1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19 package org.owasp.dependencycheck.maven;
20
21 import java.io.File;
22 import java.io.IOException;
23 import java.io.InputStream;
24 import java.io.UnsupportedEncodingException;
25 import java.net.URLEncoder;
26 import java.text.DateFormat;
27 import java.util.Date;
28 import java.util.List;
29 import java.util.Locale;
30 import java.util.logging.Level;
31 import java.util.logging.Logger;
32 import org.apache.maven.doxia.sink.SinkFactory;
33 import org.apache.maven.plugin.AbstractMojo;
34 import org.apache.maven.plugin.MojoExecutionException;
35 import org.apache.maven.project.MavenProject;
36 import java.util.Set;
37 import org.apache.maven.artifact.Artifact;
38 import org.apache.maven.plugins.annotations.Component;
39 import org.apache.maven.plugins.annotations.LifecyclePhase;
40 import org.apache.maven.plugins.annotations.Mojo;
41 import org.apache.maven.plugins.annotations.Parameter;
42 import org.apache.maven.plugins.annotations.ResolutionScope;
43 import org.apache.maven.reporting.MavenMultiPageReport;
44 import org.apache.maven.reporting.MavenReport;
45 import org.apache.maven.reporting.MavenReportException;
46 import org.apache.maven.doxia.sink.Sink;
47 import org.apache.maven.plugin.MojoFailureException;
48 import org.owasp.dependencycheck.Engine;
49 import org.owasp.dependencycheck.dependency.Dependency;
50 import org.owasp.dependencycheck.dependency.Evidence;
51 import org.owasp.dependencycheck.dependency.Identifier;
52 import org.owasp.dependencycheck.dependency.Reference;
53 import org.owasp.dependencycheck.dependency.Vulnerability;
54 import org.owasp.dependencycheck.dependency.VulnerableSoftware;
55 import org.owasp.dependencycheck.reporting.ReportGenerator;
56 import org.owasp.dependencycheck.utils.LogUtils;
57 import org.owasp.dependencycheck.utils.Settings;
58
59
60
61
62
63
64
65 @Mojo(name = "check", defaultPhase = LifecyclePhase.COMPILE, threadSafe = true,
66 requiresDependencyResolution = ResolutionScope.RUNTIME_PLUS_SYSTEM,
67 requiresOnline = true)
68 public class DependencyCheckMojo extends AbstractMojo implements MavenMultiPageReport {
69
70
71
72
73 private static final String PROPERTIES_FILE = "mojo.properties";
74
75
76
77 private static final String LOG_PROPERTIES_FILE = "log.properties";
78
79
80
81 public static final String TEST_SCOPE = "test";
82
83
84
85
86 @Component
87 private MavenProject project;
88
89
90
91 @Parameter(property = "report-name", defaultValue = "dependency-check-report")
92 private String reportName;
93
94
95
96 @Parameter(property = "logfile", defaultValue = "")
97 private String logFile;
98
99
100
101
102 @Parameter(property = "name", defaultValue = "Dependency-Check")
103 private String name;
104
105
106
107
108 @Parameter(property = "description", defaultValue = "A report providing details on any published "
109 + "vulnerabilities within project dependencies. This report is a best effort but may contain "
110 + "false positives and false negatives.")
