Updated gradle-dep-tree plugin and added support included builds #611
Conversation
# Conflicts: # commands/audit/auditbasicparams.go # commands/audit/auditparams.go # sca/bom/buildinfo/technologies/common.go # sca/bom/buildinfo/technologies/java/gradle.go # sca/bom/buildinfo/technologies/java/resources/gradle-dep-tree.jar
attiasas
added
new feature
github-actions
bot
removed
the
safe to test
attiasas
left a comment
attiasas
left a comment
There was a problem hiding this comment.
Nice work, check out my comments
- You should create the new flag in the flag maps and attach it to the related command (similar to other flags in the file)
- I released the new version of the plugin with your changes. make sure you update and run the script that the v
3.2.0will be used and theembedded pluginstest will pass - make sure all tests are passing
| Exclusions = "exclusions" | ||
| IncludeDirs = "include-dirs" | ||
| UseWrapper = "use-wrapper" | ||
| UseIncludedBuilds = "use-included-builds" |
There was a problem hiding this comment.
make sure to define the flag and assign it to the related command (similar to other flags in the file)
There was a problem hiding this comment.
should be added to commandFlags as well
| "-Dcom.jfrog.includeAllBuildFiles=true", | ||
| fmt.Sprintf("-Dcom.jfrog.includeIncludedBuilds=%t", gdt.useIncludedBuilds)} |
There was a problem hiding this comment.
There are no issue using both flags, right?
There was a problem hiding this comment.
You mean 'includeAllBuildFiles' and 'includeIncludedBuilds' ? They're not exactly related, 'includeAllBuildFiles' was already present before my change. It's used for for the gradle subprojects not for gradle included builds
| Unresolved bool `json:"unresolved,omitempty"` | ||
| Configurations *[]string `json:"configurations,omitempty"` |
There was a problem hiding this comment.
Is there a use for them here other than the logs? do we want to skip unresolved?
please make sure Xray can scan those dependencies by adding a test scan on a similar project and making sure Xray can handle those deps
There was a problem hiding this comment.
'Configurations' is used to determine the dependency scope (direct, transitive, etc.). It contains values like 'compileOnly', 'testImplementaion', etc. which are in the Gradle spec.
'Unresolved' is not being used yet, I just added it to the struct in case we will want to take it into account.
I want to stress that those values are outputted by the gradle plugin but we just didn't unmarshall them into the struct
attiasas
added
the
safe to test
github-actions
bot
removed
the
safe to test
attiasas
added
the
safe to test
github-actions
bot
removed
the
safe to test
attiasas
added
the
safe to test
github-actions
bot
removed
the
safe to test
attiasas
left a comment
attiasas
left a comment
There was a problem hiding this comment.
Nice Work!, check out my comments and:
- Do we want to add this option to
audit curationas well? - Make sure all tests are passing
| Exclusions = "exclusions" | ||
| IncludeDirs = "include-dirs" | ||
| UseWrapper = "use-wrapper" | ||
| UseIncludedBuilds = "use-included-builds" |
There was a problem hiding this comment.
should be added to commandFlags as well
| // NuGet params | ||
| SolutionFilePath string | ||
| SolutionFilePath string | ||
| UseIncludedBuilds bool |
There was a problem hiding this comment.
move to be below UseWrapper
| "github.com/stretchr/testify/assert" | ||
|
|
||
| "github.com/jfrog/jfrog-cli-core/v2/utils/tests" | ||
|
|
| golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= | ||
| rsc.io/quote v1.5.2/go.mod h1:LzX7hefJvL54yjefDEDHNONDjII0t9xZLPXsUe+TKr0= | ||
| rsc.io/sampler v1.3.0/go.mod h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA= |
| artifactory_user=admin | ||
| artifactory_password=password |
There was a problem hiding this comment.
do we need it here? remove if possiable, add ignore for security scan if needed
| artifactory_user=admin | ||
| artifactory_password=password |
There was a problem hiding this comment.
do we need it here? remove if possiable, add ignore for security scan if needed
| artifactory_user=admin | ||
| artifactory_password=password |
There was a problem hiding this comment.
do we need it here? remove if possiable, add ignore for security scan if needed
|
📗 Scan Summary
|
at 🎯 Static Application Security Testing (SAST) Vulnerability
Full descriptionVulnerability Details
OverviewStored Path Traversal is a type of vulnerability that arises when user-controlled Vulnerable examplefunc serveFile(w http.ResponseWriter, r *http.Request) {
row := db.QueryRow("SELECT file_path FROM files WHERE id = 12")
row.Scan(&filePath)
http.ServeFile(w, r, filePath)
}In this example, the RemediationTo mitigate stored path traversal vulnerabilities, it is essential to validate func serveFile(w http.ResponseWriter, r *http.Request) {
row := db.QueryRow("SELECT file_path FROM files WHERE id = ?", r.URL.Query().Get("id"))
row.Scan(&filePath)
+ // Validate file path to prevent directory traversal
+ if strings.Contains(filePath, "..") {
+ http.Error(w, "Invalid file path", http.StatusBadRequest)
+ return
+ }
http.ServeFile(w, r, filePath)
}Code FlowsVulnerable data flow analysis result
}` (at sca/bom/buildinfo/technologies/java/mvn.go line 93)
Vulnerable data flow analysis result
}` (at sca/bom/buildinfo/technologies/java/gradle.go line 152)
|
at 🎯 Static Application Security Testing (SAST) Vulnerability
Full descriptionVulnerability Details
OverviewHardcoded credentials are usernames, passwords, API keys, or other secrets Vulnerable exampleIn this example, the database username and password for the frog pond are package main
import (
"database/sql"
"fmt"
"log"
_ "[github.com/go-sql-driver/mysql](https://github.com/go-sql-driver/mysql)"
)
func main() {
// VULNERABLE: Hardcoded database credentials for the frog pond.
frogUser := "pond_admin"
frogPassword := "LeapFlog123!"
pondName := "lilypad_db"
connStr := fmt.Sprintf("%s:%s@tcp(127.0.0.1:3306)/%s",
frogUser, frogPassword, pondName)
lilypadDB, err := sql.Open("mysql", connStr)
if err != nil {
log.Fatalf("Error opening database: %v", err)
}
defer lilypadDB.Close()
err = lilypadDB.Ping()
if err != nil {
log.Fatalf("Error pinging database: %v", err)
}
fmt.Println("Successfully connected to the frog pond.")
}RemediationThe remediated code retrieves the database credentials from environment package main
import (
"database/sql"
"fmt"
"log"
"os"
_ "[github.com/go-sql-driver/mysql](https://github.com/go-sql-driver/mysql)"
)
func main() {
// SECURE: Retrieve credentials from environment variables.
frogUser := os.Getenv("FROG_DB_USER")
frogPassword := os.Getenv("FROG_DB_PASS")
pondName := os.Getenv("FROG_DB_NAME")
if frogUser == "" || frogPassword == "" || pondName == "" {
log.Fatal("DB credentials are not set in environment variables.")
}
connStr := fmt.Sprintf("%s:%s@tcp(127.0.0.1:3306)/%s",
frogUser, frogPassword, pondName)
lilypadDB, err := sql.Open("mysql", connStr)
if err != nil {
log.Fatalf("Error opening database: %v", err)
}
defer lilypadDB.Close()
err = lilypadDB.Ping()
if err != nil {
log.Fatalf("Error pinging database: %v", err)
}
fmt.Println("Successfully connected to the frog pond.")
}Code FlowsVulnerable data flow analysis result
|
2 participants
devbranch.go vet ./....go fmt ./....Depends on: