allResolvedDeps,
+ boolean aggregate, ExceptionCollection exceptionCollection) {
ExceptionCollection exCol = exceptionCollection;
if (artifactScopeExcluded.passes(dependencyNode.getArtifact().getScope())
|| artifactTypeExcluded.passes(dependencyNode.getArtifact().getType())) {
@@ -3028,7 +3017,7 @@ private ExceptionCollection scanDependencyNode(DependencyNode dependencyNode, De
// Issue #4969 Tycho appears to add System-scoped libraries in reactor projects in unresolved state
// so attempt to do a resolution for system-scoped too if still nothing found
try {
- tryResolutionOnce(project, allResolvedDeps, buildingRequest);
+ tryResolutionOnce(project, allResolvedDeps);
final Artifact result = findInAllDeps(allResolvedDeps, dependencyNode.getArtifact(), project);
isResolved = result.isResolved();
artifactFile = result.getFile();
@@ -3036,7 +3025,7 @@ private ExceptionCollection scanDependencyNode(DependencyNode dependencyNode, De
artifactId = result.getArtifactId();
version = result.getVersion();
availableVersions = result.getAvailableVersions();
- } catch (DependencyNotFoundException | DependencyResolverException e) {
+ } catch (DependencyNotFoundException e) {
getLog().warn("Error performing last-resort System-scoped dependency resolution: " + e.getMessage());
ignored = e;
}
@@ -3069,9 +3058,9 @@ private ExceptionCollection scanDependencyNode(DependencyNode dependencyNode, De
result = dependencyArtifact;
} else {
try {
- tryResolutionOnce(project, allResolvedDeps, buildingRequest);
+ tryResolutionOnce(project, allResolvedDeps);
result = findInAllDeps(allResolvedDeps, dependencyNode.getArtifact(), project);
- } catch (DependencyNotFoundException | DependencyResolverException ex) {
+ } catch (DependencyNotFoundException ex) {
getLog().debug(String.format("Aggregate : %s", aggregate));
boolean addException = true;
//CSOFF: EmptyBlock
@@ -3133,43 +3122,56 @@ && addSnapshotReactorDependency(engine, dependencyNode.getArtifact(), project))
/**
* Try resolution of artifacts once, allowing for
- * DependencyResolutionException due to reactor-dependencies not being
- * resolvable.
+ * {@link DependencyResolutionException} due to reactor-dependencies not
+ * being resolvable.
*
* The resolution is attempted only if allResolvedDeps is still empty. The
* assumption is that for any given project at least one of the dependencies
* will successfully resolve. If not, resolution will be attempted once for
* every dependency (as allResolvedDeps remains empty).
+ *
+ * Any partial results carried by the {@link DependencyResolutionException}
+ * are extracted and added to {@code allResolvedDeps}; the exception itself
+ * is swallowed so the caller can fall back to per-artifact handling.
*
- * @param project The project to dependencies for
+ * @param project The project whose dependencies are to be resolved
* @param allResolvedDeps The collection of successfully resolved
* dependencies, will be filled with the successfully resolved dependencies,
- * even in case of resolution failures.
- * @param buildingRequest The buildingRequest to hand to Maven's
- * DependencyResolver.
- * @throws DependencyResolverException For any DependencyResolverException
- * other than an Eclipse Aether DependencyResolutionException
+ * even in case of partial-failure resolution.
*/
- private void tryResolutionOnce(MavenProject project, List allResolvedDeps, ProjectBuildingRequest buildingRequest) throws DependencyResolverException {
+ private void tryResolutionOnce(MavenProject project, List allResolvedDeps) {
if (allResolvedDeps.isEmpty()) { // no (partially successful) resolution attempt done
+ final ArtifactTypeRegistry typeRegistry = session.getRepositorySession().getArtifactTypeRegistry();
+ final CollectRequest collectRequest = new CollectRequest();
+ for (org.apache.maven.model.Dependency dep : project.getDependencies()) {
+ collectRequest.addDependency(RepositoryUtils.toDependency(dep, typeRegistry));
+ }
+ if (project.getDependencyManagement() != null) {
+ for (org.apache.maven.model.Dependency dep : project.getDependencyManagement().getDependencies()) {
+ collectRequest.addManagedDependency(RepositoryUtils.toDependency(dep, typeRegistry));
+ }
+ }
+ collectRequest.setRepositories(project.getRemoteProjectRepositories());
try {
- final List dependencies = project.getDependencies();
- final List managedDependencies = project
- .getDependencyManagement() == null ? null : project.getDependencyManagement().getDependencies();
- final Iterable allDeps = dependencyResolver
- .resolveDependencies(buildingRequest, dependencies, managedDependencies, null);
- allDeps.forEach(allResolvedDeps::add);
- } catch (DependencyResolverException dre) {
- if (dre.getCause() instanceof org.eclipse.aether.resolution.DependencyResolutionException) {
- final List successResults = Mshared998Util
- .getResolutionResults((org.eclipse.aether.resolution.DependencyResolutionException) dre.getCause());
- allResolvedDeps.addAll(successResults);
- } else {
- throw dre;
+ final DependencyResult dependencyResult = repoSystem.resolveDependencies(
+ session.getRepositorySession(), new DependencyRequest(collectRequest, null));
+ addResolvedArtifacts(dependencyResult.getArtifactResults(), allResolvedDeps);
+ } catch (DependencyResolutionException dre) {
+ if (dre.getResult() != null) {
+ addResolvedArtifacts(dre.getResult().getArtifactResults(), allResolvedDeps);
}
}
}
}
+
+ private void addResolvedArtifacts(List results,
+ List allResolvedDeps) {
+ for (org.eclipse.aether.resolution.ArtifactResult ar : results) {
+ if (ar.isResolved() && ar.getArtifact() != null) {
+ allResolvedDeps.add(RepositoryUtils.toArtifact(ar.getArtifact()));
+ }
+ }
+ }
//CSON: ParameterNumber
//CSOFF: ParameterNumber
diff --git a/maven/src/main/java/org/owasp/dependencycheck/maven/Mshared998Util.java b/maven/src/main/java/org/owasp/dependencycheck/maven/Mshared998Util.java
deleted file mode 100644
index 7e8a5795dd4..00000000000
--- a/maven/src/main/java/org/owasp/dependencycheck/maven/Mshared998Util.java
+++ /dev/null
@@ -1,84 +0,0 @@
-/*
- * This file is part of dependency-check-maven.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- *
- * Copyright (c) 2021 Jeremy Long. All Rights Reserved.
