Skip to content

Commit e7a8de6

Browse files
valentijnscholtenvalentijnscholten
committed
finalization
Signed-off-by: Valentijn Scholten <[email protected]>
1 parent 65e798c commit e7a8de6

File tree

12 files changed

+593
-100
lines changed

12 files changed

+593
-100
lines changed

‎src/main/java/org/dependencytrack/model/Repository.java

Lines changed: 13 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -65,6 +65,11 @@ public class Repository implements Serializable {
6565
@JsonDeserialize(using = TrimmedStringDeserializer.class)
6666
private String identifier;
6767

68+
@Persistent
69+
@Column(name = "DESCRIPTION")
70+
@JsonDeserialize(using = TrimmedStringDeserializer.class)
71+
private String description;
72+
6873
@Persistent
6974
@Column(name = "URL")
7075
@NotBlank
@@ -100,8 +105,6 @@ public class Repository implements Serializable {
100105
@Column(name = "PASSWORD")
101106
private String password;
102107

103-
//TODO VS Add Description field
104-
105108
@Persistent
106109
@Column(name = "CONFIG", jdbcType = "CLOB")
107110
@JsonDeserialize(using = TrimmedStringDeserializer.class)
@@ -138,6 +141,14 @@ public void setIdentifier(String identifier) {
138141
this.identifier = identifier;
139142
}
140143

144+
public String getDescription() {
145+
return description;
146+
}
147+
148+
public void setDescription(String description) {
149+
this.description = description;
150+
}
151+
141152
public String getUrl() {
142153
return url;
143154
}

‎src/main/java/org/dependencytrack/persistence/DefaultObjectGenerator.java

Lines changed: 18 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -214,24 +214,24 @@ private List<Permission> getBadgesPermissions(final List<Permission> fullList) {
214214
public void loadDefaultRepositories() {
215215
try (QueryManager qm = new QueryManager()) {
216216
LOGGER.info("Synchronizing default repositories to datastore");
217-
qm.createRepository(RepositoryType.CPAN, "cpan-public-registry", "https://fastapi.metacpan.org/v1/", true, false, false, null, null, null);
218-
qm.createRepository(RepositoryType.GEM, "rubygems.org", "https://rubygems.org/", true, false, false, null, null, null);
219-
qm.createRepository(RepositoryType.HEX, "hex.pm", "https://hex.pm/", true, false, false, null, null, null);
220-
qm.createRepository(RepositoryType.HACKAGE, "hackage.haskell.org", "https://hackage.haskell.org/", true, false, false, null, null, null);
221-
qm.createRepository(RepositoryType.MAVEN, "central", "https://repo1.maven.org/maven2/", true, false, false, null, null, null);
222-
qm.createRepository(RepositoryType.MAVEN, "atlassian-public", "https://packages.atlassian.com/content/repositories/atlassian-public/", true, false, false, null, null, null);
223-
qm.createRepository(RepositoryType.MAVEN, "jboss-releases", "https://repository.jboss.org/nexus/content/repositories/releases/", true, false, false, null, null, null);
224-
qm.createRepository(RepositoryType.MAVEN, "clojars", "https://repo.clojars.org/", true, false, false, null, null, null);
225-
qm.createRepository(RepositoryType.MAVEN, "google-android", "https://maven.google.com/", true, false, false, null, null, null);
226-
qm.createRepository(RepositoryType.NIXPKGS, "nixpkgs-unstable", "https://channels.nixos.org/nixpkgs-unstable/packages.json.br", true, false, false, null, null, null);
227-
qm.createRepository(RepositoryType.NPM, "npm-public-registry", "https://registry.npmjs.org/", true, false, false, null, null, null);
228-
qm.createRepository(RepositoryType.PYPI, "pypi.org", "https://pypi.org/", true, false, false, null, null, null);
229-
qm.createRepository(RepositoryType.NUGET, "nuget-gallery", "https://api.nuget.org/", true, false, false, null, null, null);
230-
qm.createRepository(RepositoryType.COMPOSER, "packagist", "https://repo.packagist.org/", true, false, false, null, null, null);
231-
qm.createRepository(RepositoryType.COMPOSER, "drupal8", "https://packages.drupal.org/8", false, false, false, null, null, null);
232-
qm.createRepository(RepositoryType.CARGO, "crates.io", "https://crates.io", true, false, false, null, null, null);
233-
qm.createRepository(RepositoryType.GO_MODULES, "proxy.golang.org", "https://proxy.golang.org", true, false, false, null, null, null);
234-
qm.createRepository(RepositoryType.GITHUB, "github.com", "https://github.com", true, false, false, null, null, null);
217+
qm.createRepository(RepositoryType.CPAN, "cpan-public-registry", null, "https://fastapi.metacpan.org/v1/", true, false, false, null, null, null);
218+
qm.createRepository(RepositoryType.GEM, "rubygems.org", null, "https://rubygems.org/", true, false, false, null, null, null);
219+
qm.createRepository(RepositoryType.HEX, "hex.pm", null, "https://hex.pm/", true, false, false, null, null, null);
220+
qm.createRepository(RepositoryType.HACKAGE, "hackage.haskell.org", null, "https://hackage.haskell.org/", true, false, false, null, null, null);
221+
qm.createRepository(RepositoryType.MAVEN, "central", null, "https://repo1.maven.org/maven2/", true, false, false, null, null, null);
222+
qm.createRepository(RepositoryType.MAVEN, "atlassian-public", null, "https://packages.atlassian.com/content/repositories/atlassian-public/", true, false, false, null, null, null);
223+
qm.createRepository(RepositoryType.MAVEN, "jboss-releases", null, "https://repository.jboss.org/nexus/content/repositories/releases/", true, false, false, null, null, null);
224+
qm.createRepository(RepositoryType.MAVEN, "clojars", null, "https://repo.clojars.org/", true, false, false, null, null, null);
225+
qm.createRepository(RepositoryType.MAVEN, "google-android", null, "https://maven.google.com/", true, false, false, null, null, null);
226+
qm.createRepository(RepositoryType.NIXPKGS, "nixpkgs-unstable", null, "https://channels.nixos.org/nixpkgs-unstable/packages.json.br", true, false, false, null, null, null);
227+
qm.createRepository(RepositoryType.NPM, "npm-public-registry", null, "https://registry.npmjs.org/", true, false, false, null, null, null);
228+
qm.createRepository(RepositoryType.PYPI, "pypi.org", null, "https://pypi.org/", true, false, false, null, null, null);
229+
qm.createRepository(RepositoryType.NUGET, "nuget-gallery", null, "https://api.nuget.org/", true, false, false, null, null, null);
230+
qm.createRepository(RepositoryType.COMPOSER, "packagist", null, "https://repo.packagist.org/", true, false, false, null, null, null);
231+
qm.createRepository(RepositoryType.COMPOSER, "drupal8", null, "https://packages.drupal.org/8", false, false, false, null, null, null);
232+
qm.createRepository(RepositoryType.CARGO, "crates.io", null, "https://crates.io", true, false, false, null, null, null);
233+
qm.createRepository(RepositoryType.GO_MODULES, "proxy.golang.org", null, "https://proxy.golang.org", true, false, false, null, null, null);
234+
qm.createRepository(RepositoryType.GITHUB, "github.com", null, "https://github.com", true, false, false, null, null, null);
235235
}
236236
}
237237

