无法在 Maven 中获得依赖项检查报告

Question

我正在尝试获取我的 Maven 项目之一的依赖项检查报告，但每次运行时：mvn verify依赖关系报告中的依赖关系显示没有易受攻击的 JAR。我在 POM 中添加了以下插件以生成依赖项检查报告： <dependencyManagement>    <dependencies>        <dependency>        <groupId>org.apache.commons</groupId>        <artifactId>commons-email</artifactId>        <version>1.1</version>    </dependency>        <dependency>            <groupId>apache.axis</groupId>            <artifactId>jaxrpc</artifactId>            <version>1.2beta</version>            <scope>provided</scope>        </dependency>       <dependencies><dependencyManagement><build>  <plugins>    <plugin>          <groupId>org.owasp</groupId>          <artifactId>dependency-check-maven</artifactId>          <version>3.3.2</version>          <executions>              <execution>                  <goals>                      <goal>check</goal>                  </goals>              </execution>          </executions>        </plugin>  </plugins>我需要纠正什么或有其他方法吗？commons-email-1.1.jar有一些漏洞，但仍然没有被检测到。这些是 Maven 日志：[INFO] Scanning for projects...[INFO] Inspecting build with total of 1 modules...[INFO] Installing Nexus Staging features:[INFO]   ... total of 1 executions of maven-deploy-plugin replaced with nexus-staging-maven-plugin[INFO][INFO][INFO] --- maven-clean-plugin:2.6.1:clean (default-clean) @ version-mana -  --[INFO][INFO] --- maven-source-plugin:2.4:jar-no-fork (attach-sources) @ version-  mana ---[INFO][INFO] --- maven-source-plugin:2.4:test-jar-no-fork (attach-sources) @ version-mana ---[INFO]

Answer 1

如果您有权访问 maven 存储库（在执行此命令时）并安装了 mvn/mvnw ，则可以从命令行执行此行。

mvn org.owasp:dependency-check-maven:5.2.2:check

“dependency-check-report.html”报告将在目标文件夹中生成。

Answer 2

出于兴趣，我尝试了它，对我来说它正在工作：

<project>

    <modelVersion>4.0.0</modelVersion>

    <groupId>test</groupId>

    <artifactId>test</artifactId>

    <version>1.0</version>

    <dependencies>

        <dependency>

            <groupId>org.apache.commons</groupId>

            <artifactId>commons-email</artifactId>

            <version>1.1</version>

        </dependency>

    </dependencies>

    <build>

        <plugins>

            <plugin>

                <groupId>org.owasp</groupId>

                <artifactId>dependency-check-maven</artifactId>

                <version>3.3.3</version>

                <executions>

                    <execution>

                        <goals>

                            <goal>check</goal>

                        </goals>

                    </execution>

                </executions>

            </plugin>

        </plugins>

    </build>

</project>

依赖检查 Maven 告诉我：

[INFO] Analysis Complete (1 seconds)

[WARNING] 

One or more dependencies were identified with known vulnerabilities in test:

commons-email-1.1.jar (org.apache.commons:commons-email:1.1, cpe:/a:apache:commons_email:1.1) : CVE-2017-9801, CVE-2018-1294

See the dependency-check report for more details.

您的依赖项部分看起来如何？例如，如果您为 commons-email 定义范围测试，则不会显示警告