Audit Maven - use maven-dep-tree plugin

artifactory/utils/projectconfig.go

@@ -201,6 +201,7 @@ func SetResolutionRepoIfExists(params xrayutils.AuditParams, tech coreutils.Tech
 	if params.DepsRepo() != "" || params.IgnoreConfigFile() {
 		return
 	}
+
 	configFilePath, exists, err := GetProjectConfFilePath(techType[tech])
 	if err != nil {
 		err = fmt.Errorf("failed while searching for %s.yaml config file: %s", tech.String(), err.Error())
@@ -211,6 +212,7 @@ func SetResolutionRepoIfExists(params xrayutils.AuditParams, tech coreutils.Tech
 		return
 	}
 
+	log.Debug("Using resolver config from", configFilePath)
 	repoConfig, err := ReadResolutionOnlyConfiguration(configFilePath)
 	if err != nil {
 		err = fmt.Errorf("failed while reading %s.yaml config file: %s", tech.String(), err.Error())

buildscripts/download-jars.sh

@@ -7,8 +7,8 @@
 # https://github.com/jfrog/maven-dep-tree
 
 # Once you have updated the versions mentioned below, please execute this script from the root directory of the jfrog-cli-core to ensure the JAR files are updated.
-GRADLE_DEP_TREE_VERSION="3.0.0"
-MAVEN_DEP_TREE_VERSION="1.0.0"
+GRADLE_DEP_TREE_VERSION="3.0.1"
+MAVEN_DEP_TREE_VERSION="1.0.2"
 
 curl -fL https://releases.jfrog.io/artifactory/oss-release-local/com/jfrog/gradle-dep-tree/${GRADLE_DEP_TREE_VERSION}/gradle-dep-tree-${GRADLE_DEP_TREE_VERSION}.jar -o xray/commands/audit/sca/java/gradle-dep-tree.jar
-# curl -fL https://releases.jfrog.io/artifactory/oss-release-local/com/jfrog/maven-dep-tree/${MAVEN_DEP_TREE_VERSION}/maven-dep-tree-${MAVEN_DEP_TREE_VERSION}.jar -o xray/commands/audit/sca/java/maven-dep-tree.jar
+curl -fL https://releases.jfrog.io/artifactory/oss-release-local/com/jfrog/maven-dep-tree/${MAVEN_DEP_TREE_VERSION}/maven-dep-tree-${MAVEN_DEP_TREE_VERSION}.jar -o xray/commands/audit/sca/java/maven-dep-tree.jar

go.mod

@@ -99,6 +99,6 @@ require (
 	gopkg.in/warnings.v0 v0.1.2 // indirect
 )
 
-// replace github.com/jfrog/jfrog-client-go => github.com/jfrog/jfrog-client-go v1.28.1-0.20231109105822-00d80f604090
+// replace github.com/jfrog/jfrog-client-go => github.com/jfrog/jfrog-client-go dev
 
 // replace github.com/jfrog/build-info-go => github.com/jfrog/build-info-go dev

utils/config/config.go

@@ -750,6 +750,39 @@ func (serverDetails *ServerDetails) createAuthConfig(details auth.ServiceDetails
 	return details, nil
 }
 
+// GetAuthenticationCredentials retrieves authentication credentials for the serverDetails instance.
+// If both a username and password are provided, they are returned.
+// If only an access token is provided, the function extracts the username from the access token,
+// and both the username and access token are returned.
+//
+// Returns:
+// - Username and password if both are provided.
+// - Username extracted from the access token, along with the access token, if the access token is provided.
+// - An error if neither username/password nor access token is provided, with details about the missing credentials.
+func (serverDetails *ServerDetails) GetAuthenticationCredentials() (string, string, error) {
+	// Username and password are set
+	if serverDetails.Password != "" && serverDetails.User != "" {
+		return serverDetails.User, serverDetails.Password, nil
+	}
+
+	// Access token is set, extract the username from the access token if needed
+	if serverDetails.AccessToken != "" {
+		if serverDetails.User == "" {
+			serverDetails.User = auth.ExtractUsernameFromAccessToken(serverDetails.AccessToken)
+		}
+		return serverDetails.User, serverDetails.AccessToken, nil
+	}
+
+	// Username/Password or Access token isn't set
+	errMissingCredsMsg := "either username/password or access token must be set for "
+	if serverDetails.Url != "" {
+		errMissingCredsMsg += serverDetails.Url
+	} else if serverDetails.ArtifactoryUrl != "" {
+		errMissingCredsMsg += serverDetails.ArtifactoryUrl
+	}
+	return "", "", errors.New(errMissingCredsMsg)
+}
+
 func (missionControlDetails *MissionControlDetails) GetAccessToken() string {
 	return missionControlDetails.AccessToken
 }

