-
-
Notifications
You must be signed in to change notification settings - Fork 1.3k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #3736 from jeremylong/issue-3730
Filter out the reactorprojects in the dependencies for the MSHARED-998 workaround attempting to resolve a dependency with a classifier
- Loading branch information
Showing
8 changed files
with
289 additions
and
12 deletions.
There are no files selected for viewing
40 changes: 40 additions & 0 deletions
40
maven/src/it/3730-classifier-in-dependency-aggregate/childOne/pom.xml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,40 @@ | ||
| <?xml version="1.0" encoding="UTF-8"?> | ||
| <!-- | ||
| This file is part of dependency-check-maven. | ||
| Licensed under the Apache License, Version 2.0 (the "License"); | ||
| you may not use this file except in compliance with the License. | ||
| You may obtain a copy of the License at | ||
| http://www.apache.org/licenses/LICENSE-2.0 | ||
| Unless required by applicable law or agreed to in writing, software | ||
| distributed under the License is distributed on an "AS IS" BASIS, | ||
| WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| See the License for the specific language governing permissions and | ||
| limitations under the License. | ||
| Copyright (c) 2017 Jeremy Long. All Rights Reserved. | ||
| --> | ||
| <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd"> | ||
| <modelVersion>4.0.0</modelVersion> | ||
| <parent> | ||
| <groupId>org.owasp.test</groupId> | ||
| <artifactId>3730-classifier-in-dependency-aggregate</artifactId> | ||
| <version>1.0.0-SNAPSHOT</version> | ||
| </parent> | ||
| <artifactId>3730-classifier-in-dependency-aggregate-childOne</artifactId> | ||
| <packaging>jar</packaging> | ||
| <dependencies> | ||
| <dependency> | ||
| <groupId>com.google.inject</groupId> | ||
| <artifactId>guice</artifactId> | ||
| <classifier>no_aop</classifier> | ||
| </dependency> | ||
| <dependency> | ||
| <groupId>org.owasp.test</groupId> | ||
| <artifactId>3730-classifier-in-dependency-aggregate-childTwo</artifactId> | ||
| <version>1.0.0-SNAPSHOT</version> | ||
| </dependency> | ||
| </dependencies> | ||
| </project> |
35 changes: 35 additions & 0 deletions
35
maven/src/it/3730-classifier-in-dependency-aggregate/childTwo/pom.xml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,35 @@ | ||
| <?xml version="1.0" encoding="UTF-8"?> | ||
| <!-- | ||
| This file is part of dependency-check-maven. | ||
| Licensed under the Apache License, Version 2.0 (the "License"); | ||
| you may not use this file except in compliance with the License. | ||
| You may obtain a copy of the License at | ||
| http://www.apache.org/licenses/LICENSE-2.0 | ||
| Unless required by applicable law or agreed to in writing, software | ||
| distributed under the License is distributed on an "AS IS" BASIS, | ||
| WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| See the License for the specific language governing permissions and | ||
| limitations under the License. | ||
| Copyright (c) 2017 Jeremy Long. All Rights Reserved. | ||
| --> | ||
| <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd"> | ||
| <modelVersion>4.0.0</modelVersion> | ||
| <parent> | ||
| <groupId>org.owasp.test</groupId> | ||
| <artifactId>3730-classifier-in-dependency-aggregate</artifactId> | ||
| <version>1.0.0-SNAPSHOT</version> | ||
| </parent> | ||
| <artifactId>3730-classifier-in-dependency-aggregate-childTwo</artifactId> | ||
| <packaging>jar</packaging> | ||
| <dependencies> | ||
| <dependency> | ||
| <groupId>com.google.inject</groupId> | ||
| <artifactId>guice</artifactId> | ||
| <classifier>classes</classifier> | ||
| </dependency> | ||
| </dependencies> | ||
| </project> |
19 changes: 19 additions & 0 deletions
19
maven/src/it/3730-classifier-in-dependency-aggregate/invoker.properties
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,19 @@ | ||
| # | ||
| # This file is part of dependency-check-maven. | ||
| # | ||
| # Licensed under the Apache License, Version 2.0 (the "License"); | ||
| # you may not use this file except in compliance with the License. | ||
| # You may obtain a copy of the License at | ||
| # | ||
| # http://www.apache.org/licenses/LICENSE-2.0 | ||
| # | ||
| # Unless required by applicable law or agreed to in writing, software | ||
