1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18 package org.owasp.dependencycheck.maven;
19
20 import java.io.BufferedOutputStream;
21 import java.io.File;
22 import java.io.FileInputStream;
23 import java.io.FileNotFoundException;
24 import java.io.FileOutputStream;
25 import java.io.IOException;
26 import java.io.InputStream;
27 import java.io.ObjectInputStream;
28 import java.io.ObjectOutputStream;
29 import java.util.List;
30 import java.util.Locale;
31 import org.apache.maven.artifact.Artifact;
32 import org.apache.maven.doxia.sink.Sink;
33 import org.apache.maven.plugin.AbstractMojo;
34 import org.apache.maven.plugin.MojoExecutionException;
35 import org.apache.maven.plugin.MojoFailureException;
36 import org.apache.maven.plugins.annotations.Parameter;
37 import org.apache.maven.project.MavenProject;
38 import org.apache.maven.reporting.MavenReport;
39 import org.apache.maven.reporting.MavenReportException;
40 import org.apache.maven.settings.Proxy;
41 import org.owasp.dependencycheck.data.nexus.MavenArtifact;
42 import org.owasp.dependencycheck.data.nvdcve.CveDB;
43 import org.owasp.dependencycheck.data.nvdcve.DatabaseException;
44 import org.owasp.dependencycheck.data.nvdcve.DatabaseProperties;
45 import org.owasp.dependencycheck.dependency.Confidence;
46 import org.owasp.dependencycheck.dependency.Dependency;
47 import org.owasp.dependencycheck.dependency.Identifier;
48 import org.owasp.dependencycheck.dependency.Vulnerability;
49 import org.owasp.dependencycheck.reporting.ReportGenerator;
50 import org.owasp.dependencycheck.utils.Settings;
51
52
53
54
55
56 public abstract class BaseDependencyCheckMojo extends AbstractMojo implements MavenReport {
57
58
59
60
61
62 private static final String PROPERTIES_FILE = "mojo.properties";
63
64
65
66 private static final String NEW_LINE = System.getProperty("line.separator", "\n").intern();
67
68
69
70 @Parameter(property = "metaFileName", defaultValue = "dependency-check.ser", required = true)
71 private String dataFileName;
72
73
74
75
76
77
78 @Parameter(property = "project", required = true, readonly = true)
79 private MavenProject project;
80
81
82
83 @Parameter(readonly = true, required = true, property = "reactorProjects")
84 private List<MavenProject> reactorProjects;
85
86
87
88
89 @Parameter(defaultValue = "${project.build.directory}", required = true)
90 private File outputDirectory;
91
92
93
94 @Parameter(property = "project.reporting.outputDirectory", required = true)
95 private File reportOutputDirectory;
96
97
98
99
100 @SuppressWarnings("CanBeFinal")
101 @Parameter(property = "failBuildOnCVSS", defaultValue = "11", required = true)
102 private float failBuildOnCVSS = 11;
103
104
105
106
107 @SuppressWarnings("CanBeFinal")
108 @Parameter(property = "autoupdate")
109 private Boolean autoUpdate;
110
111
112
113
114
115 @Parameter(property = "aggregate")
116 @Deprecated
117 private Boolean aggregate;
118
119
120
121
122 @SuppressWarnings("CanBeFinal")
123 @Parameter(property = "format", defaultValue = "HTML", required = true)
124 private String format = "HTML";
125
126
127
128 @Parameter(property = "mavenSettings", defaultValue = "${settings}", required = false)
129 private org.apache.maven.settings.Settings mavenSettings;
130
131
132
133
134 @SuppressWarnings("CanBeFinal")
135 @Parameter(property = "mavenSettingsProxyId", required = false)
136 private String mavenSettingsProxyId;
137
138
139
140
141 @Parameter(property = "connectionTimeout", defaultValue = "", required = false)
142 private String connectionTimeout;
143
144
145
146 @Parameter(property = "suppressionFile", defaultValue = "", required = false)
147 private String suppressionFile;
148
149
