall mean any work of authorship, including
|
||||
the original version of the Work and any modifications or additions
|
||||
to that Work or Derivative Works thereof, that is intentionally
|
||||
submitted to Licensor for inclusion in the Work by the copyright owner
|
||||
or by an individual or Legal Entity authorized to submit on behalf of
|
||||
the copyright owner. For the purposes of this definition, "submitted"
|
||||
means any form of electronic, verbal, or written communication sent
|
||||
to the Licensor or its representatives, including but not limited to
|
||||
communication on electronic mailing lists, source code control systems,
|
||||
and issue tracking systems that are managed by, or on behalf of, the
|
||||
Licensor for the purpose of discussing and improving the Work, but
|
||||
excluding communication that is conspicuously marked or otherwise
|
||||
designated in writing by the copyright owner as "Not a Contribution."
|
||||
|
||||
"Contributor" shall mean Licensor and any individual or Legal Entity
|
||||
on behalf of whom a Contribution has been received by Licensor and
|
||||
subsequently incorporated within the Work.
|
||||
|
||||
2. Grant of Copyright License. Subject to the terms and conditions of
|
||||
this License, each Contributor hereby grants to You a perpetual,
|
||||
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
|
||||
copyright license to reproduce, prepare Derivative Works of,
|
||||
publicly display, publicly perform, sublicense, and distribute the
|
||||
Work and such Derivative Works in Source or Object form.
|
||||
|
||||
3. Grant of Patent License. Subject to the terms and conditions of
|
||||
this License, each Contributor hereby grants to You a perpetual,
|
||||
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
|
||||
(except as stated in this section) patent license to make, have made,
|
||||
use, offer to sell, sell, import, and otherwise transfer the Work,
|
||||
where such license applies only to those patent claims licensable
|
||||
by such Contributor that are necessarily infringed by their
|
||||
Contribution(s) alone or by combination of their Contribution(s)
|
||||
with the Work to which such Contribution(s) was submitted. If You
|
||||
institute patent litigation against any entity (including a
|
||||
cross-claim or counterclaim in a lawsuit) alleging that the Work
|
||||
or a Contribution incorporated within the Work constitutes direct
|
||||
or contributory patent infringement, then any patent licenses
|
||||
granted to You under this License for that Work shall terminate
|
||||
as of the date such litigation is filed.
|
||||
|
||||
4. Redistribution. You may reproduce and distribute copies of the
|
||||
Work or Derivative Works thereof in any medium, with or without
|
||||
modifications, and in Source or Object form, provided that You
|
||||
meet the following conditions:
|
||||
|
||||
(a) You must give any other recipients of the Work or
|
||||
Derivative Works a copy of this License; and
|
||||
|
||||
(b) You must cause any modified files to carry prominent notices
|
||||
stating that You changed the files; and
|
||||
|
||||
(c) You must retain, in the Source form of any Derivative Works
|
||||
that You distribute, all copyright, patent, trademark, and
|
||||
attribution notices from the Source form of the Work,
|
||||
excluding those notices that do not pertain to any part of
|
||||
the Derivative Works; and
|
||||
|
||||
(d) If the Work includes a "NOTICE" text file as part of its
|
||||
distribution, then any Derivative Works that You distribute must
|
||||
include a readable copy of the attribution notices contained
|
||||
within such NOTICE file, excluding those notices that do not
|
||||
pertain to any part of the Derivative Works, in at least one
|
||||
of the following places: within a NOTICE text file distributed
|
||||
as part of the Derivative Works; within the Source form or
|
||||
documentation, if provided along with the Derivative Works; or,
|
||||
within a display generated by the Derivative Works, if and
|
||||
wherever such third-party notices normally appear. The contents
|
||||
of the NOTICE file are for informational purposes only and
|
||||
do not modify the License. You may add Your own attribution
|
||||
notices within Derivative Works that You distribute, alongside
|
||||
or as an addendum to the NOTICE text from the Work, provided
|
||||
that such additional attribution notices cannot be construed
|
||||
as modifying the License.
|
||||
|
||||
You may add Your own copyright statement to Your modifications and
|
||||
may provide additional or different license terms and conditions
|
||||
for use, reproduction, or distribution of Your modifications, or
|
||||
for any such Derivative Works as a whole, provided Your use,
|
||||
reproduction, and distribution of the Work otherwise complies with
|
||||
the conditions stated in this License.
|
||||
|
||||
5. Submission of Contributions. Unless You explicitly state otherwise,
|
||||
any Contribution intentionally submitted for inclusion in the Work
|
||||
by You to the Licensor shall be under the terms and conditions of
|
||||
this License, without any additional terms or conditions.
|
||||
Notwithstanding the above, nothing herein shall supersede or modify
|
||||
the terms of any separate license agreement you may have executed
|
||||
with Licensor regarding such Contributions.
|
||||
|
||||
6. Trademarks. This License does not grant permission to use the trade
|
||||
names, trademarks, service marks, or product names of the Licensor,
|
||||
except as required for reasonable and customary use in describing the
|
||||
origin of the Work and reproducing the content of the NOTICE file.
|
||||
|
||||
7. Disclaimer of Warranty. Unless required by applicable law or
|
||||
agreed to in writing, Licensor provides the Work (and each
|
||||
Contributor provides its Contributions) on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
|
||||
implied, including, without limitation, any warranties or conditions
|
||||
of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
|
||||
PARTICULAR PURPOSE. You are solely responsible for determining the
|
||||
appropriateness of using or redistributing the Work and assume any
|
||||
risks associated with Your exercise of permissions under this License.
|
||||
|
||||
8. Limitation of Liability. In no event and under no legal theory,
|
||||
whether in tort (including negligence), contract, or otherwise,
|
||||
unless required by applicable law (such as deliberate and grossly
|
||||
negligent acts) or agreed to in writing, shall any Contributor be
|
||||
liable to You for damages, including any direct, indirect, special,
|
||||
incidental, or consequential damages of any character arising as a
|
||||
result of this License or out of the use or inability to use the
|
||||
Work (including but not limited to damages for loss of goodwill,
|
||||
work stoppage, computer failure or malfunction, or any and all
|
||||
other commercial damages or losses), even if such Contributor
|
||||
has been advised of the possibility of such damages.
|
||||
|
||||
9. Accepting Warranty or Additional Liability. While redistributing
|
||||
the Work or Derivative Works thereof, You may choose to offer,
|
||||
and charge a fee for, acceptance of support, warranty, indemnity,
|
||||
or other liability obligations and/or rights consistent with this
|
||||
License. However, in accepting such obligations, You may act only
|
||||
on Your own behalf and on Your sole responsibility, not on behalf
|
||||
of any other Contributor, and only if You agree to indemnify,
|
||||
defend, and hold each Contributor harmless for any liability
|
||||
incurred by, or claims asserted against, such Contributor by reason
|
||||
of your accepting any such warranty or additional liability.
|
||||
|
||||
END OF TERMS AND CONDITIONS
|
||||
|
||||
APPENDIX: How to apply the Apache License to your work.
|
||||
|
||||
To apply the Apache License to your work, attach the following
|
||||
boilerplate notice, with the fields enclosed by brackets "[]"
|
||||
replaced with your own identifying information. (Don't include
|
||||
the brackets!) The text should be enclosed in the appropriate
|
||||
comment syntax for the file format. We also recommend that a
|
||||
file or class name and description of purpose be included on the
|
||||
same "printed page" as the copyright notice for easier
|
||||
identification within third-party archives.
|
||||
|
||||
Copyright [yyyy] [name of copyright owner]
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
@@ -1,11 +0,0 @@
|
||||
dependency-check-gradle
|
||||
|
||||
Copyright (c) 2015 Wei Ma. All Rights Reserved.
|
||||
|
||||
The licenses for the software listed below can be found in the META-INF/licenses/[dependency name].
|
||||
|
||||
This product includes software developed by The Apache Software Foundation (http://www.apache.org/).
|
||||
|
||||
This product includes data from the Common Weakness Enumeration (CWE): http://cwe.mitre.org/
|
||||
|
||||
This product downloads and utilizes data from the National Vulnerability Database hosted by NIST: http://nvd.nist.gov/download.cfm
|
||||
@@ -1,131 +0,0 @@
|
||||
Dependency-Check-Gradle
|
||||
=========
|
||||
|
||||
The dependency-check gradle plugin allows projects to monitor dependent libraries for
|
||||
known, published vulnerabilities.
|
||||
|
||||
=========
|
||||
|
||||
## What's New
|
||||
Current latest version is `0.0.8`
|
||||
|
||||
## Usage
|
||||
|
||||
### Step 1, Apply dependency check gradle plugin
|
||||
|
||||
Install from Maven central repo
|
||||
|
||||
```groovy
|
||||
buildscript {
|
||||
repositories {
|
||||
mavenCentral()
|
||||
}
|
||||
dependencies {
|
||||
classpath 'org.owasp:dependency-check-gradle:1.3.2'
|
||||
}
|
||||
}
|
||||
|
||||
apply plugin: 'dependency-check-gradle'
|
||||
```
|
||||
|
||||
### Step 2, Run gradle task
|
||||
|
||||
Once gradle plugin applied, run following gradle task to check dependencies:
|
||||
|
||||
```
|
||||
gradle dependencyCheck --info
|
||||
```
|
||||
|
||||
The reports will be generated automatically under `./reports` folder.
|
||||
|
||||
If your project includes multiple sub-projects, the report will be generated for each sub-project in different sub-directory.
|
||||
|
||||
## FAQ
|
||||
|
||||
> **Questions List:**
|
||||
> - What if I'm behind a proxy?
|
||||
> - What if my project includes multiple sub-project? How can I use this plugin for each of them including the root project?
|
||||
> - How to customize the report directory?
|
||||
|
||||
### What if I'm behind a proxy?
|
||||
|
||||
Maybe you have to use proxy to access internet, in this case, you could configure proxy settings for this plugin:
|
||||
|
||||
```groovy
|
||||
dependencyCheck {
|
||||
proxy {
|
||||
server = "127.0.0.1" // required, the server name or IP address of the proxy
|
||||
port = 3128 // required, the port number of the proxy
|
||||
|
||||
// optional, the proxy server might require username
|
||||
// username = "username"
|
||||
|
||||
// optional, the proxy server might require password
|
||||
// password = "password"
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
In addition, if the proxy only allow HTTP `GET` or `POST` methods, you will find that the update process will always fail,
|
||||
the root cause is that every time you run `dependencyCheck` task, it will try to query the latest timestamp to determine whether need to perform an update action,
|
||||
and for performance reason the HTTP method it uses by default is `HEAD`, which probably is disabled or not supported by the proxy. To avoid this problem, you can simply change the HTTP method by below configuration:
|
||||
|
||||
```groovy
|
||||
dependencyCheck {
|
||||
quickQueryTimestamp = false // when set to false, it means use HTTP GET method to query timestamp. (default value is true)
|
||||
}
|
||||
```
|
||||
|
||||
### What if my project includes multiple sub-project? How can I use this plugin for each of them including the root project?
|
||||
|
||||
Try put 'apply plugin: "dependency-check"' inside the 'allprojects' or 'subprojects' if you'd like to check all sub-projects only, see below:
|
||||
|
||||
(1) For all projects including root project:
|
||||
|
||||
```groovy
|
||||
buildscript {
|
||||
repositories {
|
||||
mavenCentral()
|
||||
}
|
||||
dependencies {
|
||||
classpath "gradle.plugin.com.tools.security:dependency-check:0.0.8"
|
||||
}
|
||||
}
|
||||
|
||||
allprojects {
|
||||
apply plugin: "dependency-check"
|
||||
}
|
||||
```
|
||||
|
||||
(2) For all sub-projects:
|
||||
|
||||
```groovy
|
||||
buildscript {
|
||||
repositories {
|
||||
mavenCentral()
|
||||
}
|
||||
dependencies {
|
||||
classpath "gradle.plugin.com.tools.security:dependency-check:0.0.8"
|
||||
}
|
||||
}
|
||||
|
||||
subprojects {
|
||||
apply plugin: "dependency-check"
|
||||
}
|
||||
```
|
||||
|
||||
In this way, the dependency check will be executed for all projects (including root project) or just sub projects.
|
||||
|
||||
### How to customize the report directory?
|
||||
|
||||
By default, all reports will be placed under `./reports` folder, to change the default directory, just modify it in the configuration section like this:
|
||||
|
||||
```groovy
|
||||
subprojects {
|
||||
apply plugin: "dependency-check"
|
||||
|
||||
dependencyCheck {
|
||||
outputDirectory = "./customized-path/security-report"
|
||||
}
|
||||
}
|
||||
```
|
||||
@@ -1,86 +0,0 @@
|
||||
/*
|
||||
* This file is part of dependency-check-gradle.
