Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Configuration Cache Support #409

Draft
wants to merge 2 commits into
base: main
Choose a base branch
from
Draft

Configuration Cache Support #409

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
682fcc5
reduce usages of 'project' in task action
mgroth0 Sep 6, 2024
f6782e4
reduce usages of at execution time and document methods running at e…
mgroth0 Oct 18, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
66 changes: 38 additions & 28 deletions src/main/groovy/org/owasp/dependencycheck/gradle/tasks/AbstractAnalyze.groovy
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -64,6 +64,24 @@ abstract class AbstractAnalyze extends ConfiguredTask {

@Internal
String currentProjectName = project.getName()

@Internal
String currentProjectGroup = project.getGroup()

@Internal
String currentProjectVersion = project.getVersion().toString()



/**
* Gets the projects display name. Project.getDisplayName() has been
* introduced with Gradle 3.3, thus we need to check for the method's
* existence first. Fallback: use project NAME
* @return the display name
*/
@Internal
String currentProjectDisplayName = project.metaClass.respondsTo(project, "getDisplayName") ? project.getDisplayName() : project.getName()

@Internal
Attribute artifactType = Attribute.of('artifactType', String)
// @Internal
Expand Down Expand Up @@ -111,11 +129,11 @@ abstract class AbstractAnalyze extends ConfiguredTask {

logger.lifecycle("Generating report for project ${currentProjectName}")
try {
String name = project.getName()
String displayName = determineDisplayName()
String groupId = project.getGroup()
String version = project.getVersion().toString()
File output = project.file(config.outputDirectory)
String name = currentProjectName
String displayName = currentProjectDisplayName
String groupId = currentProjectGroup
String version = currentProjectVersion
File output = new File(config.outputDirectory)
for (String f : getReportFormats(config.format, config.formats)) {
engine.writeReports(displayName, groupId, name, version, output, f, exCol)
}
Expand Down Expand Up @@ -145,15 +163,6 @@ abstract class AbstractAnalyze extends ConfiguredTask {
}
}

/**
* Gets the projects display name. Project.getDisplayName() has been
* introduced with Gradle 3.3, thus we need to check for the method's
* existence first. Fallback: use project NAME
* @return the display name
*/
String determineDisplayName() {
return project.metaClass.respondsTo(project, "getDisplayName") ? project.getDisplayName() : project.getName()
}
/**
* Verifies aspects of the configuration to ensure dependency-check can run correctly.
*/
Expand Down Expand Up @@ -218,6 +227,7 @@ abstract class AbstractAnalyze extends ConfiguredTask {

/**
* Loads the projects dependencies into the dependency-check analysis engine.
* Runs at execution time
*/
abstract scanDependencies(Engine engine)

Expand All @@ -232,7 +242,7 @@ abstract class AbstractAnalyze extends ConfiguredTask {

logger.warn("Found ${vulnerabilities.size()} vulnerabilities in project ${currentProjectName}")
if (config.showSummary) {
DependencyCheckScanAgent.showSummary(project.name, engine.getDependencies());
DependencyCheckScanAgent.showSummary(currentProjectName, engine.getDependencies());
}
}

Expand Down Expand Up @@ -301,17 +311,17 @@ abstract class AbstractAnalyze extends ConfiguredTask {
* project's path.
*/
@groovy.transform.CompileStatic
def shouldBeScanned(Project project) {
!config.scanProjects || config.scanProjects.contains(project.path)
def shouldBeScanned(String projectPath) {
!config.scanProjects || config.scanProjects.contains(projectPath)
}

/**
* Checks whether the given project should be skipped
* because skipProjects contains the project's path.
*/
@groovy.transform.CompileStatic
def shouldBeSkipped(Project project) {
config.skipProjects.contains(project.path)
def shouldBeSkipped(String projectPath) {
config.skipProjects.contains(projectPath)
}

/**
Expand Down Expand Up @@ -403,6 +413,7 @@ abstract class AbstractAnalyze extends ConfiguredTask {

