OWASP Dependency-Check使用教程#

软件介绍#

OWASP Dependency-Check是一款软件组成分析（SCA）工具，用于识别项目依赖项中的已知漏洞。它扫描应用程序的依赖项，并与国家漏洞数据库（NVD）等漏洞数据库进行比对，生成包含漏洞信息的报告。

主要功能#

  • 依赖项漏洞扫描
  • 多种包管理器支持
  • 漏洞数据库查询
  • 风险评估和评分
  • 多种报告格式
  • CI/CD集成
  • 自定义规则配置
  • 增量扫描

适用场景#

  • 软件供应链安全
  • 依赖项安全审计
  • 漏洞风险评估
  • 合规性检查
  • CI/CD安全集成
  • 安全开发流程

入门级使用#

安装Dependency-Check#

使用包管理器安装#

# 使用Homebrew安装（macOS）
brew install dependency-check

# 使用Chocolatey安装（Windows）
choco install dependency-check

# 使用APT安装（Ubuntu/Debian）
sudo apt-get install dependency-check

使用Docker安装#

# 使用Docker运行
docker run --rm -v $(pwd):/src owasp/dependency-check:latest --scan /src

# 或下载独立版本
wget https://github.com/jeremylong/DependencyCheck/releases/download/v8.4.0/dependency-check-8.4.0-release.zip
unzip dependency-check-8.4.0-release.zip
cd dependency-check-8.4.0

