From 225a4c8faf7a2a67a1a8a360bc4efb70b36f6ae7 Mon Sep 17 00:00:00 2001
From: Stefan Miklosovic <smiklosovic@apache.org>
Date: Thu, 30 Sep 2021 21:30:36 +0200
Subject: [PATCH] add OWASP dependency check to Ant build

patch by Stefan Miklosovic; reviewed by Brandon Williams for CASSANDRA-14612
---
 .build/build-owasp.xml                   | 86 ++++++++++++++++++++++
 .build/dependency-check-suppressions.xml | 91 ++++++++++++++++++++++++
 build.xml                                |  1 +
 3 files changed, 178 insertions(+)
 create mode 100644 .build/build-owasp.xml
 create mode 100644 .build/dependency-check-suppressions.xml

diff --git a/.build/build-owasp.xml b/.build/build-owasp.xml
new file mode 100644
index 0000000000..e3f4c42498
--- /dev/null
+++ b/.build/build-owasp.xml
@@ -0,0 +1,86 @@
+<?xml version="1.0" encoding="UTF-8" standalone="no"?>
+<!--
+  ~ Licensed to the Apache Software Foundation (ASF) under one
+  ~ or more contributor license agreements.  See the NOTICE file
+  ~ distributed with this work for additional information
+  ~ regarding copyright ownership.  The ASF licenses this file
+  ~ to you under the Apache License, Version 2.0 (the
+  ~ "License"); you may not use this file except in compliance
+  ~ with the License.  You may obtain a copy of the License at
+  ~
+  ~     http://www.apache.org/licenses/LICENSE-2.0
+  ~
+  ~ Unless required by applicable law or agreed to in writing, software
+  ~ distributed under the License is distributed on an "AS IS" BASIS,
+  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  ~ See the License for the specific language governing permissions and
+  ~ limitations under the License.
+  -->
+<project basedir="." name="apache-cassandra-owasp-tasks">
+    <property name="dependency-check.home" value="${build.dir}/dependency-check-ant"/>
+    <property name="dependency-check.version" value="6.3.1"/>
+
+    <condition property="is.dependency.check.jar">
+        <available file="${dependency-check.home}/dependency-check-ant/dependency-check-ant.jar" type="file" />
+    </condition>
+
+    <target name="dependency-check-download"
+            depends="build"
+            description="Fetch OWASP Dependency checker"
+            unless="is.dependency.check.jar">
+
+        <echo>Downloading OWASP Dependency checks ...</echo>
+
+        <mkdir dir="${dependency-check.home}"/>
+
+        <get src="https://github.com/jeremylong/DependencyCheck/releases/download/v${dependency-check.version}/dependency-check-ant-${dependency-check.version}-release.zip"
+             dest="${dependency-check.home}/dependency-check-ant-${dependency-check.version}-release.zip" usetimestamp="true" />
+
+        <unzip src="${dependency-check.home}/dependency-check-ant-${dependency-check.version}-release.zip" dest="${dependency-check.home}"/>
+    </target>
+
+    <target name="dependency-check" description="Dependency-Check Analysis" depends="dependency-check-download,resolver-dist-lib">
+
+        <path id="dependency-check.path">
+            <fileset dir="${dependency-check.home}/dependency-check-ant/lib">
+                <include name="*.jar"/>
+            </fileset>
+        </path>
+
+        <taskdef resource="dependency-check-taskdefs.properties">
+            <classpath refid="dependency-check.path" />
+        </taskdef>
+
+        <!--
+            default value for cveValidForHours is 4 after which sync is done again
+
+            skipping using two specific caches at the end is solving (1)
+
+            failBuildOnCVSS is by default 11 so build would never fail,
+            the table categorising vulnerabilities is here (2), so by setting
+            "failBuildOnCVSS" to 1, we will fail the build on any CVE found
+            if it is not suppressed already dependency-check-suppressions.xml
+
+            If a vendor provides no details about a vulnerability,
+            NVD will score that vulnerability as 10.0 (the highest rating translating to critical).
+
+            (1) https://github.com/jeremylong/DependencyCheck/issues/2166
+            (2) https://nvd.nist.gov/vuln-metrics/cvss
+        -->
+        <dependency-check projectname="Apache Cassandra"
+                          reportoutputdirectory="${basedir}/build"
+                          reportformat="HTML"
+                          prettyPrint="true"
+                          cveValidForHours="1"
+                          centralAnalyzerUseCache="false"
+                          nodeAuditAnalyzerUseCache="false"
+                          failBuildOnCVSS="1"