‎src/main/java/org/dependencytrack/persistence/QueryManager.java

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1225,12 +1225,12 @@ public boolean repositoryExist(RepositoryType type, String identifier) {
12251225
return getRepositoryQueryManager().repositoryExist(type, identifier);
12261226
}
12271227

1228-
public Repository createRepository(RepositoryType type, String identifier, String url, boolean enabled, boolean internal, boolean isAuthenticationRequired, String username, String password, String config) {
1229-
return getRepositoryQueryManager().createRepository(type, identifier, url, enabled, internal, isAuthenticationRequired, username, password, config);
1228+
public Repository createRepository(RepositoryType type, String identifier, String description, String url, boolean enabled, boolean internal, boolean isAuthenticationRequired, String username, String password, String config) {
1229+
return getRepositoryQueryManager().createRepository(type, identifier, description, url, enabled, internal, isAuthenticationRequired, username, password, config);
12301230
}
12311231

1232-
public Repository updateRepository(UUID uuid, String identifier, String url, boolean internal, boolean authenticationRequired, String username, String password, boolean enabled, String config) {
1233-
return getRepositoryQueryManager().updateRepository(uuid, identifier, url, internal, authenticationRequired, username, password, enabled, config);
1232+
public Repository updateRepository(UUID uuid, String identifier, String description, String url, boolean internal, boolean authenticationRequired, String username, String password, boolean enabled, String config) {
1233+
return getRepositoryQueryManager().updateRepository(uuid, identifier, description, url, internal, authenticationRequired, username, password, enabled, config);
12341234
}
12351235

12361236
public RepositoryMetaComponent getRepositoryMetaComponent(RepositoryType repositoryType, String namespace, String name) {

‎src/main/java/org/dependencytrack/persistence/RepositoryQueryManager.java

Lines changed: 6 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -60,18 +60,6 @@ public class RepositoryQueryManager extends QueryManager implements IQueryManage
6060
super(pm, request);
6161
}
6262