使用Homebrew安装（推荐）#

# 安装Homebrew（如果未安装）
/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"

# 安装Dependency-Check
brew install dependency-check

# 验证安装
dependency-check --version

基本扫描#

扫描Java项目#

# 扫描Maven项目
dependency-check --scan ./target --out ./reports

# 扫描Gradle项目
dependency-check --scan ./build --out ./reports

# 扫描特定JAR文件
dependency-check --scan ./lib/myapp.jar --out ./reports

扫描Node.js项目#

# 扫描package.json
dependency-check --scan ./package.json --out ./reports

# 扫描node_modules目录
dependency-check --scan ./node_modules --out ./reports

# 扫描yarn.lock
dependency-check --scan ./yarn.lock --out ./reports

扫描Python项目#

# 扫描requirements.txt
dependency-check --scan ./requirements.txt --out ./reports

# 扫描Pipfile
dependency-check --scan ./Pipfile --out ./reports

# 扫描setup.py
dependency-check --scan ./setup.py --out ./reports

初级使用#

扫描不同类型的项目#

扫描.NET项目#

# 扫描.csproj文件
dependency-check --scan ./MyProject.csproj --out ./reports

# 扫描packages.config
dependency-check --scan ./packages.config --out ./reports

# 扫描bin目录
dependency-check --scan ./bin --out ./reports

扫描Ruby项目#

# 扫描Gemfile
dependency-check --scan ./Gemfile --out ./reports

# 扫描Gemfile.lock
dependency-check --scan ./Gemfile.lock --out ./reports

扫描Go项目#

# 扫描go.mod
dependency-check --scan ./go.mod --out ./reports

# 扫描go.sum
dependency-check --scan ./go.sum --out ./reports

报告格式#

生成HTML报告#

# 生成HTML报告（默认）
dependency-check --scan ./target --out ./reports --format HTML

# 指定报告文件名
dependency-check --scan ./target --out ./reports/dependency-check-report.html

生成XML报告#

# 生成XML报告
dependency-check --scan ./target --out ./reports --format XML

# 用于CI/CD集成
dependency-check --scan ./target --out ./reports/dependency-check-report.xml --format XML

生成JSON报告#

# 生成JSON报告
dependency-check --scan ./target --out ./reports --format JSON

# 用于自动化处理
dependency-check --scan ./target --out ./reports/dependency-check-report.json --format JSON

生成CSV报告#

# 生成CSV报告
dependency-check --scan ./target --out ./reports --format CSV

# 用于数据分析
dependency-check --scan ./target --out ./reports/dependency-check-report.csv --format CSV

中级使用#

高级扫描选项#

排除特定依赖#

# 排除特定文件
dependency-check --scan ./target --out ./reports --exclude "test-*.jar"

# 排除特定目录
dependency-check --scan ./target --out ./reports --exclude "*/test/*"

# 使用正则表达式排除
dependency-check --scan ./target --out ./reports --exclude ".*-test\\.jar"

指定扫描深度#

# 递归扫描
dependency-check --scan ./target --out ./reports --recursive

# 限制扫描深度
dependency-check --scan ./target --out ./reports --depth 3

# 不递归扫描
dependency-check --scan ./target --out ./reports --no-recursive

配置数据缓存#

# 使用本地缓存
dependency-check --scan ./target --out ./reports --data /path/to/cache

# 更新缓存
dependency-check --updateOnly

# 指定缓存目录
dependency-check --scan ./target --out ./reports --cache ./cache

自定义配置#

使用配置文件#

# 创建配置文件
cat > dependency-check-config.properties << EOF
# Dependency-Check配置文件

# 扫描目录
scan.path=./target

# 输出目录
out.path=./reports

# 报告格式
format=HTML,XML

# 排除模式
exclude=.*-test\\.jar

# 递归扫描
recursive=true

# 缓存目录
cache=./cache

# 数据目录
data=./data

EOF

# 使用配置文件
dependency-check --config dependency-check-config.properties

自定义漏洞数据库#

# 使用自定义NVD数据库
dependency-check --scan ./target --out ./reports --nvd /path/to/nvd

# 使用自定义漏洞数据库
dependency-check --scan ./target --out ./reports --suppression /path/to/suppressions.xml

# 禁用特定数据库
dependency-check --scan ./target --out ./reports --disableExperimental

中上级使用#

CI/CD集成#

Jenkins集成#

// Jenkinsfile示例
pipeline {
    agent any
    
    stages {
        stage('Dependency Check') {
            steps {
                script {
                    // 运行Dependency-Check
                    sh 'dependency-check --scan ./target --out ./reports --format XML'
                    
                    // 解析结果
                    dependencyCheckPublisher(
                        pattern: 'reports/dependency-check-report.xml',
                        failedTotalHigh: 0,
                        failedTotalMedium: 10
                    )
                }
            }
        }
    }
    
    post {
        always {
            // 归档报告
            archiveArtifacts artifacts: 'reports/**/*', fingerprint: true
        }
    }
}

GitHub Actions集成#

# .github/workflows/dependency-check.yml
name: Dependency Check

on:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]
  schedule:
    - cron: '0 0 * * 0'  # 每周运行一次

jobs:
  dependency-check:
    runs-on: ubuntu-latest
    
    steps:
    - uses: actions/checkout@v2
    
    - name: Run Dependency Check
      uses: dependency-check/Dependency-Check_Action@main
      with:
        project: 'my-project'
        path: '.'
        format: 'HTML'
        out: 'reports'
    
    - name: Upload Dependency Check Report
      uses: actions/upload-artifact@v2
      with:
        name: dependency-check-report
        path: reports/

GitLab CI集成#

# .gitlab-ci.yml
stages:
  - dependency-check

dependency-check:
  stage: dependency-check
  image: owasp/dependency-check:latest
  script:
    - dependency-check --scan . --out ./reports --format XML
  artifacts:
    paths:
      - reports/
    expire_in: 1 week
  allow_failure: true

自动化脚本#

批量扫描多个项目#

#!/bin/bash
# 批量扫描多个项目脚本

PROJECTS_DIR="/path/to/projects"
REPORTS_DIR="./reports"
mkdir -p "$REPORTS_DIR"

# 遍历所有项目
for project in "$PROJECTS_DIR"/*/; do
    project_name=$(basename "$project")
    echo "扫描项目: $project_name"
    
    # 运行扫描
    dependency-check --scan "$project" --out "$REPORTS_DIR/$project_name" --format HTML,XML
    
    # 检查是否有高危漏洞
    if grep -q "HIGH" "$REPORTS_DIR/$project_name/dependency-check-report.xml"; then
        echo "警告: $project_name 发现高危漏洞"
    fi
done

echo "批量扫描完成"

