Track uses of disallowed dependencies pattern

waelalwirr · April 12, 2024, 9:31am

I am trying to expend the XML rule to scan through the POM.xml file to capture unapproved usage of library so my requirements are below

Minimum allowed version: 1.7.0
Version: 1.9.2

what is the pattern I should use

Rebse · April 12, 2024, 5:31pm

Welcome

not sure if you’re able to extend the xml rules, but maybe this community plugin is an option !?

Gilbert

waelalwirr · April 14, 2024, 10:46am

in the shown screenshot this is the template we reusing to check the dependency version I want to understand more on the pattern to be used

Rebse · April 15, 2024, 1:43pm

The parameters of xml:S3417 are explained in detail, what is the problem?

waelalwirr · April 15, 2024, 2:18pm

I used the below pattern to limit the dependency version from 1.7.3 and above but it is not working

1.0-7.0-2

Rebse · April 15, 2024, 2:25pm

Never used this template so far, but i would try 1.7.3-* as dependency version pattern for your case.

waelalwirr · April 16, 2024, 6:51am

HI,
the pattern is for the negative case not the positive … so the pattern should indicate which versions are not allowed where the pattern you have shared is for the positive scenario

Rebse · April 16, 2024, 7:20am

Hi,

you’re right, after checking the sources

github.com

SonarSource/sonar-xml/blob/master/sonar-xml-plugin/src/main/java/org/sonar/plugins/xml/checks/maven/DisallowedDependenciesCheck.java

/*
 * SonarQube XML Plugin
 * Copyright (C) 2010-2024 SonarSource SA
 * mailto:info AT sonarsource DOT com
 *
 * This program is free software; you can redistribute it and/or
 * modify it under the terms of the GNU Lesser General Public
 * License as published by the Free Software Foundation; either
 * version 3 of the License, or (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * Lesser General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public License
 * along with this program; if not, write to the Free Software Foundation,
 * Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
 */
package org.sonar.plugins.xml.checks.maven;

This file has been truncated. show original

github.com

SonarSource/sonar-xml/blob/master/sonar-xml-plugin/src/test/java/org/sonar/plugins/xml/checks/maven/DisallowedDependenciesCheckTest.java

/*
 * SonarQube XML Plugin
 * Copyright (C) 2010-2024 SonarSource SA
 * mailto:info AT sonarsource DOT com
 *
 * This program is free software; you can redistribute it and/or
 * modify it under the terms of the GNU Lesser General Public
 * License as published by the Free Software Foundation; either
 * version 3 of the License, or (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
 * Lesser General Public License for more details.
 *
 * You should have received a copy of the GNU Lesser General Public License
 * along with this program; if not, write to the Free Software Foundation,
 * Inc., 51 Franklin Street, Fifth Floor, Boston, MA  02110-1301, USA.
 */
package org.sonar.plugins.xml.checks.maven;

This file has been truncated. show original

and the informations here

HTTP Connector Release Notes - Mule 4 | MuleSoft Documentation has version 1.1.0 (deprecated) listed as first version - don’t know if there are other versions in the wild.

the pattern should be something like that !?

0.*.*-1.7.3
or
1.1.0-1.7.3

EDIT

according to this test

github.com

SonarSource/sonar-xml/blob/34707da2bea6cc48eec3c64de6e5823441fa0ad9/sonar-xml-plugin/src/test/java/org/sonar/plugins/xml/checks/maven/helpers/RangedVersionMatcherTest.java#L96C2-L96C49


      
          void version_with_wildcard_for_lower_bound() {

this should also work
*-1.7.3

Gilbert

waelalwirr · April 16, 2024, 9:11am

yes this is working … the only comment is the range is inclusive which means if 1.7.3 is allowed you have to do *-1.7.2 … otherwise works like magic … .thanks a lot

system · April 23, 2024, 9:11am

This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.