mirror of
https://github.com/ysoftdevs/DependencyCheck.git
synced 2026-01-13 15:23:40 +01:00
580 lines
23 KiB
XML
580 lines
23 KiB
XML
<!--
|
|
This file is part of dependency-check-core.
|
|
|
|
Licensed under the Apache License, Version 2.0 (the "License");
|
|
you may not use this file except in compliance with the License.
|
|
You may obtain a copy of the License at
|
|
|
|
http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
Unless required by applicable law or agreed to in writing, software
|
|
distributed under the License is distributed on an "AS IS" BASIS,
|
|
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
See the License for the specific language governing permissions and
|
|
limitations under the License.
|
|
|
|
Copyright (c) 2012 Jeremy Long. All Rights Reserved.
|
|
-->
|
|
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
|
|
<modelVersion>4.0.0</modelVersion>
|
|
<parent>
|
|
<groupId>org.owasp</groupId>
|
|
<artifactId>dependency-check-parent</artifactId>
|
|
<version>3.1.2-SNAPSHOT</version>
|
|
</parent>
|
|
|
|
<artifactId>dependency-check-core</artifactId>
|
|
<packaging>jar</packaging>
|
|
|
|
<name>Dependency-Check Core</name>
|
|
<description>dependency-check-core is the engine and reporting tool used to identify and report if there are any known, publicly disclosed vulnerabilities in the scanned project's dependencies. The engine extracts meta-data from the dependencies and uses this to do fuzzy key-word matching against the Common Platfrom Enumeration (CPE), if any CPE identifiers are found the associated Common Vulnerability and Exposure (CVE) entries are added to the generated report.</description>
|
|
<build>
|
|
<resources>
|
|
<resource>
|
|
<directory>src/main/resources</directory>
|
|
<includes>
|
|
<include>**/*.properties</include>
|
|
<include>**/schema/*.xsd</include>
|
|
</includes>
|
|
<filtering>true</filtering>
|
|
</resource>
|
|
<resource>
|
|
<directory>${basedir}/..</directory>
|
|
<targetPath>META-INF</targetPath>
|
|
<includes>
|
|
<include>LICENSE.txt</include>
|
|
<include>NOTICE.txt</include>
|
|
</includes>
|
|
</resource>
|
|
<resource>
|
|
<directory>src/main/resources</directory>
|
|
<excludes>
|
|
<exclude>**/*.properties</exclude>
|
|
<exclude>**/*.gif</exclude>
|
|
<exclude>**/*.js</exclude>
|
|
<exclude>**/schema/**/*.xsd</exclude>
|
|
<exclude>**/schema/**/*.xml</exclude>
|
|
<exclude>**/schema/**/*.bat</exclude>
|
|
<exclude>**/schema/**/*.sh</exclude>
|
|
</excludes>
|
|
<filtering>false</filtering>
|
|
</resource>
|
|
</resources>
|
|
<testResources>
|
|
<testResource>
|
|
<directory>src/test/resources</directory>
|
|
<includes>
|
|
<include>**/*.properties</include>
|
|
</includes>
|
|
<filtering>true</filtering>
|
|
</testResource>
|
|
<testResource>
|
|
<directory>${basedir}/../src/test/resources</directory>
|
|
<filtering>false</filtering>
|
|
</testResource>
|
|
<testResource>
|
|
<directory>${basedir}/src/test/resources</directory>
|
|
<filtering>false</filtering>
|
|
</testResource>
|
|
</testResources>
|
|
<plugins>
|
|
<plugin>
|
|
<groupId>org.apache.maven.plugins</groupId>
|
|
<artifactId>maven-dependency-plugin</artifactId>
|
|
<executions>
|
|
<execution>
|
|
<phase>generate-resources</phase>