150
151 @Parameter(property = "showSummary", defaultValue = "true", required = false)
152 private boolean showSummary = true;
153
154
155
156
157 @Parameter(property = "jarAnalyzerEnabled", required = false)
158 private Boolean jarAnalyzerEnabled;
159
160
161
162
163 @Parameter(property = "archiveAnalyzerEnabled", required = false)
164 private Boolean archiveAnalyzerEnabled;
165
166
167
168
169 @Parameter(property = "pyDistributionAnalyzerEnabled", required = false)
170 private Boolean pyDistributionAnalyzerEnabled;
171
172
173
174 @Parameter(property = "pyPackageAnalyzerEnabled", required = false)
175 private Boolean pyPackageAnalyzerEnabled;
176
177
178
179 @Parameter(property = "rubygemsAnalyzerEnabled", required = false)
180 private Boolean rubygemsAnalyzerEnabled;
181
182
183
184 @Parameter(property = "opensslAnalyzerEnabled", required = false)
185 private Boolean opensslAnalyzerEnabled;
186
187
188
189 @Parameter(property = "cmakeAnalyzerEnabled", required = false)
190 private Boolean cmakeAnalyzerEnabled;
191
192
193
194 @Parameter(property = "autoconfAnalyzerEnabled", required = false)
195 private Boolean autoconfAnalyzerEnabled;
196
197
198
199 @Parameter(property = "composerAnalyzerEnabled", required = false)
200 private Boolean composerAnalyzerEnabled;
201
202
203
204 @Parameter(property = "nodeAnalyzerEnabled", required = false)
205 private Boolean nodeAnalyzerEnabled;
206
207
208
209
210 @Parameter(property = "assemblyAnalyzerEnabled", required = false)
211 private Boolean assemblyAnalyzerEnabled;
212
213
214
215
216 @Parameter(property = "nuspecAnalyzerEnabled", required = false)
217 private Boolean nuspecAnalyzerEnabled;
218
219
220
221
222 @Parameter(property = "centralAnalyzerEnabled", required = false)
223 private Boolean centralAnalyzerEnabled;
224
225
226
227
228 @Parameter(property = "nexusAnalyzerEnabled", required = false)
229 private Boolean nexusAnalyzerEnabled;
230
231
232
233
234 @Parameter(property = "nexusUrl", required = false)
235 private String nexusUrl;
236
237
238
239 @Parameter(property = "nexusUsesProxy", required = false)
240 private Boolean nexusUsesProxy;
241
242
243
244 @Parameter(property = "connectionString", defaultValue = "", required = false)
245 private String connectionString;
246
247
248
249
250
251
252 protected String getConnectionString() {
253 return connectionString;
254 }
255
256
257
258 @Parameter(property = "databaseDriverName", defaultValue = "", required = false)
259 private String databaseDriverName;
260
261
262
263 @Parameter(property = "databaseDriverPath", defaultValue = "", required = false)
264 private String databaseDriverPath;
265
266
267
268 @Parameter(property = "databaseUser", defaultValue = "", required = false)
269 private String databaseUser;
270
271
272
273 @Parameter(property = "databasePassword", defaultValue = "", required = false)
274 private String databasePassword;
275
276
277
278 @Parameter(property = "zipExtensions", required = false)
279 private String zipExtensions;
280
281
282
283 @SuppressWarnings("CanBeFinal")
284 @Parameter(property = "dependency-check.skip", defaultValue = "false", required = false)
285 private boolean skip = false;
286
287
288
289 @SuppressWarnings("CanBeFinal")
290 @Parameter(property = "skipTestScope", defaultValue = "true", required = false)
291 private boolean skipTestScope = true;
292
293
294
295 @SuppressWarnings("CanBeFinal")
296 @Parameter(property = "skipRuntimeScope", defaultValue = "false", required = false)
297 private boolean skipRuntimeScope = false;
298
299
300
301 @SuppressWarnings("CanBeFinal")
302 @Parameter(property = "skipProvidedScope", defaultValue = "false", required = false)
