org.owasp.dependencycheck.maven

Class DependencyCheckMojo

java.lang.Object

org.apache.maven.plugin.AbstractMojo

org.owasp.dependencycheck.maven.ReportAggregationMojo

org.owasp.dependencycheck.maven.DependencyCheckMojo

All Implemented Interfaces:

org.apache.maven.plugin.ContextEnabled, org.apache.maven.plugin.Mojo, org.apache.maven.reporting.MavenReport

@Mojo(name="check",
      defaultPhase=COMPILE,
      threadSafe=true,
      requiresDependencyResolution=RUNTIME_PLUS_SYSTEM,
      requiresOnline=true)
public class DependencyCheckMojo
extends ReportAggregationMojo

Maven Plugin that checks project dependencies to see if they have any known published vulnerabilities.

Author:

Jeremy Long

Field Summary

Fields inherited from interface org.apache.maven.reporting.MavenReport

CATEGORY_PROJECT_INFORMATION, CATEGORY_PROJECT_REPORTS, ROLE

Fields inherited from interface org.apache.maven.plugin.Mojo

ROLE

Constructor Summary

Constructors

Constructor and Description
DependencyCheckMojo() Constructs a new dependency-check-mojo.

Method Summary

Methods

Modifier and Type	Method and Description
protected boolean	canGenerateAggregateReport() Returns whether or not an aggregate report can be generated.
protected boolean	canGenerateNonAggregateReport() Returns whether or not a non-aggregate report can be generated.
boolean	canGenerateReport() Returns whether or not a report can be generated.
protected void	executeAggregateReport(org.apache.maven.project.MavenProject project, Locale locale) Generates the aggregate Site Report.
protected void	executeNonAggregateReport(Locale locale) Generates the Dependency-Check Site Report.
String	getCategoryName() Returns the category name.
String	getDescription(Locale locale) Gets the description of the Dependency-Check report to be displayed in the Maven Generated Reports page.
String	getName(Locale locale) Returns the report name.
String	getOutputName() Returns the output name.
protected void	performExecute() Executes the dependency-check and generates the report.
protected void	postExecute() Runs after the mojo has executed.
protected void	postGenerate() Executes after the site report has been generated.
protected List<Dependency>	readDataFile() Reads the serialized scan data from disk.
protected List<Dependency>	readDataFile(org.apache.maven.project.MavenProject project) Reads the serialized scan data from disk.
protected File	writeDataFile() Writes the scan data to disk.

Methods inherited from class org.owasp.dependencycheck.maven.ReportAggregationMojo

execute, generate, generate, getAllChildDataFiles, getAllChildren, getAllChildren, getDataFileContextKey, getDataFileName, getDataFiles, getOutputDirectoryContextKey, getProject, getReportOutputDirectory, getReportOutputDirectory, isAggregate, isExternalReport, isLastProject, isMultiModule, isMultiModule, preExecute, preGenerate, setReportOutputDirectory

Methods inherited from class org.apache.maven.plugin.AbstractMojo

getLog, getPluginContext, setLog, setPluginContext

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

DependencyCheckMojo

public DependencyCheckMojo()

Constructs a new dependency-check-mojo.

Method Detail

performExecute

protected void performExecute()
                       throws org.apache.maven.plugin.MojoExecutionException,
                              org.apache.maven.plugin.MojoFailureException

Executes the dependency-check and generates the report.

Specified by:

performExecute in class ReportAggregationMojo

Throws:

org.apache.maven.plugin.MojoExecutionException - if a maven exception occurs

org.apache.maven.plugin.MojoFailureException - thrown if a CVSS score is found that is higher then the configured level

postExecute

protected void postExecute()
                    throws org.apache.maven.plugin.MojoExecutionException,
                           org.apache.maven.plugin.MojoFailureException

Description copied from class: ReportAggregationMojo

Runs after the mojo has executed. This implementation will call writeDataFile(). As such, it is important that if this method is overriden that super.postExecute() is called.

Overrides:

postExecute in class ReportAggregationMojo

Throws:

org.apache.maven.plugin.MojoExecutionException - thrown if there is an issue executing the mojo

org.apache.maven.plugin.MojoFailureException - thrown if there is an issue executing the mojo

postGenerate

protected void postGenerate()
                     throws org.apache.maven.reporting.MavenReportException

Description copied from class: ReportAggregationMojo

Executes after the site report has been generated.

Overrides:

postGenerate in class ReportAggregationMojo

Throws:

org.apache.maven.reporting.MavenReportException - if a maven report exception occurs

executeNonAggregateReport

protected void executeNonAggregateReport(Locale locale)
                                  throws org.apache.maven.reporting.MavenReportException

Generates the Dependency-Check Site Report.

Specified by:

executeNonAggregateReport in class ReportAggregationMojo

Parameters:

locale - the locale to use when generating the report

Throws:

org.apache.maven.reporting.MavenReportException - if a maven report exception occurs

executeAggregateReport

protected void executeAggregateReport(org.apache.maven.project.MavenProject project,
                          Locale locale)
                               throws org.apache.maven.reporting.MavenReportException

Description copied from class: ReportAggregationMojo

Generates the aggregate Site Report.

Specified by:

executeAggregateReport in class ReportAggregationMojo

Parameters:

project - the maven project used to generate the aggregate report

locale - the locale to use when generating the report

Throws:

org.apache.maven.reporting.MavenReportException - if a maven report exception occurs

getOutputName

public String getOutputName()

Returns the output name.

Returns:

the output name

getCategoryName

public String getCategoryName()

Returns the category name.

Returns:

the category name

getName

public String getName(Locale locale)

Returns the report name.

Parameters:

locale - the location

Returns:

the report name

getDescription

public String getDescription(Locale locale)

Gets the description of the Dependency-Check report to be displayed in the Maven Generated Reports page.

Parameters:

locale - The Locale to get the description for

Returns:

the description

canGenerateReport

public boolean canGenerateReport()

Returns whether or not a report can be generated.

Returns:

true if a report can be generated; otherwise false

canGenerateNonAggregateReport

protected boolean canGenerateNonAggregateReport()

Returns whether or not a non-aggregate report can be generated.

Specified by:

canGenerateNonAggregateReport in class ReportAggregationMojo

Returns:

true if a non-aggregate report can be generated; otherwise false

canGenerateAggregateReport

protected boolean canGenerateAggregateReport()

Returns whether or not an aggregate report can be generated.

Specified by:

canGenerateAggregateReport in class ReportAggregationMojo

Returns:

true if an aggregate report can be generated; otherwise false

writeDataFile

protected File writeDataFile()

Writes the scan data to disk. This is used to serialize the scan data between the "check" and "aggregate" phase.

Specified by:

writeDataFile in class ReportAggregationMojo

Returns:

the File object referencing the data file that was written

readDataFile

protected List<Dependency> readDataFile()

Reads the serialized scan data from disk. This is used to serialize the scan data between the "check" and "aggregate" phase.

Returns:

a Engine object populated with dependencies if the serialized data file exists; otherwise null is returned

readDataFile

protected List<Dependency> readDataFile(org.apache.maven.project.MavenProject project)

Reads the serialized scan data from disk. This is used to serialize the scan data between the "check" and "aggregate" phase.

Parameters:

project - the Maven project to read the data file from

Returns:

a Engine object populated with dependencies if the serialized data file exists; otherwise null is returned