|
|
<goals>
|
|
<goal>copy-dependencies</goal>
|
|
</goals>
|
|
<configuration>
|
|
<outputDirectory>${project.build.directory}/test-classes</outputDirectory>
|
|
<includeScope>test</includeScope>
|
|
<excludeArtifactIds>dependency-check-utils</excludeArtifactIds>
|
|
</configuration>
|
|
</execution>
|
|
</executions>
|
|
</plugin>
|
|
<plugin>
|
|
<groupId>org.apache.maven.plugins</groupId>
|
|
<artifactId>maven-jar-plugin</artifactId>
|
|
<executions>
|
|
<execution>
|
|
<id>test-jar</id>
|
|
<phase>package</phase>
|
|
<goals>
|
|
<goal>test-jar</goal>
|
|
</goals>
|
|
<configuration>
|
|
<includes>
|
|
<include>**/*.class</include>
|
|
</includes>
|
|
</configuration>
|
|
</execution>
|
|
</executions>
|
|
</plugin>
|
|
</plugins>
|
|
</build>
|
|
<dependencies>
|
|
<dependency>
|
|
<groupId>com.vdurmont</groupId>
|
|
<artifactId>semver4j</artifactId>
|
|
</dependency>
|
|
<!-- Note, to stay compatible with Jenkins installations only JARs compiled to 1.6 can be used -->
|
|
<dependency>
|
|
<groupId>joda-time</groupId>
|
|
<artifactId>joda-time</artifactId>
|
|
</dependency>
|
|
<dependency>
|
|
<groupId>com.google.code.findbugs</groupId>
|
|
<artifactId>annotations</artifactId>
|
|
<optional>true</optional>
|
|
</dependency>
|
|
<dependency>
|
|
<groupId>org.slf4j</groupId>
|
|
<artifactId>slf4j-api</artifactId>
|
|
</dependency>
|
|
<!-- Set this to test so that each project that uses this has to have its own implementation of SLF4J -->
|
|
<dependency>
|
|
<groupId>ch.qos.logback</groupId>
|
|
<artifactId>logback-classic</artifactId>
|
|
<scope>test</scope>
|
|
</dependency>
|
|
<dependency>
|
|
<groupId>org.owasp</groupId>
|
|
<artifactId>dependency-check-utils</artifactId>
|
|
<version>${project.parent.version}</version>
|
|
</dependency>
|
|
<dependency>
|
|
<groupId>org.apache.lucene</groupId>
|
|
<artifactId>lucene-test-framework</artifactId>
|
|
<scope>test</scope>
|
|
</dependency>
|
|
<dependency>
|
|
<groupId>org.jmockit</groupId>
|
|
<artifactId>jmockit</artifactId>
|
|
<scope>test</scope>
|
|
</dependency>
|
|
<dependency>
|
|
<groupId>org.apache.commons</groupId>
|
|
<artifactId>commons-compress</artifactId>
|
|
</dependency>
|
|
<dependency>
|
|
<groupId>commons-io</groupId>
|
|
<artifactId>commons-io</artifactId>
|
|
</dependency>
|
|
<dependency>
|
|
<groupId>org.apache.commons</groupId>
|
|
<artifactId>commons-lang3</artifactId>
|
|
</dependency>
|
|
<dependency>
|
|
<groupId>org.apache.lucene</groupId>
|
|
<artifactId>lucene-core</artifactId>
|
|
</dependency>
|
|
<dependency>
|
|
<groupId>org.apache.lucene</groupId>
|
|
<artifactId>lucene-analyzers-common</artifactId>
|
|
</dependency>
|
|
<dependency>
|
|
<groupId>org.apache.lucene</groupId>
|
|
<artifactId>lucene-queryparser</artifactId>
|
|
</dependency>
|
|
<dependency>
|
|
<groupId>org.apache.velocity</groupId>
|
|
<artifactId>velocity</artifactId>
|
|
</dependency>
|
|
<dependency>
|
|
<groupId>com.h2database</groupId>
|
|
<artifactId>h2</artifactId>
|
|
<scope>runtime</scope>
|
|
</dependency>
|
|
<dependency>
|
|
<groupId>org.glassfish</groupId>
|
|
<artifactId>javax.json</artifactId>
|
|
</dependency>
|
|
<dependency>
|
|
<groupId>org.jsoup</groupId>
|
|
<artifactId>jsoup</artifactId>
|
|
