依赖漏洞扫描与修复

Dependency-Check 扫描依赖漏洞。

配置

<plugin>
  <groupId>org.owasp</groupId>
  <artifactId>dependency-check-maven</artifactId>
  <version>7.0.0</version>
  <executions>
    <execution>
      <goals>
        <goal>check</goal>
      </goals>
    </execution>
  </executions>
  <configuration>
    <failBuildOnCVSS>7</failBuildOnCVSS>
  </configuration>
</plugin>

执行

mvn dependency-check:check

报告

target/dependency-check-report.html

要点总结

• dependency-check-maven 扫描漏洞
• failBuildOnCVSS 阻断高危漏洞
• 生成漏洞报告