Skip to content

Commit 3a2b898

Browse files
nvimanvima
authored
Merge pull request #20 from blagerweij/feature/support-disable-strict-tls
Support for disabling strict TLS checking
2 parents 7c1d6fd + d312910 commit 3a2b898

File tree

11 files changed

+68
-10
lines changed

11 files changed

+68
-10
lines changed

‎src/main/kotlin/com/liftric/dtcp/DepTrackCompanionPlugin.kt‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,7 @@ class DepTrackCompanionPlugin : Plugin<Project> {
3333
task.projectVersion.set(extension.projectVersion)
3434
task.parentUUID.set(extension.parentUUID)
3535
task.ignoreProjectAlreadyExists.set(extension.ignoreProjectAlreadyExists)
36+
task.disableStrictTLS.set(extension.disableStrictTLS)
3637
}
3738

3839
val generateSbom = project.tasks.register("generateSbom") { task ->
@@ -54,6 +55,7 @@ class DepTrackCompanionPlugin : Plugin<Project> {
5455
task.parentUUID.set(extension.parentUUID)
5556
task.parentName.set(extension.parentName)
5657
task.parentVersion.set(extension.parentVersion)
58+
task.disableStrictTLS.set(extension.disableStrictTLS)
5759
task.ignoreErrors.set(extension.ignoreErrors)
5860
task.dependsOn(generateSbom)
5961
}
@@ -78,6 +80,7 @@ class DepTrackCompanionPlugin : Plugin<Project> {
7880
task.projectUUID.set(extension.projectUUID)
7981
task.projectName.set(extension.projectName)
8082
task.projectVersion.set(extension.projectVersion)
83+
task.disableStrictTLS.set(extension.disableStrictTLS)
8184
task.mustRunAfter(generateVex)
8285
task.dependsOn(generateVex)
8386
}
@@ -90,6 +93,7 @@ class DepTrackCompanionPlugin : Plugin<Project> {
9093
task.projectUUID.set(extension.projectUUID)
9194
task.projectName.set(extension.projectName)
9295
task.projectVersion.set(extension.projectVersion)
96+
task.disableStrictTLS.set(extension.disableStrictTLS)
9397
}
9498

9599
val riskScore = project.tasks.register("riskScore", RiskScoreTask::class.java) { task ->
@@ -101,6 +105,7 @@ class DepTrackCompanionPlugin : Plugin<Project> {
101105
task.projectName.set(extension.projectName)
102106
task.projectVersion.set(extension.projectVersion)
103107
task.riskScore.set(extension.riskScoreData)
108+
task.disableStrictTLS.set(extension.disableStrictTLS)
104109
}
105110

106111
project.tasks.register("runDepTrackWorkflow") { task ->
@@ -118,6 +123,7 @@ class DepTrackCompanionPlugin : Plugin<Project> {
118123
task.projectUUID.set(extension.projectUUID)
119124
task.projectName.set(extension.projectName)
120125
task.projectVersion.set(extension.projectVersion)
126+
task.disableStrictTLS.set(extension.disableStrictTLS)
121127
}
122128

123129
project.tasks.register("getSuppressedVuln", GetSuppressedVulnTask::class.java) { task ->
@@ -128,6 +134,7 @@ class DepTrackCompanionPlugin : Plugin<Project> {
128134
task.projectUUID.set(extension.projectUUID)
129135
task.projectName.set(extension.projectName)
130136
task.projectVersion.set(extension.projectVersion)
137+
task.disableStrictTLS.set(extension.disableStrictTLS)
131138
}
132139
}
133140
}

‎src/main/kotlin/com/liftric/dtcp/extensions/DepTrackCompanionExtension.kt‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@ abstract class DepTrackCompanionExtension(val project: Project) {
2323
abstract val parentName: Property<String>
2424
abstract val parentVersion: Property<String>
2525
abstract val ignoreProjectAlreadyExists: Property<Boolean>
26+
abstract val disableStrictTLS: Property<Boolean>
2627
abstract val ignoreErrors: Property<Boolean>
2728

