From 15c5be0fd06bcd7ade45d1019c902e170bbeb1bd Mon Sep 17 00:00:00 2001 From: luotianqi777 Date: Mon, 29 Apr 2024 11:01:10 +0800 Subject: [PATCH 1/2] feat: update html report template --- cmd/format/html_tpl | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/cmd/format/html_tpl b/cmd/format/html_tpl index 3f425cde..b56e19ab 100644 --- a/cmd/format/html_tpl +++ b/cmd/format/html_tpl @@ -1,2 +1,2 @@ -OpenSCA开源组件检测报告
\ No newline at end of file +OpenSCA开源组件检测报告
\ No newline at end of file From 57f54a1ef17689b92e48b873ad46a2e6fb490f6c Mon Sep 17 00:00:00 2001 From: luotianqi777 Date: Tue, 7 May 2024 21:10:11 +0800 Subject: [PATCH 2/2] feat: dependency inherit parent --- opensca/sca/java/mvn.go | 12 +++++------- test/java/15/pom.xml | 21 +++++++++++++++++++++ test/java/java_test.go | 13 +++++++++++++ 3 files changed, 39 insertions(+), 7 deletions(-) create mode 100644 test/java/15/pom.xml diff --git a/opensca/sca/java/mvn.go b/opensca/sca/java/mvn.go index f402df94..088aa2ca 100644 --- a/opensca/sca/java/mvn.go +++ b/opensca/sca/java/mvn.go @@ -183,7 +183,7 @@ func inheritModules(poms []*Pom) { type getPomFunc func(dep PomDependency, repos ...[]string) *Pom // inheritPom 继承pom所需内容 -func inheritPom(pom *Pom, inheritDependencies bool, getpom getPomFunc) { +func inheritPom(pom *Pom, getpom getPomFunc) { // 记录统计过的parent 避免pom循环引用 parentSet := map[string]bool{} @@ -218,9 +218,7 @@ func inheritPom(pom *Pom, inheritDependencies bool, getpom getPomFunc) { pom.DependencyManagement = append(pom.DependencyManagement, parentPom.DependencyManagement...) // 继承dependencies - if inheritDependencies { - pom.Dependencies = append(pom.Dependencies, parentPom.Dependencies...) - } + pom.Dependencies = append(pom.Dependencies, parentPom.Dependencies...) // 继承repo&mirror pom.Repositories = append(pom.Repositories, parentPom.Repositories...) @@ -294,7 +292,7 @@ func parsePom(ctx context.Context, pom *Pom, getpom getPomFunc) *model.DepGraph pom.Update(&pom.PomDependency) // 继承pom - inheritPom(pom, true, getpom) + inheritPom(pom, getpom) // 记录在根pom的dependencyManagement中非import组件信息 rootPomManagement := map[string]*PomDependency{} @@ -406,8 +404,8 @@ func parsePom(ctx context.Context, pom *Pom, getpom getPomFunc) *model.DepGraph subpom.PomDependency = *dep // 继承根pom的exclusion subpom.Exclusions = append(subpom.Exclusions, np.Exclusions...) - // 子依赖不继承parent的依赖项 - inheritPom(subpom, false, getpom) + // 依赖继承parent + inheritPom(subpom, getpom) sub.Expand = subpom } diff --git a/test/java/15/pom.xml b/test/java/15/pom.xml new file mode 100644 index 00000000..2fe2e51e --- /dev/null +++ b/test/java/15/pom.xml @@ -0,0 +1,21 @@ + + + + 4.0.0 + + my.foo + 1.0 + demo + + + + + com.fasterxml.jackson.datatype + jackson-datatype-jsr310 + 2.17.0 + + + + + \ No newline at end of file diff --git a/test/java/java_test.go b/test/java/java_test.go index 0f8283de..719703a5 100644 --- a/test/java/java_test.go +++ b/test/java/java_test.go @@ -161,6 +161,19 @@ var cases = []tool.TaskCase{ ), ), )}, + + // 直接依赖继承parent + {Path: "15", Result: tool.Dep("", "", + tool.Dep3("my.foo", "demo", "1.0", + tool.Dep3("com.fasterxml.jackson.datatype", "jackson-datatype-jsr310", "2.17.0", + tool.Dep3("com.fasterxml.jackson.core", "jackson-annotations", "2.17.0"), + tool.Dep3("com.fasterxml.jackson.core", "jackson-core", "2.17.0"), + tool.Dep3("com.fasterxml.jackson.core", "jackson-databind", "2.17.0", + tool.Dep3("net.bytebuddy", "byte-buddy", "1.14.9"), + ), + ), + ), + )}, } func Test_JavaWithStatic(t *testing.T) {