CVE: adapt IDEasy to consider security.json files to warn user #1280

KianRolf · 2025-04-29T09:11:08Z

#fixes #1144

…olSecurity.java Co-authored-by: Jörg Hohwiller <hohwille@users.noreply.github.com>

cli/src/main/java/com/devonfw/tools/ide/CVEFinder.java

# Conflicts: # cli/src/main/java/com/devonfw/tools/ide/variable/IdeVariables.java

hohwille

@KianRolf thanks for your PR. Quite some complexity and great that you found your way to get everything solved and working.
This is good work and only needs little polishing before we can merge. 👍
I left some review comments.
What I slightly dislike is the many and also empty *.urls files that you added what will cause us quite some maintenance effort later (will collide with #706). It would have been much better to add a new test-project for your scenario and even if you again would use intellij plus java as your scenario at least make the URLs OS-agnostic so you do not have to have 3 *.urls file for every version. Do these *.urls files actually matter for your test at all? Or could you also just add one single urls file in each of the versions folder you added?
I have not yet tested your code for bugs but just wrote my review comments from reading your code. Lets find a balance how you can get this PR done with low additional effort so we can merge it. Other things then have to be addressed after the merge.

hohwille · 2025-08-28T16:31:12Z

cli/src/main/java/com/devonfw/tools/ide/url/model/file/json/ToolSecurity.java

-      }
-    }
-    return cves;
+  public List<CVE> findCVEs() {


This method is a getter and the same functionality already exists as getIssues().
It should simply be removed.

cli/src/main/java/com/devonfw/tools/ide/CVEFinder.java

cli/src/main/java/com/devonfw/tools/ide/tool/ToolCommandlet.java

cli/src/main/java/com/devonfw/tools/ide/variable/IdeVariables.java

hohwille · 2025-08-29T16:31:31Z

cli/src/test/java/com/devonfw/tools/ide/tool/LookForCVEsTest.java

+    //arrange
+    context.setUrlsPath(URLS_PATH);
+    Intellij commandlet = new Intellij(this.context);
+    context.setAnswers("current");


very nice test. But why don't you also test the other 2 options? Too much effort?

expanded test but ran into a problem with the java check on the latest option could not figure out what went wrong.

hohwille · 2025-08-29T16:32:20Z

cli/src/test/java/com/devonfw/tools/ide/tool/tomcat/TomcatTest.java

                + " Therefore, we install a compatible version in that range."),
        new IdeLogEntry(IdeLogLevel.DEBUG, "Installed java in version " + javaVersionTomcat + " at ", true),
        new IdeLogEntry(IdeLogLevel.SUCCESS, "Successfully installed tomcat in version " + tomcatVersion),
-        new IdeLogEntry(IdeLogLevel.INFO, "OpenJDK version " + javaVersionTomcat),


why was this removed? Did this fail after your changes?
Does it reveal a bug or are we sure this is OK?

Please re-add this assertion and try to find out why your changes caused this to fail.

hohwille · 2025-08-29T16:34:33Z

cli/src/test/java/com/devonfw/tools/ide/url/model/file/json/ToolSecurityTest.java


    // assert
-    assertThat(security).containsExactly(new CVE("CVE-2024-32002", 9.0f, versionRanges));
+    assertThat(security).contains(new CVE("CVE-2024-32002", 9.0f, versionRanges));


This is also confusing me. Why was the test changed from tomcat to intellij?
Why did you change from containsExactly to the weaker contains?

jan-vcapgemini · 2025-09-02T14:45:10Z

cli/src/main/java/com/devonfw/tools/ide/variable/IdeVariables.java

  VariableDefinitionPath WORKSPACE_PATH = new VariableDefinitionPath("WORKSPACE_PATH", null, c -> c.getWorkspacePath(), true);

+  /** {@link VariableDefinition} for default CVE_MIN_SEVERITY. */
+  VariableDefinitionDoulbe CVE_MIN_SEVERIRY = new VariableDefinitionDoulbe("CVE_MIN_SEVERITY", null, c -> 1.0);


