Skip to content

Commit 79fc42e

Browse files
sambsnydsambsnyd
committed
Rename dependency vulnerability recipe to better describe its function
1 parent b1b116b commit 79fc42e

1 file changed

Lines changed: 26 additions & 25 deletions

File tree

‎src/main/java/org/openrewrite/java/dependencies/DependencyVulnerabilityCheck.java‎

Lines changed: 26 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -77,17 +77,18 @@ public class DependencyVulnerabilityCheck extends ScanningRecipe<DependencyVulne
7777

7878
@Override
7979
public String getDisplayName() {
80-
return "Check for dependency vulnerabilities";
80+
return "Find and fix vulnerable dependencies";
8181
}
8282

8383
@Override
8484
public String getDescription() {
8585
//language=markdown
86-
return "This is a software composition analysis (SCA) tool which detects publicly disclosed vulnerabilities. " +
87-
"If vulnerabilities are found, it will generate a report linking to the associated CVE entries. " +
88-
"Vulnerability information comes from the [GitHub Security Advisory Database](https://docs.github.com/en/code-security/security-advisories/global-security-advisories/about-the-github-advisory-database), " +
89-
"which aggregates vulnerability data from several public databases, including the [National Vulnerability Database](https://nvd.nist.gov/) maintained by the United States government. " +
90-
"Dependencies following [Semantic Versioning](https://semver.org/) will see their _patch_ version updated where applicable.";
86+
return "This software composition analysis (SCA) tool detects and upgrades dependencies with publicly disclosed vulnerabilities. " +
87+
"This recipe both generates a report of vulnerable dependencies and upgrades to newer versions with fixes. " +
88+
"Automatic upgrade of vulnerable versions is performed when the fixed version is a minor or patch version bump. " +
89+
"Vulnerability information comes from the [GitHub Security Advisory Database](https://docs.github.com/en/code-security/security-advisories/global-security-advisories/about-the-github-advisory-database), " +
90+
"which aggregates vulnerability data from several public databases, including the [National Vulnerability Database](https://nvd.nist.gov/) maintained by the United States government. " +
91+
"Dependencies following [Semantic Versioning](https://semver.org/) will see their _patch_ version updated where applicable.";
9192
}
9293

9394
@Override
@@ -348,7 +349,7 @@ public Xml.Tag visitTag(Xml.Tag tag, ExecutionContext ctx) {
348349
GroupArtifact ga = new GroupArtifact(gav.getGroupId(), gav.getArtifactId());
349350
String fixVersion = fixes.get(ga);
350351
if (!StringUtils.isBlank(v.getFixedVersion()) &&
351-
new LatestPatch(null).isValid(gav.getVersion(), v.getFixedVersion())) {
352+
new LatestPatch(null).isValid(gav.getVersion(), v.getFixedVersion())) {
352353
if (fixVersion == null || new StaticVersionComparator().compare(versionParser.transform(v.getFixedVersion()), versionParser.transform(fixVersion)) > 0) {
353354
fixes.put(ga, v.getFixedVersion());
354355
}
@@ -357,14 +358,14 @@ public Xml.Tag visitTag(Xml.Tag tag, ExecutionContext ctx) {
357358

358359
if (vulnerable && Boolean.TRUE.equals(addMarkers)) {
359360
return SearchResult.found(tag, "This dependency includes " + gav + " which has the following vulnerabilities:\n" +
360-
vulnerabilitiesByGav.getValue().stream()
361-
.map(vDepth -> {
362-
Vulnerability v = vDepth.getVulnerability();
363-
return v.getCve() + " (" + v.getSeverity() + " severity" +
364-
(StringUtils.isBlank(v.getFixedVersion()) ? "" : ", fixed in " + v.getFixedVersion()) +
365-
") - " + v.getSummary();
366-
})
367-
.collect(Collectors.joining("\n")));
361+
vulnerabilitiesByGav.getValue().stream()
362+
.map(vDepth -> {
363+
Vulnerability v = vDepth.getVulnerability();
364+
return v.getCve() + " (" + v.getSeverity() + " severity" +
365+
(StringUtils.isBlank(v.getFixedVersion()) ? "" : ", fixed in " + v.getFixedVersion()) +
366+
") - " + v.getSummary();
367+
})
368+
.collect(Collectors.joining("\n")));
368369
}
369370
}
370371
}
@@ -390,14 +391,14 @@ public G.CompilationUnit visitCompilationUnit(G.CompilationUnit cu, ExecutionCon
390391
ResolvedGroupArtifactVersion gav = vulnerabilitiesByGav.getKey();
391392
if (Boolean.TRUE.equals(addMarkers)) {
392393
c = SearchResult.found(c, "This project has the following vulnerabilities:\n" +
393-
vulnerabilitiesByGav.getValue().stream()
394-
.map(vDepth -> {
395-
Vulnerability v = vDepth.getVulnerability();
396-
return "Dependency " + gav + " has " + v.getCve() + " (" + v.getSeverity() + " severity" +
397-
(StringUtils.isBlank(v.getFixedVersion()) ? "" : ", fixed in " + v.getFixedVersion()) +
398-
") - " + v.getSummary();
399-
})
400-
.collect(Collectors.joining("\n")));
394+
vulnerabilitiesByGav.getValue().stream()
395+
.map(vDepth -> {
396+
Vulnerability v = vDepth.getVulnerability();
397+
return "Dependency " + gav + " has " + v.getCve() + " (" + v.getSeverity() + " severity" +
398+
(StringUtils.isBlank(v.getFixedVersion()) ? "" : ", fixed in " + v.getFixedVersion()) +
399+
") - " + v.getSummary();
400+
})
401+
.collect(Collectors.joining("\n")));
401402
}
402403
for (GradleDependencyConfiguration configuration : gp.getConfigurations()) {
403404
if (scopeExcludesConfiguration(configuration, aScope) || !configuration.isCanBeResolved()) {
@@ -406,15 +407,15 @@ public G.CompilationUnit visitCompilationUnit(G.CompilationUnit cu, ExecutionCon
406407
List<ResolvedDependency> resolved = configuration.getResolved();
407408
for (ResolvedDependency resolvedDependency : resolved) {
408409
if (Objects.equals(resolvedDependency.getGroupId(), gav.getGroupId())
409-
&& Objects.equals(resolvedDependency.getArtifactId(), gav.getArtifactId())) {
410+
&& Objects.equals(resolvedDependency.getArtifactId(), gav.getArtifactId())) {
410411

411412
for (MinimumDepthVulnerability vDepth : vulnerabilitiesByGav.getValue()) {
412413
Vulnerability v = vDepth.getVulnerability();
413414

414415
GroupArtifact ga = new GroupArtifact(gav.getGroupId(), gav.getArtifactId());
415416
String fixVersion = fixes.get(ga);
416417
if (!StringUtils.isBlank(v.getFixedVersion()) &&
417-
new LatestPatch(null).isValid(gav.getVersion(), v.getFixedVersion())) {
418+
new LatestPatch(null).isValid(gav.getVersion(), v.getFixedVersion())) {
418419
if (fixVersion == null || new StaticVersionComparator().compare(versionParser.transform(v.getFixedVersion()), versionParser.transform(fixVersion)) > 0) {
419420
fixes.put(ga, v.getFixedVersion());
420421
}

0 commit comments

Comments
 (0)