/**
* Process the incoming artifacts for the given project's configurations.
* Runs at execution time.
* @param project the project to analyze
* @param engine the dependency-check engine
*/
Expand All @@ -415,7 +426,7 @@ abstract class AbstractAnalyze extends ConfiguredTask {
if (CUTOVER_GRADLE_VERSION.compareTo(GradleVersion.current()) > 0) {
processConfigLegacy configuration, engine
} else {
processConfigV4 project, configuration, engine, true
processConfigV4 currentProjectName, configuration, engine, true
}
}
}
Expand All @@ -434,7 +445,7 @@ abstract class AbstractAnalyze extends ConfiguredTask {
if (CUTOVER_GRADLE_VERSION.compareTo(GradleVersion.current()) > 0) {
processConfigLegacy configuration, engine
} else {
processConfigV4 project, configuration, engine
processConfigV4 currentProjectName, configuration, engine
}
}
if (config.scanSet == null) {
Expand All @@ -443,18 +454,18 @@ abstract class AbstractAnalyze extends ConfiguredTask {
'./npm-shrinkwrap.json', './yarn.lock',
'./pnpm.lock', 'pnpm-lock.yaml', './Gopkg.lock', './go.mod']
toScan.each {
File f = project.file it
File f = new File(it)
if (f.exists()) {
engine.scan(f, project.name)
engine.scan(f, currentProjectName)
}
}
} else {
config.scanSet.each {
File f = project.file it
File f = it
if (f.exists()) {
engine.scan(f, project.name)
engine.scan(f, currentProjectName)
} else {
logger.warn("ScanSet file `${f}` does not exist in ${project.name}")
logger.warn("ScanSet file `${f}` does not exist in ${currentProjectName}")
}
}
}
Expand Down Expand Up @@ -550,8 +561,7 @@ abstract class AbstractAnalyze extends ConfiguredTask {
* @param engine the dependency-check engine
* @param scanningBuildEnv true if scanning the build environment; otherwise false
*/
protected void processConfigV4(Project project, Configuration configuration, Engine engine, boolean scanningBuildEnv = false) {
String projectName = project.name
protected void processConfigV4(String projectName, Configuration configuration, Engine engine, boolean scanningBuildEnv = false) {
String scope = "$projectName:$configuration.name"
if (scanningBuildEnv) {
scope += " (buildEnv)"
Expand Down
3 changes: 2 additions & 1 deletion src/main/groovy/org/owasp/dependencycheck/gradle/tasks/Aggregate.groovy
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,6 +39,7 @@ class Aggregate extends AbstractAnalyze {

/**
* Loads the projects dependencies into the dependency-check analysis engine.
* Runs at execution time
*/
def scanDependencies(Engine engine) {
logger.lifecycle("Verifying dependencies for project ${currentProjectName}")
Expand All @@ -51,7 +52,7 @@ class Aggregate extends AbstractAnalyze {

private def scanProject(Set<Project> projects, Engine engine) {
projects.each { Project project ->
if (shouldBeScanned(project) && !shouldBeSkipped(project)) {
if (shouldBeScanned(project.path) && !shouldBeSkipped(project.path)) {
if (this.config.scanDependencies) {
processConfigurations(project, engine)
}
Expand Down
7 changes: 6 additions & 1 deletion src/main/groovy/org/owasp/dependencycheck/gradle/tasks/Analyze.groovy
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,6 +18,7 @@

package org.owasp.dependencycheck.gradle.tasks

import org.gradle.api.tasks.Internal
import org.owasp.dependencycheck.Engine

/**
Expand All @@ -26,6 +27,9 @@ import org.owasp.dependencycheck.Engine
@groovy.transform.CompileStatic
class Analyze extends AbstractAnalyze {

@Internal
String currentProjectPath = project.path

Analyze() {
group = 'OWASP dependency-check'
description = 'Identifies and reports known vulnerabilities (CVEs) in project dependencies.'
Expand All @@ -37,9 +41,10 @@ class Analyze extends AbstractAnalyze {

/**
* Loads the projects dependencies into the dependency-check analysis engine.
* Runs at execution time
*/
def scanDependencies(Engine engine) {
if (shouldBeScanned(project) && !shouldBeSkipped(project)) {
if (shouldBeScanned(currentProjectPath) && !shouldBeSkipped(currentProjectPath)) {
logger.lifecycle("Verifying dependencies for project ${currentProjectName}")
if (this.config.scanDependencies) {
processConfigurations(project, engine)
Expand Down