diff --git a/dependency-check-cli/pom.xml b/dependency-check-cli/pom.xml index e1cdd6077..4f1089344 100644 --- a/dependency-check-cli/pom.xml +++ b/dependency-check-cli/pom.xml @@ -140,6 +140,8 @@ Copyright (c) 2012 - Jeremy Long. All Rights Reserved. .sh + plugins/* + true diff --git a/dependency-check-cli/src/main/assembly/release.xml b/dependency-check-cli/src/main/assembly/release.xml index d4cbdfd9a..13946088d 100644 --- a/dependency-check-cli/src/main/assembly/release.xml +++ b/dependency-check-cli/src/main/assembly/release.xml @@ -29,6 +29,13 @@ dependency-check/repo ${project.build.directory}/release/repo + + . + dependency-check/plugins + + */** + + dependency-check @@ -53,21 +60,4 @@ - \ No newline at end of file diff --git a/dependency-check-plugin/pom.xml b/dependency-check-plugin/pom.xml new file mode 100644 index 000000000..eeb333397 --- /dev/null +++ b/dependency-check-plugin/pom.xml @@ -0,0 +1,41 @@ + + + 4.0.0 + + org.owasp + dependency-check-parent + 1.4.5-SNAPSHOT + + org.owasp + dependency-check-plugin + Dependency-Check Plugin Archetype + jar + + + + org.apache.maven.plugins + maven-resources-plugin + + \ + + + + + + src/main/resources + true + + archetype-resources/pom.xml + + + + src/main/resources + false + + archetype-resources/pom.xml + + + + + diff --git a/dependency-check-plugin/src/main/resources/META-INF/maven/archetype-metadata.xml b/dependency-check-plugin/src/main/resources/META-INF/maven/archetype-metadata.xml new file mode 100644 index 000000000..98bb87fac --- /dev/null +++ b/dependency-check-plugin/src/main/resources/META-INF/maven/archetype-metadata.xml @@ -0,0 +1,20 @@ + + + + + src/main/java + + **/*.java + + + + src/main/resources + + **/* + + + + diff --git a/dependency-check-plugin/src/main/resources/archetype-resources/pom.xml b/dependency-check-plugin/src/main/resources/archetype-resources/pom.xml new file mode 100644 index 000000000..7c411aa09 --- /dev/null +++ b/dependency-check-plugin/src/main/resources/archetype-resources/pom.xml @@ -0,0 +1,44 @@ + + + 4.0.0 + \${groupId} + \${artifactId} + \${version} + + \${artifactId} + jar + + + + The Apache Software License, Version 2.0 + http://www.apache.org/licenses/LICENSE-2.0.txt + + + + + + org.owasp + dependency-check-utils + ${project.version} + provided + + + org.owasp + dependency-check-core + ${project.version} + provided + + + org.slf4j + slf4j-api + ${slf4j.version} + provided + + + junit + junit + 4.12 + test + + + diff --git a/dependency-check-plugin/src/main/resources/archetype-resources/src/main/java/NewPlugin.java b/dependency-check-plugin/src/main/resources/archetype-resources/src/main/java/NewPlugin.java new file mode 100644 index 000000000..b5a034803 --- /dev/null +++ b/dependency-check-plugin/src/main/resources/archetype-resources/src/main/java/NewPlugin.java @@ -0,0 +1,143 @@ +/* + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package ${package}; + +import java.io.File; +import org.slf4j.Logger; +import org.slf4j.LoggerFactory; +import org.owasp.dependencycheck.Engine; +import org.owasp.dependencycheck.analyzer.AnalysisPhase; +import org.owasp.dependencycheck.analyzer.Analyzer; +import org.owasp.dependencycheck.analyzer.FileTypeAnalyzer; +import org.owasp.dependencycheck.analyzer.exception.AnalysisException; +import org.owasp.dependencycheck.dependency.Dependency; +import org.owasp.dependencycheck.exception.InitializationException; + +/** + * An OWASP dependency-check plug-in example. If you are not implementing a + * FileTypeAnalyzer, simple remove the annotation and the accept() method. + */ +public class NewPlugin implements Analyzer, FileTypeAnalyzer { + + /** + * The Logger for use throughout the NewPlugin. + */ + private static final Logger LOGGER = LoggerFactory.getLogger(NewPlugin.class); + + /** + *

+ * Method implementation for the FileTypeAnalyzer; if not implementing a + * file type analyzer this method can be removed.

