Skip to content

Commit 9d483fb

Browse files
timtebeektimtebeek
authored
Limit fixWithVersionUpdateOnly to depth zero dependencies (#22)
* Limit `fixWithVersionUpdateOnly` to depth zero dependencies Fixes #5 * Allow `overrideManagedVersion` to influence `fixWithVersionUpdateOnly`
1 parent 066ae9d commit 9d483fb

1 file changed

Lines changed: 27 additions & 26 deletions

File tree

‎src/main/java/org/openrewrite/java/dependencies/DependencyVulnerabilityCheck.java‎

Lines changed: 27 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -84,15 +84,15 @@ public String getDisplayName() {
8484
public String getDescription() {
8585
//language=markdown
8686
return "This software composition analysis (SCA) tool detects and upgrades dependencies with publicly disclosed vulnerabilities. " +
87-
"This recipe both generates a report of vulnerable dependencies and upgrades to newer versions with fixes. " +
88-
"Automatic upgrade of vulnerable versions is performed when the fixed version is a minor or patch version bump. " +
89-
"Vulnerability information comes from the [GitHub Security Advisory Database](https://docs.github.com/en/code-security/security-advisories/global-security-advisories/about-the-github-advisory-database), " +
90-
"which aggregates vulnerability data from several public databases, including the [National Vulnerability Database](https://nvd.nist.gov/) maintained by the United States government. " +
91-
"Dependencies following [Semantic Versioning](https://semver.org/) will see their _patch_ version updated where applicable.";
87+
"This recipe both generates a report of vulnerable dependencies and upgrades to newer versions with fixes. " +
88+
"Automatic upgrade of vulnerable versions is performed when the fixed version is a minor or patch version bump. " +
89+
"Vulnerability information comes from the [GitHub Security Advisory Database](https://docs.github.com/en/code-security/security-advisories/global-security-advisories/about-the-github-advisory-database), " +
90+
"which aggregates vulnerability data from several public databases, including the [National Vulnerability Database](https://nvd.nist.gov/) maintained by the United States government. " +
91+
"Dependencies following [Semantic Versioning](https://semver.org/) will see their _patch_ version updated where applicable.";
9292
}
9393

9494
@Override
95-
public Validated validate() {
95+
public Validated<Object> validate() {
9696
return super.validate().and(Validated.test("scope", "scope is a valid Maven scope", scope, s -> {
9797
try {
9898
Scope.fromName(s);
@@ -174,7 +174,8 @@ public Collection<SourceFile> generate(Accumulator acc, ExecutionContext ctx) {
174174
for (MinimumDepthVulnerability vDepth : vulnerabilitiesByGav.getValue()) {
175175
Vulnerability v = vDepth.getVulnerability();
176176
ResolvedGroupArtifactVersion gav = vulnerabilitiesByGav.getKey();
177-
boolean fixWithVersionUpdateOnly = new LatestPatch(null).isValid(gav.getVersion(), v.getFixedVersion());
177+
boolean fixWithVersionUpdateOnly = (vDepth.getMinDepth() == 0 || Boolean.TRUE.equals(overrideManagedVersion))
178+
&& new LatestPatch(null).isValid(gav.getVersion(), v.getFixedVersion());
178179
report.insertRow(ctx, new VulnerabilityReport.Row(
179180
v.getCve(),
180181
gav.getGroupId(),
@@ -351,7 +352,7 @@ public Xml.Tag visitTag(Xml.Tag tag, ExecutionContext ctx) {
351352
GroupArtifact ga = new GroupArtifact(gav.getGroupId(), gav.getArtifactId());
352353
String fixVersion = fixes.get(ga);
353354
if (!StringUtils.isBlank(v.getFixedVersion()) &&
354-
new LatestPatch(null).isValid(gav.getVersion(), v.getFixedVersion())) {
355+
new LatestPatch(null).isValid(gav.getVersion(), v.getFixedVersion())) {
355356
if (fixVersion == null || new StaticVersionComparator().compare(versionParser.transform(v.getFixedVersion()), versionParser.transform(fixVersion)) > 0) {
356357
fixes.put(ga, v.getFixedVersion());
357358
}
@@ -360,14 +361,14 @@ public Xml.Tag visitTag(Xml.Tag tag, ExecutionContext ctx) {
360361

