Skip to content

Commit 31deafb

Browse files
vemvvemv
committed
4.0.0
1 parent b95a0a8 commit 31deafb

File tree

12 files changed

+99
-51
lines changed

12 files changed

+99
-51
lines changed

‎.github/ISSUE_TEMPLATE/bug.yml

+2-2
Original file line numberDiff line numberDiff line change
@@ -48,8 +48,8 @@ body:
4848
label: Installation compliance
4949
description:
5050
options:
51-
- label: I have read again and made sure that I'm following **exactly** the instructions for my tool of choice ([Leiningen](https://github.com/rm-hull/nvd-clojure/tree/v3.6.0#leiningen), [Clojure CLI](https://github.com/rm-hull/nvd-clojure/tree/v3.6.0#clojure-cli), [Clojure CLI Tool](https://github.com/rm-hull/nvd-clojure/tree/v3.6.0#clojure-cli-tool)).
51+
- label: I have read again and made sure that I'm following **exactly** the instructions for my tool of choice ([Leiningen](https://github.com/rm-hull/nvd-clojure/tree/v4.0.0#leiningen), [Clojure CLI](https://github.com/rm-hull/nvd-clojure/tree/v4.0.0#clojure-cli), [Clojure CLI Tool](https://github.com/rm-hull/nvd-clojure/tree/v4.0.0#clojure-cli-tool)).
5252
required: true
53-
- label: I understand that false positives [can be skipped locally](https://github.com/rm-hull/nvd-clojure/tree/v3.6.0#configuration-options) and should be reported to [DependencyCheck](https://github.com/jeremylong/DependencyCheck).
53+
- label: I understand that false positives [can be skipped locally](https://github.com/rm-hull/nvd-clojure/tree/v4.0.0#configuration-options) and should be reported to [DependencyCheck](https://github.com/jeremylong/DependencyCheck).
5454
required: false
5555

‎.github/ISSUE_TEMPLATE/issue.yml

+2-2
Original file line numberDiff line numberDiff line change
@@ -32,8 +32,8 @@ body:
3232
label: Installation compliance
3333
description:
3434
options:
35-
- label: I have read again and made sure that I'm following **exactly** the instructions for my tool of choice ([Leiningen](https://github.com/rm-hull/nvd-clojure/tree/v3.6.0#leiningen), [Clojure CLI](https://github.com/rm-hull/nvd-clojure/tree/v3.6.0#clojure-cli), [Clojure CLI Tool](https://github.com/rm-hull/nvd-clojure/tree/v3.6.0#clojure-cli-tool)).
35+
- label: I have read again and made sure that I'm following **exactly** the instructions for my tool of choice ([Leiningen](https://github.com/rm-hull/nvd-clojure/tree/v4.0.0#leiningen), [Clojure CLI](https://github.com/rm-hull/nvd-clojure/tree/v4.0.0#clojure-cli), [Clojure CLI Tool](https://github.com/rm-hull/nvd-clojure/tree/v4.0.0#clojure-cli-tool)).
3636
required: true
37-
- label: I understand that false positives [can be skipped locally](https://github.com/rm-hull/nvd-clojure/tree/v3.6.0#configuration-options) and should be reported to [DependencyCheck](https://github.com/jeremylong/DependencyCheck).
37+
- label: I understand that false positives [can be skipped locally](https://github.com/rm-hull/nvd-clojure/tree/v4.0.0#configuration-options) and should be reported to [DependencyCheck](https://github.com/jeremylong/DependencyCheck).
3838
required: false
3939

‎.github/dogfooding_suppressions.xml

+8
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,14 @@
3737
<filePath regex="true">.*\bbcprov-jdk18on-1\.71\.jar</filePath>
3838
<cve>CVE-2023-33201</cve>
3939
</suppress>
40+
<suppress>
41+
<filePath regex="true">.*\bbcprov-jdk18on-1\.71\.jar</filePath>
42+
<cve>CVE-2023-33202</cve>
43+
</suppress>
44+
<suppress>
45+
<filePath regex="true">.*\bbcpg-jdk18on-1\.71\.jar</filePath>
46+
<cve>CVE-2023-33202</cve>
47+
</suppress>
4048
<suppress base="true">
4149
<packageUrl regex="true">^pkg:maven/org\.codehaus\.plexus/plexus-.*$</packageUrl>
4250
<cpe>cpe:/a:codehaus-plexus_project:codehaus-plexus</cpe>