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
* Copyright (c) 2015 Wei Ma. All Rights Reserved.
|
||||
*/
|
||||
|
||||
|
||||
group = 'org.owasp'
|
||||
version = '1.3.2-SNAPSHOT'
|
||||
|
||||
buildscript {
|
||||
repositories {
|
||||
maven {
|
||||
url "https://plugins.gradle.org/m2/"
|
||||
}
|
||||
}
|
||||
|
||||
dependencies {
|
||||
classpath "com.gradle.publish:plugin-publish-plugin:0.9.0"
|
||||
}
|
||||
}
|
||||
/*
|
||||
plugins {
|
||||
id 'nu.studer.plugindev' version '1.0.3'
|
||||
}*/
|
||||
|
||||
apply plugin: 'idea'
|
||||
apply plugin: 'groovy'
|
||||
apply plugin: 'maven'
|
||||
apply plugin: 'signing'
|
||||
apply plugin: "com.gradle.plugin-publish"
|
||||
|
||||
sourceCompatibility = 1.6
|
||||
targetCompatibility = 1.6
|
||||
|
||||
repositories {
|
||||
mavenCentral()
|
||||
mavenLocal()
|
||||
}
|
||||
|
||||
dependencies {
|
||||
compile(
|
||||
localGroovy(),
|
||||
gradleApi(),
|
||||
'org.owasp:dependency-check-core:1.3.2-SNAPSHOT',
|
||||
'org.owasp:dependency-check-utils:1.3.2-SNAPSHOT'
|
||||
)
|
||||
|
||||
testCompile ('com.netflix.nebula:nebula-test:2.2.2'){
|
||||
exclude group: 'org.codehaus.groovy'
|
||||
}
|
||||
}
|
||||
|
||||
sourceSets {
|
||||
integTest {
|
||||
groovy.srcDir file('src/integTest/groovy')
|
||||
resources.srcDir file('src/integTest/resources')
|
||||
compileClasspath = sourceSets.main.output + configurations.testRuntime
|
||||
runtimeClasspath = output + compileClasspath
|
||||
}
|
||||
}
|
||||
|
||||
task integTest(type: Test) {
|
||||
group = 'verification'
|
||||
testClassesDir = sourceSets.integTest.output.classesDir
|
||||
classpath = sourceSets.integTest.runtimeClasspath
|
||||
reports.html.destination = file("$buildDir/reports/integ")
|
||||
jvmArgs '-XX:MaxPermSize=256m'
|
||||
}
|
||||
|
||||
apply from: 'conf/publish/local.gradle'
|
||||
//apply from: 'conf/publish/maven.gradle'
|
||||
//apply from: 'conf/publish/gradlePluginsPortal.gradle'
|
||||
//apply from: 'conf/publish/bintray.gradle' // according to the documentation of plugindev, this line has to be placed and the very end of the build file
|
||||
@@ -1,41 +0,0 @@
|
||||
/*
|
||||
* This file is part of dependency-check-gradle.
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
* Copyright (c) 2015 Wei Ma. All Rights Reserved.
|
||||
*/
|
||||
|
||||
// publish to Bintray
|
||||
plugindev {
|
||||
pluginId = 'dependency.check'
|
||||
pluginName = 'dependency-check'
|
||||
pluginImplementationClass 'com.tools.security.plugin.DependencyCheckGradlePlugin'
|
||||
pluginDescription 'This is dependency check gradle plugin.'
|
||||
pluginLicenses 'Apache-2.0'
|
||||
pluginTags 'dependency check', 'security'
|
||||
authorId 'wmaintw'
|
||||
authorName 'Wei Ma'
|
||||
authorEmail 'wma@thoughtworks.com'
|
||||
projectUrl 'https://github.com/wmaintw/DependencyCheck'
|
||||
projectIssuesUrl 'https://github.com/wmaintw/DependencyCheck/issues'
|
||||
projectVcsUrl 'git@github.com:wmaintw/DependencyCheck.git'
|
||||
projectInceptionYear '2015'
|
||||
done()
|
||||
}
|
||||
|
||||
bintray {
|
||||
user = bintrayUser
|
||||
key = bintrayUserKey
|
||||
pkg.repo = bintrayRepo
|
||||
}
|
||||
@@ -1,32 +0,0 @@
|
||||
/*
|
||||
* This file is part of dependency-check-gradle.
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
* Copyright (c) 2015 Wei Ma. All Rights Reserved.
|
||||
*/
|
||||
|
||||
// publish to gradle plugin portal
|
||||
pluginBundle {
|
||||
website = 'https://github.com/wmaintw/DependencyCheck'
|
||||
vcsUrl = 'git@github.com:wmaintw/DependencyCheck.git'
|
||||
description = 'This is dependency check gradle plugin.'
|
||||
tags = ['dependency check', 'security']
|
||||
|
||||
plugins {
|
||||
dependencyCheckPlugin {
|
||||
id = 'dependency.check'
|
||||
displayName = 'dependency-check'
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,26 +0,0 @@
|
||||
/*
|
||||
* This file is part of dependency-check-gradle.
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
* Copyright (c) 2015 Wei Ma. All Rights Reserved.
|
||||
*/
|
||||
|
||||
//Local debug use only
|
||||
uploadArchives {
|
||||
repositories {
|
||||
mavenDeployer {
|
||||
repository(url: uri('../../../repo'))
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,85 +0,0 @@
|
||||
/*
|
||||
* This file is part of dependency-check-gradle.
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
* Copyright (c) 2015 Wei Ma. All Rights Reserved.
|
||||
*/
|
||||
|
||||
//upload to maven central
|
||||
uploadArchives {
|
||||
repositories {
|
||||
mavenDeployer {
|
||||
beforeDeployment { MavenDeployment deployment -> signing.signPom(deployment) }
|
||||
|
||||
repository(url: "https://oss.sonatype.org/service/local/staging/deploy/maven2/") {
|
||||
authentication(userName: sonatypeUsername, password: sonatypePassword)
|
||||
}
|
||||
|
||||
snapshotRepository(url: "https://oss.sonatype.org/content/repositories/snapshots/") {
|
||||
authentication(userName: sonatypeUsername, password: sonatypePassword)
|
||||
}
|
||||
|
||||
pom.project {
|
||||
name 'Dependency Check Gradle Plugin'
|
||||
packaging 'jar'
|
||||
description 'Dependency-Check is a utility that attempts to detect publicly disclosed vulnerabilities contained within project dependencies.'
|
||||
url 'https://github.com/wmaintw/DependencyCheck/tree/master/dependency-check-gradle'
|
||||
|
||||
scm {
|
||||
connection 'git@github.com:wmaintw/DependencyCheck.git'
|
||||
developerConnection 'git@github.com:wmaintw/DependencyCheck.git'
|
||||
url 'https://github.com/wmaintw/DependencyCheck'
|
||||
}
|
||||
|
||||
licenses {
|
||||
license {
|
||||
name 'The Apache License, Version 2.0'
|
||||
url 'http://www.apache.org/licenses/LICENSE-2.0.txt'
|
||||
}
|
||||
}
|
||||
|
||||
developers {
|
||||
developer {
|
||||
id 'jeremylong'
|
||||
name 'Jeremy Long'
|
||||
email 'jeremy.long@owasp.org'
|
||||
}
|
||||
developer {
|
||||
id 'wmaintw'
|
||||
name 'Wei Ma'
|
||||
email 'wma@thoughtworks.com'
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
task javadocJar(type: Jar) {
|
||||
classifier = 'javadoc'
|
||||
from javadoc
|
||||
}
|
||||
|
||||
task sourcesJar(type: Jar, dependsOn: classes) {
|
||||
classifier = 'sources'
|
||||
from sourceSets.main.allSource
|
||||
}
|
||||
|
||||
artifacts {
|
||||
archives javadocJar, sourcesJar
|
||||
}
|
||||
|
||||
signing {
|
||||
sign configurations.archives
|
||||
}
|
||||
164
dependency-check-gradle/gradlew
vendored
164
dependency-check-gradle/gradlew
vendored
@@ -1,164 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
|
||||
##############################################################################
|
||||
##
|
||||
## Gradle start up script for UN*X
|
||||
##
|
||||
##############################################################################
|
||||
|
||||
# Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
|
||||
DEFAULT_JVM_OPTS=""
|
||||
|
||||
APP_NAME="Gradle"
|
||||
APP_BASE_NAME=`basename "$0"`
|
||||
|
||||
# Use the maximum available, or set MAX_FD != -1 to use that value.
|
||||
MAX_FD="maximum"
|
||||
|
||||
warn ( ) {
|
||||
echo "$*"
|
||||
}
|
||||
|
||||
die ( ) {
|
||||
echo
|
||||
echo "$*"
|
||||
echo
|
||||
exit 1
|
||||
}
|
||||
|
||||
# OS specific support (must be 'true' or 'false').
|
||||
cygwin=false
|
||||
msys=false
|
||||
darwin=false
|
||||
case "`uname`" in
|
||||
CYGWIN* )
|
||||
cygwin=true
|
||||
;;
|
||||
Darwin* )
|
||||
darwin=true
|
||||
;;
|
||||
MINGW* )
|
||||
msys=true
|
||||
;;
|
||||
esac
|
||||
|
||||
# For Cygwin, ensure paths are in UNIX format before anything is touched.
|
||||
if $cygwin ; then
|
||||
[ -n "$JAVA_HOME" ] && JAVA_HOME=`cygpath --unix "$JAVA_HOME"`
|
||||
fi
|
||||
|
||||
# Attempt to set APP_HOME
|
||||
# Resolve links: $0 may be a link
|
||||
PRG="$0"
|
||||
# Need this for relative symlinks.
|
||||
while [ -h "$PRG" ] ; do
|
||||
ls=`ls -ld "$PRG"`
|
||||
link=`expr "$ls" : '.*-> \(.*\)$'`
|
||||
if expr "$link" : '/.*' > /dev/null; then
|
||||
PRG="$link"
|
||||
else
|
||||
PRG=`dirname "$PRG"`"/$link"
|
||||
fi
|
||||
done
|
||||
SAVED="`pwd`"
|
||||
cd "`dirname \"$PRG\"`/" >&-
|
||||
APP_HOME="`pwd -P`"
|
||||
cd "$SAVED" >&-
|
||||
|
||||
CLASSPATH=$APP_HOME/gradle/wrapper/gradle-wrapper.jar
|
||||
|
||||
# Determine the Java command to use to start the JVM.
|
||||
if [ -n "$JAVA_HOME" ] ; then
|
||||
if [ -x "$JAVA_HOME/jre/sh/java" ] ; then
|
||||
# IBM's JDK on AIX uses strange locations for the executables
|
||||
JAVACMD="$JAVA_HOME/jre/sh/java"
|
||||
else
|
||||
JAVACMD="$JAVA_HOME/bin/java"
|
||||
fi
|
||||
if [ ! -x "$JAVACMD" ] ; then
|
||||
die "ERROR: JAVA_HOME is set to an invalid directory: $JAVA_HOME
|
||||
|
||||
Please set the JAVA_HOME variable in your environment to match the
|
||||
location of your Java installation."
