From 07203a5a2d8c5bad386b350394027d99f4fa3a36 Mon Sep 17 00:00:00 2001
From: Andrey Yegorov <andrey.yegorov@datastax.com>
Date: Wed, 19 Jan 2022 14:09:54 -0800
Subject: [PATCH 1/5] Added OWASP dependency-check

---
 build.gradle                                | 31 +++++++++++++++++++++
 gradle.properties                           |  1 +
 settings.gradle                             |  1 +
 src/owasp-dependency-check-suppressions.xml | 26 +++++++++++++++++
 4 files changed, 59 insertions(+)
 create mode 100644 src/owasp-dependency-check-suppressions.xml

diff --git a/build.gradle b/build.gradle
index 881981592f4..33fea2218ad 100644
--- a/build.gradle
+++ b/build.gradle
@@ -29,6 +29,7 @@ plugins {
     id 'checkstyle'
     id 'org.nosphere.apache.rat'
     id 'com.github.spotbugs'
+    id 'org.owasp.dependencycheck'
 }
 
 subprojects {
@@ -70,6 +71,36 @@ allprojects {
         apply plugin: 'org.nosphere.apache.rat'
         apply plugin: "checkstyle"
         apply plugin: 'com.github.spotbugs'
+        apply plugin: 'org.owasp.dependencycheck'
+
+        dependencyCheck {
+            // see https://jeremylong.github.io/DependencyCheck/dependency-check-gradle/configuration.html
+            // for configuration properties
+            suppressionFile = "src/owasp-dependency-check-suppressions.xml"
+            analyzers {
+                msbuildEnabled = false
+                rubygemsEnabled = false
+                pyDistributionEnabled = false
+                pyPackageEnabled = false
+                nuspecEnabled = false
+                nugetconfEnabled = false
+                assemblyEnabled = false
+                cmakeEnabled = false
+                composerEnabled = false
+                cpanEnabled  =false
+                nodeEnabled = false
+                cocoapodsEnabled = false
+                swiftEnabled = false
+                swiftPackageResolvedEnabled = false
+                bundleAuditEnabled = false
+                golangDepEnabled = false
+                golangModEnabled = false
+
+                nodeAudit.enabled = false
+                retirejs.enabled = false
+            }
+        }
+
         checkstyle {
             toolVersion "${checkStyleVersion}"
             configFile file("$rootDir/buildtools/src/main/resources/bookkeeper/checkstyle.xml")
diff --git a/gradle.properties b/gradle.properties
index b8be5831081..bba0e1dfa0a 100644
--- a/gradle.properties
+++ b/gradle.properties
@@ -27,3 +27,4 @@ checkStyleVersion=6.19
 spotbugsPlugin=4.7.0
 testLogger=2.0.0
 testRetry=1.0.0
+owaspPlugin=6.5.3
diff --git a/settings.gradle b/settings.gradle
index 3c72c6e5f80..04f56634461 100644
--- a/settings.gradle
+++ b/settings.gradle
@@ -25,6 +25,7 @@ pluginManagement {
         id "com.github.spotbugs" version "${spotbugsPlugin}"
         id "com.adarshr.test-logger" version  "${testLogger}"
         id "org.gradle.test-retry" version "${testRetry}"
+        id "org.owasp.dependencycheck" version "${owaspPlugin}"
     }
 }
 
diff --git a/src/owasp-dependency-check-suppressions.xml b/src/owasp-dependency-check-suppressions.xml
new file mode 100644
index 00000000000..7da86d44cc5
--- /dev/null
+++ b/src/owasp-dependency-check-suppressions.xml
@@ -0,0 +1,26 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+
+    Licensed to the Apache Software Foundation (ASF) under one
+    or more contributor license agreements.  See the NOTICE file
+    distributed with this work for additional information
+    regarding copyright ownership.  The ASF licenses this file
+    to you under the Apache License, Version 2.0 (the
+    "License"); you may not use this file except in compliance
+    with the License.  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+    Unless required by applicable law or agreed to in writing,
+    software distributed under the License is distributed on an
+    "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+    KIND, either express or implied.  See the License for the
+    specific language governing permissions and limitations
+    under the License.
+
+-->
+<suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">
+    <!-- add supressions for known vulnerabilities detected by OWASP Dependency Check -->
+
+</suppressions>
+