63-
//TODO VS remove getRepository?
64-
/**
65-
* Returns repository by identifier
66-
*
67-
* @return Repository
68-
*/
69-
public Repository getRepository(String identifier) {
70-
final Query<Repository> query = pm.newQuery(Repository.class, "identifier == :identifier");
71-
query.setParameters(identifier);
72-
return executeAndCloseUnique(query);
73-
}
74-
7563
/**
7664
* Returns a list of all repositories.
7765
*
@@ -148,6 +136,7 @@ public boolean repositoryExist(RepositoryType type, String identifier) {
148136
*
149137
* @param type the type of repository
150138
* @param identifier a unique (to the type) identifier for the repo
139+
* @param description description of the repository
151140
* @param url the URL to the repository
152141
* @param enabled if the repo is enabled or not
153142
* @param internal if the repo is internal or not
@@ -156,7 +145,7 @@ public boolean repositoryExist(RepositoryType type, String identifier) {
156145
* @param password the password to access the (authenticated) repository with
157146
* @return the created Repository
158147
*/
159-
public Repository createRepository(RepositoryType type, String identifier, String url, boolean enabled, boolean internal, boolean isAuthenticationRequired, String username, String password, String config) {
148+
public Repository createRepository(RepositoryType type, String identifier, String description, String url, boolean enabled, boolean internal, boolean isAuthenticationRequired, String username, String password, String config) {
160149
if (repositoryExist(type, identifier)) {
161150
return null;
162151
}
@@ -172,6 +161,7 @@ public Repository createRepository(RepositoryType type, String identifier, Strin
172161
final Repository repo = new Repository();
173162
repo.setType(type);
174163
repo.setIdentifier(identifier);
164+
repo.setDescription(description);
175165
repo.setUrl(url);
176166
repo.setResolutionOrder(order + 1);
177167
repo.setEnabled(enabled);
@@ -196,6 +186,7 @@ public Repository createRepository(RepositoryType type, String identifier, Strin
196186
*
197187
* @param uuid the uuid of the repository to update
198188
* @param identifier the identifier of the repository
189+
* @param description description of the repository
199190
* @param url a url of the repository
200191
* @param internal specifies if the repository is internal
201192
* @param authenticationRequired if the repository needs authentication or not
@@ -204,9 +195,10 @@ public Repository createRepository(RepositoryType type, String identifier, Strin
204195
* @param enabled specifies if the repository is enabled
205196
* @return the updated Repository
206197
*/
207-
public Repository updateRepository(UUID uuid, String identifier, String url, boolean internal, boolean authenticationRequired, String username, String password, boolean enabled, String config) {
198+
public Repository updateRepository(UUID uuid, String identifier, String description, String url, boolean internal, boolean authenticationRequired, String username, String password, boolean enabled, String config) {
208199
final Repository repository = getObjectByUuid(Repository.class, uuid);
209200
repository.setIdentifier(identifier);
201+
repository.setDescription(description);
210202
repository.setUrl(url);
211203
repository.setInternal(internal);
212204
repository.setAuthenticationRequired(authenticationRequired);

‎src/main/java/org/dependencytrack/resources/v1/RepositoryResource.java

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -190,10 +190,12 @@ public Response createRepository(Repository jsonRepository) {
190190

191191
try (QueryManager qm = new QueryManager()) {
192192
final boolean exists = qm.repositoryExist(jsonRepository.getType(), StringUtils.trimToNull(jsonRepository.getIdentifier()));
193+
//TODO VS Add description to Frontend
193194
if (!exists) {
194195
final Repository repository = qm.createRepository(
195196
jsonRepository.getType(),
196197
StringUtils.trimToNull(jsonRepository.getIdentifier()),
198+
StringUtils.trimToNull(jsonRepository.getDescription()),
197199
StringUtils.trimToNull(jsonRepository.getUrl()),
198200
jsonRepository.isEnabled(),
199201
jsonRepository.isInternal(),
@@ -241,7 +243,7 @@ public Response updateRepository(Repository jsonRepository) {
241243
? DataEncryption.encryptAsString(jsonRepository.getPassword())
242244
: repository.getPassword();
243245

244-
repository = qm.updateRepository(jsonRepository.getUuid(), repository.getIdentifier(), url,
246+
repository = qm.updateRepository(jsonRepository.getUuid(), repository.getIdentifier(), jsonRepository.getDescription(), url,
245247
jsonRepository.isInternal(), jsonRepository.isAuthenticationRequired(), jsonRepository.getUsername(), updatedPassword, jsonRepository.isEnabled(), jsonRepository.getConfig());
246248
return Response.ok(repository).build();
247249
} catch (Exception e) {

‎src/main/java/org/dependencytrack/tasks/repositories/ComposerAdvisoryMirrorTask.java