303 private boolean skipProvidedScope = false;
304
305
306
307 @Parameter(property = "dataDirectory", defaultValue = "", required = false)
308 private String dataDirectory;
309
310
311
312 @Parameter(property = "cveUrl12Modified", defaultValue = "", required = false)
313 private String cveUrl12Modified;
314
315
316
317 @Parameter(property = "cveUrl20Modified", defaultValue = "", required = false)
318 private String cveUrl20Modified;
319
320
321
322 @Parameter(property = "cveUrl12Base", defaultValue = "", required = false)
323 private String cveUrl12Base;
324
325
326
327 @Parameter(property = "cveUrl20Base", defaultValue = "", required = false)
328 private String cveUrl20Base;
329
330
331
332 @Parameter(property = "cveValidForHours", defaultValue = "", required = false)
333 private Integer cveValidForHours;
334
335
336
337
338 @Parameter(property = "pathToMono", defaultValue = "", required = false)
339 private String pathToMono;
340
341
342
343
344
345
346 @SuppressWarnings("CanBeFinal")
347 @Parameter(property = "proxyUrl", defaultValue = "", required = false)
348 @Deprecated
349 private String proxyUrl = null;
350
351
352
353
354
355 @SuppressWarnings("CanBeFinal")
356 @Parameter(property = "externalReport")
357 @Deprecated
358 private String externalReport = null;
359
360
361
362
363
364
365
366
367
368 @Override
369 public void execute() throws MojoExecutionException, MojoFailureException {
370 if (skip) {
371 getLog().info("Skipping " + getName(Locale.US));
372 } else {
373 validateAggregate();
374 project.setContextValue(getOutputDirectoryContextKey(), this.outputDirectory);
375 runCheck();
376 }
377 }
378
379
380
381
382
383
384
385 private void validateAggregate() throws MojoExecutionException {
386 if (aggregate != null && aggregate) {
387 final String msg = "Aggregate configuration detected - as of dependency-check 1.2.8 this no longer supported. "
388 + "Please use the aggregate goal instead.";
389 throw new MojoExecutionException(msg);
390 }
391 }
392
393
394
395
396
397
398
399
400
401 @Override
402 @Deprecated
403 public final void generate(@SuppressWarnings("deprecation") org.codehaus.doxia.sink.Sink sink, Locale locale) throws MavenReportException {
404 generate((Sink) sink, locale);
405 }
406
407
408
409
410
411
412
413
414 public void generate(Sink sink, Locale locale) throws MavenReportException {
415 try {
416 validateAggregate();
417 } catch (MojoExecutionException ex) {
418 throw new MavenReportException(ex.getMessage());
419 }
420 project.setContextValue(getOutputDirectoryContextKey(), getReportOutputDirectory());
421 try {
422 runCheck();
423 } catch (MojoExecutionException ex) {
424 throw new MavenReportException(ex.getMessage(), ex);
425 } catch (MojoFailureException ex) {
426 getLog().warn("Vulnerabilities were identifies that exceed the CVSS threshold for failing the build");
427 }
428 }
429
430
431
432
433
434
435
436 protected File getCorrectOutputDirectory() throws MojoExecutionException {
437 return getCorrectOutputDirectory(this.project);
438 }
439
440
441
442
443
444
445
446 protected File getCorrectOutputDirectory(MavenProject current) {
447 final Object obj = current.getContextValue(getOutputDirectoryContextKey());
448 if (obj != null && obj instanceof File) {
449 return (File) obj;
450 }
451 File target = new File(current.getBuild().getDirectory());
452 if (target.getParentFile() != null && "target".equals(target.getParentFile().getName())) {
453 target = target.getParentFile();
454 }
455 return target;
456 }
457
458
459
460
461
462
463
464 protected File getDataFile(MavenProject current) {
465 if (getLog().isDebugEnabled()) {
466 getLog().debug(String.format("Getting data filefor %s using key '%s'", current.getName(), getDataFileContextKey()));
