Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

#

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Upgrade to maven-enforcer-api 3.0.0 #57

Merged
merged 2 commits into from
Jan 27, 2022
Merged

Upgrade to maven-enforcer-api 3.0.0 #57

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
7334867
Upgrade to maven-enforcer-api 3.0.0
Sep 22, 2021
dacf3cb
Upgrade Maven dependencies and ossindex-service-client
Jan 4, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,7 +31,7 @@ For information on how to use the integrations see the project documentation:
### Requirements

* [Apache Maven](https://maven.apache.org/) 3.3+ (prefer to use included `mvnw`)
* JDK 7+ (10 is **NOT** supported)
* JDK 8+ (10 is **NOT** supported)

### Build

Expand Down
1 change: 0 additions & 1 deletion common/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,7 +46,6 @@
<dependency>
<groupId>org.apache.maven</groupId>
<artifactId>maven-artifact</artifactId>
<version>3.0</version>
</dependency>

<dependency>
Expand Down
2 changes: 1 addition & 1 deletion common/src/main/java/org/sonatype/ossindex/maven/common/ComponentReportAssistant.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -124,7 +124,7 @@ public ComponentReportResult request(final ComponentReportRequest request) {
*/
@VisibleForTesting
static PackageUrl packageUrl(final Artifact artifact) {
return new PackageUrl.Builder()
return PackageUrl.builder()
.type("maven")
.namespace(artifact.getGroupId())
.name(artifact.getArtifactId())
Expand Down
9 changes: 1 addition & 8 deletions enforcer-rules/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,11 +27,6 @@
<name>${project.groupId}:${project.artifactId}</name>
<packaging>jar</packaging>

<properties>
<!-- maven-enforcer-plugin relies on older maven implementations -->
<apache-maven.version>3.0</apache-maven.version>
</properties>

<dependencies>
<dependency>
<groupId>org.sonatype.ossindex.maven</groupId>
Expand All @@ -41,7 +36,7 @@
<dependency>
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Critical OSS Vulnerability:

pkg:maven/org.apache.maven.enforcer/enforcer-api@3.0.0

3 Critical, 0 Severe, 0 Moderate, 6 Unknown vulnerabilities have been found across 3 dependencies

Components
    pkg:maven/org.codehaus.plexus/plexus-utils@2.0.4
      CRITICAL Vulnerabilities (1)

        [CVE-2017-1000487] Improper Neutralization of Special Elements used in a Command (Command Injection)

        Plexus-utils before 3.0.16 is vulnerable to command injection because it does not correctly process the contents of double quoted strings.

        CVSS Score: 9.8

        CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

      UNKNOWN Vulnerabilities (2)
        OSSINDEX-d093-0e6b-3210

        Possible XML Injection

        > org.codehaus.plexus.util.xml.XmlWriterUtil#writeComment(XMLWriter, String, int, int, int) does not check if the comment includes a &quot;--&gt;&quot; sequence. This means that text contained in the command string could be interpreted as XML, possibly leading to XML injection issues, depending on how this method is being called.> > -- github.com

        CVSS Score: 0

        OSSINDEX-d89d-15b4-33be

        Directory traversal in org.codehaus.plexus.util.Expand

        > org.codehaus.plexus.util.Expand does not guard against directory traversal, but such protection is generally expected from unarchiving tools.> > -- github.com

        CVSS Score: 0

    pkg:maven/org.codehaus.plexus/plexus-utils@2.0.4
      CRITICAL Vulnerabilities (1)

        [CVE-2017-1000487] Improper Neutralization of Special Elements used in a Command (Command Injection)

        Plexus-utils before 3.0.16 is vulnerable to command injection because it does not correctly process the contents of double quoted strings.

        CVSS Score: 9.8

        CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

      UNKNOWN Vulnerabilities (2)
        OSSINDEX-d093-0e6b-3210

        Possible XML Injection

        > org.codehaus.plexus.util.xml.XmlWriterUtil#writeComment(XMLWriter, String, int, int, int) does not check if the comment includes a &quot;--&gt;&quot; sequence. This means that text contained in the command string could be interpreted as XML, possibly leading to XML injection issues, depending on how this method is being called.> > -- github.com

        CVSS Score: 0

        OSSINDEX-d89d-15b4-33be

        Directory traversal in org.codehaus.plexus.util.Expand

        > org.codehaus.plexus.util.Expand does not guard against directory traversal, but such protection is generally expected from unarchiving tools.> > -- github.com

        CVSS Score: 0

    pkg:maven/org.codehaus.plexus/plexus-utils@2.0.4
      CRITICAL Vulnerabilities (1)

        [CVE-2017-1000487] Improper Neutralization of Special Elements used in a Command (Command Injection)

        Plexus-utils before 3.0.16 is vulnerable to command injection because it does not correctly process the contents of double quoted strings.