Lines changed: 14 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -331,10 +331,7 @@ protected List<VulnerableSoftware> mapVulnerabilityToVulnerableSoftware(final Qu
331331
final PackageURL purl = generatePurlFromComposerAdvisory(advisory);
332332
if (purl == null)
333333
return null;
334-
String versionStartIncluding = null;
335-
String versionStartExcluding = null;
336-
String versionEndIncluding = null;
337-
String versionEndExcluding = null;
334+
338335
if (advisory.getAffectedVersions() != null) {
339336
// regex splitters copied from Composer Version Parser
340337
LOGGER.trace("Parsing version ranges for " + advisory.getPackageEcosystem() + " : "
@@ -343,6 +340,10 @@ protected List<VulnerableSoftware> mapVulnerabilityToVulnerableSoftware(final Qu
343340
.map(String::trim).toArray(String[]::new);
344341

345342
for (String range : ranges) {
343+
String versionStartIncluding = null;
344+
String versionStartExcluding = null;
345+
String versionEndIncluding = null;
346+
String versionEndExcluding = null;
346347
// Split by both ',' and ' '
347348
String[] parts = Arrays.stream(range.split("(?<!^|as|[=>< ,]) *(?<!-)[, ](?!-) *(?!,|as|$)"))
348349
.map(String::trim).toArray(String[]::new);
@@ -358,16 +359,15 @@ protected List<VulnerableSoftware> mapVulnerabilityToVulnerableSoftware(final Qu
358359
} else if (part.startsWith("=")) {
359360
versionStartIncluding = part.replace("=", "").trim();
360361
versionEndIncluding = part.replace("=", "").trim();
362+
} else if (part.trim().equals("*")) {
363+
// Drupal sometimes uses * to indicate all versions are vulnerable for abandoned plugins
364+
// Since we don't have a "deprecated" or "endoflife" or "unsupported" or "abandoned" flag, we do this:
365+
versionEndExcluding = "999.999.999";
361366
} else {
362-
// TODO VS Try to support all version ranges seen in Drupal package repo. All
363-
// from
364-
// packagist are supported above.
365-
/*
366-
* "<5.25.0 || 6.0.0 || 6.0.1" (no = for exact version)
367-
* "*" (all versions, plugin marked as unsupported)
368-
*/
369-
LOGGER.warn("Unable to determine version range of " + advisory.getPackageEcosystem()
370-
+ " : " + advisory.getPackageName() + " : " + part);
367+
// No operator, so it's a single version. Or garbage. But since none of the parts are checked for formatting, we don't check neither
368+
// Drupal uses this, for example "8.1.0"
369+
versionStartIncluding = part;
370+
versionEndIncluding = part;
371371
}
372372
}
373373
VulnerableSoftware vs = qm.getVulnerableSoftwareByPurl(purl.getType(), purl.getNamespace(),
@@ -379,6 +379,7 @@ protected List<VulnerableSoftware> mapVulnerabilityToVulnerableSoftware(final Qu
379379
continue;
380380
}
381381
}
382+
382383
vs = new VulnerableSoftware();
383384
vs.setVulnerable(true);
384385
vs.setPurlType(purl.getType());

‎src/test/java/org/dependencytrack/parser/composer/ComposerAdvisoryParserTest.java

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -174,7 +174,7 @@ public class ComposerAdvisoryParserTest {
174174
]
175175
}
176176
""");
177-
// TODO VS Test wildcardall versions
177+
178178
public final static JSONObject VULN_WILDCARD_ALL = new JSONObject("""
179179
{
180180
"advisoryId": "PKSA-n8hw-tywm-xrh7",
@@ -202,8 +202,7 @@ public class ComposerAdvisoryParserTest {
202202
""");
203203

204204

205-
//TODO VS Test NoOp version
206-
public final static JSONObject VULN_NOOP_VERSION = new JSONObject("""
205+
public final static JSONObject VULN_EXACT_VERSION = new JSONObject("""
207206
{
208207
"advisoryId": "PKSA-n8hw-tywm-xrh7",
209208
"packageName": "drupal/core",
@@ -254,6 +253,8 @@ public void testParseNoErrors() throws IOException {
254253
ComposerAdvisoryParser.parseAdvisory(VULN_FOP_CVE);
255254
ComposerAdvisoryParser.parseAdvisory(VULN_FOP_NO_CVE);
256255
ComposerAdvisoryParser.parseAdvisory(VULN_COMPOSER);
256+
ComposerAdvisoryParser.parseAdvisory(VULN_WILDCARD_ALL);
257+
ComposerAdvisoryParser.parseAdvisory(VULN_EXACT_VERSION);
257258
}
258259

259260
}

0 commit comments

Comments
 (0)