Configurable OwaspDependencyParserSettings

rapid7 · Nov 24, 2020 · 8048580 · 8048580
1 parent 32f171a
commit 8048580
Show file tree

Hide file tree

Showing 2 changed files with 12 additions and 2 deletions.
diff --git a/pom.xml b/pom.xml
@@ -58,7 +58,7 @@
     <commons.compress.version>1.19</commons.compress.version>
     <commons.io.version>2.6</commons.io.version>
     <jackson.version>[2.9.9,2.10.0)</jackson.version>
-    <slf4j.version>1.7.25</slf4j.version>
+    <slf4j.version>1.7.30</slf4j.version>
     <dependency.check.version>5.3.2</dependency.check.version>
     <!-- test dependencies -->
     <hamcrest.version>1.3</hamcrest.version>
@@ -114,6 +114,12 @@
       <groupId>org.owasp</groupId>
       <artifactId>dependency-check-core</artifactId>
       <version>${dependency.check.version}</version>
+      <exclusions>
+        <exclusion>
+          <artifactId>commons-beanutils</artifactId>
+          <groupId>commons-beanutils</groupId>
+        </exclusion>
+      </exclusions>
     </dependency>
 
     <dependency>

diff --git a/src/main/java/com/rapid7/container/analyzer/docker/service/DockerImageAnalyzerService.java b/src/main/java/com/rapid7/container/analyzer/docker/service/DockerImageAnalyzerService.java
@@ -77,6 +77,10 @@ public class DockerImageAnalyzerService {
   private List<ImageHandler> imageHandlers;
 
   public DockerImageAnalyzerService(String rpmDockerImage) {
+    this(rpmDockerImage, OwaspDependencyParserSettingsBuilder.EXPERIMENTAL);
+  }
+
+  public DockerImageAnalyzerService(String rpmDockerImage, OwaspDependencyParserSettingsBuilder builder) {
     objectMapper = new ObjectMapper();
     objectMapper.disable(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES);
     objectMapper.registerModule(new InstantParserModule());
@@ -88,7 +92,7 @@ public DockerImageAnalyzerService(String rpmDockerImage) {
     layerHandlers.add(new DpkgFingerprinter(new DpkgParser()));
     layerHandlers.add(new ApkgFingerprinter(new ApkgParser()));
     layerHandlers.add(new PacmanFingerprinter(new PacmanPackageParser()));
-    layerHandlers.add(new OwaspDependencyFingerprinter(new OwaspDependencyParser(OwaspDependencyParserSettingsBuilder.EXPERIMENTAL)));
+    layerHandlers.add(new OwaspDependencyFingerprinter(new OwaspDependencyParser(builder)));
   }
 
   public void addFileHandler(LayerFileHandler handler) {