Add an owasp-check profile

[sberyozkin]

Make it easier to run OWASP checks on the whole project or individual extensions

[loicmathieu]

Hi @sberyozkin if I understand it correctly, this add the dependency check plugin in the Quarkus build itself.
Do you plan to create a github scheduled action for ex to check dependency violations each day ?
Maybe the CONTRIBUTING guide should be updated to explain how to check dependency violations when someone add a new dependency ?

[sberyozkin]

Hi @loicmathieu

Do you plan to create a github scheduled action for ex to check dependency violations each day ?

Not yet, the initial motivation was to make it easier for anyone building Quarkus to check, now and then someone reports an OWASP issue so it could be handy to have an option to run a quick test inside a specific extension, without having to go to some demo, update the pom there, etc.

Adding an action can be the next step, I can experiment with setting up the one in my fork.
I should probably though update the dependabot rules to get the version updated regularly.

Maybe the CONTRIBUTING guide should be updated to explain how to check dependency violations when someone add a new dependency

I think it makes sense

[sberyozkin]

Hmm, I can't invoke it as mvn -Pdependency-check dependency-check:check and instead have to call it as mvn -Pdependency-check org.owasp:dependency-check-maven:check, as it looks like pluginGroups can be added in settings.xml only, or can I define it somewhere in pom.xml ?

[loicmathieu]

Plugin management is not easy with maven (I think they plan to improve it in Maven 4), maybe ask one of our Maven expert ;)

Please add a section in the CONTRIBUTING guide on how to launch it then I'll approve the PR.

[sberyozkin]

Hi Loic @loicmathieu Just about to ping Alexey on dev, I wanted to add a shorter line to the contributions doc :-)

[sberyozkin]

@loicmathieu, have a look please, that should look better now with thanks to @aloubyansky.

I'll investigate how to add an action and have a complete report aggregated as well, soon enough after I get from PTO in one week's time

[aloubyansky]

Having a plugin config in the pluginManagement should already allow mvn dependency-check:check in submodules. The profile could help with the defaultGoal.

[sberyozkin]

Thanks Alexey and Loic for the ideas how to improve/simplify.

[sberyozkin]

Lets also wait for Guillaume to check it

[loicmathieu]

Lgtm

[gsmet]

I force pushed some formatting and documentation fixes.

But running mvn -Dowasp-check at the root doesn't work (because it's declared in the build-parent). Not sure if you wanted it to work but if so there's more work needed. If not, you should probably precise in the documentation that the command needs to be run in the extension directory.

[gsmet]

Also I tried to run it in extensions/hibernate-validator and ended up with the following error:

