diff --git a/dependency-check-maven/pom.xml b/dependency-check-maven/pom.xml index 42233ed3d..187081527 100644 --- a/dependency-check-maven/pom.xml +++ b/dependency-check-maven/pom.xml @@ -217,7 +217,7 @@ Copyright (c) 2013 Jeremy Long. All Rights Reserved. org.apache.maven.plugins maven-invoker-plugin - 2.0.0 + 3.0.1 org.codehaus.groovy @@ -228,7 +228,7 @@ Copyright (c) 2013 Jeremy Long. All Rights Reserved. - 2 + 4 690-threadsafety/pom.xml 618-aggregator-purge/pom.xml diff --git a/dependency-check-maven/src/it/617-hierarchical-cross-deps/prebuild.groovy b/dependency-check-maven/src/it/617-hierarchical-cross-deps/prebuild.groovy deleted file mode 100644 index 9eff4bb5c..000000000 --- a/dependency-check-maven/src/it/617-hierarchical-cross-deps/prebuild.groovy +++ /dev/null @@ -1,17 +0,0 @@ -/* - * This file is part of dependency-check-maven. - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - * - * Copyright (c) 2014 Jeremy Long. All Rights Reserved. - */ diff --git a/dependency-check-maven/src/it/618-aggregator-update-only/prebuild.groovy b/dependency-check-maven/src/it/618-aggregator-update-only/prebuild.groovy deleted file mode 100644 index 3071d8668..000000000 --- a/dependency-check-maven/src/it/618-aggregator-update-only/prebuild.groovy +++ /dev/null @@ -1,18 +0,0 @@ -/* - * This file is part of dependency-check-maven. - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - * - * Copyright (c) 2014 Jeremy Long. All Rights Reserved. - */ - diff --git a/dependency-check-maven/src/it/629-jackson-dataformat/prebuild.groovy b/dependency-check-maven/src/it/629-jackson-dataformat/prebuild.groovy deleted file mode 100644 index 9eff4bb5c..000000000 --- a/dependency-check-maven/src/it/629-jackson-dataformat/prebuild.groovy +++ /dev/null @@ -1,17 +0,0 @@ -/* - * This file is part of dependency-check-maven. - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - * - * Copyright (c) 2014 Jeremy Long. All Rights Reserved. - */ diff --git a/dependency-check-maven/src/it/690-threadsafety/prebuild.groovy b/dependency-check-maven/src/it/690-threadsafety/prebuild.groovy deleted file mode 100644 index 9eff4bb5c..000000000 --- a/dependency-check-maven/src/it/690-threadsafety/prebuild.groovy +++ /dev/null @@ -1,17 +0,0 @@ -/* - * This file is part of dependency-check-maven. - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - * - * Copyright (c) 2014 Jeremy Long. All Rights Reserved. - */ diff --git a/dependency-check-maven/src/it/710-pom-parse-error/prebuild.groovy b/dependency-check-maven/src/it/710-pom-parse-error/prebuild.groovy deleted file mode 100644 index 9eff4bb5c..000000000 --- a/dependency-check-maven/src/it/710-pom-parse-error/prebuild.groovy +++ /dev/null @@ -1,17 +0,0 @@ -/* - * This file is part of dependency-check-maven. - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - * - * Copyright (c) 2014 Jeremy Long. All Rights Reserved. - */ diff --git a/dependency-check-maven/src/it/729-system-scope-resolved/prebuild.groovy b/dependency-check-maven/src/it/729-system-scope-resolved/prebuild.groovy deleted file mode 100644 index 9ec3a0a91..000000000 --- a/dependency-check-maven/src/it/729-system-scope-resolved/prebuild.groovy +++ /dev/null @@ -1,17 +0,0 @@ -/* - * This file is part of dependency-check-maven. - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - * - * Copyright (c) 2017 Jeremy Long. All Rights Reserved. - */ diff --git a/dependency-check-maven/src/it/729-system-scope-skipped/prebuild.groovy b/dependency-check-maven/src/it/729-system-scope-skipped/prebuild.groovy deleted file mode 100644 index 9eff4bb5c..000000000 --- a/dependency-check-maven/src/it/729-system-scope-skipped/prebuild.groovy +++ /dev/null @@ -1,17 +0,0 @@ -/* - * This file is part of dependency-check-maven. - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - * - * Copyright (c) 2014 Jeremy Long. All Rights Reserved. - */ diff --git a/dependency-check-maven/src/it/815-broken-suppression-aggregate/broken-suppression.xml b/dependency-check-maven/src/it/815-broken-suppression-aggregate/broken-suppression.xml new file mode 100644 index 000000000..598a56cae --- /dev/null +++ b/dependency-check-maven/src/it/815-broken-suppression-aggregate/broken-suppression.xml @@ -0,0 +1,27 @@ + + + + + + ^com\.vaadin\.external\.google:android-json:.