        CVSS Score: 9.8

        CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

      UNKNOWN Vulnerabilities (2)
        OSSINDEX-d093-0e6b-3210

        Possible XML Injection

        > org.codehaus.plexus.util.xml.XmlWriterUtil#writeComment(XMLWriter, String, int, int, int) does not check if the comment includes a &quot;--&gt;&quot; sequence. This means that text contained in the command string could be interpreted as XML, possibly leading to XML injection issues, depending on how this method is being called.> > -- github.com

        CVSS Score: 0

        OSSINDEX-d89d-15b4-33be

        Directory traversal in org.codehaus.plexus.util.Expand

        > org.codehaus.plexus.util.Expand does not guard against directory traversal, but such protection is generally expected from unarchiving tools.> > -- github.com

        CVSS Score: 0

(at-me [in a reply](https://help.sonatype.com/lift/talking-to-lift) with `help` or `ignore`)

<groupId>org.apache.maven.enforcer</groupId>
<artifactId>enforcer-api</artifactId>
<version>3.0.0-M1</version>
<version>3.0.0</version>
</dependency>

<dependency>
Expand All @@ -64,11 +59,9 @@
<artifactId>maven-artifact</artifactId>
</dependency>

<!-- maven-enforcer-plugin uses older maven-dependency-tree 2.x API and is not compatible with latest 3.x -->
<dependency>
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Critical OSS Vulnerability:

pkg:maven/org.apache.maven.shared/maven-dependency-tree@3.1.0

18 Critical, 0 Severe, 0 Moderate, 36 Unknown vulnerabilities have been found across 18 dependencies

Components
    pkg:maven/org.codehaus.plexus/plexus-utils@2.0.4
      CRITICAL Vulnerabilities (1)

        [CVE-2017-1000487] Improper Neutralization of Special Elements used in a Command (Command Injection)

        Plexus-utils before 3.0.16 is vulnerable to command injection because it does not correctly process the contents of double quoted strings.

        CVSS Score: 9.8

        CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

      UNKNOWN Vulnerabilities (2)
        OSSINDEX-d093-0e6b-3210

        Possible XML Injection

        > org.codehaus.plexus.util.xml.XmlWriterUtil#writeComment(XMLWriter, String, int, int, int) does not check if the comment includes a &quot;--&gt;&quot; sequence. This means that text contained in the command string could be interpreted as XML, possibly leading to XML injection issues, depending on how this method is being called.> > -- github.com

        CVSS Score: 0

        OSSINDEX-d89d-15b4-33be

        Directory traversal in org.codehaus.plexus.util.Expand

        > org.codehaus.plexus.util.Expand does not guard against directory traversal, but such protection is generally expected from unarchiving tools.> > -- github.com

        CVSS Score: 0

    pkg:maven/org.codehaus.plexus/plexus-utils@2.0.4
      CRITICAL Vulnerabilities (1)

        [CVE-2017-1000487] Improper Neutralization of Special Elements used in a Command (Command Injection)

        Plexus-utils before 3.0.16 is vulnerable to command injection because it does not correctly process the contents of double quoted strings.

        CVSS Score: 9.8

        CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

      UNKNOWN Vulnerabilities (2)
        OSSINDEX-d093-0e6b-3210

        Possible XML Injection

        > org.codehaus.plexus.util.xml.XmlWriterUtil#writeComment(XMLWriter, String, int, int, int) does not check if the comment includes a &quot;--&gt;&quot; sequence. This means that text contained in the command string could be interpreted as XML, possibly leading to XML injection issues, depending on how this method is being called.> > -- github.com

        CVSS Score: 0

        OSSINDEX-d89d-15b4-33be

        Directory traversal in org.codehaus.plexus.util.Expand

        > org.codehaus.plexus.util.Expand does not guard against directory traversal, but such protection is generally expected from unarchiving tools.> > -- github.com

        CVSS Score: 0

    pkg:maven/org.codehaus.plexus/plexus-utils@2.0.4
      CRITICAL Vulnerabilities (1)

        [CVE-2017-1000487] Improper Neutralization of Special Elements used in a Command (Command Injection)

        Plexus-utils before 3.0.16 is vulnerable to command injection because it does not correctly process the contents of double quoted strings.

