This is an automated email from the ASF dual-hosted git repository.
hao pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/eagle.git
The following commit(s) were added to refs/heads/master by this push:
new df0e91d [EAGLE-1102] Integrate CVE maven plugin
df0e91d is described below
commit df0e91de65cf9428f0f735065eba580e37183030
Author: Grainier <[email protected]>
AuthorDate: Mon Oct 7 23:05:57 2019 -0700
[EAGLE-1102] Integrate CVE maven plugin
<!--
{% comment %}
Licensed to the Apache Software Foundation (ASF) under one or more
contributor license agreements. See the NOTICE file distributed with
this work for additional information regarding copyright ownership.
The ASF licenses this file to you under the Apache License, Version 2.0
(the "License"); you may not use this file except in compliance with
the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
{% endcomment %}
-->
## Purpose
Purpose of this pull request is to integrate the CVE maven plugin for eagle
to check security vulnerabilities in dependencies during build time. This will
help to detect publicly disclosed vulnerabilities contained within eagle's
dependencies (and the dependencies of all child modules).
## Usage
This plugin configuration is attached to the `mvn verify` phase. Therefore,
this will run automatically when we perform a `mvn clean verify`. Once the
`mvn` process is completed, the plugin will create a
`dependency-check-report.html` report in `target/` dir with the detect
vulnerabilities.
In case if you need to skip this plugin, use `owasp.check.skip=true`
property (i.e `mvn clean verify -Dowasp.check.skip=true`).
## Remarks
- Fixes https://issues.apache.org/jira/browse/EAGLE-1102
- https://issues.apache.org/jira/browse/EAGLE-1100
- https://github.com/jeremylong/DependencyCheck
-
https://jeremylong.github.io/DependencyCheck/dependency-check-maven/aggregate-mojo.html
- https://jeremylong.github.io/DependencyCheck/general/suppression.html
---
Be sure to do all of the following to help us incorporate your contribution
quickly and easily:
- [x] Make sure the PR title is formatted like:
`[EAGLE-<Jira issue #>] Description of pull request`
- [x] Make sure tests pass via `mvn clean verify`. (Even better, enable
Travis-CI on your fork and ensure the whole test matrix passes).
- [x] Replace `<Jira issue #>` in the title with the actual Jira issue
number, if there is one.
- [ ] If this contribution is large, please file an Apache
[Individual Contributor License
Agreement](https://www.apache.org/licenses/icla.txt).
---
Author: Grainier <[email protected]>
Closes #1005 from grainier/EAGLE-1102.
---
eagle-dev/owasp-dependency-check-suppression.xml | 28 ++++++++++++++++++++++++
pom.xml | 26 ++++++++++++++++++++++
2 files changed, 54 insertions(+)
diff --git a/eagle-dev/owasp-dependency-check-suppression.xml
b/eagle-dev/owasp-dependency-check-suppression.xml
new file mode 100644
index 0000000..6121f99
--- /dev/null
+++ b/eagle-dev/owasp-dependency-check-suppression.xml
@@ -0,0 +1,28 @@
+<?xml version="1.0" encoding="UTF-8"?>
+
+<!--
+ Licensed under the Apache License, Version 2.0 (the "License");
+ you may not use this file except in compliance with the License.
+ You may obtain a copy of the License at
+ http://www.apache.org/licenses/LICENSE-2.0
+ Unless required by applicable law or agreed to in writing, software
+ distributed under the License is distributed on an "AS IS" BASIS,
+ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ See the License for the specific language governing permissions and
+ limitations under the License. See accompanying LICENSE file.
+-->
+
+<suppressions
xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd";>
+
+ <!--
+ refer :
https://jeremylong.github.io/DependencyCheck/general/suppression.html
+ for samples on suppressing false positives.
+ -->
+ <suppress>
+ <notes><![CDATA[
+ This suppresses all CVE entries that have a score below CVSS 7.
+ ]]></notes>
+ <cvssBelow>7</cvssBelow>
+ </suppress>
+
+</suppressions>
diff --git a/pom.xml b/pom.xml
index 7d479c3..00962ff 100755
--- a/pom.xml
+++ b/pom.xml
@@ -151,6 +151,7 @@
<scala-lang.version>2.11.8</scala-lang.version>
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
<project.reporting.outputEncoding>UTF-8</project.reporting.outputEncoding>
+ <owasp.check.skip>false</owasp.check.skip>
<!-- Maven Plugins Versions -->
<maven.version>3.3.3</maven.version>
@@ -173,6 +174,7 @@
<checkstyle.version>7.1</checkstyle.version>
<cobertura-maven.version>2.7</cobertura-maven.version>
<coveralls-maven.version>4.3.0</coveralls-maven.version>
+ <dependency-check-maven.version>5.2.2</dependency-check-maven.version>
<buildnumber-maven.version>1.4</buildnumber-maven.version>
<templating-maven.version>1.0.0</templating-maven.version>
@@ -1321,6 +1323,30 @@
<additionalparam>-Xdoclint:none</additionalparam>
</configuration>
</plugin>
+
+ <!-- OWASP dependency check -->
+ <plugin>
+ <groupId>org.owasp</groupId>
+ <artifactId>dependency-check-maven</artifactId>
+ <version>${dependency-check-maven.version}</version>
+ <configuration>
+ <!-- use -Dowasp.check.skip=true to skip dependency check
-->
+ <skip>${owasp.check.skip}</skip>
+ <format>HTML</format>
+
<bundleAuditAnalyzerEnabled>false</bundleAuditAnalyzerEnabled>
+ <assemblyAnalyzerEnabled>false</assemblyAnalyzerEnabled>
+
<suppressionFile>eagle-dev/owasp-dependency-check-suppression.xml</suppressionFile>
+ </configuration>
+ <executions>
+ <execution>
+ <goals>
+ <!-- generates aggregated reports in target/ -->
+ <goal>check</goal>
+ <goal>aggregate</goal>
+ </goals>
+ </execution>
+ </executions>
+ </plugin>
</plugins>
</build>
<repositories>