|
||||
fi
|
||||
else
|
||||
JAVACMD="java"
|
||||
which java >/dev/null 2>&1 || die "ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
|
||||
|
||||
Please set the JAVA_HOME variable in your environment to match the
|
||||
location of your Java installation."
|
||||
fi
|
||||
|
||||
# Increase the maximum file descriptors if we can.
|
||||
if [ "$cygwin" = "false" -a "$darwin" = "false" ] ; then
|
||||
MAX_FD_LIMIT=`ulimit -H -n`
|
||||
if [ $? -eq 0 ] ; then
|
||||
if [ "$MAX_FD" = "maximum" -o "$MAX_FD" = "max" ] ; then
|
||||
MAX_FD="$MAX_FD_LIMIT"
|
||||
fi
|
||||
ulimit -n $MAX_FD
|
||||
if [ $? -ne 0 ] ; then
|
||||
warn "Could not set maximum file descriptor limit: $MAX_FD"
|
||||
fi
|
||||
else
|
||||
warn "Could not query maximum file descriptor limit: $MAX_FD_LIMIT"
|
||||
fi
|
||||
fi
|
||||
|
||||
# For Darwin, add options to specify how the application appears in the dock
|
||||
if $darwin; then
|
||||
GRADLE_OPTS="$GRADLE_OPTS \"-Xdock:name=$APP_NAME\" \"-Xdock:icon=$APP_HOME/media/gradle.icns\""
|
||||
fi
|
||||
|
||||
# For Cygwin, switch paths to Windows format before running java
|
||||
if $cygwin ; then
|
||||
APP_HOME=`cygpath --path --mixed "$APP_HOME"`
|
||||
CLASSPATH=`cygpath --path --mixed "$CLASSPATH"`
|
||||
|
||||
# We build the pattern for arguments to be converted via cygpath
|
||||
ROOTDIRSRAW=`find -L / -maxdepth 1 -mindepth 1 -type d 2>/dev/null`
|
||||
SEP=""
|
||||
for dir in $ROOTDIRSRAW ; do
|
||||
ROOTDIRS="$ROOTDIRS$SEP$dir"
|
||||
SEP="|"
|
||||
done
|
||||
OURCYGPATTERN="(^($ROOTDIRS))"
|
||||
# Add a user-defined pattern to the cygpath arguments
|
||||
if [ "$GRADLE_CYGPATTERN" != "" ] ; then
|
||||
OURCYGPATTERN="$OURCYGPATTERN|($GRADLE_CYGPATTERN)"
|
||||
fi
|
||||
# Now convert the arguments - kludge to limit ourselves to /bin/sh
|
||||
i=0
|
||||
for arg in "$@" ; do
|
||||
CHECK=`echo "$arg"|egrep -c "$OURCYGPATTERN" -`
|
||||
CHECK2=`echo "$arg"|egrep -c "^-"` ### Determine if an option
|
||||
|
||||
if [ $CHECK -ne 0 ] && [ $CHECK2 -eq 0 ] ; then ### Added a condition
|
||||
eval `echo args$i`=`cygpath --path --ignore --mixed "$arg"`
|
||||
else
|
||||
eval `echo args$i`="\"$arg\""
|
||||
fi
|
||||
i=$((i+1))
|
||||
done
|
||||
case $i in
|
||||
(0) set -- ;;
|
||||
(1) set -- "$args0" ;;
|
||||
(2) set -- "$args0" "$args1" ;;
|
||||
(3) set -- "$args0" "$args1" "$args2" ;;
|
||||
(4) set -- "$args0" "$args1" "$args2" "$args3" ;;
|
||||
(5) set -- "$args0" "$args1" "$args2" "$args3" "$args4" ;;
|
||||
(6) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" ;;
|
||||
(7) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" "$args6" ;;
|
||||
(8) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" "$args6" "$args7" ;;
|
||||
(9) set -- "$args0" "$args1" "$args2" "$args3" "$args4" "$args5" "$args6" "$args7" "$args8" ;;
|
||||
esac
|
||||
fi
|
||||
|
||||
# Split up the JVM_OPTS And GRADLE_OPTS values into an array, following the shell quoting and substitution rules
|
||||
function splitJvmOpts() {
|
||||
JVM_OPTS=("$@")
|
||||
}
|
||||
eval splitJvmOpts $DEFAULT_JVM_OPTS $JAVA_OPTS $GRADLE_OPTS
|
||||
JVM_OPTS[${#JVM_OPTS[*]}]="-Dorg.gradle.appname=$APP_BASE_NAME"
|
||||
|
||||
exec "$JAVACMD" "${JVM_OPTS[@]}" -classpath "$CLASSPATH" org.gradle.wrapper.GradleWrapperMain "$@"
|
||||
90
dependency-check-gradle/gradlew.bat
vendored
90
dependency-check-gradle/gradlew.bat
vendored
@@ -1,90 +0,0 @@
|
||||
@if "%DEBUG%" == "" @echo off
|
||||
@rem ##########################################################################
|
||||
@rem
|
||||
@rem Gradle startup script for Windows
|
||||
@rem
|
||||
@rem ##########################################################################
|
||||
|
||||
@rem Set local scope for the variables with windows NT shell
|
||||
if "%OS%"=="Windows_NT" setlocal
|
||||
|
||||
@rem Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
|
||||
set DEFAULT_JVM_OPTS=
|
||||
|
||||
set DIRNAME=%~dp0
|
||||
if "%DIRNAME%" == "" set DIRNAME=.
|
||||
set APP_BASE_NAME=%~n0
|
||||
set APP_HOME=%DIRNAME%
|
||||
|
||||
@rem Find java.exe
|
||||
if defined JAVA_HOME goto findJavaFromJavaHome
|
||||
|
||||
set JAVA_EXE=java.exe
|
||||
%JAVA_EXE% -version >NUL 2>&1
|
||||
if "%ERRORLEVEL%" == "0" goto init
|
||||
|
||||
echo.
|
||||
echo ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
|
||||
echo.
|
||||
echo Please set the JAVA_HOME variable in your environment to match the
|
||||
echo location of your Java installation.
|
||||
|
||||
goto fail
|
||||
|
||||
:findJavaFromJavaHome
|
||||
set JAVA_HOME=%JAVA_HOME:"=%
|
||||
set JAVA_EXE=%JAVA_HOME%/bin/java.exe
|
||||
|
||||
if exist "%JAVA_EXE%" goto init
|
||||
|
||||
echo.
|
||||
echo ERROR: JAVA_HOME is set to an invalid directory: %JAVA_HOME%
|
||||
echo.
|
||||
echo Please set the JAVA_HOME variable in your environment to match the
|
||||
echo location of your Java installation.
|
||||
|
||||
goto fail
|
||||
|
||||
:init
|
||||
@rem Get command-line arguments, handling Windowz variants
|
||||
|
||||
if not "%OS%" == "Windows_NT" goto win9xME_args
|
||||
if "%@eval[2+2]" == "4" goto 4NT_args
|
||||
|
||||
:win9xME_args
|
||||
@rem Slurp the command line arguments.
|
||||
set CMD_LINE_ARGS=
|
||||
set _SKIP=2
|
||||
|
||||
:win9xME_args_slurp
|
||||
if "x%~1" == "x" goto execute
|
||||
|
||||
set CMD_LINE_ARGS=%*
|
||||
goto execute
|
||||
|
||||
:4NT_args
|
||||
@rem Get arguments from the 4NT Shell from JP Software
|
||||
set CMD_LINE_ARGS=%$
|
||||
|
||||
:execute
|
||||
@rem Setup the command line
|
||||
|
||||
set CLASSPATH=%APP_HOME%\gradle\wrapper\gradle-wrapper.jar
|
||||
|
||||
@rem Execute Gradle
|
||||
"%JAVA_EXE%" %DEFAULT_JVM_OPTS% %JAVA_OPTS% %GRADLE_OPTS% "-Dorg.gradle.appname=%APP_BASE_NAME%" -classpath "%CLASSPATH%" org.gradle.wrapper.GradleWrapperMain %CMD_LINE_ARGS%
|
||||
|
||||
:end
|
||||
@rem End local scope for the variables with windows NT shell
|
||||
if "%ERRORLEVEL%"=="0" goto mainEnd
|
||||
|
||||
:fail
|
||||
rem Set variable GRADLE_EXIT_CONSOLE if you need the _script_ return code instead of
|
||||
rem the _cmd.exe /c_ return code!
|
||||
if not "" == "%GRADLE_EXIT_CONSOLE%" exit 1
|
||||
exit /b 1
|
||||
|
||||
:mainEnd
|
||||
if "%OS%"=="Windows_NT" endlocal
|
||||
|
||||
:omega
|
||||
@@ -1,70 +0,0 @@
|
||||
<!--
|
||||
This file is part of dependency-check-gradle.
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
|
||||
Copyright (c) 2015 Wei Ma. All Rights Reserved.
|
||||
-->
|
||||
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd">
|
||||
<modelVersion>4.0.0</modelVersion>
|
||||
<url>http://maven.apache.org</url>
|
||||
|
||||
<parent>
|
||||
<groupId>org.owasp</groupId>
|
||||
<artifactId>dependency-check-parent</artifactId>
|
||||
<version>1.3.2-SNAPSHOT</version>
|
||||
</parent>
|
||||
|
||||
<artifactId>dependency-check-gradle</artifactId>
|
||||
<version>0.0.8</version>
|
||||
<!-- we must use gradle to build this, as such the packaging is pom -->
|
||||
<packaging>pom</packaging>
|
||||
|
||||
<name>Dependency-Check Gradle Plugin</name>
|
||||
<description>dependency-check-gradle is a Gradle Plugin that uses dependency-check-core to detect publicly disclosed vulnerabilities associated with the project's dependencies. The plugin will generate a report listing the dependency, any identified Common Platform Enumeration (CPE) identifiers, and the associated Common Vulnerability and Exposure (CVE) entries.</description>
|
||||
<inceptionYear>2015</inceptionYear>
|
||||
|
||||
<!-- begin copy from http://minds.coremedia.com/2012/09/11/problem-solved-deploy-multi-module-maven-project-site-as-github-pages/ -->
|
||||
<distributionManagement>
|
||||
<site>
|
||||
<id>github-pages-site</id>
|
||||
<name>Deployment through GitHub's site deployment plugin</name>
|
||||
<url>${basedir}/../target/site/dependency-check-gradle</url>
|
||||
</site>
|
||||
</distributionManagement>
|
||||
<properties>
|
||||
<!-- Skip the surefire report since there are no tests... -->
|
||||
<skipSurefireReport>true</skipSurefireReport>
|
||||
<!-- Skip the versions report since there are no dependencies... -->
|
||||
<versions.skip>true</versions.skip>
|
||||
</properties>
|
||||
<!-- end copy -->
|
||||
<build>
|
||||
<plugins>
|
||||
<plugin>
|
||||
<groupId>org.apache.maven.plugins</groupId>
|
||||
<artifactId>maven-site-plugin</artifactId>
|
||||
<dependencies>
|
||||
<dependency>
|
||||
<groupId>org.apache.maven.doxia</groupId>
|
||||
<artifactId>doxia-module-markdown</artifactId>
|
||||
<version>1.6</version>
|
||||
</dependency>
|
||||
</dependencies>
|
||||
<configuration>
|
||||
<skipDeploy>true</skipDeploy>
|
||||
</configuration>
|
||||
</plugin>
|
||||
</plugins>
|
||||
</build>
|
||||
</project>
|
||||
@@ -1,19 +0,0 @@
|
||||
/*
|
||||
* This file is part of dependency-check-gradle.
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
* Copyright (c) 2015 Wei Ma. All Rights Reserved.
|
||||
*/
|
||||
|
||||
rootProject.name = 'dependency-check-gradle'
|
||||
@@ -1,34 +0,0 @@
|
||||
package com.tools.security.plugin
|
||||
|
||||
import nebula.test.IntegrationSpec
|
||||
import nebula.test.functional.ExecutionResult
|
||||
|
||||
/**
|
||||
* @author Sion Williams
|
||||
*/
|
||||
class DependencyCheckGradlePluginIntegSpec extends IntegrationSpec {
|
||||
def "I can add the plugin to a build with no errors"() {
|
||||
setup:
|
||||
buildFile << '''
|
||||
apply plugin: 'dependencyCheck'
|
||||
'''.stripIndent()
|
||||
|
||||
when:
|
||||
ExecutionResult result = runTasksSuccessfully('tasks')
|
||||
|
||||
then:
|
||||
result.standardOutput.contains('dependencyCheck - Produce dependency security report.')
|
||||
}
|
||||
|
||||
def "I can override outputDir with extension"() {
|
||||
setup:
|
||||
writeHelloWorld('com.example')
|
||||
copyResources('outputDir.gradle', 'build.gradle')
|
||||
|
||||
when:
|
||||
runTasksSuccessfully('dependencyCheck')
|
||||
|
||||
then:
|
||||
fileExists('build/dependencyCheckReport')
|
||||
}
|
||||
}
|
||||
@@ -1,21 +0,0 @@
|
||||
/**
|
||||
* Build file to exercise dependency check
|
||||
* @author Sion Williams
|
||||
*/
|
||||
apply plugin: 'java'
|
||||
apply plugin: 'dependencyCheck'
|
||||
|
||||
sourceCompatibility = 1.5
|
||||
version = '1.0'
|
||||
|
||||
repositories {
|
||||
mavenCentral()
|
||||
}
|
||||
|
||||
dependencies {
|
||||
compile group: 'commons-collections', name: 'commons-collections', version: '3.2'
|
||||
}
|
||||
|
||||
dependencyCheck {
|
||||
reportsDirName = "reports"
|
||||
}
|
||||
@@ -1,100 +0,0 @@
|
||||
/*
|
||||
* This file is part of dependency-check-gradle.
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
* Copyright (c) 2015 Jeremy Long. All Rights Reserved.
|
||||
*/
|
||||
|
||||
package com.tools.security.extension
|
||||
|
||||
/**
|
||||
* The analyzer configuration extension. Any value not configured will use the dependency-check-core defaults.
|
||||
*/
|
||||
class AnalyzerExtension {
|
||||
|
||||
/**
|
||||
* Sets whether the Archive Analyzer will be used.
|
||||
*/
|
||||
Boolean archiveEnabled
|
||||
/**
|
||||
* A comma-separated list of additional file extensions to be treated like a ZIP file, the contents will be extracted and analyzed.
|
||||
*/
|
||||
String zipExtensions
|
||||
/**
|
||||
* Sets whether Jar Analyzer will be used.
|
||||
*/
|
||||
Boolean jarEnabled
|
||||
/**
|
||||
* Sets whether Central Analyzer will be used. If this analyzer is being disabled there is a good chance you also want to disable the Nexus Analyzer (see below).
|
||||
*/
|
||||
Boolean centralEnabled
|
||||
/**
|
||||
* Sets whether Nexus Analyzer will be used. This analyzer is superceded by the Central Analyzer; however, you can configure this to run against a Nexus Pro installation.
|
||||
*/
|
||||
Boolean nexusEnabled
|
||||
/**
|
||||
* Defines the Nexus Server's web service end point (example http://domain.enterprise/service/local/). If not set the Nexus Analyzer will be disabled.
|
||||
*/
|
||||
String nexusUrl
|
||||
/**
|
||||
* Whether or not the defined proxy should be used when connecting to Nexus.
|
||||
*/
|
||||
Boolean nexusUsesProxy
|
||||
/**
|
||||
* Sets whether or not the .NET Nuget Nuspec Analyzer will be used.
|
||||
*/
|
||||
Boolean nuspecEnabled
|
||||
/**
|
||||
* Sets whether or not the .NET Assembly Analyzer should be used.
|
||||
*/
|
||||
Boolean assemblyEnabled
|
||||
/**
|
||||
* The path to Mono for .NET assembly analysis on non-windows systems.
|
||||
*/
|
||||
String pathToMono
|
||||
|
||||
|
||||
/**
|
||||
* Sets whether the Python Distribution Analyzer will be used.
|
||||
*/
|
||||
Boolean pyDistributionEnabled
|
||||
/**
|
||||
* Sets whether the Python Package Analyzer will be used.
|
||||
*/
|
||||
Boolean pyPackageEnabled
|
||||
/**
|
||||
* Sets whether the Ruby Gemspec Analyzer will be used.
|
||||
*/
|
||||
Boolean rubygemsEnabled
|
||||
/**
|
||||
* Sets whether or not the openssl Analyzer should be used.
|
||||
*/
|
||||
Boolean opensslEnabled
|
||||
/**
|
||||
* Sets whether or not the CMake Analyzer should be used.
|
||||
*/
|
||||
Boolean cmakeEnabled
|
||||
/**
|
||||
* Sets whether or not the autoconf Analyzer should be used.
|
||||
*/
|
||||
Boolean autoconfEnabled
|
||||
/**
|
||||
* Sets whether or not the PHP Composer Lock File Analyzer should be used.
|
||||
*/
|
||||
Boolean composerEnabled
|
||||
/**
|
||||
* Sets whether or not the Node.js Analyzer should be used.
|
||||
*/
|
||||
Boolean nodeEnabled
|
||||
}
|
||||
@@ -1,70 +0,0 @@
|
||||
/*
|
||||
* This file is part of dependency-check-gradle.
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
* Copyright (c) 2015 Wei Ma. All Rights Reserved.
|
||||
*/
|
||||
|
||||
package com.tools.security.extension
|
||||
|
||||
import static org.owasp.dependencycheck.reporting.ReportGenerator.Format
|
||||
|
||||
/*
|
||||
* Configuration extension for the dependencyCheck plugin.
|
||||
*
|
||||
* @author Wei Ma
|
||||
* @author Jeremy Long
|
||||
*/
|
||||
class CheckExtension extends UpdateExtension {
|
||||
/**
|
||||
* Configuration for the analyzers.
|
||||
*/
|
||||
AnalyzerExtension analyzerExtension
|
||||
|
||||
/**
|
||||
* The path to the suppression file.
|
||||
*/
|
||||
String suppressionFile
|
||||
/**
|
||||
* Sets whether auto-updating of the NVD CVE/CPE data is enabled.
|
||||
*/
|
||||
Boolean autoUpdate
|
||||
|
||||
//The following properties are not used via the settings object, instead
|
||||
// they are directly used by the check task.
|
||||
/**
|
||||
* When set to true dependency groups that start with 'test' will not be included in the analysis.
|
||||
* The default value is true.
|
||||
*/
|
||||
Boolean skipTestGroups = true
|
||||
/**
|
||||
* The report format to be generated (HTML, XML, VULN, ALL). This configuration option has
|
||||
* no affect if using this within the Site plugin unless the externalReport is set to true.
|
||||
* The default is HTML.
|
||||
*/
|
||||
Format format = Format.HTML
|
||||
/**
|
||||
* The name of the directory where reports will be written. Defaults to 'reports'.
|
||||
*/
|
||||
String reportsDirName = "reports"
|
||||
/**
|
||||
* Specifies if the build should be failed if a CVSS score above a specified level is identified. The default is
|
||||
* 11 which means since the CVSS scores are 0-10, by default the build will never fail.
|
||||
*/
|
||||
Float failBuildOnCVSS = 11.0
|
||||
/**
|
||||
* Displays a summary of the findings. Defaults to true.
|
||||
*/
|
||||
Boolean showSummary = true
|
||||
}
|
||||
@@ -1,42 +0,0 @@
|
||||
/*
|
||||
* This file is part of dependency-check-gradle.
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
* Copyright (c) 2015 Wei Ma. All Rights Reserved.
|
||||
*/
|
||||
|
||||
package com.tools.security.extension
|
||||
|
||||
public class CveExtension {
|
||||
/**
|
||||
* URL for the modified CVE 1.2:
|
||||
* https://nvd.nist.gov/download/nvdcve-Modified.xml.gz
|
||||
**/
|
||||
String url20Modified
|
||||
/**
|
||||
* URL for the modified CVE 1.2:
|
||||
* https://nvd.nist.gov/feeds/xml/cve/nvdcve-2.0-Modified.xml.gz
|
||||
**/
|
||||
String url12Modified
|
||||
/**
|
||||
* URL for the modified CVE 1.2:
|
||||
* https://nvd.nist.gov/download/nvdcve-%d.xml.gz
|
||||
**/
|
||||
String url20Base
|
||||
/**
|
||||
* Base URL for each year's CVE 2.0, the %d will be replaced with the year.
|
||||
* https://nvd.nist.gov/feeds/xml/cve/nvdcve-2.0-%d.xml.gz
|
||||
**/
|
||||
String url12Base
|
||||
}
|
||||
@@ -1,45 +0,0 @@
|
||||
/*
|
||||
* This file is part of dependency-check-gradle.
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
* Copyright (c) 2015 Jeremy Long. All Rights Reserved.
|
||||
*/
|
||||
|
||||
package com.tools.security.extension
|
||||
|
||||
/**
|
||||
* The update data configuration extension. Any value not configured will use the dependency-check-core defaults.
|
||||
*/
|
||||
class DataExtension extends PurgeDataExtension {
|
||||
/**
|
||||
* The connection string to the database.
|
||||
*/
|
||||
String connectionString
|
||||
/**
|
||||
* The user name to use when connecting to the database.
|
||||
*/
|
||||
String username
|
||||
/**
|
||||
* The password to use when connecting to the database.
|
||||
*/
|
||||
String password
|
||||
/**
|
||||
* The database dirver name (e.g. org.h2.Driver).
|
||||
*/
|
||||
String driver
|
||||
/**
|
||||
* The path to the driver (JAR) in case it is not already in the classpath.
|
||||
*/
|
||||
String driverPath
|
||||
}
|
||||
@@ -1,29 +0,0 @@
|
||||
/*
|
||||
* This file is part of dependency-check-gradle.
