feat(java): add support of test scope for pom.xml files
#7486
Conversation
| @@ -303,7 +303,7 @@ func (d pomDependency) ToArtifact(opts analysisOptions) artifact { | |||
| Exclusions: exclusions, | |||
| Locations: locations, | |||
| Relationship: ftypes.RelationshipIndirect, // default | |||
| Test: d.Scope == "test", | |||
| Test: d.Scope == "test" || opts.testScope, | |||
There was a problem hiding this comment.
I'm wondering if it works as expected. For example, if two direct dependencies have the same transitive dependency, and one scope is "test" and the other is not, I guess it would not be considered devDependency. How does Maven work?
There was a problem hiding this comment.
hm... Nice catch.
I updated logic and added test for this case (comment before test shows how mvn works).
Can you take a look and check that this is what you meant?
| @@ -303,7 +303,7 @@ func (d pomDependency) ToArtifact(opts analysisOptions) artifact { | |||
| Exclusions: exclusions, | |||
| Locations: locations, | |||
| Relationship: ftypes.RelationshipIndirect, // default | |||
| Test: d.Scope == "test", | |||
| Test: d.Scope == "test" || opts.testScope, | |||
There was a problem hiding this comment.
Doesn't it mean it'll include the test even if testScope is false? Unlike the other PR, this PR still includes test dependencies for me
There was a problem hiding this comment.
hmm... that's weird.
Do you see any vulnerabilities for test dependencies (or test packages in json format)?
debug logs for test dependencies are normal for this PR, because Trivy currently analyzes all dependencies and excludes Dev dependencies later.
There was a problem hiding this comment.
It takes ages to scan and then fails with:
semaphore acquire: context deadline exceeded
There was a problem hiding this comment.
This is timeout error.
Trivy's runtime has increased because Trivy first checks all dependencies (including test ones), and only then excludes them from the report
DmitriyLewen
changed the title
Devtest scope for pom.xml files
Description
We added support of
testscope.but we were forced to roll back these changes (see #7488).
This PR adds support of
testscope.Also this PR takes into account the problem with child dependencies of a test dependency(mark test deps and children of this dependency as
Dev).Blocker PR
pom.xmlfile scan times. (see enhancement(report): include/exclude dev deps in analyzers #7476 (comment)).Checklist