接入Gradle原生OWASP任务报告与显式依赖缓存隔离

Author: loong10k

README.md

@@ -1088,3 +1088,5 @@ flowchart LR
 Real native tests cover all seven rules, repeated identity, presence, noqa suppression and absence after documentation repair; facts remain open. Additional cases retain native exemptions, implicit-exception conflicts and unselected DOC rules. Existing protocols admit native rule IDs and redacted guidance; historical schemas, approved mappings and closure authority are not expanded. See [Ruff DOC acceptance](tests/acceptance/ruff-documentation-contract.md) for evidence and version limits. Complete Python documentation, independent precision, all platforms and production qualification remain pending.
 
 Read-only four-core acceptance plan: `codeguard capabilities [language] --acceptance-plan --format=json`. All 57 languages / 228 obligations remain unqualified; filtering preserves full obligations. See [acceptance plan](docs/Codeguard-Production-Acceptance-Plan.md).
+
+Java Gradle vulnerability checks now expose explicit original tasks through `codeguard cve java`, preserving JSON configuration and optional module-cache inputs. Observations remain unverified; workbench integration and full native acceptance are pending. See [Gradle OWASP](docs/Codeguard-Gradle-Vulnerability-Checks.md).

README.zh-CN.md

@@ -1065,3 +1065,5 @@ flowchart LR
 真实七项规则已验证重复扫描身份、存在、noqa 抑制及文档修复后未受信消失，事实保持 open；另有原生豁免、隐式异常冲突和未选择 DOC 的边界。既有协议允许原规则 ID 和脱敏指引，本次不扩大历史 schema、受批准映射或关闭权限。验收与版本限制见 [Ruff DOC 验收](tests/acceptance/ruff-documentation-contract.md)。当前仍不是完整 Python 文档、独立误报评测、全平台或生产资格。
 
 四核心验收计划只读入口：`codeguard capabilities [language] --acceptance-plan --format=json`. 57 语言/228 义务保留未授予资格，筛选不缩减总义务。参见[acceptance plan](docs/Codeguard-Production-Acceptance-Plan.zh_CN.md).
+
+Java Gradle 漏洞检查新增显式原任务入口 `codeguard cve java`；JSON 原配置与可选模块缓存保留，结果仍未受信，工作台和完整原生验收待完成。详见[Gradle OWASP](docs/Codeguard-Gradle-Vulnerability-Checks.zh_CN.md).

crates/codeguard-adapters/src/gradle_dependency_check_plan.rs

@@ -0,0 +1,42 @@
+use crate::{GradleCheckerModel, GradleDependencyCheckTaskPlan, parse_gradle_checker_model};
+use std::collections::BTreeSet;
+
+/// 选择显式OWASP任务；参数为原生模型和完整任务路径，返回经插件/类型/启用状态核验的计划。
+/// 不自动执行同名普通任务，不将根插件身份继承给子项目。
+pub fn plan_gradle_dependency_check_tasks(
+    model: &GradleCheckerModel,
+    requested: &[String],
+) -> Result<Vec<GradleDependencyCheckTaskPlan>, &'static str> {
+    let model = parse_gradle_checker_model(
+        &serde_json::to_vec(model).map_err(|_| "gradle_model_invalid")?,
+    )?;
+    if requested.is_empty() || requested.len() > 128 {
+        return Err("gradle_owasp_task_selection_invalid");
+    }
+    let mut seen = BTreeSet::new();
+    let mut plans = Vec::new();
+    for path in requested {
+        if !seen.insert(path) {
+            return Err("gradle_owasp_task_selection_duplicate");
+        }
+        let mut selected = None;
+        for project in &model.projects {
+            let prefix = if project.path == ":" {
+                ""
+            } else {
+                project.path.as_str()
+            };
+            for task in project.dependency_check_tasks() {
+                if format!("{prefix}:{}", task.name) == *path {
+                    selected = Some(GradleDependencyCheckTaskPlan {
+                        project_path: project.path.clone(),
+                        task_path: path.clone(),
+                        implementation: task.implementation.clone(),
+                    });
+                }
+            }
+        }
+        plans.push(selected.ok_or("gradle_owasp_task_unavailable")?);
+    }
+    Ok(plans)
+}