</dependency>
|
|
<dependency>
|
|
<groupId>com.sun.mail</groupId>
|
|
<artifactId>mailapi</artifactId>
|
|
</dependency>
|
|
<dependency>
|
|
<groupId>com.google.code.gson</groupId>
|
|
<artifactId>gson</artifactId>
|
|
</dependency>
|
|
<!-- The following dependencies are only used during testing
|
|
and must not be converted to a properties based version number -->
|
|
<dependency>
|
|
<groupId>org.apache.maven.scm</groupId>
|
|
<artifactId>maven-scm-provider-cvsexe</artifactId>
|
|
<version>1.8.1</version>
|
|
<scope>test</scope>
|
|
<optional>true</optional>
|
|
</dependency>
|
|
<dependency>
|
|
<groupId>org.springframework</groupId>
|
|
<artifactId>spring-webmvc</artifactId>
|
|
<version>2.5.5</version>
|
|
<scope>test</scope>
|
|
<optional>true</optional>
|
|
</dependency>
|
|
<dependency>
|
|
<groupId>org.springframework.security</groupId>
|
|
<artifactId>spring-security-web</artifactId>
|
|
<version>3.0.0.RELEASE</version>
|
|
<scope>test</scope>
|
|
<optional>true</optional>
|
|
</dependency>
|
|
<dependency>
|
|
<groupId>com.hazelcast</groupId>
|
|
<artifactId>hazelcast</artifactId>
|
|
<version>2.5</version>
|
|
<scope>test</scope>
|
|
<optional>true</optional>
|
|
</dependency>
|
|
<dependency>
|
|
<groupId>net.sf.ehcache</groupId>
|
|
<artifactId>ehcache-core</artifactId>
|
|
<version>2.2.0</version>
|
|
<scope>test</scope>
|
|
<optional>true</optional>
|
|
</dependency>
|
|
<dependency>
|
|
<groupId>org.apache.struts</groupId>
|
|
<artifactId>struts2-core</artifactId>
|
|
<version>2.1.2</version>
|
|
<scope>test</scope>
|
|
<optional>true</optional>
|
|
</dependency>
|
|
<dependency>
|
|
<groupId>org.mortbay.jetty</groupId>
|
|
<artifactId>jetty</artifactId>
|
|
<version>6.1.0</version>
|
|
<scope>test</scope>
|
|
<optional>true</optional>
|
|
</dependency>
|
|
<dependency>
|
|
<groupId>org.apache.axis2</groupId>
|
|
<artifactId>axis2-spring</artifactId>
|
|
<version>1.4.1</version>
|
|
<scope>test</scope>
|
|
<optional>true</optional>
|
|
</dependency>
|
|
<dependency>
|
|
<groupId>org.apache.axis2</groupId>
|
|
<artifactId>axis2-adb</artifactId>
|
|
<version>1.4.1</version>
|
|
<scope>test</scope>
|
|
<optional>true</optional>
|
|
</dependency>
|
|
<dependency>
|
|
<groupId>org.apache.geronimo.daytrader</groupId>
|
|
<artifactId>daytrader-ear</artifactId>
|
|
<version>2.1.7</version>
|
|
<type>ear</type>
|
|
<scope>test</scope>
|
|
<optional>true</optional>
|
|
</dependency>
|
|
<dependency>
|
|
<groupId>org.glassfish.main.admingui</groupId>
|
|
<artifactId>war</artifactId>
|
|
<version>4.0</version>
|
|
<type>war</type>
|
|
<scope>test</scope>
|
|
<optional>true</optional>
|
|
</dependency>
|
|
<dependency>
|
|
<groupId>org.dojotoolkit</groupId>
|
|
<artifactId>dojo-war</artifactId>
|
|
<version>1.3.0</version>
|
|
<type>war</type>
|
|
<scope>test</scope>
|
|
<optional>true</optional>
|
|
</dependency>
|
|
<dependency>
|
|
<groupId>org.apache.openjpa</groupId>
|
|
<artifactId>openjpa</artifactId>
|
|
<version>2.0.1</version>
|
|
<scope>test</scope>
|
|
<optional>true</optional>
|
|
</dependency>
|
|
<dependency>
|
|
<groupId>com.google.inject</groupId>
|
|
<artifactId>guice</artifactId>
|
|
<version>3.0</version>
|
|
<scope>test</scope>
|
|
<optional>true</optional>