定期扫描脚本#

#!/bin/bash
# 定期扫描脚本

PROJECT_DIR="/path/to/project"
REPORTS_DIR="./reports"
LOG_FILE="./dependency-check.log"

# 记录日志
log() {
    echo "$(date '+%Y-%m-%d %H:%M:%S') - $1" >> "$LOG_FILE"
}

# 更新漏洞数据库
log "更新漏洞数据库"
dependency-check --updateOnly

# 运行扫描
log "开始扫描项目"
dependency-check --scan "$PROJECT_DIR" --out "$REPORTS_DIR" --format HTML,XML

# 检查扫描结果
if [ $? -eq 0 ]; then
    log "扫描成功完成"
else
    log "扫描失败，退出码: $?"
fi

# 发送通知（如果有漏洞）
if grep -q "HIGH" "$REPORTS_DIR/dependency-check-report.xml"; then
    log "发现高危漏洞，发送通知"
    # 这里可以添加邮件或Slack通知
fi

log "扫描流程结束"

高级使用#

风险评估#

漏洞严重性分析#

#!/usr/bin/env python3
import xml.etree.ElementTree as ET
import json

def analyze_vulnerabilities(xml_file):
    """分析漏洞严重性"""
    
    tree = ET.parse(xml_file)
    root = tree.getroot()
    
    vulnerabilities = {
        "critical": [],
        "high": [],
        "medium": [],
        "low": [],
        "info": []
    }
    
    for dependency in root.findall(".//dependency"):
        for vuln in dependency.findall(".//vulnerability"):
            severity = vuln.get("severity", "UNKNOWN")
            name = dependency.get("filename")
            
            if severity == "CRITICAL":
                vulnerabilities["critical"].append(name)
            elif severity == "HIGH":
                vulnerabilities["high"].append(name)
            elif severity == "MEDIUM":
                vulnerabilities["medium"].append(name)
            elif severity == "LOW":
                vulnerabilities["low"].append(name)
            else:
                vulnerabilities["info"].append(name)
    
    return vulnerabilities

# 使用示例
vulns = analyze_vulnerabilities("reports/dependency-check-report.xml")
print(json.dumps(vulns, indent=2))

CVSS评分分析#

#!/usr/bin/env python3
import xml.etree.ElementTree as ET
from collections import defaultdict

def analyze_cvss_scores(xml_file):
    """分析CVSS评分"""
    
    tree = ET.parse(xml_file)
    root = tree.getroot()
    
    cvss_scores = defaultdict(list)
    
    for dependency in root.findall(".//dependency"):
        for vuln in dependency.findall(".//vulnerability"):
            cvss = vuln.find(".//cvssScore")
            if cvss is not None:
                score = float(cvss.text)
                name = dependency.get("filename")
                cvss_scores[name].append(score)
    
    # 计算平均CVSS评分
    avg_scores = {}
    for name, scores in cvss_scores.items():
        avg_scores[name] = sum(scores) / len(scores)
    
    return avg_scores

# 使用示例
scores = analyze_cvss_scores("reports/dependency-check-report.xml")
for name, score in sorted(scores.items(), key=lambda x: x[1], reverse=True):
    print(f"{name}: {score:.2f}")

自定义规则#

创建抑制规则#

<?xml version="1.0" encoding="UTF-8"?>
<suppressions>
    <!-- 抑制特定CVE -->
    <suppress>
        <notes><![CDATA[
            假阳性：该CVE不适用于我们的使用场景
        ]]></notes>
        <cve>CVE-2021-12345</cve>
    </suppress>
    
    <!-- 抑制特定依赖 -->
    <suppress>
        <notes><![CDATA[
            内部依赖，不对外暴露
        ]]></notes>
        <packageUrl regex="true">^pkg:maven/com\.mycompany/.*@.*$</packageUrl>
    </suppress>
    
    <!-- 抑制特定文件 -->
    <suppress>
        <notes><![CDATA[
            测试依赖，不用于生产
        ]]></notes>
        <filePath regex="true">.*/test/.*</filePath>
    </suppress>
    
    <!-- 抑制低严重性漏洞 -->
    <suppress>
        <notes><![CDATA[
            低严重性漏洞，已计划修复
        ]]></notes>
        <severity>LOW</severity>
    </suppress>
</suppressions>