        CVSS Score: 9.8

        CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

      UNKNOWN Vulnerabilities (2)
        OSSINDEX-d093-0e6b-3210

        Possible XML Injection

        > org.codehaus.plexus.util.xml.XmlWriterUtil#writeComment(XMLWriter, String, int, int, int) does not check if the comment includes a &quot;--&gt;&quot; sequence. This means that text contained in the command string could be interpreted as XML, possibly leading to XML injection issues, depending on how this method is being called.> > -- github.com

        CVSS Score: 0

        OSSINDEX-d89d-15b4-33be

        Directory traversal in org.codehaus.plexus.util.Expand

        > org.codehaus.plexus.util.Expand does not guard against directory traversal, but such protection is generally expected from unarchiving tools.> > -- github.com

        CVSS Score: 0

    pkg:maven/org.codehaus.plexus/plexus-utils@2.0.4
      CRITICAL Vulnerabilities (1)

        [CVE-2017-1000487] Improper Neutralization of Special Elements used in a Command (Command Injection)

        Plexus-utils before 3.0.16 is vulnerable to command injection because it does not correctly process the contents of double quoted strings.

        CVSS Score: 9.8

        CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

      UNKNOWN Vulnerabilities (2)
        OSSINDEX-d093-0e6b-3210

        Possible XML Injection

        > org.codehaus.plexus.util.xml.XmlWriterUtil#writeComment(XMLWriter, String, int, int, int) does not check if the comment includes a &quot;--&gt;&quot; sequence. This means that text contained in the command string could be interpreted as XML, possibly leading to XML injection issues, depending on how this method is being called.> > -- github.com

        CVSS Score: 0

        OSSINDEX-d89d-15b4-33be

        Directory traversal in org.codehaus.plexus.util.Expand

        > org.codehaus.plexus.util.Expand does not guard against directory traversal, but such protection is generally expected from unarchiving tools.> > -- github.com

        CVSS Score: 0

    pkg:maven/org.codehaus.plexus/plexus-utils@2.0.4
      CRITICAL Vulnerabilities (1)

        [CVE-2017-1000487] Improper Neutralization of Special Elements used in a Command (Command Injection)

        Plexus-utils before 3.0.16 is vulnerable to command injection because it does not correctly process the contents of double quoted strings.

        CVSS Score: 9.8

        CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

      UNKNOWN Vulnerabilities (2)
        OSSINDEX-d093-0e6b-3210

        Possible XML Injection

        > org.codehaus.plexus.util.xml.XmlWriterUtil#writeComment(XMLWriter, String, int, int, int) does not check if the comment includes a &quot;--&gt;&quot; sequence. This means that text contained in the command string could be interpreted as XML, possibly leading to XML injection issues, depending on how this method is being called.> > -- github.com

        CVSS Score: 0

        OSSINDEX-d89d-15b4-33be

        Directory traversal in org.codehaus.plexus.util.Expand

        > org.codehaus.plexus.util.Expand does not guard against directory traversal, but such protection is generally expected from unarchiving tools.> > -- github.com

        CVSS Score: 0

    pkg:maven/org.codehaus.plexus/plexus-utils@2.0.4
      CRITICAL Vulnerabilities (1)

        [CVE-2017-1000487] Improper Neutralization of Special Elements used in a Command (Command Injection)

        Plexus-utils before 3.0.16 is vulnerable to command injection because it does not correctly process the contents of double quoted strings.

        CVSS Score: 9.8

        CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

      UNKNOWN Vulnerabilities (2)
        OSSINDEX-d093-0e6b-3210

        Possible XML Injection

        > org.codehaus.plexus.util.xml.XmlWriterUtil#writeComment(XMLWriter, String, int, int, int) does not check if the comment includes a &quot;--&gt;&quot; sequence. This means that text contained in the command string could be interpreted as XML, possibly leading to XML injection issues, depending on how this method is being called.> > -- github.com

        CVSS Score: 0

        OSSINDEX-d89d-15b4-33be

        Directory traversal in org.codehaus.plexus.util.Expand

        > org.codehaus.plexus.util.Expand does not guard against directory traversal, but such protection is generally expected from unarchiving tools.> > -- github.com

        CVSS Score: 0

    pkg:maven/org.codehaus.plexus/plexus-utils@2.0.4
      CRITICAL Vulnerabilities (1)

        [CVE-2017-1000487] Improper Neutralization of Special Elements used in a Command (Command Injection)

        Plexus-utils before 3.0.16 is vulnerable to command injection because it does not correctly process the contents of double quoted strings.

