Compare commits

..

27 Commits

Author SHA1 Message Date
0edac4fc37 v1.3.5 pom 2023-08-21 15:33:12 -04:00
f837e5d1c0 Merge branch 'develop' into stable 2023-08-21 15:32:38 -04:00
08498d4224 v1.3.4 pom 2023-08-20 16:56:20 -04:00
1c7997d85c Merge branch 'develop' into stable 2023-08-20 16:56:04 -04:00
9874ed9543 v1.3.3 pom 2023-08-20 15:03:10 -04:00
eeb7a84698 Merge branch 'develop' into stable 2023-08-20 15:02:58 -04:00
4c1c4d412d v1.3.2 pom 2023-08-20 13:34:37 -04:00
fc5e0c6bd1 Merge branch 'develop' into stable 2023-08-20 13:32:59 -04:00
d41d73fa1c v1.3.1 pom 2023-08-20 12:59:23 -04:00
a9aa47d412 Merge branch 'develop' into stable 2023-08-20 12:58:55 -04:00
cfb13f3170 v1.3.0 pom 2023-08-20 12:04:15 -04:00
75f8175a1c Merge branch 'develop' into stable 2023-08-20 12:03:52 -04:00
58eb0ec013 v1.2.4 pom 2023-08-20 11:35:52 -04:00
dec181aa71 Merge branch 'develop' into stable 2023-08-20 11:35:29 -04:00
b6c7323203 v1.2.3 pom 2023-08-16 12:38:18 -04:00
9644bbe154 Merge branch 'develop' into stable 2023-08-16 12:37:38 -04:00
118b40f3f9 v1.2.2 pom 2023-06-30 12:42:52 -04:00
db3061a3a6 Merge branch 'develop' into stable 2023-06-30 12:42:25 -04:00
f991975923 v1.2.1 pom 2023-05-30 09:37:29 -04:00
e4f14a81da Merge branch 'develop' into stable 2023-05-30 09:36:26 -04:00
f749926f92 v1.2.0 pom 2023-05-29 11:13:11 -04:00
8c3ce9f069 Merge branch 'develop' into stable 2023-05-29 11:11:02 -04:00
cf2fdf42fa v1.1.1 pom 2023-05-25 15:24:41 -04:00
3d7d8bb769 Merge branch 'develop' into stable 2023-05-25 15:24:08 -04:00
01768754f0 v1.1.0 pom 2023-05-25 13:22:00 -04:00
e241137209 Merge branch 'develop' into stable 2023-05-25 13:19:36 -04:00
ff2a8b89e5 v1.0.0 pom 2023-05-25 08:56:24 -04:00
9 changed files with 38 additions and 288 deletions

View File

@ -5,9 +5,7 @@ This is a maven plugin that allows for developers and organizations to ban Maven
## Usage
### Prevent Banned Artifacts
Here is a pseudo-code example of all the options this plugin provides.
Here is an example of the primary reason why this plugin is useful.
```xml
<project>
@ -23,7 +21,6 @@ Here is a pseudo-code example of all the options this plugin provides.
<extensions>true</extensions>
<configuration>
<import>
<file>project-file.xml</file>
<url>https://host:port/path/file.xml</url>
<artifact>groupId:artifactId:version</artifact>
</import>
@ -57,11 +54,9 @@ Here is a pseudo-code example of all the options this plugin provides.
</project>
```
The `extensions` elements is critical. Without it, the plugin does nothing as far as banning artifacts/dependencies. With it, the plugin is able to not only detect banned artifacts, but do it before they are downloaded. This works with both dependencies and plugins. This keeps libraries from even reaching your local Maven repository cache.
The `extensions` elements is critical. Without it, the plugin does nothing for banning artifacts/dependencies. With it, the plugin is able to not only detect ban artifacts, but do it before they are downloaded. This keeps libraries from even reaching your local Maven repository cache.
### Purge Banned Artifacts
Here is an example of the non-extension use case for the plugin. You could use the same plugin for both preventing banned artifacts and cleaning up previously downloaded ones. Just set `extensions` to `true` in those cases, as highlighted in the previous section.
Here is an example of the non-extension use case for the plugin:
```xml
<project>
@ -74,6 +69,7 @@ Here is an example of the non-extension use case for the plugin. You could use
<groupId>com.inteligr8</groupId>
<artifactId>ban-maven-plugin</artifactId>
<version>...</version>
<extensions>true</extensions>
<configuration>
...
