Excluded transitive dependencies of WAR overlays are still scanned

[ThrawnCA]

Transitive dependencies of a WAR overlay that are excluded within the WAR plugin are still showing up in the scan, despite not being in the resulting WAR file.

Eg the following POM snippets:

    <dependency>
        <scope>provided</scope>
        <groupId>org.jasig.cas</groupId>
        <artifactId>cas-server-webapp</artifactId>
        <version>3.5.3</version>
        <type>war</type>
    </dependency>
    <dependency><groupId>commons-beanutils</groupId><artifactId>commons-beanutils</artifactId><version>1.9.3</version></dependency>
    <dependency><groupId>commons-codec</groupId><artifactId>commons-codec</artifactId><version>1.10</version></dependency>
    <dependency><groupId>commons-collections</groupId><artifactId>commons-collections</artifactId><version>3.2.2</version></dependency>
    <dependency><groupId>commons-fileupload</groupId><artifactId>commons-fileupload</artifactId><version>1.3.2</version></dependency>
    <dependency><groupId>commons-httpclient</groupId><artifactId>commons-httpclient</artifactId><version>3.1</version></dependency>
    <dependency><groupId>commons-io</groupId><artifactId>commons-io</artifactId><version>2.5</version></dependency>
    <dependency><groupId>commons-lang</groupId><artifactId>commons-lang</artifactId><version>2.6</version></dependency>
    <dependency><groupId>commons-logging</groupId><artifactId>commons-logging</artifactId><version>1.2</version></dependency>
    <dependency><groupId>joda-time</groupId><artifactId>joda-time</artifactId><version>2.9.4</version></dependency>
    <dependency><groupId>org.apache.httpcomponents</groupId><artifactId>httpclient</artifactId><version>4.5.2</version></dependency>
    <dependency><groupId>org.apache.santuario</groupId><artifactId>xmlsec</artifactId><version>1.5.8</version></dependency>
    <dependency><groupId>org.apache.xmlgraphics</groupId><artifactId>batik-css</artifactId><version>1.8</version></dependency>
    <dependency><groupId>org.opensaml</groupId><artifactId>opensaml</artifactId><version>2.6.6</version></dependency>
    <dependency><groupId>org.owasp.esapi</groupId><artifactId>esapi</artifactId><version>2.1.0.1</version>
        <exclusions>
            <exclusion><groupId>commons-beanutils</groupId><artifactId>commons-beanutils-core</artifactId></exclusion>
            <exclusion><groupId>log4j</groupId><artifactId>log4j</artifactId></exclusion>
            <exclusion><groupId>org.owasp.antisamy</groupId><artifactId>antisamy</artifactId></exclusion>
        </exclusions>
    </dependency>
    <dependency><groupId>org.slf4j</groupId><artifactId>jcl-over-slf4j</artifactId><version>1.7.23</version></dependency>
    <dependency><groupId>org.slf4j</groupId><artifactId>log4j-over-slf4j</artifactId><version>1.7.23</version></dependency>
    <dependency><groupId>org.slf4j</groupId><artifactId>slf4j-api</artifactId><version>1.7.23</version></dependency>
    <dependency><groupId>org.springframework</groupId><artifactId>spring-aop</artifactId><version>3.1.4.RELEASE</version></dependency>
    <dependency><groupId>org.springframework</groupId><artifactId>spring-asm</artifactId><version>3.1.4.RELEASE</version></dependency>
    <dependency><groupId>org.springframework</groupId><artifactId>spring-beans</artifactId><version>3.1.4.RELEASE</version></dependency>
    <dependency><groupId>org.springframework</groupId><artifactId>spring-context</artifactId><version>3.1.4.RELEASE</version></dependency>
    <dependency><groupId>org.springframework</groupId><artifactId>spring-context-support</artifactId><version>3.1.4.RELEASE</version></dependency>
    <dependency><groupId>org.springframework</groupId><artifactId>spring-core</artifactId><version>3.1.4.RELEASE</version></dependency>
    <dependency><groupId>org.springframework</groupId><artifactId>spring-expression</artifactId><version>3.1.4.RELEASE</version></dependency>
    <dependency><groupId>org.springframework</groupId><artifactId>spring-jdbc</artifactId><version>3.1.4.RELEASE</version></dependency>
    <dependency><groupId>org.springframework</groupId><artifactId>spring-orm</artifactId><version>3.1.4.RELEASE</version></dependency>
    <dependency><groupId>org.springframework</groupId><artifactId>spring-tx</artifactId><version>3.1.4.RELEASE</version></dependency>
    <dependency><groupId>org.springframework</groupId><artifactId>spring-web</artifactId><version>3.1.4.RELEASE</version></dependency>
    <dependency><groupId>org.springframework</groupId><artifactId>spring-webmvc</artifactId><version>3.1.4.RELEASE</version></dependency>
    <dependency><groupId>org.springframework.security</groupId><artifactId>spring-security-cas</artifactId><version>3.1.7.RELEASE</version></dependency>
    <dependency><groupId>org.springframework.security</groupId><artifactId>spring-security-config</artifactId><version>3.1.7.RELEASE</version></dependency>
    <dependency><groupId>org.springframework.security</groupId><artifactId>spring-security-core</artifactId><version>3.1.7.RELEASE</version></dependency>
    <dependency><groupId>org.springframework.security</groupId><artifactId>spring-security-crypto</artifactId><version>3.1.7.RELEASE</version></dependency>
    <dependency><groupId>org.springframework.security</groupId><artifactId>spring-security-web</artifactId><version>3.1.7.RELEASE</version></dependency>
    <dependency><groupId>xalan</groupId><artifactId>xalan</artifactId><version>2.7.2</version></dependency>
    <dependency><groupId>xerces</groupId><artifactId>xercesImpl</artifactId><version>2.11.0.SP3</version></dependency>
    <dependency><groupId>xml-apis</groupId><artifactId>xml-apis</artifactId><version>1.4.01</version></dependency>

