Closed henrikplate closed 2 years ago
@serenaponta I updated the JavaDoc of SpringBootAnalyzer
, please merge if you're fine with the changes.
@serenaponta please wait a little more before merging, I might have found another problem in the meantime
Found it: If the appContext
config settings were not provided as env. variables or system properties, i.e. when calling the instr
goal on a project having the profile, they were not visible to AbstractInstrumentor
and its sub classes, which called new VulasConfiguration()
. Some of those sub classes, however, depend on having the application context, e.g. to read the change list of vulnerabilities.
Fixed by calling VulasConfiguration.getGlobal()
, to which the profile/plugin configuration settings are added in AbstractVulasMojo
.
Added
SpringBootAnalyzer
to inspect and instrument Spring Boot applications packaged as executable, self-contained JARs (with foldersBOOT-INF/lib
andBOOT-INF/classes
). For example, a given executabletarget/foo.jar
will be rewritten totarget/vulas/target/foo-steady-instr.jar
.In this context, the following other improvements were implemented:
ClassVisitor
sets the major version of the instrumented class to major of the original file, unless that is bigger than the JVM at hand (in which case this major is taken).vulas.core.instr.blacklist.classes
has been reduced to the packagesorg.apache.maven.surefire,org.junit,org.eclipse.steady,org.jacoco.
, which makes that more traces will be collected, esp. forjackson
andjavassist
. This is possible because the instrumentation agentlang-java...with-dependencies
repackages many more classes than before.plugin-maven
does not depend any more onlang-java...with-dependencies
, which requires that this file has to be copied explicitly before any instrumentation (the corresponding command is printed to the console).VulasConfiguration
.ZipSlipAnalyzer
log messages in case of non-problematic files.VulasAgentMojo
.TODO
s