Feature/remove unirest #1

mehab · 2023-01-23T16:54:05Z

Description

Addressed Issue

Additional Details

Checklist

I have read and understand the contributing guidelines
This PR fixes a defect, and I have provided tests to verify that the fix is effective
This PR implements an enhancement, and I have provided tests to verify that it works as intended
This PR introduces changes to the database model, and I have added corresponding update logic
This PR introduces new or alters existing behavior, and I have updated the documentation accordingly

Signed-off-by: mehab <[email protected]>

sonatype-lift · 2023-01-23T17:02:07Z

src/main/java/org/dependencytrack/tasks/scanners/SnykAnalysisTask.java

                .intervalFunction(ofExponentialBackoff(
                        Duration.ofSeconds(Config.getInstance().getPropertyAsInt(ConfigKey.SNYK_RETRY_EXPONENTIAL_BACKOFF_INITIAL_DURATION_SECONDS)),
                        Config.getInstance().getPropertyAsInt(ConfigKey.SNYK_RETRY_EXPONENTIAL_BACKOFF_MULTIPLIER),
                        Duration.ofSeconds(Config.getInstance().getPropertyAsInt(ConfigKey.SNYK_RETRY_EXPONENTIAL_BACKOFF_MAX_DURATION_SECONDS))
                ))
                .maxAttempts(Config.getInstance().getPropertyAsInt(ConfigKey.SNYK_RETRY_MAX_ATTEMPTS))
                .retryOnException(exception -> false)
-                .retryOnResult(response -> HttpStatus.TOO_MANY_REQUESTS == response.getStatus())
+                .retryOnResult(response -> 429 == response.getStatusLine().getStatusCode())


YodaCondition: The non-constant portion of an equals check generally comes first.

Suggested change

.retryOnResult(response -> 429 == response.getStatusLine().getStatusCode())

.retryOnResult(response -> response.getStatusLine().getStatusCode() == 429)

ℹ️ Learn about @sonatype-lift commands

You can reply with the following commands. For example, reply with @sonatype-lift ignoreall to leave out all findings.

Command Usage

@sonatype-lift ignore Leave out the above finding from this PR

@sonatype-lift ignoreall Leave out all the existing findings from this PR

@sonatype-lift exclude <file|issue|path|tool> Exclude specified file|issue|path|tool from Lift findings by updating your config.toml file

Note: When talking to LiftBot, you need to refresh the page to see its response.
_{Click here to add LiftBot to another repo.}

Was this a good recommendation?
[ 🙁 Not relevant ] - [ 😕 Won't fix ] - [ 😑 Not critical, will fix ] - [ 🙂 Critical, will fix ] - [ 😊 Critical, fixing now ]

sonatype-lift · 2023-01-23T17:02:09Z

src/main/java/org/dependencytrack/tasks/repositories/GoModulesMetaAnalyzer.java

+            if (response.getStatusLine().getStatusCode() == HttpStatus.SC_OK) {
+                if (response.getEntity()!=null) {
+                    String responseString = EntityUtils.toString(response.getEntity());
+                    final JSONObject responseJson = new org.json.JSONObject(responseString);


UnnecessarilyFullyQualified: This fully qualified name is unambiguous to the compiler if imported.

Suggested change

final JSONObject responseJson = new org.json.JSONObject(responseString);

final JSONObject responseJson = new JSONObject(responseString);

ℹ️ Learn about @sonatype-lift commands

You can reply with the following commands. For example, reply with @sonatype-lift ignoreall to leave out all findings.

Command Usage

@sonatype-lift ignore Leave out the above finding from this PR

@sonatype-lift ignoreall Leave out all the existing findings from this PR

@sonatype-lift exclude <file|issue|path|tool> Exclude specified file|issue|path|tool from Lift findings by updating your config.toml file

Note: When talking to LiftBot, you need to refresh the page to see its response.
_{Click here to add LiftBot to another repo.}

Was this a good recommendation?
[ 🙁 Not relevant ] - [ 😕 Won't fix ] - [ 😑 Not critical, will fix ] - [ 🙂 Critical, will fix ] - [ 😊 Critical, fixing now ]

sonatype-lift · 2023-01-23T17:02:11Z

src/main/java/org/dependencytrack/util/VulnDBUtil.java

+        Results results;
+        try{
+        if (response != null) {
+            if (response.getStatusLine().getStatusCode() == org.apache.http.HttpStatus.SC_OK) {


UnnecessarilyFullyQualified: This fully qualified name is unambiguous to the compiler if imported.

Suggested change

if (response.getStatusLine().getStatusCode() == org.apache.http.HttpStatus.SC_OK) {

if (response.getStatusLine().getStatusCode() == HttpStatus.SC_OK) {

ℹ️ Learn about @sonatype-lift commands

You can reply with the following commands. For example, reply with @sonatype-lift ignoreall to leave out all findings.

Command Usage

@sonatype-lift ignore Leave out the above finding from this PR

@sonatype-lift ignoreall Leave out all the existing findings from this PR

@sonatype-lift exclude <file|issue|path|tool> Exclude specified file|issue|path|tool from Lift findings by updating your config.toml file

Note: When talking to LiftBot, you need to refresh the page to see its response.
_{Click here to add LiftBot to another repo.}

Was this a good recommendation?
[ 🙁 Not relevant ] - [ 😕 Won't fix ] - [ 😑 Not critical, will fix ] - [ 🙂 Critical, will fix ] - [ 😊 Critical, fixing now ]

sonatype-lift · 2023-01-23T17:02:14Z

src/main/java/org/dependencytrack/tasks/repositories/MavenMetaAnalyzer.java

+                    final HttpEntity entity = response.getEntity();
+                    if (entity != null) {
+                        try (InputStream in = entity.getContent()) {
+                            final Document document = XmlUtil.buildSecureDocumentBuilder().parse(in);


XXE_DOCUMENT: The use of DocumentBuilder.parse(...) (DocumentBuilder) is vulnerable to XML External Entity attacks

ℹ️ Learn about @sonatype-lift commands

You can reply with the following commands. For example, reply with @sonatype-lift ignoreall to leave out all findings.

Command Usage

@sonatype-lift ignore Leave out the above finding from this PR

@sonatype-lift ignoreall Leave out all the existing findings from this PR

@sonatype-lift exclude <file|issue|path|tool> Exclude specified file|issue|path|tool from Lift findings by updating your config.toml file

Note: When talking to LiftBot, you need to refresh the page to see its response.
_{Click here to add LiftBot to another repo.}

Was this a good recommendation?
[ 🙁 Not relevant ] - [ 😕 Won't fix ] - [ 😑 Not critical, will fix ] - [ 🙂 Critical, will fix ] - [ 😊 Critical, fixing now ]

sonatype-lift · 2023-01-23T17:02:16Z

src/main/java/org/dependencytrack/tasks/repositories/GoModulesMetaAnalyzer.java

@@ -66,21 +63,13 @@ public MetaModel analyze(final Component component) {
        if (component.getPurl() == null || component.getPurl().getNamespace() == null) {
            return meta;
        }
-
-        final UnirestInstance ui = UnirestFactory.getUnirestInstance();
        final String url = String.format(baseUrl + API_URL, caseEncode(component.getPurl().getNamespace()), caseEncode(component.getPurl().getName()));


💬 23 similar findings have been found in this PR

Var: Unnecessary 'final' modifier.

