From 64298c02f02e70f2cde79c2a031ce7a08f75b779 Mon Sep 17 00:00:00 2001 From: Angel Eduardo Hincho Jove <82984150+ahincho@users.noreply.github.com> Date: Sun, 12 Jul 2026 21:33:09 -0500 Subject: [PATCH 1/2] fix(ci): explicit OWASP data.directory + disable irrelevant analyzers - data.directory now points at the shared, build-tool-agnostic path (~/.dependency-check-data) that reusable-owasp-check.yml caches and restores the centralized nova-devops NVD mirror into. The plugin's implicit default was never verified/documented; previous cache sizes (15-57MB) strongly suggest it did not match what was being cached. - Disabled analyzers for ecosystems that plainly do not exist in this repo (assembly/nuspec/nugetconf/msbuild/.NET, golang, swift, cocoapods, composer/PHP, cpan/Perl, cmake/autoconf, bundleAudit/rubygems, python, dart, retirejs) - zero detection-feature cost since none of these file types are present. Node/nodeAudit analyzers are NOT disabled (package.json is real - commitlint/lefthook devDependencies). - Verified property names against the actually-installed 12.2.2 Gradle plugin jar (javap on AnalyzerExtension.class) rather than assumed from docs - e.g. carthageAnalyzerEnabled does not exist in this version. See docs/java/06-semantic-versioning-en-java.md for the investigation into why OWASP scans were taking 30-50+ min. --- build.gradle.kts | 43 +++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 43 insertions(+) diff --git a/build.gradle.kts b/build.gradle.kts index 8b7ca80..a7e5f9c 100644 --- a/build.gradle.kts +++ b/build.gradle.kts @@ -73,6 +73,49 @@ dependencyCheck { // and an empty NVD key (slower updates, acceptable for local dev). failBuildOnCVSS = (System.getenv("NOVA_OWASP_FAIL_ON_CVSS") ?: "11").toFloat() nvd.apiKey = System.getenv("NVD_API_KEY") ?: "" + + // Must match the path reusable-owasp-check.yml caches AND restores the + // shared nova-devops NVD mirror into. Do NOT rely on the plugin's + // built-in default here - it was never verified/documented and previous + // cache sizes (15-57MB) strongly suggest it did not match what was + // being cached. Locally (no env var set) this falls back to a plain, + // dedicated directory outside ~/.gradle so it is never confused with + // unrelated Gradle caches. + data.directory = System.getenv("NOVA_OWASP_DATA_DIR") + ?: "${System.getProperty("user.home")}/.dependency-check-data" + + // Investigation (2026-07-13, docs/java/06-semantic-versioning-en-java.md): + // a cold NVD sync took 50+ min mostly due to cache scoping, NOT these + // analyzers - but disabling ecosystems that plainly do not exist + // anywhere in this repo removes real (if smaller) analyze-phase + // overhead and network surface at zero detection-feature cost. + // + // Deliberately NOT disabled: nodeEnabled / nodeAudit.enabled + // (package.json IS present - commitlint/lefthook devDependencies - + // keep scanning it for real) and opensslEnabled (harmless/fast). + // RetireJS IS disabled: it fingerprints vendored/bundled JS *library* + // files - this repo has no such files, only commitlint.config.js. + analyzers { + retirejs.enabled = false + assemblyEnabled = false + nuspecEnabled = false + nugetconfEnabled = false + msbuildEnabled = false + golangDepEnabled = false + golangModEnabled = false + swiftEnabled = false + swiftPackageResolvedEnabled = false + cocoapodsEnabled = false + composerEnabled = false + cpanEnabled = false + cmakeEnabled = false + autoconfEnabled = false + bundleAuditEnabled = false + pyDistributionEnabled = false + pyPackageEnabled = false + rubygemsEnabled = false + dartEnabled = false + } } pitest { From 8c7e89fbb5c3b8060689bfce7f14ca7c24d7edb3 Mon Sep 17 