111 private String description;
112
113
114
115
116 @Parameter(property = "reportOutputDirectory", defaultValue = "${project.reporting.outputDirectory}", required = true)
117 private File reportOutputDirectory;
118
119
120
121
122
123 @Parameter(property = "failBuildOnCVSS", defaultValue = "11", required = true)
124 private float failBuildOnCVSS = 11;
125
126
127
128 @Parameter(defaultValue = "${project.build.directory}", required = true)
129 private File outputDirectory;
130
131
132
133
134 @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"})
135 @Parameter(property = "autoupdate", defaultValue = "true", required = true)
136 private boolean autoUpdate = true;
137
138
139
140
141
142 @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"})
143 @Parameter(property = "format", defaultValue = "HTML", required = true)
144 private String format = "HTML";
145
146
147
148 @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"})
149 @Parameter(property = "externalReport", defaultValue = "false", required = true)
150 private boolean externalReport = false;
151
152
153
154 @SuppressWarnings("CanBeFinal")
155 @Parameter(property = "proxyUrl", defaultValue = "", required = false)
156 private String proxyUrl = null;
157
158
159
160 @SuppressWarnings("CanBeFinal")
161 @Parameter(property = "proxyPort", defaultValue = "", required = false)
162 private String proxyPort = null;
163
164
165
166 @SuppressWarnings("CanBeFinal")
167 @Parameter(property = "proxyUsername", defaultValue = "", required = false)
168 private String proxyUsername = null;
169
170
171
172 @SuppressWarnings("CanBeFinal")
173 @Parameter(property = "proxyPassword", defaultValue = "", required = false)
174 private String proxyPassword = null;
175
176
177
178 @SuppressWarnings("CanBeFinal")
179 @Parameter(property = "connectionTimeout", defaultValue = "", required = false)
180 private String connectionTimeout = null;
181
182
183
184 @SuppressWarnings("CanBeFinal")
185 @Parameter(property = "suppressionFile", defaultValue = "", required = false)
186 private String suppressionFile = null;
187
188
189
190
191
192
193
194 private Engine executeDependencyCheck() {
195
196 final InputStream in = DependencyCheckMojo.class.getClassLoader().getResourceAsStream(LOG_PROPERTIES_FILE);
197 LogUtils.prepareLogger(in, logFile);
198
199 populateSettings();
200 final Engine engine = new Engine();
201 final Set<Artifact> artifacts = project.getArtifacts();
202 for (Artifact a : artifacts) {
203 if (!TEST_SCOPE.equals(a.getScope())) {
204 engine.scan(a.getFile().getAbsolutePath());
205 }
206 }
207 engine.analyzeDependencies();
208 return engine;
209 }
210
211
212
213
214
215
216 private void generateExternalReports(Engine engine) {
217 final ReportGenerator r = new ReportGenerator(project.getName(), engine.getDependencies(), engine.getAnalyzers());
218 try {
219 r.generateReports(outputDirectory.getCanonicalPath(), format);
220 } catch (IOException ex) {
221 Logger.getLogger(DependencyCheckMojo.class.getName()).log(Level.SEVERE, null, ex);
222 } catch (Exception ex) {
223 Logger.getLogger(DependencyCheckMojo.class.getName()).log(Level.SEVERE, null, ex);
224 }
225 }
226
227
228
229
230
231
232
233 private void generateMavenSiteReport(final Engine engine, Sink sink) {
234 final List<Dependency> dependencies = engine.getDependencies();
235
236 writeSiteReportHeader(sink, project.getName());
237 writeSiteReportTOC(sink, dependencies);
238