        CVSS Score: 9.8

        CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

      UNKNOWN Vulnerabilities (2)
        OSSINDEX-d093-0e6b-3210

        Possible XML Injection

        > org.codehaus.plexus.util.xml.XmlWriterUtil#writeComment(XMLWriter, String, int, int, int) does not check if the comment includes a &quot;--&gt;&quot; sequence. This means that text contained in the command string could be interpreted as XML, possibly leading to XML injection issues, depending on how this method is being called.> > -- github.com

        CVSS Score: 0

        OSSINDEX-d89d-15b4-33be

        Directory traversal in org.codehaus.plexus.util.Expand

        > org.codehaus.plexus.util.Expand does not guard against directory traversal, but such protection is generally expected from unarchiving tools.> > -- github.com

        CVSS Score: 0

    pkg:maven/org.codehaus.plexus/plexus-utils@2.0.4
      CRITICAL Vulnerabilities (1)

        [CVE-2017-1000487] Improper Neutralization of Special Elements used in a Command (Command Injection)

        Plexus-utils before 3.0.16 is vulnerable to command injection because it does not correctly process the contents of double quoted strings.

        CVSS Score: 9.8

        CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

      UNKNOWN Vulnerabilities (2)
        OSSINDEX-d093-0e6b-3210

        Possible XML Injection

        > org.codehaus.plexus.util.xml.XmlWriterUtil#writeComment(XMLWriter, String, int, int, int) does not check if the comment includes a &quot;--&gt;&quot; sequence. This means that text contained in the command string could be interpreted as XML, possibly leading to XML injection issues, depending on how this method is being called.> > -- github.com

        CVSS Score: 0

        OSSINDEX-d89d-15b4-33be

        Directory traversal in org.codehaus.plexus.util.Expand

        > org.codehaus.plexus.util.Expand does not guard against directory traversal, but such protection is generally expected from unarchiving tools.> > -- github.com

        CVSS Score: 0

    pkg:maven/org.codehaus.plexus/plexus-utils@2.0.4
      CRITICAL Vulnerabilities (1)

        [CVE-2017-1000487] Improper Neutralization of Special Elements used in a Command (Command Injection)

        Plexus-utils before 3.0.16 is vulnerable to command injection because it does not correctly process the contents of double quoted strings.

        CVSS Score: 9.8

        CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

      UNKNOWN Vulnerabilities (2)
        OSSINDEX-d093-0e6b-3210

        Possible XML Injection

        > org.codehaus.plexus.util.xml.XmlWriterUtil#writeComment(XMLWriter, String, int, int, int) does not check if the comment includes a &quot;--&gt;&quot; sequence. This means that text contained in the command string could be interpreted as XML, possibly leading to XML injection issues, depending on how this method is being called.> > -- github.com

        CVSS Score: 0

        OSSINDEX-d89d-15b4-33be

        Directory traversal in org.codehaus.plexus.util.Expand

        > org.codehaus.plexus.util.Expand does not guard against directory traversal, but such protection is generally expected from unarchiving tools.> > -- github.com

        CVSS Score: 0

    pkg:maven/org.codehaus.plexus/plexus-utils@2.0.4
      CRITICAL Vulnerabilities (1)

        [CVE-2017-1000487] Improper Neutralization of Special Elements used in a Command (Command Injection)

        Plexus-utils before 3.0.16 is vulnerable to command injection because it does not correctly process the contents of double quoted strings.

