Merge branch 'main' into snyk-upgrade-077a3e87df1150537a4c8d358405a7b0

Author: soul2zimate

README.md

@@ -104,7 +104,7 @@ repositories {
 <dependency>
     <groupId>com.redhat.exhort</groupId>
     <artifactId>exhort-java-api</artifactId>
-    <version>0.0.8-SNAPSHOT</version>
+    <version>0.0.9-SNAPSHOT</version>
 </dependency>
 ```
 </li>
@@ -188,7 +188,7 @@ Excluding a package from any analysis can be achieved by marking the package for
 <dependency> <!--exhortignore-->
   <groupId>...</groupId>
   <artifactId>...</artifactId>
-  <version>0.0.8-SNAPSHOT</version>
+  <version>0.0.9-SNAPSHOT</version>
 </dependency>
 ```
 </li>

pom.xml

@@ -5,7 +5,7 @@
 
   <groupId>com.redhat.exhort</groupId>
   <artifactId>exhort-java-api</artifactId>
-  <version>0.0.8-SNAPSHOT</version>
+  <version>0.0.9-SNAPSHOT</version>
   <name>Exhort Java API</name>
   <description>Exhort Java API</description>
   <url>https://github.com/trustification/exhort-java-api#readme</url>
@@ -706,7 +706,7 @@ limitations under the License.]]>
                 </transformer>
 
                 <!-- Service files transformer for Jackson and other services -->
-                <transformer implementation="org.apache.maven.plugins.shade.resource.ServicesResourceTransformer"/>
+                <transformer implementation="org.apache.maven.plugins.shade.resource.ServicesResourceTransformer" />
 
                 <!-- Append NOTICE files -->
                 <transformer implementation="org.apache.maven.plugins.shade.resource.AppendingTransformer">
@@ -745,8 +745,8 @@ limitations under the License.]]>
           <formats>
             <format>
               <includes><include>src/*</include></includes>
-              <trimTrailingWhitespace/>
-              <endWithNewline/>
+              <trimTrailingWhitespace />
+              <endWithNewline />
               <indent>
                 <tabs>true</tabs>
                 <spacesPerTab>4</spacesPerTab>

src/main/java/com/redhat/exhort/providers/JavaMavenProvider.java

@@ -238,11 +238,41 @@ private List<DependencyAggregator> getDependencies(final Path manifestPath) thro
       // when a "dependency" tag starts, it will be initiated,
       // when a "dependency" tag ends, it will be parsed, act upon, and reset
       DependencyAggregator dependencyAggregator = null;
+      boolean insideDependencyManagement = false;
+      boolean insideExclusions = false;
+      boolean insidePlugins = false;
       while (reader.hasNext()) {
         reader.next(); // get the next event
+        if (reader.isStartElement() && "dependencyManagement".equals(reader.getLocalName())) {
+          insideDependencyManagement = true;
+          continue;
+        }
+        if (reader.isEndElement() && "dependencyManagement".equals(reader.getLocalName())) {
+          insideDependencyManagement = false;
+          continue;
+        }
+        if (reader.isStartElement() && "plugins".equals(reader.getLocalName())) {
+          insidePlugins = true;
+          continue;
+        }
+        if (reader.isEndElement() && "plugins".equals(reader.getLocalName())) {
+          insidePlugins = false;
+          continue;
+        }
+        if (reader.isStartElement() && "exclusions".equals(reader.getLocalName())) {
+          insideExclusions = true;
+          continue;
+        }
+        if (reader.isEndElement() && "exclusions".equals(reader.getLocalName())) {
+          insideExclusions = false;
+          continue;
+        }
         if (reader.isStartElement() && "dependency".equals(reader.getLocalName())) {
-          // starting "dependency" tag, initiate aggregator
-          dependencyAggregator = new DependencyAggregator();
+          // starting "dependency" tag, initiate aggregator only if not inside dependencyManagement
+          // or plugins
+          if (!insideDependencyManagement && !insidePlugins) {
+            dependencyAggregator = new DependencyAggregator();
+          }
           continue;
         }
 
@@ -256,9 +286,10 @@ private List<DependencyAggregator> getDependencies(final Path manifestPath) thro
             continue;
           }
 
-          if (reader.isStartElement()) {
+          if (reader.isStartElement() && !insideExclusions) {
             // NOTE if we want to include "scope" tags in ignore,
             // add a case here and a property in DependencyIgnore
+            // Only process these elements if we're not inside exclusions
             switch (reader.getLocalName()) {
               case "groupId": // starting "groupId" tag, get next event and set to aggregator
                 reader.next();
@@ -282,8 +313,11 @@ private List<DependencyAggregator> getDependencies(final Path manifestPath) thro
           }
 
           if (reader.isEndElement() && "dependency".equals(reader.getLocalName())) {
-            // add object to list and reset dependency aggregator
-            deps.add(dependencyAggregator);
+            // add object to list and reset dependency aggregator only if not inside
+            // dependencyManagement or plugins
+            if (!insideDependencyManagement && !insidePlugins && dependencyAggregator != null) {
+              deps.add(dependencyAggregator);
+            }
             dependencyAggregator = null;
           }
         }
@@ -383,7 +417,9 @@ private String selectMvnRuntime(final Path manifestPath) {
         try {
           // verify maven wrapper is accessible
           Operations.runProcess(manifest.getParent(), mvnw, ARG_VERSION);
-          log.fine(String.format("using maven wrapper from : %s", mvnw));
+          if (debugLoggingIsNeeded()) {
+            log.info(String.format("using maven wrapper from : %s", mvnw));
+          }
           return mvnw;
         } catch (Exception e) {
           log.warning(
@@ -393,7 +429,9 @@ private String selectMvnRuntime(final Path manifestPath) {
     }
     // If maven wrapper is not requested or not accessible, fall back to use mvn
     String mvn = Operations.getExecutable(MVN, ARG_VERSION);
-    log.fine(String.format("using mvn executable from : %s", mvn));
+    if (debugLoggingIsNeeded()) {
+      log.info(String.format("using mvn executable from : %s", mvn));
+    }
     return mvn;
   }