Feature/precompute #169
Feature/precompute #169
Conversation
Signed-off-by: mehab <meha.bhargava2@gmail.com>
Signed-off-by: mehab <meha.bhargava2@gmail.com>
![sonatype-lift[bot]](https://avatars.githubusercontent.com/in/9843?s=60&v=4){kind=small}
| @@ -50,13 +50,13 @@ public PolicyCondition.Subject supportedSubject() { | |||
| * {@inheritDoc} | |||
| */ | |||
| @Override | |||
| public List<PolicyConditionViolation> evaluate(final Policy policy, final Component component) { | |||
| public List<PolicyConditionViolation> evaluate(final Policy policy, final Component component, List<Vulnerability> vulerabilities) { | |||
There was a problem hiding this comment.
MixedMutabilityReturnType: This method returns both mutable and immutable collections or maps from different paths. This may be confusing for users of the method.
| public List<PolicyConditionViolation> evaluate(final Policy policy, final Component component, List<Vulnerability> vulerabilities) { | |
| final ImmutableList.Builder<PolicyConditionViolation> violations = ImmutableList.builder(); |
❗❗ 2 similar findings have been found in this PR
🔎 Expand here to view all instances of this finding
| File Path | Line Number |
|---|---|
| src/main/java/org/dependencytrack/policy/VulnerabilityIdPolicyEvaluator.java | 55 |
| src/main/java/org/dependencytrack/policy/SeverityPolicyEvaluator.java | 58 |
Visit the Lift Web Console to find more details in your report.
ℹ️ Expand to see all @sonatype-lift commands
You can reply with the following commands. For example, reply with @sonatype-lift ignoreall to leave out all findings.
| Command | Usage |
|---|---|
@sonatype-lift ignore |
Leave out the above finding from this PR |
@sonatype-lift ignoreall |
Leave out all the existing findings from this PR |
@sonatype-lift exclude <file|issue|path|tool> |
Exclude specified file|issue|path|tool from Lift findings by updating your config.toml file |
Note: When talking to LiftBot, you need to refresh the page to see its response.
Click here to add LiftBot to another repo.
There was a problem hiding this comment.
@sonatype-lift ignore
There was a problem hiding this comment.
I've recorded these 3 issues as ignored for this pull request.
If you change your mind, just comment @sonatype-lift unignore.
Signed-off-by: mehab <meha.bhargava2@gmail.com>
Description
Updated policy evaluation to get vulnerabilities list for each component in advance in case it is needed by evaluators (severity, cwe and vulnerability id). In these cases, in the existing logic the getAllVulnerabilities query was being called separately each time
Addressed Issue
Addresses DependencyTrack/hyades#529
Additional Details
Checklist