[PPSC-878] feat(supply-chain): add Java (Maven/Gradle) package release-age enforcement#211
Merged
Merged
Conversation
…e-age enforcement
|
| Severity | Count |
|---|---|
| 🟡 MEDIUM | 1 |
Total: 1
View all 1 findings
🟡 MEDIUM (1)
CWE-253 - The `loadConfigUpward` function searches for a configuration file
Location: internal/cmd/supply_chain.go:16
The loadConfigUpward function searches for a configuration file. When it doesn't find one, it returns a nil configuration object together with a nil error (line 16). If another part of the program receives these return values and assumes that a nil error means the configuration is always valid, it might try to use the configuration without checking whether it is nil. Doing so would cause the program to crash (a runtime panic). This situation can happen when a user runs the command in a directory that lacks the expected configuration file. The function itself does not protect against this misuse, so the risk comes from the way the returned values are checked later in the code.
)
// loadConfigUpward searches from dir upward (via FindConfigDir) for a
// .armis-supply-chain.yaml and loads it. It returns the parsed config (nil if
// none is found), the directory the config was found in, and any load error.
// This keeps `check`, `status`, and `wrap` consistent: a config in a parent
// directory applies when commands are run from a subdirectory.
func loadConfigUpward(dir string) (*supplychain.Config, string, error) {
configDir := supplychain.FindConfigDir(dir)
if configDir == "" {
return nil, "", nil
}
cfg, err := supplychain.LoadConfig(configDir)
if err != nil {
return nil, configDir, err
}
return cfg, configDir, nil
}
var supplyChainCmd = &cobra.Command{
Use: "supply-chain",
CWEs: CWE-253: Incorrect Check of Function Return Value
Test Coverage Reporttotal: (statements) 68.8% Coverage by function |
There was a problem hiding this comment.
Pull request overview
Adds Java ecosystem support (Maven pom.xml and Gradle gradle.lockfile) to the supply-chain “release age” enforcement, extending existing Node/Python coverage by introducing Maven Central lookups and wiring the new parsers into detection, checking, and wrap/init flows.
Changes:
- Add a Maven Central registry client with retry/backoff and caching for publish-date lookups.
- Implement
pom.xmlandgradle.lockfileparsers and route them through the existing supply-chain check dispatch. - Extend ecosystem detection and CLI help/wrap/init plumbing to recognize Maven/Gradle projects.
Reviewed changes
Copilot reviewed 13 out of 13 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| internal/supplychain/registry/maven.go | New Maven Central client for publish-date queries (backoff + caching). |
| internal/supplychain/registry/maven_test.go | Unit tests for Maven Central client behavior and caching. |
| internal/supplychain/detect.go | Add Maven/Gradle ecosystems and detect pom.xml / gradle.lockfile. |
| internal/supplychain/check/testdata/pom.xml | Test fixture POM for Maven dependency parsing. |
| internal/supplychain/check/testdata/gradle.lockfile | Test fixture Gradle lockfile for parsing. |
| internal/supplychain/check/maven.go | New pom.xml parser to extract Maven dependencies. |
| internal/supplychain/check/maven_test.go | Unit tests for Maven POM parsing rules (scope/property refs). |
| internal/supplychain/check/gradle.go | New Gradle lockfile parser. |
| internal/supplychain/check/gradle_test.go | Unit tests for Gradle lockfile parsing. |
| internal/supplychain/check/check.go | Dispatch Maven/Gradle parsing + Maven Central querying. |
| internal/cmd/supply_chain.go | Update CLI help text to include Java ecosystems / Maven Central. |
| internal/cmd/supply_chain_wrap.go | Allow mvn/gradle and route them via pre-install block enforcement. |
| internal/cmd/supply_chain_init.go | Map Maven/Gradle ecosystems to package manager names for init. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- maven registry: escape Solr query special chars (`"`, `\`) in group/artifact/version before interpolating into the quoted Solr term. URL-escaping is decoded before Solr parses the query, so an unescaped version could break out of the quoted term and return an unrelated artifact's timestamp, bypassing release-age enforcement. Correct the stale armis:ignore rationales accordingly. - maven check: stop treating <dependencyManagement> entries as direct dependencies (false positives). Use them only as a fallback version source to backfill versionless <dependencies> entries. - gradle check: fix misleading comments — the suffix after `=` is a comma-separated list of configuration names, not a hash.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Related Issue
Type of Change
Problem
The supply-chain enforcement feature covered Node.js and Python ecosystems but had no support for Java projects using Maven (
pom.xml) or Gradle (gradle.lockfile).Solution
Adds Maven Central registry client (
registry/maven.go) with exponential backoff for rate limiting,pom.xmlparser (skips test/provided scopes and unresolvable${property}version refs), andgradle.lockfileparser. Wires both ecosystems into lockfile detection, the check dispatch, and thesupply-chain wrappre-install block flow. Maven Central queries use regex-validated coordinates and are QueryEscaped; SSRF findings suppressed witharmis:ignoreasbaseURLis a trusted construction-time constant.Testing
Automated Tests
Manual Testing
Verified
armis-cli supply-chain checkdetectspom.xmlandgradle.lockfilein a test project and correctly queries Maven Central for publish dates.Checklist