|
|
</dependency>
|
|
<dependency>
|
|
<groupId>org.springframework.retry</groupId>
|
|
<artifactId>spring-retry</artifactId>
|
|
<version>1.1.0.RELEASE</version>
|
|
<scope>test</scope>
|
|
<optional>true</optional>
|
|
</dependency>
|
|
<dependency>
|
|
<groupId>uk.ltd.getahead</groupId>
|
|
<artifactId>dwr</artifactId>
|
|
<version>1.1.1</version>
|
|
<scope>test</scope>
|
|
<optional>true</optional>
|
|
</dependency>
|
|
<dependency>
|
|
<groupId>xalan</groupId>
|
|
<artifactId>xalan</artifactId>
|
|
<version>2.7.0</version>
|
|
<scope>test</scope>
|
|
<optional>true</optional>
|
|
</dependency>
|
|
<dependency>
|
|
<groupId>com.thoughtworks.xstream</groupId>
|
|
<artifactId>xstream</artifactId>
|
|
<version>1.4.8</version>
|
|
<scope>test</scope>
|
|
<optional>true</optional>
|
|
</dependency>
|
|
|
|
</dependencies>
|
|
<profiles>
|
|
<profile>
|
|
<id>MySQL-IntegrationTest</id>
|
|
<activation>
|
|
<property>
|
|
<name>mysql</name>
|
|
</property>
|
|
</activation>
|
|
<build>
|
|
<plugins>
|
|
<plugin>
|
|
<groupId>org.apache.maven.plugins</groupId>
|
|
<artifactId>maven-failsafe-plugin</artifactId>
|
|
<configuration>
|
|
<systemProperties>
|
|
<property>
|
|
<name>data.driver_path</name>
|
|
<value>${driver_path}</value>
|
|
</property>
|
|
<property>
|
|
<name>data.driver_name</name>
|
|
<value>${driver_name}</value>
|
|
</property>
|
|
<property>
|
|
<name>data.connection_string</name>
|
|
<value>${connection_string}</value>
|
|
</property>
|
|
</systemProperties>
|
|
<includes>
|
|
<include>**/*MySqlIT.java</include>
|
|
</includes>
|
|
</configuration>
|
|
<executions>
|
|
<execution>
|
|
<goals>
|
|
<goal>integration-test</goal>
|
|
<goal>verify</goal>
|
|
</goals>
|
|
</execution>
|
|
</executions>
|
|
</plugin>
|
|
</plugins>
|
|
</build>
|
|
</profile>
|
|
<profile>
|
|
<id>Postgresql-IntegrationTest</id>
|
|
<activation>
|
|
<property>
|
|
<name>postgresql</name>
|
|
</property>
|
|
</activation>
|
|
<dependencies>
|
|
<dependency>
|
|
<groupId>org.postgresql</groupId>
|
|
<artifactId>postgresql</artifactId>
|
|
<version>9.4-1204-jdbc42</version>
|
|
</dependency>
|
|
</dependencies>
|
|
<build>
|
|
<plugins>
|
|
<plugin>
|
|
<groupId>org.apache.maven.plugins</groupId>
|
|
<artifactId>maven-failsafe-plugin</artifactId>
|
|
<configuration>
|
|
<systemProperties>
|
|
<property>
|
|
<name>data.driver_path</name>
|
|
<value>${driver_path}</value>
|
|
</property>
|
|
<property>
|
|
<name>data.driver_name</name>
|
|
<value>${driver_name}</value>
|
|
</property>
|
|
<property>
|
|
<name>data.connection_string</name>
|
|
<value>${connection_string}</value>
|
|
</property>
|
|
</systemProperties>
|
|
<includes>
|
|
<include>**/*MySqlIT.java</include>
|
|
</includes>
|
|
</configuration>
|
|
<executions>
|
|
<execution>
|
|
<goals>
|
|
<goal>integration-test</goal>
|
|
<goal>verify</goal>
|
|
</goals>
|
|
</execution>
|
|
</executions>
|
|
</plugin>
|
|
</plugins>
|
|
</build>
|
|
</profile>
|
|
<!--
|
|
The following profile adds additional dependencies that are only
|
|
used during testing.
|
|
|
|
TODO move the following FP tests to a seperate invoker test in the
|
|
maven plugin project. Add checks against the XML to validate that
|
|
these do not report FP.