crates/codeguard-adapters/src/gradle_dependency_check_task_plan.rs

@@ -0,0 +1,10 @@
+/// 显式选择的Gradle OWASP原任务；仅保存原生模型身份，不签发漏洞扫描资格。
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub struct GradleDependencyCheckTaskPlan {
+    /// 所属项目完整路径。
+    pub project_path: String,
+    /// 本轮显式请求的完整任务路径。
+    pub task_path: String,
+    /// 原生模型观察到的官方分析/聚合基类。
+    pub implementation: String,
+}

crates/codeguard-adapters/src/gradle_owasp_report_ownership.rs

@@ -0,0 +1,17 @@
+use serde::{Deserialize, Serialize};
+
+/// 一张原生OWASP报告的所属任务与输出身份；不代表依赖归属或漏洞库时效。
+#[derive(Clone, Debug, Deserialize, Eq, PartialEq, Serialize)]
+#[serde(deny_unknown_fields)]
+pub struct GradleOwaspReportOwnership {
+    /// 原生所属项目路径。
+    pub project_path: String,
+    /// 显式执行的完整任务路径。
+    pub task_path: String,
+    /// 原生官方基类名称。
+    pub implementation: String,
+    /// 原任务用于报告的项目显示名。
+    pub report_project_name: String,
+    /// 私有受检副本内的唯一JSON输出相对路径。
+    pub report_path: String,
+}

crates/codeguard-adapters/src/gradle_owasp_report_ownership_parser.rs

@@ -0,0 +1,69 @@
+use crate::{
+    GradleCheckerModel, GradleOwaspReportOwnership, parse_unique_json,
+    plan_gradle_dependency_check_tasks,
+};
+use std::collections::BTreeSet;
+
+/// 验证本轮原生输出归属；参数为有界JSON、当前模型及原请求路径，返回逐任务唯一报告位置。
+/// 拒绝不匹配/重复任务、输出别名/越界和缺失归属，不根据报告文件名推断扫描完成。
+pub fn parse_gradle_owasp_report_ownership(
+    raw: &[u8],
+    model: &GradleCheckerModel,
+    requested: &[String],
+) -> Result<Vec<GradleOwaspReportOwnership>, &'static str> {
+    if raw.is_empty() || raw.len() > 1024 * 1024 {
+        return Err("gradle_owasp_ownership_budget_invalid");
+    }
+    let doc = parse_unique_json(raw).map_err(|_| "gradle_owasp_ownership_json_invalid")?;
+    let object = doc
+        .as_object()
+        .ok_or("gradle_owasp_ownership_shape_invalid")?;
+    if object.len() != 3
+        || doc["schema_version"] != "0.1.0"
+        || doc["report_type"] != "gradle_owasp_report_ownership"
+    {
+        return Err("gradle_owasp_ownership_protocol_invalid");
+    }
+    let plans = plan_gradle_dependency_check_tasks(model, requested)?;
+    let rows = doc["tasks"]
+        .as_array()
+        .ok_or("gradle_owasp_ownership_shape_invalid")?;
+    if rows.len() != plans.len() {
+        return Err("gradle_owasp_ownership_incomplete");
+    }
+    let mut paths = BTreeSet::new();
+    let mut tasks = BTreeSet::new();
+    let mut result = Vec::new();
+    for value in rows {
+        let row: GradleOwaspReportOwnership = serde_json::from_value(value.clone())
+            .map_err(|_| "gradle_owasp_ownership_shape_invalid")?;
+        if !plans.iter().any(|plan| {
+            plan.project_path == row.project_path
+                && plan.task_path == row.task_path
+                && plan.implementation == row.implementation
+        }) || !tasks.insert(row.task_path.clone())
+        {
+            return Err("gradle_owasp_ownership_task_mismatch");
+        }
+        if row.report_project_name.is_empty()
+            || row.report_project_name.len() > 256
+            || row.report_project_name.chars().any(char::is_control)
+        {
+            return Err("gradle_owasp_project_name_invalid");
+        }
+        if row.report_path.len() > 256
+            || !row.report_path.ends_with("/dependency-check-report.json")
+            || row.report_path.split('/').any(|part| {
+                part.is_empty()
+                    || matches!(part, "." | "..")
+                    || part.contains(['\\', ':'])
+                    || part.chars().any(char::is_control)
+            })
+            || !paths.insert(row.report_path.clone())
+        {
+            return Err("gradle_owasp_report_scope_invalid");
+        }
+        result.push(row);
+    }
+    Ok(result)
+}

crates/codeguard-adapters/src/lib.rs

@@ -469,3 +469,13 @@ pub use gradle_javadoc_diagnostic::GradleJavadocDiagnostic;
 pub use gradle_javadoc_output::parse_gradle_javadoc_output;
 