Typo in Class name and in constant CVE_MIN_SEVERIRY => CVE_MIN_SEVERITY

jan-vcapgemini · 2025-09-02T14:46:32Z

cli/src/main/java/com/devonfw/tools/ide/variable/VariableDefinitionDoulbe.java

+
+import com.devonfw.tools.ide.context.IdeContext;
+
+public class VariableDefinitionDoulbe extends AbstractVariableDefinition<Double> {


Typo in class name and Javadocs missing.

jan-vcapgemini · 2025-09-03T19:18:56Z

cli/src/main/java/com/devonfw/tools/ide/tool/LocalToolCommandlet.java

+    return install(silent, processContext, step, false);
+  }
+
+  public boolean install(boolean silent, ProcessContext processContext, Step step, boolean isDependency) {


Please declare this install override method as an abstract in ToolCommandlet and use the @Override annotation here. Please also add Javadoc to the method.

jan-vcapgemini · 2025-09-03T19:20:55Z

cli/src/main/java/com/devonfw/tools/ide/tool/LocalToolCommandlet.java

  private boolean doInstallStep(VersionIdentifier configuredVersion, VersionIdentifier installedVersion, boolean silent, ProcessContext processContext,
      Step step) {
+    return doInstallStep(configuredVersion, installedVersion, silent, processContext, step, false);
+  }


This method is not in use anymore, delete?

jan-vcapgemini · 2025-09-03T19:22:50Z

cli/src/main/java/com/devonfw/tools/ide/tool/LocalToolCommandlet.java

   * @return the {@link ToolInstallation} matching the given {@code version}.
   */
-  public ToolInstallation installTool(GenericVersionRange version, ProcessContext processContext) {
+  public ToolInstallation installTool(GenericVersionRange version, ProcessContext processContext, boolean isDependency) {


Please add isDependency param to Javadoc.

jan-vcapgemini · 2025-09-03T19:23:00Z

cli/src/main/java/com/devonfw/tools/ide/tool/LocalToolCommandlet.java

   * @return the {@link ToolInstallation} matching the given {@code version}.
   */
-  public ToolInstallation installTool(GenericVersionRange version, ProcessContext processContext, String edition) {
+  public ToolInstallation installTool(GenericVersionRange version, ProcessContext processContext, String edition, boolean isDependenny) {


Please fix the typo and add isDependency param to Javadoc.

jan-vcapgemini · 2025-09-03T19:24:15Z

cli/src/main/java/com/devonfw/tools/ide/tool/LocalToolCommandlet.java

+   * @param allowedVersions the allowed {@link VersionRange}.
+   * @return {@code true} if the tool was newly installed, {@code false} otherwise (installation was already present).
+   */
+  private VersionIdentifier lookForCVEs(VersionIdentifier version, String edition, ProcessContext processContext, VersionRange allowedVersions) {


Please rename method to lookForCves.

Use CamelCase even for abbreviations (XmlUtil instead of XMLUtil).

See: https://github.com/devonfw/IDEasy/blob/main/documentation/coding-conventions.adoc

jan-vcapgemini · 2025-09-03T19:25:04Z

cli/src/main/java/com/devonfw/tools/ide/CVEFinder.java

+/**
+ * Class used to handle and get {@link ToolSecurity}, {@link CVE} for specific tool.
+ */
+public class CVEFinder {


Please rename class to CveFinder.

Use CamelCase even for abbreviations (XmlUtil instead of XMLUtil).

See: https://github.com/devonfw/IDEasy/blob/main/documentation/coding-conventions.adoc

jan-vcapgemini · 2025-09-03T19:28:57Z

cli/src/main/java/com/devonfw/tools/ide/tool/LocalToolCommandlet.java

+    } else {
+      cveFinder = new CVEFinder(context, this, version, allowedVersions);
+    }
+    Collection<CVE> cves = cveFinder.getCVEs(version);


Please rename CVE class to Cve.

Use CamelCase even for abbreviations (XmlUtil instead of XMLUtil).

See: https://github.com/devonfw/IDEasy/blob/main/documentation/coding-conventions.adoc

jan-vcapgemini · 2025-09-03T19:30:36Z

cli/src/main/java/com/devonfw/tools/ide/CVEFinder.java

+   *
+   * @param versionIdentifier {@link VersionIdentifier}.
+   */
+  public void listCVEs(VersionIdentifier versionIdentifier) {


Please rename method to listCves.