...

    <plugin>
        <groupId>org.apache.maven.plugins</groupId>
        <version>2.6</version>
        <artifactId>maven-war-plugin</artifactId>
        <configuration>
            <warSourceExcludes>**/default/ui/includes/*.jsp</warSourceExcludes>
            <overlays>
                <overlay>
                    <groupId>org.jasig.cas</groupId><artifactId>cas-server-webapp</artifactId>
                    <excludes>
                        <exclude>WEB-INF/lib/bcprov-jdk15-*.jar</exclude>
                        <exclude>WEB-INF/lib/cas-client-*.jar</exclude>
                        <exclude>WEB-INF/lib/commons-beanutils-*.jar</exclude>
                        <exclude>WEB-INF/lib/commons-codec-*.jar</exclude>
                        <exclude>WEB-INF/lib/commons-collections-*.jar</exclude>
                        <exclude>WEB-INF/lib/commons-lang-*.jar</exclude>
                        <exclude>WEB-INF/lib/commons-logging-*.jar</exclude>
                        <exclude>WEB-INF/lib/esapi-*.jar</exclude>
                        <exclude>WEB-INF/lib/javassist-*.jar</exclude>
                        <exclude>WEB-INF/lib/jcl-over-slf4j-*.jar</exclude>
                        <exclude>WEB-INF/lib/joda-time-*.jar</exclude>
                        <exclude>WEB-INF/lib/jul-to-slf4j-*.jar</exclude>
                        <exclude>WEB-INF/lib/log4j-1*.jar</exclude>
                        <exclude>WEB-INF/lib/opensaml-*.jar</exclude>
                        <exclude>WEB-INF/lib/openws-*.jar</exclude>
                        <exclude>WEB-INF/lib/serializer-*.jar</exclude>
                        <exclude>WEB-INF/lib/slf4j-log4j12-*.jar</exclude>
                        <exclude>WEB-INF/lib/slf4j-api-*.jar</exclude>
                        <exclude>WEB-INF/lib/spring-*-3.1.1.RELEASE.jar</exclude>
                        <exclude>WEB-INF/lib/spring-security-*-3.1.0.RELEASE.jar</exclude>
                        <exclude>WEB-INF/lib/velocity-*.jar</exclude>
                        <exclude>WEB-INF/lib/xalan-*.jar</exclude>
                        <exclude>WEB-INF/lib/xercesImpl-*.jar</exclude>
                        <exclude>WEB-INF/lib/xmlsec-*.jar</exclude>
                        <exclude>WEB-INF/lib/xmltooling-*.jar</exclude>
                        <exclude>WEB-INF/lib/xml-apis-*.jar</exclude>
                        <exclude>WEB-INF/lib/stax-api-1.0.1.jar</exclude>
                        <exclude>WEB-INF/cas.properties</exclude>
                        <exclude>WEB-INF/classes/log4j.properties</exclude>
                        <exclude>WEB-INF/web.xml</exclude>
                        <exclude>WEB-INF/view/jsp/default/ui/includes/*.jsp</exclude>
                    </excludes>
                </overlay>
            </overlays>
        </configuration>
    </plugin>

will result in:

cas-server-webapp-3.5.3.war: bcprov-jdk15-1.45.jar (cpe:/a:bouncycastle:bouncy-castle-crypto-package:1.45, cpe:/a:bouncycastle:bouncy_castle_crypto_package:1.45, org.bouncycastle:bcprov-jdk15:1.45) : CVE-2015-7940
cas-server-webapp-3.5.3.war: commons-beanutils-1.7.0.jar (commons-beanutils:commons-beanutils:1.7.0, cpe:/a:apache:commons_beanutils:1.7.0) : CVE-2014-0114
cas-server-webapp-3.5.3.war: commons-collections-3.2.jar (commons-collections:commons-collections:3.2, cpe:/a:apache:commons_collections:3.2.1) : CVE-2015-6420
cas-server-webapp-3.5.3.war: hibernate-validator-4.2.0.Final.jar (cpe:/a:hibernate:hibernate_validator:4.2.0, org.hibernate:hibernate-validator:4.2.0.Final) : CVE-2014-3558
cas-server-webapp-3.5.3.war: serializer-2.7.1.jar (cpe:/a:apache:xalan-java:2.7.1, xalan:serializer:2.7.1) : CVE-2014-0107
cas-server-webapp-3.5.3.war: spring-core-3.1.1.RELEASE.jar (cpe:/a:pivotal:spring_framework:3.1.1, cpe:/a:pivotal_software:spring_framework:3.1.1, cpe:/a:springsource:spring_framework:3.1.1, cpe:/a:vmware:springsource_spring_framework:3.1.1, org.springframework:spring-core:3.1.1.RELEASE) : CVE-2016-9878, CVE-2014-3625, CVE-2014-3578, CVE-2014-1904, CVE-2014-0054, CVE-2013-7315, CVE-2013-6429, CVE-2013-4152
cas-server-webapp-3.5.3.war: standard-1.1.2.jar (cpe:/a:apache:standard_taglibs:1.1.2, taglibs:standard:1.1.2) : CVE-2015-0254
cas-server-webapp-3.5.3.war: xalan-2.7.1.jar (cpe:/a:apache:xalan-java:2.7.1, xalan:xalan:2.7.1) : CVE-2014-0107
cas-server-webapp-3.5.3.war: xstream-1.3.jar (com.thoughtworks.xstream:xstream:1.3, cpe:/a:x-stream:xstream:1.3) : CVE-2016-3674

[mprins]

Excluding a file from a package doesn't relieve the project dependency, probably you should be using scope on your dependencies or you should be using some other way to exclude dependencies

[jeremylong]

One way to accomplish what you are looking for is to declare the dependencies as provided; as that is what they appear to be because you are excluding them from the resulting WAR. Then within dependency-check configure <skipProvidedScope>true</skipProvidedScope>.

Does that work?

[ThrawnCA]

Ah. I'd already tried provided scope, but didn't notice that flag. Yes, it works; thanks.

It does make me think, though, since WAR dependencies will usually be overlays, should they be handled specially? Eg checking for exclusions of this kind in the WAR plugin, or defaulting to ignoring provided WARs?

[jmanico]

Grand Admiral Thrawn is a star wars Empire general. He's blue.

…

On Feb 24, 2017, at 3:08 AM, ThrawnCA ***@***.***> wrote: Ah. I'd already tried provided scope, but didn't notice that flag. Yes, it works. It does make me think, though, since WAR dependencies will usually be overlays, should they be handled specially? Eg checking for exclusions of this kind in the WAR plugin, or defaulting to ignoring them if provided? — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub, or mute the thread.

[jeremylong]

@ThrawnCA I can definitely see the use case for excluding the transitive dependencies of a WAR overlay that are excluded. However, the implementation could be tricky. If I am thinking about this correctly (having never directly worked with WAR overlays) one would need to resolve all dependencies (primary, transitive) of the main project being scanned, build a dependency tree, read the exclusion list from the dependent WAR overlay, and then exclude dependencies that are in the exclusion list that only exist in the dependency-tree where the only parent is from the WAR overlay. One then also needs to consider nested (is this even possible?) or multiple WAR overlays.

While I can see the value, this one will be a bit lower on my priority list.

[ThrawnCA]

Grand Admiral Thrawn is a star wars Empire general

Yes? I'm pretty sure Github doesn't have a policy requiring real names.

need to resolve all dependencies

I haven't really looked into how the dependencies are presented to plugins. What you really want is to ignore the fact that an excluded library is a transitive dependency of the WAR, when resolving the dependency tree - but still take notice if the same library was included by a different source. I agree that it seems like it could be tricky.

nested or multiple

I...guess it's possible to nest overlays? Although I'm not sure what transitive dependencies would show up in that case. Multiple overlays is probably also possible, but probably a pretty low priority. People can always handle those ridiculous cases manually if they need to.

Thanks for responding.

[mprins]

In a war overlay the dependency on the overlay-war(s) is declared implicitly, as part of that declaration any exclusions can be added to dependency node, excluding like done above is just wrong (also because if the resulting war is overlain again it will still have all those deps as a transitive dependency.
for a quick intro: https://maven.apache.org/plugins/maven-war-plugin/overlays.html

[ThrawnCA]

excluding like done above is just wrong

You mean defining exclusions within the WAR overlay? What alternative do you propose?

If you don't define the exclusion, but you declare an updated version of the dependency, then the resulting WAR file will have both JARs in it. Not good at all.

[mprins]

<dependency>
        <scope>provided</scope>
        <groupId>org.jasig.cas</groupId>
        <artifactId>cas-server-webapp</artifactId>
        <version>3.5.3</version>
        <type>war</type>
       <exclusions>
              <exclusion>....<exclusion>
       </exclusions>
</dependency>
        

should exclude the dependency from the dependency tree

[ThrawnCA]

Nope, the excluded dependencies still show up in the dependency checker report. Probably because they're not being pulled in via the dependency resolution mechanism; they're actually contained in the WAR file that we're overlaying.