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
* Copyright (c) 2015 Wei Ma. All Rights Reserved.
|
||||
*/
|
||||
|
||||
package com.tools.security.extension
|
||||
/**
|
||||
* TODO - this should not be needed, instead rely on the configured HTTP or HTTPS proxies
|
||||
* https://docs.gradle.org/current/userguide/build_environment.html
|
||||
*/
|
||||
class ProxyExtension {
|
||||
String server
|
||||
Integer port
|
||||
String username
|
||||
String password
|
||||
}
|
||||
@@ -1,29 +0,0 @@
|
||||
/*
|
||||
* This file is part of dependency-check-gradle.
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
* Copyright (c) 2015 Jeremy Long. All Rights Reserved.
|
||||
*/
|
||||
|
||||
package com.tools.security.extension
|
||||
|
||||
/**
|
||||
* The data configuration extension. Any value not configured will use the dependency-check-core defaults.
|
||||
*/
|
||||
class PurgeDataExtension {
|
||||
/**
|
||||
* The directory to store the H2 database that contains the cache of the NVD CVE data.
|
||||
*/
|
||||
String directory="[JAR]/../../dependency-check-data"
|
||||
}
|
||||
@@ -1,23 +0,0 @@
|
||||
/*
|
||||
* This file is part of dependency-check-gradle.
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
* Copyright (c) 2015 Wei Ma. All Rights Reserved.
|
||||
*/
|
||||
|
||||
package com.tools.security.extension
|
||||
|
||||
class PurgeExtension {
|
||||
PurgeDataExtension dataExtension
|
||||
}
|
||||
@@ -1,33 +0,0 @@
|
||||
/*
|
||||
* This file is part of dependency-check-gradle.
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
* Copyright (c) 2015 Wei Ma. All Rights Reserved.
|
||||
*/
|
||||
|
||||
package com.tools.security.extension
|
||||
|
||||
class UpdateExtension extends PurgeExtension {
|
||||
ProxyExtension proxyExtension
|
||||
CveExtension cveExtension
|
||||
DataExtension dataExtension
|
||||
/**
|
||||
* Set to false if the proxy does not support HEAD requests. The default is true.
|
||||
*/
|
||||
Boolean quickQueryTimestamp
|
||||
/**
|
||||
* The number of hours to wait before checking for additional updates from the NVD.
|
||||
*/
|
||||
Integer cveValidForHours
|
||||
}
|
||||
@@ -1,75 +0,0 @@
|
||||
/*
|
||||
* This file is part of dependency-check-gradle.
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
* Copyright (c) 2015 Wei Ma. All Rights Reserved.
|
||||
*/
|
||||
|
||||
package com.tools.security.plugin
|
||||
|
||||
import com.tools.security.extension.CveExtension
|
||||
import com.tools.security.extension.CheckExtension
|
||||
import com.tools.security.extension.ProxyExtension
|
||||
import com.tools.security.extension.DataExtension
|
||||
import com.tools.security.extension.AnalyzerExtension
|
||||
import com.tools.security.extension.UpdateExtension
|
||||
import com.tools.security.extension.PurgeExtension
|
||||
import com.tools.security.extension.PurgeDataExtension
|
||||
import com.tools.security.tasks.Check
|
||||
import com.tools.security.tasks.Update
|
||||
import com.tools.security.tasks.Purge
|
||||
|
||||
import org.gradle.api.Plugin
|
||||
import org.gradle.api.Project
|
||||
|
||||
class DependencyCheck implements Plugin<Project> {
|
||||
private static final String CHECK_TASK = 'dependencyCheck'
|
||||
private static final String UPDATE_TASK = 'dependencyCheckUpdate'
|
||||
private static final String PURGE_TASK = 'dependencyCheckPurge'
|
||||
|
||||
|
||||
/* configuration extensions */
|
||||
private static final String PROXY_EXTENSION_NAME = "proxy"
|
||||
private static final String CVE_EXTENSION_NAME = "cve"
|
||||
private static final String DATA_EXTENSION_NAME = "data"
|
||||
private static final String ANALYZER_EXTENSION_NAME = "analyzer"
|
||||
|
||||
@Override
|
||||
void apply(Project project) {
|
||||
initializeConfigurations(project)
|
||||
registerTasks(project)
|
||||
}
|
||||
|
||||
def initializeConfigurations(Project project) {
|
||||
def ext = project.extensions.create(CHECK_TASK, CheckExtension)
|
||||
ext.extensions.create(PROXY_EXTENSION_NAME, ProxyExtension)
|
||||
ext.extensions.create(CVE_EXTENSION_NAME, CveExtension)
|
||||
ext.extensions.create(DATA_EXTENSION_NAME, DataExtension)
|
||||
ext.extensions.create(ANALYZER_EXTENSION_NAME, AnalyzerExtension)
|
||||
|
||||
def extu = project.extensions.create(UPDATE_TASK, UpdateExtension)
|
||||
extu.extensions.create(CVE_EXTENSION_NAME, CveExtension)
|
||||
extu.extensions.create(DATA_EXTENSION_NAME, DataExtension)
|
||||
extu.extensions.create(PROXY_EXTENSION_NAME, ProxyExtension)
|
||||
|
||||
def extp = project.extensions.create(PURGE_TASK, PurgeExtension)
|
||||
extp.extensions.create(DATA_EXTENSION_NAME, PurgeDataExtension)
|
||||
}
|
||||
|
||||
def registerTasks(Project project) {
|
||||
project.task(CHECK_TASK, type: Check)
|
||||
project.task(UPDATE_TASK, type: Update)
|
||||
project.task(PURGE_TASK, type: Purge)
|
||||
}
|
||||
}
|
||||
@@ -1,292 +0,0 @@
|
||||
/*
|
||||
* This file is part of dependency-check-gradle.
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
* Copyright (c) 2015 Wei Ma. All Rights Reserved.
|
||||
*/
|
||||
|
||||
package com.tools.security.tasks
|
||||
|
||||
import org.gradle.api.DefaultTask
|
||||
import org.gradle.api.artifacts.Configuration
|
||||
import org.gradle.api.artifacts.ResolvedArtifact
|
||||
import org.gradle.api.tasks.TaskAction
|
||||
import org.gradle.api.GradleException
|
||||
import org.gradle.api.InvalidUserDataException
|
||||
|
||||
import org.owasp.dependencycheck.Engine
|
||||
import org.owasp.dependencycheck.data.nvdcve.CveDB
|
||||
import org.owasp.dependencycheck.dependency.Dependency
|
||||
import org.owasp.dependencycheck.reporting.ReportGenerator
|
||||
import org.owasp.dependencycheck.utils.Settings
|
||||
import org.owasp.dependencycheck.dependency.Identifier;
|
||||
import org.owasp.dependencycheck.dependency.Vulnerability;
|
||||
|
||||
|
||||
import static org.owasp.dependencycheck.utils.Settings.KEYS.CVE_MODIFIED_12_URL
|
||||
import static org.owasp.dependencycheck.utils.Settings.KEYS.CVE_MODIFIED_20_URL
|
||||
import static org.owasp.dependencycheck.utils.Settings.KEYS.CVE_SCHEMA_1_2
|
||||
import static org.owasp.dependencycheck.utils.Settings.KEYS.CVE_SCHEMA_2_0
|
||||
import static org.owasp.dependencycheck.utils.Settings.KEYS.CVE_START_YEAR
|
||||
import static org.owasp.dependencycheck.utils.Settings.KEYS.DOWNLOADER_QUICK_QUERY_TIMESTAMP
|
||||
import static org.owasp.dependencycheck.utils.Settings.KEYS.PROXY_PASSWORD
|
||||
import static org.owasp.dependencycheck.utils.Settings.KEYS.PROXY_PORT
|
||||
import static org.owasp.dependencycheck.utils.Settings.KEYS.PROXY_SERVER
|
||||
import static org.owasp.dependencycheck.utils.Settings.KEYS.PROXY_USERNAME
|
||||
import static org.owasp.dependencycheck.utils.Settings.KEYS.AUTO_UPDATE
|
||||
import static org.owasp.dependencycheck.utils.Settings.KEYS.DATA_DIRECTORY
|
||||
import static org.owasp.dependencycheck.utils.Settings.KEYS.SUPPRESSION_FILE
|
||||
|
||||
import static org.owasp.dependencycheck.utils.Settings.KEYS.DB_DRIVER_NAME
|
||||
import static org.owasp.dependencycheck.utils.Settings.KEYS.DB_DRIVER_PATH
|
||||
import static org.owasp.dependencycheck.utils.Settings.KEYS.DB_CONNECTION_STRING
|
||||
import static org.owasp.dependencycheck.utils.Settings.KEYS.DB_USER
|
||||
import static org.owasp.dependencycheck.utils.Settings.KEYS.DB_PASSWORD
|
||||
|
||||
import static org.owasp.dependencycheck.utils.Settings.KEYS.ANALYZER_JAR_ENABLED
|
||||
import static org.owasp.dependencycheck.utils.Settings.KEYS.ANALYZER_NUSPEC_ENABLED
|
||||
import static org.owasp.dependencycheck.utils.Settings.KEYS.ANALYZER_CENTRAL_ENABLED
|
||||
import static org.owasp.dependencycheck.utils.Settings.KEYS.ANALYZER_NEXUS_ENABLED
|
||||
import static org.owasp.dependencycheck.utils.Settings.KEYS.ANALYZER_NEXUS_URL
|
||||
import static org.owasp.dependencycheck.utils.Settings.KEYS.ANALYZER_NEXUS_USES_PROXY
|
||||
import static org.owasp.dependencycheck.utils.Settings.KEYS.ANALYZER_ARCHIVE_ENABLED
|
||||
import static org.owasp.dependencycheck.utils.Settings.KEYS.ADDITIONAL_ZIP_EXTENSIONS
|
||||
import static org.owasp.dependencycheck.utils.Settings.KEYS.ANALYZER_ASSEMBLY_ENABLED
|
||||
import static org.owasp.dependencycheck.utils.Settings.KEYS.ANALYZER_ASSEMBLY_MONO_PATH
|
||||
import static org.owasp.dependencycheck.utils.Settings.KEYS.ANALYZER_PYTHON_DISTRIBUTION_ENABLED
|
||||
import static org.owasp.dependencycheck.utils.Settings.KEYS.ANALYZER_PYTHON_PACKAGE_ENABLED
|
||||
import static org.owasp.dependencycheck.utils.Settings.KEYS.ANALYZER_RUBY_GEMSPEC_ENABLED
|
||||
import static org.owasp.dependencycheck.utils.Settings.KEYS.ANALYZER_OPENSSL_ENABLED
|
||||
import static org.owasp.dependencycheck.utils.Settings.KEYS.ANALYZER_CMAKE_ENABLED
|
||||
import static org.owasp.dependencycheck.utils.Settings.KEYS.ANALYZER_AUTOCONF_ENABLED
|
||||
import static org.owasp.dependencycheck.utils.Settings.KEYS.ANALYZER_COMPOSER_LOCK_ENABLED
|
||||
import static org.owasp.dependencycheck.utils.Settings.KEYS.ANALYZER_NODE_PACKAGE_ENABLED
|
||||
|
||||
/**
|
||||
* Checks the projects dependencies for known vulnerabilities.
|
||||
*/
|
||||
class Check extends DefaultTask {
|
||||
|
||||
def currentProjectName = project.getName()
|
||||
def config = project.dependencyCheck
|
||||
|
||||
/**
|
||||
* Initializes the check task.
|
||||
*/
|
||||
Check() {
|
||||
group = 'OWASP dependency-check'
|
||||
description = 'Produce dependency security report.'
