diff --git a/CHANGES b/CHANGES index b46a641..319e65a 100644 --- a/CHANGES +++ b/CHANGES @@ -2,6 +2,17 @@ Changelog ========= +Version 1.0.8 + +- feature dump dependencies tree to file include / exclude scan result +- upgrade upgrade org.apache.httpcomponents:httpclient to 4.5.13 + +Version 1.0.7 + +- bugfix NPE on outputDepToFile +- feature only analyze mode +- feature dump dependencies tree to file + Version 1.0.6 - feature change simple-json to gson diff --git a/README.md b/README.md index ec83e5f..45d470e 100644 --- a/README.md +++ b/README.md @@ -93,7 +93,7 @@ Maven >= 3.1 com.immomo.momosec mosec-maven-plugin - 1.0.7 + 1.0.8 test @@ -144,7 +144,7 @@ mosec:test User property: onlyProvenance outputDepToFile (Default: ) - 输出依赖树到文件 + 输出依赖树到文件，如果用户设置了onlyAnalyze=true则仅输出依赖树，否则输出依赖树以及漏洞检查结果 User property: outputDepToFile severityLevel (Default: High) @@ -193,7 +193,7 @@ MOSEC-MAVEN-PLUGIN使用`org.apache.maven:maven-core`组件中提供的`aether-a 4.在另一个maven工程中执行如下命令 ```shell script -> mvnDebug com.immomo.momosec:mosec-maven-plugin:1.0.7:test +> mvnDebug com.immomo.momosec:mosec-maven-plugin:1.0.8:test ``` -5.回到Intellij中，下断点，开始Debug \ No newline at end of file +5.回到Intellij中，下断点，开始Debug diff --git a/mvn-repo/com/immomo/momosec/mosec-maven-plugin/1.0.8/mosec-maven-plugin-1.0.8.jar b/mvn-repo/com/immomo/momosec/mosec-maven-plugin/1.0.8/mosec-maven-plugin-1.0.8.jar new file mode 100644 index 0000000..a80f7ec Binary files /dev/null and b/mvn-repo/com/immomo/momosec/mosec-maven-plugin/1.0.8/mosec-maven-plugin-1.0.8.jar differ diff --git a/mvn-repo/com/immomo/momosec/mosec-maven-plugin/1.0.8/mosec-maven-plugin-1.0.8.jar.md5 b/mvn-repo/com/immomo/momosec/mosec-maven-plugin/1.0.8/mosec-maven-plugin-1.0.8.jar.md5 new file mode 100644 index 0000000..1cc1cdf --- /dev/null +++ b/mvn-repo/com/immomo/momosec/mosec-maven-plugin/1.0.8/mosec-maven-plugin-1.0.8.jar.md5 @@ -0,0 +1 @@ +eaab7df555e60240e4fa10a6009c8397 \ No newline at end of file diff --git a/mvn-repo/com/immomo/momosec/mosec-maven-plugin/1.0.8/mosec-maven-plugin-1.0.8.jar.sha1 b/mvn-repo/com/immomo/momosec/mosec-maven-plugin/1.0.8/mosec-maven-plugin-1.0.8.jar.sha1 new file mode 100644 index 0000000..3c96921 --- /dev/null +++ b/mvn-repo/com/immomo/momosec/mosec-maven-plugin/1.0.8/mosec-maven-plugin-1.0.8.jar.sha1 @@ -0,0 +1 @@ +a498dbf4f6979fb752d846d6321b2967a0997bf7 \ No newline at end of file diff --git a/mvn-repo/com/immomo/momosec/mosec-maven-plugin/1.0.8/mosec-maven-plugin-1.0.8.pom b/mvn-repo/com/immomo/momosec/mosec-maven-plugin/1.0.8/mosec-maven-plugin-1.0.8.pom new file mode 100644 index 0000000..0b65fec --- /dev/null +++ b/mvn-repo/com/immomo/momosec/mosec-maven-plugin/1.0.8/mosec-maven-plugin-1.0.8.pom @@ -0,0 +1,124 @@ + + 4.0.0 + + + 3.1.0 + + + com.immomo.momosec + mosec-maven-plugin + 1.0.8 + maven-plugin + + Mosec Maven Plugin + 用于检测Maven项目的第三方依赖组件是否存在安全漏洞 + + + + retanoj + mmsrc@immomo.com + + + + + UTF-8 + 3.3.9 + + + + + org.apache.maven + maven-core + ${mavenVersion} + + + org.apache.maven.plugin-tools + maven-plugin-annotations + 3.2 + provided + + + com.google.code.gson + gson + 2.8.5 + + + org.apache.httpcomponents + httpclient + 4.5.13 + + + + + org.apache.maven.plugin-testing + maven-plugin-testing-harness + 3.3.0 + test + + + junit + junit + 4.13 + test + + + org.mockito + mockito-core + 2.28.2 + test + + + org.apache.maven + maven-compat + 3.3.9 + test + + + + + + + org.apache.maven.plugins + maven-plugin-plugin + 3.5 + + mosec + true + + + + mojo-descriptor + + descriptor + + + + help-goal + + helpmojo + + + + + + + org.apache.maven.plugins + maven-compiler-plugin + 3.6.2 + + 1.8 + 1.8 + -Xlint + + + + + + + + internal + file://mvn-repo + + + diff --git a/mvn-repo/com/immomo/momosec/mosec-maven-plugin/1.0.8/mosec-maven-plugin-1.0.8.pom.md5 b/mvn-repo/com/immomo/momosec/mosec-maven-plugin/1.0.8/mosec-maven-plugin-1.0.8.pom.md5 new file mode 100644 index 0000000..ff7e58f --- /dev/null +++ b/mvn-repo/com/immomo/momosec/mosec-maven-plugin/1.0.8/mosec-maven-plugin-1.0.8.pom.md5 @@ -0,0 +1 @@ +a6c1f8d0cffbb61f3287950aa4cf1844 \ No newline at end of file diff --git a/mvn-repo/com/immomo/momosec/mosec-maven-plugin/1.0.8/mosec-maven-plugin-1.0.8.pom.sha1 b/mvn-repo/com/immomo/momosec/mosec-maven-plugin/1.0.8/mosec-maven-plugin-1.0.8.pom.sha1 new file mode 100644 index 0000000..c8992c8 --- /dev/null +++ b/mvn-repo/com/immomo/momosec/mosec-maven-plugin/1.0.8/mosec-maven-plugin-1.0.8.pom.sha1 @@ -0,0 +1 @@ +085580bdcd35aec853378a0752979b5a94352b5e \ No newline at end of file diff --git a/mvn-repo/com/immomo/momosec/mosec-maven-plugin/maven-metadata.xml b/mvn-repo/com/immomo/momosec/mosec-maven-plugin/maven-metadata.xml index c8a4522..3796511 100644 --- a/mvn-repo/com/immomo/momosec/mosec-maven-plugin/maven-metadata.xml +++ b/mvn-repo/com/immomo/momosec/mosec-maven-plugin/maven-metadata.xml @@ -3,11 +3,12 @@ com.immomo.momosec mosec-maven-plugin - 1.0.7 - 1.0.7 + 1.0.8 + 1.0.8 1.0.7 + 1.0.8 - 20210603114400 + 20210621033628 diff --git a/mvn-repo/com/immomo/momosec/mosec-maven-plugin/maven-metadata.xml.md5 b/mvn-repo/com/immomo/momosec/mosec-maven-plugin/maven-metadata.xml.md5 index 9bd1952..c5a04fe 100644 --- a/mvn-repo/com/immomo/momosec/mosec-maven-plugin/maven-metadata.xml.md5 +++ b/mvn-repo/com/immomo/momosec/mosec-maven-plugin/maven-metadata.xml.md5 @@ -1 +1 @@ -9a19947fd891260a434b54caab6706ea \ No newline at end of file +95c17d487c921627a9b97445e2a00f47 \ No newline at end of file diff --git a/mvn-repo/com/immomo/momosec/mosec-maven-plugin/maven-metadata.xml.sha1 b/mvn-repo/com/immomo/momosec/mosec-maven-plugin/maven-metadata.xml.sha1 index 69f7d7d..70786be 100644 --- a/mvn-repo/com/immomo/momosec/mosec-maven-plugin/maven-metadata.xml.sha1 +++ b/mvn-repo/com/immomo/momosec/mosec-maven-plugin/maven-metadata.xml.sha1 @@ -1 +1 @@ -7229e831d912dcebec125e09a6fd9dee76fea894 \ No newline at end of file +4f2ce91855db9e696891caa64a322b381bef5894 \ No newline at end of file diff --git a/pom.xml b/pom.xml index d44e765..0b65fec 100644 --- a/pom.xml +++ b/pom.xml @@ -8,7 +8,7 @@ com.immomo.momosec mosec-maven-plugin - 1.0.7 + 1.0.8 maven-plugin Mosec Maven Plugin @@ -46,7 +46,7 @@ org.apache.httpcomponents httpclient - 4.5.10 + 4.5.13 diff --git a/src/main/java/com/immomo/momosec/maven/plugins/MosecTest.java b/src/main/java/com/immomo/momosec/maven/plugins/MosecTest.java index bbbf3f6..5daba2e 100644 --- a/src/main/java/com/immomo/momosec/maven/plugins/MosecTest.java +++ b/src/main/java/com/immomo/momosec/maven/plugins/MosecTest.java @@ -34,6 +34,8 @@ import