+                          assemblyAnalyzerEnabled="false"
+                          dataDirectory="${dependency-check.home}/data"
+                          suppressionFile="${basedir}/.build/dependency-check-suppressions.xml">
+            <fileset dir="lib">
+                <include name="**/*.jar"/>
+            </fileset>
+        </dependency-check>
+    </target>
+</project>
diff --git a/.build/dependency-check-suppressions.xml b/.build/dependency-check-suppressions.xml
new file mode 100644
index 0000000000..b9776cfbf0
--- /dev/null
+++ b/.build/dependency-check-suppressions.xml
@@ -0,0 +1,91 @@
+<!--
+  ~ Licensed to the Apache Software Foundation (ASF) under one
+  ~ or more contributor license agreements.  See the NOTICE file
+  ~ distributed with this work for additional information
+  ~ regarding copyright ownership.  The ASF licenses this file
+  ~ to you under the Apache License, Version 2.0 (the
+  ~ "License"); you may not use this file except in compliance
+  ~ with the License.  You may obtain a copy of the License at
+  ~
+  ~     http://www.apache.org/licenses/LICENSE-2.0
+  ~
+  ~ Unless required by applicable law or agreed to in writing, software
+  ~ distributed under the License is distributed on an "AS IS" BASIS,
+  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  ~ See the License for the specific language governing permissions and
+  ~ limitations under the License.
+  -->
+<!--
+  copy suppressions / false positives here if there are any, how to do it is explained in
+  https://jeremylong.github.io/DependencyCheck/general/suppression.html
+-->
+<suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">
+    <suppress>
+        <!--  https://issues.apache.org/jira/browse/CASSANDRA-16150 -->
+        <packageUrl regex="true">^pkg:maven/org\.yaml/snakeyaml@.*$</packageUrl>
+        <cve>CVE-2017-18640</cve>
+    </suppress>
+
+    <!-- https://issues.apache.org/jira/browse/CASSANDRA-15417 -->
+    <suppress>
+        <packageUrl regex="true">^pkg:maven/io\.netty/netty\-all@.*$</packageUrl>
+        <cve>CVE-2019-16869</cve>
+        <cve>CVE-2019-20444</cve>
+        <cve>CVE-2019-20445</cve>
+        <cve>CVE-2021-21290</cve>
+        <cve>CVE-2021-21295</cve>
+        <cve>CVE-2021-21409</cve>
+    </suppress>
+
+    <!-- https://issues.apache.org/jira/browse/CASSANDRA-14183 -->
+    <suppress>
+        <packageUrl regex="true">^pkg:maven/ch\.qos\.logback/logback\-core@.*$</packageUrl>
+        <cve>CVE-2017-5929</cve>
+    </suppress>
+    <suppress>
+        <packageUrl regex="true">^pkg:maven/ch\.qos\.logback/logback\-classic@.*$</packageUrl>
+        <cve>CVE-2017-5929</cve>
+    </suppress>
+
+    <!-- this was fixed in 3.0.22 -->
+    <suppress>
+        <packageUrl regex="true">^pkg:maven/com\.datastax\.cassandra/cassandra\-driver\-core@.*$</packageUrl>
+        <cve>CVE-2020-13946</cve>
+        <cve>CVE-2020-17516</cve>
+    </suppress>
+
+    <!-- https://issues.apache.org/jira/browse/CASSANDRA-14760 -->
+    <suppress>
+        <packageUrl regex="true">^pkg:maven/com\.google\.guava/guava@.*$</packageUrl>
+        <cve>CVE-2018-10237</cve>
+        <cve>CVE-2020-8908</cve>
+    </suppress>
+
+    <!-- https://issues.apache.org/jira/browse/CASSANDRA-16606 -->
+    <suppress>
+        <packageUrl regex="true">^pkg:maven/org\.apache\.thrift/libthrift@.*$</packageUrl>
+        <cve>CVE-2015-3254</cve>
+        <cve>CVE-2016-5397</cve>
+        <cve>CVE-2018-1320</cve>
+        <cve>CVE-2018-11798</cve>
+        <cve>CVE-2019-0205</cve>
+    </suppress>
+
+    <!-- https://issues.apache.org/jira/browse/CASSANDRA-16056 -->
+    <!-- https://issues.apache.org/jira/browse/CASSANDRA-15416 -->
+    <suppress>
+        <packageUrl regex="true">^pkg:maven/org\.codehaus\.jackson/jackson\-mapper\-asl@.*$</packageUrl>
+        <cve>CVE-2017-7525</cve>
+        <cve>CVE-2017-15095</cve>
+        <cve>CVE-2017-17485</cve>
+        <cve>CVE-2018-5968</cve>
+        <cve>CVE-2018-14718</cve>
+        <cve>CVE-2018-1000873</cve>
+        <cve>CVE-2018-7489</cve>
+        <cve>CVE-2019-10172</cve>
+        <cve>CVE-2019-14540</cve>
+        <cve>CVE-2019-14893</cve>
+        <cve>CVE-2019-16335</cve>
+        <cve>CVE-2019-17267</cve>
+    </suppress>
+</suppressions>
diff --git a/build.xml b/build.xml
index c30d5963ca..d9ea7ca59a 100644
--- a/build.xml
+++ b/build.xml
@@ -1901,4 +1901,5 @@
 
   <import file="${basedir}/.build/build-resolver.xml"/>
   <import file="${basedir}/.build/build-rat.xml"/>
+  <import file="${basedir}/.build/build-owasp.xml"/>
 </project>