Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: Support maven extensions like Tycho adding system-scoped dependencies without a systemPath #5366

Merged
merged 3 commits into from
Jan 26, 2023
Merged

fix: Support maven extensions like Tycho adding system-scoped dependencies without a systemPath #5366

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
cbb1937
Be more verbose on not-resolved system-scoped dependencies. Improves …
aikebah Dec 13, 2022
248740f
fix: Issue #4969 Fix Tycho system-scoped dependency resolution
aikebah Jan 22, 2023
3e19590
style: fixup checkstyle issues
aikebah Jan 22, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
87 changes: 66 additions & 21 deletions maven/src/main/java/org/owasp/dependencycheck/maven/BaseDependencyCheckMojo.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2680,13 +2680,40 @@ private ExceptionCollection scanDependencyNode(DependencyNode dependencyNode, De
}
}
}
Throwable ignored = null;
if (!isResolved) {
getLog().error("Unable to resolve system scoped dependency: " + dependencyNode.toNodeString());
// Issue #4969 Tycho appears to add System-scoped libraries in reactor projects in unresolved state
// so attempt to do a resolution for system-scoped too if still nothing found
try {
tryResolutionOnce(project, allResolvedDeps, buildingRequest);
final Artifact result = findInAllDeps(allResolvedDeps, dependencyNode.getArtifact(), project);
isResolved = result.isResolved();
artifactFile = result.getFile();
groupId = result.getGroupId();
artifactId = result.getArtifactId();
version = result.getVersion();
availableVersions = result.getAvailableVersions();
} catch (DependencyNotFoundException | DependencyResolverException e) {
getLog().warn("Error performing last-resort System-scoped dependency resolution: " + e.getMessage());
ignored = e;
}
}
if (!isResolved) {
final StringBuilder message = new StringBuilder("Unable to resolve system scoped dependency: ");
if (artifactFile != null) {
message.append(dependencyNode.toNodeString()).append(" at path ").append(artifactFile);
} else {
message.append(dependencyNode.toNodeString()).append(" at path ").append(a.getFile());
}
getLog().error(message);
if (exCol == null) {
exCol = new ExceptionCollection();
}
exCol.addException(new DependencyNotFoundException("Unable to resolve system scoped dependency: "
+ dependencyNode.toNodeString()));
final Exception thrown = new DependencyNotFoundException(message.toString());
if (ignored != null) {
thrown.addSuppressed(ignored);
}
exCol.addException(thrown);
}
} else {
final Artifact dependencyArtifact = dependencyNode.getArtifact();
Expand All @@ -2699,24 +2726,7 @@ private ExceptionCollection scanDependencyNode(DependencyNode dependencyNode, De
result = dependencyArtifact;
} else {
try {
if (allResolvedDeps.isEmpty()) { // no (partially successful) resolution attempt done
try {
final List<org.apache.maven.model.Dependency> dependencies = project.getDependencies();
final List<org.apache.maven.model.Dependency> managedDependencies = project
.getDependencyManagement() == null ? null : project.getDependencyManagement().getDependencies();
final Iterable<ArtifactResult> allDeps = dependencyResolver
.resolveDependencies(buildingRequest, dependencies, managedDependencies, null);
allDeps.forEach(allResolvedDeps::add);
} catch (DependencyResolverException dre) {
if (dre.getCause() instanceof org.eclipse.aether.resolution.DependencyResolutionException) {
final List<ArtifactResult> successResults = Mshared998Util
.getResolutionResults((org.eclipse.aether.resolution.DependencyResolutionException) dre.getCause());
allResolvedDeps.addAll(successResults);
} else {
throw dre;
}
}
}
tryResolutionOnce(project, allResolvedDeps, buildingRequest);
result = findInAllDeps(allResolvedDeps, dependencyNode.getArtifact(), project);
} catch (DependencyNotFoundException | DependencyResolverException ex) {
getLog().debug(String.format("Aggregate : %s", aggregate));
Expand Down Expand Up @@ -2777,6 +2787,41 @@ && addSnapshotReactorDependency(engine, dependencyNode.getArtifact(), project))
}
return exCol;
}

/**
* Try resolution of artifacts once, allowing for DependencyResolutionException due to reactor-dependencies not
* being resolvable.
* <br>
* The resolution is attempted only if allResolvedDeps is still empty. The assumption is that for any given project
* at least one of the dependencies will successfully resolve. If not, resolution will be attempted once for every
* dependency (as allResolvedDeps remains empty).
*
* @param project The project to dependencies for
* @param allResolvedDeps The collection of successfully resolved dependencies, will be filled with the successfully
* resolved dependencies, even in case of resolution failures.
* @param buildingRequest The buildingRequest to hand to Maven's DependencyResolver.
* @throws DependencyResolverException For any DependencyResolverException other than an Eclipse Aether DependencyResolutionException
*/
private void tryResolutionOnce(MavenProject project, List<ArtifactResult> allResolvedDeps, ProjectBuildingRequest buildingRequest) throws DependencyResolverException {
if (allResolvedDeps.isEmpty()) { // no (partially successful) resolution attempt done
try {
final List<org.apache.maven.model.Dependency> dependencies = project.getDependencies();
final List<org.apache.maven.model.Dependency> managedDependencies = project
.getDependencyManagement() == null ? null : project.getDependencyManagement().getDependencies();
final Iterable<ArtifactResult> allDeps = dependencyResolver
.resolveDependencies(buildingRequest, dependencies, managedDependencies, null);
allDeps.forEach(allResolvedDeps::add);
} catch (DependencyResolverException dre) {
if (dre.getCause() instanceof org.eclipse.aether.resolution.DependencyResolutionException) {
final List<ArtifactResult> successResults = Mshared998Util
.getResolutionResults((org.eclipse.aether.resolution.DependencyResolutionException) dre.getCause());
allResolvedDeps.addAll(successResults);
} else {
throw dre;
}
}
}
}
//CSON: ParameterNumber

//CSOFF: ParameterNumber
Expand Down