|
||||
}
|
||||
|
||||
/**
|
||||
* Calls dependency-check-core's analysis engine to scan
|
||||
* all of the projects dependencies.
|
||||
*/
|
||||
@TaskAction
|
||||
def check() {
|
||||
initializeSettings()
|
||||
def engine = new Engine()
|
||||
|
||||
scanDependencies(engine)
|
||||
analyzeDependencies(engine)
|
||||
generateReport(engine)
|
||||
showSummary(engine)
|
||||
checkForFailure(engine)
|
||||
cleanup(engine)
|
||||
}
|
||||
|
||||
/**
|
||||
* Initializes the settings object. If the setting is not set the
|
||||
* default from dependency-check-core is used.
|
||||
*/
|
||||
def initializeSettings() {
|
||||
Settings.initialize()
|
||||
|
||||
Settings.setBooleanIfNotNull(AUTO_UPDATE, config.autoUpdate)
|
||||
Settings.setStringIfNotEmpty(SUPPRESSION_FILE, config.suppressionFile)
|
||||
|
||||
Settings.setStringIfNotEmpty(PROXY_SERVER, config.proxy.server)
|
||||
Settings.setStringIfNotEmpty(PROXY_PORT, "${config.proxy.port}")
|
||||
Settings.setStringIfNotEmpty(PROXY_USERNAME, config.proxy.username)
|
||||
Settings.setStringIfNotEmpty(PROXY_PASSWORD, config.proxy.password)
|
||||
//Settings.setStringIfNotEmpty(CONNECTION_TIMEOUT, connectionTimeout)
|
||||
Settings.setStringIfNotNull(DATA_DIRECTORY, config.data.directory)
|
||||
Settings.setStringIfNotEmpty(DB_DRIVER_NAME, config.data.driver)
|
||||
Settings.setStringIfNotEmpty(DB_DRIVER_PATH, config.data.driverPath)
|
||||
Settings.setStringIfNotEmpty(DB_CONNECTION_STRING, config.data.connectionString)
|
||||
Settings.setStringIfNotEmpty(DB_USER, config.data.username)
|
||||
Settings.setStringIfNotEmpty(DB_PASSWORD, config.data.password)
|
||||
Settings.setStringIfNotEmpty(CVE_MODIFIED_12_URL, config.cve.url12Modified)
|
||||
Settings.setStringIfNotEmpty(CVE_MODIFIED_20_URL, config.cve.url20Modified)
|
||||
Settings.setStringIfNotEmpty(CVE_SCHEMA_1_2, config.cve.url12Base)
|
||||
Settings.setStringIfNotEmpty(CVE_SCHEMA_2_0, config.cve.url20Base)
|
||||
|
||||
if (config.cveValidForHours != null) {
|
||||
if (config.cveValidForHours >= 0) {
|
||||
Settings.setInt(CVE_CHECK_VALID_FOR_HOURS, config.cveValidForHours);
|
||||
} else {
|
||||
throw new InvalidUserDataException("Invalid setting: `validForHours` must be 0 or greater");
|
||||
}
|
||||
}
|
||||
Settings.setBooleanIfNotNull(ANALYZER_JAR_ENABLED, config.analyzer.jarEnabled)
|
||||
Settings.setBooleanIfNotNull(ANALYZER_NUSPEC_ENABLED, config.analyzer.nuspecEnabled)
|
||||
Settings.setBooleanIfNotNull(ANALYZER_CENTRAL_ENABLED, config.analyzer.centralEnabled)
|
||||
|
||||
Settings.setBooleanIfNotNull(ANALYZER_NEXUS_ENABLED, config.analyzer.nexusEnabled)
|
||||
Settings.setStringIfNotEmpty(ANALYZER_NEXUS_URL, config.analyzer.nexusUrl)
|
||||
Settings.setBooleanIfNotNull(ANALYZER_NEXUS_USES_PROXY, config.analyzer.nexusUsesProxy)
|
||||
|
||||
Settings.setBooleanIfNotNull(ANALYZER_ARCHIVE_ENABLED, config.analyzer.archiveEnabled)
|
||||
Settings.setStringIfNotEmpty(ADDITIONAL_ZIP_EXTENSIONS, config.analyzer.zipExtensions)
|
||||
Settings.setBooleanIfNotNull(ANALYZER_ASSEMBLY_ENABLED, config.analyzer.assemblyEnabled)
|
||||
Settings.setStringIfNotEmpty(ANALYZER_ASSEMBLY_MONO_PATH, config.analyzer.pathToMono)
|
||||
|
||||
Settings.setBooleanIfNotNull(ANALYZER_PYTHON_DISTRIBUTION_ENABLED, config.analyzer.pyDistributionEnabled)
|
||||
Settings.setBooleanIfNotNull(ANALYZER_PYTHON_PACKAGE_ENABLED, config.analyzer.pyPackageEnabled)
|
||||
Settings.setBooleanIfNotNull(ANALYZER_RUBY_GEMSPEC_ENABLED, config.analyzer.rubygemsEnabled)
|
||||
Settings.setBooleanIfNotNull(ANALYZER_OPENSSL_ENABLED, config.analyzer.opensslEnabled)
|
||||
Settings.setBooleanIfNotNull(ANALYZER_CMAKE_ENABLED, config.analyzer.cmakeEnabled)
|
||||
Settings.setBooleanIfNotNull(ANALYZER_AUTOCONF_ENABLED, config.analyzer.autoconfEnabled)
|
||||
Settings.setBooleanIfNotNull(ANALYZER_COMPOSER_LOCK_ENABLED, config.analyzer.composerEnabled)
|
||||
Settings.setBooleanIfNotNull(ANALYZER_NODE_PACKAGE_ENABLED, config.analyzer.nodeEnabled)
|
||||
}
|
||||
/**
|
||||
* Relases resources and removes temporary files used.
|
||||
*/
|
||||
def cleanup(engine) {
|
||||
Settings.cleanup(true)
|
||||
engine.cleanup();
|
||||
}
|
||||
|
||||
/**
|
||||
* Loads the projects dependencies into the dependency-check analysis engine.
|
||||
*/
|
||||
def scanDependencies(engine) {
|
||||
logger.lifecycle("Verifying dependencies for project ${currentProjectName}")
|
||||
getAllDependencies(project).each {
|
||||
engine.scan(it)
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Performs the dependency-check analysis.
|
||||
*/
|
||||
def analyzeDependencies(Engine engine) {
|
||||
logger.lifecycle("Checking for updates and analyzing vulnerabilities for dependencies")
|
||||
engine.analyzeDependencies()
|
||||
}
|
||||
|
||||
/**
|
||||
* Displays a summary of the dependency-check results to the build console.
|
||||
*/
|
||||
def showSummary(Engine engine) {
|
||||
def vulnerabilities = engine.getDependencies().collect { Dependency dependency ->
|
||||
dependency.getVulnerabilities()
|
||||
}.flatten()
|
||||
|
||||
logger.lifecycle("Found ${vulnerabilities.size()} vulnerabilities in project ${currentProjectName}")
|
||||
if (config.showSummary) {
|
||||
final StringBuilder summary = new StringBuilder()
|
||||
for (Dependency d : engine.getDependencies()) {
|
||||
boolean firstEntry = true
|
||||
final StringBuilder ids = new StringBuilder()
|
||||
for (Vulnerability v : d.getVulnerabilities()) {
|
||||
if (firstEntry) {
|
||||
firstEntry = false
|
||||
} else {
|
||||
ids.append(", ")
|
||||
}
|
||||
ids.append(v.getName())
|
||||
}
|
||||
if (ids.length() > 0) {
|
||||
summary.append(d.getFileName()).append(" (")
|
||||
firstEntry = true
|
||||
for (Identifier id : d.getIdentifiers()) {
|
||||
if (firstEntry) {
|
||||
firstEntry = false
|
||||
} else {
|
||||
summary.append(", ")
|
||||
}
|
||||
summary.append(id.getValue())
|
||||
}
|
||||
summary.append(") : ").append(ids).append('\n')
|
||||
}
|
||||
}
|
||||
if (summary.length() > 0) {
|
||||
final String msg = String.format("%n%n"
|
||||
+ "One or more dependencies were identified with known vulnerabilities:%n%n%s"
|
||||
+ "%n%nSee the dependency-check report for more details.%n%n", summary.toString())
|
||||
logger.lifecycle(msg)
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
/**
|
||||
* If configured, fails the build if a vulnerability is identified with a CVSS
|
||||
* score higher then the failure threshold configured.
|
||||
*/
|
||||
def checkForFailure(Engine engine) {
|
||||
if (config.failBuildOnCVSS>10) {
|
||||
return
|
||||
}
|
||||
|
||||
def vulnerabilities = engine.getDependencies().collect { Dependency dependency ->
|
||||
dependency.getVulnerabilities()
|
||||
}.flatten()
|
||||
|
||||
final StringBuilder ids = new StringBuilder();
|
||||
|
||||
vulnerabilities.each {
|
||||
if (it.getCvssScore() >= config.failBuildOnCVSS) {
|
||||
if (ids.length() == 0) {
|
||||
ids.append(it.getName());
|
||||
} else {
|
||||
ids.append(", ").append(it.getName());
|
||||
}
|
||||
}
|
||||
}
|
||||
if (ids.length() > 0) {
|
||||
final String msg = String.format("%n%nDependency-Check Failure:%n"
|
||||
+ "One or more dependencies were identified with vulnerabilities that have a CVSS score greater then '%.1f': %s%n"
|
||||
+ "See the dependency-check report for more details.%n%n", config.failBuildOnCVSS, ids.toString());
|
||||
throw new GradleException(msg);
|
||||
}
|
||||
|
||||
}
|
||||
/**
|
||||
* Writes the report(s) to the configured output directory.
|
||||
*/
|
||||
def generateReport(Engine engine) {
|
||||
logger.lifecycle("Generating report for project ${currentProjectName}")
|
||||
def reportGenerator = new ReportGenerator(currentProjectName, engine.dependencies, engine.analyzers,
|
||||
new CveDB().databaseProperties)
|
||||
|
||||
reportGenerator.generateReports("$project.buildDir/${config.reportsDirName}", config.format)
|
||||
}
|
||||
|
||||
/**
|
||||
* Returns all dependencies associated wtihin the configured dependency groups. Test
|
||||
* groups can be excluded by setting the skipTestGroups configuration to true.
|
||||
*/
|
||||
def getAllDependencies(project) {
|
||||
return project.getConfigurations().findAll {
|
||||
!config.skipTestGroups || (config.skipTestGroups && !it.getName().startsWith("test"))
|
||||
}.collect {
|
||||
it.getResolvedConfiguration().getResolvedArtifacts().collect { ResolvedArtifact artifact ->
|
||||
artifact.getFile()
|
||||
}
|
||||
}.flatten().unique();
|
||||
}
|
||||
}
|
||||
@@ -1,82 +0,0 @@
|
||||
/*
|
||||
* This file is part of dependency-check-gradle.