239 int cnt = 0;
240 for (Dependency d : dependencies) {
241 writeSiteReportDependencyHeader(sink, d);
242 cnt = writeSiteReportDependencyAnalysisExceptions(d, cnt, sink);
243 cnt = writeSiteReportDependencyEvidenceUsed(d, cnt, sink);
244 cnt = writeSiteReportDependencyRelatedDependencies(d, cnt, sink);
245 writeSiteReportDependencyIdentifiers(d, sink);
246 writeSiteReportDependencyVulnerabilities(d, sink, cnt);
247 }
248 sink.body_();
249 }
250
251
252
253
254
255
256
257
258
259 private void writeSiteReportDependencyVulnerabilities(Dependency d, Sink sink, int collapsibleHeaderCount) {
260 int cnt = collapsibleHeaderCount;
261 if (d.getVulnerabilities() != null && !d.getVulnerabilities().isEmpty()) {
262 for (Vulnerability v : d.getVulnerabilities()) {
263
264 sink.paragraph();
265 sink.bold();
266 try {
267 sink.link("http://web.nvd.nist.gov/view/vuln/detail?vulnId=" + URLEncoder.encode(v.getName(), "US-ASCII"));
268 sink.text(v.getName());
269 sink.link_();
270 sink.bold_();
271 } catch (UnsupportedEncodingException ex) {
272 sink.text(v.getName());
273 sink.bold_();
274 sink.lineBreak();
275 sink.text("http://web.nvd.nist.gov/view/vuln/detail?vulnId=" + v.getName());
276 }
277 sink.paragraph_();
278 sink.paragraph();
279 sink.text("Severity: ");
280 if (v.getCvssScore() < 4.0) {
281 sink.text("Low");
282 } else {
283 if (v.getCvssScore() >= 7.0) {
284 sink.text("High");
285 } else {
286 sink.text("Medium");
287 }
288 }
289 sink.lineBreak();
290 sink.text("CVSS Score: " + v.getCvssScore());
291 if (v.getCwe() != null && !v.getCwe().isEmpty()) {
292 sink.lineBreak();
293 sink.text("CWE: ");
294 sink.text(v.getCwe());
295 }
296 sink.paragraph_();
297 sink.paragraph();
298 sink.text(v.getDescription());
299 if (v.getReferences() != null && !v.getReferences().isEmpty()) {
300 sink.list();
301 for (Reference ref : v.getReferences()) {
302 sink.listItem();
303 sink.text(ref.getSource());
304 sink.text(" - ");
305 sink.link(ref.getUrl());
306 sink.text(ref.getName());
307 sink.link_();
308 sink.listItem_();
309 }
310 sink.list_();
311 }
312 sink.paragraph_();
313 if (v.getVulnerableSoftware() != null && !v.getVulnerableSoftware().isEmpty()) {
314 sink.paragraph();
315
316 cnt += 1;
317 sink.rawText("Vulnerable Software <a href=\"javascript:toggleElement(this, 'vulnSoft" + cnt + "')\">[-]</a>");
318 sink.rawText("<div id=\"vulnSoft" + cnt + "\" style=\"display:block\">");
319 sink.list();
320 for (VulnerableSoftware vs : v.getVulnerableSoftware()) {
321 sink.listItem();
322 try {
323 sink.link("http://web.nvd.nist.gov/view/vuln/search-results?cpe=" + URLEncoder.encode(vs.getName(), "US-ASCII"));
324 sink.text(vs.getName());
325 sink.link_();
326 if (vs.hasPreviousVersion()) {
327 sink.text(" and all previous versions.");
328 }
329 } catch (UnsupportedEncodingException ex) {
330 sink.text(vs.getName());
331 if (vs.hasPreviousVersion()) {
332 sink.text(" and all previous versions.");
333 }
334 sink.text(" (http://web.nvd.nist.gov/view/vuln/search-results?cpe=" + vs.getName() + ")");
335 }
336
337 sink.listItem_();
338 }
339 sink.list_();
340 sink.rawText("</div>");
341 sink.paragraph_();
342 }
343 }
344 }
345 }
346
347
348
349
350
351
352
353 private void writeSiteReportDependencyIdentifiers(Dependency d, Sink sink) {
354 if (d.getIdentifiers() != null && !d.getIdentifiers().isEmpty()) {
355 sink.sectionTitle4();
356 sink.text("Identifiers");
357 sink.sectionTitle4_();
358 sink.list();
