Skip to content

Commit ba694ab

Browse files
MattesMrzikMattesMrzik
committedDec 6, 2023
devonfw#103: refinements
1 parent ba87b95 commit ba694ab

File tree

12 files changed

+135
-115
lines changed

12 files changed

+135
-115
lines changed
 

‎cli/src/main/java/com/devonfw/tools/ide/common/SystemPath.java

+1
Original file line numberDiff line numberDiff line change
@@ -166,6 +166,7 @@ public Path getPath(String tool) {
166166
*/
167167
public void setPath(String tool, Path path) {
168168

169+
this.paths.add(path);
169170
this.tool2pathMap.put(tool, path);
170171
}
171172

‎cli/src/main/java/com/devonfw/tools/ide/tool/GlobalToolCommandlet.java

+1-3
Original file line numberDiff line numberDiff line change
@@ -47,10 +47,8 @@ protected boolean doInstall(boolean silent) {
4747
String edition = getEdition();
4848
ToolRepository toolRepository = this.context.getDefaultToolRepository();
4949
VersionIdentifier configuredVersion = getConfiguredVersion();
50-
5150
VersionIdentifier selectedVersion = securityRiskInteraction(configuredVersion);
52-
System.out.println("Selected version: " + selectedVersion);
53-
51+
setVersion(selectedVersion, silent);
5452
VersionIdentifier resolvedVersion = toolRepository.resolveVersion(this.tool, edition, selectedVersion);
5553
// download and install the global tool
5654
FileAccess fileAccess = this.context.getFileAccess();

‎cli/src/main/java/com/devonfw/tools/ide/tool/LocalToolCommandlet.java

+1-6
Original file line numberDiff line numberDiff line change
@@ -60,15 +60,10 @@ public Path getToolBinPath() {
6060
protected boolean doInstall(boolean silent) {
6161

6262
VersionIdentifier configuredVersion = getConfiguredVersion();
63-
6463
VersionIdentifier selectedVersion = securityRiskInteraction(configuredVersion);
65-
66-
System.out.println("Selected version: " + selectedVersion);
67-
64+
setVersion(selectedVersion, silent);
6865
// install configured version of our tool in the software repository if not already installed
6966
ToolInstallation installation = installInRepo(selectedVersion);
70-
71-
7267
// check if we already have this version installed (linked) locally in IDE_HOME/software
7368
VersionIdentifier installedVersion = getInstalledVersion();
7469
VersionIdentifier resolvedVersion = installation.resolvedVersion();

‎cli/src/main/java/com/devonfw/tools/ide/tool/ToolCommandlet.java

+14-12
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@
66
import java.nio.file.Paths;
77
import java.util.List;
88
import java.util.Set;
9+
import java.util.stream.Collectors;
910
import java.util.stream.Stream;
1011

1112
import com.devonfw.tools.ide.cli.CliException;
@@ -20,7 +21,8 @@
2021
import com.devonfw.tools.ide.process.ProcessContext;
2122
import com.devonfw.tools.ide.process.ProcessErrorHandling;
2223
import com.devonfw.tools.ide.property.StringListProperty;
23-
import com.devonfw.tools.ide.url.model.file.json.UrlSecurityJsonFile;
24+
import com.devonfw.tools.ide.url.model.file.UrlSecurityJsonFile;
25+
import com.devonfw.tools.ide.url.model.file.UrlSecurityJsonFile.UrlSecurityWarning;
2426
import com.devonfw.tools.ide.util.FilenameUtil;
2527
import com.devonfw.tools.ide.version.VersionIdentifier;
2628

@@ -173,7 +175,7 @@ public boolean install(boolean silent) {
173175

174176
protected String securityRiskInteractionQuestion(String question, String... options) {
175177