使用抑制规则#

# 使用抑制规则文件
dependency-check --scan ./target --out ./reports \
    --suppression suppressions.xml

# 多个抑制规则文件
dependency-check --scan ./target --out ./reports \
    --suppression suppressions1.xml \
    --suppression suppressions2.xml

大师级使用#

企业级部署#

集中式扫描服务#

#!/bin/bash
# 集中式扫描服务脚本

SCAN_QUEUE="/path/to/scan_queue"
SCAN_RESULTS="/path/to/scan_results"
LOG_FILE="/var/log/dependency-check-service.log"

# 初始化队列
mkdir -p "$SCAN_QUEUE" "$SCAN_RESULTS"

# 扫描函数
scan_project() {
    local project_path=$1
    local project_name=$(basename "$project_path")
    local result_dir="$SCAN_RESULTS/$project_name"
    
    echo "$(date): 开始扫描 $project_name" >> "$LOG_FILE"
    
    # 创建结果目录
    mkdir -p "$result_dir"
    
    # 运行扫描
    dependency-check --scan "$project_path" --out "$result_dir" \
        --format HTML,XML,JSON
    
    # 记录结果
    if [ $? -eq 0 ]; then
        echo "$(date): $project_name 扫描成功" >> "$LOG_FILE"
    else
        echo "$(date): $project_name 扫描失败" >> "$LOG_FILE"
    fi
}

# 监控队列
while true; do
    for project in "$SCAN_QUEUE"/*; do
        if [ -f "$project" ]; then
            project_path=$(cat "$project")
            scan_project "$project_path"
            
            # 移除已处理的任务
            rm "$project"
        fi
    done
    
    sleep 60  # 每分钟检查一次
done

分布式扫描#

#!/usr/bin/env python3
import subprocess
import multiprocessing
import os

def scan_project(project_path, output_dir):
    """扫描单个项目"""
    cmd = [
        "dependency-check",
        "--scan", project_path,
        "--out", output_dir,
        "--format", "XML"
    ]
    
    result = subprocess.run(cmd, capture_output=True, text=True)
    return result.returncode, result.stdout, result.stderr

def distributed_scan(projects, output_base_dir, workers=4):
    """分布式扫描"""
    
    os.makedirs(output_base_dir, exist_ok=True)
    
    # 创建进程池
    with multiprocessing.Pool(workers) as pool:
        results = []
        
        for project in projects:
            project_name = os.path.basename(project)
            output_dir = os.path.join(output_base_dir, project_name)
            
            result = pool.apply_async(scan_project, (project, output_dir))
            results.append(result)
        
        # 等待所有任务完成
        for result in results:
            returncode, stdout, stderr = result.get()
            
            if returncode != 0:
                print(f"扫描失败: {stderr}")
            else:
                print(f"扫描成功: {stdout}")

# 使用示例
projects = [
    "/path/to/project1",
    "/path/to/project2",
    "/path/to/project3"
]

distributed_scan(projects, "./scan_results", workers=4)

高级分析#

依赖关系分析#

#!/usr/bin/env python3
import xml.etree.ElementTree as ET
import networkx as nx
import matplotlib.pyplot as plt

def build_dependency_graph(xml_file):
    """构建依赖关系图"""
    
    tree = ET.parse(xml_file)
    root = tree.getroot()
    
    G = nx.DiGraph()
    
    for dependency in root.findall(".//dependency"):
        name = dependency.get("filename")
        
        # 添加节点
        G.add_node(name)
        
        # 添加依赖关系
        for child in dependency.findall(".//dependency"):
            child_name = child.get("filename")
            G.add_edge(name, child_name)
    
    return G

def visualize_graph(G, output_file="dependency_graph.png"):
    """可视化依赖关系图"""
    
    plt.figure(figsize=(12, 8))
    pos = nx.spring_layout(G)
    
    nx.draw(G, pos, with_labels=True, node_size=3000,
            node_color='lightblue', font_size=8)
    
    plt.savefig(output_file, dpi=300, bbox_inches='tight')
    plt.close()