</configuration>
@ -95,25 +91,11 @@ Here is an example of the non-extension use case for the plugin. You could use
The `purge-repo` goal will remove all banned artifacts from your local Maven cache. It does not support `groupIdRegex` or blank `groupId` specifications. So any of those will not be purged/removed.
For instance, you can use the following and expect it to work for preventing and purging banned dependencies and plugins:
```xml
<include>
<artifact>
<groupId>...<groupId>
<artifactId>...<artifactId>
<version>...</version>
</artifact>
<artifact>com.inteligr8:ban-maven-plugin:[,1.0.0)</artifact>
<artifact>log4j:log4j</artifact>
</include>
```
## Configuration
If no `includes` are provided, then no artifacts will be banned. An *included* artifact is a banned artifact. An *excluded* artifact is not banned. It is the opposite of what you may think. If no `excludes` are provided, then no banned artifacts are granted an exception.
The `artifact` element supports the descriptive `groupId`/`artifactId`/`version` elements or the abbreviated colon-based notation. When using the colon-based notation, the group ID and artifact ID may be treated as `groupIdRegex` and `artifactIdRegex` (see below). If you only use acceptable `groupId` and `artifactId` characters (letters/numbers/dashes/underscores/dots), it will not. But if you include any other characters, like `\.` or `*`, then it will be treated as regex. How it is treated will impact the functionality of `purge-repo` goal, if you are using it.
The `artifact` element supports the descriptive `groupId`/`artifactId`/`version` elements or the abbreviated colon-based notation. When using the colon-based notation, the group ID and artifact ID are treated as `groupIdRegex` and `artifactIdRegex` (see below).
If `groupId` or `artifactId` or `version` are not provided, they are ignored in the matching process. So it will match all applicable artifacts and the constraint will be only for what was specified. This means that `<includes><artifact>:</artifact></includes>` will ban every artifact and all their versions.
@ -129,42 +111,10 @@ Order does not matter. All include specifications are processed, followed by al
## Import
The `import` file, URL, and artifact are to reference XML files that conform to the same `configuration` element as described here. In fact, the root elmenet of that XML should be `configuration`. It will only support the `includes` and `excludes` elements. so you cannot do recursive imports.
The `import` URL and artifact are to reference XML files that conform to the same `configuration` element as described here. In fact, the root elmenet of that XML should be `configuration`. It will only support the `includes` and `excludes` elements. so you cannot do recursive imports.
You can create a Maven `pom` packaging type project that deploys a configuration XML to your Maven repository. Then use an `import` to allow you to change banned dependencies without making changes to each individual project. Just like with the `version` notation in the `includes` and `excludes` elements, your `import` `artifact` element supports a version range. This way the latest banned dependencies can be side-loaded into all projects. This means previously functioning builds may eventually start failing. That is by design in this scenario.
The `import` elements supports multiple `url` or `artifact` declarations. All imported and directly specified include specifications are processed before all exclude specifications. You cannot change an include when importing, but you can add new ones, that may cover more versions; and you can exclude versions that may have been included by the import.
The `excludes` element is a way to provide project-by-project exceptions to imported banned artifacts where warranted.
## Examples
The recommended use of this plugin is for its use across whole organizations. First, you will want a simple Maven project that is referenced by all other Maven projects. That simple project will declare the banned artifacts and potentially purge existing ones. See the `examples/ban-config` project for a full example.
```xml
<configuration>
<includes>
<!-- CVE-2019-17571 -->
<artifact>org.apache.logging.log4j::[,2.17.1)</artifact>
<artifact>log4j:log4j</artifact>
</includes>
</configuration>
```
Deploying that project will result in the publication of the `ban-config.xml` to your Maven repository. That is where it can be picked up by all other projects so they can enforce the ban. If you do not have a local Maven repository, then you will have to upload the `ban-config.xml` to some other URL-accessible location by some other means.
Once you have that in place, you will want to add the following to every single Maven project that should be governed by the aforementioned `ban-config`. See the `examples/governed-artifact` project for a full example.