Suggested change

final String url = String.format(baseUrl + API_URL, caseEncode(component.getPurl().getNamespace()), caseEncode(component.getPurl().getName()));

String url = String.format(baseUrl + API_URL, caseEncode(component.getPurl().getNamespace()), caseEncode(component.getPurl().getName()));

🔎 Expand here to view all instances of this finding

File Path Line Number

src/main/java/org/dependencytrack/tasks/scanners/SnykAnalysisTask.java 328

src/main/java/org/dependencytrack/util/VulnDBUtil.java 201

src/main/java/org/dependencytrack/util/VulnDBUtil.java 165

src/main/java/org/dependencytrack/tasks/scanners/SnykAnalysisTask.java 106

src/main/java/org/dependencytrack/tasks/repositories/GemMetaAnalyzer.java 65

src/main/java/org/dependencytrack/util/VulnDBUtil.java 134

src/main/java/org/dependencytrack/tasks/scanners/SnykAnalysisTask.java 345

src/main/java/org/dependencytrack/util/VulnDBUtil.java 116

src/main/java/org/dependencytrack/tasks/repositories/GoModulesMetaAnalyzer.java 68

src/main/java/org/dependencytrack/tasks/repositories/GemMetaAnalyzer.java 69

Showing 10 of 23 findings. Visit the Lift Web Console to see all.

ℹ️ Learn about @sonatype-lift commands

You can reply with the following commands. For example, reply with @sonatype-lift ignoreall to leave out all findings.

Command Usage

@sonatype-lift ignore Leave out the above finding from this PR

@sonatype-lift ignoreall Leave out all the existing findings from this PR

@sonatype-lift exclude <file|issue|path|tool> Exclude specified file|issue|path|tool from Lift findings by updating your config.toml file

Note: When talking to LiftBot, you need to refresh the page to see its response.
_{Click here to add LiftBot to another repo.}

Was this a good recommendation?
[ 🙁 Not relevant ] - [ 😕 Won't fix ] - [ 😑 Not critical, will fix ] - [ 🙂 Critical, will fix ] - [ 😊 Critical, fixing now ]

sonatype-lift · 2023-01-23T17:02:19Z

src/main/java/org/dependencytrack/util/VulnDBUtil.java

+                if (extTexts != null) {
+                    for(int j = 0; j < extTexts.length(); ++j) {
+                        JSONObject jso = extTexts.getJSONObject(j);
+                        ExternalText externalText = new ExternalText();


💬 20 similar findings have been found in this PR

Varifier: Consider using var here to avoid boilerplate.

Suggested change

ExternalText externalText = new ExternalText();

var externalText = new ExternalText();

🔎 Expand here to view all instances of this finding

File Path Line Number

src/main/java/org/dependencytrack/tasks/scanners/SnykAnalysisTask.java 327

src/main/java/org/dependencytrack/util/VulnDBUtil.java 190

src/main/java/org/dependencytrack/util/VulnDBUtil.java 81

src/main/java/org/dependencytrack/tasks/repositories/GemMetaAnalyzer.java 73

src/main/java/org/dependencytrack/util/VulnDBUtil.java 278

src/main/java/org/dependencytrack/util/VulnDBUtil.java 322

src/main/java/org/dependencytrack/tasks/repositories/GoModulesMetaAnalyzer.java 72

src/main/java/org/dependencytrack/util/VulnDBUtil.java 171

src/main/java/org/dependencytrack/util/VulnDBUtil.java 155

src/main/java/org/dependencytrack/tasks/scanners/SnykAnalysisTask.java 106

Showing 10 of 20 findings. Visit the Lift Web Console to see all.

ℹ️ Learn about @sonatype-lift commands

You can reply with the following commands. For example, reply with @sonatype-lift ignoreall to leave out all findings.

Command Usage

@sonatype-lift ignore Leave out the above finding from this PR

@sonatype-lift ignoreall Leave out all the existing findings from this PR

@sonatype-lift exclude <file|issue|path|tool> Exclude specified file|issue|path|tool from Lift findings by updating your config.toml file

Note: When talking to LiftBot, you need to refresh the page to see its response.
_{Click here to add LiftBot to another repo.}

Was this a good recommendation?
[ 🙁 Not relevant ] - [ 😕 Won't fix ] - [ 😑 Not critical, will fix ] - [ 🙂 Critical, will fix ] - [ 😊 Critical, fixing now ]

sonatype-lift · 2023-01-23T17:02:22Z

src/main/java/org/dependencytrack/tasks/repositories/GemMetaAnalyzer.java

@@ -64,29 +63,24 @@ public RepositoryType supportedRepositoryType() {
     * {@inheritDoc}
     */
    public MetaModel analyze(final Component component) {


💬 17 similar findings have been found in this PR

UnnecessaryFinal: Since Java 8, it's been unnecessary to make local variables and parameters final for use in lambdas or anonymous classes. Marking them as final is weakly discouraged, as it adds a fair amount of noise for minimal benefit.

Suggested change

public MetaModel analyze(final Component component) {

public MetaModel analyze( Component component) {

🔎 Expand here to view all instances of this finding

File Path Line Number

src/main/java/org/dependencytrack/tasks/scanners/SnykAnalysisTask.java 298

src/main/java/org/dependencytrack/tasks/scanners/SnykAnalysisTask.java 300

src/main/java/org/dependencytrack/tasks/scanners/SnykAnalysisTask.java 106

src/main/java/org/dependencytrack/tasks/repositories/GoModulesMetaAnalyzer.java 68

src/main/java/org/dependencytrack/tasks/scanners/SnykAnalysisTask.java 299

src/main/java/org/dependencytrack/tasks/scanners/SnykAnalysisTask.java 306

src/main/java/org/dependencytrack/tasks/repositories/GemMetaAnalyzer.java 68

src/main/java/org/dependencytrack/tasks/scanners/SnykAnalysisTask.java 328

src/main/java/org/dependencytrack/tasks/repositories/GoModulesMetaAnalyzer.java 72

src/main/java/org/dependencytrack/tasks/repositories/AbstractMetaAnalyzer.java 95

Showing 10 of 17 findings. Visit the Lift Web Console to see all.

ℹ️ Learn about @sonatype-lift commands

You can reply with the following commands. For example, reply with @sonatype-lift ignoreall to leave out all findings.

Command Usage

@sonatype-lift ignore Leave out the above finding from this PR

@sonatype-lift ignoreall Leave out all the existing findings from this PR

@sonatype-lift exclude <file|issue|path|tool> Exclude specified file|issue|path|tool from Lift findings by updating your config.toml file

Note: When talking to LiftBot, you need to refresh the page to see its response.
_{Click here to add LiftBot to another repo.}

Was this a good recommendation?
[ 🙁 Not relevant ] - [ 😕 Won't fix ] - [ 😑 Not critical, will fix ] - [ 🙂 Critical, will fix ] - [ 😊 Critical, fixing now ]

sonatype-lift · 2023-01-23T17:02:24Z

src/main/java/org/dependencytrack/tasks/scanners/SnykAnalysisTask.java

-                        .formatted(component.getPurl(), response.getStatus(), errors.stream()
-                                .map(error -> " - %s: %s (%s)".formatted(error.title(), error.detail(), error.code()))
-                                .collect(Collectors.joining("\n"))));
+        final HttpUriRequest request = new HttpGet(requestUrl);


💬 4 similar findings have been found in this PR

HTTP_PARAMETER_POLLUTION: Concatenating user-controlled input into a URL

🔎 Expand here to view all instances of this finding

File Path Line Number

src/main/java/org/dependencytrack/integrations/defectdojo/DefectDojoClient.java 100

src/main/java/org/dependencytrack/integrations/defectdojo/DefectDojoClient.java 115

src/main/java/org/dependencytrack/tasks/repositories/AbstractMetaAnalyzer.java 95

src/main/java/org/dependencytrack/util/VulnDBUtil.java 81

Visit the Lift Web Console to find more details in your report.

