Skip to content

Commit

Permalink
revert(java): stop supporting of test scope for pom.xml files (#7488
Browse files Browse the repository at this point in the history
)
  • Loading branch information
DmitriyLewen authored Sep 12, 2024
1 parent 8876e70 commit b0222fe
Show file tree
Hide file tree
Showing 6 changed files with 7 additions and 51 deletions.
18 changes: 6 additions & 12 deletions docs/docs/coverage/language/java.md
Original file line number Diff line number Diff line change
Expand Up @@ -12,12 +12,12 @@ Each artifact supports the following scanners:

The following table provides an outline of the features Trivy offers.

| Artifact | Internet access | Dev dependencies | [Dependency graph][dependency-graph] | Position | [Detection Priority][detection-priority] |
|------------------|:---------------------:|:------------------:|:------------------------------------:|:--------:|:----------------------------------------:|
| JAR/WAR/PAR/EAR | Trivy Java DB | Include | - | - | Not needed |
| pom.xml | Maven repository [^1] | [Exclude](#scopes) ||[^7] | - |
| *gradle.lockfile | - | Exclude ||| Not needed |
| *.sbt.lock | - | Exclude | - || Not needed |
| Artifact | Internet access | Dev dependencies | [Dependency graph][dependency-graph] | Position | [Detection Priority][detection-priority] |
|------------------|:---------------------:|:----------------:|:------------------------------------:|:--------:|:----------------------------------------:|
| JAR/WAR/PAR/EAR | Trivy Java DB | Include | - | - | Not needed |
| pom.xml | Maven repository [^1] | Exclude ||[^7] | - |
| *gradle.lockfile | - | Exclude ||| Not needed |
| *.sbt.lock | - | Exclude | - || Not needed |

These may be enabled or disabled depending on the target.
See [here](./index.md) for the detail.
Expand Down Expand Up @@ -69,11 +69,6 @@ The vulnerability database will be downloaded anyway.
!!! Warning
Trivy may skip some dependencies (that were not found on your local machine) when the `--offline-scan` flag is passed.

### scopes
Trivy supports `runtime`, `compile`, `test` and `import` (for `dependencyManagement`) [dependency scopes][dependency-scopes].
Dependencies without scope are also detected.

By default, Trivy doesn't report dependencies with `test` scope. Use the `--include-dev-deps` flag to include them.

### maven-invoker-plugin
Typically, the integration tests directory (`**/[src|target]/it/*/pom.xml`) of [maven-invoker-plugin][maven-invoker-plugin] doesn't contain actual `pom.xml` files and should be skipped to avoid noise.
Expand Down Expand Up @@ -125,4 +120,3 @@ Make sure that you have cache[^8] directory to find licenses from `*.pom` depend
[maven-pom-repos]: https://maven.apache.org/settings.html#repositories
[sbt-dependency-lock]: https://stringbean.github.io/sbt-dependency-lock
[detection-priority]: ../../scanner/vulnerability.md#detection-priority
[dependency-scopes]: https://maven.apache.org/guides/introduction/introduction-to-dependency-mechanism.html#Dependency_Scope
1 change: 0 additions & 1 deletion pkg/dependency/parser/java/pom/artifact.go
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,6 @@ type artifact struct {

Module bool
Relationship ftypes.Relationship
Test bool

Locations ftypes.Locations
}
Expand Down
4 changes: 1 addition & 3 deletions pkg/dependency/parser/java/pom/parse.go
Original file line number Diff line number Diff line change
Expand Up @@ -214,7 +214,6 @@ func (p *Parser) parseRoot(root artifact, uniqModules map[string]struct{}) ([]ft
Licenses: result.artifact.Licenses,
Relationship: art.Relationship,
Locations: art.Locations,
Test: art.Test,
}

// save only dependency names
Expand All @@ -235,7 +234,6 @@ func (p *Parser) parseRoot(root artifact, uniqModules map[string]struct{}) ([]ft
Licenses: art.Licenses,
Relationship: art.Relationship,
Locations: art.Locations,
Dev: art.Test,
}
pkgs = append(pkgs, pkg)

Expand Down Expand Up @@ -402,7 +400,7 @@ func (p *Parser) parseDependencies(deps []pomDependency, props map[string]string
// Resolve dependencies
d = d.Resolve(props, depManagement, rootDepManagement)

if (d.Scope != "" && d.Scope != "compile" && d.Scope != "runtime" && d.Scope != "test") || d.Optional {
if (d.Scope != "" && d.Scope != "compile" && d.Scope != "runtime") || d.Optional {
continue
}

Expand Down
28 changes: 0 additions & 28 deletions pkg/dependency/parser/java/pom/parse_test.go
Original file line number Diff line number Diff line change
Expand Up @@ -61,27 +61,13 @@ func TestPom_Parse(t *testing.T) {
},
},
},
{
ID: "org.example:example-test:2.0.0",
Name: "org.example:example-test",
Version: "2.0.0",
Relationship: ftypes.RelationshipDirect,
Dev: true,
Locations: ftypes.Locations{
{
StartLine: 49,
EndLine: 54,
},
},
},
},
wantDeps: []ftypes.Dependency{
{
ID: "com.example:happy:1.0.0",
DependsOn: []string{
"org.example:example-api:1.7.30",
"org.example:example-runtime:1.0.0",
"org.example:example-test:2.0.0",
},
},
},
Expand Down Expand Up @@ -123,27 +109,13 @@ func TestPom_Parse(t *testing.T) {
},
},
},
{
ID: "org.example:example-test:2.0.0",
Name: "org.example:example-test",
Version: "2.0.0",
Relationship: ftypes.RelationshipDirect,
Dev: true,
Locations: ftypes.Locations{
{
StartLine: 49,
EndLine: 54,
},
},
},
},
wantDeps: []ftypes.Dependency{
{
ID: "com.example:happy:1.0.0",
DependsOn: []string{
"org.example:example-api:1.7.30",
"org.example:example-runtime:1.0.0",
"org.example:example-test:2.0.0",
},
},
},
Expand Down
1 change: 0 additions & 1 deletion pkg/dependency/parser/java/pom/pom.go
Original file line number Diff line number Diff line change
Expand Up @@ -303,7 +303,6 @@ func (d pomDependency) ToArtifact(opts analysisOptions) artifact {
Exclusions: exclusions,
Locations: locations,
Relationship: ftypes.RelationshipIndirect, // default
Test: d.Scope == "test",
}
}

Expand Down
6 changes: 0 additions & 6 deletions pkg/dependency/parser/java/pom/testdata/happy/pom.xml
Original file line number Diff line number Diff line change
Expand Up @@ -46,11 +46,5 @@
<version>999</version>
<scope>provided</scope>
</dependency>
<dependency>
<groupId>org.example</groupId>
<artifactId>example-test</artifactId>
<version>2.0.0</version>
<scope>test</scope>
</dependency>
</dependencies>
</project>

0 comments on commit b0222fe

Please sign in to comment.