Skip to content

Commit 763ee10

Browse files
jeremylongjeremylong
authored
Merge branch 'main' into jcs-logging
2 parents 09b8b4d + 0425f70 commit 763ee10

File tree

24 files changed

+530
-35
lines changed

24 files changed

+530
-35
lines changed

‎Dockerfile‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@ ARG GID=1000
1515
ENV user=dependencycheck
1616
ENV JAVA_HOME=/opt/jdk
1717
ENV JAVA_OPTS="-Danalyzer.assembly.dotnet.path=/usr/bin/dotnet -Danalyzer.bundle.audit.path=/usr/bin/bundle-audit -Danalyzer.golang.path=/usr/local/go/bin/go"
18+
ENV ODC_NAME=dependency-check-docker
1819

1920
COPY --from=jlink /jlinked /opt/jdk/
2021
COPY --from=go /usr/local/go/ /usr/local/go/

‎ant/src/main/java/org/owasp/dependencycheck/taskdefs/Check.java‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,7 @@
4545
import org.owasp.dependencycheck.utils.InvalidSettingException;
4646
import org.owasp.dependencycheck.utils.Settings;
4747
import org.owasp.dependencycheck.utils.SeverityUtil;
48+
import org.owasp.dependencycheck.utils.scarf.TelemetryCollector;
4849
import org.slf4j.impl.StaticLoggerBinder;
4950

5051
//CSOFF: MethodCount
@@ -1335,6 +1336,7 @@ protected void executeWithContextClassloader() throws BuildException {
13351336
} catch (InvalidSettingException e) {
13361337
throw new BuildException(e);
13371338
}
1339+
TelemetryCollector.send(getSettings());
13381340
try (Engine engine = new Engine(Check.class.getClassLoader(), getSettings())) {
13391341
for (Resource resource : getPath()) {
13401342
final FileProvider provider = resource.as(FileProvider.class);

‎ant/src/main/resources/task.properties‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,3 @@
11
# the path to the data directory
22
data.directory=data/11.0
3+
odc.application.name=dependency-check-ant

‎cli/src/main/java/org/owasp/dependencycheck/App.java‎

Lines changed: 19 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@
2626

2727
import java.util.stream.Collectors;
2828
import java.util.stream.Stream;
29+
2930
import org.apache.commons.cli.ParseException;
3031
import org.apache.tools.ant.DirectoryScanner;
3132
import org.owasp.dependencycheck.data.nvdcve.DatabaseException;
@@ -39,6 +40,7 @@
3940
import org.owasp.dependencycheck.utils.Downloader;
4041
import org.owasp.dependencycheck.utils.InvalidSettingException;
4142
import org.owasp.dependencycheck.utils.Settings;
43+
import org.owasp.dependencycheck.utils.scarf.TelemetryCollector;
4244
import org.slf4j.Logger;
4345
import org.slf4j.LoggerFactory;
4446

@@ -48,7 +50,10 @@
4850
import ch.qos.logback.classic.spi.ILoggingEvent;
4951
import ch.qos.logback.classic.Level;
5052
import ch.qos.logback.classic.LoggerContext;
53+
import io.github.jeremylong.jcs3.slf4j.Slf4jAdapter;
54+
5155
import java.util.TreeSet;
56+
5257
import org.owasp.dependencycheck.utils.SeverityUtil;
5358