# 使用示例
G = build_dependency_graph("reports/dependency-check-report.xml")
visualize_graph(G, "dependency_graph.png")

趋势分析#

#!/usr/bin/env python3
import xml.etree.ElementTree as ET
import json
from datetime import datetime
import matplotlib.pyplot as plt

def extract_vulnerability_data(xml_file):
    """提取漏洞数据"""
    
    tree = ET.parse(xml_file)
    root = tree.getroot()
    
    data = {
        "timestamp": datetime.now().isoformat(),
        "total": 0,
        "critical": 0,
        "high": 0,
        "medium": 0,
        "low": 0
    }
    
    for dependency in root.findall(".//dependency"):
        for vuln in dependency.findall(".//vulnerability"):
            severity = vuln.get("severity", "UNKNOWN")
            data["total"] += 1
            
            if severity == "CRITICAL":
                data["critical"] += 1
            elif severity == "HIGH":
                data["high"] += 1
            elif severity == "MEDIUM":
                data["medium"] += 1
            elif severity == "LOW":
                data["low"] += 1
    
    return data

def analyze_trend(data_files):
    """分析漏洞趋势"""
    
    trend_data = []
    
    for file in data_files:
        data = extract_vulnerability_data(file)
        trend_data.append(data)
    
    # 绘制趋势图
    timestamps = [d["timestamp"] for d in trend_data]
    critical = [d["critical"] for d in trend_data]
    high = [d["high"] for d in trend_data]
    medium = [d["medium"] for d in trend_data]
    
    plt.figure(figsize=(12, 6))
    plt.plot(timestamps, critical, label='Critical', color='red')
    plt.plot(timestamps, high, label='High', color='orange')
    plt.plot(timestamps, medium, label='Medium', color='yellow')
    
    plt.xlabel('Time')
    plt.ylabel('Vulnerability Count')
    plt.title('Vulnerability Trend')
    plt.legend()
    plt.xticks(rotation=45)
    plt.tight_layout()
    
    plt.savefig('vulnerability_trend.png', dpi=300)
    plt.close()

# 使用示例
data_files = [
    "reports/scan1.xml",
    "reports/scan2.xml",
    "reports/scan3.xml"
]

analyze_trend(data_files)

实战案例#

案例1: Java项目安全审计#

场景描述#

对Java项目进行全面的安全审计，识别依赖项中的已知漏洞。

实施步骤#

#!/bin/bash
# Java项目安全审计脚本

PROJECT_DIR="/path/to/java-project"
REPORTS_DIR="./reports"
mkdir -p "$REPORTS_DIR"

echo "=== Java项目安全审计 ==="
echo "项目目录: $PROJECT_DIR"
echo "报告目录: $REPORTS_DIR"

# 1. 扫描Maven依赖
echo "[1/4] 扫描Maven依赖..."
dependency-check --scan "$PROJECT_DIR/target" \
    --out "$REPORTS_DIR/maven" \
    --format HTML,XML,JSON \
    --project "Maven Dependencies"

# 2. 扫描Gradle依赖
echo "[2/4] 扫描Gradle依赖..."
dependency-check --scan "$PROJECT_DIR/build" \
    --out "$REPORTS_DIR/gradle" \
    --format HTML,XML,JSON \
    --project "Gradle Dependencies"

# 3. 扫描第三方库
echo "[3/4] 扫描第三方库..."
dependency-check --scan "$PROJECT_DIR/lib" \
    --out "$REPORTS_DIR/third-party" \
    --format HTML,XML,JSON \
    --project "Third-party Libraries"

# 4. 生成综合报告
echo "[4/4] 生成综合报告..."

cat > "$REPORTS_DIR/audit_summary.txt" << EOF
Java项目安全审计报告
====================
审计时间: $(date)

项目信息:
- Maven依赖: $(jq '.dependencies | length' "$REPORTS_DIR/maven/dependency-check-report.json")
- Gradle依赖: $(jq '.dependencies | length' "$REPORTS_DIR/gradle/dependency-check-report.json")
- 第三方库: $(jq '.dependencies | length' "$REPORTS_DIR/third-party/dependency-check-report.json")