176-
question += " Do you want to";
178+
question += "Do you want to";
177179
for (int i = 0; i < options.length - 1; i++) {
178180
options[i] += " or";
179181
}
@@ -186,8 +188,8 @@ protected String securityRiskInteractionQuestion(String question, String... opti
186188
*
187189
* @param configuredVersion the {@link VersionIdentifier} to be checked.
188190
* @return the {@link VersionIdentifier} to be used for installation. If the configured version is safe or there are
189-
* no save versions the potentially unresolved configured version is simply returned. Otherwise, a resolved version is
190-
* returned.
191+
* no save versions the potentially unresolved configured version is simply returned. Otherwise, a resolved
192+
* version is returned.
191193
*/
192194
protected VersionIdentifier securityRiskInteraction(VersionIdentifier configuredVersion) {
193195

@@ -225,16 +227,17 @@ protected VersionIdentifier securityRiskInteraction(VersionIdentifier configured
225227
break;
226228
}
227229
}
228-
229-
String currentIsUnsafe = "Currently, version " + current + " of " + this.getName() + " is installed, "
230-
+ "which is has a vulnerability:\n" + " TODO list vulnerability" + "\n\n (See also " + securityFile.getPath()
231-
+ ")";
230+
String cves = securityFile.getMatchingSecurityWarnings(current).stream().map(UrlSecurityWarning::cveName)
231+
.collect(Collectors.joining(", "));
232+
String currentIsUnsafe = "Currently, version " + current + " of " + this.getName() + " is selected, "
233+
+ "which is has one or more vulnerabilities:\n\n" + cves + "\n\n(See also " + securityFile.getPath() + ")\n\n";
232234

233235
String stay = "stay with the current unsafe version (" + current + ")";
234236
String installLatestSafe = "install the latest safe version (" + latestSafe + ")";
235237
String installSafeLatest = "install the (safe) latest version (" + latestSafe + ")";
236238
String installNextSafe = "install the next safe version (" + nextSafe + ")";
237-
// I don't need to offer "install latest which is unsafe" as option since the user can set to the latest and choose "stay"
239+
// I don't need to offer "install latest which is unsafe" as option since the user can set to the latest and choose
240+
// "stay"
238241

239242
if (latestSafe == null) {
240243
this.context.warning(currentIsUnsafe + "There is no safe version available.");
@@ -257,9 +260,8 @@ protected VersionIdentifier securityRiskInteraction(VersionIdentifier configured
257260
return answer.startsWith(stay) ? current : latestSafe;
258261

259262
} else if (nextSafe.equals(latestSafe)) {
260-
String answer = securityRiskInteractionQuestion(
261-
currentIsUnsafe + " Of the newer versions, only the version " + nextSafe
262-
+ " is safe, Which is not the latest.", stay, "Install the safe version (" + nextSafe + ")");
263+
String answer = securityRiskInteractionQuestion(currentIsUnsafe + " Of the newer versions, only the version "
264+
+ nextSafe + " is safe, Which is not the latest.", stay, "Install the safe version (" + nextSafe + ")");
263265
return answer.startsWith(stay) ? current : nextSafe;
264266

265267
} else {

‎cli/src/main/java/com/devonfw/tools/ide/tool/helm/HelmUrlUpdater.java

+6
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,12 @@ protected String getGithubOrganization() {
2929
return "helm";
3030
}
3131

32+
@Override
33+
public String mapUrlVersionToCpeVersion(String version) {
34+
35+
return version.substring(getVersionPrefixToRemove().length());
36+
}
37+
3238
@Override
3339
protected void addVersion(UrlVersion urlVersion) {
3440

‎cli/src/main/java/com/devonfw/tools/ide/tool/java/JavaUrlUpdater.java

+4-13
Original file line numberDiff line numberDiff line change
@@ -27,24 +27,15 @@ protected String mapVersion(String version) {
2727
}
2828

2929
@Override
30-
protected String getCpeVendor() {
30+
public String getCpeVendor() {
3131

32-
// return "vikwp";
33-
return "eclipse";
32+
return "eclipse";
3433
}
3534

3635
@Override
37-
protected String getCpeProduct() {
36+
public String getCpeProduct() {
3837

39-
// return "vik_booking";
40-
return "temurin";
41-
}
42-
43-
@Override
44-
protected String mapUrlVersionToCpeVersion(String version) {
45-
46-
// return "1.5.8";
47-
return version;
38+
return "temurin";
4839
}
4940

5041
@Override

‎cli/src/main/java/com/devonfw/tools/ide/url/model/file/json/UrlSecurityJsonFile.java ‎cli/src/main/java/com/devonfw/tools/ide/url/model/file/UrlSecurityJsonFile.java

+28-14
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
package com.devonfw.tools.ide.url.model.file.json;
1+
package com.devonfw.tools.ide.url.model.file;
22

33
import java.io.BufferedWriter;
44
import java.io.IOException;
@@ -14,22 +14,40 @@
1414
import org.slf4j.LoggerFactory;
1515

1616
import com.devonfw.tools.ide.json.mapping.JsonMapping;
17-
import com.devonfw.tools.ide.url.model.file.AbstractUrlFile;
1817
import com.devonfw.tools.ide.url.model.folder.UrlEdition;
1918
import com.devonfw.tools.ide.version.VersionIdentifier;
2019
import com.devonfw.tools.ide.version.VersionRange;
2120
import com.fasterxml.jackson.core.JsonProcessingException;
2221
import com.fasterxml.jackson.core.type.TypeReference;
2322
import com.fasterxml.jackson.databind.ObjectMapper;
2423

24+
/**
25+
* {@link UrlFile} for the "security.json" file.
26+
*/
2527
public class UrlSecurityJsonFile extends AbstractUrlFile<UrlEdition> {
2628

29+
/***
30+
* A simple container with the information about a security warning.
31+
*
32+
* @param versionRange the version range, specifying the versions of the tool to which the security risk applies.
33+
* @param severity the severity of the security risk.
34+
* @param severityVersion Indicating from which version the {@code severity} was obtained. As of December 2023, this
35+
* is either v2 or v3.
36+
* @param cveName the name of the CVE (Common Vulnerabilities and Exposures).
37+
* @param description the description of the CVE.
38+
* @param nistUrl the url to the CVE on the NIST website.
39+
* @param referenceUrl the urls where additional information about the CVE can be found.
40+
*/
41+
public record UrlSecurityWarning(VersionRange versionRange, BigDecimal severity, String severityVersion,
42+
String cveName, String description, String nistUrl, List<String> referenceUrl) {
43+
};
44+
2745
/** {@link #getName() Name} of security json file. */
2846
public static final String FILENAME_SECURITY = "security.json";
2947

3048
private static final Logger LOG = LoggerFactory.getLogger(UrlSecurityJsonFile.class);
3149

32-
Set<UrlSecurityWarning> warnings;
50+
private Set<UrlSecurityWarning> warnings;
3351

3452
/**
3553
* The constructor.
@@ -45,21 +63,21 @@ public UrlSecurityJsonFile(UrlEdition parent) {
4563
/***
4664
* Adds a new security warning to the security json file.
4765
*
48-
* @param versionRange the version range, specifying the versions of the tool to which the security risk applies
66+
* @param versionRange the version range, specifying the versions of the tool to which the security risk applies.
4967
* @param severity the severity of the security risk.
5068
* @param severityVersion Indicating from which version the {@code severity} was obtained. As of December 2023, this
51-
* is either v2 or v3.
69+
* is either v2 or v3.
5270
* @param cveName the name of the CVE (Common Vulnerabilities and Exposures).
5371
* @param description the description of the CVE.
5472
* @param nistUrl the url to the CVE on the NIST website.
5573
* @param referenceUrl the urls where additional information about the CVE can be found.
5674
* @return {@code true} if the security match was added, {@code false} if it was already present.
5775
*/
58-
public boolean addSecurityWarning(VersionRange versionRange, BigDecimal severity, String severityVersion, String cveName,
59-
String description, String nistUrl, List<String> referenceUrl) {
76+
public boolean addSecurityWarning(VersionRange versionRange, BigDecimal severity, String severityVersion,
77+
String cveName, String description, String nistUrl, List<String> referenceUrl) {
6078