467 }
468 final Object obj = current.getContextValue(getDataFileContextKey());
469 if (obj != null) {
470 if (obj instanceof String) {
471 final File f = new File((String) obj);
472 return f;
473 }
474 } else {
475 if (getLog().isDebugEnabled()) {
476 getLog().debug("Context value not found");
477 }
478 }
479 return null;
480 }
481
482
483
484
485
486
487
488 protected void scanArtifacts(MavenProject project, Engine engine) {
489 for (Artifact a : project.getArtifacts()) {
490 if (excludeFromScan(a)) {
491 continue;
492 }
493 final List<Dependency> deps = engine.scan(a.getFile().getAbsoluteFile());
494 if (deps != null) {
495 if (deps.size() == 1) {
496 final Dependency d = deps.get(0);
497 if (d != null) {
498 final MavenArtifact ma = new MavenArtifact(a.getGroupId(), a.getArtifactId(), a.getVersion());
499 d.addAsEvidence("pom", ma, Confidence.HIGHEST);
500 d.addProjectReference(project.getName());
501 if (getLog().isDebugEnabled()) {
502 getLog().debug(String.format("Adding project reference %s on dependency %s", project.getName(),
503 d.getDisplayFileName()));
504 }
505 }
506 } else {
507 if (getLog().isDebugEnabled()) {
508 final String msg = String.format("More then 1 dependency was identified in first pass scan of '%s:%s:%s'",
509 a.getGroupId(), a.getArtifactId(), a.getVersion());
510 getLog().debug(msg);
511 }
512 }
513 }
514 }
515 }
516
517
518
519
520
521
522
523 public abstract void runCheck() throws MojoExecutionException, MojoFailureException;
524
525
526
527
528
529
530 @Override
531 public void setReportOutputDirectory(File directory) {
532 reportOutputDirectory = directory;
533 }
534
535
536
537
538
539
540 @Override
541 public File getReportOutputDirectory() {
542 return reportOutputDirectory;
543 }
544
545
546
547
548
549
550 public File getOutputDirectory() {
551 return outputDirectory;
552 }
553
554
555
556
557
558
559 @Override
560 public final boolean isExternalReport() {
561 return true;
562 }
563
564
565
566
567
568
569 @Override
570 public String getOutputName() {
571 if ("HTML".equalsIgnoreCase(this.format) || "ALL".equalsIgnoreCase(this.format)) {
572 return "dependency-check-report";
573 } else if ("XML".equalsIgnoreCase(this.format)) {
574 return "dependency-check-report.xml#";
575 } else if ("VULN".equalsIgnoreCase(this.format)) {
576 return "dependency-check-vulnerability";
577 } else {
578 getLog().warn("Unknown report format used during site generation.");
579 return "dependency-check-report";
580 }
581 }
582
583
584
585
586
587
588 @Override
589 public String getCategoryName() {
590 return MavenReport.CATEGORY_PROJECT_REPORTS;
591 }
592
593
594
595
596
597
598
599
600 protected Engine initializeEngine() throws DatabaseException {
601 populateSettings();
602 return new Engine(this.project,
603 this.reactorProjects);
604 }
605
606
607
608
609
610 protected void populateSettings() {
611 Settings.initialize();
612 InputStream mojoProperties = null;
613 try {
614 mojoProperties = this.getClass().getClassLoader().getResourceAsStream(PROPERTIES_FILE);
615 Settings.mergeProperties(mojoProperties);
616 } catch (IOException ex) {
617 getLog().warn("Unable to load the dependency-check ant task.properties file.");
618 if (getLog().isDebugEnabled()) {
619 getLog().debug("", ex);
620 }
621 } finally {
622 if (mojoProperties != null) {
623 try {
624 mojoProperties.close();
625 } catch (IOException ex) {
626 if (getLog().isDebugEnabled()) {
627 getLog().debug("", ex);
628 }
629 }
630 }
631 }
632 Settings.setBooleanIfNotNull(Settings.KEYS.AUTO_UPDATE, autoUpdate);
633
634 if (externalReport != null) {
635 getLog().warn("The 'externalReport' option was set; this configuration option has been removed. "