ℹ️ Learn about @sonatype-lift commands

You can reply with the following commands. For example, reply with @sonatype-lift ignoreall to leave out all findings.

Command Usage

@sonatype-lift ignore Leave out the above finding from this PR

@sonatype-lift ignoreall Leave out all the existing findings from this PR

@sonatype-lift exclude <file|issue|path|tool> Exclude specified file|issue|path|tool from Lift findings by updating your config.toml file

Note: When talking to LiftBot, you need to refresh the page to see its response.
_{Click here to add LiftBot to another repo.}

Was this a good recommendation?
[ 🙁 Not relevant ] - [ 😕 Won't fix ] - [ 😑 Not critical, will fix ] - [ 🙂 Critical, will fix ] - [ 😊 Critical, fixing now ]

sonatype-lift · 2023-01-23T17:02:26Z

🛠 Lift Auto-fix

Some of the Lift findings in this PR can be automatically fixed. You can download and apply these changes in your local project directory of your branch to review the suggestions before committing.¹

# Download the patch
curl https://lift.sonatype.com/api/patch/github.com/mehab/dependency-track/1.diff -o lift-autofixes.diff

# Apply the patch with git
git apply lift-autofixes.diff

# Review the changes
git diff

Want it all in a single command? Open a terminal in your project's directory and copy and paste the following command:

curl https://lift.sonatype.com/api/patch/github.com/mehab/dependency-track/1.diff | git apply

Once you're satisfied commit and push your changes in your project.

You can preview the patch by opening the patch URL in the browser. ↩

Signed-off-by: mehab <[email protected]>

sonatype-lift · 2023-01-24T18:42:18Z

src/main/java/org/dependencytrack/notification/publisher/AbstractWebhookPublisher.java

-            logger.error("Destination: " + destination);
-            logger.error("Response: " + response.getBody());
-            logger.debug(content);
+            HttpPost request = new HttpPost(destination);


Varifier: Consider using var here to avoid boilerplate.

Suggested change

HttpPost request = new HttpPost(destination);

var request = new HttpPost(destination);

ℹ️ Learn about @sonatype-lift commands

You can reply with the following commands. For example, reply with @sonatype-lift ignoreall to leave out all findings.

Command Usage

@sonatype-lift ignore Leave out the above finding from this PR

@sonatype-lift ignoreall Leave out all the existing findings from this PR

@sonatype-lift exclude <file|issue|path|tool> Exclude specified file|issue|path|tool from Lift findings by updating your config.toml file

Note: When talking to LiftBot, you need to refresh the page to see its response.
_{Click here to add LiftBot to another repo.}

Was this a good recommendation?
[ 🙁 Not relevant ] - [ 😕 Won't fix ] - [ 😑 Not critical, will fix ] - [ 🙂 Critical, will fix ] - [ 😊 Critical, fixing now ]

sonatype-lift · 2023-01-24T18:42:20Z

src/main/java/org/dependencytrack/notification/publisher/AbstractWebhookPublisher.java

@@ -46,33 +54,31 @@ public void publish(final String publisherName, final PebbleTemplate template, f
            return;
        }
        final String mimeType = getTemplateMimeType(config);


💬 10 similar findings have been found in this PR

Var: Unnecessary 'final' modifier.

Suggested change

final String mimeType = getTemplateMimeType(config);

String mimeType = getTemplateMimeType(config);

🔎 Expand here to view all instances of this finding

File Path Line Number

src/main/java/org/dependencytrack/notification/publisher/AbstractWebhookPublisher.java 61

src/main/java/org/dependencytrack/notification/publisher/AbstractWebhookPublisher.java 96

src/main/java/org/dependencytrack/notification/publisher/AbstractWebhookPublisher.java 44

src/main/java/org/dependencytrack/notification/publisher/AbstractWebhookPublisher.java 43

src/main/java/org/dependencytrack/notification/publisher/AbstractWebhookPublisher.java 43

src/main/java/org/dependencytrack/notification/publisher/AbstractWebhookPublisher.java 43

src/main/java/org/dependencytrack/notification/publisher/AbstractWebhookPublisher.java 85

src/main/java/org/dependencytrack/notification/publisher/AbstractWebhookPublisher.java 43

src/main/java/org/dependencytrack/notification/publisher/AbstractWebhookPublisher.java 72

src/main/java/org/dependencytrack/notification/publisher/AbstractWebhookPublisher.java 96

Visit the Lift Web Console to find more details in your report.

ℹ️ Learn about @sonatype-lift commands

You can reply with the following commands. For example, reply with @sonatype-lift ignoreall to leave out all findings.

Command Usage

@sonatype-lift ignore Leave out the above finding from this PR

@sonatype-lift ignoreall Leave out all the existing findings from this PR

@sonatype-lift exclude <file|issue|path|tool> Exclude specified file|issue|path|tool from Lift findings by updating your config.toml file

Note: When talking to LiftBot, you need to refresh the page to see its response.
_{Click here to add LiftBot to another repo.}

Was this a good recommendation?
[ 🙁 Not relevant ] - [ 😕 Won't fix ] - [ 😑 Not critical, will fix ] - [ 🙂 Critical, will fix ] - [ 😊 Critical, fixing now ]

sonatype-lift · 2023-01-24T18:42:22Z

src/main/java/org/dependencytrack/notification/publisher/AbstractWebhookPublisher.java


 public abstract class AbstractWebhookPublisher implements Publisher {
+    private static final org.slf4j.Logger LOGGER = LoggerFactory.getLogger(AbstractWebhookPublisher.class);

    public void publish(final String publisherName, final PebbleTemplate template, final Notification notification, final JsonObject config) {


💬 10 similar findings have been found in this PR

UnnecessaryFinal: Since Java 8, it's been unnecessary to make local variables and parameters final for use in lambdas or anonymous classes. Marking them as final is weakly discouraged, as it adds a fair amount of noise for minimal benefit.

Suggested change

public void publish(final String publisherName, final PebbleTemplate template, final Notification notification, final JsonObject config) {

public void publish(final String publisherName, final PebbleTemplate template, Notification notification, final JsonObject config) {

🔎 Expand here to view all instances of this finding

File Path Line Number

src/main/java/org/dependencytrack/notification/publisher/AbstractWebhookPublisher.java 44

src/main/java/org/dependencytrack/notification/publisher/AbstractWebhookPublisher.java 43

src/main/java/org/dependencytrack/notification/publisher/AbstractWebhookPublisher.java 43

src/main/java/org/dependencytrack/notification/publisher/AbstractWebhookPublisher.java 43

src/main/java/org/dependencytrack/notification/publisher/AbstractWebhookPublisher.java 96

src/main/java/org/dependencytrack/notification/publisher/AbstractWebhookPublisher.java 96

src/main/java/org/dependencytrack/notification/publisher/AbstractWebhookPublisher.java 72

src/main/java/org/dependencytrack/notification/publisher/AbstractWebhookPublisher.java 56

src/main/java/org/dependencytrack/notification/publisher/AbstractWebhookPublisher.java 85

src/main/java/org/dependencytrack/notification/publisher/AbstractWebhookPublisher.java 61

Visit the Lift Web Console to find more details in your report.

ℹ️ Learn about @sonatype-lift commands

You can reply with the following commands. For example, reply with @sonatype-lift ignoreall to leave out all findings.

