From 535b5a96d948b6ca64ed8ae85ccd26b11fa0137a Mon Sep 17 00:00:00 2001 From: DmitriyLewen <91113035+DmitriyLewen@users.noreply.github.com> Date: Thu, 8 Feb 2024 15:43:35 +0600 Subject: [PATCH] feat(java): add dependency location support for `gradle` files (#6083) --- docs/docs/coverage/language/java.md | 2 +- go.mod | 2 +- go.sum | 4 ++-- integration/testdata/gradle.json.golden | 2 ++ pkg/fanal/analyzer/language/java/gradle/lockfile_test.go | 7 +++++++ 5 files changed, 13 insertions(+), 4 deletions(-) diff --git a/docs/docs/coverage/language/java.md b/docs/docs/coverage/language/java.md index 4043fc7e188..f30c5cb05b8 100644 --- a/docs/docs/coverage/language/java.md +++ b/docs/docs/coverage/language/java.md @@ -15,7 +15,7 @@ The following table provides an outline of the features Trivy offers. |------------------|:---------------------:|:----------------:|:------------------------------------:|:--------:| | JAR/WAR/PAR/EAR | Trivy Java DB | Include | - | - | | pom.xml | Maven repository [^1] | Exclude | ✓ | ✓[^7] | -| *gradle.lockfile | - | Exclude | - | - | +| *gradle.lockfile | - | Exclude | - | ✓ | These may be enabled or disabled depending on the target. See [here](./index.md) for the detail. diff --git a/go.mod b/go.mod index c8adcd3bf8a..f92a01fe7b9 100644 --- a/go.mod +++ b/go.mod @@ -14,7 +14,7 @@ require ( github.com/alicebob/miniredis/v2 v2.31.1 github.com/aquasecurity/bolt-fixtures v0.0.0-20200903104109-d34e7f983986 github.com/aquasecurity/defsec v0.94.1 - github.com/aquasecurity/go-dep-parser v0.0.0-20240202105001-4f19ab402b0b + github.com/aquasecurity/go-dep-parser v0.0.0-20240208080026-8cc7d408bce4 github.com/aquasecurity/go-gem-version v0.0.0-20201115065557-8eed6fe000ce github.com/aquasecurity/go-npm-version v0.0.0-20201110091526-0b796d180798 github.com/aquasecurity/go-pep440-version v0.0.0-20210121094942-22b2f8951d46 diff --git a/go.sum b/go.sum index d16c12c19d2..f07a2bd9f6b 100644 --- a/go.sum +++ b/go.sum @@ -325,8 +325,8 @@ github.com/aquasecurity/bolt-fixtures v0.0.0-20200903104109-d34e7f983986 h1:2a30 github.com/aquasecurity/bolt-fixtures v0.0.0-20200903104109-d34e7f983986/go.mod h1:NT+jyeCzXk6vXR5MTkdn4z64TgGfE5HMLC8qfj5unl8= github.com/aquasecurity/defsec v0.94.1 h1:lk44bfUltm0f0Dw4DbO3Ka9d/bf3N8cWclSdHXMyKF4= github.com/aquasecurity/defsec v0.94.1/go.mod h1:wiX9BX0SOG0ZWjVIPYGPl46fyO3Gu8lJnk4rmhFR7IA= -github.com/aquasecurity/go-dep-parser v0.0.0-20240202105001-4f19ab402b0b h1:GEwxQO0+OcZ4wgmtqU+8qBK179BXhz+WHTWahZA5dfM= -github.com/aquasecurity/go-dep-parser v0.0.0-20240202105001-4f19ab402b0b/go.mod h1:P0PmelcN1ABKJrDzRbPnn6hK7RvgI+xmjiV/9uPaNnY= +github.com/aquasecurity/go-dep-parser v0.0.0-20240208080026-8cc7d408bce4 h1:6qs80w4qPbPnF6GhbIifSANqfCrq90CKtSUBaw6p0z0= +github.com/aquasecurity/go-dep-parser v0.0.0-20240208080026-8cc7d408bce4/go.mod h1:P0PmelcN1ABKJrDzRbPnn6hK7RvgI+xmjiV/9uPaNnY= github.com/aquasecurity/go-gem-version v0.0.0-20201115065557-8eed6fe000ce h1:QgBRgJvtEOBtUXilDb1MLi1p1MWoyFDXAu5DEUl5nwM= github.com/aquasecurity/go-gem-version v0.0.0-20201115065557-8eed6fe000ce/go.mod h1:HXgVzOPvXhVGLJs4ZKO817idqr/xhwsTcj17CLYY74s= github.com/aquasecurity/go-mock-aws v0.0.0-20240109054747-49e4b5da33cb h1:dNxUB2bSbiLGNYcXkbBKrrfuY96+dXhA9FahEFZ4THQ= diff --git a/integration/testdata/gradle.json.golden b/integration/testdata/gradle.json.golden index 4979b31fbed..86822d526e3 100644 --- a/integration/testdata/gradle.json.golden +++ b/integration/testdata/gradle.json.golden @@ -23,6 +23,7 @@ "Vulnerabilities": [ { "VulnerabilityID": "CVE-2020-9548", + "PkgID": "com.fasterxml.jackson.core:jackson-databind:2.9.1", "PkgName": "com.fasterxml.jackson.core:jackson-databind", "PkgIdentifier": { "PURL": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1" @@ -87,6 +88,7 @@ }, { "VulnerabilityID": "CVE-2021-20190", + "PkgID": "com.fasterxml.jackson.core:jackson-databind:2.9.1", "PkgName": "com.fasterxml.jackson.core:jackson-databind", "PkgIdentifier": { "PURL": "pkg:maven/com.fasterxml.jackson.core/jackson-databind@2.9.1" diff --git a/pkg/fanal/analyzer/language/java/gradle/lockfile_test.go b/pkg/fanal/analyzer/language/java/gradle/lockfile_test.go index 01ef6a6c99f..e48ce885865 100644 --- a/pkg/fanal/analyzer/language/java/gradle/lockfile_test.go +++ b/pkg/fanal/analyzer/language/java/gradle/lockfile_test.go @@ -27,8 +27,15 @@ func Test_gradleLockAnalyzer_Analyze(t *testing.T) { FilePath: "testdata/happy.lockfile", Libraries: types.Packages{ { + ID: "com.example:example:0.0.1", Name: "com.example:example", Version: "0.0.1", + Locations: []types.Location{ + { + StartLine: 4, + EndLine: 4, + }, + }, }, }, },