templates.htmlReport.vsl Maven / Gradle / Ivy
Show all versions of dependency-check-core Show documentation
#**
This file is part of dependency-check-core.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
Copyright (c) 2012 Jeremy Long. All Rights Reserved.
@author Jeremy Long
@version 1.2
*#
#[[
Dependency-Check Report
Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies;
false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and
the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties,
implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided
is at the user’s risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever
arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.
How to read the report |
Suppressing false positives |
Getting Help: github issues
]]#
Project: $enc.html($applicationName)
#if ($groupID && $artifactID && $applicationVersion)
$enc.html($groupID):$enc.html($artifactID):$enc.html($applicationVersion)
#end
#set($depCount=$dependencies.size())
#set($vulnDepCount=0)
#set($vulnCount=0)
#set($vulnSuppressedCount=0)
#set($cpeSuppressedCount=0)
#foreach($dependency in $dependencies)
#set($depCount=$depCount+$dependency.getRelatedDependencies().size())
#if($dependency.getVulnerabilities().size()>0)
#set($vulnDepCount=$vulnDepCount+1)
#set($vulnCount=$vulnCount+$dependency.getVulnerabilities().size())
#end
#if($dependency.getSuppressedIdentifiers().size()>0)
#set($cpeSuppressedCount=$cpeSuppressedCount+1)
#end
#if($dependency.getSuppressedVulnerabilities().size()>0)
#set($vulnSuppressedCount=$vulnSuppressedCount+$dependency.getSuppressedVulnerabilities().size())
#end
#end
Scan Information (show all):
- dependency-check version: $version
- Report Generated On: $scanDate
- Dependencies Scanned: $depCount ($dependencies.size() unique)
- Vulnerable Dependencies: $vulnDepCount
- Vulnerabilities Found: $vulnCount
- Vulnerabilities Suppressed: $vulnSuppressedCount
- ...
#foreach($prop in $properties.getMetaData().entrySet())
#end
Display: Showing Vulnerable Dependencies (click to show all)
#set($lnkcnt=0)
Dependency
Vulnerability IDs
Package
Highest Severity
CVE Count
Confidence
Evidence Count
#foreach($dependency in $dependencies)
#set($lnkcnt=$lnkcnt+1)
$enc.html($dependency.DisplayFileName)
#set($mavenlink="")
#set($cpeIdCount=0)
#set($cpeIdConf="")
#set($sortValue="")
#foreach($id in $dependency.getVulnerableSoftwareIdentifiers())
#set($sortValue=$sortValue+$id.value)
#end
#set($sortValue="")
#set($cpeSort=0)
#foreach($id in $dependency.getVulnerableSoftwareIdentifiers())
#if ($cpeIdCount>=1)
#end
#if( $id.url )
$enc.html($id.value)
#else
$enc.html($id.value)
#end
#if ($cpeIdConf == "")
#set($cpeIdConf=$id.confidence)
#set($cpeSort=$id.confidence.ordinal())
#elseif ($cpeIdConf.compareTo($id.confidence)>0)
#set($cpeIdConf=$id.confidence)
#set($cpeSort=$id.confidence.ordinal())
#end
#set($cpeIdCount=$cpeIdCount+1)
#end
#foreach($id in $dependency.getSoftwareIdentifiers())
#set($sortValue=$sortValue+$id.value)
#end
#set($sortValue="")
#set($idCount=0)
#foreach($id in $dependency.getSoftwareIdentifiers())
#if ($idCount>=1)
#end
#if( $id.url )
$enc.html($id.value)
#else
$enc.html($id.value)
#end
#set($idCount=$idCount+1)
#end
#set($cveImpact=-1)
#set($cveSeverity=" ")
#foreach($vuln in $dependency.getVulnerabilities())
## yes - we are mixing v2 and v3... no consistency in data so doing the best we can
#if ($vuln.cvssV3)
#if ($cveImpact<$vuln.cvssV3.baseScore)
#set($cveImpact=$vuln.cvssV3.baseScore)
#set($cveSeverity=$enc.html($vuln.cvssV3.baseSeverity))
#end
#elseif ($vuln.cvssV2)
#if ($cveImpact<$vuln.cvssV2.score)