5459
/**
@@ -184,6 +189,7 @@ public int run(String[] args) {
184189
try {
185190
populateSettings(cli);
186191
Downloader.getInstance().configure(settings);
192+
TelemetryCollector.send(settings);
187193
} catch (InvalidSettingException ex) {
188194
LOGGER.error(ex.getMessage(), ex);
189195
LOGGER.debug(ERROR_LOADING_PROPERTIES_FILE, ex);
@@ -249,7 +255,7 @@ public int run(String[] args) {
249255
* collection.
250256
*/
251257
private int runScan(String reportDirectory, String[] outputFormats, String applicationName, String[] files,
252-
String[] excludes, int symLinkDepth, float cvssFailScore) throws DatabaseException,
258+
String[] excludes, int symLinkDepth, float cvssFailScore) throws DatabaseException,
253259
ExceptionCollection, ReportException {
254260
Engine engine = null;
255261
try {
@@ -336,10 +342,10 @@ private int determineReturnCode(Engine engine, float cvssFailScore) {
336342
if (addName) {
337343
addName = false;
338344
ids.append(NEW_LINE).append(d.getFileName()).append(" (")
339-
.append(Stream.concat(d.getSoftwareIdentifiers().stream(), d.getVulnerableSoftwareIdentifiers().stream())
340-
.map(Identifier::getValue)
341-
.collect(Collectors.joining(", ")))
342-
.append("): ");
345+
.append(Stream.concat(d.getSoftwareIdentifiers().stream(), d.getVulnerableSoftwareIdentifiers().stream())
346+
.map(Identifier::getValue)
347+
.collect(Collectors.joining(", ")))
348+
.append("): ");
343349
ids.append(v.getName()).append('(').append(score).append(')');
344350
} else {
345351
ids.append(", ").append(v.getName()).append('(').append(score).append(')');
@@ -445,6 +451,7 @@ private void runUpdateOnly() throws UpdateException, DatabaseException {
445451
}
446452

447453
//CSOFF: MethodLength
454+
448455
/**
449456
* Updates the global Settings.
450457
*
@@ -454,6 +461,12 @@ private void runUpdateOnly() throws UpdateException, DatabaseException {
454461
* file is unable to be loaded.
455462
*/
456463
protected void populateSettings(CliParser cli) throws InvalidSettingException {
464+
String name = System.getenv("ODC_NAME") != null ? System.getenv("ODC_NAME") : "dependency-check-cli";
465+
if (name.isBlank()) {
466+
name = "dependency-check-cli";
467+
}
468+
name = name.replace("/", "-").replace(" ", "_");
469+
settings.setString(Settings.KEYS.APPLICATION_NAME, name);
457470
final File propertiesFile = cli.getFileArgument(CliParser.ARGUMENT.PROP);
458471
if (propertiesFile != null) {
459472
try {
@@ -726,6 +739,7 @@ protected void populateSettings(CliParser cli) throws InvalidSettingException {
726739
}
727740

728741
//CSON: MethodLength
742+
729743
/**
730744
* Creates a file appender and adds it to logback.
731745
*

‎core/pom.xml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -294,7 +294,7 @@ Copyright (c) 2012 Jeremy Long. All Rights Reserved.
294294
<scope>compile</scope>
295295
</dependency>
296296
<dependency>
297-
<groupId>org.glassfish</groupId>
297+
<groupId>org.eclipse.parsson</groupId>
298298
<artifactId>jakarta.json</artifactId>
299299
</dependency>
300300
<dependency>

‎core/src/main/java/org/owasp/dependencycheck/agent/DependencyCheckScanAgent.java‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,7 @@
3535
import org.owasp.dependencycheck.reporting.ReportGenerator;
3636
import org.owasp.dependencycheck.utils.Settings;
3737
import org.owasp.dependencycheck.utils.SeverityUtil;
38+
import org.owasp.dependencycheck.utils.scarf.TelemetryCollector;
3839
import org.slf4j.Logger;
3940
import org.slf4j.LoggerFactory;
4041

@@ -888,6 +889,8 @@ public void setPropertiesFilePath(String propertiesFilePath) {
888889
@SuppressWarnings("squid:S2095")
889890
private Engine executeDependencyCheck() throws ExceptionCollection {
890891
populateSettings();
892+
String version = settings.getString(Settings.KEYS.APPLICATION_VERSION, "Unknown");
893+
TelemetryCollector.send(settings, "dependency-check-scan-agent", version);
891894
final Engine engine;
892895
try {
893896
engine = new Engine(settings);

