From 4c3b96e4cd8c80d31887c333b110e052f6a600aa Mon Sep 17 00:00:00 2001
From: Jacek Lewandowski <lewandowski.jacek@gmail.com>
Date: Thu, 7 Dec 2023 12:07:24 +0100
Subject: [PATCH] Updated the OWASP plugin to 9.0.5 and refactored dependency
 checks

Configured OWASP database to use caching and NVD key. Properties can be
configured in ~/.ant/build.properties and define both the key and
the storage location

Patch by Jacek Lewandowski; reviewed by Maxim Muzafarov, Stefan Miklosovic for CASSANDRA-19146
---
 .build/build-owasp.xml                   | 89 +++++++++++++++---------
 .build/dependency-check-suppressions.xml | 26 +------
 build.xml                                |  1 +
 3 files changed, 59 insertions(+), 57 deletions(-)

diff --git a/.build/build-owasp.xml b/.build/build-owasp.xml
index a792730fb9..e14f310b15 100644
--- a/.build/build-owasp.xml
+++ b/.build/build-owasp.xml
@@ -16,30 +16,51 @@
   ~ See the License for the specific language governing permissions and
   ~ limitations under the License.
   -->
-<project basedir="." name="apache-cassandra-owasp-tasks">
-    <property name="dependency-check.version" value="8.3.1"/>
-    <property name="dependency-check.home" value="${build.dir}/dependency-check-ant-${dependency-check.version}"/>
+<project basedir="." name="apache-cassandra-owasp-tasks"
+         xmlns:unless="ant:unless">
+    <property name="dependency-check.version" value="9.0.5"/>
+    <property name="dependency-check.home" value="${tmp.dir}/dependency-check-ant-${dependency-check.version}"/>
+    <property name="dependency-check.archive.dir"
+              value="${local.repository}/org/owasp/dependency-check-ant/${dependency-check.version}"/>
+    <property name="dependency-check.archive.name"
+              value="dependency-check-ant-${dependency-check.version}-release.zip"/>
+    <property name="dependency-check.report.dir" value="${build.dir}/owasp"/>
 
-    <condition property="is.dependency.check.jar">
-        <available file="${dependency-check.home}/dependency-check-ant/dependency-check-ant.jar" type="file" />
+    <condition property="dependency-check-ant.archive.present">
+        <available file="${dependency-check.archive.dir}/${dependency-check.archive.name}" type="file"/>
     </condition>
 
-    <target name="dependency-check-download"
-            depends="build"
+    <target name="-dependency-check-download"
             description="Fetch OWASP Dependency checker"
-            unless="is.dependency.check.jar">
+            unless="dependency-check-ant.archive.present">
 
-        <echo>Downloading OWASP Dependency checks ...</echo>
-
-        <mkdir dir="${dependency-check.home}"/>
-
-        <get src="https://github.com/jeremylong/DependencyCheck/releases/download/v${dependency-check.version}/dependency-check-ant-${dependency-check.version}-release.zip"
-             dest="${dependency-check.home}/dependency-check-ant-${dependency-check.version}-release.zip"/>
-
-        <unzip src="${dependency-check.home}/dependency-check-ant-${dependency-check.version}-release.zip" dest="${dependency-check.home}"/>
+        <mkdir dir="${dependency-check.archive.dir}"/>
+        <get src="https://github.com/jeremylong/DependencyCheck/releases/download/v${dependency-check.version}/${dependency-check.archive.name}"
+             dest="${dependency-check.archive.dir}/${dependency-check.archive.name}" retries="3"/>
     </target>
 
-    <target name="dependency-check" description="Dependency-Check Analysis" depends="dependency-check-download,resolver-dist-lib">
+    <target name="-dependency-check-init" depends="-dependency-check-download">
+        <delete dir="${dependency-check.home}" includeemptydirs="true" failonerror="false"/>
+        <mkdir dir="${dependency-check.home}"/>
+        <unzip src="${dependency-check.archive.dir}/${dependency-check.archive.name}" dest="${dependency-check.home}"/>
+    </target>
+
+    <target name="-run-owasp-scan" description="Dependency-Check Analysis"
+            depends="-dependency-check-init,resolver-dist-lib">
+        <fail unless:set="nvd.api.key">
+            Please set the nvd.api.key property to your NVD API key. It is recommended to put that property into your
+            ~/.ant/build.properties file. You can get your API key from https://nvd.nist.gov/developers/request-an-api-key
+        </fail>
+
+        <echo unless:set="nvd.data.dir">
+            Since the NVD database is pretty large, you should consider storing it in some persistent location to reuse
+            it between builds. You can do that by setting the nvd.data.dir property to a directory of your choice,
+            such as ~/.cache/ant/owasp/database for Linux or ~/Library/Caches/Ant/owasp/database for MacOS.
+            Putting that property into your ~/.ant/build.properties file is recommended.
+        </echo>
+
+        <property name="nvd.data.dir" value="${tmp.dir}/owasp/database"/>
+        <property name="nvd.validity.hours" value="4"/>
 
         <path id="dependency-check.path">
             <fileset dir="${dependency-check.home}/dependency-check-ant/lib">
@@ -52,35 +73,39 @@
         </taskdef>
 
         <!--
-            default value for cveValidForHours is 4 after which sync is done again
-
-            skipping using two specific caches at the end is solving (1)
+            default value for nvdValidForHours is 4 after which sync is done again
 
             failBuildOnCVSS is by default 11 so build would never fail,
-            the table categorising vulnerabilities is here (2), so by setting
+            the table categorising vulnerabilities is here (1), so by setting
             "failBuildOnCVSS" to 1, we will fail the build on any CVE found
             if it is not suppressed already dependency-check-suppressions.xml
 
             If a vendor provides no details about a vulnerability,
             NVD will score that vulnerability as 10.0 (the highest rating translating to critical).
 