Command Usage

@sonatype-lift ignore Leave out the above finding from this PR

@sonatype-lift ignoreall Leave out all the existing findings from this PR

@sonatype-lift exclude <file|issue|path|tool> Exclude specified file|issue|path|tool from Lift findings by updating your config.toml file

Note: When talking to LiftBot, you need to refresh the page to see its response.
_{Click here to add LiftBot to another repo.}

Was this a good recommendation?
[ 🙁 Not relevant ] - [ 😕 Won't fix ] - [ 😑 Not critical, will fix ] - [ 🙂 Critical, will fix ] - [ 😊 Critical, fixing now ]

Signed-off-by: mehab <[email protected]>

…to feature/removeUnirest

sonatype-lift · 2023-01-27T19:45:12Z

src/main/java/org/dependencytrack/integrations/fortifyssc/FortifySscClient.java

+            HttpPost request = new HttpPost(builder.build());
+            request.addHeader("accept", "application/xml");
+            HttpEntity data = MultipartEntityBuilder.create().setMode(HttpMultipartMode.BROWSER_COMPATIBLE)
+                    .addBinaryBody("files[]", findingsJson, org.apache.http.entity.ContentType.APPLICATION_JSON, "findings.json")


UnnecessarilyFullyQualified: This fully qualified name is unambiguous to the compiler if imported.

Suggested change

.addBinaryBody("files[]", findingsJson, org.apache.http.entity.ContentType.APPLICATION_JSON, "findings.json")

.addBinaryBody("files[]", findingsJson, ContentType.APPLICATION_JSON, "findings.json")

ℹ️ Learn about @sonatype-lift commands

You can reply with the following commands. For example, reply with @sonatype-lift ignoreall to leave out all findings.

Command Usage

@sonatype-lift ignore Leave out the above finding from this PR

@sonatype-lift ignoreall Leave out all the existing findings from this PR

@sonatype-lift exclude <file|issue|path|tool> Exclude specified file|issue|path|tool from Lift findings by updating your config.toml file

Note: When talking to LiftBot, you need to refresh the page to see its response.
_{Click here to add LiftBot to another repo.}

Was this a good recommendation?
[ 🙁 Not relevant ] - [ 😕 Won't fix ] - [ 😑 Not critical, will fix ] - [ 🙂 Critical, will fix ] - [ 😊 Critical, fixing now ]

sonatype-lift · 2023-01-27T19:45:14Z

src/main/java/org/dependencytrack/tasks/repositories/CargoMetaAnalyzer.java

-                        final JSONObject crate = response.getBody().getObject().optJSONObject("crate");
+            try (final CloseableHttpResponse response = processHttpRequest(url)) {
+                if (response.getStatusLine().getStatusCode() == HttpStatus.SC_OK) {
+                    final HttpEntity entity = response.getEntity();


💬 15 similar findings have been found in this PR

Var: Unnecessary 'final' modifier.

Suggested change

final HttpEntity entity = response.getEntity();

HttpEntity entity = response.getEntity();

🔎 Expand here to view all instances of this finding

File Path Line Number

src/main/java/org/dependencytrack/tasks/repositories/CargoMetaAnalyzer.java 72

src/main/java/org/dependencytrack/tasks/repositories/CargoMetaAnalyzer.java 70

src/main/java/org/dependencytrack/tasks/repositories/CargoMetaAnalyzer.java 88

src/main/java/org/dependencytrack/tasks/repositories/CargoMetaAnalyzer.java 90

src/main/java/org/dependencytrack/tasks/repositories/CargoMetaAnalyzer.java 87

src/main/java/org/dependencytrack/tasks/repositories/CargoMetaAnalyzer.java 81

src/main/java/org/dependencytrack/integrations/fortifyssc/FortifySscClient.java 79

src/main/java/org/dependencytrack/tasks/repositories/CargoMetaAnalyzer.java 69

src/main/java/org/dependencytrack/tasks/repositories/CargoMetaAnalyzer.java 84

src/main/java/org/dependencytrack/integrations/fortifyssc/FortifySscClient.java 54

Showing 10 of 15 findings. Visit the Lift Web Console to see all.

ℹ️ Learn about @sonatype-lift commands

You can reply with the following commands. For example, reply with @sonatype-lift ignoreall to leave out all findings.

Command Usage

@sonatype-lift ignore Leave out the above finding from this PR

@sonatype-lift ignoreall Leave out all the existing findings from this PR

@sonatype-lift exclude <file|issue|path|tool> Exclude specified file|issue|path|tool from Lift findings by updating your config.toml file

Note: When talking to LiftBot, you need to refresh the page to see its response.
_{Click here to add LiftBot to another repo.}

Was this a good recommendation?
[ 🙁 Not relevant ] - [ 😕 Won't fix ] - [ 😑 Not critical, will fix ] - [ 🙂 Critical, will fix ] - [ 😊 Critical, fixing now ]

sonatype-lift · 2023-01-27T19:45:17Z

src/main/java/org/dependencytrack/tasks/repositories/CargoMetaAnalyzer.java

-                        final JSONObject crate = response.getBody().getObject().optJSONObject("crate");
+            try (final CloseableHttpResponse response = processHttpRequest(url)) {
+                if (response.getStatusLine().getStatusCode() == HttpStatus.SC_OK) {
+                    final HttpEntity entity = response.getEntity();


💬 15 similar findings have been found in this PR

UnnecessaryFinal: Since Java 8, it's been unnecessary to make local variables and parameters final for use in lambdas or anonymous classes. Marking them as final is weakly discouraged, as it adds a fair amount of noise for minimal benefit.

Suggested change

final HttpEntity entity = response.getEntity();

HttpEntity entity = response.getEntity();

🔎 Expand here to view all instances of this finding

File Path Line Number

src/main/java/org/dependencytrack/integrations/fortifyssc/FortifySscClient.java 54

src/main/java/org/dependencytrack/tasks/repositories/CargoMetaAnalyzer.java 73

src/main/java/org/dependencytrack/integrations/fortifyssc/FortifySscClient.java 79

src/main/java/org/dependencytrack/tasks/repositories/CargoMetaAnalyzer.java 79

src/main/java/org/dependencytrack/tasks/repositories/CargoMetaAnalyzer.java 88

src/main/java/org/dependencytrack/integrations/fortifyssc/FortifySscClient.java 51

src/main/java/org/dependencytrack/integrations/fortifyssc/FortifySscClient.java 79

src/main/java/org/dependencytrack/tasks/repositories/CargoMetaAnalyzer.java 81

src/main/java/org/dependencytrack/tasks/repositories/CargoMetaAnalyzer.java 72

src/main/java/org/dependencytrack/tasks/repositories/CargoMetaAnalyzer.java 90

Showing 10 of 15 findings. Visit the Lift Web Console to see all.

ℹ️ Learn about @sonatype-lift commands

You can reply with the following commands. For example, reply with @sonatype-lift ignoreall to leave out all findings.

Command Usage

@sonatype-lift ignore Leave out the above finding from this PR

@sonatype-lift ignoreall Leave out all the existing findings from this PR

@sonatype-lift exclude <file|issue|path|tool> Exclude specified file|issue|path|tool from Lift findings by updating your config.toml file

Note: When talking to LiftBot, you need to refresh the page to see its response.
_{Click here to add LiftBot to another repo.}

Was this a good recommendation?
[ 🙁 Not relevant ] - [ 😕 Won't fix ] - [ 😑 Not critical, will fix ] - [ 🙂 Critical, will fix ] - [ 😊 Critical, fixing now ]

sonatype-lift · 2023-01-27T19:45:19Z

src/main/java/org/dependencytrack/integrations/fortifyssc/FortifySscClient.java

@@ -45,49 +50,54 @@ public FortifySscClient(final FortifySscUploader uploader, final URL baseURL) {

    public String generateOneTimeUploadToken(final String citoken) {
        LOGGER.debug("Generating one-time upload token");
-        final UnirestInstance ui = UnirestFactory.getUnirestInstance();
+        HttpPost request = new HttpPost(baseURL + "/api/v1/fileTokens");


💬 3 similar findings have been found in this PR

Varifier: Consider using var here to avoid boilerplate.