‎core/src/main/java/org/owasp/dependencycheck/analyzer/NodePackageAnalyzer.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -196,7 +196,7 @@ private boolean isNodeAuditEnabled(Engine engine) {
196196
try {
197197
((AbstractNpmAnalyzer) a).prepareFileTypeAnalyzer(engine);
198198
} catch (InitializationException ex) {
199-
String message = "Error initializing the " + a.getName();
199+
final String message = "Error initializing the " + a.getName();
200200
LOGGER.debug(message, ex);
201201
}
202202
}

‎core/src/main/java/org/owasp/dependencycheck/analyzer/OssIndexAnalyzer.java‎

Lines changed: 8 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -59,10 +59,10 @@
5959
import java.net.SocketTimeoutException;
6060

6161
import javax.annotation.Nullable;
62+
6263
import org.apache.commons.lang3.StringUtils;
6364
import org.owasp.dependencycheck.utils.CvssUtil;
6465
import org.sonatype.goodies.packageurl.InvalidException;
65-
import org.sonatype.ossindex.service.client.transport.Transport.TransportException;
6666

6767
/**
6868
* Enrich dependency information from Sonatype OSS index.
@@ -131,13 +131,14 @@ protected void closeAnalyzer() throws Exception {
131131

132132
@Override
133133
protected void prepareAnalyzer(Engine engine) throws InitializationException {
134-
synchronized (FETCH_MUTIX) {
135-
if (StringUtils.isEmpty(getSettings().getString(KEYS.ANALYZER_OSSINDEX_USER, StringUtils.EMPTY)) ||
136-
StringUtils.isEmpty(getSettings().getString(KEYS.ANALYZER_OSSINDEX_PASSWORD, StringUtils.EMPTY))) {
137-
LOG.warn("Disabling OSS Index analyzer due to missing user/password credentials. Authentication is now required: https://ossindex.sonatype.org/doc/auth-required");
138-
setEnabled(false);
134+
synchronized (FETCH_MUTIX) {
135+
if (StringUtils.isEmpty(getSettings().getString(KEYS.ANALYZER_OSSINDEX_USER, StringUtils.EMPTY))
136+
|| StringUtils.isEmpty(getSettings().getString(KEYS.ANALYZER_OSSINDEX_PASSWORD, StringUtils.EMPTY))) {
137+
LOG.warn("Disabling OSS Index analyzer due to missing user/password credentials. Authentication is now " +
138+
"required: https://ossindex.sonatype.org/doc/auth-required");
139+
setEnabled(false);
140+
}
139141
}
140-
}
141142
}
142143

143144
@Override

‎core/src/main/java/org/owasp/dependencycheck/dependency/VulnerableSoftware.java‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -528,6 +528,11 @@ public String toString() {
528528
return sb.toString();
529529
}
530530

531+
/**
532+
* Returns the NVD search URL for this vulnerable software.
533+
*
534+
* @return the NVD search URL
535+
*/
531536
public String toNvdSearchUrl() {
532537
return CpeIdentifier.nvdSearchUrlFor(this);
533538
}

‎core/src/main/java/org/owasp/dependencycheck/xml/suppression/SuppressionHandler.java‎

Lines changed: 50 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@
2020
import java.util.ArrayList;
2121
import java.util.Calendar;
2222
import java.util.List;
23+
import java.util.Optional;
2324
import javax.annotation.concurrent.NotThreadSafe;
2425
import org.owasp.dependencycheck.exception.ParseException;
2526
import org.owasp.dependencycheck.utils.DateUtil;
@@ -30,7 +31,8 @@
3031
import org.xml.sax.helpers.DefaultHandler;
3132

3233
/**
33-
* A handler to load suppression rules.
34+
* A handler to load suppression rules. In the input xml a suppression rule can be part of a {@code suppressionGroup}. In that
35+
* case the attributes set on group element will act as default values for child suppressions.
3436
*
3537
* @author Jeremy Long
3638
*/
@@ -42,6 +44,10 @@ public class SuppressionHandler extends DefaultHandler {
4244
*/
4345
private static final Logger LOGGER = LoggerFactory.getLogger(SuppressionHandler.class);
4446