| # distributed under the License is distributed on an "AS IS" BASIS, | ||
| # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| # See the License for the specific language governing permissions and | ||
| # limitations under the License. | ||
| # | ||
| # Copyright (c) 2014 Jeremy Long. All Rights Reserved. | ||
| # | ||
|
|
||
| invoker.goals = --no-transfer-progress --batch-mode -Danalyzer.ossindex.enabled=false -Danalyzer.central.enabled=false ${project.groupId}:${project.artifactId}:${project.version}:aggregate -Dformat=XML -Dcve.startyear=2018 |
47 changes: 47 additions & 0 deletions
47
maven/src/it/3730-classifier-in-dependency-aggregate/pom.xml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,47 @@ | ||
| <?xml version="1.0" encoding="UTF-8"?> | ||
| <!-- | ||
| This file is part of dependency-check-maven. | ||
| Licensed under the Apache License, Version 2.0 (the "License"); | ||
| you may not use this file except in compliance with the License. | ||
| You may obtain a copy of the License at | ||
| http://www.apache.org/licenses/LICENSE-2.0 | ||
| Unless required by applicable law or agreed to in writing, software | ||
| distributed under the License is distributed on an "AS IS" BASIS, | ||
| WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| See the License for the specific language governing permissions and | ||
| limitations under the License. | ||
| Copyright (c) 2017 Jeremy Long. All Rights Reserved. | ||
| --> | ||
| <project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd"> | ||
| <modelVersion>4.0.0</modelVersion> | ||
| <groupId>org.owasp.test</groupId> | ||
| <artifactId>3730-classifier-in-dependency-aggregate</artifactId> | ||
| <version>1.0.0-SNAPSHOT</version> | ||
| <packaging>pom</packaging> | ||
| <modules> | ||
| <module>childOne</module> | ||
| <module>childTwo</module> | ||
| </modules> | ||
| <dependencyManagement> | ||
| <dependencies> | ||
| <dependency> | ||
| <groupId>com.google.inject</groupId> | ||
| <artifactId>guice</artifactId> | ||
| <version>4.2.2</version> | ||
| <classifier>no_aop</classifier> | ||
| <scope>provided</scope> | ||
| </dependency> | ||
| <dependency> | ||
| <groupId>com.google.inject</groupId> | ||
| <artifactId>guice</artifactId> | ||
| <version>4.2.2</version> | ||
| <classifier>classes</classifier> | ||
| <scope>provided</scope> | ||
| </dependency> | ||
| </dependencies> | ||
| </dependencyManagement> | ||
| </project> |
43 changes: 43 additions & 0 deletions
43
maven/src/it/3730-classifier-in-dependency-aggregate/postbuild.groovy
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,43 @@ | ||
| /* | ||
| * This file is part of dependency-check-maven. | ||
| * | ||
| * Licensed under the Apache License, Version 2.0 (the "License"); | ||
| * you may not use this file except in compliance with the License. | ||
| * You may obtain a copy of the License at | ||
| * | ||
| * http://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, software | ||
| * distributed under the License is distributed on an "AS IS" BASIS, | ||
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| * See the License for the specific language governing permissions and | ||
| * limitations under the License. | ||
| * | ||
| * Copyright (c) 2014 Jeremy Long. All Rights Reserved. | ||
| */ | ||
|
|
||
| import org.apache.commons.io.FileUtils; | ||
| import org.w3c.dom.NodeList; | ||
|
|
||
| import java.nio.charset.Charset; | ||
| import javax.xml.xpath.* | ||
| import javax.xml.parsers.DocumentBuilderFactory | ||
|
|
||
| // Check to see if jackson-databind-2.5.3.jar was identified with a known CVE - using CVE-2018-7489. | ||
|
|
||
| def countMatches(String xml, String xpathQuery) { | ||
| def xpath = XPathFactory.newInstance().newXPath() | ||
| def builder = DocumentBuilderFactory.newInstance().newDocumentBuilder() | ||
| def inputStream = new ByteArrayInputStream( xml.bytes ) | ||
| def records = builder.parse(inputStream).documentElement | ||
| NodeList nodes = xpath.evaluate( xpathQuery, records, XPathConstants.NODESET ) as NodeList | ||
| nodes.getLength(); | ||
| } | ||
|
|
||
| String log = FileUtils.readFileToString(new File(basedir, "target/dependency-check-report.xml"), Charset.defaultCharset().name()); | ||