 pub use production_acceptance_plan::parse_production_acceptance_plan;
+
+mod gradle_dependency_check_task_plan;
+mod gradle_dependency_check_plan;
+pub use gradle_dependency_check_task_plan::GradleDependencyCheckTaskPlan;
+pub use gradle_dependency_check_plan::plan_gradle_dependency_check_tasks;
+
+mod gradle_owasp_report_ownership;
+mod gradle_owasp_report_ownership_parser;
+pub use gradle_owasp_report_ownership::GradleOwaspReportOwnership;
+pub use gradle_owasp_report_ownership_parser::parse_gradle_owasp_report_ownership;

crates/codeguard-adapters/tests/gradle_dependency_check_plan.rs

@@ -0,0 +1,47 @@
+use codeguard_adapters::{parse_gradle_checker_model, plan_gradle_dependency_check_tasks};
+use serde_json::json;
+
+#[test]
+fn explicitly_selected_task_requires_owning_plugin_class_and_enabled_state() {
+    for (plugin, implementation, enabled, expected) in [
+        (
+            true,
+            "org.owasp.dependencycheck.gradle.tasks.Analyze",
+            true,
+            true,
+        ),
+        (
+            true,
+            "org.owasp.dependencycheck.gradle.tasks.Aggregate",
+            true,
+            true,
+        ),
+        (
+            false,
+            "org.owasp.dependencycheck.gradle.tasks.Analyze",
+            true,
+            false,
+        ),
+        (true, "org.gradle.api.DefaultTask", true, false),
+        (
+            true,
+            "org.owasp.dependencycheck.gradle.tasks.Analyze",
+            false,
+            false,
+        ),
+    ] {
+        let value = json!({"schema_version":"0.1.0","report_type":"gradle_checker_model","gradle_version":"8.10.2","included_build_count":0,"projects":[{"path":":","project_dir":".","build_dir":"build","plugins":if plugin {vec!["org.owasp.dependencycheck"]}else{vec![]},"tasks":[{"name":"customScan","implementation":implementation,"enabled":enabled}]}]});
+        let model = parse_gradle_checker_model(&serde_json::to_vec(&value).unwrap()).unwrap();
+        assert_eq!(
+            plan_gradle_dependency_check_tasks(&model, &[":customScan".into()]).is_ok(),
+            expected
+        );
+        for requested in [
+            vec![],
+            vec![":unknown".into()],
+            vec![":customScan".into(), ":customScan".into()],
+        ] {
+            assert!(plan_gradle_dependency_check_tasks(&model, &requested).is_err());
+        }
+    }
+}