47+
/**
48+
* The suppressionGroup node, indicates the start of a new suppressionGroup.
49+
*/
50+
public static final String SUPPRESSION_GROUP = "suppressionGroup";
4551
/**
4652
* The suppress node, indicates the start of a new rule.
4753
*/
@@ -105,6 +111,10 @@ public class SuppressionHandler extends DefaultHandler {
105111
*/
106112
private StringBuilder currentText;
107113

114+
private Boolean groupBase = null;
115+
private Calendar groupUntil = null;
116+
117+
108118
/**
109119
* Get the value of suppressionRules.
110120
*
@@ -127,22 +137,40 @@ public List<SuppressionRule> getSuppressionRules() {
127137
public void startElement(String uri, String localName, String qName, Attributes attributes) throws SAXException {
128138
currentAttributes = attributes;
129139
currentText = new StringBuilder();
140+
141+
if (SUPPRESSION_GROUP.equals(qName)) {
142+
groupBase = attributes.getValue("base") != null ? Boolean.parseBoolean(attributes.getValue("base")) : null;
143+
groupUntil = parseUntilAttribute(attributes).orElse(null);
144+
}
145+
130146
if (SUPPRESS.equals(qName)) {
147+
Boolean base = attributes.getValue("base") != null ? Boolean.parseBoolean(attributes.getValue("base")) : null;
148+
Calendar until = parseUntilAttribute(attributes).orElse(null);
149+
131150
rule = new SuppressionRule();
132-
final String base = currentAttributes.getValue("base");
133-
if (base != null) {
134-
rule.setBase(Boolean.parseBoolean(base));
135-
} else {
136-
rule.setBase(false);
137-
}
138-
final String until = currentAttributes.getValue("until");
139-
if (until != null) {
140-
try {
141-
rule.setUntil(DateUtil.parseXmlDate(until));
142-
} catch (ParseException ex) {
143-
throw new SAXException("Unable to parse until date in suppression file: " + until, ex);
144-
}
151+
//If suppression doesn't have attribute set, use that of the group (if in group).
152+
rule.setBase(base != null ? base : groupBase);
153+
rule.setUntil(until != null ? until : groupUntil);
154+
}
155+
}
156+
157+
/**
158+
* Read the provided {@code attributes} for attribute {@code until}. Return {@link Calendar} object if attribute is
159+
* present and can be parsed.
160+
*
161+
* @return empty if attribute {@code until} is not present.
162+
* @throws SAXException if attribute {@code until} is present but value can not be parsed as {@link Calendar}.
163+
*/
164+
private static Optional<Calendar> parseUntilAttribute(Attributes attributes) throws SAXException {
165+
String untilStr = attributes.getValue("until");
166+
if (untilStr != null) {
167+
try {
168+
return Optional.of(DateUtil.parseXmlDate(untilStr));
169+
} catch (ParseException ex) {
170+
throw new SAXException("Unable to parse attribute 'until': " + untilStr, ex);
145171
}
172+
} else {
173+
return Optional.empty();
146174
}
147175
}
148176

@@ -166,6 +194,10 @@ public void endElement(String uri, String localName, String qName) throws SAXExc
166194
}
167195
rule = null;
168196
break;
197+
case SUPPRESSION_GROUP:
198+
groupBase = null;
199+
groupUntil = null;
200+
break;
169201
case FILE_PATH:
170202
rule.setFilePath(processPropertyType());
171203
break;
@@ -191,7 +223,10 @@ public void endElement(String uri, String localName, String qName) throws SAXExc
191223
rule.addVulnerabilityName(processPropertyType());
192224
break;
193225
case NOTES:
194-
rule.setNotes(currentText.toString().trim());
226+
// Check that the notes element is from a suppression and not a suppressionGroup.
227+
if(rule != null) {
228+
rule.setNotes(currentText.toString().trim());
229+
}
195230
break;
196231
case CVSS_BELOW:
197232
final Double cvss = Double.valueOf(currentText.toString().trim());

0 commit comments

Comments
 (0)