漏洞统计:
- Critical: $(grep -c "CRITICAL" "$REPORTS_DIR/maven/dependency-check-report.xml")
- High: $(grep -c "HIGH" "$REPORTS_DIR/maven/dependency-check-report.xml")
- Medium: $(grep -c "MEDIUM" "$REPORTS_DIR/maven/dependency-check-report.xml")
- Low: $(grep -c "LOW" "$REPORTS_DIR/maven/dependency-check-report.xml")

详细报告:
- Maven: $REPORTS_DIR/maven/dependency-check-report.html
- Gradle: $REPORTS_DIR/gradle/dependency-check-report.html
- Third-party: $REPORTS_DIR/third-party/dependency-check-report.html
EOF

echo ""
echo "Java项目安全审计完成！"
echo "综合报告: $REPORTS_DIR/audit_summary.txt"

案例2: 持续集成安全检查#

场景描述#

在CI/CD流程中集成依赖项安全检查，确保每次构建都经过安全审计。

实施步骤#

#!/bin/bash
# CI/CD安全检查脚本

set -e  # 遇到错误立即退出

PROJECT_DIR="${1:-.}"
REPORTS_DIR="./reports"
MAX_CRITICAL=0
MAX_HIGH=5
MAX_MEDIUM=20

echo "=== CI/CD依赖项安全检查 ==="
echo "项目目录: $PROJECT_DIR"
echo "报告目录: $REPORTS_DIR"

# 创建报告目录
mkdir -p "$REPORTS_DIR"

# 运行扫描
echo "开始扫描..."
dependency-check --scan "$PROJECT_DIR" \
    --out "$REPORTS_DIR" \
    --format XML,JSON \
    --project "CI/CD Scan"

# 分析结果
echo "分析扫描结果..."

CRITICAL_COUNT=$(grep -c "CRITICAL" "$REPORTS_DIR/dependency-check-report.xml" || echo 0)
HIGH_COUNT=$(grep -c "HIGH" "$REPORTS_DIR/dependency-check-report.xml" || echo 0)
MEDIUM_COUNT=$(grep -c "MEDIUM" "$REPORTS_DIR/dependency-check-report.xml" || echo 0)

echo "漏洞统计:"
echo "  Critical: $CRITICAL_COUNT"
echo "  High: $HIGH_COUNT"
echo "  Medium: $MEDIUM_COUNT"

# 检查阈值
if [ "$CRITICAL_COUNT" -gt "$MAX_CRITICAL" ]; then
    echo "错误: Critical漏洞数量 ($CRITICAL_COUNT) 超过阈值 ($MAX_CRITICAL)"
    exit 1
fi

if [ "$HIGH_COUNT" -gt "$MAX_HIGH" ]; then
    echo "警告: High漏洞数量 ($HIGH_COUNT) 超过阈值 ($MAX_HIGH)"
    # 可以选择继续或退出
    # exit 1
fi

if [ "$MEDIUM_COUNT" -gt "$MAX_MEDIUM" ]; then
    echo "警告: Medium漏洞数量 ($MEDIUM_COUNT) 超过阈值 ($MAX_MEDIUM)"
fi

echo "安全检查通过！"
exit 0

案例3: 企业级依赖项管理#

场景描述#

建立企业级的依赖项管理系统，统一管理所有项目的依赖项安全。

实施步骤#

#!/bin/bash
# 企业级依赖项管理脚本

PROJECTS_DIR="/path/to/projects"
CENTRAL_DB="/path/to/central-db"
REPORTS_DIR="/path/to/reports"
LOG_FILE="/var/log/dependency-management.log"

# 初始化
mkdir -p "$CENTRAL_DB" "$REPORTS_DIR"

log() {
    echo "$(date '+%Y-%m-%d %H:%M:%S') - $1" >> "$LOG_FILE"
}

# 扫描所有项目
scan_all_projects() {
    log "开始扫描所有项目"
    
    for project in "$PROJECTS_DIR"/*/; do
        project_name=$(basename "$project")
        log "扫描项目: $project_name"
        
        # 运行扫描
        dependency-check --scan "$project" \
            --out "$REPORTS_DIR/$project_name" \
            --format JSON
        