```xml
<plugin>
<groupId>com.inteligr8</groupId>
<artifactId>ban-maven-plugin</artifactId>
<version>...</version>
<extensions>true</extensions>
<configuration>
<import>
<artifact>com.inteligr8:ban-config:[2025.03,)</artifact>
</import>
</configuration>
</plugin>
```

View File

@ -1,8 +0,0 @@
<?xml version="1.0" encoding="utf-8" ?>
<configuration>
<includes>
<!-- CVE-2019-17571 -->
<artifact>org.apache.logging.log4j::[,2.17.1)</artifact>
<artifact>log4j:log4j</artifact>
</includes>
</configuration>

View File

@ -1,85 +0,0 @@
<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
<modelVersion>4.0.0</modelVersion>
<groupId>com.inteligr8</groupId>
<artifactId>ban-config</artifactId>
<packaging>pom</packaging>
<!-- A monthly cadence is reasonable at most organizations -->
<version>2025.03</version>
<name>Banned Artifact Configuration</name>
<build>
<resources>
<resource>
<directory>.</directory>
<includes>
<include>*-config.xml</include>
</includes>
<targetPath>${project.build.directory}</targetPath>
</resource>
</resources>
<plugins>
<plugin>
<groupId>com.inteligr8</groupId>
<artifactId>ban-maven-plugin</artifactId>
<version>1.4.0</version>
<executions>
<execution>
<id>purge-maven-repo</id>
<phase>clean</phase>
<goals><goal>purge-repo</goal></goals>
<configuration>
<import>
<file>ban-config.xml</file>
</import>
</configuration>
</execution>
</executions>
</plugin>
<plugin>
<artifactId>maven-resources-plugin</artifactId>
<executions>
<execution>
<id>filter</id>
<goals><goal>resources</goal></goals>
</execution>
</executions>
</plugin>
<plugin>
<artifactId>maven-install-plugin</artifactId>
<configuration>
<skip>true</skip>
<file>${project.build.directory}/ban-config.xml</file>
</configuration>
<executions>
<execution>
<id>install-xml</id>
<phase>install</phase>
<goals><goal>install-file</goal></goals>
<configuration>
<groupId>${project.groupId}</groupId>
<artifactId>${project.artifactId}</artifactId>
<version>${project.version}</version>
<packaging>xml</packaging>
</configuration>
</execution>
</executions>
</plugin>
<plugin>
<artifactId>maven-deploy-plugin</artifactId>
<configuration>
<file>ban-config.xml</file>
<pomFile>pom.xml</pomFile>
<packaging>xml</packaging>
</configuration>
</plugin>
</plugins>
</build>
</project>

View File

@ -1,31 +0,0 @@
<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
<modelVersion>4.0.0</modelVersion>
<groupId>com.inteligr8</groupId>
<artifactId>governed-artifact</artifactId>
<version>1.0-SNAPSHOT</version>
<packaging>jar</packaging>
<name>Any Governed Artifact</name>
<build>
<plugins>
<plugin>
<groupId>com.inteligr8</groupId>
<artifactId>ban-maven-plugin</artifactId>
<version>1.4.0</version>
<extensions>true</extensions>
<configuration>
<import>
<artifact>com.inteligr8:ban-config:[2025.03,)</artifact>
</import>
</configuration>
</plugin>
</plugins>
</build>
</project>

29
pom.xml
View File

@ -7,7 +7,7 @@
<groupId>com.inteligr8</groupId>
<artifactId>ban-maven-plugin</artifactId>
<version>1.4-SNAPSHOT</version>
<version>1.3.5</version>
<packaging>maven-plugin</packaging>
<name>Ban Dependencies Maven Plugin</name>
@ -43,14 +43,14 @@
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
<maven.compiler.source>1.8</maven.compiler.source>
<maven.compiler.target>1.8</maven.compiler.target>
<maven.version>3.9.9</maven.version>
<maven.version>3.9.0</maven.version>
</properties>
<dependencies>
<dependency>
<groupId>org.apache.commons</groupId>
<artifactId>commons-lang3</artifactId>
<version>3.17.0</version>
<version>3.4</version>
</dependency>
<dependency>
<groupId>org.apache.maven.shared</groupId>
@ -66,7 +66,7 @@
<dependency>
<groupId>org.apache.maven.plugin-tools</groupId>
<artifactId>maven-plugin-annotations</artifactId>
<version>3.15.1</version>
<version>3.7.1</version>
<scope>provided</scope>
</dependency>
<dependency>
@ -90,27 +90,16 @@
<dependency>
<groupId>junit</groupId>
<artifactId>junit</artifactId>
<version>4.13.2</version>
<version>4.12</version>
<scope>test</scope>
</dependency>
</dependencies>
<build>
<pluginManagement>
<plugins>
<plugin>
<artifactId>maven-plugin-plugin</artifactId>
<version>3.15.1</version>
</plugin>
<plugin>
<artifactId>maven-invoker-plugin</artifactId>
<version>3.9.0</version>
</plugin>
</plugins>
</pluginManagement>