#set($cveImpact=$vuln.cvssV2.score)
#set($cveSeverity=$enc.html($vuln.cvssV2.severity))
#end
#end
#if ($vuln.unscoredSeverity)
#set($cveSeverity=$enc.html($vuln.unscoredSeverity))
#end
#end
#set($sortValue=$cveImpact*10)
$cveSeverity
$dependency.getVulnerabilities().size()
$WordUtils.capitalizeFully($cpeIdConf.toString())
$dependency.size()
#end
Dependencies
#set($lnkcnt=0)
#set($cnt=0)
#set($vsctr=0) ##counter to create unique groups for vulnerable software
#foreach($dependency in $dependencies)
#set($lnkcnt=$lnkcnt+1)
$enc.html($dependency.DisplayFileName)
#if ($dependency.description)
Description:
$enc.html($dependency.description)
#end
#if ($dependency.license)
#if ($dependency.license.startsWith("http://"))
License:
$enc.html($dependency.license)
#else
License:$enc.html($dependency.license)
#end
#end
File Path: $enc.html($dependency.FilePath)
#if(!$dependency.isVirtual())
MD5: $enc.html($dependency.Md5sum)
SHA1: $enc.html($dependency.Sha1sum)
SHA256:$enc.html($dependency.Sha256sum)
#end
#if ($dependency.projectReferences.size()==1)
Referenced In Project/Scope:
#foreach($ref in $dependency.projectReferences)
$enc.html($ref)
#end
#end
#if ($dependency.projectReferences.size()>1)
Referenced In Projects/Scopes:
#foreach($ref in $dependency.projectReferences)
- $enc.html($ref)
#end
#end
#set($cnt=$cnt+1)
Evidence
#if($dependency.getRelatedDependencies().size()>0)
#set($cnt=$cnt+1)
Related Dependencies
#end
#set($cnt=$cnt+1)
Identifiers
##: $enc.html($cpevalue)
#set($suppressGav='')
#if ($dependency.getSoftwareIdentifiers().size()==0 && $dependency.getVulnerableSoftwareIdentifiers().size()==0)
- None
#else
#foreach($id in $dependency.getSoftwareIdentifiers())
#set($suppressGav=$rpt.identifierToSuppressionId($id))
#if ($suppressGav)
#break
#end
#end
#foreach($id in $dependency.getSoftwareIdentifiers())
#if( $id.url )
- $enc.html($id.value)
#else
- $enc.html($id.value)
#end
#if ($id.confidence)
(Confidence:$WordUtils.capitalizeFully($id.confidence.toString()))
#end
#if ($id.notes)
- Notes: $enc.html($id.notes)
#end
#end
#foreach($id in $dependency.getVulnerableSoftwareIdentifiers())
#if( $id.url )
- $enc.html($id.value)
#else
- $enc.html($id.value)
#end
#if ($id.confidence)
(Confidence:$WordUtils.capitalizeFully($id.confidence.toString()))
#end
#if ($id.notes)
- Notes: $enc.html($id.notes)
#end
#end
#end
#if($dependency.getVulnerabilities().size()>0)
#set($cnt=$cnt+1)
Published Vulnerabilities
#foreach($vuln in $dependency.getVulnerabilities(true))
#set($vsctr=$vsctr+1)
#if($vuln.getSource().name().equals("NVD"))
#elseif($vuln.getSource().name().equals("NPM"))
#else
$enc.html($vuln.name) ($vuln.getSource().name())
#end
$enc.html($vuln.description)
#if($vuln.getCvssV2())
CVSSv2:
- Base Score: $enc.html($vuln.getCvssV2().getSeverity()) ($vuln.getCvssV2().getScore())
- Vector: $enc.html($vuln.getCvssV2().toString())
#end
#if($vuln.getCvssV3())
CVSSv3:
- Base Score: $enc.html($vuln.getCvssV3().getBaseSeverity()) ($vuln.getCvssV3().getBaseScore())
- Vector: $enc.html($vuln.getCvssV3().toString())
#end
#if ($vuln.cwe)
CWE: $vuln.cwe.toString()
#end
#if ($vuln.notes)
Notes: $enc.html($vuln.notes)
#end
#if ($vuln.getReferences().size()>0)
References:
#foreach($ref in $vuln.getReferences(true))
#if ($ref.url)
- $enc.html($ref.source) - $enc.html($ref.name)
#else
- $enc.html($ref.source) - $enc.html($ref.name)
#end
#end
#end
#if ($vuln.getSource().name().equals("NVD"))
#if ($vuln.getVulnerableSoftware().size()<2)
Vulnerable Software & Versions:
#else
Vulnerable Software & Versions: (show all)
- $enc.html($vuln.matchedVulnerableSoftware.toString())
- ...