636 + "Please update the dependency-check-maven plugin's configuration");
637 }
638
639 if (proxyUrl != null && !proxyUrl.isEmpty()) {
640 getLog().warn("Deprecated configuration detected, proxyUrl will be ignored; use the maven settings " + "to configure the proxy instead");
641 }
642 final Proxy proxy = getMavenProxy();
643 if (proxy != null) {
644 Settings.setString(Settings.KEYS.PROXY_SERVER, proxy.getHost());
645 Settings.setString(Settings.KEYS.PROXY_PORT, Integer.toString(proxy.getPort()));
646 final String userName = proxy.getUsername();
647 final String password = proxy.getPassword();
648 Settings.setStringIfNotNull(Settings.KEYS.PROXY_USERNAME, userName);
649 Settings.setStringIfNotNull(Settings.KEYS.PROXY_PASSWORD, password);
650 }
651
652 Settings.setStringIfNotEmpty(Settings.KEYS.CONNECTION_TIMEOUT, connectionTimeout);
653 Settings.setStringIfNotEmpty(Settings.KEYS.SUPPRESSION_FILE, suppressionFile);
654
655
656 Settings.setBooleanIfNotNull(Settings.KEYS.ANALYZER_JAR_ENABLED, jarAnalyzerEnabled);
657 Settings.setBooleanIfNotNull(Settings.KEYS.ANALYZER_NUSPEC_ENABLED, nuspecAnalyzerEnabled);
658 Settings.setBooleanIfNotNull(Settings.KEYS.ANALYZER_CENTRAL_ENABLED, centralAnalyzerEnabled);
659 Settings.setBooleanIfNotNull(Settings.KEYS.ANALYZER_NEXUS_ENABLED, nexusAnalyzerEnabled);
660 Settings.setStringIfNotEmpty(Settings.KEYS.ANALYZER_NEXUS_URL, nexusUrl);
661 Settings.setBooleanIfNotNull(Settings.KEYS.ANALYZER_NEXUS_USES_PROXY, nexusUsesProxy);
662 Settings.setBooleanIfNotNull(Settings.KEYS.ANALYZER_ASSEMBLY_ENABLED, assemblyAnalyzerEnabled);
663 Settings.setBooleanIfNotNull(Settings.KEYS.ANALYZER_ARCHIVE_ENABLED, archiveAnalyzerEnabled);
664 Settings.setStringIfNotEmpty(Settings.KEYS.ADDITIONAL_ZIP_EXTENSIONS, zipExtensions);
665 Settings.setStringIfNotEmpty(Settings.KEYS.ANALYZER_ASSEMBLY_MONO_PATH, pathToMono);
666
667 Settings.setBooleanIfNotNull(Settings.KEYS.ANALYZER_PYTHON_DISTRIBUTION_ENABLED, pyDistributionAnalyzerEnabled);
668 Settings.setBooleanIfNotNull(Settings.KEYS.ANALYZER_PYTHON_PACKAGE_ENABLED, pyPackageAnalyzerEnabled);
669 Settings.setBooleanIfNotNull(Settings.KEYS.ANALYZER_RUBY_GEMSPEC_ENABLED, rubygemsAnalyzerEnabled);
670 Settings.setBooleanIfNotNull(Settings.KEYS.ANALYZER_OPENSSL_ENABLED, opensslAnalyzerEnabled);
671 Settings.setBooleanIfNotNull(Settings.KEYS.ANALYZER_CMAKE_ENABLED, cmakeAnalyzerEnabled);
672 Settings.setBooleanIfNotNull(Settings.KEYS.ANALYZER_AUTOCONF_ENABLED, autoconfAnalyzerEnabled);
673 Settings.setBooleanIfNotNull(Settings.KEYS.ANALYZER_COMPOSER_LOCK_ENABLED, composerAnalyzerEnabled);
674 Settings.setBooleanIfNotNull(Settings.KEYS.ANALYZER_NODE_PACKAGE_ENABLED, nodeAnalyzerEnabled);
675
676
677 Settings.setStringIfNotEmpty(Settings.KEYS.DB_DRIVER_NAME, databaseDriverName);
678 Settings.setStringIfNotEmpty(Settings.KEYS.DB_DRIVER_PATH, databaseDriverPath);
679 Settings.setStringIfNotEmpty(Settings.KEYS.DB_CONNECTION_STRING, connectionString);
680 Settings.setStringIfNotEmpty(Settings.KEYS.DB_USER, databaseUser);
681 Settings.setStringIfNotEmpty(Settings.KEYS.DB_PASSWORD, databasePassword);
682
683 Settings.setStringIfNotEmpty(Settings.KEYS.DATA_DIRECTORY, dataDirectory);
684
685 Settings.setStringIfNotEmpty(Settings.KEYS.CVE_MODIFIED_12_URL, cveUrl12Modified);
686 Settings.setStringIfNotEmpty(Settings.KEYS.CVE_MODIFIED_20_URL, cveUrl20Modified);
687 Settings.setStringIfNotEmpty(Settings.KEYS.CVE_SCHEMA_1_2, cveUrl12Base);
688 Settings.setStringIfNotEmpty(Settings.KEYS.CVE_SCHEMA_2_0, cveUrl20Base);
689 Settings.setIntIfNotNull(Settings.KEYS.CVE_CHECK_VALID_FOR_HOURS, cveValidForHours);
690
691 }
692
693
694
695
696
697