crates/codeguard-adapters/tests/gradle_owasp_report_ownership.rs

@@ -0,0 +1,91 @@
+use codeguard_adapters::{parse_gradle_checker_model, parse_gradle_owasp_report_ownership};
+use serde_json::{Value, json};
+fn model() -> codeguard_adapters::GradleCheckerModel {
+    parse_gradle_checker_model(&serde_json::to_vec(&json!({"schema_version":"0.1.0","report_type":"gradle_checker_model","gradle_version":"8.10.2","included_build_count":0,"projects":[{"path":":","project_dir":".","build_dir":"build","plugins":["org.owasp.dependencycheck"],"tasks":[{"name":"dependencyCheckAnalyze","implementation":"org.owasp.dependencycheck.gradle.tasks.Analyze","enabled":true}]}]})).unwrap()).unwrap()
+}
+fn ownership() -> Value {
+    json!({"schema_version":"0.1.0","report_type":"gradle_owasp_report_ownership","tasks":[{"project_path":":","task_path":":dependencyCheckAnalyze","implementation":"org.owasp.dependencycheck.gradle.tasks.Analyze","report_project_name":"root project 'sample'","report_path":"build/reports/dependency-check-report.json"}]})
+}
+#[test]
+fn ownership_is_attributed_to_exact_requested_official_task() {
+    assert_eq!(
+        parse_gradle_owasp_report_ownership(
+            &serde_json::to_vec(&ownership()).unwrap(),
+            &model(),
+            &[":dependencyCheckAnalyze".into()]
+        )
+        .unwrap()
+        .len(),
+        1
+    );
+    for mutation in 0..8 {
+        let mut value = ownership();
+        match mutation {
+            0 => value["tasks"][0]["report_path"] = "../outside.json".into(),
+            1 => value["tasks"][0]["report_path"] = "/absolute.json".into(),
+            2 => value["tasks"][0]["task_path"] = ":ordinary".into(),
+            3 => value["tasks"][0]["implementation"] = "org.gradle.api.DefaultTask".into(),
+            4 => value["tasks"][0]["project_path"] = ":other".into(),
+            5 => value["tasks"][0]["report_project_name"] = "".into(),
+            6 => {
+                value["tasks"].as_array_mut().unwrap().clear();
+            }
+            _ => {
+                let item = value["tasks"][0].clone();
+                value["tasks"].as_array_mut().unwrap().push(item);
+            }
+        }
+        assert!(
+            parse_gradle_owasp_report_ownership(
+                &serde_json::to_vec(&value).unwrap(),
+                &model(),
+                &[":dependencyCheckAnalyze".into()]
+            )
+            .is_err()
+        );
+    }
+}
+#[test]
+fn duplicate_json_fields_and_budget_overruns_are_rejected() {
+    assert!(
+        parse_gradle_owasp_report_ownership(
+            br#"{"schema_version":"0.1.0","schema_version":"0.1.0"}"#,
+            &model(),
+            &[":dependencyCheckAnalyze".into()]
+        )
+        .is_err()
+    );
+    assert!(
+        parse_gradle_owasp_report_ownership(
+            &vec![b' '; 1024 * 1024 + 1],
+            &model(),
+            &[":dependencyCheckAnalyze".into()]
+        )
+        .is_err()
+    );
+}
+
+#[test]
+fn two_official_tasks_cannot_claim_one_output_path() {
+    let mut model = model();
+    let mut task = model.projects[0].tasks[0].clone();
+    task.name = "otherScan".into();
+    model.projects[0].tasks.push(task);
+    let mut doc = ownership();
+    let mut record = doc["tasks"][0].clone();
+    record["task_path"] = ":otherScan".into();
+    doc["tasks"].as_array_mut().unwrap().push(record);
+    let paths = vec![":dependencyCheckAnalyze".into(), ":otherScan".into()];
+    assert_eq!(
+        parse_gradle_owasp_report_ownership(&serde_json::to_vec(&doc).unwrap(), &model, &paths)
+            .unwrap_err(),
+        "gradle_owasp_report_scope_invalid"
+    );
+    doc["tasks"][1]["report_path"] = "build/other/dependency-check-report.json".into();
+    assert_eq!(
+        parse_gradle_owasp_report_ownership(&serde_json::to_vec(&doc).unwrap(), &model, &paths)
+            .unwrap()
+            .len(),
+        2
+    );
+}

crates/codeguard-cli/examples/probe_gradle_dependency_check.rs

@@ -0,0 +1,41 @@
+//! 已有工具的局部OWASP应用服务探针；非发布命令或生产资格入口。
+#[cfg(unix)]
+fn main() -> Result<(), Box<dyn std::error::Error>> {
+    use codeguard_cli::{
+        gradle_dependency_check_probe::observe, gradle_dependency_check_request::Request,
+        gradle_model_probe_request::Request as NativeRequest,
+    };
+    use std::{
+        collections::BTreeSet,
+        path::PathBuf,
+        sync::atomic::AtomicBool,
+        time::{Duration, Instant},
+    };
+    let args = std::env::args().skip(1).collect::<Vec<_>>();
+    if args.len() < 6 {
+        return Err(
+            "usage: PROJECT_ROOT GRADLE_BUNDLE JAVA_HOME TASK_PATH PROJECT_FILE PROJECT_FILE..."
+                .into(),
+        );
+    }
+    let request = Request {
+        module_cache: None,
+        native: NativeRequest {
+            project_root: PathBuf::from(&args[0]),
+            gradle_bundle: PathBuf::from(&args[1]),
+            java_home: PathBuf::from(&args[2]),
+            project_files: args[4..].iter().map(PathBuf::from).collect::<BTreeSet<_>>(),
+            deadline: Instant::now() + Duration::from_secs(90),
+        },
+        task_paths: vec![args[3].clone()],
+    };
+    let report = observe(&request, &AtomicBool::new(false));
+    println!("{}", serde_json::to_string_pretty(&report)?);
+    // 读取原生观察不能充当漏洞清洁或交付成功。
+    std::process::exit(3);
+}
+#[cfg(not(unix))]
+fn main() {
+    eprintln!("Gradle原生执行探针尚未在此平台验收");
+    std::process::exit(3);
+}