Skip to content

Commit b4b90cf

Browse files
DmitriyLewenDmitriyLewen
authored
feat(java): add support for line numbers for pom.xml files (aquasecurity#5991)
1 parent fb36c4e commit b4b90cf

File tree

5 files changed

+49
-9
lines changed

5 files changed

+49
-9
lines changed

‎docs/docs/coverage/language/java.md‎

Lines changed: 7 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -11,11 +11,11 @@ Each artifact supports the following scanners:
1111

1212
The following table provides an outline of the features Trivy offers.
1313

14-
| Artifact | Internet access | Dev dependencies | [Dependency graph][dependency-graph] |
15-
|------------------|:---------------------:|:----------------:|:------------------------------------:|
16-
| JAR/WAR/PAR/EAR | Trivy Java DB | Include | - |
17-
| pom.xml | Maven repository [^1] | Exclude | ✓ |
18-
| *gradle.lockfile | - | Exclude | - |
14+
| Artifact | Internet access | Dev dependencies | [Dependency graph][dependency-graph] | Position |
15+
|------------------|:---------------------:|:----------------:|:------------------------------------:|:--------:|
16+
| JAR/WAR/PAR/EAR | Trivy Java DB | Include | - | - |
17+
| pom.xml | Maven repository [^1] | Exclude | ✓ | ✓[^7] |
18+
| *gradle.lockfile | - | Exclude | - | - |
1919

2020
These may be enabled or disabled depending on the target.
2121
See [here](./index.md) for the detail.
@@ -46,7 +46,7 @@ If your machine doesn't have the necessary files - Trivy tries to find the infor
4646

4747
!!! Note
4848
Trivy only takes information about packages. We don't take a list of vulnerabilities for packages from the `maven repository`.
49-
Information about data sources for Java you can see [here](../../scanner/vulnerability.md#data-sources_1).
49+
Information about data sources for Java you can see [here](../../scanner/vulnerability.md#data-sources-1).
5050

5151
You can disable connecting to the maven repository with the `--offline-scan` flag.
5252
The `--offline-scan` flag does not affect the Trivy database.
@@ -67,5 +67,6 @@ It doesn't require the internet access.
6767
[^4]: e.g. when parent pom.xml file has `../pom.xml` path
6868
[^5]: When you use dependency path in `relativePath` field in pom.xml file
6969
[^6]: `/Users/<username>/.m2/repository` (for Linux and Mac) and `C:/Users/<username>/.m2/repository` (for Windows) by default
70+
[^7]: To avoid confusion, Trivy only finds locations for direct dependencies from the base pom.xml file.
7071

7172
[dependency-graph]: ../../configuration/reporting.md#show-origins-of-vulnerable-dependencies

‎go.mod‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@ require (
1414
github.com/alicebob/miniredis/v2 v2.31.0
1515
github.com/aquasecurity/bolt-fixtures v0.0.0-20200903104109-d34e7f983986
1616
github.com/aquasecurity/defsec v0.94.1
17-
github.com/aquasecurity/go-dep-parser v0.0.0-20231229070651-5f0903175562
17+
github.com/aquasecurity/go-dep-parser v0.0.0-20240124102329-7be7d210a3d4
1818
github.com/aquasecurity/go-gem-version v0.0.0-20201115065557-8eed6fe000ce
1919
github.com/aquasecurity/go-npm-version v0.0.0-20201110091526-0b796d180798
2020
github.com/aquasecurity/go-pep440-version v0.0.0-20210121094942-22b2f8951d46

‎go.sum‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -328,8 +328,8 @@ github.com/aquasecurity/bolt-fixtures v0.0.0-20200903104109-d34e7f983986 h1:2a30
328328
github.com/aquasecurity/bolt-fixtures v0.0.0-20200903104109-d34e7f983986/go.mod h1:NT+jyeCzXk6vXR5MTkdn4z64TgGfE5HMLC8qfj5unl8=
329329
github.com/aquasecurity/defsec v0.94.1 h1:lk44bfUltm0f0Dw4DbO3Ka9d/bf3N8cWclSdHXMyKF4=
330330
github.com/aquasecurity/defsec v0.94.1/go.mod h1:wiX9BX0SOG0ZWjVIPYGPl46fyO3Gu8lJnk4rmhFR7IA=
331-
github.com/aquasecurity/go-dep-parser v0.0.0-20231229070651-5f0903175562 h1:jdymGFJpArgx1ZZW7yqgCV8Tt+sEZ4jKxjQufPYRSXE=
332-
github.com/aquasecurity/go-dep-parser v0.0.0-20231229070651-5f0903175562/go.mod h1:B+gSaiuXV258CtyfBwFvG87+GE/FOh6W4N+LMuQxvVA=
331+
github.com/aquasecurity/go-dep-parser v0.0.0-20240124102329-7be7d210a3d4 h1:Ex+YahhZPTu0WF9IKngLr/oRWgW5TN9ed0n4Twsq2Hw=
332+
github.com/aquasecurity/go-dep-parser v0.0.0-20240124102329-7be7d210a3d4/go.mod h1:P0PmelcN1ABKJrDzRbPnn6hK7RvgI+xmjiV/9uPaNnY=
333333
github.com/aquasecurity/go-gem-version v0.0.0-20201115065557-8eed6fe000ce h1:QgBRgJvtEOBtUXilDb1MLi1p1MWoyFDXAu5DEUl5nwM=
334334
github.com/aquasecurity/go-gem-version v0.0.0-20201115065557-8eed6fe000ce/go.mod h1:HXgVzOPvXhVGLJs4ZKO817idqr/xhwsTcj17CLYY74s=
335335
github.com/aquasecurity/go-mock-aws v0.0.0-20240109054747-49e4b5da33cb h1:dNxUB2bSbiLGNYcXkbBKrrfuY96+dXhA9FahEFZ4THQ=

‎pkg/fanal/analyzer/language/java/pom/pom_test.go‎

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,11 +29,25 @@ func Test_pomAnalyzer_Analyze(t *testing.T) {
2929
Type: types.Pom,
3030
FilePath: "testdata/happy/pom.xml",
3131
Libraries: types.Packages{
32+
{
33+
ID: "com.example:example-api:2.0.0",
34+
Name: "com.example:example-api",
35+
Version: "2.0.0",
36+
Locations: []types.Location{
37+
{
38+
StartLine: 28,
39+
EndLine: 32,
40+
},
41+
},
42+
},
3243
{
3344
ID: "com.example:example:1.0.0",
3445
Name: "com.example:example",
3546
Version: "1.0.0",
3647
Licenses: []string{"Apache-2.0"},
48+
DependsOn: []string{
49+
"com.example:example-api:2.0.0",
50+
},
3751
},
3852
},
3953
},
@@ -50,11 +64,25 @@ func Test_pomAnalyzer_Analyze(t *testing.T) {
5064
Type: types.Pom,
5165
FilePath: "pom.xml",
5266
Libraries: types.Packages{
67+
{
68+
ID: "com.example:example-api:2.0.0",
69+
Name: "com.example:example-api",
70+
Version: "2.0.0",
71+
Locations: []types.Location{
72+
{
73+
StartLine: 28,
74+
EndLine: 32,
75+
},
76+
},
77+
},
5378
{
5479
ID: "com.example:example:1.0.0",
5580
Name: "com.example:example",
5681
Version: "1.0.0",
5782
Licenses: []string{"Apache-2.0"},
83+
DependsOn: []string{
84+
"com.example:example-api:2.0.0",
85+
},
5886
},
5987
},
6088
},
@@ -104,6 +132,9 @@ func Test_pomAnalyzer_Analyze(t *testing.T) {
104132
Dir: tt.inputDir,
105133
FilePath: tt.inputFile,
106134
Content: f,
135+
Options: analyzer.AnalysisOptions{
136+
Offline: true,
137+
},
107138
})
108139
if tt.wantErr != "" {
109140
require.NotNil(t, err)

‎pkg/fanal/analyzer/language/java/pom/testdata/happy/pom.xml‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -23,4 +23,12 @@
2323
<url>https://github.com/knqyf263</url>
2424
</developer>
2525
</developers>
26+
27+
<dependencies>
28+
<dependency>
29+
<groupId>com.example</groupId>
30+
<artifactId>example-api</artifactId>
31+
<version>2.0.0</version>
32+
</dependency>
33+
</dependencies>
2634
</project>

0 commit comments

Comments
 (0)