[ERROR] org.owasp.dependencycheck.data.nvdcve.DatabaseException: Error updating 'CVE-2020-36569'
org.owasp.dependencycheck.data.update.exception.UpdateException: org.owasp.dependencycheck.data.nvdcve.DatabaseException: Error updating 'CVE-2020-36569'
    at org.owasp.dependencycheck.data.update.nvd.ProcessTask.processFiles (ProcessTask.java:157)
    at org.owasp.dependencycheck.data.update.nvd.ProcessTask.call (ProcessTask.java:114)
    at org.owasp.dependencycheck.data.update.nvd.ProcessTask.call (ProcessTask.java:41)
    at java.util.concurrent.FutureTask.run (FutureTask.java:264)
    at java.util.concurrent.ThreadPoolExecutor.runWorker (ThreadPoolExecutor.java:1128)
    at java.util.concurrent.ThreadPoolExecutor$Worker.run (ThreadPoolExecutor.java:628)
    at java.lang.Thread.run (Thread.java:829)
Caused by: org.owasp.dependencycheck.data.nvdcve.DatabaseException: Error updating 'CVE-2020-36569'
    at org.owasp.dependencycheck.data.nvdcve.CveDB.updateVulnerability (CveDB.java:823)
    at org.owasp.dependencycheck.data.update.nvd.NvdCveParser.parse (NvdCveParser.java:114)
    at org.owasp.dependencycheck.data.update.nvd.ProcessTask.importJSON (ProcessTask.java:141)
    at org.owasp.dependencycheck.data.update.nvd.ProcessTask.processFiles (ProcessTask.java:154)
    at org.owasp.dependencycheck.data.update.nvd.ProcessTask.call (ProcessTask.java:114)
    at org.owasp.dependencycheck.data.update.nvd.ProcessTask.call (ProcessTask.java:41)
    at java.util.concurrent.FutureTask.run (FutureTask.java:264)
    at java.util.concurrent.ThreadPoolExecutor.runWorker (ThreadPoolExecutor.java:1128)
    at java.util.concurrent.ThreadPoolExecutor$Worker.run (ThreadPoolExecutor.java:628)
    at java.lang.Thread.run (Thread.java:829)
Caused by: org.h2.jdbc.JdbcBatchUpdateException: Value too long for column "VERSIONENDEXCLUDING CHARACTER VARYING(60)": "'0.0.0-20160722212129-ac0cc4484ad4_before_v0.0.0-20200131131040-063a3fb69896' (75)"; SQL statement:
INSERT INTO software (cveid, cpeEntryId, versionEndExcluding, versionEndIncluding, versionStartExcluding, versionStartIncluding, vulnerable) VALUES (?, ?, ?, ?, ?, ?, ?) [22001-214]
    at org.h2.jdbc.JdbcPreparedStatement.executeBatch (JdbcPreparedStatement.java:1269)
    at org.apache.commons.dbcp2.DelegatingStatement.executeBatch (DelegatingStatement.java:241)
    at org.apache.commons.dbcp2.DelegatingStatement.executeBatch (DelegatingStatement.java:241)
    at org.owasp.dependencycheck.data.nvdcve.CveDB.executeBatch (CveDB.java:1248)
    at org.owasp.dependencycheck.data.nvdcve.CveDB.updateVulnerabilityInsertSoftware (CveDB.java:1098)
    at org.owasp.dependencycheck.data.nvdcve.CveDB.updateVulnerability (CveDB.java:816)
    at org.owasp.dependencycheck.data.update.nvd.NvdCveParser.parse (NvdCveParser.java:114)
    at org.owasp.dependencycheck.data.update.nvd.ProcessTask.importJSON (ProcessTask.java:141)
    at org.owasp.dependencycheck.data.update.nvd.ProcessTask.processFiles (ProcessTask.java:154)
    at org.owasp.dependencycheck.data.update.nvd.ProcessTask.call (ProcessTask.java:114)
    at org.owasp.dependencycheck.data.update.nvd.ProcessTask.call (ProcessTask.java:41)
    at java.util.concurrent.FutureTask.run (FutureTask.java:264)
    at java.util.concurrent.ThreadPoolExecutor.runWorker (ThreadPoolExecutor.java:1128)
    at java.util.concurrent.ThreadPoolExecutor$Worker.run (ThreadPoolExecutor.java:628)
    at java.lang.Thread.run (Thread.java:829)
[WARNING] A new version of dependency-check is available. Consider updating to version 7.4.4.
[WARNING] Unable to update 1 or more Cached Web DataSource, using local data instead. Results may not include recent vulnerabilities.

[sberyozkin]

@gsmet Thanks for the updates,

you should probably precise in the documentation that the command needs to be run in the extension directory.

Sure.

Will also try 7.4.4 with hibernate-validator

[sberyozkin]

Hi @gsmet

Not sure if it is 7.4.4 which fixed the error you reported or not, but it works OK,

[INFO] Checking for updates
[INFO] NVD CVE requires several updates; this could take a couple of minutes.
[INFO] Download Started for NVD CVE - 2002
[INFO] Download Complete for NVD CVE - 2002  (1152 ms)
....
[INFO] Processing Complete for NVD CVE - 2022  (27138 ms)
[INFO] Download Started for NVD CVE - Modified
[INFO] Download Complete for NVD CVE - Modified  (1009 ms)
[INFO] Processing Started for NVD CVE - Modified
[INFO] Processing Complete for NVD CVE - Modified  (1285 ms)
[INFO] Begin database maintenance
[INFO] Updated the CPE ecosystem on 125055 NVD records
[INFO] Removed the CPE ecosystem on 4 NVD records
[INFO] Cleaned up 6 orphaned NVD records
[INFO] End database maintenance (21143 ms)
[INFO] Begin database defrag
[INFO] End database defrag (5537 ms)
[INFO] Check for updates complete (226382 ms)

.....

