https://kotlinlang.org logo
Join Slack
Powered by
Hello folks, :wave::skin-tone-4: I’m working towa...
# gradle
h
Hello folks, 👋🏽 I’m working towards fixing a vulnerability from 
org.json
and I noticed that the vulnerability for my gradle project is using the 
dataFile
scope. For one of my projects, I addressed it by doing:
Copy code
dependencies {
        dataFiles("org.json","json","20230227")
}
However, for another project, I get the error:
Copy code
Configuration with name 'dataFiles' not found.
Would any of you have any suggestion what could I could be possible be doing wrong? Any help is greatly appreciated. BTW: Using gradle 8.1.1 in both.
c
datafiles is a custom gradle configuration defined in your first project. The second project does not define that configuration hence the error. You’ll need to assess the second project to determine if it uses that dependency, and if so on which configurations.
Btw it’s more effective to use constraints to force minimum dependency versions for vulnerabilities as they also handle transitive dependencies. https://docs.gradle.org/current/userguide/dependency_constraints.html
h
Thanks for your reply Chris. That's what has been the problem from my view. I'm not able to find the usage of the reference for the library at all. Already tried many things. Do you have any suggestions on where I would check for such configuration? Thanks for the tip regarding the constraint. It is definitely better to use that, good point.
c
have you trying a build scan (
./gradlew build --scan
) to identify dependencies?
it is perhaps a transitive dependency (will still show up in the scan), which can be addressed via a constraint (once you know from the scan what configuration(s) it is on)
h
I haven’t actually tried 
./gradlew build --scan
I tried 
./gradlew dependencies
though.
This is what it returns, for example: The reason why it is returning in 
runtimeClasspath
, etc, it was because I tried to add the 
implementation (library)
for the project that I couldn’t use dataFiles.
c
you’ll need to repeat that for each project, e.g. 
:project:dependencies
- by itself it only shows dependencies for the root project. Try a scan, it’s more interactive / searchable.
h
Just to confirm I understand, would running, 
./gradlew build --scan
suffice the request? I mean, it looks like I need to accept Term and Conditions in order to get it published. Not sure how safe it would be to do that though. 👀
c
your call on the safety. It does have all the deets needed to diagnose issues such as this.
h
Is there anyway to avoid that on going to public? I mean, can’t I get the output on machine only? Another option is, If I use the dependency analyser from IntellijIdea, would that help in anyway? Because I can definitely see the reference for the library there.
c
Outside of the scan this reference may help with other options.
h
Could this be the culprit?
c
Yes
h
This is what the details return.
c
Seems like snyk plug-in is reporting vulnerability on itself
h
But what is confusing me now is: What could preventing me from “overriding” this dataFile dependency if I try to do:
Copy code
constraints {
            dataFiles("org.json","json","20230227") {
                because("<https://security.snyk.io/vuln/SNYK-JAVA-ORGJSON-5488379>")
            }
        }
And it fails with:
Copy code
Configuration with name 'dataFiles' not found.

* Try:
> Run with --info or --debug option to get more log output.
> Run with --scan to get full insights.