#foreach($vs in $vuln.getVulnerableSoftware(true))
#end
#end
#elseif ($vuln.getSource().name().equals("NPM"))
Vulnerable Software & Versions:
#foreach($vs in $vuln.getVulnerableSoftware())
- $enc.html($vs.toString())
#end
#end
#end
#end
#end
## BEGIN SUPPRESSED VULNERABILITIES
#if ($vulnSuppressedCount>0 || $cpeSuppressedCount>0)
#set($cnt=$cnt+1)
Suppressed Vulnerabilities
#foreach($dependency in $dependencies)
#if ($dependency.getSuppressedIdentifiers().size()>0 || $dependency.getSuppressedVulnerabilities().size()>0)
#set($lnkcnt=$lnkcnt+1)
$enc.html($dependency.DisplayFileName)
#if ($dependency.description)
Description:
$enc.html($dependency.description)
#end
#if ($dependency.license)
#if ($dependency.license.startsWith("http://"))
License:
$enc.html($dependency.license)
#else
License:$enc.html($dependency.license)
#end
#end
File Path: $enc.html($dependency.FilePath)
#if(!$dependency.isVirtual())
MD5: $enc.html($dependency.Md5sum)
SHA1: $enc.html($dependency.Sha1sum)
SHA256: $enc.html($dependency.Sha255sum)
#end
#set($cnt=$cnt+1)
Evidence
#if($dependency.getRelatedDependencies().size()>0)
#set($cnt=$cnt+1)
Related Dependencies
#end
#set($cnt=$cnt+1)
Suppressed Identifiers
##: $enc.html($cpevalue)
#if ($dependency.getSuppressedIdentifiers().size()==0)
- None
#else
#foreach($id in $dependency.getSuppressedIdentifiers())
#if( $id.url )
- $enc.html($id.value) suppressed
#else
- $enc.html($id.value) suppressed
#end
#if ($id.confidence)
(Confidence:$WordUtils.capitalizeFully($id.confidence.toString()))
#end
#if ($id.notes)
- Notes: $enc.html($id.notes)
#end
#end
#end
#if($dependency.getSuppressedVulnerabilities().size()>0)
#set($cnt=$cnt+1)
Suppressed Vulnerabilities
#foreach($vuln in $dependency.getSuppressedVulnerabilities(true))
#set($vsctr=$vsctr+1)
#if($vuln.getSource().name().equals("NVD"))
$enc.html($vuln.name) suppressed
#elseif($vuln.getSource().name().equals("NPM"))
NPM-$enc.html($vuln.name) suppressed
#elseif($vuln.getSource().name().equals("RETIREJS"))
$enc.html($vuln.name) (RetireJS) suppressed
#end
$enc.html($vuln.description)
#if($vuln.getCvssV2())
CVSSv2:
- Base Score: $enc.html($vuln.getCvssV2().getSeverity()) ($vuln.getCvssV2().getScore())
- Vector: $enc.html($vuln.getCvssV2().toString())
#end
#if($vuln.getCvssV3())
CVSSv3:
- $enc.html($vuln.getCvssV3().getBaseSeverity()) ($vuln.getCvssV3().getBaseScore())
- $enc.html($vuln.getCvssV3().toString())
#end
#if ($vuln.cwe)
CWE: $vuln.cwe.toString()
#end
#if ($vuln.notes)
Notes: $enc.html($vuln.notes)
#end
#if ($vuln.getReferences().size()>0)
References:
#foreach($ref in $vuln.getReferences(true))
#if ($ref.url)
- $enc.html($ref.source) - $enc.html($ref.name)
#else
- $enc.html($ref.source) - $enc.html($ref.name)
#end
#end
#end
#if ($vuln.getVulnerableSoftware().size()<2)
Vulnerable Software & Versions:
#else
Vulnerable Software & Versions: (show all)
- $enc.html($vuln.matchedVulnerableSoftware.toString())
- ...
#foreach($vs in $vuln.getVulnerableSoftware(true))
#end
#end
#end
#end
#end
#end
#end
## END SUPPRESSED VULNERABILITIES
This report contains data retrieved from the National Vulnerability Database.
This report may contain data retrieved from the NPM Public Advisories.
This report may contain data retrieved from RetireJS.
This report may contain data retrieved from the Sonatype OSS Index.