Security hardening about echosvg HOT 4 OPEN

The last two points of this issue were done in e92d319 (shipped in version 0.3).

from echosvg.

KeenWrite uses SpotBugs and OWASP, which may also prove useful for EchoSVG.

buildscript {
  repositories {
    mavenCentral()
    maven {
      url "https://plugins.gradle.org/m2/"
    }
  }
  dependencies {
    classpath 'org.owasp:dependency-check-gradle:8.2.1'
    classpath "com.github.spotbugs.snom:spotbugs-gradle-plugin:5.0.14"
  }
}

plugins {
  // ...
  id "com.github.spotbugs" version "5.0.14"
}

spotbugs {
  excludeFilter.set(
      file("${projectDir}/bug-filter.xml")
  )
}

apply plugin: 'org.owasp.dependencycheck'

This allows the build to fail for any issues raised by SpotBugs. Tweaking the bug-filter.xml file provides fine-grained control over what issues to ignore.

<?xml version="1.0" encoding="UTF-8"?>
<FindBugsFilter>
  <Match>
    <Or>
      <Bug code="EI, EI2" />
    </Or>
  </Match>

  <Match class="com.keenwrite.preview.HighQualityRenderingHints">
    <Method name="initializeRenderingHints" />
    <Bug code="WMI" />
  </Match>

  <Match class="com.keenwrite.processors.HtmlPreviewProcessor">
    <Method name="&lt;init&gt;" />
    <Bug code="ST" />
  </Match>
</FindBugsFilter>

from echosvg.

Thanks for the suggestion, Dave: I just committed the support for the org.owasp.dependencycheck plugin (although @dependabot already provides much of that functionality). However I don't think that I'll do the same with the SpotBugs plugin because it adds a maintenance burden (even for people that may contribute PRs in the future).

I run SpotBugs from the Eclipse IDE and already fixed a number of the issues found by it, but there are still several non-security issues that SpotBugs is reporting. Given that this project already runs a CodeQL scan for every commit (apart from periodic runs), I don't think that adding a SpotBugs task would be worth the effort.

from echosvg.

I can't close tickets; feel free to close.

This is basically a meta-issue about security, I'm keeping it open.

from echosvg.