java Sonarqube正在进行核心漏洞查找。如何解决

Question

Sonarqube正在寻找核心漏洞。如何解决

   "textRange": {
      "startLine": 1,
      "endLine": 1,
      "startOffset": 0,
      "endOffset": 38
    },
    "flows": [],
    "status": "OPEN",
    "message": "Filename: test-0.0.1-SNAPSHOT.jar: undertow-core-2.0.29.Final.jar 
| Reference: CVE-2020-1745 | CVSS Score: 9.8 | Category: CWE-200 | A file inclusion 
vulnerability was found 
in the AJP connector enabled with a default AJP configuration port of 8009 in 
Undertow version 2.0.29.Final and before and was fixed in 2.0.30.Final. A remote, 
unauthenticated attacker could exploit this vulnerability to read web application files 
from a vulnerable server. In instances where the vulnerable server allows file uploads, 
an attacker could upload malicious JavaServer Pages (JSP) code within a variety of file 
types and trigger this vulnerability to gain remote code execution.",

pom上没有底拖，因为它是另一个依赖项（spring boot starter Undertow，已更新为2.3.3.RELEASE的最新版本）的子项。有没有办法让spring boot starter有一个特定版本的undertow

[INFO] +- org.springframework.boot:spring-boot-starter-undertow:jar:2.3.3.RELEASE:compile
[INFO] |  +- io.undertow:undertow-core:jar:2.0.29.Final:compile
[INFO] |  |  +- org.jboss.xnio:xnio-api:jar:3.3.8.Final:compile
[INFO] |  |  \- org.jboss.xnio:xnio-nio:jar:3.3.8.Final:runtime

[INFO] |  +- io.undertow:undertow-servlet:jar:2.0.29.Final:compile
[INFO] |  +- io.undertow:undertow-websockets-jsr:jar:2.0.29.Final:compile
[INFO] |  |  \- org.jboss.spec.javax.websocket:jboss-websocket-api_1.1_spec:jar:1.1.4.Final:compile
[INFO] |  +- jakarta.servlet:jakarta.servlet-api:jar:4.0.3:compile
[INFO] |  \- org.glassfish:jakarta.el:jar:3.0.3:compile

Answer 1

如果你需要一个特定版本的Undertow，只需将其包含在pom中即可。xml:

<dependency>
  <groupId>io.undertow</groupId>
  <artifactId>undertow-core</artifactId>
  <version>2.0.30.Final</version>
</dependency>

通过这样做，您将覆盖通过其他依赖项（包括Spring）可能获得的任何其他版本

如果您需要的版本已经包含在其他一些包的依赖项中，并且您希望Spring使用该版本（而不是手动覆盖pom中的每个底层依赖项），那么您可以尝试exclude仅使用初学者提供的版本：

<dependency>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-actuator</artifactId>
    <version>2.3.3.RELEASE</version> <!  already includes undertow 2.0.30  >
</dependency>
<dependency>
  <groupId>org.springframework.boot</groupId>
  <artifactId>spring-boot-starter-undertow</artifactId>
  <version>2.3.3.RELEASE</version>
  <exclusions>
    <exclusion>
      <groupId>io.undertow</groupId>
      <artifactId>undertow-core</artifactId>
    </exclusion>
  </exclusions>
</dependency>

如果您执行上述操作，Spring将选择Spring boot actuator提供的下拖核心版本，而不是Spring boot starter下拖提供的版本