Suggested change

HttpPost request = new HttpPost(baseURL + "/api/v1/fileTokens");

var request = new HttpPost(baseURL + "/api/v1/fileTokens");

🔎 Expand here to view all instances of this finding

File Path Line Number

src/main/java/org/dependencytrack/integrations/fortifyssc/FortifySscClient.java 63

src/main/java/org/dependencytrack/tasks/repositories/CargoMetaAnalyzer.java 78

src/main/java/org/dependencytrack/tasks/repositories/CargoMetaAnalyzer.java 70

Visit the Lift Web Console to find more details in your report.

ℹ️ Learn about @sonatype-lift commands

You can reply with the following commands. For example, reply with @sonatype-lift ignoreall to leave out all findings.

Command Usage

@sonatype-lift ignore Leave out the above finding from this PR

@sonatype-lift ignoreall Leave out all the existing findings from this PR

@sonatype-lift exclude <file|issue|path|tool> Exclude specified file|issue|path|tool from Lift findings by updating your config.toml file

Note: When talking to LiftBot, you need to refresh the page to see its response.
_{Click here to add LiftBot to another repo.}

Was this a good recommendation?
[ 🙁 Not relevant ] - [ 😕 Won't fix ] - [ 😑 Not critical, will fix ] - [ 🙂 Critical, will fix ] - [ 😊 Critical, fixing now ]

…y-track into feature/removeUnirest

…ndency-track into feature/removeUnirest

…y-track into feature/removeUnirest

sonatype-lift · 2023-02-03T11:34:40Z

src/main/java/org/dependencytrack/model/vulnDb/VulnDbParser.java

+    }
+
+    public <T> Results<T> parse(File file, Class<? extends ApiObject> apiObject) throws IOException {
+            String jsonData = Files.readString(Paths.get(file.toURI()), Charset.defaultCharset());


PATH_TRAVERSAL_IN: This API (java/nio/file/Paths.get(Ljava/net/URI;)Ljava/nio/file/Path;) reads a file whose location might be specified by user input

ℹ️ Learn about @sonatype-lift commands

You can reply with the following commands. For example, reply with @sonatype-lift ignoreall to leave out all findings.

Command Usage

@sonatype-lift ignore Leave out the above finding from this PR

@sonatype-lift ignoreall Leave out all the existing findings from this PR

@sonatype-lift exclude <file|issue|path|tool> Exclude specified file|issue|path|tool from Lift findings by updating your config.toml file

Note: When talking to LiftBot, you need to refresh the page to see its response.
_{Click here to add LiftBot to another repo.}

Was this a good recommendation?
[ 🙁 Not relevant ] - [ 😕 Won't fix ] - [ 😑 Not critical, will fix ] - [ 🙂 Critical, will fix ] - [ 😊 Critical, fixing now ]

sonatype-lift · 2023-02-03T11:40:23Z

src/main/java/org/dependencytrack/parser/cyclonedx/util/ModelConverter.java

@@ -663,8 +665,11 @@ public static org.cyclonedx.model.vulnerability.Vulnerability convert(final Quer
    }

    /**
-     * Converts a parsed Bom to a native list of Dependency-Track component object
+     * Converts a parsed Bom to a native list of Dependency-Track component objects
+     * @param qm


EmptyBlockTag: A block tag (@param, @return, @throws, @deprecated) has an empty description. Block tags without descriptions don't add much value for future readers of the code; consider removing the tag entirely or adding a description.

Suggested change

* @param qm

*

ℹ️ Learn about @sonatype-lift commands

You can reply with the following commands. For example, reply with @sonatype-lift ignoreall to leave out all findings.

Command Usage

@sonatype-lift ignore Leave out the above finding from this PR

@sonatype-lift ignoreall Leave out all the existing findings from this PR

@sonatype-lift exclude <file|issue|path|tool> Exclude specified file|issue|path|tool from Lift findings by updating your config.toml file

Note: When talking to LiftBot, you need to refresh the page to see its response.
_{Click here to add LiftBot to another repo.}

Was this a good recommendation?
[ 🙁 Not relevant ] - [ 😕 Won't fix ] - [ 😑 Not critical, will fix ] - [ 🙂 Critical, will fix ] - [ 😊 Critical, fixing now ]

sonatype-lift · 2023-02-03T11:40:25Z

src/main/java/org/dependencytrack/parser/cyclonedx/util/ModelConverter.java

                final JSONArray jsonArray = new JSONArray();
-                final org.cyclonedx.model.Dependency d1 = getDependencyFromBomRef(c1.getBomRef(), bom.getDependencies());
+                final org.cyclonedx.model.Dependency d1 = getDependencyFromBomRef(c1.getKey(), bom.getDependencies());


UnnecessarilyFullyQualified: This fully qualified name is unambiguous to the compiler if imported.

Suggested change

final org.cyclonedx.model.Dependency d1 = getDependencyFromBomRef(c1.getKey(), bom.getDependencies());

final Dependency targetDep = getDependencyFromBomRef(targetBomRef, bom.getDependencies());

ℹ️ Learn about @sonatype-lift commands

You can reply with the following commands. For example, reply with @sonatype-lift ignoreall to leave out all findings.

Command Usage

@sonatype-lift ignore Leave out the above finding from this PR

@sonatype-lift ignoreall Leave out all the existing findings from this PR

@sonatype-lift exclude <file|issue|path|tool> Exclude specified file|issue|path|tool from Lift findings by updating your config.toml file

Note: When talking to LiftBot, you need to refresh the page to see its response.
_{Click here to add LiftBot to another repo.}

Was this a good recommendation?
[ 🙁 Not relevant ] - [ 😕 Won't fix ] - [ 😑 Not critical, will fix ] - [ 🙂 Critical, will fix ] - [ 😊 Critical, fixing now ]

Signed-off-by: mehab <[email protected]>

sonatype-lift · 2023-02-03T11:57:28Z

src/main/java/org/dependencytrack/model/vuln_vb/VulnDbParser.java

+    }
+
+    public <T> Results<T> parse(File file, Class<? extends ApiObject> apiObject) throws IOException {
+            String jsonData = Files.readString(Paths.get(file.toURI()), Charset.defaultCharset());


PATH_TRAVERSAL_IN: This API (java/nio/file/Paths.get(Ljava/net/URI;)Ljava/nio/file/Path;) reads a file whose location might be specified by user input

ℹ️ Learn about @sonatype-lift commands

You can reply with the following commands. For example, reply with @sonatype-lift ignoreall to leave out all findings.

Command Usage

@sonatype-lift ignore Leave out the above finding from this PR

@sonatype-lift ignoreall Leave out all the existing findings from this PR

@sonatype-lift exclude <file|issue|path|tool> Exclude specified file|issue|path|tool from Lift findings by updating your config.toml file

Note: When talking to LiftBot, you need to refresh the page to see its response.
_{Click here to add LiftBot to another repo.}

Was this a good recommendation?
[ 🙁 Not relevant ] - [ 😕 Won't fix ] - [ 😑 Not critical, will fix ] - [ 🙂 Critical, will fix ] - [ 😊 Critical, fixing now ]

Signed-off-by: mehab <[email protected]>

sonatype-lift · 2023-02-03T14:13:06Z

src/main/java/org/dependencytrack/model/vulndb/VulnDbParser.java

+    }
+
+    public <T> Results<T> parse(File file, Class<? extends ApiObject> apiObject) throws IOException {
+            String jsonData = Files.readString(Paths.get(file.toURI()), Charset.defaultCharset());


PATH_TRAVERSAL_IN: This API (java/nio/file/Paths.get(Ljava/net/URI;)Ljava/nio/file/Path;) reads a file whose location might be specified by user input

ℹ️ Learn about @sonatype-lift commands

You can reply with the following commands. For example, reply with @sonatype-lift ignoreall to leave out all findings.

