Comments (11)
I hope this helps. Thanks for working on this library!
Exceptions
I had similar issues with monger
library. The exception seems to be caused by guava library version 18.0. In monger's case guava comes from clojurewerkz/support
:
$ lein deps :tree
...
[com.novemberain/monger "3.5.0"]
[clojurewerkz/support "1.1.0"]
[com.google.guava/guava "18.0"]
...
The exception can be avoided by using the latest support library version as it uses a different version of guava:
- [com.novemberain/monger "3.5.0"]
+ [com.novemberain/monger "3.5.0" :exclusions [clojurewerkz/support]]
+ [clojurewerkz/support "1.5.0"] ;this overrides the problematic monger dependency
After the change:
$ lein deps :tree
...
[clojurewerkz/support "1.5.0"]
[com.google.guava/guava "21.0"]
...
I stopped here and didn't look further on why older guava version causes the exceptions.
Elastisch
@Juholei clojurewerkz/elastisch
also uses the support library but it actually excludes the guava dependency for it already. The guava (version 18) dependency comes from org.elasticsearch/elasticsearch
. This old guava version might be the issue for you also.
Even latest elastisch seems to use an old version of elasticsearch. Might be worth a try to override it or guava.
from nvd-clojure.
Can you create a dummy project.clj
which has the same dependencies as your project so we can try and reproduce this issue?
from nvd-clojure.
Also, do you have any extra nvd config flags set in either your user profile or project.clj
?
from nvd-clojure.
There isn't any configuration done. In a fresh project with the same dependencies it seems to end up in the same error as in #33. I figured out that I'd start stripping away some dependencies to see if it is some of them causing it and it seems now if I remove [clojurewerkz/elastisch "2.2.2"] from the dependencies, the analysis succeeds.
project.clj containing only this
(defproject dummy-project "1.0.0"
:dependencies [[clojurewerkz/elastisch "2.2.2"]]
:plugins [[lein-nvd "1.0.0"]])
ends with the error
Exception in thread "main" org.owasp.dependencycheck.exception.ExceptionCollection: One or more exceptions occurred during dependency-check analysis
Unexpected Exception, compiling:(/private/var/folders/zs/xwx9c01d2nd_40fjjk9f_b4c0000gp/T/form-init824973952916588961.clj:1:124)
at clojure.lang.Compiler.load(Compiler.java:7239)
at clojure.lang.Compiler.loadFile(Compiler.java:7165)
at clojure.main$load_script.invoke(main.clj:275)
at clojure.main$init_opt.invoke(main.clj:280)
at clojure.main$initialize.invoke(main.clj:308)
at clojure.main$null_opt.invoke(main.clj:343)
at clojure.main$main.doInvoke(main.clj:421)
at clojure.lang.RestFn.invoke(RestFn.java:421)
at clojure.lang.Var.invoke(Var.java:383)
at clojure.lang.AFn.applyToHelper(AFn.java:156)
at clojure.lang.Var.applyTo(Var.java:700)
at clojure.main.main(main.java:37)
Caused by: org.owasp.dependencycheck.exception.ExceptionCollection: One or more exceptions occurred during dependency-check analysis
Unexpected Exception
at org.owasp.dependencycheck.Engine.analyzeDependencies(Engine.java:693)
at nvd.task.check$scan_and_analyze.invoke(check.clj:43)
at nvd.task.check$_main.invoke(check.clj:54)
at user$eval516.invoke(form-init824973952916588961.clj:1)
at clojure.lang.Compiler.eval(Compiler.java:6782)
at clojure.lang.Compiler.eval(Compiler.java:6772)
at clojure.lang.Compiler.load(Compiler.java:7227)
... 11 more
from nvd-clojure.
Thanks for the reproducible test case ... I will investigate further
from nvd-clojure.
Experiencing this one as well, it's frustrating that no useful info is printed.
@rm-hull: I would suggest that you specifically catch ExceptionCollection
, accessing its getExceptions() method, so each of the actual exceptions get printed.
You could compose those into an ex-info
's data and throw that.
from nvd-clojure.
I would suggest that you specifically catch ExceptionCollection, accessing its getExceptions() method, so each of the actual exceptions get printed.
Any luck with this? I could contribute a PR.
from nvd-clojure.
Happy to accept PRs - Im not going to be able to look at this until late August - on vacation at the moment
from nvd-clojure.
Note that #42 was merged as 1.3.0, so if this issue is still valid, it can be reproduced far more cleanly now.
from nvd-clojure.
This doesn't seem to happen anymore on 1.3.1.
from nvd-clojure.
[closing as per @Juholei's last comment]
Please re-open if you affected by this
from nvd-clojure.
Related Issues (20)
- Using nvd-clojure for JS dependencies, too HOT 2
- Add JDK 17 to the CI matrix
- Output a sarif file HOT 4
- CVE-2021-43138 and org.clojure/core.async HOT 3
- nvd-clojure incorrectly flags core.async with a CVE HOT 1
- Running from Clojure CLI gives java.lang.NoSuchMethodError HOT 4
- Issue template (or form)
- 2.6.0 release HOT 2
- Continuation of discussion from issue #142... HOT 2
- lein - Could not find artifact HOT 1
- Easier template/setup HOT 1
- Error for all users due to insufficient column width in the database HOT 6
- Does not work on Windows HOT 4
- Option to only fill the DB without analysing
- Update `dependency-check` library support to version 9.0.x HOT 3
- `NVD_API_TOKEN` environment variable does not work HOT 12
- CVE-2017-20189 is reported for projects that depend on clojure 1.9+ HOT 4
- Make NVD API key optional HOT 3
- Add support for multiple nvd suppression files HOT 1
- Scan failing after 6 hours HOT 15
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from nvd-clojure.