同步操作将从 悬镜安全/OpenSCA-cli 强制同步,此操作会覆盖自 Fork 仓库以来所做的任何修改,且无法恢复!!!
确定后同步将在后台操作,完成时将刷新页面,请耐心等待。
/** @Descripation: mvn解析依赖树* @Date: 2021年12月16日 10:10:13*/package javaimport ("bytes""crypto/tls""fmt""io/ioutil""net/http""os""os/exec""regexp""strings""time""util/args""util/cache""util/enum/language""util/logs""util/model""util/temp""github.com/pkg/errors")// MvnDepTree 调用mvn解析项目获取依赖树func MvnDepTree(path string, root *model.DepTree) {pwd := temp.GetPwd()os.Chdir(path)cmd := exec.Command("mvn", "dependency:tree", "--fail-never")out, _ := cmd.CombinedOutput()os.Chdir(pwd)// 统一替换换行符为\nout = bytes.ReplaceAll(out, []byte("\r\n"), []byte("\n"))out = bytes.ReplaceAll(out, []byte("\n\r"), []byte("\n"))out = bytes.ReplaceAll(out, []byte("\r"), []byte("\n"))// 获取mvn解析内容lines := strings.Split(string(out), "\n")for i := range lines {lines[i] = strings.TrimPrefix(lines[i], "[INFO] ")}// 捕获依赖树起始位置title := regexp.MustCompile(`--- [^\n]+ ---`)// 记录依赖树起始位置行号start := 0// 标记是否在依赖范围内树tree := falseroot.Direct = true// 获取mvn依赖树for i, line := range lines {if title.MatchString(line) {tree = truestart = icontinue}if tree && strings.Trim(line, "-") == "" {tree = falsebuildMvnDepTree(root, lines[start+1:i])for _, c := range root.Children {c.Direct = true}continue}}return}// buildMvnDepTree 构建mvn树func buildMvnDepTree(root *model.DepTree, lines []string) {// 记录当前的顶点节点列表tops := []*model.DepTree{root}// 上一层级lastLevel := -1for _, line := range lines {// 计算层级level := 0for line[level*3+2] == ' ' {level++}tops = tops[:len(tops)-lastLevel+level-1]root = tops[len(tops)-1]tags := strings.Split(line[level*3:], ":")if len(tags) < 4 {logs.Error(errors.New("mvn parse error"))break}dep := model.NewDepTree(root)dep.Vendor = tags[0]dep.Name = tags[1]dep.Version = model.NewVersion(tags[3])dep.Language = language.Javatops = append(tops, dep)lastLevel = level}}// downloadPom 下载pom文件func downloadPom(dep model.Dependency) (data []byte, err error) {tags := strings.Split(dep.Vendor, ".")tags = append(tags, dep.Name)tags = append(tags, dep.Version.Org)tags = append(tags, fmt.Sprintf("%s-%s.pom", dep.Name, dep.Version.Org))// 先扫描指定仓库for _, m := range args.Config.Maven {url := strings.TrimSuffix(m.Repo, `/`) + `/`url = url + strings.Join(tags, "/")name := m.Userpassword := m.Passworddata, err = getFromRepo(url, name, password)if data == nil {continue}return}// 指定仓库都没有就去官方仓库查询d := `https://repo.maven.apache.org/maven2/`url := d + strings.Join(tags, "/")if rep, err := http.Get(url); err != nil {return nil, err} else {defer rep.Body.Close()if rep.StatusCode == 200 {return ioutil.ReadAll(rep.Body)}}// 应该走不到这里return nil, fmt.Errorf("download failure")}// 从私服库获取pom文件func getFromRepo(url string, name string, password string) (data []byte, err error) {c := http.Client{Transport: &http.Transport{TLSClientConfig: &tls.Config{InsecureSkipVerify: true}}, Timeout: time.Duration(1 * time.Second)}resp, err := c.Get(url)if err != nil {return nil, err} else {resp.Request.SetBasicAuth(name, password)defer resp.Body.Close()logs.Debug(fmt.Sprintf("status code: %d url: %s", resp.StatusCode, url))if resp.StatusCode == 200 {return ioutil.ReadAll(resp.Body)}}return nil, fmt.Errorf("download from repository failure")}// getpom is get pom from indexfunc getpom(groupId, artifactId, version string) (p *Pom) {p = &Pom{Properties: PomProperties{}}if groupId == "" || artifactId == "" || version == "" {return nil}dep := model.Dependency{Vendor: groupId,Name: artifactId,Version: model.NewVersion(version),}data := cache.LoadCache(dep)if len(data) != 0 {return ReadPom(data)} else {// 无本地缓存下载pom文件if data, err := downloadPom(dep); err == nil {// 保存pom文件cache.SaveCache(dep, data)return ReadPom(data)} else {logs.Warn(err)}}return nil}
此处可能存在不合适展示的内容,页面不予展示。您可通过相关编辑功能自查并修改。
如您确认内容无涉及 不当用语 / 纯广告导流 / 暴力 / 低俗色情 / 侵权 / 盗版 / 虚假 / 无价值内容或违法国家有关法律法规的内容,可点击提交进行申诉,我们将尽快为您处理。