利用Sonatype API实现依赖检测工具

<dependency>  <groupId>org.apache.maven</groupId>  <artifactId>maven-model-builder</artifactId>  <version>3.8.1</version></dependency><dependency>  <groupId>org.apache.maven</groupId>  <artifactId>maven-model</artifactId>   <version>3.8.1</version></dependency>

import java.io.File;import java.io.FileReader;import java.io.StringReader;import java.io.StringWriter;import java.util.ArrayList;import java.util.List;import java.util.Properties;import java.util.regex.Matcher;import java.util.regex.Pattern;import javax.xml.parsers.DocumentBuilder;import javax.xml.parsers.DocumentBuilderFactory;import org.apache.maven.model.Dependency;import org.apache.maven.model.DependencyManagement;import org.apache.maven.model.Model;import org.apache.maven.model.io.DefaultModelWriter;import org.apache.maven.model.io.xpp3.MavenXpp3Reader;import org.w3c.dom.Document;import org.w3c.dom.Element;import org.w3c.dom.NodeList;public class PomParser {    // 参数:Pom文件绝对路径    public static List<Dependency> parse(String pomPath) throws Exception {        List<Dependency> result = new ArrayList<>();        MavenXpp3Reader reader = new MavenXpp3Reader();        Model model = reader.read(new FileReader(pomPath));        Properties properties = model.getProperties(); // 获取所有属性        // 将model对象转为xml字符串        DefaultModelWriter writer = new DefaultModelWriter();        StringWriter stringWriter = new StringWriter();        writer.write(stringWriter, null, model);        String xmlString = stringWriter.toString();        // 合并Dependencies和DependencyManagement        List<org.apache.maven.model.Dependency> allDependencies=model.getDependencies();        DependencyManagement dependencyManagement = model.getDependencyManagement();        if (dependencyManagement!=null && dependencyManagement.getDependencies().size()>0){            allDependencies.addAll(dependencyManagement.getDependencies());        }        for (org.apache.maven.model.Dependency dependency : allDependencies) { // 遍历每个依赖对象            String version = dependency.getVersion();            if (version!=null && version.startsWith("${") && version.endsWith("}")) { // 如果版本号以${}包裹，则需要进行替换                String propertyName = version.substring(2, version.length() - 1);                String propertyValue = properties.getProperty(propertyName);                if (propertyValue == null) { // 如果属性不存在，抛出异常                    throw new IllegalArgumentException("Property not found: " + propertyName);                }                dependency.setVersion(propertyValue);            }        }        for (org.apache.maven.model.Dependency dependency : allDependencies) {            result.add(new Dependency(dependency.getGroupId(), dependency.getArtifactId(), dependency.getVersion()));        }        return result;    }}// Denpendency结构体    public static class Dependency {        private final String groupId;        private final String artifactId;        private final String version;        public Dependency(String groupId, String artifactId, String version) {            this.groupId = groupId;            this.artifactId = artifactId;            this.version = version;        }        public String getGroupId() {            return groupId;        }        public String getArtifactId() {            return artifactId;        }        public String getVersion() {            return version;        }    }

