diff --git a/experimental/javareach/README.md b/experimental/javareach/README.md new file mode 100644 index 0000000000..43ef6063b1 --- /dev/null +++ b/experimental/javareach/README.md @@ -0,0 +1,19 @@ +# Java reachability (WIP) + +This is an experimental tool to statically enumerate the reachable classes in a +Java program. + +The intention is to see if this can be used to exclude transitive dependencies +from vulnerability scanning completely, if they can be proven to be +unreachable. + +## Usage + +``` +go run ./cmd/reachable -classpath= path/to/root/class +``` + +Note that `` currently only supports a single directory path +containing .class files, with a directory structure that mirrors the package +hierarchy. This is unlike classpaths supported by Java runtimes (which supports +specifying multiple directories and .jar files) diff --git a/experimental/javareach/cmd/reachable/main.go b/experimental/javareach/cmd/reachable/main.go index 8f3924d442..d3f1e2cc10 100644 --- a/experimental/javareach/cmd/reachable/main.go +++ b/experimental/javareach/cmd/reachable/main.go @@ -134,6 +134,7 @@ func enumerateReachability(cf *javareach.ClassFile, classPath string, seen map[s slog.Debug("found", "dependency", class) depcf, err := findClass(classPath, class) if err != nil { + // Dependencies can be optional, so this is not a fatal error. slog.Error("failed to find class", "class", class, "from", thisClass, "cp idx", i, "error", err) continue }