| int count = countMatches(log,"/analysis/dependencies/dependency[./fileName = 'guice-4.2.2-no_aop.jar']"); | ||
| if (count != 1){ | ||
| System.out.println(String.format("google guice no_aop was identified %s times, expected 1", count)); | ||
| return false; | ||
| } | ||
| return true; |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
81 changes: 81 additions & 0 deletions
81
maven/src/main/java/org/owasp/dependencycheck/maven/Mshared998Util.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,81 @@ | ||
| /* | ||
| * This file is part of dependency-check-maven. | ||
| * | ||
| * Licensed under the Apache License, Version 2.0 (the "License"); | ||
| * you may not use this file except in compliance with the License. | ||
| * You may obtain a copy of the License at | ||
| * | ||
| * http://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, software | ||
| * distributed under the License is distributed on an "AS IS" BASIS, | ||
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| * See the License for the specific language governing permissions and | ||
| * limitations under the License. | ||
| * | ||
| * Copyright (c) 2021 Jeremy Long. All Rights Reserved. | ||
| */ | ||
| package org.owasp.dependencycheck.maven; | ||
|
|
||
| import org.apache.maven.RepositoryUtils; | ||
| import org.apache.maven.artifact.Artifact; | ||
| import org.apache.maven.shared.transfer.artifact.ArtifactCoordinate; | ||
| import org.apache.maven.shared.transfer.dependencies.resolve.DependencyResolverException; | ||
| import org.eclipse.aether.resolution.ArtifactResult; | ||
| import org.eclipse.aether.resolution.DependencyResolutionException; | ||
| import org.eclipse.aether.resolution.DependencyResult; | ||
|
|
||
| import java.util.Objects; | ||
|
|
||
| public final class Mshared998Util { | ||
| /** | ||
| * Empty constructor to prevent instantiation of utility-class. | ||
| */ | ||
| private Mshared998Util() { | ||
| } | ||
|
|
||
| /** | ||
| * Find the artifact for the given coordinate among the available succesfull resolution attempts contained within the | ||
| * DependencyResolverException | ||
| * @param dre The DependencyResolverException that might have embedded successful resolution results | ||
| * @param coordinate The coordinates of the artifact we're interested in | ||
| * @return The resolved artifact matching {@code coordinate} or {@code null} if not found | ||
| */ | ||
| public static Artifact findArtifactInAetherDREResult(final DependencyResolverException dre, | ||
| final ArtifactCoordinate coordinate) { | ||
| Artifact result = null; | ||
| if (dre.getCause() instanceof DependencyResolutionException) { | ||
| final DependencyResolutionException adre = (DependencyResolutionException) dre.getCause(); | ||
| final DependencyResult dependencyResult = adre.getResult(); | ||
| if (dependencyResult != null) { | ||
| for (ArtifactResult artifactResult : dependencyResult.getArtifactResults()) { | ||
| if (matchesCoordinate(artifactResult, coordinate)) { | ||
| result = RepositoryUtils.toArtifact(artifactResult.getArtifact()); | ||
| break; | ||
| } | ||
| } | ||
| } | ||
| } | ||
| return result; | ||
| } | ||
|
|
||
| /** | ||
| * Checks whether the given ArtifactResult contains an artifact that matches the coordinate | ||
| * @param artifactResult The ArtifactResult to inspect | ||
| * @param coordinate The coordinate to match with | ||
| * @return {@code true} when the artifactresult contains an artifact that matches the coordinate on GAV_C_E, | ||
| * false otherwise. | ||
| */ private static boolean matchesCoordinate(final ArtifactResult artifactResult, final ArtifactCoordinate coordinate) { | ||
| if (artifactResult.getArtifact() == null) { | ||
| return false; | ||
| } else { | ||
| final org.eclipse.aether.artifact.Artifact artifact = artifactResult.getArtifact(); | ||
| boolean result = Objects.equals(artifact.getGroupId(), coordinate.getGroupId()); | ||
| result &= Objects.equals(artifact.getArtifactId(), coordinate.getArtifactId()); | ||
| result &= Objects.equals(artifact.getVersion(), coordinate.getVersion()); | ||
| result &= Objects.equals(artifact.getClassifier(), coordinate.getClassifier()); | ||
| result &= Objects.equals(artifact.getExtension(), coordinate.getExtension()); | ||
| return result; | ||
| } | ||
| } | ||
| } |