-            (1) https://github.com/jeremylong/DependencyCheck/issues/2166
-            (2) https://nvd.nist.gov/vuln-metrics/cvss
+            (1) https://nvd.nist.gov/vuln-metrics/cvss
         -->
         <dependency-check projectname="Apache Cassandra"
-                          reportoutputdirectory="${basedir}/build"
-                          reportformat="HTML"
+                          nvdApiKey="${nvd.api.key}"
+                          reportoutputdirectory="${dependency-check.report.dir}"
+                          reportformat="ALL"
                           prettyPrint="true"
-                          cveValidForHours="1"
-                          centralAnalyzerUseCache="false"
-                          nodeAuditAnalyzerUseCache="false"
+                          nvdValidForHours="${nvd.validity.hours}"
+                          centralAnalyzerUseCache="true"
+                          nodeAuditAnalyzerUseCache="true"
                           failBuildOnCVSS="1"
                           assemblyAnalyzerEnabled="false"
-                          dataDirectory="${dependency-check.home}/data"
+                          dataDirectory="${nvd.data.dir}"
                           suppressionFile="${basedir}/.build/dependency-check-suppressions.xml">
-            <fileset dir="lib">
-                <include name="**/*.jar"/>
-            </fileset>
+            <fileset refid="dependencies_to_check"/>
         </dependency-check>
     </target>
+
+    <target name="dependency-check" depends="resolver-dist-lib">
+        <fileset dir="lib" id="dependencies_to_check">
+            <include name="**/*.jar"/>
+        </fileset>
+        <antcall target="-run-owasp-scan" inheritrefs="true" inheritall="true"/>
+    </target>
+
 </project>
diff --git a/.build/dependency-check-suppressions.xml b/.build/dependency-check-suppressions.xml
index 04a74bb4b2..5df9d6e7ce 100644
--- a/.build/dependency-check-suppressions.xml
+++ b/.build/dependency-check-suppressions.xml
@@ -20,17 +20,10 @@
   https://jeremylong.github.io/DependencyCheck/general/suppression.html
 -->
 <suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">
-    <suppress>
-        <!--  https://issues.apache.org/jira/browse/CASSANDRA-18608 -->
-        <packageUrl regex="true">^pkg:maven/org\.xerial\.snappy/snappy\-java@.*$</packageUrl>
-        <cve>CVE-2023-34453</cve>
-        <cve>CVE-2023-34454</cve>
-        <cve>CVE-2023-34455</cve>
-    </suppress>
     <suppress>
         <!--  https://issues.apache.org/jira/browse/CASSANDRA-16150 -->
         <packageUrl regex="true">^pkg:maven/org\.yaml/snakeyaml@.*$</packageUrl>
-        <cve>CVE-2023-2251</cve>
+        <!--        <cve>CVE-2023-2251</cve>-->
         <cve>CVE-2022-38752</cve>
         <cve>CVE-2022-38751</cve>
         <cve>CVE-2022-38750</cve>
@@ -38,8 +31,6 @@
         <cve>CVE-2022-25857</cve>
         <cve>CVE-2022-38749</cve>
         <cve>CVE-2022-1471</cve>
-        <cve>CVE-2022-3064</cve>
-        <cve>CVE-2021-4235</cve>
         <cve>CVE-2017-18640</cve>
     </suppress>
 
@@ -58,7 +49,6 @@
         <cve>CVE-2021-43797</cve>
         <cve>CVE-2022-24823</cve>
         <cve>CVE-2022-41881</cve>
-        <cve>CVE-2022-41915</cve>
         <cve>CVE-2023-34462</cve>
         <cve>CVE-2023-44487</cve>
     </suppress>
@@ -84,27 +74,13 @@
         <packageUrl regex="true">^pkg:maven/com\.thinkaurelius\.thrift/thrift-server@.*$</packageUrl>
         <cve>CVE-2015-3254</cve>
         <cve>CVE-2016-5397</cve>
-        <cve>CVE-2018-1320</cve>
-        <cve>CVE-2018-11798</cve>
         <cve>CVE-2019-0205</cve>
     </suppress>
 
-    <!-- https://issues.apache.org/jira/browse/CASSANDRA-16056 -->
-    <!-- https://issues.apache.org/jira/browse/CASSANDRA-15416 -->
     <suppress>
         <packageUrl regex="true">^pkg:maven/org\.codehaus\.jackson/jackson\-mapper\-asl@.*$</packageUrl>
         <cve>CVE-2017-7525</cve>
-        <cve>CVE-2017-15095</cve>
-        <cve>CVE-2017-17485</cve>
-        <cve>CVE-2018-5968</cve>
-        <cve>CVE-2018-14718</cve>
-        <cve>CVE-2018-1000873</cve>
-        <cve>CVE-2018-7489</cve>
         <cve>CVE-2019-10172</cve>
-        <cve>CVE-2019-14540</cve>
-        <cve>CVE-2019-14893</cve>
-        <cve>CVE-2019-16335</cve>
-        <cve>CVE-2019-17267</cve>
     </suppress>
 
     <!-- https://issues.apache.org/jira/browse/CASSANDRA-19142 -->
diff --git a/build.xml b/build.xml
index ae04bd894f..b025a6e15b 100644
--- a/build.xml
+++ b/build.xml
@@ -30,6 +30,7 @@
     <property environment="env"/>
     <property file="build.properties" />
     <property file="build.properties.default" />
+    <property file="${user.home}/.ant/build.properties"/>
     <property name="debuglevel" value="source,lines,vars"/>
 
     <!-- default version and SCM information -->