61-
UrlSecurityWarning newWarning = new UrlSecurityWarning(versionRange, severity, severityVersion, cveName, description, nistUrl,
62-
referenceUrl);
79+
UrlSecurityWarning newWarning = new UrlSecurityWarning(versionRange, severity, severityVersion, cveName,
80+
description, nistUrl, referenceUrl);
6381
boolean added = warnings.add(newWarning);
6482
this.modified = this.modified || added;
6583
return added;
@@ -136,8 +154,4 @@ protected void doSave() {
136154
throw new IllegalStateException("Failed to save file " + path, e);
137155
}
138156
}
139-
}
140-
141-
record UrlSecurityWarning(VersionRange versionRange, BigDecimal severity, String severityVersion, String cveName, String description, String nistUrl,
142-
List<String> referenceUrl) {
143-
};
157+
}

‎cli/src/main/java/com/devonfw/tools/ide/url/model/folder/UrlEdition.java

+1-1
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22

33
import com.devonfw.tools.ide.url.model.AbstractUrlFolderWithParent;
44
import com.devonfw.tools.ide.url.model.file.UrlSecurityFile;
5-
import com.devonfw.tools.ide.url.model.file.json.UrlSecurityJsonFile;
5+
import com.devonfw.tools.ide.url.model.file.UrlSecurityJsonFile;
66

77
/**
88
* An {@link UrlFolder} representing the actual edition of a {@link UrlTool}. The default edition may have the same

‎cli/src/test/java/com/devonfw/tools/ide/tool/ToolCommandletTest.java

+10-10
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,16 @@
11
package com.devonfw.tools.ide.tool;
22

3-
import com.devonfw.tools.ide.context.IdeTestContext;
4-
import com.devonfw.tools.ide.url.model.file.json.UrlSecurityJsonFile;
5-
import com.devonfw.tools.ide.version.VersionRange;
3+
import java.nio.file.Path;
4+
65
import org.junit.jupiter.api.Test;
76

87
import com.devonfw.tools.ide.context.AbstractIdeContextTest;
98
import com.devonfw.tools.ide.context.IdeContext;
9+
import com.devonfw.tools.ide.context.IdeTestContext;
1010
import com.devonfw.tools.ide.tool.az.Azure;
11+
import com.devonfw.tools.ide.url.model.file.UrlSecurityJsonFile;
1112
import com.devonfw.tools.ide.version.VersionIdentifier;
12-
13-
import java.nio.file.Path;
13+
import com.devonfw.tools.ide.version.VersionRange;
1414

1515
/***
1616
* Test of {@link ToolCommandlet}.
@@ -215,9 +215,11 @@ public void testSecurityRiskInteractionNoSafeVersionFound() {
215215
/***
216216
* Creates the context and data for the tests of {@link ToolCommandlet#securityRiskInteraction(VersionIdentifier)}.
217217
*
218-
* @param dummyTool the dummy tool to be used for the tests. The {@link com.devonfw.tools.ide.url.model.folder.UrlVersion folders}
219-
* representing the versions of the dummy tool are created here.
220-
* @param answers the answers to be used for the interaction in {@link ToolCommandlet#securityRiskInteraction(VersionIdentifier)}.
218+
* @param dummyTool the dummy tool to be used for the tests. The
219+
* {@link com.devonfw.tools.ide.url.model.folder.UrlVersion folders} representing the versions of the dummy
220+
* tool are created here.
221+
* @param answers the answers to be used for the interaction in
222+
* {@link ToolCommandlet#securityRiskInteraction(VersionIdentifier)}.
221223
* @return the {@link IdeTestContext} to be used for the tests.
222224
*/
223225
private IdeContext getContextForSecurityJsonTests(Class<? extends ToolCommandlet> dummyTool, String... answers) {
@@ -234,5 +236,3 @@ private IdeContext getContextForSecurityJsonTests(Class<? extends ToolCommandlet
234236
return context;
235237
}
236238
}
237-
238-

0 commit comments

Comments
 (0)
Please sign in to comment.