‎.github/workflows/ci.yaml

+4
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,8 @@ on:
1111
jobs:
1212
test_suite:
1313
name: Linting and tests
14+
env:
15+
NVD_API_TOKEN: ${{ secrets.NVD_API_TOKEN }}
1416
runs-on: ubuntu-latest
1517
strategy:
1618
matrix:
@@ -39,6 +41,8 @@ jobs:
3941
continue-on-error: true
4042
integration:
4143
name: Integration test suite
44+
env:
45+
NVD_API_TOKEN: ${{ secrets.NVD_API_TOKEN }}
4246
runs-on: ubuntu-latest
4347
strategy:
4448
matrix:

‎CHANGELOG.md

+7
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,10 @@
1+
## Changes from 4.0.0 to 4.0.0
2+
3+
* Update `dependency-check-core` to the 9.x series ([9.0.8](https://github.com/jeremylong/DependencyCheck/blob/v9.0.8/CHANGELOG.md))
4+
* This **requires** nvd-clojure users to request a NVD API key and configure it correctly.
5+
* You can [obtain an API key](https://nvd.nist.gov/developers/request-an-api-key) in a few minutes - it's an automated process.
6+
* Then, you can configure it in nvd-clojure by setting it in the `:nvd-api :key` path, or as a `NVD_API_TOKEN` environment variable.
7+
18
## Changes from 3.5.0 to 3.6.0
29

310
* Update `dependency-check-core`.

‎Makefile

+1-1
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22

33
# Example usage:
44
# copy a one-off Clojars token to your clipboard
5-
# GIT_TAG=v3.6.0 CLOJARS_USERNAME=$USER CLOJARS_PASSWORD=$(pbpaste) make deploy
5+
# GIT_TAG=v4.0.0 CLOJARS_USERNAME=$USER CLOJARS_PASSWORD=$(pbpaste) make deploy
66

77
deploy: check-env
88
lein clean

‎README.md

+9-6
Original file line numberDiff line numberDiff line change
@@ -18,18 +18,18 @@ will be checked for known security vulnerabilities. `nvd-clojure` passes them to
1818
1919
### Installation and basic usage
2020

21-
> _Please see also:_ [Avoiding classpath interference](https://github.com/rm-hull/nvd-clojure/blob/v3.6.0/FAQ.md#what-is-classpath-interference)
21+
> _Please see also:_ [Avoiding classpath interference](https://github.com/rm-hull/nvd-clojure/blob/v4.0.0/FAQ.md#what-is-classpath-interference)
2222
2323
#### Leiningen
2424

2525
<details>
2626

27-
Please create a separate project consisting of `[nvd-clojure/nvd-clojure "3.6.0"]`. Said project can be located inside the targeted repo's Git repository.
27+
Please create a separate project consisting of `[nvd-clojure/nvd-clojure "4.0.0"]`. Said project can be located inside the targeted repo's Git repository.
2828

2929
```clj
3030
(defproject nvd-helper "local"
3131
:description "nvd-clojure helper project"
32-
:dependencies [[nvd-clojure "3.6.0"]
32+
:dependencies [[nvd-clojure "4.0.0"]
3333
[org.clojure/clojure "1.11.1"]]
3434
:jvm-opts ["-Dclojure.main.report=stderr"])
3535
```
@@ -54,7 +54,7 @@ If you are using a multi-modules solution (e.g. `lein-monolith`), you should ens
5454

5555
<details>
5656

57-
Please create a separate project consisting exclusively of `nvd-clojure/nvd-clojure {:mvn/version "3.6.0"}`. Said project can be located inside the targeted repo's Git repository.
57+
Please create a separate project consisting exclusively of `nvd-clojure/nvd-clojure {:mvn/version "4.0.0"}`. Said project can be located inside the targeted repo's Git repository.
5858

5959
Please do not add nvd-clojure as a dependency in the deps.edn of the project to be analysed.
6060

@@ -155,7 +155,7 @@ dependency relationships are:
155155
dependencies, and suggest upgraded versions, and can optionally be configured
156156
to update the project file.
157157

158-
(Note that that is only one of the multiple ways of remediating a given vulnerability, please see [FAQ](https://github.com/rm-hull/nvd-clojure/blob/v3.6.0/FAQ.md#how-to-remediate-a-cve-is-it-a-good-idea-to-automate-remediation))
158+
(Note that that is only one of the multiple ways of remediating a given vulnerability, please see [FAQ](https://github.com/rm-hull/nvd-clojure/blob/v4.0.0/FAQ.md#how-to-remediate-a-cve-is-it-a-good-idea-to-automate-remediation))
159159