698 private Proxy getMavenProxy() {
699 if (mavenSettings != null) {
700 final List<Proxy> proxies = mavenSettings.getProxies();
701 if (proxies != null && !proxies.isEmpty()) {
702 if (mavenSettingsProxyId != null) {
703 for (Proxy proxy : proxies) {
704 if (mavenSettingsProxyId.equalsIgnoreCase(proxy.getId())) {
705 return proxy;
706 }
707 }
708 } else if (proxies.size() == 1) {
709 return proxies.get(0);
710 } else {
711 getLog().warn("Multiple proxy definitions exist in the Maven settings. In the dependency-check "
712 + "configuration set the mavenSettingsProxyId so that the correct proxy will be used.");
713 throw new IllegalStateException("Ambiguous proxy definition");
714 }
715 }
716 }
717 return null;
718 }
719
720
721
722
723
724
725
726 protected boolean excludeFromScan(Artifact a) {
727 if (skipTestScope && Artifact.SCOPE_TEST.equals(a.getScope())) {
728 return true;
729 }
730 if (skipProvidedScope && Artifact.SCOPE_PROVIDED.equals(a.getScope())) {
731 return true;
732 }
733 if (skipRuntimeScope && !Artifact.SCOPE_RUNTIME.equals(a.getScope())) {
734 return true;
735 }
736 return false;
737 }
738
739
740
741
742
743
744
745
746
747 protected MavenProject getProject() {
748 return project;
749 }
750
751
752
753
754
755
756 protected List<MavenProject> getReactorProjects() {
757 return reactorProjects;
758 }
759
760
761
762
763
764
765 protected String getFormat() {
766 return format;
767 }
768
769
770
771
772
773
774
775
776 protected void writeReports(Engine engine, MavenProject p, File outputDir) {
777 DatabaseProperties prop = null;
778 CveDB cve = null;
779 try {
780 cve = new CveDB();
781 cve.open();
782 prop = cve.getDatabaseProperties();
783 } catch (DatabaseException ex) {
784 if (getLog().isDebugEnabled()) {
785 getLog().debug("Unable to retrieve DB Properties", ex);
786 }
787 } finally {
788 if (cve != null) {
789 cve.close();
790 }
791 }
792 final ReportGenerator r = new ReportGenerator(p.getName(), engine.getDependencies(), engine.getAnalyzers(), prop);
793 try {
794 r.generateReports(outputDir.getAbsolutePath(), format);
795 } catch (IOException ex) {
796 getLog().error(
797 "Unexpected exception occurred during analysis; please see the verbose error log for more details.");
798 if (getLog().isDebugEnabled()) {
799 getLog().debug("", ex);
800 }
801 } catch (Throwable ex) {
802 getLog().error(
803 "Unexpected exception occurred during analysis; please see the verbose error log for more details.");
804 if (getLog().isDebugEnabled()) {
805 getLog().debug("", ex);
806 }
807 }
808 }
809
810
811
812
813
814
815
816
817
818 protected void checkForFailure(List<Dependency> dependencies) throws MojoFailureException {
819 if (failBuildOnCVSS <= 10) {
820 final StringBuilder ids = new StringBuilder();
821 for (Dependency d : dependencies) {
822 boolean addName = true;
823 for (Vulnerability v : d.getVulnerabilities()) {
824 if (v.getCvssScore() >= failBuildOnCVSS) {
825 if (addName) {
826 addName = false;
827 ids.append(NEW_LINE).append(d.getFileName()).append(": ");
828 ids.append(v.getName());
829 } else {
830 ids.append(", ").append(v.getName());
831 }
832 }
833 }
834 }
835 if (ids.length() > 0) {
836 final String msg = String.format("%n%nDependency-Check Failure:%n"
837 + "One or more dependencies were identified with vulnerabilities that have a CVSS score greater then '%.1f': %s%n"
838 + "See the dependency-check report for more details.%n%n", failBuildOnCVSS, ids.toString());
839 throw new MojoFailureException(msg);
840 }
841 }
842 }
843
844
845
846
847
848
849
850 protected void showSummary(MavenProject mp, List<Dependency> dependencies) {
851 if (showSummary) {
852 final StringBuilder summary = new StringBuilder();