Command Usage

@sonatype-lift ignore Leave out the above finding from this PR

@sonatype-lift ignoreall Leave out all the existing findings from this PR

@sonatype-lift exclude <file|issue|path|tool> Exclude specified file|issue|path|tool from Lift findings by updating your config.toml file

Note: When talking to LiftBot, you need to refresh the page to see its response.
_{Click here to add LiftBot to another repo.}

Was this a good recommendation?
[ 🙁 Not relevant ] - [ 😕 Won't fix ] - [ 😑 Not critical, will fix ] - [ 🙂 Critical, will fix ] - [ 😊 Critical, fixing now ]

Signed-off-by: mehab <[email protected]>

sonatype-lift · 2023-02-06T11:33:53Z

src/main/java/org/dependencytrack/policy/ComponentAgePolicyEvaluator.java

+
+        final LocalDate publishedDate = LocalDate.ofInstant(published.toInstant(), ZoneId.systemDefault());
+        final LocalDate ageDate = publishedDate.plus(agePeriod);
+        final LocalDate today = LocalDate.now();


JavaTimeDefaultTimeZone: LocalDate.now() is not allowed because it silently uses the system default time-zone. You must pass an explicit time-zone (e.g., ZoneId.of("America/Los_Angeles")) to this method.

Suggested change

final LocalDate today = LocalDate.now();

final LocalDate today = LocalDate.now(ZoneId.systemDefault());

ℹ️ Learn about @sonatype-lift commands

You can reply with the following commands. For example, reply with @sonatype-lift ignoreall to leave out all findings.

Command Usage

@sonatype-lift ignore Leave out the above finding from this PR

@sonatype-lift ignoreall Leave out all the existing findings from this PR

@sonatype-lift exclude <file|issue|path|tool> Exclude specified file|issue|path|tool from Lift findings by updating your config.toml file

Note: When talking to LiftBot, you need to refresh the page to see its response.
_{Click here to add LiftBot to another repo.}

Was this a good recommendation?
[ 🙁 Not relevant ] - [ 😕 Won't fix ] - [ 😑 Not critical, will fix ] - [ 🙂 Critical, will fix ] - [ 😊 Critical, fixing now ]

sonatype-lift · 2023-02-06T11:33:55Z

src/main/java/org/dependencytrack/policy/ComponentAgePolicyEvaluator.java

+            case NUMERIC_EQUAL -> ageDate.isEqual(today);
+            case NUMERIC_NOT_EQUAL -> !ageDate.isEqual(today);
+            case NUMERIC_LESSER_THAN_OR_EQUAL -> ageDate.isEqual(today) || ageDate.isAfter(today);
+            case NUMERIC_LESS_THAN -> ageDate.isAfter(LocalDate.now());


JavaTimeDefaultTimeZone: LocalDate.now() is not allowed because it silently uses the system default time-zone. You must pass an explicit time-zone (e.g., ZoneId.of("America/Los_Angeles")) to this method.

Suggested change

case NUMERIC_LESS_THAN -> ageDate.isAfter(LocalDate.now());

case NUMERIC_LESS_THAN -> ageDate.isAfter(LocalDate.now(ZoneId.systemDefault()));

ℹ️ Learn about @sonatype-lift commands

You can reply with the following commands. For example, reply with @sonatype-lift ignoreall to leave out all findings.

Command Usage

@sonatype-lift ignore Leave out the above finding from this PR

@sonatype-lift ignoreall Leave out all the existing findings from this PR

@sonatype-lift exclude <file|issue|path|tool> Exclude specified file|issue|path|tool from Lift findings by updating your config.toml file

Note: When talking to LiftBot, you need to refresh the page to see its response.
_{Click here to add LiftBot to another repo.}

Was this a good recommendation?
[ 🙁 Not relevant ] - [ 😕 Won't fix ] - [ 😑 Not critical, will fix ] - [ 🙂 Critical, will fix ] - [ 😊 Critical, fixing now ]

sonatype-lift · 2023-02-06T11:33:58Z

src/main/java/org/dependencytrack/policy/PolicyEngine.java

@@ -55,6 +55,7 @@ public PolicyEngine() {
        evaluators.add(new CpePolicyEvaluator());
        evaluators.add(new SwidTagIdPolicyEvaluator());
        evaluators.add(new VersionPolicyEvaluator());
+        evaluators.add(new ComponentAgePolicyEvaluator());


RESOURCE_LEAK: resource of type org.dependencytrack.persistence.QueryManager acquired by call to ComponentAgePolicyEvaluator() at line 58 is not released after line 58.

ℹ️ Learn about @sonatype-lift commands

You can reply with the following commands. For example, reply with @sonatype-lift ignoreall to leave out all findings.

Command Usage

@sonatype-lift ignore Leave out the above finding from this PR

@sonatype-lift ignoreall Leave out all the existing findings from this PR

@sonatype-lift exclude <file|issue|path|tool> Exclude specified file|issue|path|tool from Lift findings by updating your config.toml file

Note: When talking to LiftBot, you need to refresh the page to see its response.
_{Click here to add LiftBot to another repo.}

Was this a good recommendation?
[ 🙁 Not relevant ] - [ 😕 Won't fix ] - [ 😑 Not critical, will fix ] - [ 🙂 Critical, will fix ] - [ 😊 Critical, fixing now ]

Signed-off-by: mehab <[email protected]>

…y-track into feature/removeUnirest

sonatype-lift · 2023-02-10T20:25:42Z

src/main/java/org/dependencytrack/integrations/defectdojo/DefectDojoClient.java

+                .addPart("close_old_findings", new StringBody("true", ContentType.MULTIPART_FORM_DATA))
+                .addPart("push_to_jira", new StringBody("push_to_jira", ContentType.MULTIPART_FORM_DATA))
+                .addPart("test", new StringBody(testId, ContentType.MULTIPART_FORM_DATA))
+                .addPart("scan_date", new StringBody(DATE_FORMAT.format(new Date()), ContentType.MULTIPART_FORM_DATA))


JavaUtilDate: Date has a bad API that leads to bugs; prefer java.time.Instant or LocalDate.

ℹ️ Expand to see all @sonatype-lift commands

You can reply with the following commands. For example, reply with @sonatype-lift ignoreall to leave out all findings.

Command Usage

@sonatype-lift ignore Leave out the above finding from this PR

@sonatype-lift ignoreall Leave out all the existing findings from this PR

@sonatype-lift exclude <file|issue|path|tool> Exclude specified file|issue|path|tool from Lift findings by updating your config.toml file

Note: When talking to LiftBot, you need to refresh the page to see its response.
_{Click here to add LiftBot to another repo.}

Help us improve LIFT! (Sonatype LiftBot external survey)

Was this a good recommendation for you? _{Answering this survey will not impact your Lift settings.}

[ 🙁 Not relevant ] - [ 😕 Won't fix ] - [ 😑 Not critical, will fix ] - [ 🙂 Critical, will fix ] - [ 😊 Critical, fixing now ]

sonatype-lift · 2023-02-10T20:25:44Z

src/main/java/org/dependencytrack/integrations/defectdojo/DefectDojoClient.java

+                .addPart("minimum_severity", new StringBody("Info", ContentType.MULTIPART_FORM_DATA))
+                .addPart("close_old_findings", new StringBody("true", ContentType.MULTIPART_FORM_DATA))
+                .addPart("push_to_jira", new StringBody("push_to_jira", ContentType.MULTIPART_FORM_DATA))
+                .addPart("scan_date", new StringBody(DATE_FORMAT.format(new Date()), ContentType.MULTIPART_FORM_DATA))


JavaUtilDate: Date has a bad API that leads to bugs; prefer java.time.Instant or LocalDate.

