JarCastingRIPS Maven Plugin
Apache Maven is a popular build management tool for Java applications. RIPS security analysis can be easily integrated as a build task in order to fail your build whenever new security vulnerabilities are discovered.
Configuration
You can add and configure the plugin in your pom.xml:
<build>
<plugins>
<plugin>
<groupId>com.ripstech.maven</groupId>
<artifactId>rips-maven-plugin</artifactId>
<version>1.0.0</version>
<configuration>
<apiUrl>https://api-3.ripstech.com</apiUrl>
<uiUrl>https://saas.ripstech.com</uiUrl>
<email>test@company</email>
<password>yourPassword</password>
<applicationId>yourApplicationId</applicationId>
<scanVersion>{isoDateTime}</scanVersion>
<thresholds>
<low>10</low>
<medium>5</medium>
<high>0</high>
<critical>0</critical>
</thresholds>
<printIssues>true</printIssues>
</configuration>
<executions>
<execution>
<goals>
<goal>scan</goal>
</goals>
</execution>
</executions>
</plugin>
</plugins>
</build>
Local Setup
Add the plugin to your local repository:
mvn install:install-file -Dfile=<path-to-jar> -DgroupId=com.ripstech \
-DartifactId=rips-maven-plugin -Dversion=1.0.0 -Dpackaging=jar
Details
- rips.apiUrl(required): Your RIPS Api Url.
- rips.uiUrl(optional): Your RIPS Ui Url.
- rips.email(required): Your RIPS Api login email.
- rips.password(required): Your RIPS Api password.
- rips.applicationId(required): The id of the RIPS application to use.
- rips.profileId(optional): The RIPS analysis profile.
- rips.scanVersion(optional): The version name of the scan.
- rips.thresholds(optional): Map of tolerated numbers of issues by severity. Possible severities: critical, high, medium, low. (E.g. critical: 0, high: 0, medium: 5, low: 10)
- rips.analysisDepth(optional): Overwrite default analysis depth(5).
- rips.scanTimeout(optional): Overwrite default scan timeout (5) in hours.
- rips.printIssues(optional): Set to false to suppress detailed output of all issues.
Setting the build phase
The plugins' default build phase is 'verify' which means it scans during integration tests. You can change this using the <executions> tag. For instance if you want to set it to 'deploy':
<executions>
<execution>
<phase>deploy</phase>
<goals>
<goal>scan</goal>
</goals>
</execution>
</executions>