        # 提取依赖项信息
        jq '.dependencies[] | {
            filename: .filename,
            sha256: .sha256,
            vulnerabilities: [.vulnerabilities[] | {
                name: .name,
                severity: .severity,
                cvssScore: .cvssScore
            }]
        }' "$REPORTS_DIR/$project_name/dependency-check-report.json" > \
            "$CENTRAL_DB/${project_name}.json"
    done
    
    log "所有项目扫描完成"
}

# 生成企业报告
generate_enterprise_report() {
    log "生成企业报告"
    
    cat > "$REPORTS_DIR/enterprise_report.html" << EOF
<!DOCTYPE html>
<html>
<head>
    <title>企业依赖项安全报告</title>
    <style>
        body { font-family: Arial, sans-serif; margin: 20px; }
        h1 { color: #333; }
        h2 { color: #666; }
        table { border-collapse: collapse; width: 100%; }
        th, td { border: 1px solid #ddd; padding: 8px; text-align: left; }
        th { background-color: #f2f2f2; }
        .critical { color: red; }
        .high { color: orange; }
        .medium { color: yellow; }
        .low { color: green; }
    </style>
</head>
<body>
    <h1>企业依赖项安全报告</h1>
    <p>生成时间: $(date)</p>
    
    <h2>项目概览</h2>
    <table>
        <tr>
            <th>项目名称</th>
            <th>依赖项数量</th>
            <th>Critical</th>
            <th>High</th>
            <th>Medium</th>
            <th>Low</th>
        </tr>
EOF

    # 添加项目数据
    for db_file in "$CENTRAL_DB"/*.json; do
        project_name=$(basename "$db_file" .json)
        
        critical=$(jq '[.[] | .vulnerabilities[] | select(.severity == "CRITICAL")] | length' "$db_file")
        high=$(jq '[.[] | .vulnerabilities[] | select(.severity == "HIGH")] | length' "$db_file")
        medium=$(jq '[.[] | .vulnerabilities[] | select(.severity == "MEDIUM")] | length' "$db_file")
        low=$(jq '[.[] | .vulnerabilities[] | select(.severity == "LOW")] | length' "$db_file")
        total=$(jq 'length' "$db_file")
        
        cat >> "$REPORTS_DIR/enterprise_report.html" << EOF
        <tr>
            <td>$project_name</td>
            <td>$total</td>
            <td class="critical">$critical</td>
            <td class="high">$high</td>
            <td class="medium">$medium</td>
            <td class="low">$low</td>
        </tr>
EOF
    done

    cat >> "$REPORTS_DIR/enterprise_report.html" << EOF
    </table>
</body>
</html>
EOF

    log "企业报告生成完成"
}

# 主流程
scan_all_projects
generate_enterprise_report

log "依赖项管理流程完成"

总结#

OWASP Dependency-Check是一款功能强大的软件组成分析工具，为供应链安全提供了全面的支持。

核心优势#

  • 全面覆盖: 支持多种包管理器和编程语言
  • 自动化: 自动识别和扫描依赖项
  • 漏洞数据库: 使用NVD等权威漏洞数据库
  • 报告丰富: 支持多种报告格式
  • 易于集成: 可轻松集成到CI/CD流程

应用场景#

  • 软件供应链安全审计
  • 依赖项漏洞检测
  • CI/CD安全集成
  • 合规性检查
  • 风险评估

最佳实践#

  1. 定期扫描: 建立定期扫描机制，及时发现新漏洞
  2. CI/CD集成: 将扫描集成到构建流程，确保代码质量
  3. 阈值管理: 设置合理的漏洞阈值，平衡安全和开发效率
  4. 抑制规则: 使用抑制规则管理假阳性
  5. 持续监控: 建立持续监控机制，跟踪漏洞修复进度

注意事项#

  • 扫描可能会消耗较多时间和资源
  • 需要定期更新漏洞数据库
  • 某些依赖项可能无法识别
  • 需要结合人工审查，避免误报
  • 注意许可证和合规性要求
Backward 供应链情报收集 Snyk使用教程 Forward
Linux邪修 - © 2024 Linux邪修