359 for (Identifier i : d.getIdentifiers()) {
360 sink.listItem();
361 sink.text(i.getType());
362 sink.text(": ");
363 if (i.getUrl() != null && i.getUrl().length() > 0) {
364 sink.link(i.getUrl());
365 sink.text(i.getValue());
366 sink.link_();
367 } else {
368 sink.text(i.getValue());
369 }
370 if (i.getDescription() != null && i.getDescription().length() > 0) {
371 sink.lineBreak();
372 sink.text(i.getDescription());
373 }
374 sink.listItem_();
375 }
376 sink.list_();
377 }
378 }
379
380
381
382
383
384
385
386
387
388 private int writeSiteReportDependencyRelatedDependencies(Dependency d, int collapsibleHeaderCount, Sink sink) {
389 int cnt = collapsibleHeaderCount;
390 if (d.getRelatedDependencies() != null && !d.getRelatedDependencies().isEmpty()) {
391 cnt += 1;
392 sink.sectionTitle4();
393 sink.rawText("Related Dependencies <a href=\"javascript:toggleElement(this, 'related" + cnt + "')\">[+]</a>");
394 sink.sectionTitle4_();
395 sink.rawText("<div id=\"related" + cnt + "\" style=\"display:none\">");
396 sink.list();
397 for (Dependency r : d.getRelatedDependencies()) {
398 sink.listItem();
399 sink.text(r.getFileName());
400 sink.list();
401 writeListItem(sink, "File Path: " + r.getFilePath());
402 writeListItem(sink, "SHA1: " + r.getSha1sum());
403 writeListItem(sink, "MD5: " + r.getMd5sum());
404 sink.list_();
405 sink.listItem_();
406 }
407 sink.list_();
408 sink.rawText("</div>");
409 }
410 return cnt;
411 }
412
413
414
415
416
417
418
419
420
421 private int writeSiteReportDependencyEvidenceUsed(Dependency d, int collapsibleHeaderCount, Sink sink) {
422 int cnt = collapsibleHeaderCount;
423 if (d.getEvidenceUsed() != null && d.getEvidenceUsed().size() > 0) {
424 cnt += 1;
425 sink.sectionTitle4();
426 sink.rawText("Evidence Collected <a href=\"javascript:toggleElement(this, 'evidence" + cnt + "')\">[+]</a>");
427 sink.sectionTitle4_();
428 sink.rawText("<div id=\"evidence" + cnt + "\" style=\"display:none\">");
429 sink.table();
430 sink.tableRow();
431 writeTableHeaderCell(sink, "Source");
432 writeTableHeaderCell(sink, "Name");
433 writeTableHeaderCell(sink, "Value");
434 sink.tableRow_();
435 for (Evidence e : d.getEvidenceUsed()) {
436 sink.tableRow();
437 writeTableCell(sink, e.getSource());
438 writeTableCell(sink, e.getName());
439 writeTableCell(sink, e.getValue());
440 sink.tableRow_();
441 }
442 sink.table_();
443 sink.rawText("</div>");
444 }
445 return cnt;
446 }
447
448
449
450
451
452
453
454
455
456
457 private int writeSiteReportDependencyAnalysisExceptions(Dependency d, int collapsibleHeaderCount, Sink sink) {
458 int cnt = collapsibleHeaderCount;
459 if (d.getAnalysisExceptions() != null && !d.getAnalysisExceptions().isEmpty()) {
460 cnt += 1;
461 sink.sectionTitle4();
462 sink.rawText("<font style=\"color:red\">Errors occurred during analysis:</font> <a href=\"javascript:toggleElement(this, 'errors"
463 + cnt + "')\">[+]</a>");
464 sink.sectionTitle4_();
465 sink.rawText("<div id=\"errors" + cnt + "\">");
466 sink.list();
467 for (Exception e : d.getAnalysisExceptions()) {
468 sink.listItem();
469 sink.text(e.getMessage());
470 sink.listItem_();
471 }
472 sink.list_();
473 sink.rawText("</div>");
474 }
475 return cnt;
476 }
477
478
479
480
481
482
483
484 private void writeSiteReportDependencyHeader(Sink sink, Dependency d) {
485 sink.sectionTitle2();
486 sink.anchor("sha1" + d.getSha1sum());
487 sink.text(d.getFileName());
488 sink.anchor_();
