Incorporating known-vulnerable JAR scanning into RHQ

John Mazzitelli mazz at redhat.com
Thu Nov 1 13:54:12 UTC 2012


> The plugin could instead inject the new resource type under our selected 
> resource types in different plugins we develop and 3rd party plugins could 
> define their own injection points in their plugin descriptors if they wished to 
> include this functionality

That's an interesting idea. So we could have a single plugin that injects into, say, the AS4 and AS7 hierarchies to look for vulnerabilities in there. We could have a commons module with the common API that does the scanning (so other people can write their own plugins and just have a mvn dependency on that commons API module that does the scanning).

> (this would require the affected resource components 
> to probably implement some new interface in the code so that the plugin would 
> be able to figure out the base directories to base the scan on).

If by "the affected resource components" you mean the new ones this new plugin is injected, yes. Those could have plugin configs with excluded/included dirs to check (which default to some values that make sense depending on the parent resource it is injecting to - it could inspect the parent plugin config for things like "install directory" to come up with these defaults). This should not mean we have to add new interfaces to the parent resources (like the AS7 server component, or the AS4 server component) - we could gleen from their already existing plugin config information that is useful (like install directory and things like that).


More information about the rhq-devel mailing list