+ *

+ * Determines if the analyzer can process the given file.

+ * + * @param pathname the path to the file + * @return true if the analyzer can process the file; otherwise + * false + */ + @Override + public boolean accept(File pathname) { + throw new UnsupportedOperationException("Not implemented yet."); + } + + /** + * Analyzes the given dependency. The analysis could be anything from + * identifying an Identifier for the dependency, to finding vulnerabilities, + * etc. Additionally, if the analyzer collects enough information to add a + * description or license information for the dependency it should be added. + * + * @param dependency a dependency to analyze. + * @param engine the engine that is scanning the dependencies - this is + * useful if we need to check other dependencies + * @throws AnalysisException is thrown if there is an error analyzing the + * dependency file + */ + @Override + public void analyze(Dependency dependency, Engine engine) throws AnalysisException { + if (enabled) { + throw new UnsupportedOperationException("Not implemented yet."); + } + } + + /** + * Returns the name of the analyzer. + * + * @return the name of the analyzer. + */ + @Override + public String getName() { + return "New Plugin"; + } + + /** + * Returns the phase that the analyzer is intended to run in. + * + * @return the phase that the analyzer is intended to run in. + */ + @Override + public AnalysisPhase getAnalysisPhase() { + return AnalysisPhase.INFORMATION_COLLECTION; + } + + /** + * The initialize method is called (once) prior to the analyze method being + * called on all of the dependencies. + * + * @throws InitializationException is thrown if an exception occurs + * initializing the analyzer. + */ + @Override + public void initialize() throws InitializationException { + + } + + /** + * The close method is called after all of the dependencies have been + * analyzed. + * + * @throws Exception is thrown if an exception occurs closing the analyzer. + */ + @Override + public void close() throws Exception { + + } + + /** + * Returns whether multiple instances of the same type of analyzer can run + * in parallel. Note that running analyzers of different types in parallel + * is not supported at all. + * + * @return {@code true} if the analyzer supports parallel processing, + * {@code false} else + */ + @Override + public boolean supportsParallelProcessing() { + return true; + } + + /** + * Flag indicating whether or not the analyzer is enabled. + */ + private boolean enabled = true; + + /** + * Returns whether or not the analyzer is enabled. + * + * @return whether or not the analyzer is enabled + */ + @Override + public boolean isEnabled() { + return enabled; + } +} diff --git a/dependency-check-plugin/src/main/resources/archetype-resources/src/main/resources/META-INF/services/org.owasp.dependencycheck.analyzer.Analyzer b/dependency-check-plugin/src/main/resources/archetype-resources/src/main/resources/META-INF/services/org.owasp.dependencycheck.analyzer.Analyzer new file mode 100644 index 000000000..92854d72b --- /dev/null +++ b/dependency-check-plugin/src/main/resources/archetype-resources/src/main/resources/META-INF/services/org.owasp.dependencycheck.analyzer.Analyzer @@ -0,0 +1 @@ +${package}.NewPlugin \ No newline at end of file diff --git a/dependency-check-plugin/src/main/resources/archetype-resources/src/main/resources/META-INF/services/org.owasp.dependencycheck.data.update.CachedWebDataSource b/dependency-check-plugin/src/main/resources/archetype-resources/src/main/resources/META-INF/services/org.owasp.dependencycheck.data.update.CachedWebDataSource new file mode 100644 index 000000000..e69de29bb diff --git a/pom.xml b/pom.xml index b71888541..c47d96199 100644 --- a/pom.xml +++ b/pom.xml @@ -29,6 +29,7 @@ Copyright (c) 2012 - Jeremy Long dependency-check-ant dependency-check-maven dependency-check-utils + dependency-check-plugin Dependency-Check https://github.com/jeremylong/DependencyCheck.git @@ -222,7 +223,7 @@ Copyright (c) 2012 - Jeremy Long org.apache.maven.plugins maven-resources-plugin - 3.0.1 + 3.0.2 org.apache.maven.plugins