|
37 | 37 | (delay {:nvd-clojure (get-version "nvd-clojure" "nvd-clojure") |
38 | 38 | :dependency-check (.getImplementationVersion (.getPackage Engine))})) |
39 | 39 |
|
| 40 | +(def classpath-separator-re |
| 41 | + (re-pattern (str File/pathSeparatorChar))) |
| 42 | + |
40 | 43 | (defn absolute-path ^String [file] |
41 | 44 | (s/replace-first file #"^~" (System/getProperty "user.home"))) |
42 | 45 |
|
| 46 | +(defn parse-classpath |
| 47 | + "Accepts a classpath string (i.e. colon-separated paths) and returns a sequence of analyzable |
| 48 | + absolute paths. |
| 49 | +
|
| 50 | + In particular, source paths such as `src`, while part of the classpath, won't be meaningfully |
| 51 | + analyzed by dependency-check-core. We only care about regular files (e.g. *.jar or |
| 52 | + package-lock.json). Thus, skip directories in general as well as non-existing files." |
| 53 | + [classpath-string] |
| 54 | + (into [] |
| 55 | + (comp (remove (fn [^String s] |
| 56 | + (let [file (io/file s)] |
| 57 | + (or (.isDirectory file) |
| 58 | + (not (.exists file)))))) |
| 59 | + (map absolute-path)) |
| 60 | + (s/split classpath-string classpath-separator-re))) |
| 61 | + |
43 | 62 | (defn- scan-and-analyze [project] |
44 | 63 | (let [^Engine engine (:engine project)] |
| 64 | + ;; See `parse-classpath` for details on which classpath entries are considered here. |
45 | 65 | (doseq [p (:classpath project)] |
46 | 66 | (.scan engine (absolute-path p))) |
47 | 67 | (try |
|
90 | 110 | fail-build? |
91 | 111 | conditional-exit))) |
92 | 112 |
|
93 | | -(def classpath-separator-re |
94 | | - (re-pattern (str File/pathSeparatorChar))) |
95 | | - |
96 | 113 | (defn -main [& [config-filename ^String classpath-string]] |
97 | 114 | (when (s/blank? classpath-string) |
98 | 115 | (throw (ex-info "nvd-clojure requires a classpath value to be explicitly passed as a CLI argument. |
99 | 116 | Older usages are deprecated." {}))) |
100 | 117 |
|
101 | | - (let [classpath (s/split classpath-string classpath-separator-re) |
102 | | - classpath (into [] |
103 | | - (remove (fn [^String s] |
104 | | - ;; Source paths such as `src`, while part of the classpath, won't |
105 | | - ;; be meaningfully analyzed by dependency-check-core. Thus, skip |
106 | | - ;; directories in general as well as non-existing files. |
107 | | - (let [file (io/file s)] |
108 | | - (or (.isDirectory file) |
109 | | - (not (.exists file)))))) |
110 | | - classpath)] |
| 118 | + (let [classpath (parse-classpath classpath-string)] |
111 | 119 |
|
112 | 120 | (when-not (System/getProperty "nvd-clojure.internal.skip-self-check") |
113 | 121 | (when-let [bad-entry (->> classpath |
|
0 commit comments