* Exception is:
org.gradle.api.artifacts.UnknownConfigurationException: Configuration with name 'dataFiles' not found.
c
Yes. It is in dataFiles in one project but not others.
h
If I remember correctly, gradle 8.1.1 already supports dataFiles by default. It is just not being recognised. I have also tried, but without much help.
Copy code
configurations {
   dataFiles
}
Yes. It is in dataFiles in one project but not others.
What do you mean?
c
Datafiles is not a gradle provided configuration. It is being created by some other plugin in some projects but not others.
h
Maybe I’m not expressing myself well, haha. Apologies for that. Let’s think in this scenario: 1. Repository A (
build.gradle.kts_1
) a. This repository uses Snyk plugin; b. It also uses gradle 8.1.1 c. When I updated 
build.gradle.kts
and added the 
constraint
, overriding 
dataFiles
, it worked as it should. 2. Repository B (
build.gradle.kts_2
) a. This repository uses Snyk plugin; b. It also uses gradle 8.1.1 c. When I updated 
build.gradle.kts
and added the 
constraint
, overriding 
dataFiles
, it failed with the error above. Is there anything I might be missing here? For example, is there any possible configuration that could affect how gradle resolve the configuration from within 
dependencies
?
c
Assuming those are projects (not repositories), Project B does not have a dataFiles configuration, so why are you trying to fix it there? Does Project B have that vulnerable json lib in a different configuration?
h
They are independent repositories. (complete separate applications). Each of them have their own plugins and dependencies, but both of them have:
Copy code
plugins {
id("io.snyk.gradle.plugin.snykplugin") version "0.4"
}
Which I suppose that where the vulnerable dependency is coming from.
I noticed that a PR to fix the issue, was already raised for snyk plugin. It is just my head hitting against the wall trying to understand the reason for the exception. Not sure why that happens.
c
So they are separate Gradle projects. They likely have different sets of plugins. Does snyk not tell you which configuration (on Project B) the vulnerability is on?
h
Yes, it is the same json package. If I simply add:
Copy code
dataFiles("org.json","json","20230227")
gradle will fail to build due to the 
dataFiles
keyword.
c
Not sure what same json package means. What is the snyk output from just Project B?
h
Not sure what same json package means.
The same dependency 
org.json:json
.
What is the snyk output from just Project B?
I don’t think the problem here is with the snyk execution (since I’m not invoking it). The build gradle does not compile, because when I make usage of the 
dataFiles
keyword under 
dependencies
(from 
build.gradle.kts
), the exception is thrown by simply trying to re-sync the project.
c
Yes. For the reason noted above. You can’t apply the fix from one project to a completely different project, there’s no expectation that will magically work. You’ll need to assess the vulnerabilities in Project B and action those specifically.
h
image.png
That’s exactly what I’m trying to do right? The fix for project A is completely independent from project B. Project A has already been merged and released. I’m trying to apply the same fix for project B, which was by adding the 
dataFiles
, but in project A I didn’t get the exception.
There might be something compromising the usage of 
dataFiles
in my gradle config. Which I’m not entirely sure what it could be
c
if the fix for project a is completely independent why the expectation it will work on project b? Assess project b and fix its specific vulnerabilities. Datafiles isn’t the problem - it’s the erroneous use of a project a fix in a separate project with different configuration.
h
I was just trying to resolve the vulnerability issue from Project B the same way I resolved for other 2 projects. Which was by overriding the vulnerable dependency by specifying the 
dataFiles
within the 
dependency
. But for some odd reason, using 
dataFiles
in project B, doesn’t compile. I will see if I can investigate further, but it is very odd.
c
It’s not an odd reason, project b has a different configuration that doesn’t use datafiles.
h
According to the dependencies scan, it does use.
Copy code
gradle -q dependencies --configuration dataFiles                                                                         

------------------------------------------------------------
Root project 'plugins'
------------------------------------------------------------

dataFiles - The data artifacts to be processed for this plugin.
\--- org.json:json:20200518

A web-based, searchable dependency report is available by adding the --scan option.
c
Is project B a sub project of another one, or a standalone project?
h
It is a standalone project.
Hey Chris, I think I found what the issue might be. In 
settings.graadle.kts
I have the following:
Copy code
rootProject.name = "plugins"

include(":src:directDownload")
include(":src:collectMetrics")
I noticed that once I remove the 
includes
from 
settings.gradle.kts
, I don’t get the exception. So I probably need somehow to apply the 
dataFiles
only for 
plugins
context.
c
ah yea. apply in your main build.gradle.kts (for ‘plugins’ project); placing it somewhere that affects the subprojects is causing the failure as those subprojects don’t have the dataFiles configuration.
h
Yep, I think that might be the issue. So I suppose I would need to do something like:
Copy code
project("plugins") {
    dependencies {
        constraints {
            dataFiles("org.json","json","20230227") {
                because("<https://security.snyk.io/vuln/SNYK-JAVA-ORGJSON-5488379>")
            }
        }
    }
}
And remove the 
dataFiles
from 
allProjects
?
c
correct!
h
Is that how I reference the name of the root.name project? Because I got the error:
Copy code
Project with path 'plugins' could not be found in root project 'plugins'.
I will see if I can find the issue.
c
this is not necessary, you are already in the project: 
project("plugins") {
h
What is not necessary? Sorry, I’m very newbie with Gradle
c
it should be this:
Copy code
dependencies {
        constraints {
            dataFiles("org.json","json","20230227") {
                because("<https://security.snyk.io/vuln/SNYK-JAVA-ORGJSON-5488379>")
            }
        }
    }
h
It worked.
OMFG! Thanks so much Chris for your help.
I can definitely see the library updated now. 🙌🏽
151 Views
Open in Slack
PreviousNext
Powered by