Writing report to: /home/sberyozkin/work/rh/quarkusio/quarkus/extensions/hibernate-validator/deployment/target/dependency-check-report.html
[INFO] ------------------------------------------------------------------------
[INFO] Reactor Summary for Quarkus - Hibernate Validator 999-SNAPSHOT:
[INFO] 
[INFO] Quarkus - Hibernate Validator ...................... SUCCESS [03:55 min]
[INFO] Quarkus - Hibernate Validator - SPI ................ SUCCESS [ 10.735 s]
[INFO] Quarkus - Hibernate Validator - Runtime ............ SUCCESS [  8.957 s]
[INFO] Quarkus - Hibernate Validator - Deployment ......... SUCCESS [  7.297 s]

[sberyozkin]

Latest updates:

• added a clarification to CONTRIBUTING.md that the check has to be run in the extension directory
• updated version to 7.4.4
• disabled the NET analyzer

We can further tune it as necessary

[gsmet]

I triggered another CI run as apparently something went wrong on the GitHub side.

[sberyozkin]

Thanks, looks like it failed yesterday again, so I've triggered it once more

[quarkus-bot]

Failing Jobs - Building 23ccc4d

Status	Name	Step	Failures	Logs	Raw logs
✖	Devtools Tests - JDK 11	Build	Failures	Logs	Raw logs
✖	Devtools Tests - JDK 11 Windows	Build	⚠️ Check →	Logs	Raw logs
✖	Devtools Tests - JDK 17	Build	Failures	Logs	Raw logs
✔️	JVM Tests - JDK 11
✔️	JVM Tests - JDK 17
⌛	JVM Tests - JDK 18	Build	⚠️ Check →	Logs	Raw logs
⌛	Native Tests - Misc4	Build	⚠️ Check →	Logs	Raw logs

Full information is available in the Build summary check run.

Failures

⚙️ Devtools Tests - JDK 11 #

- Failing: integration-tests/devtools 

📦 integration-tests/devtools

✖ io.quarkus.devtools.codestarts.quarkus.HibernateOrmCodestartTest.testContent line 23 - More details - Source on GitHub

java.lang.AssertionError: 
[Snapshot is not matching (use -Dsnap to update it automatically): HibernateOrmCodestartTest/testContent/src_main_kotlin_ilove_quark_us_MyKotlinEntity.kt] 
Path:

✖ io.quarkus.devtools.codestarts.quarkus.HibernateOrmPanacheKotlinCodestartTest.testContent line 23 - More details - Source on GitHub

java.lang.AssertionError: 
[Snapshot is not matching (use -Dsnap to update it automatically): HibernateOrmPanacheKotlinCodestartTest/testContent/src_main_kotlin_ilove_quark_us_MyKotlinEntity.kt] 
Path:

---

⚙️ Devtools Tests - JDK 17 #

- Failing: integration-tests/devtools 

📦 integration-tests/devtools

✖ io.quarkus.devtools.codestarts.quarkus.HibernateOrmCodestartTest.testContent line 23 - More details - Source on GitHub

java.lang.AssertionError: 
[Snapshot is not matching (use -Dsnap to update it automatically): HibernateOrmCodestartTest/testContent/src_main_kotlin_ilove_quark_us_MyKotlinEntity.kt] 
Path:

✖ io.quarkus.devtools.codestarts.quarkus.HibernateOrmPanacheKotlinCodestartTest.testContent line 23 - More details - Source on GitHub

java.lang.AssertionError: 
[Snapshot is not matching (use -Dsnap to update it automatically): HibernateOrmPanacheKotlinCodestartTest/testContent/src_main_kotlin_ilove_quark_us_MyKotlinEntity.kt] 
Path:

[sberyozkin]

Guillaume, not sure it is worth mentioning it in the release notes but please add a label if you think it can be of interest