<plugins>
<plugin>
<artifactId>maven-plugin-plugin</artifactId>
<version>3.7.1</version>
<executions>
<execution>
<id>default-descriptor</id>
@ -145,7 +134,7 @@
<plugin>
<groupId>org.codehaus.plexus</groupId>
<artifactId>plexus-component-metadata</artifactId>
<version>2.2.0</version>
<version>2.1.1</version>
<executions>
<execution>
<goals>
@ -156,6 +145,7 @@
</plugin>
<plugin>
<artifactId>maven-invoker-plugin</artifactId>
<version>3.4.0</version>
<configuration>
<projectsDirectory>${basedir}/src/it</projectsDirectory>
<cloneProjectsTo>${project.build.directory}/it</cloneProjectsTo>
@ -191,6 +181,7 @@
<plugins>
<plugin>
<artifactId>maven-invoker-plugin</artifactId>
<version>3.2.2</version>
<executions>
<execution>
<id>run-its</id>
@ -249,7 +240,7 @@
<plugin>
<groupId>org.sonatype.plugins</groupId>
<artifactId>nexus-staging-maven-plugin</artifactId>
<version>1.7.0</version>
<version>1.6.13</version>
<extensions>true</extensions>
<configuration>
<serverId>ossrh</serverId>

View File

@ -47,7 +47,7 @@ public abstract class AbstractBanConfiguration implements BanConfiguration {
private final Logger logger = LoggerFactory.getLogger(this.getClass());
private final Pattern artifactPattern = Pattern.compile("^([^:]*):([^:]*)(:([^:]+))?$");
private final Pattern notRegexPattern = Pattern.compile("^[A-Za-z0-9_\\-\\.]*$");
private final Pattern notRegexPattern = Pattern.compile("^[A-Za-z0-9_\\.]*$");
protected final List<ArtifactFilter> includeArtifacts = new LinkedList<>();
protected final List<ArtifactFilter> excludeArtifacts = new LinkedList<>();
@ -75,35 +75,35 @@ public abstract class AbstractBanConfiguration implements BanConfiguration {
private void processImports(Xpp3Dom importDom) throws IOException, MojoFailureException {
for (Xpp3Dom child : importDom.getChildren()) {
BanConfigurationDownloader downloader = null;
if (child.getName().equals("file")) {
File file = new File(StringUtils.trimToNull(child.getValue()));
downloader = new BanConfigurationDownloader(this.session, this.artifactResolver, this.versionRangeResolver, file);
} else if (child.getName().equals("url")) {
if (child.getName().equals("url")) {
String url = StringUtils.trimToNull(child.getValue());
downloader = new BanConfigurationDownloader(this.session, this.artifactResolver, this.versionRangeResolver, url);
} else if (child.getName().equals("artifact")) {
Artifact artifact = new DefaultArtifact(child.getValue());
if (!"xml".equals(artifact.getExtension()))
artifact = new DefaultArtifact(artifact.getGroupId(), artifact.getArtifactId(), artifact.getClassifier(), "xml", artifact.getVersion());
Version latestVersion = this.findLatestVersion(artifact, child.getValue());
Artifact latestArtifact = this.findLatestArtifact(artifact, child.getValue());
if (latestArtifact == null && latestVersion != null) {
this.logger.debug("A latest version was found, but could not resolve the artifact using the range; trying to resolve the artifact with the specific version: {}: {}", latestVersion, child.getValue());
artifact = artifact.setVersion(latestVersion.toString());
latestArtifact = this.findLatestArtifact(artifact, child.getValue());
}
if (latestArtifact != null && latestArtifact.getFile() != null) {
this.logger.debug("The latest artifact was found: {}", latestArtifact);
File file = latestArtifact.getFile();
downloader = new BanConfigurationDownloader(this.session, this.artifactResolver, this.versionRangeResolver, file);
} else if (artifact != null) {
File file = artifact.getFile();
downloader = new BanConfigurationDownloader(this.session, this.artifactResolver, this.versionRangeResolver, file);
VersionRangeRequest vrrequest = new VersionRangeRequest(artifact, this.session.getCurrentProject().getRemoteProjectRepositories(), null);
try {
VersionRangeResult vrresult = this.versionRangeResolver.resolveVersionRange(this.session.getRepositorySession(), vrrequest);
if (vrresult.getVersions().isEmpty()) {
this.logger.error("The artifact version range could not be resolved; skipping: {}", child.getValue());
} else {
Version version = vrresult.getHighestVersion();
artifact = artifact.setVersion(version.toString());
ArtifactRequest arequest = new ArtifactRequest(artifact, this.session.getCurrentProject().getRemoteProjectRepositories(), null);