org.eclipse.aether.RepositorySystemSession; import org.eclipse.aether.collection.DependencyCollectionException; import org.eclipse.aether.repository.RemoteRepository; +import java.io.BufferedReader; +import java.io.InputStreamReader; import java.util.ArrayList; import java.util.List; @@ -97,7 +99,7 @@ public class MosecTest extends AbstractMojo { private String outputDepToFile; /** - * 仅分析依赖，不上报 + * 仅分析依赖，不进行漏洞检查 */ @Parameter(property = "onlyAnalyze", defaultValue = "false") private Boolean onlyAnalyze; @@ -146,11 +148,11 @@ public class MosecTest extends AbstractMojo { projectTree.addProperty("severityLevel", severityLevel); String jsonDepTree = new GsonBuilder().setPrettyPrinting().create().toJson(projectTree); getLog().debug(jsonDepTree); - if (outputDepToFile != null && !"".equals(outputDepToFile)) { - writeToFile(outputDepToFile, jsonDepTree); - } if (Boolean.TRUE.equals(onlyAnalyze)) { + if (!"".equals(outputDepToFile) && outputDepToFile != null) { + writeToFile(outputDepToFile, jsonDepTree); + } getLog().info("onlyAnalyze mode, Done."); return; } @@ -168,8 +170,18 @@ public class MosecTest extends AbstractMojo { throw new NetworkErrorException(response.getStatusLine().getReasonPhrase()); } + JsonParser parser = new JsonParser(); + JsonObject responseJson; + try { + responseJson = parser.parse(new BufferedReader(new InputStreamReader(response.getEntity().getContent()))).getAsJsonObject(); + } catch (JsonParseException | IllegalStateException e) { + throw new NetworkErrorException(Constants.ERROR_ON_API); + } + if (!"".equals(outputDepToFile) && outputDepToFile != null) { + writeToFile(outputDepToFile, jsonDepTree, responseJson); + } Renderer renderer = new Renderer(getLog(), failOnVuln); - renderer.renderResponse(response.getEntity().getContent()); + renderer.renderResponse(responseJson); } catch (DependencyCollectionException e) { throw new MojoFailureException(e.getMessage()); diff --git a/src/main/java/com/immomo/momosec/maven/plugins/Renderer.java b/src/main/java/com/immomo/momosec/maven/plugins/Renderer.java index 39434a3..e9964eb 100644 --- a/src/main/java/com/immomo/momosec/maven/plugins/Renderer.java +++ b/src/main/java/com/immomo/momosec/maven/plugins/Renderer.java @@ -34,15 +34,7 @@ public class Renderer { this.failOnVuln = failOnVuln; } - public void renderResponse(InputStream in) throws NetworkErrorException, FoundVulnerableException { - JsonParser parser = new JsonParser(); - JsonObject responseJson; - try { - responseJson = parser.parse(new BufferedReader(new InputStreamReader(in))).getAsJsonObject(); - } catch (JsonParseException | IllegalStateException e) { - throw new NetworkErrorException(Constants.ERROR_ON_API); - } - + public void renderResponse(JsonObject responseJson) throws NetworkErrorException, FoundVulnerableException { if(responseJson.get("ok") != null && responseJson.get("ok").getAsBoolean()) { String ok = "✓ Tested %s dependencies, no vulnerable found."; getLog().info(logHelper.strongInfo(String.format(ok, responseJson.get("dependencyCount").getAsString()))); @@ -100,4 +92,22 @@ public class Renderer { outputStream.write(jsonTree.getBytes()); outputStream.close(); } + + public static void writeToFile(String filename, String jsonTree, JsonObject responseJson) throws IOException, NetworkErrorException { + File file = new File(filename); + JsonParser parser = new JsonParser(); + JsonObject result = parser.parse(jsonTree).getAsJsonObject(); + result.add("ok", responseJson.get("ok")); + result.add("dependencyCount", responseJson.get("dependencyCount")); + result.add("vulnerabilities", responseJson.get("vulnerabilities")); + if (!file.exists()) { + File dir = new File(file.getAbsoluteFile().getParent()); + dir.mkdirs(); + file.createNewFile(); + } + String jsonResult = new GsonBuilder().setPrettyPrinting().create().toJson(result); + FileOutputStream outputStream = new FileOutputStream(file); + outputStream.write(jsonResult.getBytes()); + outputStream.close(); + } } diff --git a/src/test/java/com/immomo/momosec/maven/plugins/TestRenderer.java b/src/test/java/com/immomo/momosec/maven/plugins/TestRenderer.java index 1d38984..b38805f 100644 --- a/src/test/java/com/immomo/momosec/maven/plugins/TestRenderer.java +++ b/src/test/java/com/immomo/momosec/maven/plugins/TestRenderer.java @@ -15,6 +15,7 @@ */ package com.immomo.momosec.maven.plugins; +import com.google.gson.JsonParser; import com.immomo.momosec.maven.plugins.exceptions.FoundVulnerableException; import com.immomo.momosec.maven.plugins.exceptions.NetworkErrorException; import org.apache.maven.monitor.logging.DefaultLog; @@ -45,7 +46,8 @@ public class TestRenderer { private final String no_vulnerable_response = "{" + " \"ok\": true," + - " \"dependencyCount\": 3" + + " \"dependencyCount\": 3," + + " \"vulnerabilities\": []" + "}"; private final String vulnerable_response = @@ -74,20 +76,11 @@ public class TestRenderer { System.setErr(originalErr); } - - @Test - public void renderResponseTest_ErrorJson() throws Exception { - exceptionRule.expect(NetworkErrorException.class); - exceptionRule.expectMessage(Constants.ERROR_ON_API); - - Renderer renderer = new Renderer(log, true); - renderer.renderResponse(new ByteArrayInputStream("_".getBytes())); - } - @Test public void renderResponseTest_NotFoundVuln() throws Exception { Renderer renderer = new Renderer(log, true); - renderer.renderResponse(new ByteArrayInputStream(no_vulnerable_response.getBytes())); + JsonParser parser = new JsonParser(); + renderer.renderResponse(parser.parse(no_vulnerable_response).getAsJsonObject()); String expect = "[INFO] " + logHelper.strongInfo("✓ Tested 3 dependencies, no vulnerable found.") + "\n"; Assert.assertEquals(expect, outContent.toString()); @@ -99,13 +92,15 @@ public class TestRenderer { exceptionRule.expectMessage(Constants.ERROR_ON_VULNERABLE); Renderer renderer = new Renderer(log, true); - renderer.renderResponse(new ByteArrayInputStream(vulnerable_response.getBytes())); + JsonParser parser = new JsonParser(); + renderer.renderResponse(parser.parse(vulnerable_response).getAsJsonObject()); } @Test public void renderResponseTest_FoundVulnWithoutFailOnVuln() throws Exception { Renderer renderer = new Renderer(log, false); - renderer.renderResponse(new ByteArrayInputStream(vulnerable_response.getBytes())); + JsonParser parser = new JsonParser(); + renderer.renderResponse(parser.parse(vulnerable_response).getAsJsonObject()); String expect = "[WARNING] " + logHelper.strongError("✗ High severity (Fake Vulnerable - CVE-0001-0001) found on com.study.foo:bar@1.0.0") + "\n" +