|
|
-->
|
|
<!--profile>
|
|
<id>False Positive Tests</id>
|
|
<activation>
|
|
<property>
|
|
<name>releaseTesting</name>
|
|
</property>
|
|
</activation>
|
|
<dependencies>
|
|
<dependency>
|
|
<groupId>org.apache.xmlgraphics</groupId>
|
|
<artifactId>batik-util</artifactId>
|
|
<version>1.7</version>
|
|
<scope>test</scope>
|
|
<optional>true</optional>
|
|
</dependency>
|
|
<dependency>
|
|
<groupId>org.apache.ws.security</groupId>
|
|
<artifactId>wss4j</artifactId>
|
|
<version>1.5.7</version>
|
|
<scope>test</scope>
|
|
<optional>true</optional>
|
|
</dependency>
|
|
<dependency>
|
|
<groupId>com.ganyo</groupId>
|
|
<artifactId>gcm-server</artifactId>
|
|
<version>1.0.2</version>
|
|
<scope>test</scope>
|
|
<optional>true</optional>
|
|
</dependency>
|
|
<dependency>
|
|
<groupId>org.python</groupId>
|
|
<artifactId>jython-standalone</artifactId>
|
|
<version>2.7-b1</version>
|
|
<scope>test</scope>
|
|
<optional>true</optional>
|
|
</dependency>
|
|
<dependency>
|
|
<groupId>org.jruby</groupId>
|
|
<artifactId>jruby-complete</artifactId>
|
|
<version>1.7.4</version>
|
|
<scope>test</scope>
|
|
<optional>true</optional>
|
|
</dependency>
|
|
<dependency>
|
|
<groupId>org.jruby</groupId>
|
|
<artifactId>jruby</artifactId>
|
|
<version>1.6.3</version>
|
|
<scope>test</scope>
|
|
<optional>true</optional>
|
|
</dependency>
|
|
<dependency>
|
|
<groupId>org.glassfish.jersey.core</groupId>
|
|
<artifactId>jersey-client</artifactId>
|
|
<version>2.12</version>
|
|
<scope>test</scope>
|
|
<optional>true</optional>
|
|
</dependency>
|
|
<dependency>
|
|
<groupId>com.sun.jersey</groupId>
|
|
<artifactId>jersey-client</artifactId>
|
|
<version>1.11.1</version>
|
|
<scope>test</scope>
|
|
<optional>true</optional>
|
|
</dependency>
|
|
<dependency>
|
|
<groupId>com.sun.faces</groupId>
|
|
<artifactId>jsf-impl</artifactId>
|
|
<version>2.2.8-02</version>
|
|
<scope>test</scope>
|
|
<optional>true</optional>
|
|
</dependency>
|
|
<dependency>
|
|
<groupId>com.google.inject</groupId>
|
|
<artifactId>guice</artifactId>
|
|
<version>3.0</version>
|
|
<scope>test</scope>
|
|
<optional>true</optional>
|
|
</dependency>
|
|
<dependency>
|
|
<groupId>org.opensaml</groupId>
|
|
<artifactId>xmltooling</artifactId>
|
|
<version>1.4.1</version>
|
|
<scope>test</scope>
|
|
<optional>true</optional>
|
|
</dependency>
|
|
<dependency>
|
|
<groupId>com.google.gerrit</groupId>
|
|
<artifactId>gerrit-extension-api</artifactId>
|
|
<version>2.11</version>
|
|
<scope>test</scope>
|
|
<optional>true</optional>
|
|
</dependency>
|
|
<dependency>
|
|
<groupId>com.google.apis</groupId>
|
|
<artifactId>google-api-services-sqladmin</artifactId>
|
|
<version>v1beta4-rev5-1.20.0</version>
|
|
<scope>test</scope>
|
|
<optional>true</optional>
|
|
</dependency>
|
|
<dependency>
|
|
<groupId>com.google.gwt.google-apis</groupId>
|
|
<artifactId>gwt-gears</artifactId>
|
|
<version>1.2.1</version>
|
|
<scope>test</scope>
|
|
<optional>true</optional>
|
|
</dependency>
|
|
<dependency>
|
|
<groupId>org.mozilla</groupId>
|
|
<artifactId>rhino</artifactId>
|
|
<version>1.7.6</version>
|
|
<scope>test</scope>
|
|
<optional>true</optional>
|
|
</dependency>
|
|
<dependency>
|
|
<groupId>com.microsoft.windowsazure</groupId>
|
|
<artifactId>microsoft-azure-api-media</artifactId>
|
|
<version>0.5.0</version>
|
|
<scope>test</scope>
|
|
<optional>true</optional>
|
|
</dependency>
|
|
<dependency>
|
|
<groupId>com.microsoft.windowsazure</groupId>
|
|
<artifactId>microsoft-azure-api-management-sql</artifactId>
|
|
<version>0.5.0</version>
|
|
<scope>test</scope>
|
|
<optional>true</optional>
|
|
</dependency>
|
|
<dependency>
|
|
<groupId>com.microsoft.bingads</groupId>
|
|
<artifactId>microsoft.bingads</artifactId>
|
|
<version>9.3.4</version>
|
|
<scope>test</scope>
|
|
<optional>true</optional>
|
|
</dependency>
|
|
</dependencies>
|
|
</profile-->
|
|
</profiles>
|
|
</project>
|