2829
abstract val riskScoreData: Property<RiskScoreBuilder>

‎src/main/kotlin/com/liftric/dtcp/service/ApiService.kt‎

Lines changed: 22 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,8 +12,24 @@ import io.ktor.http.*
1212
import kotlinx.serialization.KSerializer
1313
import kotlinx.serialization.json.Json
1414
import java.io.File
15+
import java.security.cert.X509Certificate
16+
import javax.net.ssl.X509TrustManager
1517

16-
class ApiService(apiKey: String) {
18+
class ApiService(apiKey: String, disableStrictTLS: Boolean = false) {
19+
20+
private val trustAllManager = if (disableStrictTLS) {
21+
object: X509TrustManager {
22+
@Suppress("kotlin:S4830")
23+
override fun checkClientTrusted(chain: Array<out X509Certificate>?, authType: String?) { /* NOOP */ }
24+
25+
@Suppress("kotlin:S4830")
26+
override fun checkServerTrusted(chain: Array<out X509Certificate>?, authType: String?) { /* NOOP */ }
27+
28+
override fun getAcceptedIssuers(): Array<X509Certificate>? = null
29+
}
30+
} else {
31+
null
32+
}
1733

1834
private val client = HttpClient(CIO) {
1935
expectSuccess = true
@@ -27,6 +43,11 @@ class ApiService(apiKey: String) {
2743
ignoreUnknownKeys = true
2844
})
2945
}
46+
engine {
47+
https {
48+
trustManager = trustAllManager
49+
}
50+
}
3051
}
3152

3253
suspend fun uploadFileWithFormData(

‎src/main/kotlin/com/liftric/dtcp/service/DependencyTrack.kt‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,9 +6,9 @@ import kotlinx.coroutines.delay
66
import kotlinx.coroutines.runBlocking
77
import java.io.File
88

9-
class DependencyTrack(apiKey: String, private val baseUrl: String) {
9+
class DependencyTrack(apiKey: String, private val baseUrl: String, private val disableStrictTLS: Boolean) {
1010

11-
private val client: ApiService = ApiService(apiKey)
11+
private val client: ApiService = ApiService(apiKey, disableStrictTLS)
1212

1313
fun getProject(projectName: String, projectVersion: String): Project = runBlocking {
1414
val url = "$baseUrl/api/v1/project/lookup?name=$projectName&version=$projectVersion"

‎src/main/kotlin/com/liftric/dtcp/tasks/AnalyzeProjectTask.kt‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,10 @@ abstract class AnalyzeProjectTask : DefaultTask() {
2727
@get:Optional
2828
abstract val projectVersion: Property<String>
2929

30+
@get:Input
31+
@get:Optional
32+
abstract val disableStrictTLS: Property<Boolean>
33+
3034
@TaskAction
3135
fun analyzeProjectTask() {
3236
val apiKeyValue = apiKey.get()
@@ -36,7 +40,7 @@ abstract class AnalyzeProjectTask : DefaultTask() {
3640
val projectNameValue = projectName.orNull
3741
val projectVersionValue = projectVersion.orNull
3842

39-
val dt = DependencyTrack(apiKeyValue, urlValue)
43+
val dt = DependencyTrack(apiKeyValue, urlValue, disableStrictTLS.getOrElse(false))
4044

4145
val uuid = when {
4246
projectUUIDValue != null -> projectUUIDValue

‎src/main/kotlin/com/liftric/dtcp/tasks/CreateProject.kt‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -40,9 +40,13 @@ abstract class CreateProject : DefaultTask() {
4040
@get:Optional
4141
abstract val ignoreProjectAlreadyExists: Property<Boolean>
4242

43+
@get:Input
44+
@get:Optional
45+
abstract val disableStrictTLS: Property<Boolean>
46+
4347
@TaskAction
4448
fun createProjectTask() {
45-
val dt = DependencyTrack(apiKey.get(), url.get())
49+
val dt = DependencyTrack(apiKey.get(), url.get(), disableStrictTLS.getOrElse(false))
4650