From ef1f8d44ac0a55487d780223717dd99590d54422 Mon Sep 17 00:00:00 2001
From: Andrey Yegorov <andrey.yegorov@datastax.com>
Date: Wed, 19 Jan 2022 20:10:57 -0800
Subject: [PATCH 2/5] Excluding tests/ from dependency check - compat tests
 bring in old dependencies and it is not a prod code

---
 build.gradle | 61 +++++++++++++++++++++++++++++++---------------------
 1 file changed, 36 insertions(+), 25 deletions(-)

diff --git a/build.gradle b/build.gradle
index 33fea2218ad..98d31b58fe5 100644
--- a/build.gradle
+++ b/build.gradle
@@ -59,6 +59,13 @@ releaseParams { // ReleaseExtension
     }
 }
 
+def skipDepCheck = []
+allprojects {
+    if (it.path.startsWith(':tests')) {
+        skipDepCheck << it.path
+    }
+}
+
 allprojects {
     apply from: "$rootDir/dependencies.gradle"
     if (it.path != ':circe-checksum:src:main:circe'
@@ -71,33 +78,37 @@ allprojects {
         apply plugin: 'org.nosphere.apache.rat'
         apply plugin: "checkstyle"
         apply plugin: 'com.github.spotbugs'
-        apply plugin: 'org.owasp.dependencycheck'
+        
+        if (!it.path.startsWith(':tests')) {
+            apply plugin: 'org.owasp.dependencycheck'
 
-        dependencyCheck {
-            // see https://jeremylong.github.io/DependencyCheck/dependency-check-gradle/configuration.html
-            // for configuration properties
-            suppressionFile = "src/owasp-dependency-check-suppressions.xml"
-            analyzers {
-                msbuildEnabled = false
-                rubygemsEnabled = false
-                pyDistributionEnabled = false
-                pyPackageEnabled = false
-                nuspecEnabled = false
-                nugetconfEnabled = false
-                assemblyEnabled = false
-                cmakeEnabled = false
-                composerEnabled = false
-                cpanEnabled  =false
-                nodeEnabled = false
-                cocoapodsEnabled = false
-                swiftEnabled = false
-                swiftPackageResolvedEnabled = false
-                bundleAuditEnabled = false
-                golangDepEnabled = false
-                golangModEnabled = false
+            dependencyCheck {
+                // see https://jeremylong.github.io/DependencyCheck/dependency-check-gradle/configuration.html
+                // for configuration properties
+                suppressionFile = "$rootDir/src/owasp-dependency-check-suppressions.xml"
+                skipProjects = skipDepCheck
+                analyzers {
+                    msbuildEnabled = false
+                    rubygemsEnabled = false
+                    pyDistributionEnabled = false
+                    pyPackageEnabled = false
+                    nuspecEnabled = false
+                    nugetconfEnabled = false
+                    assemblyEnabled = false
+                    cmakeEnabled = false
+                    composerEnabled = false
+                    cpanEnabled = false
+                    nodeEnabled = false
+                    cocoapodsEnabled = false
+                    swiftEnabled = false
+                    swiftPackageResolvedEnabled = false
+                    bundleAuditEnabled = false
+                    golangDepEnabled = false
+                    golangModEnabled = false
 
-                nodeAudit.enabled = false
-                retirejs.enabled = false
+                    nodeAudit.enabled = false
+                    retirejs.enabled = false
+                }
             }
         }
 

From 9a737b7cbc46811a388ce06d72d10d0cddb69d61 Mon Sep 17 00:00:00 2001
From: Andrey Yegorov <andrey.yegorov@datastax.com>
Date: Mon, 24 Jan 2022 17:55:15 -0800
Subject: [PATCH 3/5] Suppress ETCD-related misdetections