ℹ️ Expand to see all @sonatype-lift commands

You can reply with the following commands. For example, reply with @sonatype-lift ignoreall to leave out all findings.

Command Usage

@sonatype-lift ignore Leave out the above finding from this PR

@sonatype-lift ignoreall Leave out all the existing findings from this PR

@sonatype-lift exclude <file|issue|path|tool> Exclude specified file|issue|path|tool from Lift findings by updating your config.toml file

Note: When talking to LiftBot, you need to refresh the page to see its response.
_{Click here to add LiftBot to another repo.}

Help us improve LIFT! (Sonatype LiftBot external survey)

Was this a good recommendation for you? _{Answering this survey will not impact your Lift settings.}

[ 🙁 Not relevant ] - [ 😕 Won't fix ] - [ 😑 Not critical, will fix ] - [ 🙂 Critical, will fix ] - [ 😊 Critical, fixing now ]

sonatype-lift · 2023-02-10T20:25:46Z

src/main/java/org/dependencytrack/parser/vulndb/VulnDbParser.java

+    }
+
+    public <T> Results<T> parse(File file, Class<? extends ApiObject> apiObject) throws IOException {
+        String jsonData = Files.readString(Paths.get(file.toURI()), Charset.defaultCharset());


PATH_TRAVERSAL_IN: This API (java/nio/file/Paths.get(Ljava/net/URI;)Ljava/nio/file/Path;) reads a file whose location might be specified by user input

ℹ️ Expand to see all @sonatype-lift commands

You can reply with the following commands. For example, reply with @sonatype-lift ignoreall to leave out all findings.

Command Usage

@sonatype-lift ignore Leave out the above finding from this PR

@sonatype-lift ignoreall Leave out all the existing findings from this PR

@sonatype-lift exclude <file|issue|path|tool> Exclude specified file|issue|path|tool from Lift findings by updating your config.toml file

Note: When talking to LiftBot, you need to refresh the page to see its response.
_{Click here to add LiftBot to another repo.}

Help us improve LIFT! (Sonatype LiftBot external survey)

Was this a good recommendation for you? _{Answering this survey will not impact your Lift settings.}

[ 🙁 Not relevant ] - [ 😕 Won't fix ] - [ 😑 Not critical, will fix ] - [ 🙂 Critical, will fix ] - [ 😊 Critical, fixing now ]

Signed-off-by: mehab <[email protected]>

…y-track into feature/removeUnirest

Signed-off-by: mehab <[email protected]>

…ndency-track into feature/removeUnirest

Signed-off-by: mehab <[email protected]>

sonatype-lift · 2023-02-13T13:11:03Z

src/main/java/org/dependencytrack/tasks/scanners/BaseComponentAnalyzerTask.java

@@ -147,7 +147,7 @@ protected void handleUnexpectedHttpResponse(final Logger logger, String url, fin
        );
    }

-    protected void handleRequestException(final Logger logger, final Exception e) {
+    protected void handleRequestException(final Logger logger, final Throwable e) {


InconsistentCapitalization: Found the field 'LOGGER' with the same name as the parameter 'logger' but with different capitalization.

Suggested change

protected void handleRequestException(final Logger logger, final Throwable e) {

protected void handleRequestException(final Logger LOGGER, final Throwable e) {

ℹ️ Expand to see all @sonatype-lift commands

You can reply with the following commands. For example, reply with @sonatype-lift ignoreall to leave out all findings.

Command Usage

@sonatype-lift ignore Leave out the above finding from this PR

@sonatype-lift ignoreall Leave out all the existing findings from this PR

@sonatype-lift exclude <file|issue|path|tool> Exclude specified file|issue|path|tool from Lift findings by updating your config.toml file

Note: When talking to LiftBot, you need to refresh the page to see its response.
_{Click here to add LiftBot to another repo.}

Help us improve LIFT! (Sonatype LiftBot external survey)

Was this a good recommendation for you? _{Answering this survey will not impact your Lift settings.}

[ 🙁 Not relevant ] - [ 😕 Won't fix ] - [ 😑 Not critical, will fix ] - [ 🙂 Critical, will fix ] - [ 😊 Critical, fixing now ]