        CVSS Score: 9.8

        CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

      UNKNOWN Vulnerabilities (2)
        OSSINDEX-d093-0e6b-3210

        Possible XML Injection

        > org.codehaus.plexus.util.xml.XmlWriterUtil#writeComment(XMLWriter, String, int, int, int) does not check if the comment includes a &quot;--&gt;&quot; sequence. This means that text contained in the command string could be interpreted as XML, possibly leading to XML injection issues, depending on how this method is being called.> > -- github.com

        CVSS Score: 0

        OSSINDEX-d89d-15b4-33be

        Directory traversal in org.codehaus.plexus.util.Expand

        > org.codehaus.plexus.util.Expand does not guard against directory traversal, but such protection is generally expected from unarchiving tools.> > -- github.com

        CVSS Score: 0

    pkg:maven/org.codehaus.plexus/plexus-utils@2.0.4
      CRITICAL Vulnerabilities (1)

        [CVE-2017-1000487] Improper Neutralization of Special Elements used in a Command (Command Injection)

        Plexus-utils before 3.0.16 is vulnerable to command injection because it does not correctly process the contents of double quoted strings.

        CVSS Score: 9.8

        CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

      UNKNOWN Vulnerabilities (2)
        OSSINDEX-d093-0e6b-3210

        Possible XML Injection

        > org.codehaus.plexus.util.xml.XmlWriterUtil#writeComment(XMLWriter, String, int, int, int) does not check if the comment includes a &quot;--&gt;&quot; sequence. This means that text contained in the command string could be interpreted as XML, possibly leading to XML injection issues, depending on how this method is being called.> > -- github.com

        CVSS Score: 0

        OSSINDEX-d89d-15b4-33be

        Directory traversal in org.codehaus.plexus.util.Expand

        > org.codehaus.plexus.util.Expand does not guard against directory traversal, but such protection is generally expected from unarchiving tools.> > -- github.com

        CVSS Score: 0

    pkg:maven/org.codehaus.plexus/plexus-utils@2.0.4
      CRITICAL Vulnerabilities (1)

        [CVE-2017-1000487] Improper Neutralization of Special Elements used in a Command (Command Injection)

        Plexus-utils before 3.0.16 is vulnerable to command injection because it does not correctly process the contents of double quoted strings.

        CVSS Score: 9.8

        CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

      UNKNOWN Vulnerabilities (2)
        OSSINDEX-d093-0e6b-3210

        Possible XML Injection

        > org.codehaus.plexus.util.xml.XmlWriterUtil#writeComment(XMLWriter, String, int, int, int) does not check if the comment includes a &quot;--&gt;&quot; sequence. This means that text contained in the command string could be interpreted as XML, possibly leading to XML injection issues, depending on how this method is being called.> > -- github.com

        CVSS Score: 0

        OSSINDEX-d89d-15b4-33be

        Directory traversal in org.codehaus.plexus.util.Expand

        > org.codehaus.plexus.util.Expand does not guard against directory traversal, but such protection is generally expected from unarchiving tools.> > -- github.com

        CVSS Score: 0

    pkg:maven/org.codehaus.plexus/plexus-utils@2.0.4
      CRITICAL Vulnerabilities (1)

        [CVE-2017-1000487] Improper Neutralization of Special Elements used in a Command (Command Injection)

        Plexus-utils before 3.0.16 is vulnerable to command injection because it does not correctly process the contents of double quoted strings.

        CVSS Score: 9.8

        CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

      UNKNOWN Vulnerabilities (2)
        OSSINDEX-d093-0e6b-3210

        Possible XML Injection

        > org.codehaus.plexus.util.xml.XmlWriterUtil#writeComment(XMLWriter, String, int, int, int) does not check if the comment includes a &quot;--&gt;&quot; sequence. This means that text contained in the command string could be interpreted as XML, possibly leading to XML injection issues, depending on how this method is being called.> > -- github.com

        CVSS Score: 0

        OSSINDEX-d89d-15b4-33be

        Directory traversal in org.codehaus.plexus.util.Expand

        > org.codehaus.plexus.util.Expand does not guard against directory traversal, but such protection is generally expected from unarchiving tools.> > -- github.com

        CVSS Score: 0

    pkg:maven/org.codehaus.plexus/plexus-utils@2.0.4
      CRITICAL Vulnerabilities (1)

        [CVE-2017-1000487] Improper Neutralization of Special Elements used in a Command (Command Injection)

        Plexus-utils before 3.0.16 is vulnerable to command injection because it does not correctly process the contents of double quoted strings.