*$ + cpe:/a:google:android + + diff --git a/dependency-check-maven/src/it/815-broken-suppression-aggregate/invoker.properties b/dependency-check-maven/src/it/815-broken-suppression-aggregate/invoker.properties new file mode 100644 index 000000000..8d65ccd95 --- /dev/null +++ b/dependency-check-maven/src/it/815-broken-suppression-aggregate/invoker.properties @@ -0,0 +1,19 @@ +# +# This file is part of dependency-check-core. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# +# Copyright (c) 2017 The OWASP Foundation. All Rights Reserved. +# +invoker.buildResult = failure +invoker.goals = install ${project.groupId}:${project.artifactId}:${project.version}:aggregate diff --git a/dependency-check-maven/src/it/815-broken-suppression-aggregate/pom.xml b/dependency-check-maven/src/it/815-broken-suppression-aggregate/pom.xml new file mode 100644 index 000000000..e37076fd1 --- /dev/null +++ b/dependency-check-maven/src/it/815-broken-suppression-aggregate/pom.xml @@ -0,0 +1,53 @@ + + + + 4.0.0 + org.owasp.test + test-broken-suppression-files + 1.0.0-SNAPSHOT + jar + + + + + com.vaadin.external.google + android-json + 0.0.20131108.vaadin1 + + + com.fasterxml.jackson.dataformat + jackson-dataformat-xml + 2.4.5 + + + + + + + org.owasp + dependency-check-maven + + + ${project.basedir}/broken-suppression.xml + + + + + + diff --git a/dependency-check-maven/src/it/false-positives/prebuild.groovy b/dependency-check-maven/src/it/false-positives/prebuild.groovy deleted file mode 100644 index c1e9eda11..000000000 --- a/dependency-check-maven/src/it/false-positives/prebuild.groovy +++ /dev/null @@ -1,28 +0,0 @@ -/* - * This file is part of dependency-check-maven. - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - * - * Copyright (c) 2014 Jeremy Long. All Rights Reserved. - */ - -import org.apache.commons.io.FileUtils; - -// Load NVD-CVE if not exist and had been saved in a previous IT -File datasDwl = new File("target/local-repo/org/owasp/dependency-check-data/3.0", "dc.h2.db"); -File datasSave = new File("target/nvd-cve-backup", "dc.h2.db"); - -if (!datasDwl.exists() && datasSave.exists()){ - System.out.println("Load NVD-CVE from backup"); - FileUtils.copyFile(datasSave, datasDwl); -} diff --git a/dependency-check-maven/src/main/java/org/owasp/dependencycheck/maven/AggregateMojo.java b/dependency-check-maven/src/main/java/org/owasp/dependencycheck/maven/AggregateMojo.java index 7a0c0b6d5..b64e0b489 100644 --- a/dependency-check-maven/src/main/java/org/owasp/dependencycheck/maven/AggregateMojo.java +++ b/dependency-check-maven/src/main/java/org/owasp/dependencycheck/maven/AggregateMojo.java @@ -86,6 +86,14 @@ public class AggregateMojo extends BaseDependencyCheckMojo { exCol.getExceptions().addAll(ex.getExceptions()); if (ex.isFatal()) { exCol.setFatal(true); + final String msg = String.format("Fatal exception(s) analyzing %s", childProject.getName()); + if (this.isFailOnError()) { + throw new MojoExecutionException(msg, exCol); + } + getLog().error(msg); + if (getLog().isDebugEnabled()) { + getLog().debug(exCol); + } } } } @@ -139,6 +147,9 @@ public class AggregateMojo extends BaseDependencyCheckMojo { } showSummary(this.getProject(), engine.getDependencies()); checkForFailure(engine.getDependencies()); + if (exCol != null && this.isFailOnError()) { + throw new MojoExecutionException("One or more exceptions occurred during dependency-check analysis", exCol); + } engine.cleanup(); Settings.cleanup(); }