From b345359eca7d11b19d6de6e7d209139dc4afd4f1 Mon Sep 17 00:00:00 2001 From: Jeremy Long Date: Thu, 27 Oct 2022 20:46:44 -0400 Subject: [PATCH] feat: add mojo to scan plugins, resolves #4035 --- .../dependency/Dependency.java | 29 +- .../main/resources/templates/htmlReport.vsl | 59 +- .../dependencycheck/maven/AggregateMojo.java | 18 + .../maven/BaseDependencyCheckMojo.java | 570 ++++++++++++------ .../dependencycheck/maven/CheckMojo.java | 15 + .../CollectingRootDependencyGraphVisitor.java | 70 +++ .../dependencycheck/maven/PurgeMojo.java | 14 + .../dependencycheck/maven/UpdateMojo.java | 14 + .../maven/BaseDependencyCheckMojoTest.java | 4 + 9 files changed, 608 insertions(+), 185 deletions(-) create mode 100644 maven/src/main/java/org/owasp/dependencycheck/maven/CollectingRootDependencyGraphVisitor.java diff --git a/core/src/main/java/org/owasp/dependencycheck/dependency/Dependency.java b/core/src/main/java/org/owasp/dependencycheck/dependency/Dependency.java index fd31f392cd4..fff8c6b6f6e 100644 --- a/core/src/main/java/org/owasp/dependencycheck/dependency/Dependency.java +++ b/core/src/main/java/org/owasp/dependencycheck/dependency/Dependency.java @@ -102,6 +102,11 @@ public class Dependency extends EvidenceCollection implements Serializable { * A collection of related dependencies. */ private final SortedSet relatedDependencies = new TreeSet<>(Dependency.NAME_COMPARATOR); + /** + * The set of dependencies that included this dependency (i.e., this is a + * transitive dependency because it was included by X). + */ + private final Set includedBy = new HashSet<>(); /** * A list of projects that reference this dependency. */ @@ -433,6 +438,7 @@ public synchronized Set getSoftwareIdentifiers() { public synchronized Set getVulnerableSoftwareIdentifiers() { return Collections.unmodifiableSet(this.vulnerableSoftwareIdentifiers); } + /** * Returns the count of vulnerability identifiers. * @@ -441,6 +447,7 @@ public synchronized Set getVulnerableSoftwareIdentifiers() { public synchronized int getVulnerableSoftwareIdentifiersCount() { return this.vulnerableSoftwareIdentifiers.size(); } + /** * Adds a set of Identifiers to the current list of software identifiers. * Only used for testing. @@ -767,6 +774,26 @@ public synchronized void clearRelatedDependencies() { relatedDependencies.clear(); } + /** + * Get the unmodifiable set of includedBy (the list of parents of this + * transitive dependency). + * + * @return the unmodifiable set of includedBy + */ + public synchronized Set getIncludedBy() { + return Collections.unmodifiableSet(new HashSet<>(includedBy)); + } + + /** + * Adds the parent or root of the transitive dependency chain (i.e., this + * was included by the parent dependency X). + * + * @param includedBy a project reference + */ + public synchronized void addIncludedBy(String includedBy) { + this.includedBy.add(includedBy); + } + /** * Get the unmodifiable set of projectReferences. * @@ -808,7 +835,7 @@ public synchronized void addRelatedDependency(Dependency dependency) { LOGGER.debug("dependency: {}", dependency); } else if (NAME_COMPARATOR.compare(this, dependency) == 0) { LOGGER.debug("Attempted to add the same dependency as this, likely due to merging identical dependencies " - + "obtained from different modules"); + + "obtained from different modules"); LOGGER.debug("this: {}", this); LOGGER.debug("dependency: {}", dependency); } else if (!relatedDependencies.add(dependency)) { diff --git a/core/src/main/resources/templates/htmlReport.vsl b/core/src/main/resources/templates/htmlReport.vsl index 1dad4c983b4..29239b7bbdd 100644 --- a/core/src/main/resources/templates/htmlReport.vsl +++ b/core/src/main/resources/templates/htmlReport.vsl @@ -602,6 +602,28 @@ Copyright (c) 2012 Jeremy Long. All Rights Reserved. .underline { text-decoration: underline; } + .tooltip { + position: relative; + display: inline-block; + border-bottom: 1px dotted black; + } + + .tooltip .tooltiptext { + visibility: hidden; + width: 220px; + background-color: #cccccc; + text-align: center; + border-radius: 6px; + padding: 5px 0; + + /* Position the tooltip */ + position: absolute; + z-index: 1; + } + + .tooltip:hover .tooltiptext { + visibility: visible; + } @@ -804,10 +826,7 @@ Getting Help: SHA256:$enc.html($dependency.Sha256sum) #end #if ($dependency.projectReferences.size()==1) -
Referenced In Project/Scope: - #foreach($ref in $dependency.projectReferences) - $enc.html($ref) - #end +
Referenced In Project/Scope: $enc.html($dependency.projectReferences.iterator().next()) #end #if ($dependency.projectReferences.size()>1)
Referenced In Projects/Scopes: