mirror of https://github.com/apache/cassandra
add OWASP dependency check to Ant build
patch by Stefan Miklosovic; reviewed by Brandon Williams for CASSANDRA-14612
This commit is contained in:
Stefan Miklosovic
parent
3e6faca572
commit
225a4c8faf
|
|
@ -0,0 +1,86 @@
|
|||
<?xml version="1.0" encoding="UTF-8" standalone="no"?>
|
||||
<!--
|
||||
~ Licensed to the Apache Software Foundation (ASF) under one
|
||||
~ or more contributor license agreements. See the NOTICE file
|
||||
~ distributed with this work for additional information
|
||||
~ regarding copyright ownership. The ASF licenses this file
|
||||
~ to you under the Apache License, Version 2.0 (the
|
||||
~ "License"); you may not use this file except in compliance
|
||||
~ with the License. You may obtain a copy of the License at
|
||||
~
|
||||
~ http://www.apache.org/licenses/LICENSE-2.0
|
||||
~
|
||||
~ Unless required by applicable law or agreed to in writing, software
|
||||
~ distributed under the License is distributed on an "AS IS" BASIS,
|
||||
~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
~ See the License for the specific language governing permissions and
|
||||
~ limitations under the License.
|
||||
-->
|
||||
<project basedir="." name="apache-cassandra-owasp-tasks">
|
||||
<property name="dependency-check.home" value="${build.dir}/dependency-check-ant"/>
|
||||
<property name="dependency-check.version" value="6.3.1"/>
|
||||
|
||||
<condition property="is.dependency.check.jar">
|
||||
<available file="${dependency-check.home}/dependency-check-ant/dependency-check-ant.jar" type="file" />
|
||||
</condition>
|
||||
|
||||
<target name="dependency-check-download"
|
||||
depends="build"
|
||||
description="Fetch OWASP Dependency checker"
|
||||
unless="is.dependency.check.jar">
|
||||
|
||||
<echo>Downloading OWASP Dependency checks ...</echo>
|
||||
|
||||
<mkdir dir="${dependency-check.home}"/>
|
||||
|
||||
<get src="https://github.com/jeremylong/DependencyCheck/releases/download/v${dependency-check.version}/dependency-check-ant-${dependency-check.version}-release.zip"
|
||||
dest="${dependency-check.home}/dependency-check-ant-${dependency-check.version}-release.zip" usetimestamp="true" />
|
||||
|
||||
<unzip src="${dependency-check.home}/dependency-check-ant-${dependency-check.version}-release.zip" dest="${dependency-check.home}"/>
|
||||
</target>
|
||||
|
||||
<target name="dependency-check" description="Dependency-Check Analysis" depends="dependency-check-download,resolver-dist-lib">
|
||||
|
||||
<path id="dependency-check.path">
|
||||
<fileset dir="${dependency-check.home}/dependency-check-ant/lib">
|
||||
<include name="*.jar"/>
|
||||
</fileset>
|
||||
</path>
|
||||
|
||||
<taskdef resource="dependency-check-taskdefs.properties">
|
||||
<classpath refid="dependency-check.path" />
|
||||
</taskdef>
|
||||
|
||||
<!--
|
||||
default value for cveValidForHours is 4 after which sync is done again
|
||||
|
||||
skipping using two specific caches at the end is solving (1)
|
||||
|
||||
failBuildOnCVSS is by default 11 so build would never fail,
|
||||
the table categorising vulnerabilities is here (2), so by setting
|
||||
"failBuildOnCVSS" to 1, we will fail the build on any CVE found
|
||||
if it is not suppressed already dependency-check-suppressions.xml
|
||||
|
||||
If a vendor provides no details about a vulnerability,
|
||||
NVD will score that vulnerability as 10.0 (the highest rating translating to critical).
|
||||
|
||||
(1) https://github.com/jeremylong/DependencyCheck/issues/2166
|
||||
(2) https://nvd.nist.gov/vuln-metrics/cvss
|
||||
-->
|
||||
<dependency-check projectname="Apache Cassandra"
|
||||
reportoutputdirectory="${basedir}/build"
|
||||
reportformat="HTML"
|
||||
prettyPrint="true"
|
||||
cveValidForHours="1"
|
||||
centralAnalyzerUseCache="false"
|
||||
nodeAuditAnalyzerUseCache="false"
|
||||
failBuildOnCVSS="1"
|
||||
assemblyAnalyzerEnabled="false"
|
||||
dataDirectory="${dependency-check.home}/data"
|
||||
suppressionFile="${basedir}/.build/dependency-check-suppressions.xml">
|
||||
<fileset dir="lib">
|
||||
<include name="**/*.jar"/>
|
||||
</fileset>
|
||||
</dependency-check>
|
||||
</target>
|
||||
</project>
|
||||
|
|
@ -0,0 +1,91 @@
|
|||
<!--
|
||||
~ Licensed to the Apache Software Foundation (ASF) under one
|
||||
~ or more contributor license agreements. See the NOTICE file
|
||||
~ distributed with this work for additional information
|
||||
~ regarding copyright ownership. The ASF licenses this file
|
||||
~ to you under the Apache License, Version 2.0 (the
|
||||
~ "License"); you may not use this file except in compliance
|
||||
~ with the License. You may obtain a copy of the License at
|
||||
~
|
||||
~ http://www.apache.org/licenses/LICENSE-2.0
|
||||
~
|
||||
~ Unless required by applicable law or agreed to in writing, software
|
||||
~ distributed under the License is distributed on an "AS IS" BASIS,
|
||||
~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
~ See the License for the specific language governing permissions and
|
||||
~ limitations under the License.
|
||||
-->
|
||||
<!--
|
||||
copy suppressions / false positives here if there are any, how to do it is explained in
|
||||
https://jeremylong.github.io/DependencyCheck/general/suppression.html
|
||||
-->
|
||||
<suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">
|
||||
<suppress>
|
||||
<!-- https://issues.apache.org/jira/browse/CASSANDRA-16150 -->
|
||||
<packageUrl regex="true">^pkg:maven/org\.yaml/snakeyaml@.*$</packageUrl>
|
||||
<cve>CVE-2017-18640</cve>
|
||||
</suppress>
|
||||
|
||||
<!-- https://issues.apache.org/jira/browse/CASSANDRA-15417 -->
|
||||
<suppress>
|
||||
<packageUrl regex="true">^pkg:maven/io\.netty/netty\-all@.*$</packageUrl>
|
||||
<cve>CVE-2019-16869</cve>
|
||||
<cve>CVE-2019-20444</cve>
|
||||
<cve>CVE-2019-20445</cve>
|
||||
<cve>CVE-2021-21290</cve>
|
||||
<cve>CVE-2021-21295</cve>
|
||||
<cve>CVE-2021-21409</cve>
|
||||
</suppress>
|
||||
|
||||
<!-- https://issues.apache.org/jira/browse/CASSANDRA-14183 -->
|
||||
<suppress>
|
||||
<packageUrl regex="true">^pkg:maven/ch\.qos\.logback/logback\-core@.*$</packageUrl>
|
||||
<cve>CVE-2017-5929</cve>
|
||||
</suppress>
|
||||
<suppress>
|
||||
<packageUrl regex="true">^pkg:maven/ch\.qos\.logback/logback\-classic@.*$</packageUrl>
|
||||
<cve>CVE-2017-5929</cve>
|
||||
</suppress>
|
||||
|
||||
<!-- this was fixed in 3.0.22 -->
|
||||
<suppress>
|
||||
<packageUrl regex="true">^pkg:maven/com\.datastax\.cassandra/cassandra\-driver\-core@.*$</packageUrl>
|
||||
<cve>CVE-2020-13946</cve>
|
||||
<cve>CVE-2020-17516</cve>
|
||||
</suppress>
|
||||
|
||||
<!-- https://issues.apache.org/jira/browse/CASSANDRA-14760 -->
|
||||
<suppress>
|
||||
<packageUrl regex="true">^pkg:maven/com\.google\.guava/guava@.*$</packageUrl>
|
||||
<cve>CVE-2018-10237</cve>
|
||||
<cve>CVE-2020-8908</cve>
|
||||
</suppress>
|
||||
|
||||
<!-- https://issues.apache.org/jira/browse/CASSANDRA-16606 -->
|
||||
<suppress>
|
||||
<packageUrl regex="true">^pkg:maven/org\.apache\.thrift/libthrift@.*$</packageUrl>
|
||||
<cve>CVE-2015-3254</cve>
|
||||
<cve>CVE-2016-5397</cve>
|
||||
<cve>CVE-2018-1320</cve>
|
||||
<cve>CVE-2018-11798</cve>
|
||||
<cve>CVE-2019-0205</cve>
|
||||
</suppress>
|
||||
|
||||
<!-- https://issues.apache.org/jira/browse/CASSANDRA-16056 -->
|
||||
<!-- https://issues.apache.org/jira/browse/CASSANDRA-15416 -->
|
||||
<suppress>
|
||||
<packageUrl regex="true">^pkg:maven/org\.codehaus\.jackson/jackson\-mapper\-asl@.*$</packageUrl>
|
||||
<cve>CVE-2017-7525</cve>
|
||||
<cve>CVE-2017-15095</cve>
|
||||
<cve>CVE-2017-17485</cve>
|
||||
<cve>CVE-2018-5968</cve>
|
||||
<cve>CVE-2018-14718</cve>
|
||||
<cve>CVE-2018-1000873</cve>
|
||||
<cve>CVE-2018-7489</cve>
|
||||
<cve>CVE-2019-10172</cve>
|
||||
<cve>CVE-2019-14540</cve>
|
||||
<cve>CVE-2019-14893</cve>
|
||||
<cve>CVE-2019-16335</cve>
|
||||
<cve>CVE-2019-17267</cve>
|
||||
</suppress>
|
||||
</suppressions>
|
||||
Loading…
Reference in New Issue