4751
val project = CreateProject(
4852
name = projectName.get(),

‎src/main/kotlin/com/liftric/dtcp/tasks/GetOutdatedDependenciesTask.kt‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,11 @@ abstract class GetOutdatedDependenciesTask : DefaultTask() {
3030
@get:Optional
3131
abstract val projectVersion: Property<String>
3232

33+
@get:Input
34+
@get:Optional
35+
abstract val disableStrictTLS: Property<Boolean>
36+
37+
3338
@TaskAction
3439
fun getOutdatedDependenciesTask() {
3540
val apiKeyValue = apiKey.get()
@@ -38,7 +43,7 @@ abstract class GetOutdatedDependenciesTask : DefaultTask() {
3843
val projectNameValue = projectName.orNull
3944
val projectVersionValue = projectVersion.orNull
4045

41-
val dt = DependencyTrack(apiKeyValue, urlValue)
46+
val dt = DependencyTrack(apiKeyValue, urlValue, disableStrictTLS.getOrElse(false))
4247

4348
val project = when {
4449
projectUUIDValue != null -> dt.getProject(projectUUIDValue)

‎src/main/kotlin/com/liftric/dtcp/tasks/GetSuppressedVulnTask.kt‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,10 @@ abstract class GetSuppressedVulnTask : DefaultTask() {
2828
@get:Optional
2929
abstract val projectVersion: Property<String>
3030

31+
@get:Input
32+
@get:Optional
33+
abstract val disableStrictTLS: Property<Boolean>
34+
3135
@TaskAction
3236
fun getSuppressedVulnTask() {
3337
val apiKeyValue = apiKey.get()
@@ -36,7 +40,7 @@ abstract class GetSuppressedVulnTask : DefaultTask() {
3640
val projectNameValue = projectName.orNull
3741
val projectVersionValue = projectVersion.orNull
3842

39-
val dt = DependencyTrack(apiKeyValue, urlValue)
43+
val dt = DependencyTrack(apiKeyValue, urlValue, disableStrictTLS.getOrElse(false))
4044

4145
val findings = when {
4246
projectUUIDValue != null -> dt.getProjectFindingsById(projectUUIDValue)

‎src/main/kotlin/com/liftric/dtcp/tasks/RiskScoreTask.kt‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,10 @@ abstract class RiskScoreTask : DefaultTask() {
3535
@get:Optional
3636
abstract val riskScore: Property<RiskScoreBuilder>
3737

38+
@get:Input
39+
@get:Optional
40+
abstract val disableStrictTLS: Property<Boolean>
41+
3842
@TaskAction
3943
fun riskScoreTask() {
4044
val apiKeyValue = apiKey.get()
@@ -52,7 +56,7 @@ abstract class RiskScoreTask : DefaultTask() {
5256
val maxRiskScore = riskScoreValue.maxRiskScore.orNull
5357
val timeout = riskScoreValue.timeout.orNull
5458

55-
val dt = DependencyTrack(apiKeyValue, urlValue)
59+
val dt = DependencyTrack(apiKeyValue, urlValue, disableStrictTLS.getOrElse(false))
5660

5761
val uuid = when {
5862
projectUUIDValue != null -> projectUUIDValue

‎src/main/kotlin/com/liftric/dtcp/tasks/UploadSBOMTask.kt‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,10 @@ abstract class UploadSBOMTask : DefaultTask() {
4949
@get:Optional
5050
abstract val parentVersion: Property<String>
5151

52+
@get:Input
53+
@get:Optional
54+
abstract val disableStrictTLS: Property<Boolean>
55+
5256
@get:Input
5357
@get:Optional
5458
abstract val ignoreErrors: Property<Boolean>
@@ -71,7 +75,7 @@ abstract class UploadSBOMTask : DefaultTask() {
7175
throw GradleException("Either projectUUID or projectName and projectVersion must be set")
7276
}
7377

74-
val dt = DependencyTrack(apiKeyValue, urlValue)
78+
val dt = DependencyTrack(apiKeyValue, urlValue, disableStrictTLS.getOrElse(false))
7579
try {
7680
val response = dt.uploadSbom(
7781
file = inputFileValue,

0 commit comments

Comments
 (0)