try {
ArtifactResult aresult = this.artifactResolver.resolveArtifact(this.session.getRepositorySession(), arequest);
File file = aresult.getArtifact().getFile();
downloader = new BanConfigurationDownloader(this.session, this.artifactResolver, this.versionRangeResolver, file);
} catch (ArtifactResolutionException are) {
this.logger.warn("The artifact version could not be resolved; skipping: {}", artifact, version);
}
}
} catch (VersionRangeResolutionException vrre) {
this.logger.error("The artifact version range could not be resolved; skipping: {}", child.getValue());
}
} else {
this.logger.debug("Unrecognized configuration element ignored: {}: {}", child.getName(), child.getValue());
}
if (downloader != null) {
@ -113,37 +113,6 @@ public abstract class AbstractBanConfiguration implements BanConfiguration {
}
}
private Version findLatestVersion(Artifact artifact, String logId) {
this.logger.trace("Inspecting the local and remote repositories to select the version to import: {}", logId);
VersionRangeRequest vrrequest = new VersionRangeRequest(artifact, this.session.getCurrentProject().getRemoteProjectRepositories(), null);
try {
VersionRangeResult vrresult = this.versionRangeResolver.resolveVersionRange(this.session.getRepositorySession(), vrrequest);
if (vrresult.getVersions().isEmpty()) {
this.logger.info("The artifact version range could not be resolved: {}", logId);
return null;
} else {
this.logger.debug("The artifact version discovered: {}: {}", vrresult.getHighestVersion(), logId);
return vrresult.getHighestVersion();
}
} catch (VersionRangeResolutionException vrre) {
this.logger.error("The artifact version range could not be resolved; skipping: {}", logId);
return null;
}
}
private Artifact findLatestArtifact(Artifact artifact, String logId) {
this.logger.trace("Inspecting the local/remote repositories to select the artifact to import: {}", logId);
ArtifactRequest arequest = new ArtifactRequest(artifact, this.session.getCurrentProject().getRemoteProjectRepositories(), null);
try {
ArtifactResult aresult = this.artifactResolver.resolveArtifact(this.session.getRepositorySession(), arequest);
this.logger.debug("This artifact version discovered: {}: {}", aresult.getArtifact().getVersion(), logId);
return aresult.getArtifact();
} catch (ArtifactResolutionException are) {
this.logger.warn("The artifact could not be resolved; skipping: {}", artifact);
return null;
}
}
private void processIncludesExcludes(Xpp3Dom rootDom) {
Xpp3Dom includesDom = rootDom.getChild("includes");
if (includesDom != null)

View File

@ -29,7 +29,6 @@ import org.apache.maven.model.Plugin;
import org.apache.maven.plugin.MojoFailureException;
import org.apache.maven.plugin.PluginResolutionException;
import org.apache.maven.plugin.internal.PluginDependenciesResolver;
import org.apache.maven.plugins.annotations.Parameter;
import org.apache.maven.project.DefaultDependencyResolutionRequest;
import org.apache.maven.project.DependencyResolutionException;
import org.apache.maven.project.DependencyResolutionResult;
@ -45,8 +44,6 @@ import org.eclipse.aether.impl.VersionRangeResolver;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import com.inteligr8.maven.ban.model.ImportConfig;
@Named("ban")
@Singleton
public class BanExtension extends AbstractMavenLifecycleParticipant {
@ -68,18 +65,6 @@ public class BanExtension extends AbstractMavenLifecycleParticipant {
@Inject
private PluginDependenciesResolver pluginDepResolver;
/**
* The configuration is parsed manually. This is here to prevent warning messages with IDEs and builders.
*/
@Parameter(name = "import")
private ImportConfig importConfig;
@Parameter(name = "includes")
private List<String> includes;
@Parameter(name = "excludes")
private List<String> excludes;
@Override
public void afterProjectsRead(MavenSession session) throws MavenExecutionException {

View File

@ -1,11 +0,0 @@
package com.inteligr8.maven.ban.model;
import java.util.List;
public class Config {
public ImportConfig importConfigs;
public List<String> includes;
public List<String> excludes;
}

View File

@ -1,10 +0,0 @@
package com.inteligr8.maven.ban.model;
import java.util.List;
public class ImportConfig {
public List<String> url;
public List<String> artifact;
}