2 回答

TA貢獻1793條經驗 獲得超6個贊
如果您有權訪問 maven 存儲庫(在執行此命令時)并安裝了 mvn/mvnw ,則可以從命令行執行此行。
mvn org.owasp:dependency-check-maven:5.2.2:check
“dependency-check-report.html”報告將在目標文件夾中生成。

TA貢獻1785條經驗 獲得超8個贊
出于興趣,我嘗試了它,對我來說它正在工作:
<project>
<modelVersion>4.0.0</modelVersion>
<groupId>test</groupId>
<artifactId>test</artifactId>
<version>1.0</version>
<dependencies>
<dependency>
<groupId>org.apache.commons</groupId>
<artifactId>commons-email</artifactId>
<version>1.1</version>
</dependency>
</dependencies>
<build>
<plugins>
<plugin>
<groupId>org.owasp</groupId>
<artifactId>dependency-check-maven</artifactId>
<version>3.3.3</version>
<executions>
<execution>
<goals>
<goal>check</goal>
</goals>
</execution>
</executions>
</plugin>
</plugins>
</build>
</project>
依賴檢查 Maven 告訴我:
[INFO] Analysis Complete (1 seconds)
[WARNING]
One or more dependencies were identified with known vulnerabilities in test:
commons-email-1.1.jar (org.apache.commons:commons-email:1.1, cpe:/a:apache:commons_email:1.1) : CVE-2017-9801, CVE-2018-1294
See the dependency-check report for more details.
您的依賴項部分看起來如何?例如,如果您為 commons-email 定義范圍測試,則不會顯示警告
添加回答
舉報