361362
if (vulnerable && Boolean.TRUE.equals(addMarkers)) {
362363
return SearchResult.found(tag, "This dependency includes " + gav + " which has the following vulnerabilities:\n" +
363-
vulnerabilitiesByGav.getValue().stream()
364-
.map(vDepth -> {
365-
Vulnerability v = vDepth.getVulnerability();
366-
return v.getCve() + " (" + v.getSeverity() + " severity" +
367-
(StringUtils.isBlank(v.getFixedVersion()) ? "" : ", fixed in " + v.getFixedVersion()) +
368-
") - " + v.getSummary();
369-
})
370-
.collect(Collectors.joining("\n")));
364+
vulnerabilitiesByGav.getValue().stream()
365+
.map(vDepth -> {
366+
Vulnerability v = vDepth.getVulnerability();
367+
return v.getCve() + " (" + v.getSeverity() + " severity" +
368+
(StringUtils.isBlank(v.getFixedVersion()) ? "" : ", fixed in " + v.getFixedVersion()) +
369+
") - " + v.getSummary();
370+
})
371+
.collect(Collectors.joining("\n")));
371372
}
372373
}
373374
}
@@ -393,14 +394,14 @@ public G.CompilationUnit visitCompilationUnit(G.CompilationUnit cu, ExecutionCon
393394
ResolvedGroupArtifactVersion gav = vulnerabilitiesByGav.getKey();
394395
if (Boolean.TRUE.equals(addMarkers)) {
395396
c = SearchResult.found(c, "This project has the following vulnerabilities:\n" +
396-
vulnerabilitiesByGav.getValue().stream()
397-
.map(vDepth -> {
398-
Vulnerability v = vDepth.getVulnerability();
399-
return "Dependency " + gav + " has " + v.getCve() + " (" + v.getSeverity() + " severity" +
400-
(StringUtils.isBlank(v.getFixedVersion()) ? "" : ", fixed in " + v.getFixedVersion()) +
401-
") - " + v.getSummary();
402-
})
403-
.collect(Collectors.joining("\n")));
397+
vulnerabilitiesByGav.getValue().stream()
398+
.map(vDepth -> {
399+
Vulnerability v = vDepth.getVulnerability();
400+
return "Dependency " + gav + " has " + v.getCve() + " (" + v.getSeverity() + " severity" +
401+
(StringUtils.isBlank(v.getFixedVersion()) ? "" : ", fixed in " + v.getFixedVersion()) +
402+
") - " + v.getSummary();
403+
})
404+
.collect(Collectors.joining("\n")));
404405
}
405406
for (GradleDependencyConfiguration configuration : gp.getConfigurations()) {
406407
if (scopeExcludesConfiguration(configuration, aScope) || !configuration.isCanBeResolved()) {
@@ -409,15 +410,15 @@ public G.CompilationUnit visitCompilationUnit(G.CompilationUnit cu, ExecutionCon
409410
List<ResolvedDependency> resolved = configuration.getResolved();
410411
for (ResolvedDependency resolvedDependency : resolved) {
411412
if (Objects.equals(resolvedDependency.getGroupId(), gav.getGroupId())
412-
&& Objects.equals(resolvedDependency.getArtifactId(), gav.getArtifactId())) {
413+
&& Objects.equals(resolvedDependency.getArtifactId(), gav.getArtifactId())) {
413414

414415
for (MinimumDepthVulnerability vDepth : vulnerabilitiesByGav.getValue()) {
415416
Vulnerability v = vDepth.getVulnerability();
416417

417418
GroupArtifact ga = new GroupArtifact(gav.getGroupId(), gav.getArtifactId());
418419
String fixVersion = fixes.get(ga);
419420
if (!StringUtils.isBlank(v.getFixedVersion()) &&
420-
new LatestPatch(null).isValid(gav.getVersion(), v.getFixedVersion())) {
421+
new LatestPatch(null).isValid(gav.getVersion(), v.getFixedVersion())) {
421422
if (fixVersion == null || new StaticVersionComparator().compare(versionParser.transform(v.getFixedVersion()), versionParser.transform(fixVersion)) > 0) {
422423
fixes.put(ga, v.getFixedVersion());
423424
}

0 commit comments

Comments
 (0)