160160
## Configuration
161161

@@ -180,6 +180,9 @@ wiki.
180180

181181
There are some specific settings below which are worthy of a few comments:
182182

183+
* `:nvd-api` - map of:
184+
* :key - **MANDATORY** (unless you set an `NVD_API_TOKEN` environment variable) - must contain an API key that you can obtain in https://nvd.nist.gov/developers/request-an-api-key
185+
* other keys: `:endpoint`, `:delay`, `:max-retry-count`, `:valid-for-hours`, `:datafeed` - advanced, please refer to the source code.
183186
* `:fail-threshold` default value `0`; checks the highest CVSS score across all dependencies, and fails if this threshold is breached.
184187
- As CVSS score ranges from `0..10`, the default value will cause a build to fail even for the lowest rated
185188
vulnerability.
@@ -209,7 +212,7 @@ You can also set logging properties directly through Java system properties (the
209212
clojure -J-Dclojure.main.report=stderr -J-Dorg.slf4j.simpleLogger.log.org.apache.commons=error -Tnvd nvd.task/check # ...
210213
```
211214

212-
## [FAQ](https://github.com/rm-hull/nvd-clojure/blob/v3.6.0/FAQ.md)
215+
## [FAQ](https://github.com/rm-hull/nvd-clojure/blob/v4.0.0/FAQ.md)
213216

214217
## Attribution
215218

‎deps.edn

+3-3
Original file line numberDiff line numberDiff line change
@@ -2,9 +2,9 @@
22
:deps {org.clojure/clojure {:mvn/version "1.11.1"}
33
org.clojure/java.classpath {:mvn/version "1.0.0"}
44
clansi/clansi {:mvn/version "1.0.0"}
5-
org.clojure/data.json {:mvn/version "2.4.0"}
6-
org.slf4j/slf4j-simple {:mvn/version "2.0.9"}
7-
org.owasp/dependency-check-core {:mvn/version "8.4.3"}
5+
org.clojure/data.json {:mvn/version "2.5.0"}
6+
org.slf4j/slf4j-simple {:mvn/version "2.0.10"}
7+
org.owasp/dependency-check-core {:mvn/version "9.0.8"}
88
rm-hull/table {:mvn/version "0.7.1"}
99
trptcolin/versioneer {:mvn/version "0.2.0"}}
1010
:mvn/repos {"central" {:url "https://repo1.maven.org/maven2/"}

‎project.clj

+18-18
Original file line numberDiff line numberDiff line change
@@ -1,30 +1,30 @@
1-
(defproject nvd-clojure "3.6.0"
1+
(defproject nvd-clojure "4.0.0"
22
:description "National Vulnerability Database dependency checker"
33
:url "https://github.com/rm-hull/nvd-clojure"
44
:license {:name "The MIT License (MIT)"
55
:url "https://opensource.org/licenses/MIT"}
66
:dependencies [[org.clojure/clojure "1.11.1"]
77
[clansi "1.0.0"]
8-
[org.clojure/data.json "2.4.0"]
9-
[org.slf4j/slf4j-simple "2.0.9"]
10-
[org.owasp/dependency-check-core "8.4.3"]
8+
[org.clojure/data.json "2.5.0"]
9+
[org.slf4j/slf4j-simple "2.0.10"]
10+
[org.owasp/dependency-check-core "9.0.8"]
1111
[rm-hull/table "0.7.1"]
1212
[trptcolin/versioneer "0.2.0"]
1313
;; Explicitly depend on a certain Jackson, consistently.
1414
;; (See also: https://github.com/jeremylong/DependencyCheck/issues/3441)
15-
[com.fasterxml.jackson.core/jackson-databind "2.16.0"]
16-
[com.fasterxml.jackson.core/jackson-annotations "2.16.0"]
17-
[com.fasterxml.jackson.core/jackson-core "2.16.0"]
18-
[com.fasterxml.jackson.module/jackson-module-afterburner "2.16.0"]
19-
[org.apache.maven.resolver/maven-resolver-transport-http "1.9.16" #_"Fixes a CVE"]
15+
[com.fasterxml.jackson.core/jackson-databind "2.16.1"]
16+
[com.fasterxml.jackson.core/jackson-annotations "2.16.1"]
17+
[com.fasterxml.jackson.core/jackson-core "2.16.1"]
18+
[com.fasterxml.jackson.module/jackson-module-afterburner "2.16.1"]
19+
[org.apache.maven.resolver/maven-resolver-transport-http "1.9.18" #_"Fixes a CVE"]
2020
[org.yaml/snakeyaml "2.2" #_"Fixes a CVE"]
21-
[org.apache.maven/maven-core "3.9.5" #_"Fixes a CVE"]