Use CamelCase even for abbreviations (XmlUtil instead of XMLUtil).

See: https://github.com/devonfw/IDEasy/blob/main/documentation/coding-conventions.adoc

jan-vcapgemini · 2025-09-03T19:30:59Z

cli/src/main/java/com/devonfw/tools/ide/CVEFinder.java

+   * @param versionIdentifier
+   * @return all {@link CVE}s from specific {@link VersionIdentifier}.
+   */
+  public Collection<CVE> getCVEs(VersionIdentifier versionIdentifier) {


Please rename method to getCves.

Use CamelCase even for abbreviations (XmlUtil instead of XMLUtil).

See: https://github.com/devonfw/IDEasy/blob/main/documentation/coding-conventions.adoc

cli/src/main/java/com/devonfw/tools/ide/tool/LocalToolCommandlet.java

jan-vcapgemini · 2025-09-03T19:49:41Z

cli/src/test/java/com/devonfw/tools/ide/tool/LookForCVEsTest.java

+/**
+ * Test for method lookForCVEs in {@link LocalToolCommandlet}.
+ */
+public class LookForCVEsTest extends AbstractIdeContextTest {


Please rename class to LookForCvesTest.

jan-vcapgemini · 2025-09-03T21:36:19Z

cli/src/main/java/com/devonfw/tools/ide/tool/LocalToolCommandlet.java

          toolParent, this.tool, version, configuredVersion);
    }
-    ToolInstallation toolInstallation = installTool(version, processContext);
+    ToolInstallation toolInstallation = installTool(


This change seems to break the TomcatTest. Please check why the version determined from the dependency file (21_35) is not being used.

Co-authored-by: Jörg Hohwiller <hohwille@users.noreply.github.com>

…java Co-authored-by: Jörg Hohwiller <hohwille@users.noreply.github.com>

…et.java Co-authored-by: jan-vcapgemini <59438728+jan-vcapgemini@users.noreply.github.com>

KianRolf and others added 18 commits March 26, 2025 15:15

#security.json in java

a92912b

Merge branch 'main' into T1000

0e731b2

Merge branch 'main' into T1000

e79bd80

test fix

874660d

Merge branch 'main' into T1000

692f678

Merge branch 'main' into T1000

2831d3a

Update cli/src/main/java/com/devonfw/tools/ide/url/model/file/json/To…

83c648b

…olSecurity.java Co-authored-by: Jörg Hohwiller <hohwille@users.noreply.github.com>

Update cli/src/main/java/com/devonfw/tools/ide/url/model/file/json/To…

f7bba9c

…olSecurity.java Co-authored-by: Jörg Hohwiller <hohwille@users.noreply.github.com>

Update cli/src/main/java/com/devonfw/tools/ide/url/model/file/json/To…

7c9241d

…olSecurity.java Co-authored-by: Jörg Hohwiller <hohwille@users.noreply.github.com>

Update cli/src/main/java/com/devonfw/tools/ide/url/model/file/json/To…

c9c2da4

…olSecurity.java Co-authored-by: Jörg Hohwiller <hohwille@users.noreply.github.com>

devonfw#103: review adjustments

06f6b02

Merge branch 'main' into T1000

e709d33

Merge branch 'main' into T1000

6226802

devonfw#1144: question dialog with user

5df81e8

Merge branch 'main' into T1000

50cbe70

Merge branch 'main' into T1000

fb37697

devonfw#1144: basic concept

a10ccd3

Merge branch 'main' into T1000

a9a4f35

github-project-automation bot added this to IDEasy board Apr 29, 2025

github-project-automation bot moved this to 🆕 New in IDEasy board Apr 29, 2025

KianRolf self-assigned this Apr 29, 2025

KianRolf added the security CVEs or other vulnerabilities label Apr 29, 2025

Merge branch 'main' into T1000

8ba3fc6

hohwille mentioned this pull request May 12, 2025

#103: security warning for CVEs in file tool/edition/security #119

Closed

hohwille reviewed May 19, 2025

View reviewed changes

cli/src/main/java/com/devonfw/tools/ide/CVEFinder.java Outdated Show resolved Hide resolved