853 for (Dependency d : dependencies) {
854 boolean firstEntry = true;
855 final StringBuilder ids = new StringBuilder();
856 for (Vulnerability v : d.getVulnerabilities()) {
857 if (firstEntry) {
858 firstEntry = false;
859 } else {
860 ids.append(", ");
861 }
862 ids.append(v.getName());
863 }
864 if (ids.length() > 0) {
865 summary.append(d.getFileName()).append(" (");
866 firstEntry = true;
867 for (Identifier id : d.getIdentifiers()) {
868 if (firstEntry) {
869 firstEntry = false;
870 } else {
871 summary.append(", ");
872 }
873 summary.append(id.getValue());
874 }
875 summary.append(") : ").append(ids).append(NEW_LINE);
876 }
877 }
878 if (summary.length() > 0) {
879 final String msg = String.format("%n%n" + "One or more dependencies were identified with known vulnerabilities in %s:%n%n%s"
880 + "%n%nSee the dependency-check report for more details.%n%n", mp.getName(), summary.toString());
881 getLog().warn(msg);
882 }
883 }
884 }
885
886
887
888
889
890
891
892
893
894 protected String getDataFileContextKey() {
895 return "dependency-check-path-" + dataFileName;
896 }
897
898
899
900
901
902
903
904 protected String getOutputDirectoryContextKey() {
905 return "dependency-output-dir-" + dataFileName;
906 }
907
908
909
910
911
912
913
914
915 protected void writeDataFile(MavenProject mp, File writeTo, List<Dependency> dependencies) {
916 File file;
917
918 if (mp.getContextValue(this.getDataFileContextKey()) == null) {
919 if (writeTo == null) {
920 file = new File(mp.getBuild().getDirectory());
921 file = new File(file, dataFileName);
922 } else {
923 file = new File(writeTo, dataFileName);
924 }
925 final File parent = file.getParentFile();
926 if (!parent.isDirectory() && parent.mkdirs()) {
927 getLog().error(String.format("Directory '%s' does not exist and cannot be created; unable to write data file.",
928 parent.getAbsolutePath()));
929 }
930
931 ObjectOutputStream out = null;
932 try {
933 if (dependencies != null) {
934 out = new ObjectOutputStream(new BufferedOutputStream(new FileOutputStream(file)));
935 out.writeObject(dependencies);
936 }
937 if (getLog().isDebugEnabled()) {
938 getLog().debug(String.format("Serialized data file written to '%s' for %s, referenced by key %s",
939 file.getAbsolutePath(), mp.getName(), this.getDataFileContextKey()));
940 }
941 mp.setContextValue(this.getDataFileContextKey(), file.getAbsolutePath());
942 } catch (IOException ex) {
943 getLog().warn("Unable to create data file used for report aggregation; "
944 + "if report aggregation is being used the results may be incomplete.");
945 if (getLog().isDebugEnabled()) {
946 getLog().debug(ex.getMessage(), ex);
947 }
948 } finally {
949 if (out != null) {
950 try {
951 out.close();
952 } catch (IOException ex) {
953 if (getLog().isDebugEnabled()) {
954 getLog().debug("ignore", ex);
955 }
956 }
957 }
958 }
959 }
960 }
961
962
963
964
965
966
967
968
969
970 protected List<Dependency> readDataFile(MavenProject project) {
971 final Object oPath = project.getContextValue(this.getDataFileContextKey());
972 if (oPath == null) {
973 return null;
974 }
975 List<Dependency> ret = null;
976 final String path = (String) oPath;
977 ObjectInputStream ois = null;
978 try {
979 ois = new ObjectInputStream(new FileInputStream(path));
980 ret = (List<Dependency>) ois.readObject();
981 } catch (FileNotFoundException ex) {
982
983 getLog().error("", ex);
984 } catch (IOException ex) {
985 getLog().error("", ex);
986 } catch (ClassNotFoundException ex) {
987 getLog().error("", ex);
988 } finally {
989 if (ois != null) {
990 try {
991 ois.close();
992 } catch (IOException ex) {
993 getLog().error("", ex);
994 }
995 }
996 }
997 return ret;
998 }
999
1000 }