---
 src/owasp-dependency-check-suppressions.xml | 45 +++++++++++++++++++++
 1 file changed, 45 insertions(+)

diff --git a/src/owasp-dependency-check-suppressions.xml b/src/owasp-dependency-check-suppressions.xml
index 7da86d44cc5..c65b18b1b2e 100644
--- a/src/owasp-dependency-check-suppressions.xml
+++ b/src/owasp-dependency-check-suppressions.xml
@@ -22,5 +22,50 @@
 <suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">
     <!-- add supressions for known vulnerabilities detected by OWASP Dependency Check -->
 
+    <!-- jetcd matched against ETCD server CVEs-->
+    <suppress>
+        <notes><![CDATA[
+       file name: jetcd-core-0.5.11.jar
+       ]]></notes>
+        <sha1>c85851ca3ea8128d480d3f75c568a37e64e8a77b</sha1>
+        <cve>CVE-2020-15106</cve>
+    </suppress>
+    <suppress>
+        <notes><![CDATA[
+       file name: jetcd-core-0.5.11.jar
+       ]]></notes>
+        <sha1>c85851ca3ea8128d480d3f75c568a37e64e8a77b</sha1>
+        <cve>CVE-2020-15112</cve>
+    </suppress>
+    <suppress>
+        <notes><![CDATA[
+       file name: jetcd-core-0.5.11.jar
+       ]]></notes>
+        <sha1>c85851ca3ea8128d480d3f75c568a37e64e8a77b</sha1>
+        <cve>CVE-2020-15113</cve>
+    </suppress>
+
+    <suppress>
+        <notes><![CDATA[
+       file name: jetcd-common-0.5.11.jar
+       ]]></notes>
+        <sha1>6dac6efe035a2be9ba299fbf31be5f903401869f</sha1>
+        <cve>CVE-2020-15106</cve>
+    </suppress>
+    <suppress>
+        <notes><![CDATA[
+       file name: jetcd-common-0.5.11.jar
+       ]]></notes>
+        <sha1>6dac6efe035a2be9ba299fbf31be5f903401869f</sha1>
+        <cve>CVE-2020-15112</cve>
+    </suppress>
+    <suppress>
+        <notes><![CDATA[
+       file name: jetcd-common-0.5.11.jar
+       ]]></notes>
+        <sha1>6dac6efe035a2be9ba299fbf31be5f903401869f</sha1>
+        <cve>CVE-2020-15113</cve>
+    </suppress>
+
 </suppressions>
 

From 82094cca65a2738451b2aa9699540643242e7aed Mon Sep 17 00:00:00 2001
From: Andrey Yegorov <andrey.yegorov@datastax.com>
Date: Tue, 25 Jan 2022 15:25:42 -0800
Subject: [PATCH 4/5] owasp: skip checkstyle config

---
 build.gradle | 1 +
 1 file changed, 1 insertion(+)

diff --git a/build.gradle b/build.gradle
index 98d31b58fe5..e5cd1474b05 100644
--- a/build.gradle
+++ b/build.gradle
@@ -87,6 +87,7 @@ allprojects {
                 // for configuration properties
                 suppressionFile = "$rootDir/src/owasp-dependency-check-suppressions.xml"
                 skipProjects = skipDepCheck
+                skipConfigurations = ["checkstyle"]
                 analyzers {
                     msbuildEnabled = false
                     rubygemsEnabled = false

From 5f1fc4b8b1736302184375a5751f07e6cc4da64e Mon Sep 17 00:00:00 2001
From: Andrey Yegorov <andrey.yegorov@datastax.com>
Date: Wed, 26 Jan 2022 09:42:23 -0800
Subject: [PATCH 5/5] Skip spotbugs

---
 build.gradle | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/build.gradle b/build.gradle
index e5cd1474b05..517ee46e938 100644
--- a/build.gradle
+++ b/build.gradle
@@ -87,7 +87,7 @@ allprojects {
                 // for configuration properties
                 suppressionFile = "$rootDir/src/owasp-dependency-check-suppressions.xml"
                 skipProjects = skipDepCheck
-                skipConfigurations = ["checkstyle"]
+                skipConfigurations = ["checkstyle", "spotbugs"]
                 analyzers {
                     msbuildEnabled = false
                     rubygemsEnabled = false