22-
[org.eclipse.jetty/jetty-client "12.0.3" #_"Fixes a CVE" :exclusions [org.slf4j/slf4j-api]]
23-
[org.apache.maven.resolver/maven-resolver-spi "1.9.16" #_"Satisfies :pedantic?"]
24-
[org.apache.maven.resolver/maven-resolver-api "1.9.16" #_"Satisfies :pedantic?"]
25-
[org.apache.maven.resolver/maven-resolver-util "1.9.16" #_"Satisfies :pedantic?"]
26-
[org.apache.maven.resolver/maven-resolver-impl "1.9.16" #_"Satisfies :pedantic?"]
27-
[org.apache.maven/maven-resolver-provider "3.9.5" #_"Satisfies :pedantic?"]
21+
[org.apache.maven/maven-core "3.9.6" #_"Fixes a CVE"]
22+
[org.eclipse.jetty/jetty-client "12.0.5" #_"Fixes a CVE" :exclusions [org.slf4j/slf4j-api]]
23+
[org.apache.maven.resolver/maven-resolver-spi "1.9.18" #_"Satisfies :pedantic?"]
24+
[org.apache.maven.resolver/maven-resolver-api "1.9.18" #_"Satisfies :pedantic?"]
25+
[org.apache.maven.resolver/maven-resolver-util "1.9.18" #_"Satisfies :pedantic?"]
26+
[org.apache.maven.resolver/maven-resolver-impl "1.9.18" #_"Satisfies :pedantic?"]
27+
[org.apache.maven/maven-resolver-provider "3.9.6" #_"Satisfies :pedantic?"]
2828
[org.codehaus.plexus/plexus-utils "4.0.0" #_"Satisfies :pedantic?"]]
2929
:managed-dependencies [[com.google.code.gson/gson "2.10.1"]]
3030
:scm {:url "[email protected]:rm-hull/nvd-clojure.git"}
@@ -43,10 +43,10 @@
4343
[jonase/eastwood "1.4.0"]]
4444
:eastwood {:add-linters [:boxed-math
4545
:performance]}
46-
:dependencies [[clj-kondo "2023.10.20"]
46+
:dependencies [[clj-kondo "2023.12.15"]
4747
[commons-collections "20040616"]]}
4848
:ci {:pedantic? :abort}
49-
:clj-kondo {:dependencies [[clj-kondo "2023.10.20"]]}
49+
:clj-kondo {:dependencies [[clj-kondo "2023.12.15"]]}
5050
:skip-self-check {:jvm-opts ["-Dnvd-clojure.internal.skip-self-check=true"]}}
5151
:deploy-repositories [["clojars" {:url "https://clojars.org/repo"
5252
:username :env/clojars_username

‎resources/nvd_clojure/default_config_content.edn

+5-1
Original file line numberDiff line numberDiff line change
@@ -6,12 +6,16 @@
66

77
;; Feel free to tweak it, version-control it and remove any comment.
88

9-
;; Configuration reference: https://github.com/rm-hull/nvd-clojure/tree/v3.6.0#configuration-options
9+
;; Configuration reference: https://github.com/rm-hull/nvd-clojure/tree/v4.0.0#configuration-options
1010

1111
{;; You can use the `:suppression-file` in order to silence false positives.
1212
;; This file will be automatically created, with whatever filename is specified here, if it didn't exist already.
1313
:suppression-file "nvd_suppressions.xml"
1414

15+
;; MANDATORY - please set this (or a `NVD_API_TOKEN` environment variable, deleting this entry)
16+
;; according to an API key that you can obtain in https://nvd.nist.gov/developers/request-an-api-key
17+
:nvd-api {:key nil}
18+
1519
#_:analyzer ;; Analyzer options, which are mostly advanced/internal
1620
#_{:ossindex-warn-only-on-remote-errors
1721
;; Occasionally necessary for not making HTTP 500 errors from OSS Index (one of the multiple analyzers internally used)

‎src/nvd/config.clj

+21-8
Original file line numberDiff line numberDiff line change
@@ -46,10 +46,15 @@
4646
Settings$KEYS/DB_DRIVER_PATH [:database :driver-path]
4747
Settings$KEYS/DB_CONNECTION_STRING [:database :connection-string]
4848
Settings$KEYS/DB_USER [:database :user]
49-
Settings$KEYS/DB_PASSWORD [:database :password]})
50-
51-
(def ^:private integer-mappings
52-
{Settings$KEYS/CVE_CHECK_VALID_FOR_HOURS [:cve :valid-for-hours]})
49+
Settings$KEYS/DB_PASSWORD [:database :password]
50+