489 sink.sectionTitle2_();
490 if (d.getDescription() != null && d.getDescription().length() > 0) {
491 sink.paragraph();
492 sink.bold();
493 sink.text("Description: ");
494 sink.bold_();
495 sink.text(d.getDescription());
496 sink.paragraph_();
497 }
498 if (d.getLicense() != null && d.getLicense().length() > 0) {
499 sink.paragraph();
500 sink.bold();
501 sink.text("License: ");
502 sink.bold_();
503 if (d.getLicense().startsWith("http://") && !d.getLicense().contains(" ")) {
504 sink.link(d.getLicense());
505 sink.text(d.getLicense());
506 sink.link_();
507 } else {
508 sink.text(d.getLicense());
509 }
510 sink.paragraph_();
511 }
512 }
513
514
515
516
517
518
519
520 private void writeListItem(Sink sink, String text) {
521 sink.listItem();
522 sink.text(text);
523 sink.listItem_();
524 }
525
526
527
528
529
530
531
532 private void writeTableCell(Sink sink, String text) {
533 sink.tableCell();
534 sink.text(text);
535 sink.tableCell_();
536 }
537
538
539
540
541
542
543
544 private void writeTableHeaderCell(Sink sink, String text) {
545 sink.tableHeaderCell();
546 sink.text(text);
547 sink.tableHeaderCell_();
548 }
549
550
551
552
553
554
555
556 private void writeSiteReportTOC(Sink sink, final List<Dependency> dependencies) {
557 sink.list();
558 for (Dependency d : dependencies) {
559 sink.listItem();
560 sink.link("#sha1" + d.getSha1sum());
561 sink.text(d.getFileName());
562 sink.link_();
563 if (!d.getVulnerabilities().isEmpty()) {
564 sink.rawText(" <font style=\"color:red\">•</font>");
565 }
566 if (!d.getRelatedDependencies().isEmpty()) {
567 sink.list();
568 for (Dependency r : d.getRelatedDependencies()) {
569 writeListItem(sink, r.getFileName());
570 }
571 sink.list_();
572 }
573 sink.listItem_();
574 }
575 sink.list_();
576 }
577
578
579
580
581
582
583
584 private void writeSiteReportHeader(Sink sink, String projectName) {
585 sink.head();
586 sink.title();
587 sink.text("Dependency-Check Report: " + projectName);
588 sink.title_();
589 sink.head_();
590 sink.body();
591 sink.rawText("<script type=\"text/javascript\">");
592 sink.rawText("function toggleElement(el, targetId) {");
593 sink.rawText("if (el.innerText == '[+]') {");
594 sink.rawText(" el.innerText = '[-]';");
595 sink.rawText(" document.getElementById(targetId).style.display='block';");
596 sink.rawText("} else {");
597 sink.rawText(" el.innerText = '[+]';");
598 sink.rawText(" document.getElementById(targetId).style.display='none';");
599 sink.rawText("}");
600
601 sink.rawText("}");
602 sink.rawText("</script>");
603 sink.section1();
604 sink.sectionTitle1();
605 sink.text("Project: " + projectName);
606 sink.sectionTitle1_();
607 sink.date();
608 final Date now = new Date();
609 sink.text(DateFormat.getDateTimeInstance().format(now));
610 sink.date_();
611 sink.section1_();
612 }
613
614
615
616
617
618
619
620 private void populateSettings() {
621 InputStream mojoProperties = null;
622 try {
623 mojoProperties = this.getClass().getClassLoader().getResourceAsStream(PROPERTIES_FILE);
624 Settings.mergeProperties(mojoProperties);
625 } catch (IOException ex) {
626 Logger.getLogger(DependencyCheckMojo.class.getName()).log(Level.WARNING, "Unable to load the dependency-check ant task.properties file.");
627 Logger.getLogger(DependencyCheckMojo.class.getName()).log(Level.FINE, null, ex);
628 } finally {
629 if (mojoProperties != null) {
630 try {
631 mojoProperties.close();
632 } catch (IOException ex) {
