[Feature Request] Adding pom version to projectinfo section of the dependency check report

[Prakhash]

Hi all,

I would like to request a new feature from the dependency check.

As shown below, Dependency check currently provides only the 3 options in the projectinfo, in addition to this, I wish to add the project version to the projectinfo section.

<projectInfo>
    <name>WSO2 Carbon - UI</name>
    <reportDate>2017-02-20T20:23:53.695+0530</reportDate>
    <credits>This report contains data retrieved from the National Vulnerability Database: http://nvd.nist.gov</credits>
</projectInfo>

Like this below :

 <projectInfo>
    <name>WSO2 Carbon - UI</name>
    <version>4.4.0</version>
    <reportDate>2017-02-20T20:23:53.695+0530</reportDate>
    <credits>This report contains data retrieved from the National Vulnerability Database: http://nvd.nist.gov</credits>
</projectInfo>

This is a really an essential requirement for people who are maintaining products with multiple versions and we create customized reports from the XML report generated by Dependency check. So it is not practical to always go and edit the bulk HTML reports

My Solution

For now, I have implemented this by forking the dependency check code by doing the following changes. If this an acceptable way of doing this, I can send a PR to you, or else please recommend a way to do this

1. Introduced a new constructor as below in [1] with the applicationVersion included

  public ReportGenerator(String applicationName,String applicationVersion, List<Dependency> dependencies, List<Analyzer> analyzers, DatabaseProperties properties) {

      this(applicationName,dependencies,analyzers,properties);
      context.put("pomVersion",applicationVersion);
  }

2. Changed the invoking maven method as below with the p.getVersion() attribute [2]

   final ReportGenerator r = new ReportGenerator(p.getName(),p.getVersion(), engine.getDependencies(), engine.getAnalyzers(), prop);

3. Changed the schema as in [3]

4. Changed the XmlReport.vsl as in [4]

[1] https://github.com/Prakhash/DependencyCheck/blob/master/dependency-check-core/src/main/java/org/owasp/dependencycheck/reporting/ReportGenerator.java#L128

[2] https://github.com/Prakhash/DependencyCheck/blob/master/dependency-check-maven/src/main/java/org/owasp/dependencycheck/maven/BaseDependencyCheckMojo.java#L1049

[3] https://github.com/Prakhash/DependencyCheck/blob/master/dependency-check-core/src/main/resources/schema/dependency-check.1.3.xsd

[4] https://github.com/Prakhash/DependencyCheck/blob/master/dependency-check-core/src/main/resources/templates/XmlReport.vsl

Regards,
Prakhash

[stevespringett]

I'll let Jeremy comment on the implementation, but I welcome the scheme change proposed, as it fits in nicely to what Dependency Track is doing.

However, the agent, CLI, Ant and Gradle plugins should all be updated to take advantage of the change.

[jeremylong]

This is something that could be used by any of the integrations that are truly baked into the build process; namely Maven, Gradle, and SBT. With each of these we would have the ability to grab the actual coordinates of the projects instead of just the version. What about instead of "version" we add the full coordinates?

[Prakhash]

+1 for this idea. Any suggestions on what we need to include here (all the coordinates not needed I guess)? I can change my implementation which I did for "version" and send a PR.

[Prakhash]

Shall I implement this with project name, version, artifact ID and group ID ?

[jeremylong]

Sure, if you have time a PR to include this would be great. The one thing I'm wondering about though is with aggregate builds and the related dependencies section. Should the full GAV of the source be listed in each dependency object? Possibly even marked as direct vs. transitive?

Thoughts?

[jeremylong]

This update was added for Maven. However, we still need to update the gradle plugin.

[Prakhash]

Thanks Jeremy. I will start working on it as soon as possible

[lock]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.