Update from dependency-track

mehab added 8 commits January 17, 2023 21:46

unirest removed from repo meta analyzer files

c7a7074

Signed-off-by: mehab <[email protected]>

empty commit

39f31f3

Signed-off-by: mehab <[email protected]>

more removal of unirest

7e40086

Signed-off-by: mehab <[email protected]>

merged changes from upstream master

6cc00de

Signed-off-by: mehab <[email protected]>

defect dojo and oss index changed

2c99bf2

Signed-off-by: mehab <[email protected]>

removed unirest client

b1dca1d

Signed-off-by: mehab <[email protected]>

cleanup

e691dda

Signed-off-by: mehab <[email protected]>

removed spdx based test that is not working and is not relevant

89ab958

Signed-off-by: mehab <[email protected]>

sonatype-lift bot reviewed Jan 23, 2023

View reviewed changes

added unit tests for vulndb

f7d6c1c

Signed-off-by: mehab <[email protected]>

sonatype-lift bot reviewed Jan 24, 2023

View reviewed changes

mehab added 2 commits January 27, 2023 19:32

added tests

9e45ee7

Signed-off-by: mehab <[email protected]>

Merge branch 'master' of https://github.com/mehab/dependency-track in…

d718caa

…to feature/removeUnirest

sonatype-lift bot reviewed Jan 27, 2023

View reviewed changes

mehab added 3 commits January 30, 2023 15:20

Merge branch 'DependencyTrack:master' into feature/removeUnirest

c5b0e96

Merge branch 'master' of https://github.com/DependencyTrack/dependenc…

d405ab8

…y-track into feature/removeUnirest

Merge branch 'feature/removeUnirest' of https://github.com/mehab/depe…

21d2ae5

…ndency-track into feature/removeUnirest

Merge branch 'master' of https://github.com/DependencyTrack/dependenc…

4a34be1

…y-track into feature/removeUnirest

sonatype-lift bot reviewed Feb 3, 2023

View reviewed changes

renamed package per standard

2a7f648

Signed-off-by: mehab <[email protected]>

sonatype-lift bot reviewed Feb 3, 2023

View reviewed changes

changed package name to follow convention

119b8f5

Signed-off-by: mehab <[email protected]>

sonatype-lift bot reviewed Feb 3, 2023

View reviewed changes

changes from merge master and pr review

8a049f1

Signed-off-by: mehab <[email protected]>

sonatype-lift bot reviewed Feb 6, 2023

View reviewed changes

mehab added 4 commits February 6, 2023 11:37

merged changes from master upstream

4309ca9

Signed-off-by: mehab <[email protected]>

intermediate changes

2e8af4a

Signed-off-by: mehab <[email protected]>

all changes completed except additional unit test

860c90e

Signed-off-by: mehab <[email protected]>

Merge branch 'master' of https://github.com/DependencyTrack/dependenc…

a119f8b

…y-track into feature/removeUnirest

sonatype-lift bot reviewed Feb 10, 2023

View reviewed changes

mehab added 9 commits February 11, 2023 08:25

fixed unit test

9cfd580

Signed-off-by: mehab <[email protected]>

content type found and updated for defectdojo and fortifyssc

58d863f

Signed-off-by: mehab <[email protected]>

Merge branch 'DependencyTrack:master' into feature/removeUnirest

b95545a

Merge branch 'master' of https://github.com/DependencyTrack/dependenc…

3d780f4

…y-track into feature/removeUnirest

resolved merged error

e2c6eee

Signed-off-by: mehab <[email protected]>

Merge branch 'feature/removeUnirest' of https://github.com/mehab/depe…

46e6640

…ndency-track into feature/removeUnirest

merged changes from main

c974b72

Signed-off-by: mehab <[email protected]>

added tests with wiremock

1c1b1d3

Signed-off-by: mehab <[email protected]>

added tests with wiremock

38b3115

Signed-off-by: mehab <[email protected]>

sonatype-lift bot reviewed Feb 13, 2023

View reviewed changes

mehab pushed a commit that referenced this pull request Jun 27, 2023

Merge pull request #1 from DependencyTrack/master

828c057

Update from dependency-track

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Feature/remove unirest #1

Feature/remove unirest #1

mehab commented Jan 23, 2023

sonatype-lift bot Jan 23, 2023

sonatype-lift bot Jan 23, 2023

sonatype-lift bot Jan 23, 2023

sonatype-lift bot Jan 23, 2023

sonatype-lift bot Jan 23, 2023

sonatype-lift bot Jan 23, 2023

sonatype-lift bot Jan 23, 2023

sonatype-lift bot Jan 23, 2023

sonatype-lift bot commented Jan 23, 2023

sonatype-lift bot Jan 24, 2023

sonatype-lift bot Jan 24, 2023

sonatype-lift bot Jan 24, 2023

sonatype-lift bot Jan 27, 2023

sonatype-lift bot Jan 27, 2023

sonatype-lift bot Jan 27, 2023

sonatype-lift bot Jan 27, 2023

sonatype-lift bot Feb 3, 2023

sonatype-lift bot Feb 3, 2023

sonatype-lift bot Feb 3, 2023

sonatype-lift bot Feb 3, 2023

sonatype-lift bot Feb 3, 2023

sonatype-lift bot Feb 6, 2023

sonatype-lift bot Feb 6, 2023

sonatype-lift bot Feb 6, 2023

sonatype-lift bot Feb 10, 2023

sonatype-lift bot Feb 10, 2023

sonatype-lift bot Feb 10, 2023

sonatype-lift bot Feb 13, 2023

	.retryOnResult(response -> 429 == response.getStatusLine().getStatusCode())
	.retryOnResult(response -> response.getStatusLine().getStatusCode() == 429)

Command	Usage
`@sonatype-lift ignore`	Leave out the above finding from this PR
`@sonatype-lift ignoreall`	Leave out all the existing findings from this PR
`@sonatype-lift exclude <file\|issue\|path\|tool>`	Exclude specified `file\|issue\|path\|tool` from Lift findings by updating your config.toml file

	final JSONObject responseJson = new org.json.JSONObject(responseString);
	final JSONObject responseJson = new JSONObject(responseString);

	if (response.getStatusLine().getStatusCode() == org.apache.http.HttpStatus.SC_OK) {
	if (response.getStatusLine().getStatusCode() == HttpStatus.SC_OK) {

	final String url = String.format(baseUrl + API_URL, caseEncode(component.getPurl().getNamespace()), caseEncode(component.getPurl().getName()));
	String url = String.format(baseUrl + API_URL, caseEncode(component.getPurl().getNamespace()), caseEncode(component.getPurl().getName()));

	ExternalText externalText = new ExternalText();
	var externalText = new ExternalText();

	public MetaModel analyze(final Component component) {
	public MetaModel analyze( Component component) {

	HttpPost request = new HttpPost(destination);
	var request = new HttpPost(destination);

	final String mimeType = getTemplateMimeType(config);
	String mimeType = getTemplateMimeType(config);

	public void publish(final String publisherName, final PebbleTemplate template, final Notification notification, final JsonObject config) {
	public void publish(final String publisherName, final PebbleTemplate template, Notification notification, final JsonObject config) {

	.addBinaryBody("files[]", findingsJson, org.apache.http.entity.ContentType.APPLICATION_JSON, "findings.json")
	.addBinaryBody("files[]", findingsJson, ContentType.APPLICATION_JSON, "findings.json")

	final HttpEntity entity = response.getEntity();
	HttpEntity entity = response.getEntity();

	HttpPost request = new HttpPost(baseURL + "/api/v1/fileTokens");
	var request = new HttpPost(baseURL + "/api/v1/fileTokens");

	final org.cyclonedx.model.Dependency d1 = getDependencyFromBomRef(c1.getKey(), bom.getDependencies());
	final Dependency targetDep = getDependencyFromBomRef(targetBomRef, bom.getDependencies());

	final LocalDate today = LocalDate.now();
	final LocalDate today = LocalDate.now(ZoneId.systemDefault());

	case NUMERIC_LESS_THAN -> ageDate.isAfter(LocalDate.now());
	case NUMERIC_LESS_THAN -> ageDate.isAfter(LocalDate.now(ZoneId.systemDefault()));

	protected void handleRequestException(final Logger logger, final Throwable e) {
	protected void handleRequestException(final Logger LOGGER, final Throwable e) {

Feature/remove unirest #1

Are you sure you want to change the base?

Feature/remove unirest #1

Conversation

mehab commented Jan 23, 2023

Description

Addressed Issue

Additional Details

Checklist

sonatype-lift bot Jan 23, 2023

Choose a reason for hiding this comment

sonatype-lift bot Jan 23, 2023

Choose a reason for hiding this comment

sonatype-lift bot Jan 23, 2023

Choose a reason for hiding this comment

sonatype-lift bot Jan 23, 2023

Choose a reason for hiding this comment

sonatype-lift bot Jan 23, 2023

Choose a reason for hiding this comment

sonatype-lift bot Jan 23, 2023

Choose a reason for hiding this comment

sonatype-lift bot Jan 23, 2023

Choose a reason for hiding this comment

sonatype-lift bot Jan 23, 2023

Choose a reason for hiding this comment

sonatype-lift bot commented Jan 23, 2023

🛠 Lift Auto-fix

Footnotes

sonatype-lift bot Jan 24, 2023

Choose a reason for hiding this comment

sonatype-lift bot Jan 24, 2023

Choose a reason for hiding this comment

sonatype-lift bot Jan 24, 2023

Choose a reason for hiding this comment

sonatype-lift bot Jan 27, 2023

Choose a reason for hiding this comment

sonatype-lift bot Jan 27, 2023

Choose a reason for hiding this comment

sonatype-lift bot Jan 27, 2023

Choose a reason for hiding this comment

sonatype-lift bot Jan 27, 2023

Choose a reason for hiding this comment

sonatype-lift bot Feb 3, 2023

Choose a reason for hiding this comment

sonatype-lift bot Feb 3, 2023

Choose a reason for hiding this comment

sonatype-lift bot Feb 3, 2023

Choose a reason for hiding this comment

sonatype-lift bot Feb 3, 2023

Choose a reason for hiding this comment

sonatype-lift bot Feb 3, 2023

Choose a reason for hiding this comment

sonatype-lift bot Feb 6, 2023

Choose a reason for hiding this comment

sonatype-lift bot Feb 6, 2023

Choose a reason for hiding this comment

sonatype-lift bot Feb 6, 2023

Choose a reason for hiding this comment

sonatype-lift bot Feb 10, 2023

Choose a reason for hiding this comment

sonatype-lift bot Feb 10, 2023

Choose a reason for hiding this comment

sonatype-lift bot Feb 10, 2023

Choose a reason for hiding this comment

sonatype-lift bot Feb 13, 2023

Choose a reason for hiding this comment