package com.VulnScanner.DpendCheck;import org.apache.http.HttpEntity;import org.apache.http.client.methods.CloseableHttpResponse;import org.apache.http.client.methods.HttpPost;import org.apache.http.conn.ssl.NoopHostnameVerifier;import org.apache.http.conn.ssl.SSLConnectionSocketFactory;import org.apache.http.entity.StringEntity;import org.apache.http.impl.client.CloseableHttpClient;import org.apache.http.impl.client.HttpClients;import org.apache.http.ssl.SSLContextBuilder;import org.apache.http.ssl.TrustStrategy;import org.apache.http.util.EntityUtils;import javax.net.ssl.HostnameVerifier;import javax.net.ssl.SSLContext;import java.io.IOException;import java.security.KeyManagementException;import java.security.KeyStoreException;import java.security.NoSuchAlgorithmException;import java.security.cert.CertificateException;import java.security.cert.X509Certificate;public class HttpsUtils {    static CloseableHttpClient httpClient;    static CloseableHttpResponse httpResponse;    public static CloseableHttpClient createSSLClientDefault() {        try {            SSLContext sslContext = new SSLContextBuilder().loadTrustMaterial(null, new TrustStrategy() {                // 信任所有                public boolean isTrusted(X509Certificate[] chain, String authType) throws CertificateException {                    return true;                }            }).build();            HostnameVerifier hostnameVerifier = NoopHostnameVerifier.INSTANCE;            SSLConnectionSocketFactory sslsf = new SSLConnectionSocketFactory(sslContext, hostnameVerifier);            return HttpClients.custom().setSSLSocketFactory(sslsf).build();        } catch (KeyManagementException e) {            e.printStackTrace();        } catch (NoSuchAlgorithmException e) {            e.printStackTrace();        } catch (KeyStoreException e) {            e.printStackTrace();        }        return HttpClients.createDefault();    }    /**     * 发送https请求     *     * @param content     * @throws Exception     */    public static String send(String content, String url) {        try {            HttpPost request = new HttpPost(url);            StringEntity entity = new StringEntity(content, "UTF-8");            entity.setContentEncoding("UTF-8");            entity.setContentType("application/json");            request.setEntity(entity);            request.addHeader("Connection", "Keep-Alive");            request.addHeader("accept", "application/json");            request.addHeader("Content-Type", "application/json");            httpClient = HttpsUtils.createSSLClientDefault();            httpResponse = httpClient.execute(request);            HttpEntity httpEntity = httpResponse.getEntity();            if (httpEntity != null) {                String jsObject = EntityUtils.toString(httpEntity, "UTF-8");                return jsObject;            } else {                return null;            }        } catch (Exception e) {            e.printStackTrace();            return null;        } finally {            try {                httpResponse.close();                httpClient.close();            } catch (IOException e) {                e.printStackTrace();            }        }    }}

maven:groupId/artifactId@Version

public class Checker {    private static final String API_BASE_URL = "https://ossindex.sonatype.org/api/v3";    public  List<ScanResult> getAllVulns(String filePath) throws Exception {        List<ScanResult> scanResults=new ArrayList<ScanResult>();        try {            List<PomParser.Dependency> dependencies = PomParser.parse(filePath);            for (PomParser.Dependency dependency:dependencies){                scanResults.addAll(scanDependencies(dependency.getGroupId(),dependency.getArtifactId(),dependency.getVersion()));            }        }catch (Exception e){}        return scanResults;    }    /**     * 扫描指定 Maven 项目的所有依赖项，并返回包含 CVE 信息的扫描结果。     *     * @param groupId Maven 项目的 Group ID     * @param artifactId Maven 项目的 Artifact ID     * @param version Maven 项目的版本号     * @return 包含 CVE 信息的扫描结果列表     */    public List<ScanResult> scanDependencies(String groupId, String artifactId, String version) throws IOException, JSONException {        // 处理 CVE 数据并生成扫描结果        List<ScanResult> results = new ArrayList<>();        try{            // 构造 API 请求 URL            String url = API_BASE_URL + "/component-report/";            String content="{ "coordinates":["maven:"+groupId+"/"+artifactId+"@"+version+""]}";            // 解析 JSON 响应            String data = HttpsUtils.send(content, url);            int start = data.indexOf("[{");            data=data.substring(start+1,data.length()-1);            JSONObject jsonResponse = new JSONObject(data);            JSONArray vulnerabilities = jsonResponse.optJSONArray("vulnerabilities");            if (vulnerabilities != null) {                for (int i = 0; i < vulnerabilities.length(); i++) {                    JSONObject vuln = vulnerabilities.getJSONObject(i);                    String cveId = vuln.optString("cve");                    String description = vuln.optString("description");                    results.add(new ScanResult(cveId, description,groupId,artifactId,version));                }            }        }catch (Exception e){        }        return results;    }}// ScanResult结构体(自行生成Getter/Setter)public class ScanResult {    private String cveId;    private String description;    private String groupId;    private String artifactId;    private String version;    public ScanResult(String cveId, String description,String groupId,String artifactId,String version) {        this.cveId = cveId;        this.description = description;        this.groupId=groupId;        this.artifactId=artifactId;        this.version=version;    }}

int start = data.indexOf("[{");data=data.substring(start+1,data.length()-1);