- */
-package org.owasp.dependencycheck.maven;
-
-import org.apache.maven.RepositoryUtils;
-import org.apache.maven.shared.transfer.artifact.resolve.ArtifactResult;
-import org.eclipse.aether.resolution.DependencyResolutionException;
-import org.eclipse.aether.resolution.DependencyResult;
-
-import java.util.ArrayList;
-import java.util.List;
-
-public final class Mshared998Util {
-
- /**
- * Empty constructor to prevent instantiation of utility-class.
- */
- private Mshared998Util() {
- }
-
- /**
- * Get the list of ArtifactResults from a resolution that ran into an exception.
- *
- * @param adre
- * The DependencyResolutionException that might have embedded resolution results
- *
- * @return The list of ArtifactResults created from the dependencyResult of the exception.
- */
- public static List getResolutionResults(DependencyResolutionException adre) {
- final DependencyResult dependencyResult = adre.getResult();
- final List results = new ArrayList<>();
- if (dependencyResult != null) {
- for (org.eclipse.aether.resolution.ArtifactResult artifactResult : dependencyResult.getArtifactResults()) {
- results.add(new M31ArtifactResult(artifactResult));
- }
- }
- return results;
- }
-
- /**
- * Our own implementation of ArtifactResult because MShared library does not expose the
- * transformation from eclipse aether ArtifactResult to maven-shared ArtifactResult.
- * So we cannot reuse Maven's own implementation in
- * org.apache.maven.shared.transfer.artifact.resolve.internal
- * This class is a copy of it, but then hard-bound to eclipse aether implementation
- * as DependencyCheck is already not compatible with maven 3.0
- */
- static class M31ArtifactResult implements ArtifactResult {
-
- /**
- * The ArtifactResult of the Maven 3.1+ artifact resolution
- * implementation library (Eclipse Aether) that is wrapped by this instance
- */
- private final org.eclipse.aether.resolution.ArtifactResult artifactResult;
-
- /**
- * @param artifactResult
- * {@link ArtifactResult}
- */
- M31ArtifactResult(org.eclipse.aether.resolution.ArtifactResult artifactResult) {
- this.artifactResult = artifactResult;
- }
-
- @Override
- public org.apache.maven.artifact.Artifact getArtifact() {
- return RepositoryUtils.toArtifact(artifactResult.getArtifact());
- }
- }
-}
diff --git a/maven/src/site/markdown/index.md.vm b/maven/src/site/markdown/index.md.vm
index 2284ba43e98..19a3200d888 100644
--- a/maven/src/site/markdown/index.md.vm
+++ b/maven/src/site/markdown/index.md.vm
@@ -1,7 +1,7 @@
Usage
======================
Dependency-check-maven is very simple to utilize and can be used as a stand-alone
-plug-in or as part of the site plug-in. The plug-in requires Maven 3.6.3 or higher.
+plug-in or as part of the site plug-in. The plug-in requires Maven 3.8.1 or higher.
It is important to understand that the first time this task is executed it may
take 20 minutes or more as it downloads and processes the data from the National
diff --git a/pom.xml b/pom.xml
index ac653f543a5..656f0da8d83 100644
--- a/pom.xml
+++ b/pom.xml
@@ -20,7 +20,7 @@ Copyright (c) 2012 - Jeremy Long
org.owasp
dependency-check-parent
- 12.2.3-SNAPSHOT
+ 13.0.0-SNAPSHOT
pom
diff --git a/src/site/markdown/index.md b/src/site/markdown/index.md
index f240dc4f19a..2e723419055 100644
--- a/src/site/markdown/index.md
+++ b/src/site/markdown/index.md
@@ -31,7 +31,7 @@ OWASP dependency-check's core analysis engine can be used as:
- [Command Line Tool](dependency-check-cli/index.html)
- [Gradle Plugin](dependency-check-gradle/index.html)
- [Jenkins Plugin](dependency-check-jenkins/index.html)
-- [Maven Plugin](dependency-check-maven/index.html) - Maven 3.6.3 or newer required
+- [Maven Plugin](dependency-check-maven/index.html) - Maven 3.8.1 or newer required
Unofficial (Not endorsed by OWASP)
- [SBT Plugin](https://github.com/nMoncho/sbt-dependency-check)
diff --git a/utils/pom.xml b/utils/pom.xml
index f6bbb02ad57..81fcc2774c2 100644
--- a/utils/pom.xml
+++ b/utils/pom.xml
@@ -20,7 +20,7 @@ Copyright (c) 2014 - Jeremy Long. All Rights Reserved.
org.owasp
dependency-check-parent
- 12.2.3-SNAPSHOT
+ 13.0.0-SNAPSHOT
dependency-check-utils