00:00:00 2001 From: Angel Eduardo Hincho Jove <82984150+ahincho@users.noreply.github.com> Date: Mon, 13 Jul 2026 10:06:10 -0500 Subject: [PATCH 2/2] fix(deps): resolve same 4 CVEs that blocked mask-utils PR#6 (CVSS >= 7) End-to-end validation confirmed the same 4 CVEs affect all Nova libraries that use the shared Gradle plugin set (jgit/grgit transitives): - CVE-2026-54428 (7.5) and CVE-2026-54399 (7.5) - DoS in httpcore/httpcore5 - CVE-2025-67030 (8.8) - RCE in plexus-utils - CVE-2025-48734 (8.8) - RCE in commons-beanutils Two layers of fix (same as mask-utils commit f133fa2): 1. scanConfigurations = [compileClasspath, runtimeClasspath] Restricts analysis to what propagates to consumers. 2. resolutionStrategy.eachDependency constraints Patches the vulnerable deps to their CVE-free minimums. Verified locally: 'gradlew dependencyCheckAnalyze' reports 0 vulnerabilities. --- build.gradle.kts | 42 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 42 insertions(+) diff --git a/build.gradle.kts b/build.gradle.kts index a7e5f9c..3376be5 100644 --- a/build.gradle.kts +++ b/build.gradle.kts @@ -29,6 +29,36 @@ repositories { mavenCentral() } +// Force patched versions of any transitive deps that carry known CVEs (CVSS >= 7). +// Versions verified against Maven Central 2026-07-13. Applied globally so they +// cover any classpath (compile, runtime, even buildscript transitives) so the +// OWASP gate reflects the real, patched state. +// +// - Apache HttpComponents Core 4.4.16+ for CVE-2026-54428, CVE-2026-54399 +// - Apache HttpComponents Core5 5.4.2+ for CVE-2026-54428, CVE-2026-54399 +// - Apache Commons BeanUtils 1.11.0+ for CVE-2025-48734 +// - plexus-utils 3.5.1+ for CVE-2025-67030 (commit 6d780b3 per NVD) +configurations.all { + resolutionStrategy.eachDependency { + if (requested.group == "org.apache.httpcomponents" && requested.name.startsWith("httpcore")) { + useVersion("4.4.16") + because("CVE-2026-54428, CVE-2026-54399 require httpcore 4.4.16+") + } + if (requested.group == "org.apache.httpcomponents.core5" && requested.name.startsWith("httpcore5")) { + useVersion("5.4.2") + because("CVE-2026-54428, CVE-2026-54399 require httpcore5 5.4.2+") + } + if (requested.group == "commons-beanutils" && requested.name == "commons-beanutils") { + useVersion("1.11.0") + because("CVE-2025-48734 requires commons-beanutils 1.11.0+") + } + if (requested.group == "org.codehaus.plexus" && requested.name == "plexus-utils") { + useVersion("3.5.1") + because("CVE-2025-67030 requires plexus-utils 3.5.1+") + } + } +} + val junitVersion = "6.0.0" val jqwikVersion = "1.9.3" @@ -74,6 +104,18 @@ dependencyCheck { failBuildOnCVSS = (System.getenv("NOVA_OWASP_FAIL_ON_CVSS") ?: "11").toFloat() nvd.apiKey = System.getenv("NVD_API_KEY") ?: "" + // Restrict OWASP analysis to configurations that actually propagate to + // consumers of this artifact. Without this, the plugin also scans test + // configurations and (via the gradle daemon's own classpath) the + // buildscript plugin transitives that NEVER reach a downstream project + // consuming this artifact. For a pure library with no runtime deps, + // this would otherwise surface CVEs in things like httpcore (transitive + // of jgit/grgit), plexus-utils, and commons-beanutils that are build-time + // only and not security-relevant for library consumers. + // + // Verified pattern in nova-java-mask-utils PR#6 (commit f133fa2). + scanConfigurations = listOf("compileClasspath", "runtimeClasspath") + // Must match the path reusable-owasp-check.yml caches AND restores the // shared nova-devops NVD mirror into. Do NOT rely on the plugin's // built-in default here - it was never verified/documented and previous