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
* Copyright (c) 2015 Jeremy Long. All Rights Reserved.
|
||||
*/
|
||||
|
||||
package com.tools.security.tasks
|
||||
|
||||
import org.gradle.api.DefaultTask
|
||||
import org.gradle.api.artifacts.Configuration
|
||||
import org.gradle.api.artifacts.ResolvedArtifact
|
||||
import org.gradle.api.tasks.TaskAction
|
||||
import java.io.File
|
||||
import org.owasp.dependencycheck.Engine
|
||||
import org.owasp.dependencycheck.data.nvdcve.CveDB
|
||||
import org.owasp.dependencycheck.dependency.Dependency
|
||||
import org.owasp.dependencycheck.reporting.ReportGenerator
|
||||
import org.owasp.dependencycheck.utils.Settings
|
||||
|
||||
import static org.owasp.dependencycheck.utils.Settings.KEYS.DATA_DIRECTORY
|
||||
|
||||
/**
|
||||
* Purges the local cache of the NVD CVE data.
|
||||
*/
|
||||
class Purge extends DefaultTask {
|
||||
|
||||
def config = project.dependencyCheckPurge
|
||||
|
||||
/**
|
||||
* Initializes the purge task.
|
||||
*/
|
||||
Purge() {
|
||||
group = 'OWASP dependency-check'
|
||||
description = 'Purges the local cache of the NVD.'
|
||||
}
|
||||
|
||||
/**
|
||||
* Purges the local cache of the NVD data.
|
||||
*/
|
||||
@TaskAction
|
||||
def purge() {
|
||||
initializeSettings()
|
||||
def db = new File(Settings.getDataDirectory(), "dc.h2.db")
|
||||
if (db.exists()) {
|
||||
if (db.delete()) {
|
||||
logger.info("Database file purged; local copy of the NVD has been removed")
|
||||
} else {
|
||||
logger.warn("Unable to delete '${db.getAbsolutePath()}'; please delete the file manually")
|
||||
}
|
||||
} else {
|
||||
logger.warn("Unable to purge database; the database file does not exists: ${db.getAbsolutePath()}")
|
||||
}
|
||||
cleanup()
|
||||
}
|
||||
|
||||
/**
|
||||
* Intializes the configuration.
|
||||
*/
|
||||
def initializeSettings() {
|
||||
Settings.initialize()
|
||||
Settings.setStringIfNotNull(DATA_DIRECTORY, config.data.directory)
|
||||
}
|
||||
|
||||
/**
|
||||
* Relases resources and removes temporary files used.
|
||||
*/
|
||||
def cleanup() {
|
||||
Settings.cleanup(true)
|
||||
}
|
||||
}
|
||||
@@ -1,116 +0,0 @@
|
||||
/*
|
||||
* This file is part of dependency-check-gradle.
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
* Copyright (c) 2015 Jeremy Long. All Rights Reserved.
|
||||
*/
|
||||
|
||||
package com.tools.security.tasks
|
||||
|
||||
import org.gradle.api.DefaultTask
|
||||
import org.gradle.api.artifacts.Configuration
|
||||
import org.gradle.api.artifacts.ResolvedArtifact
|
||||
import org.gradle.api.tasks.TaskAction
|
||||
import org.gradle.api.InvalidUserDataException
|
||||
import org.owasp.dependencycheck.Engine
|
||||
import org.owasp.dependencycheck.data.nvdcve.CveDB
|
||||
import org.owasp.dependencycheck.dependency.Dependency
|
||||
import org.owasp.dependencycheck.reporting.ReportGenerator
|
||||
import org.owasp.dependencycheck.utils.Settings
|
||||
|
||||
import static org.owasp.dependencycheck.utils.Settings.KEYS.CVE_MODIFIED_12_URL
|
||||
import static org.owasp.dependencycheck.utils.Settings.KEYS.CVE_MODIFIED_20_URL
|
||||
import static org.owasp.dependencycheck.utils.Settings.KEYS.CVE_SCHEMA_1_2
|
||||
import static org.owasp.dependencycheck.utils.Settings.KEYS.CVE_SCHEMA_2_0
|
||||
import static org.owasp.dependencycheck.utils.Settings.KEYS.CVE_START_YEAR
|
||||
import static org.owasp.dependencycheck.utils.Settings.KEYS.DOWNLOADER_QUICK_QUERY_TIMESTAMP
|
||||
import static org.owasp.dependencycheck.utils.Settings.KEYS.PROXY_PASSWORD
|
||||
import static org.owasp.dependencycheck.utils.Settings.KEYS.PROXY_PORT
|
||||
import static org.owasp.dependencycheck.utils.Settings.KEYS.PROXY_SERVER
|
||||
import static org.owasp.dependencycheck.utils.Settings.KEYS.PROXY_USERNAME
|
||||
import static org.owasp.dependencycheck.utils.Settings.KEYS.DATA_DIRECTORY
|
||||
import static org.owasp.dependencycheck.utils.Settings.KEYS.SUPPRESSION_FILE
|
||||
|
||||
import static org.owasp.dependencycheck.utils.Settings.KEYS.DB_DRIVER_NAME
|
||||
import static org.owasp.dependencycheck.utils.Settings.KEYS.DB_DRIVER_PATH
|
||||
import static org.owasp.dependencycheck.utils.Settings.KEYS.DB_CONNECTION_STRING
|
||||
import static org.owasp.dependencycheck.utils.Settings.KEYS.DB_USER
|
||||
import static org.owasp.dependencycheck.utils.Settings.KEYS.DB_PASSWORD
|
||||
|
||||
/**
|
||||
* Updates the local cache of the NVD CVE data.
|
||||
*
|
||||
* @author Jeremy Long
|
||||
*/
|
||||
class Update extends DefaultTask {
|
||||
|
||||
def config = project.dependencyCheckUpdate
|
||||
|
||||
/**
|
||||
* Initializes the update task.
|
||||
*/
|
||||
Update() {
|
||||
group = 'OWASP dependency-check'
|
||||
description = 'Downloads and stores updates from the NVD CVE data feeds.'
|
||||
}
|
||||
|
||||
/**
|
||||
* Executes the update task.
|
||||
*/
|
||||
@TaskAction
|
||||
def update() {
|
||||
initializeSettings()
|
||||
def engine = new Engine()
|
||||
engine.doUpdates()
|
||||
cleanup(engine)
|
||||
}
|
||||
|
||||
/**
|
||||
* Initializes the settings; if the setting is not configured
|
||||
* then the default value from dependency-check-core is used.
|
||||
*/
|
||||
def initializeSettings() {
|
||||
Settings.initialize()
|
||||
Settings.setStringIfNotEmpty(PROXY_SERVER, config.proxy.server)
|
||||
Settings.setStringIfNotEmpty(PROXY_PORT, "${config.proxy.port}")
|
||||
Settings.setStringIfNotEmpty(PROXY_USERNAME, config.proxy.username)
|
||||
Settings.setStringIfNotEmpty(PROXY_PASSWORD, config.proxy.password)
|
||||
//Settings.setStringIfNotEmpty(CONNECTION_TIMEOUT, connectionTimeout)
|
||||
Settings.setStringIfNotNull(DATA_DIRECTORY, config.data.directory)
|
||||
Settings.setStringIfNotEmpty(DB_DRIVER_NAME, config.data.driver)
|
||||
Settings.setStringIfNotEmpty(DB_DRIVER_PATH, config.data.driverPath)
|
||||
Settings.setStringIfNotEmpty(DB_CONNECTION_STRING, config.data.connectionString)
|
||||
Settings.setStringIfNotEmpty(DB_USER, config.data.username)
|
||||
Settings.setStringIfNotEmpty(DB_PASSWORD, config.data.password)
|
||||
Settings.setStringIfNotEmpty(CVE_MODIFIED_12_URL, config.cve.url12Modified)
|
||||
Settings.setStringIfNotEmpty(CVE_MODIFIED_20_URL, config.cve.url20Modified)
|
||||
Settings.setStringIfNotEmpty(CVE_SCHEMA_1_2, config.cve.url12Base)
|
||||
Settings.setStringIfNotEmpty(CVE_SCHEMA_2_0, config.cve.url20Base)
|
||||
|
||||
if (config.cveValidForHours != null) {
|
||||
if (config.cveValidForHours >= 0) {
|
||||
Settings.setInt(CVE_CHECK_VALID_FOR_HOURS, config.cveValidForHours);
|
||||
} else {
|
||||
throw new InvalidUserDataException("Invalid setting: `validForHours` must be 0 or greater");
|
||||
}
|
||||
}
|
||||
}
|
||||
/**
|
||||
* Relases resources and removes temporary files used.
|
||||
*/
|
||||
def cleanup(engine) {
|
||||
Settings.cleanup(true)
|
||||
engine.cleanup();
|
||||
}
|
||||
}
|
||||
@@ -1,19 +0,0 @@
|
||||
#
|
||||
# This file is part of dependency-check-gradle.
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||
# you may not use this file except in compliance with the License.
|
||||
# You may obtain a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
#
|
||||
# Copyright (c) 2015 Wei Ma. All Rights Reserved.
|
||||
#
|
||||
|
||||
implementation-class=com.tools.security.plugin.DependencyCheck
|
||||
@@ -1,202 +0,0 @@
|
||||
|
||||
Apache License
|
||||
Version 2.0, January 2004
|
||||
http://www.apache.org/licenses/
|
||||
|
||||
TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
|
||||
|
||||
1. Definitions.
|
||||
|
||||
"License" shall mean the terms and conditions for use, reproduction,
|
||||
and distribution as defined by Sections 1 through 9 of this document.
|
||||
|
||||
"Licensor" shall mean the copyright owner or entity authorized by
|
||||
the copyright owner that is granting the License.
|
||||
|
||||
"Legal Entity" shall mean the union of the acting entity and all
|
||||
other entities that control, are controlled by, or are under common
|
||||
control with that entity. For the purposes of this definition,
|
||||
"control" means (i) the power, direct or indirect, to cause the
|
||||
direction or management of such entity, whether by contract or
|
||||
otherwise, or (ii) ownership of fifty percent (50%) or more of the
|
||||
outstanding shares, or (iii) beneficial ownership of such entity.
|
||||
|
||||
"You" (or "Your") shall mean an individual or Legal Entity
|
||||
exercising permissions granted by this License.
|
||||
|
||||
"Source" form shall mean the preferred form for making modifications,
|
||||
including but not limited to software source code, documentation
|
||||
source, and configuration files.
|
||||
|
||||
"Object" form shall mean any form resulting from mechanical
|
||||
transformation or translation of a Source form, including but
|
||||
not limited to compiled object code, generated documentation,
|
||||
and conversions to other media types.
|
||||
|
||||
"Work" shall mean the work of authorship, whether in Source or
|
||||
Object form, made available under the License, as indicated by a
|
||||
copyright notice that is included in or attached to the work
|
||||
(an example is provided in the Appendix below).
|
||||
|
||||
"Derivative Works" shall mean any work, whether in Source or Object
|
||||
form, that is based on (or derived from) the Work and for which the
|
||||
editorial revisions, annotations, elaborations, or other modifications
|
||||
represent, as a whole, an original work of authorship. For the purposes
|
||||
of this License, Derivative Works shall not include works that remain
|
||||
separable from, or merely link (or bind by name) to the interfaces of,
|
||||
the Work and Derivative Works thereof.
|
||||
|
||||
"Contribution" shall mean any work of authorship, including
|
||||
the original version of the Work and any modifications or additions
|
||||
to that Work or Derivative Works thereof, that is intentionally
|
||||
submitted to Licensor for inclusion in the Work by the copyright owner
|
||||
or by an individual or Legal Entity authorized to submit on behalf of
|
||||
the copyright owner. For the purposes of this definition, "submitted"
|
||||
means any form of electronic, verbal, or written communication sent
|
||||
to the Licensor or its representatives, including but not limited to
|
||||
communication on electronic mailing lists, source code control systems,
|
||||
and issue tracking systems that are managed by, or on behalf of, the
|
||||
Licensor for the purpose of discussing and improving the Work, but
|
||||
excluding communication that is conspicuously marked or otherwise
|
||||
designated in writing by the copyright owner as "Not a Contribution."
