diff --git a/resources/vulnerable-deps.edn b/resources/vulnerable-deps.edn index c7f356d..b79e149 100644 --- a/resources/vulnerable-deps.edn +++ b/resources/vulnerable-deps.edn @@ -1,4 +1,5 @@ {:deps {org.clojure/clojure {:mvn/version "1.11.0-alpha1"} com.auth0/java-jwt {:mvn/version "3.5.0"} - image-resizer/image-resizer {:mvn/version "0.1.10"}} - :aliases {:banana {:extra-deps {clj-http/clj-http {:mvn/version "3.9.1"}}}}} \ No newline at end of file + image-resizer/image-resizer {:mvn/version "0.1.10"} + io.replikativ/datahike {:mvn/version "0.4.1480"}} + :aliases {:banana {:extra-deps {clj-http/clj-http {:mvn/version "3.9.1"}}}}} diff --git a/src/clj_watson/diplomat/remediate.clj b/src/clj_watson/diplomat/remediate.clj index 02cd7fe..cd746f7 100644 --- a/src/clj_watson/diplomat/remediate.clj +++ b/src/clj_watson/diplomat/remediate.clj @@ -29,19 +29,21 @@ (let [parents (-> parents first reverse) root-dependency (last parents) safe-version (-> vulnerability dependency-safe-versions first)] - (loop [parents parents - child-dependency dependency-name - child-safe-version safe-version] - (if (seq parents) - (let [parent-dependency-name (first parents) - latest-version (->> parent-dependency-name - diplomat.dependency/get-all-versions - last)] - (if (parent-dependency-contains-child-version? parent-dependency-name latest-version child-dependency child-safe-version repositories) - (recur (next parents) parent-dependency-name latest-version) - {root-dependency {:exclusions [child-dependency]} - child-dependency {:mvn/version child-safe-version}})) - {child-dependency {:mvn/version child-safe-version}})))) + (if safe-version + (loop [parents parents + child-dependency dependency-name + child-safe-version safe-version] + (if (seq parents) + (let [parent-dependency-name (first parents) + latest-version (->> parent-dependency-name + diplomat.dependency/get-all-versions + last)] + (if (parent-dependency-contains-child-version? parent-dependency-name latest-version child-dependency child-safe-version repositories) + (recur (next parents) parent-dependency-name latest-version) + {root-dependency {:exclusions [child-dependency]} + child-dependency {:mvn/version child-safe-version}})) + {child-dependency {:mvn/version child-safe-version}})) + "vulnerability without patch."))) (defn vulnerabilities-fix-suggestions [{:keys [vulnerable-dependencies] :as dependencies} deps-edn-path] (let [deps (-> deps-edn-path slurp edn/read-string) diff --git a/src/clj_watson/entrypoint.clj b/src/clj_watson/entrypoint.clj index 61de5f2..6e7777a 100644 --- a/src/clj_watson/entrypoint.clj +++ b/src/clj_watson/entrypoint.clj @@ -22,4 +22,5 @@ (comment (scan {:deps-edn-path "resources/vulnerable-deps.edn" + :suggest-fix true :dependency-check-properties "resources/dependency-check.properties"})) \ No newline at end of file