        CVSS Score: 9.8

        CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

      UNKNOWN Vulnerabilities (2)
        OSSINDEX-d093-0e6b-3210

        Possible XML Injection

        > org.codehaus.plexus.util.xml.XmlWriterUtil#writeComment(XMLWriter, String, int, int, int) does not check if the comment includes a &quot;--&gt;&quot; sequence. This means that text contained in the command string could be interpreted as XML, possibly leading to XML injection issues, depending on how this method is being called.> > -- github.com

        CVSS Score: 0

        OSSINDEX-d89d-15b4-33be

        Directory traversal in org.codehaus.plexus.util.Expand

        > org.codehaus.plexus.util.Expand does not guard against directory traversal, but such protection is generally expected from unarchiving tools.> > -- github.com

        CVSS Score: 0

    pkg:maven/org.codehaus.plexus/plexus-utils@2.0.4
      CRITICAL Vulnerabilities (1)

        [CVE-2017-1000487] Improper Neutralization of Special Elements used in a Command (Command Injection)

        Plexus-utils before 3.0.16 is vulnerable to command injection because it does not correctly process the contents of double quoted strings.

        CVSS Score: 9.8

        CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

      UNKNOWN Vulnerabilities (2)
        OSSINDEX-d093-0e6b-3210

        Possible XML Injection

        > org.codehaus.plexus.util.xml.XmlWriterUtil#writeComment(XMLWriter, String, int, int, int) does not check if the comment includes a &quot;--&gt;&quot; sequence. This means that text contained in the command string could be interpreted as XML, possibly leading to XML injection issues, depending on how this method is being called.> > -- github.com

        CVSS Score: 0

        OSSINDEX-d89d-15b4-33be

        Directory traversal in org.codehaus.plexus.util.Expand

        > org.codehaus.plexus.util.Expand does not guard against directory traversal, but such protection is generally expected from unarchiving tools.> > -- github.com

        CVSS Score: 0

    pkg:maven/org.codehaus.plexus/plexus-utils@2.0.4
      CRITICAL Vulnerabilities (1)

        [CVE-2017-1000487] Improper Neutralization of Special Elements used in a Command (Command Injection)

        Plexus-utils before 3.0.16 is vulnerable to command injection because it does not correctly process the contents of double quoted strings.

        CVSS Score: 9.8

        CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

      UNKNOWN Vulnerabilities (2)
        OSSINDEX-d093-0e6b-3210

        Possible XML Injection

        > org.codehaus.plexus.util.xml.XmlWriterUtil#writeComment(XMLWriter, String, int, int, int) does not check if the comment includes a &quot;--&gt;&quot; sequence. This means that text contained in the command string could be interpreted as XML, possibly leading to XML injection issues, depending on how this method is being called.> > -- github.com

        CVSS Score: 0

        OSSINDEX-d89d-15b4-33be

        Directory traversal in org.codehaus.plexus.util.Expand

        > org.codehaus.plexus.util.Expand does not guard against directory traversal, but such protection is generally expected from unarchiving tools.> > -- github.com

        CVSS Score: 0

    pkg:maven/org.codehaus.plexus/plexus-utils@2.0.4
      CRITICAL Vulnerabilities (1)

        [CVE-2017-1000487] Improper Neutralization of Special Elements used in a Command (Command Injection)

        Plexus-utils before 3.0.16 is vulnerable to command injection because it does not correctly process the contents of double quoted strings.

        CVSS Score: 9.8

        CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

      UNKNOWN Vulnerabilities (2)
        OSSINDEX-d093-0e6b-3210

        Possible XML Injection

        > org.codehaus.plexus.util.xml.XmlWriterUtil#writeComment(XMLWriter, String, int, int, int) does not check if the comment includes a &quot;--&gt;&quot; sequence. This means that text contained in the command string could be interpreted as XML, possibly leading to XML injection issues, depending on how this method is being called.> > -- github.com

        CVSS Score: 0

        OSSINDEX-d89d-15b4-33be

        Directory traversal in org.codehaus.plexus.util.Expand

        > org.codehaus.plexus.util.Expand does not guard against directory traversal, but such protection is generally expected from unarchiving tools.> > -- github.com

        CVSS Score: 0

    pkg:maven/org.codehaus.plexus/plexus-utils@2.0.4
      CRITICAL Vulnerabilities (1)

        [CVE-2017-1000487] Improper Neutralization of Special Elements used in a Command (Command Injection)

        Plexus-utils before 3.0.16 is vulnerable to command injection because it does not correctly process the contents of double quoted strings.

