Repository: tomee Updated Branches: refs/heads/tomee-7.0.x 804c639dd -> cfa04251c
TOMEE-2363 Introduces OWASP dependency check via two profiles "owasp-check" (will fail the build for CVE score > 8.0" and "owasp-report" Project: http://git-wip-us.apache.org/repos/asf/tomee/repo Commit: http://git-wip-us.apache.org/repos/asf/tomee/commit/cfa04251 Tree: http://git-wip-us.apache.org/repos/asf/tomee/tree/cfa04251 Diff: http://git-wip-us.apache.org/repos/asf/tomee/diff/cfa04251 Branch: refs/heads/tomee-7.0.x Commit: cfa04251c2981030c4c74405dd6713bbb042601f Parents: 804c639 Author: rzo1 <[email protected]> Authored: Tue Dec 18 11:20:23 2018 +0100 Committer: rzo1 <[email protected]> Committed: Thu Dec 20 15:57:20 2018 +0100 ---------------------------------------------------------------------- owasp-dc-suppression.xml | 80 +++++++++++++++++++++++++++++++++++++++++++ pom.xml | 59 ++++++++++++++++++++++++++++--- 2 files changed, 135 insertions(+), 4 deletions(-) ---------------------------------------------------------------------- http://git-wip-us.apache.org/repos/asf/tomee/blob/cfa04251/owasp-dc-suppression.xml ---------------------------------------------------------------------- diff --git a/owasp-dc-suppression.xml b/owasp-dc-suppression.xml new file mode 100644 index 0000000..04b5050 --- /dev/null +++ b/owasp-dc-suppression.xml @@ -0,0 +1,80 @@ +<?xml version="1.0" encoding="UTF-8"?> +<suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.2.xsd";> + <suppress> + <notes><![CDATA[ + file name: self dependencies... + ]]></notes> + <gav regex="true">^org\.apache\.tomee:.*$</gav> + <cve>CVE-2018-8031</cve> + </suppress> + <suppress> + <notes><![CDATA[ + file name: self dependencies... + ]]></notes> + <gav regex="true">^org\.apache\.tomee:.*$</gav> + <cve>CVE-2010-1151</cve> + </suppress> + <suppress> + <notes><![CDATA[ + file name: false positive apache http server + ]]></notes> + <gav regex="true">^org\.apache\.tomee:.*$</gav> + <cpe>cpe:/a:apache:apache_http_server</cpe> + </suppress> + <suppress> + <notes><![CDATA[ + file name: false positive apache http server + ]]></notes> + <gav regex="true">^org\.apache\.tomee:.*$</gav> + <cpe>cpe:/a:apache:http_server</cpe> + </suppress> + <suppress> + <notes><![CDATA[ + file name: ziplock-*.jar + ]]></notes> + <gav regex="true">^org\.apache\.tomee:ziplock:.*$</gav> + <cpe>cpe:/a:zip_project:zip</cpe> + </suppress> + <suppress> + <notes><![CDATA[ + file name: eclipselink-*jar + ]]></notes> + <gav regex="true">^org\.eclipse\.persistence:eclipselink:.*$</gav> + <cpe>cpe:/a:git:git</cpe> + </suppress> + <suppress> + <notes><![CDATA[ + file name: eclipselink-*.jar + ]]></notes> + <gav regex="true">^org\.eclipse\.persistence:eclipselink:.*$</gav> + <cpe>cpe:/a:git_project:git</cpe> + </suppress> + <suppress> + <notes><![CDATA[ + file name: javax.persistence-*.jar + ]]></notes> + <gav regex="true">^org\.eclipse\.persistence:javax\.persistence:.*$</gav> + <cpe>cpe:/a:git_project:git</cpe> + </suppress> + <suppress> + <notes><![CDATA[ + file name: javax.persistence-*.jar + ]]></notes> + <gav regex="true">^org\.eclipse\.persistence:javax\.persistence:.*$</gav> + <cpe>cpe:/a:git:git</cpe> + </suppress> + <suppress> + <notes><![CDATA[ + file name: commonj.sdo-*.jar + ]]></notes> + <gav regex="true">^org\.eclipse\.persistence:commonj\.sdo:.*$</gav> + <cpe>cpe:/a:git:git</cpe> + </suppress> + <suppress> + <notes><![CDATA[ + file name: commonj.sdo-*.jar + ]]></notes> + <gav regex="true">^org\.eclipse\.persistence:commonj\.sdo:.*$</gav> + <cpe>cpe:/a:git_project:git</cpe> + </suppress> +</suppressions> \ No newline at end of file http://git-wip-us.apache.org/repos/asf/tomee/blob/cfa04251/pom.xml ---------------------------------------------------------------------- diff --git a/pom.xml b/pom.xml index 8471867..ac2e824 100644 --- a/pom.xml +++ b/pom.xml @@ -125,7 +125,7 @@ <openejb.osgi.dynamic.import>${openejb.osgi.dynamic.import.pkg}</openejb.osgi.dynamic.import> <openejb.osgi.symbolic.name>${project.groupId}.${project.artifactId}</openejb.osgi.symbolic.name> - <batchee.version>0.4-incubating</batchee.version> + <batchee.version>0.4-incubating</batchee.version> <version.arquillian>1.1.13.Final</version.arquillian> <version.shrinkwrap.descriptor>2.0.0</version.shrinkwrap.descriptor> @@ -344,6 +344,11 @@ <artifactId>maven-compiler-plugin</artifactId> <version>3.6.2</version> </plugin> + <plugin> + <groupId>org.owasp</groupId> + <artifactId>dependency-check-maven</artifactId> + <version>4.0.0</version> + </plugin> </plugins> </pluginManagement> @@ -627,6 +632,53 @@ </profile> <profile> + <id>owasp-report</id> + <build> + <plugins> + <plugin> + <groupId>org.owasp</groupId> + <artifactId>dependency-check-maven</artifactId> + <configuration> + <skipProvidedScope>true</skipProvidedScope> + <skipRuntimeScope>true</skipRuntimeScope> + <suppressionFiles>${maven.multiModuleProjectDirectory}/owasp-dc-suppression.xml</suppressionFiles> + </configuration> + <executions> + <execution> + <goals> + <goal>aggregate</goal> + </goals> + </execution> + </executions> + </plugin> + </plugins> + </build> + </profile> + <profile> + <id>owasp-check</id> + <build> + <plugins> + <plugin> + <groupId>org.owasp</groupId> + <artifactId>dependency-check-maven</artifactId> + <configuration> + <skipProvidedScope>true</skipProvidedScope> + <skipRuntimeScope>true</skipRuntimeScope> + <failBuildOnCVSS>8.0</failBuildOnCVSS> + <suppressionFiles>${maven.multiModuleProjectDirectory}/owasp-dc-suppression.xml</suppressionFiles> + </configuration> + <executions> + <execution> + <goals> + <goal>check</goal> + </goals> + </execution> + </executions> + </plugin> + </plugins> + </build> + </profile> + <profile> <id>rat</id> <modules> <module>itests</module> @@ -657,7 +709,7 @@ <reportFile>${project.build.directory}/${project.build.finalName}.rat</reportFile> <excludes> <exclude>**/target/**/*</exclude> - <exclude>**/js/livereload.js</exclude> + <exclude>**/js/livereload.js</exclude> <!-- left around after creating the site --> <exclude>**/cobertura.ser</exclude> @@ -1739,5 +1791,4 @@ --> </plugins> </reporting> -</project> - +</project> \ No newline at end of file