|
||||
|
||||
"Contributor" shall mean Licensor and any individual or Legal Entity
|
||||
on behalf of whom a Contribution has been received by Licensor and
|
||||
subsequently incorporated within the Work.
|
||||
|
||||
2. Grant of Copyright License. Subject to the terms and conditions of
|
||||
this License, each Contributor hereby grants to You a perpetual,
|
||||
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
|
||||
copyright license to reproduce, prepare Derivative Works of,
|
||||
publicly display, publicly perform, sublicense, and distribute the
|
||||
Work and such Derivative Works in Source or Object form.
|
||||
|
||||
3. Grant of Patent License. Subject to the terms and conditions of
|
||||
this License, each Contributor hereby grants to You a perpetual,
|
||||
worldwide, non-exclusive, no-charge, royalty-free, irrevocable
|
||||
(except as stated in this section) patent license to make, have made,
|
||||
use, offer to sell, sell, import, and otherwise transfer the Work,
|
||||
where such license applies only to those patent claims licensable
|
||||
by such Contributor that are necessarily infringed by their
|
||||
Contribution(s) alone or by combination of their Contribution(s)
|
||||
with the Work to which such Contribution(s) was submitted. If You
|
||||
institute patent litigation against any entity (including a
|
||||
cross-claim or counterclaim in a lawsuit) alleging that the Work
|
||||
or a Contribution incorporated within the Work constitutes direct
|
||||
or contributory patent infringement, then any patent licenses
|
||||
granted to You under this License for that Work shall terminate
|
||||
as of the date such litigation is filed.
|
||||
|
||||
4. Redistribution. You may reproduce and distribute copies of the
|
||||
Work or Derivative Works thereof in any medium, with or without
|
||||
modifications, and in Source or Object form, provided that You
|
||||
meet the following conditions:
|
||||
|
||||
(a) You must give any other recipients of the Work or
|
||||
Derivative Works a copy of this License; and
|
||||
|
||||
(b) You must cause any modified files to carry prominent notices
|
||||
stating that You changed the files; and
|
||||
|
||||
(c) You must retain, in the Source form of any Derivative Works
|
||||
that You distribute, all copyright, patent, trademark, and
|
||||
attribution notices from the Source form of the Work,
|
||||
excluding those notices that do not pertain to any part of
|
||||
the Derivative Works; and
|
||||
|
||||
(d) If the Work includes a "NOTICE" text file as part of its
|
||||
distribution, then any Derivative Works that You distribute must
|
||||
include a readable copy of the attribution notices contained
|
||||
within such NOTICE file, excluding those notices that do not
|
||||
pertain to any part of the Derivative Works, in at least one
|
||||
of the following places: within a NOTICE text file distributed
|
||||
as part of the Derivative Works; within the Source form or
|
||||
documentation, if provided along with the Derivative Works; or,
|
||||
within a display generated by the Derivative Works, if and
|
||||
wherever such third-party notices normally appear. The contents
|
||||
of the NOTICE file are for informational purposes only and
|
||||
do not modify the License. You may add Your own attribution
|
||||
notices within Derivative Works that You distribute, alongside
|
||||
or as an addendum to the NOTICE text from the Work, provided
|
||||
that such additional attribution notices cannot be construed
|
||||
as modifying the License.
|
||||
|
||||
You may add Your own copyright statement to Your modifications and
|
||||
may provide additional or different license terms and conditions
|
||||
for use, reproduction, or distribution of Your modifications, or
|
||||
for any such Derivative Works as a whole, provided Your use,
|
||||
reproduction, and distribution of the Work otherwise complies with
|
||||
the conditions stated in this License.
|
||||
|
||||
5. Submission of Contributions. Unless You explicitly state otherwise,
|
||||
any Contribution intentionally submitted for inclusion in the Work
|
||||
by You to the Licensor shall be under the terms and conditions of
|
||||
this License, without any additional terms or conditions.
|
||||
Notwithstanding the above, nothing herein shall supersede or modify
|
||||
the terms of any separate license agreement you may have executed
|
||||
with Licensor regarding such Contributions.
|
||||
|
||||
6. Trademarks. This License does not grant permission to use the trade
|
||||
names, trademarks, service marks, or product names of the Licensor,
|
||||
except as required for reasonable and customary use in describing the
|
||||
origin of the Work and reproducing the content of the NOTICE file.
|
||||
|
||||
7. Disclaimer of Warranty. Unless required by applicable law or
|
||||
agreed to in writing, Licensor provides the Work (and each
|
||||
Contributor provides its Contributions) on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
|
||||
implied, including, without limitation, any warranties or conditions
|
||||
of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
|
||||
PARTICULAR PURPOSE. You are solely responsible for determining the
|
||||
appropriateness of using or redistributing the Work and assume any
|
||||
risks associated with Your exercise of permissions under this License.
|
||||
|
||||
8. Limitation of Liability. In no event and under no legal theory,
|
||||
whether in tort (including negligence), contract, or otherwise,
|
||||
unless required by applicable law (such as deliberate and grossly
|
||||
negligent acts) or agreed to in writing, shall any Contributor be
|
||||
liable to You for damages, including any direct, indirect, special,
|
||||
incidental, or consequential damages of any character arising as a
|
||||
result of this License or out of the use or inability to use the
|
||||
Work (including but not limited to damages for loss of goodwill,
|
||||
work stoppage, computer failure or malfunction, or any and all
|
||||
other commercial damages or losses), even if such Contributor
|
||||
has been advised of the possibility of such damages.
|
||||
|
||||
9. Accepting Warranty or Additional Liability. While redistributing
|
||||
the Work or Derivative Works thereof, You may choose to offer,
|
||||
and charge a fee for, acceptance of support, warranty, indemnity,
|
||||
or other liability obligations and/or rights consistent with this
|
||||
License. However, in accepting such obligations, You may act only
|
||||
on Your own behalf and on Your sole responsibility, not on behalf
|
||||
of any other Contributor, and only if You agree to indemnify,
|
||||
defend, and hold each Contributor harmless for any liability
|
||||
incurred by, or claims asserted against, such Contributor by reason
|
||||
of your accepting any such warranty or additional liability.
|
||||
|
||||
END OF TERMS AND CONDITIONS
|
||||
|
||||
APPENDIX: How to apply the Apache License to your work.
|
||||
|
||||
To apply the Apache License to your work, attach the following
|
||||
boilerplate notice, with the fields enclosed by brackets "[]"
|
||||
replaced with your own identifying information. (Don't include
|
||||
the brackets!) The text should be enclosed in the appropriate
|
||||
comment syntax for the file format. We also recommend that a
|
||||
file or class name and description of purpose be included on the
|
||||
same "printed page" as the copyright notice for easier
|
||||
identification within third-party archives.
|
||||
|
||||
Copyright [yyyy] [name of copyright owner]
|
||||
|
||||
Licensed under the Apache License, Version 2.0 (the "License");
|
||||
you may not use this file except in compliance with the License.
|
||||
You may obtain a copy of the License at
|
||||
|
||||
http://www.apache.org/licenses/LICENSE-2.0
|
||||
|
||||
Unless required by applicable law or agreed to in writing, software
|
||||
distributed under the License is distributed on an "AS IS" BASIS,
|
||||
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
See the License for the specific language governing permissions and
|
||||
limitations under the License.
|
||||
@@ -1,99 +0,0 @@
|
||||
/*
|
||||
* This file is part of dependency-check-gradle.
|
||||
*
|
||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
||||
* you may not use this file except in compliance with the License.
|
||||
* You may obtain a copy of the License at
|
||||
*
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Unless required by applicable law or agreed to in writing, software
|
||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
* See the License for the specific language governing permissions and
|
||||
* limitations under the License.
|
||||
*
|
||||
* Copyright (c) 2015 Sion Williams. All Rights Reserved.
|
||||
*/
|
||||
|
||||
package com.tools.security.plugin
|
||||
|
||||
import nebula.test.PluginProjectSpec
|
||||
import org.gradle.api.Task
|
||||
|
||||
class DependencyCheckGradlePluginSpec extends PluginProjectSpec {
|
||||
static final String PLUGIN_ID = 'dependency-check-gradle'
|
||||
|
||||
@Override
|
||||
String getPluginName() {
|
||||
return PLUGIN_ID
|
||||
}
|
||||
|
||||
def setup() {
|
||||
project.apply plugin: pluginName
|
||||
}
|
||||
|
||||
def 'apply creates dependencyCheck extension'() {
|
||||
expect: project.extensions.findByName( 'dependencyCheck' )
|
||||
}
|
||||
|
||||
def "apply creates dependencyCheck task"() {
|
||||
expect: project.tasks.findByName( 'dependencyCheck' )
|
||||
}
|
||||
|
||||
def 'dependencyCheck task has correct default values'() {
|
||||
setup:
|
||||
Task task = project.tasks.findByName( 'dependencyCheck' )
|
||||
|
||||
expect:
|
||||
task.group == 'Dependency Check'
|
||||
task.description == 'Produce dependency security report.'
|
||||
project.dependencyCheck.proxy.server == null
|
||||
project.dependencyCheck.proxy.port == null
|
||||
project.dependencyCheck.proxy.username == null
|
||||
project.dependencyCheck.proxy.password == null
|
||||
project.dependencyCheck.cve.url12Modified == null
|
||||
project.dependencyCheck.cve.url20Modified == null
|
||||
project.dependencyCheck.cve.startYear == null
|
||||
project.dependencyCheck.cve.url12Base == null
|
||||
project.dependencyCheck.cve.url20Base == null
|
||||
project.dependencyCheck.outputDirectory == './reports'
|
||||
project.dependencyCheck.quickQueryTimestamp == null
|
||||
}
|
||||
|
||||
def 'tasks use correct values when extension is used'() {
|
||||
when:
|
||||
project.dependencyCheck {
|
||||
proxy {
|
||||
server = '127.0.0.1'
|
||||
port = 3128
|
||||
username = 'proxyUsername'
|
||||
password = 'proxyPassword'
|
||||
}
|
||||
|
||||
cve {
|
||||
startYear = 2002
|
||||
url12Base = 'cveUrl12Base'
|
||||
url20Base = 'cveUrl20Base'
|
||||
url12Modified = 'cveUrl12Modified'
|
||||
url20Modified = 'cveUrl20Modified'
|
||||
}
|
||||
|
||||
outputDirectory = 'outputDirectory'
|
||||
quickQueryTimestamp = false
|
||||
}
|
||||
|
||||
then:
|
||||
project.dependencyCheck.proxy.server == '127.0.0.1'
|
||||
project.dependencyCheck.proxy.port == 3128
|
||||
project.dependencyCheck.proxy.username == 'proxyUsername'
|
||||
project.dependencyCheck.proxy.password == 'proxyPassword'
|
||||
project.dependencyCheck.cve.url12Modified == 'cveUrl12Modified'
|
||||
project.dependencyCheck.cve.url20Modified == 'cveUrl20Modified'
|
||||
project.dependencyCheck.cve.startYear == 2002
|
||||
project.dependencyCheck.cve.url12Base == 'cveUrl12Base'
|
||||
project.dependencyCheck.cve.url20Base == 'cveUrl20Base'
|
||||
project.dependencyCheck.outputDirectory == 'outputDirectory'
|
||||
project.dependencyCheck.quickQueryTimestamp == false
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user