633 Logger.getLogger(DependencyCheckMojo.class.getName()).log(Level.FINEST, null, ex);
634 }
635 }
636 }
637
638 Settings.setBoolean(Settings.KEYS.AUTO_UPDATE, autoUpdate);
639
640 if (proxyUrl != null && !proxyUrl.isEmpty()) {
641 Settings.setString(Settings.KEYS.PROXY_URL, proxyUrl);
642 }
643 if (proxyPort != null && !proxyPort.isEmpty()) {
644 Settings.setString(Settings.KEYS.PROXY_PORT, proxyPort);
645 }
646 if (proxyUsername != null && !proxyUsername.isEmpty()) {
647 Settings.setString(Settings.KEYS.PROXY_USERNAME, proxyUsername);
648 }
649 if (proxyPassword != null && !proxyPassword.isEmpty()) {
650 Settings.setString(Settings.KEYS.PROXY_PASSWORD, proxyPassword);
651 }
652 if (connectionTimeout != null && !connectionTimeout.isEmpty()) {
653 Settings.setString(Settings.KEYS.CONNECTION_TIMEOUT, connectionTimeout);
654 }
655 if (suppressionFile != null && !suppressionFile.isEmpty()) {
656 Settings.setString(Settings.KEYS.SUPPRESSION_FILE, suppressionFile);
657 }
658 }
659
660
661
662
663
664
665
666
667 public void execute() throws MojoExecutionException, MojoFailureException {
668 final Engine engine = executeDependencyCheck();
669 generateExternalReports(engine);
670 if (this.failBuildOnCVSS <= 10) {
671 checkForFailure(engine.getDependencies());
672 }
673 }
674
675
676
677
678
679
680
681
682 public void generate(@SuppressWarnings("deprecation") org.codehaus.doxia.sink.Sink sink,
683 Locale locale) throws MavenReportException {
684 generate((Sink) sink, null, locale);
685 }
686
687
688
689
690
691
692
693
694
695 public void generate(Sink sink, SinkFactory sinkFactory, Locale locale) throws MavenReportException {
696 final Engine engine = executeDependencyCheck();
697 generateMavenSiteReport(engine, sink);
698 }
699
700
701
702
703
704
705
706 public String getOutputName() {
707 return reportName;
708 }
709
710
711
712
713
714
715 public String getCategoryName() {
716 return MavenReport.CATEGORY_PROJECT_REPORTS;
717 }
718
719
720
721
722
723
724
725 public String getName(Locale locale) {
726 return name;
727 }
728
729
730
731
732
733
734 public void setReportOutputDirectory(File directory) {
735 reportOutputDirectory = directory;
736 }
737
738
739
740
741
742
743 public File getReportOutputDirectory() {
744 return reportOutputDirectory;
745 }
746
747
748
749
750
751
752
753
754 public String getDescription(Locale locale) {
755 return description;
756 }
757
758
759
760
761
762
763 public boolean isExternalReport() {
764 return externalReport;
765 }
766
767
768
769
770
771
772 public boolean canGenerateReport() {
773 return true;
774 }
775
776
777
778
779
780
781
782
783
784
785 private void checkForFailure(List<Dependency> dependencies) throws MojoFailureException {
786 final StringBuilder ids = new StringBuilder();
787 for (Dependency d : dependencies) {
788 for (Vulnerability v : d.getVulnerabilities()) {
789 if (v.getCvssScore() >= failBuildOnCVSS) {
790 if (ids.length() == 0) {
791 ids.append(v.getName());
792 } else {
793 ids.append(", ").append(v.getName());
794 }
795 }
796 }
797 }
798 if (ids.length() > 0) {
799 final String msg = String.format("%n%nDependency-Check Failure:%n"
800 + "One or more dependencies were identified with vulnerabilities that have a CVSS score greater then '%.1f': %s%n"
801 + "See the dependency-check report for more details.%n%n", failBuildOnCVSS, ids.toString());
802 throw new MojoFailureException(msg);
803 }
804 }
805 }