KianRolf added 5 commits August 4, 2025 10:38

Merge branch 'main' into T1000

b27abe7

# Conflicts: # cli/src/main/java/com/devonfw/tools/ide/variable/IdeVariables.java

devonfw#1144: Get question to work

ba2f094

Merge branch 'main' into T1000

cfd3937

Merge branch 'T1000' of https://github.com/KianRolf/IDEasy into T1000

f096c9f

# Conflicts: # cli/src/main/java/com/devonfw/tools/ide/variable/IdeVariables.java

#testing

7d3a237

devonfw#1144: java doc

e2f50c1

hohwille approved these changes Aug 29, 2025

View reviewed changes

github-project-automation bot moved this from Team Review to 👀 In review in IDEasy board Aug 29, 2025

Merge branch 'main' into T1000

0ad9a3a

jan-vcapgemini reviewed Sep 2, 2025

View reviewed changes

Merge branch 'main' into T1000

bdace6f

jan-vcapgemini reviewed Sep 3, 2025

View reviewed changes

cli/src/main/java/com/devonfw/tools/ide/tool/LocalToolCommandlet.java Outdated Show resolved Hide resolved

jan-vcapgemini reviewed Sep 3, 2025

View reviewed changes

KianRolf and others added 11 commits September 11, 2025 22:22

Update cli/src/main/java/com/devonfw/tools/ide/CVEFinder.java

65f0b0a

Co-authored-by: Jörg Hohwiller <hohwille@users.noreply.github.com>

Update cli/src/main/java/com/devonfw/tools/ide/CVEFinder.java

a683882

Co-authored-by: Jörg Hohwiller <hohwille@users.noreply.github.com>

Update cli/src/main/java/com/devonfw/tools/ide/CVEFinder.java

7aa7d03

Co-authored-by: Jörg Hohwiller <hohwille@users.noreply.github.com>

Update cli/src/main/java/com/devonfw/tools/ide/CVEFinder.java

08887bf

Co-authored-by: Jörg Hohwiller <hohwille@users.noreply.github.com>

Update cli/src/main/java/com/devonfw/tools/ide/CVEFinder.java

71ff2f0

Co-authored-by: Jörg Hohwiller <hohwille@users.noreply.github.com>

Update cli/src/main/java/com/devonfw/tools/ide/tool/ToolCommandlet.java

ca459f0

Co-authored-by: Jörg Hohwiller <hohwille@users.noreply.github.com>

Update cli/src/main/java/com/devonfw/tools/ide/variable/IdeVariables.…

7c3d636

…java Co-authored-by: Jörg Hohwiller <hohwille@users.noreply.github.com>

devonfw#1144: fix safestlatestversion find

aed4d91

devonfw#1144: expand test

285bfed

devonfw#1144: fix tomcattest

047d1d3

Update cli/src/main/java/com/devonfw/tools/ide/tool/LocalToolCommandl…

1ee3ae5

…et.java Co-authored-by: jan-vcapgemini <59438728+jan-vcapgemini@users.noreply.github.com>


		import com.devonfw.tools.ide.context.IdeContext;

		public class VariableDefinitionDoulbe extends AbstractVariableDefinition<Double> {

CVE: adapt IDEasy to consider security.json files to warn user #1280

Are you sure you want to change the base?

CVE: adapt IDEasy to consider security.json files to warn user #1280

Uh oh!

Conversation

KianRolf commented Apr 29, 2025

Uh oh!

Uh oh!

hohwille left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jan-vcapgemini Sep 2, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jan-vcapgemini Sep 2, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jan-vcapgemini Sep 3, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jan-vcapgemini Sep 3, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jan-vcapgemini Sep 3, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

jan-vcapgemini Sep 3, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

jan-vcapgemini Sep 2, 2025 •

edited

Loading

jan-vcapgemini Sep 2, 2025 •

edited

Loading

jan-vcapgemini Sep 3, 2025 •

edited

Loading

jan-vcapgemini Sep 3, 2025 •

edited

Loading

jan-vcapgemini Sep 3, 2025 •

edited

Loading

jan-vcapgemini Sep 3, 2025 •

edited

Loading