xray/commands/audit/sca/java/deptreemanager.go

@@ -0,0 +1,103 @@
+package java
+
+import (
+	"encoding/json"
+	"github.com/jfrog/gofrog/datastructures"
+	"github.com/jfrog/jfrog-cli-core/v2/utils/config"
+	"github.com/jfrog/jfrog-cli-core/v2/utils/coreutils"
+	"github.com/jfrog/jfrog-client-go/utils/errorutils"
+	xrayUtils "github.com/jfrog/jfrog-client-go/xray/services/utils"
+	"os"
+	"strings"
+)
+
+type DepTreeParams struct {
+	Tool                  coreutils.Technology
+	UseWrapper            bool
+	IsMvnDepTreeInstalled bool
+	Server                *config.ServerDetails
+	DepsRepo              string
+}
+
+type DepTreeManager struct {
+	server       *config.ServerDetails
+	releasesRepo string
+	depsRepo     string
+	useWrapper   bool
+}
+
+func NewDepTreeManager(params *DepTreeParams) *DepTreeManager {
+	return &DepTreeManager{useWrapper: params.UseWrapper, depsRepo: params.DepsRepo, server: params.Server}
+}
+
+// The structure of a dependency tree of a module in a Gradle/Maven project, as created by the gradle-dep-tree and maven-dep-tree plugins.
+type moduleDepTree struct {
+	Root  string                 `json:"root"`
+	Nodes map[string]depTreeNode `json:"nodes"`
+}
+
+type depTreeNode struct {
+	Children []string `json:"children"`
+}
+
+// getGraphFromDepTree reads the output files of the gradle-dep-tree and maven-dep-tree plugins and returns them as a slice of GraphNodes.
+// It takes the output of the plugin's run (which is a byte representation of a list of paths of the output files, separated by newlines) as input.
+func getGraphFromDepTree(depTreeOutput []byte) (depsGraph []*xrayUtils.GraphNode, uniqueDeps []string, err error) {
+	modules, err := parseDepTreeFiles(depTreeOutput)
+	if err != nil {
+		return
+	}
+	uniqueDepsSet := datastructures.MakeSet[string]()
+	for _, moduleTree := range modules {
+		directDepId := GavPackageTypeIdentifier + moduleTree.Root
+		directDependency := &xrayUtils.GraphNode{
+			Id:    directDepId,
+			Nodes: []*xrayUtils.GraphNode{},
+		}
+		uniqueDepsSet.Add(directDepId)
+		populateDependencyTree(directDependency, moduleTree.Root, moduleTree, uniqueDepsSet)
+		depsGraph = append(depsGraph, directDependency)
+	}
+	uniqueDeps = uniqueDepsSet.ToSlice()
+	return
+}
+
+func populateDependencyTree(currNode *xrayUtils.GraphNode, currNodeId string, moduleTree *moduleDepTree, uniqueDepsSet *datastructures.Set[string]) {
+	if currNode.NodeHasLoop() {
+		return
+	}
+	for _, childId := range moduleTree.Nodes[currNodeId].Children {
+		childGav := GavPackageTypeIdentifier + childId
+		childNode := &xrayUtils.GraphNode{
+			Id:     childGav,
+			Nodes:  []*xrayUtils.GraphNode{},
+			Parent: currNode,
+		}
+		uniqueDepsSet.Add(childGav)
+		populateDependencyTree(childNode, childId, moduleTree, uniqueDepsSet)
+		currNode.Nodes = append(currNode.Nodes, childNode)
+	}
+}
+
+func parseDepTreeFiles(jsonFilePaths []byte) ([]*moduleDepTree, error) {
+	outputFilePaths := strings.Split(strings.TrimSpace(string(jsonFilePaths)), "\n")
+	var modules []*moduleDepTree
+	for _, path := range outputFilePaths {
+		results, err := parseDepTreeFile(path)
+		if err != nil {
+			return nil, err
+		}
+		modules = append(modules, results)
+	}
+	return modules, nil
+}
+
+func parseDepTreeFile(path string) (results *moduleDepTree, err error) {
+	depTreeJson, err := os.ReadFile(strings.TrimSpace(path))
+	if errorutils.CheckError(err) != nil {
+		return
+	}
+	results = &moduleDepTree{}
+	err = errorutils.CheckError(json.Unmarshal(depTreeJson, &results))
+	return
+}

xray/commands/audit/sca/java/javautils_test.go → xray/commands/audit/sca/java/deptreemanager_test.go

@@ -5,10 +5,11 @@ import (
 	"github.com/stretchr/testify/assert"
 	"os"
 	"path/filepath"
+	"reflect"
 	"testing"
 )
 
-func TestGetGraphFromDepTree(t *testing.T) {
+func TestGetGradleGraphFromDepTree(t *testing.T) {
 	// Create and change directory to test workspace
 	tempDirPath, cleanUp := sca.CreateTestWorkspace(t, "gradle-example-ci-server")
 	defer func() {
@@ -42,6 +43,9 @@ func TestGetGraphFromDepTree(t *testing.T) {
 		},
 		expectedUniqueDeps: []string{
 			GavPackageTypeIdentifier + "junit:junit:4.11",
+			GavPackageTypeIdentifier + "org.jfrog.example.gradle:webservice:1.0",
+			GavPackageTypeIdentifier + "org.jfrog.example.gradle:api:1.0",
+			GavPackageTypeIdentifier + "org.jfrog.example.gradle:" + filepath.Base(tempDirPath) + ":1.0",
 			GavPackageTypeIdentifier + "commons-io:commons-io:1.2",
 			GavPackageTypeIdentifier + "org.apache.wicket:wicket:1.3.7",
 			GavPackageTypeIdentifier + "org.jfrog.example.gradle:shared:1.0",
@@ -53,12 +57,12 @@ func TestGetGraphFromDepTree(t *testing.T) {
 		},
 	}
 
-	manager := &depTreeManager{}
+	manager := &gradleDepTreeManager{&DepTreeManager{}}
 	outputFileContent, err := manager.runGradleDepTree()
 	assert.NoError(t, err)
 	depTree, uniqueDeps, err := getGraphFromDepTree(outputFileContent)
 	assert.NoError(t, err)
-	assert.ElementsMatch(t, uniqueDeps, testCase.expectedUniqueDeps, "First is actual, Second is Expected")
+	reflect.DeepEqual(uniqueDeps, testCase.expectedUniqueDeps)
 
 	for _, dependency := range depTree {
 		depChild, exists := testCase.expectedTree[dependency.Id]