Settings$KEYS/NVD_API_KEY [:nvd-api :key]
51+
Settings$KEYS/NVD_API_ENDPOINT [:nvd-api :endpoint]
52+
Settings$KEYS/NVD_API_DELAY [:nvd-api :delay]
53+
Settings$KEYS/NVD_API_MAX_RETRY_COUNT [:nvd-api :max-retry-count]
54+
Settings$KEYS/NVD_API_VALID_FOR_HOURS [:nvd-api :valid-for-hours]
55+
Settings$KEYS/NVD_API_DATAFEED_URL [:nvd-api :datafeed :url]
56+
Settings$KEYS/NVD_API_DATAFEED_USER [:nvd-api :datafeed :user]
57+
Settings$KEYS/NVD_API_DATAFEED_PASSWORD [:nvd-api :datafeed :password]})
5358

5459
(def ^:private boolean-mappings
5560
{Settings$KEYS/ANALYZER_ARCHIVE_ENABLED [:analyzer :archive-enabled]
@@ -100,7 +105,9 @@
100105
{:exit-after-check true
101106
:delete-config? true
102107
:verbose-summary false
103-
:nvd {:analyzer {:assembly-enabled false
108+
:nvd {:nvd-api {:delay 5000 ;; Value based on https://github.com/jeremylong/DependencyCheck/commit/be5c4a4f39d
109+
:max-retry-count 10}
110+
:analyzer {:assembly-enabled false
104111
:archive-enabled true
105112
:autoconf-enabled false
106113
:bundle-audit-enabled false
@@ -187,15 +194,21 @@ You can pass an empty string for an .edn file to be automatically created."
187194

188195
(maybe-create-suppression-file! nvd-settings)
189196

190-
(doseq [[prop path] integer-mappings]
191-
(.setIntIfNotNull settings prop (get-in nvd-settings path)))
192-
193197
(doseq [[prop path] boolean-mappings]
194198
(.setBooleanIfNotNull settings prop (get-in nvd-settings path)))
195199

196200
(doseq [[prop path] string-mappings]
197201
(.setStringIfNotEmpty settings prop (str (get-in nvd-settings path))))
198202

203+
(when (= ::not-found (get-in nvd-settings [:nvd-api :key] ::not-found))
204+
(let [api-key (System/getenv "NVD_API_TOKEN")]
205+
206+
(when (or (not api-key)
207+
(string/blank? api-key))
208+
(throw (ex-info "No NVD API key supplied as config settings or env var." {})))
209+
210+
(.setString settings Settings$KEYS/NVD_API_KEY api-key)))
211+
199212
(-> project
200213
(assoc-in [:nvd :data-directory] (.getDataDirectory settings))
201214
(assoc :engine (Engine. settings)

‎src/nvd/report.clj

+19-10
Original file line numberDiff line numberDiff line change
@@ -22,16 +22,17 @@
2222

2323
(ns nvd.report
2424
(:require
25-
[clojure.string :as s]
26-
[clojure.java.io :as io]
2725
[clansi :refer [style]]
26+
[clojure.java.io :as io]
27+
[clojure.string :as s]
28+
[nvd.log :as log]
2829
[table.core :refer [table]])
2930
(:import
30-
[java.util Arrays]
31-
[org.owasp.dependencycheck Engine]
32-
[org.owasp.dependencycheck.dependency Dependency Vulnerability]
33-
[org.owasp.dependencycheck.exception ExceptionCollection]
34-
[org.owasp.dependencycheck.reporting ReportGenerator]))
31+
(java.util Arrays)
32+
(org.owasp.dependencycheck Engine)
33+
(org.owasp.dependencycheck.dependency Dependency Vulnerability)
34+
(org.owasp.dependencycheck.exception ExceptionCollection)
35+
(org.owasp.dependencycheck.reporting ReportGenerator)))
3536

3637
(def default-output-dir "target/nvd")
3738

@@ -53,9 +54,17 @@
5354
(let [cvss2 (.getCvssV2 vulnerability)
5455
cvss3 (.getCvssV3 vulnerability)]
5556
(cond
56-
cvss2 (.getScore cvss2)
57-
cvss3 (.getBaseScore cvss3)
58-
:else 1)))
57+
cvss2 (max (double (or (.getExploitabilityScore cvss2)
58+
0))
59+
(double (or (.getImpactScore cvss2)
60+
0)))
61+
cvss3 (max (double (or (.getExploitabilityScore cvss3)
62+
0))
63+
(double (or (.getImpactScore cvss3)
64+
0)))
65+
:else (do
66+
(.warn log/logger (str "No CVSS found for: " (pr-str vulnerability)))
67+
1))))
5968

6069
(defn- severity [^long cvssScore]
6170
(cond

0 commit comments

Comments
 (0)