stella-ops.org/git.stella-ops.org
1
0
Fork 0
Code Issues Pull Requests Actions 2 Releases Wiki Activity
Files
cf5b72974f923126944f4dcd47e85864ebb31a3b
git.stella-ops.org/docs/features/unchecked/scanner/java-shaded-shadow-jar-detection.md

1.7 KiB
Raw Blame History

Java Shaded/Shadow JAR Detection

Module

Scanner

Status

IMPLEMENTED

Description

Detects Maven Shade plugin and Gradle Shadow plugin fat/uber JARs by analyzing relocated packages, service-provider rewrites, and embedded dependency manifests to attribute inner components.

Implementation Details

  • Shaded JAR Detection:
    • src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Java/Internal/Shading/ShadedJarDetector.cs - ShadedJarDetector identifies Maven Shade and Gradle Shadow fat/uber JARs by analyzing relocated packages, service-provider rewrites, and embedded dependency manifests
  • Analysis Results:
    • src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Java/Internal/ShadedJarAnalysisResult.cs - ShadedJarAnalysisResult model capturing detected shading details including relocated packages and embedded components
  • Language Analyzer Integration:
    • src/Scanner/__Libraries/StellaOps.Scanner.Analyzers.Lang.Java/JavaLanguageAnalyzer.cs - Integrates shaded JAR detection into the analysis pipeline

E2E Test Plan

  • Scan a container image with a Maven Shade plugin-produced uber JAR and verify embedded dependencies are attributed as inner components
  • Scan a Gradle Shadow plugin-produced fat JAR and verify relocated packages are detected
  • Verify service-provider rewrites (META-INF/services) from shading are identified and the original component is attributed
  • Verify relocated package prefixes (e.g., com.google.common relocated to shaded.com.google.common) are detected and mapped back to the original dependency
  • Verify the SBOM includes both the outer shaded JAR and the inner embedded dependencies with correct attribution