mirror of
https://github.com/ysoftdevs/DependencyCheck.git
synced 2026-02-19 00:47:59 +01:00
releasing updates from private repo
Former-commit-id: 745279b1fbbfe1e331adbf52ca4ccd9e75a18178
This commit is contained in:
Jeremy Long
31
src/site/markdown/index.md
Normal file
31
src/site/markdown/index.md
Normal file
@@ -0,0 +1,31 @@
|
||||
About
|
||||
====================
|
||||
Dependency-check is an open source solution the OWASP Top 10 2013 entry: [A9 -
|
||||
Using Components with Known Vulnerabilities](https://www.owasp.org/index.php/Top_10_2013-A9-Using_Components_with_Known_Vulnerabilities).
|
||||
Dependency-check can currently be used to scan Java applications (and their
|
||||
dependent libraries) to identify known vulnerable components.
|
||||
|
||||
The problem with using known vulnerable components was covered in a paper by Jeff
|
||||
Williams and Arshan Dabirsiaghi titled, "[The Unfortunate Reality of Insecure
|
||||
Libraries](https://www.aspectsecurity.com/uploads/downloads/2012/03/Aspect-Security-The-Unfortunate-Reality-of-Insecure-Libraries.pdf)".
|
||||
The gist of the paper is that we as a development community include third party
|
||||
libraries in our applications that contain well known published vulnerabilities
|
||||
\(such as those at the [National Vulnerability Database](http://web.nvd.nist.gov/view/vuln/search)\).
|
||||
|
||||
Dependency-check scans directories and files and if it contains an Analyzer that
|
||||
can scan a particular file type then information from the file is collected. This
|
||||
information is then used to identify the [Common Platform Enumeration](http://nvd.nist.gov/cpe.cfm) \(CPE\). If a
|
||||
CPE is identified a listing of associated [Common Vulnerability and Exposure](http://cve.mitre.org/) \(CVE\)
|
||||
entries are listed in a report.
|
||||
|
||||
**IMPORTANT NOTE**: Dependency-check automatically updates itself using the NVD Data Feeds hosted by
|
||||
NIST. **The initial download of the data may take fifteen minutes
|
||||
or more**, if you run the tool at least once every seven days only a small XML file
|
||||
needs to be downloaded to keep the local copy of the data current.
|
||||
|
||||
Dependency-check's core analysis library is exposed in various forms:
|
||||
|
||||
- [Command Line Tool](dependency-check-cli/index.html)
|
||||
- [Maven Plugin](dependency-check-maven/usage.html)
|
||||
- [Ant Task](dependency-check-ant/installation.html)
|
||||
- Jenkins Plugin
|
||||
@@ -1,9 +1,76 @@
|
||||
<?xml version="1.0" encoding="ISO-8859-1"?>
|
||||
<project name="DependencyCheck">
|
||||
<bannerLeft>
|
||||
<name>DependencyCheck</name>
|
||||
</bannerLeft>
|
||||
<body>
|
||||
<menu ref="reports" />
|
||||
</body>
|
||||
<!--
|
||||
This file is part of dependency-check.
|
||||
|
||||
Dependency-check is free software: you can redistribute it and/or modify it
|
||||
under the terms of the GNU General Public License as published by the Free
|
||||
Software Foundation, either version 3 of the License, or (at your option) any
|
||||
later version.
|
||||
|
||||
Dependency-check is distributed in the hope that it will be useful, but
|
||||
WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
|
||||
FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
|
||||
details.
|
||||
|
||||
You should have received a copy of the GNU General Public License along with
|
||||
dependency-check. If not, see http://www.gnu.org/licenses/.
|
||||
|
||||
Copyright (c) 2013 Jeremy Long. All Rights Reserved.
|
||||
-->
|
||||
<project name="dependency-check">
|
||||
<skin>
|
||||
<groupId>org.apache.maven.skins</groupId>
|
||||
<artifactId>maven-fluido-skin</artifactId>
|
||||
<version>1.3.0</version>
|
||||
</skin>
|
||||
<custom>
|
||||
<fluidoSkin>
|
||||
<!--<googleSearch/>-->
|
||||
<sourceLineNumbersEnabled>true</sourceLineNumbersEnabled>
|
||||
<sideBarEnabled>true</sideBarEnabled>
|
||||
<gitHub>
|
||||
<projectId>jeremylong/DependencyCheck</projectId>
|
||||
<ribbonOrientation>right</ribbonOrientation>
|
||||
<ribbonColor>gray</ribbonColor>
|
||||
</gitHub>
|
||||
<twitter>
|
||||
<user>ctxt</user>
|
||||
<showUser>true</showUser>
|
||||
<showFollowers>true</showFollowers>
|
||||
</twitter>
|
||||
|
||||
</fluidoSkin>
|
||||
</custom>
|
||||
<bannerLeft>
|
||||
<name>dependency-check</name>
|
||||
</bannerLeft>
|
||||
<publishDate position="right" />
|
||||
<version position="right" />
|
||||
<body>
|
||||
<head>
|
||||
<style type="text/css">
|
||||
#bannerLeft { margin-top:50px !important }
|
||||
</style>
|
||||
</head>
|
||||
<breadcrumbs>
|
||||
<item name=" " href="#"/>
|
||||
</breadcrumbs>
|
||||
|
||||
<menu ref="reports" />
|
||||
<menu name="Modules">
|
||||
<item name="dependency-check-core" href="./dependency-check-core/index.html">
|
||||
<description>The core dependency-check library</description>
|
||||
</item>
|
||||
<item name="dependency-check-cli" href="./dependency-check-cli/index.html">
|
||||
<description>The command line interface for dependency-check.</description>
|
||||
</item>
|
||||
<item name="dependency-check-ant" href="./dependency-check-ant/index.html">
|
||||
<description>An Ant task to run dependency-check.</description>
|
||||
</item>
|
||||
<item name="dependency-check-maven" href="./dependency-check-maven/index.html">
|
||||
<description>A Maven plugin for dependency-check.</description>
|
||||
</item>
|
||||
</menu>
|
||||
<footer/>
|
||||
</body>
|
||||
</project>
|
||||
Reference in New Issue
Block a user