        CVSS Score: 9.8

        CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

      UNKNOWN Vulnerabilities (2)
        OSSINDEX-d093-0e6b-3210

        Possible XML Injection

        > org.codehaus.plexus.util.xml.XmlWriterUtil#writeComment(XMLWriter, String, int, int, int) does not check if the comment includes a &quot;--&gt;&quot; sequence. This means that text contained in the command string could be interpreted as XML, possibly leading to XML injection issues, depending on how this method is being called.> > -- github.com

        CVSS Score: 0

        OSSINDEX-d89d-15b4-33be

        Directory traversal in org.codehaus.plexus.util.Expand

        > org.codehaus.plexus.util.Expand does not guard against directory traversal, but such protection is generally expected from unarchiving tools.> > -- github.com

        CVSS Score: 0

(at-me [in a reply](https://help.sonatype.com/lift/talking-to-lift) with `help` or `ignore`)

<groupId>org.apache.maven.shared</groupId>
<artifactId>maven-dependency-tree</artifactId>
<version>2.2</version>
</dependency>

<dependency>
Expand Down
8 changes: 7 additions & 1 deletion ...r-rules/src/main/java/org/sonatype/ossindex/maven/enforcer/BanVulnerableDependencies.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,6 +20,8 @@
import javax.annotation.Nonnull;
import javax.annotation.Nullable;

import org.apache.maven.project.DefaultProjectBuildingRequest;
import org.apache.maven.project.ProjectBuildingRequest;
import org.sonatype.ossindex.maven.common.ComponentReportAssistant;
import org.sonatype.ossindex.maven.common.ComponentReportRequest;
import org.sonatype.ossindex.maven.common.ComponentReportResult;
Expand Down Expand Up @@ -312,7 +314,11 @@ private Set<Artifact> resolveDependencies() throws DependencyGraphBuilderExcepti
artifactFilter = new CumulativeScopeArtifactFilter(scopes);
}

DependencyNode node = graphBuilder.buildDependencyGraph(project, artifactFilter);
ProjectBuildingRequest buildingRequest =
new DefaultProjectBuildingRequest( session.getProjectBuildingRequest() );
buildingRequest.setProject( project );

DependencyNode node = graphBuilder.buildDependencyGraph(buildingRequest, artifactFilter);
collectArtifacts(result, node);

return result;
Expand Down
17 changes: 9 additions & 8 deletions pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -92,10 +92,11 @@
</distributionManagement>

<properties>
<maven.compiler.source>1.7</maven.compiler.source>
<maven.compiler.target>1.7</maven.compiler.target>
<maven.compiler.source>1.8</maven.compiler.source>
<maven.compiler.target>1.8</maven.compiler.target>

<apache-maven.version>3.0</apache-maven.version>
<apache-maven.version>3.5.0</apache-maven.version>
<maven.plugin-annotations.version>3.6.0</maven.plugin-annotations.version>
<jackson.version>2.9.10</jackson.version>
<dionysus.version>1.0.3</dionysus.version>

Expand Down Expand Up @@ -137,7 +138,7 @@
<dependency>
<groupId>org.sonatype.ossindex</groupId>
<artifactId>ossindex-service-client</artifactId>
<version>1.1.1</version>
<version>1.8.1</version>
</dependency>

<dependency>
Expand All @@ -149,7 +150,7 @@
<dependency>
<groupId>org.apache.maven.plugin-tools</groupId>
<artifactId>maven-plugin-annotations</artifactId>
<version>${apache-maven.version}</version>
<version>${maven.plugin-annotations.version}</version>
</dependency>

<dependency>
Expand Down Expand Up @@ -185,7 +186,7 @@
<dependency>
<groupId>org.apache.maven.shared</groupId>
<artifactId>maven-dependency-tree</artifactId>
<version>3.0.1</version>
<version>3.1.0</version>
</dependency>

<dependency>
Expand Down Expand Up @@ -365,7 +366,7 @@
<configuration>
<rules>
<byteCodeRule implementation="org.owasp.maven.enforcer.rule.ClassFileFormatRule">
<supportedClassFileFormat>51</supportedClassFileFormat>
<supportedClassFileFormat>52</supportedClassFileFormat>
</byteCodeRule>
</rules>
</configuration>
Expand All @@ -379,7 +380,7 @@
<configuration>
<signature>
<groupId>org.codehaus.mojo.signature</groupId>
<artifactId>java17</artifactId>
<artifactId>java18</artifactId>
<version>1.0</version>
</signature>
</configuration>
Expand Down