search

jeremylong / DependencyCheck

OWASP dependency-check is a software composition analysis utility that detects publicly disclosed vulnerabilities in application dependencies.
https://owasp.org/www-project-dependency-check/
Apache License 2.0
6.29k stars 1.26k forks source link

Ant task fails #2348

Open yuliym opened 4 years ago

yuliym commented 4 years ago

Hi would like to integrate Dependency Check as ant task however it fails with following output\ BUILD FAILED /vagrant/olhamodulea/build-user.xml:84: Could not create type dependency-check due to java.lang.NoSuchMethodError: org.slf4j.impl.StaticLoggerBinder.setTask(Lorg/apache/tools/ant/Task;)V at org.owasp.dependencycheck.taskdefs.Purge.(Purge.java:63) at org.owasp.dependencycheck.taskdefs.Update.(Update.java:102) at org.owasp.dependencycheck.taskdefs.Check.(Check.java:372) at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method) at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62) at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45) at java.lang.reflect.Constructor.newInstance(Constructor.java:423) at org.apache.tools.ant.AntTypeDefinition.innerCreateAndSet(AntTypeDefinition.java:329) at org.apache.tools.ant.AntTypeDefinition.createAndSet(AntTypeDefinition.java:274) at org.apache.tools.ant.AntTypeDefinition.icreate(AntTypeDefinition.java:219) at org.apache.tools.ant.AntTypeDefinition.create(AntTypeDefinition.java:206) at org.apache.tools.ant.ComponentHelper.createComponent(ComponentHelper.java:285) at org.apache.tools.ant.ComponentHelper.createComponent(ComponentHelper.java:263) at org.apache.tools.ant.UnknownElement.makeObject(UnknownElement.java:430) at org.apache.tools.ant.UnknownElement.maybeConfigure(UnknownElement.java:164) at org.apache.tools.ant.Task.perform(Task.java:347) at org.apache.tools.ant.Target.execute(Target.java:435) at org.apache.tools.ant.Target.performTasks(Target.java:456) at org.apache.tools.ant.Project.executeSortedTargets(Project.java:1405) at org.apache.tools.ant.Project.executeTarget(Project.java:1376) at org.apache.tools.ant.helper.DefaultExecutor.executeTargets(DefaultExecutor.java:41) at org.apache.tools.ant.Project.executeTargets(Project.java:1260) at org.apache.tools.ant.Main.runBuild(Main.java:853) at org.apache.tools.ant.Main.startAnt(Main.java:235) at org.apache.tools.ant.launch.Launcher.run(Launcher.java:285) at org.apache.tools.ant.launch.Launcher.main(Launcher.java:112)

Total time: 5 seconds

Could you please advise ?

jeremylong commented 4 years ago

What version of Ant are you using? Can you provide the build file (build.xml, build-user.xml)?

jeremylong commented 4 years ago

What version of dependency-check?

yuliym commented 4 years ago

Hi @jeremylong We are using ant 1.9.6 Seems I found where is problem our ant lib folder contains following *jar file slf4j-jdk14-1.6.6.jar which has this class org/slf4j/impl/StaticLoggerBinder.class I suspect that class is outdated and does not have method setTask I ran ant in debug mode and see following message Class org.slf4j.impl.StaticLoggerBinder loaded from parent loader (parentFirst)

Any idea how to tell ant task to load classes from dependency check lib folder first?

mprins commented 4 years ago

I would try with a recent, supported version of Ant not a 2015 version. https://ant.apache.org/bindownload.cgi

mkienenb commented 2 years ago

Note that this problem can be caused by some other ant lib providing an implementation of org.slf4j.impl.StaticLoggerBinder. Try a fresh install of ant to rule this out.