MACRO NEPAL
Titliel – SourceClear (Veracode) Integration in Java
awiskar acharya
November 27, 2025
4:17 pm

Article: Comprehensive Software Composition Analysis with Veracode SourceClear

Veracode SourceClear provides software composition analysis (SCA) to identify vulnerabilities in open-source dependencies. This article covers comprehensive integration strategies for Java applications with advanced features like policy enforcement, CI/CD integration, and remediation guidance.

Core SourceClear Integration

package com.titliel.veracode;
import java.io.*;
import java.nio.file.*;
import java.util.*;
import java.util.concurrent.*;
import java.net.http.*;
import java.net.URI;
import javax.net.ssl.SSLContext;
/**
* Titliel Veracode SourceClear Scanner
* Advanced SCA integration with policy enforcement and remediation tracking
*/
public class TitlielSourceClearScanner {
private final SourceClearConfig config;
private final HttpClient httpClient;
private final VulnerabilityProcessor vulnProcessor;
private final PolicyEngine policyEngine;
private final ReportGenerator reportGenerator;
private final ExecutorService scanExecutor;
public TitlielSourceClearScanner() {
this.config = SourceClearConfig.getInstance();
this.httpClient = createHttpClient();
this.vulnProcessor = new VulnerabilityProcessor();
this.policyEngine = new PolicyEngine();
this.reportGenerator = new ReportGenerator();
this.scanExecutor = Executors.newFixedThreadPool(config.getThreadCount());
}
/**
* Perform comprehensive SCA scan
*/
public ScanResult scanProject(ProjectContext context) {
long startTime = System.currentTimeMillis();
ScanResult result = new ScanResult(context);
try {
// Pre-scan validation
validateProjectStructure(context);
// Execute scan phases in parallel
List<Future<ScanResult>> futures = new ArrayList<>();
futures.add(scanExecutor.submit(() -> performDependencyScan(context)));
futures.add(scanExecutor.submit(() -> performLicenseScan(context)));
futures.add(scanExecutor.submit(() -> performVulnerabilityScan(context)));
futures.add(scanExecutor.submit(() -> performPolicyCheck(context)));
// Wait for all scans to complete
for (Future<ScanResult> future : futures) {
try {
ScanResult partialResult = future.get();
result.merge(partialResult);
} catch (Exception e) {
result.addError(new ScanError("Scan phase failed", e));
}
}
// Post-process results
processScanResults(result);
// Generate reports
generateReports(result);
// Upload results to Veracode platform
if (config.isUploadEnabled()) {
uploadResults(result);
}
} catch (Exception e) {
result.addError(new ScanError("Scan failed", e));
} finally {
result.setScanDuration(System.currentTimeMillis() - startTime);
}
return result;
}
/**
* Perform dependency inventory scan
*/
private ScanResult performDependencyScan(ProjectContext context) {
ScanResult result = new ScanResult(context, ScanType.DEPENDENCY_INVENTORY);
try {
DependencyResolver resolver = new DependencyResolver();
List<Dependency> dependencies = resolver.resolveDependencies(context);
result.setDependencies(dependencies);
result.addMetric("dependencies_count", dependencies.size());
// Analyze dependency health
analyzeDependencyHealth(dependencies, result);
} catch (Exception e) {
result.addError(new ScanError("Dependency scan failed", e));
}
return result;
}
/**
* Perform license compliance scan
*/
private ScanResult performLicenseScan(ProjectContext context) {
ScanResult result = new ScanResult(context, ScanType.LICENSE_COMPLIANCE);
try {
LicenseAnalyzer analyzer = new LicenseAnalyzer();
List<LicenseViolation> violations = analyzer.analyzeLicenses(context);
for (LicenseViolation violation : violations) {
result.addLicenseViolation(violation);
}
result.addMetric("license_violations", violations.size());
} catch (Exception e) {
result.addError(new ScanError("License scan failed", e));
}
return result;
}
/**
* Perform vulnerability analysis
*/
private ScanResult performVulnerabilityScan(ProjectContext context) {
ScanResult result = new ScanResult(context, ScanType.VULNERABILITY_ANALYSIS);
try {
// Get dependencies from context or resolve fresh
List<Dependency> dependencies = result.getDependencies();
if (dependencies.isEmpty()) {
DependencyResolver resolver = new DependencyResolver();
dependencies = resolver.resolveDependencies(context);
}
// Check vulnerabilities for each dependency
for (Dependency dependency : dependencies) {
List<Vulnerability> vulns = checkDependencyVulnerabilities(dependency);
result.addVulnerabilities(vulns);
}
result.addMetric("vulnerabilities_count", result.getVulnerabilities().size());
} catch (Exception e) {
result.addError(new ScanError("Vulnerability scan failed", e));
}
return result;
}
/**
* Perform policy compliance check
*/
private ScanResult performPolicyCheck(ProjectContext context) {
ScanResult result = new ScanResult(context, ScanType.POLICY_COMPLIANCE);
try {
PolicyCheckResult policyResult = policyEngine.evaluatePolicy(result);
result.setPolicyResult(policyResult);
result.addMetric("policy_violations", policyResult.getViolations().size());
result.addMetric("policy_compliant", policyResult.isCompliant());
} catch (Exception e) {
result.addError(new ScanError("Policy check failed", e));
}
return result;
}
/**
* Check vulnerabilities for a specific dependency using SourceClear API
*/
private List<Vulnerability> checkDependencyVulnerabilities(Dependency dependency) {
List<Vulnerability> vulnerabilities = new ArrayList<>();
try {
// Build API request
String apiUrl = config.getApiBaseUrl() + "/v1/dependencies/vulnerabilities";
String requestBody = buildVulnerabilityRequest(dependency);
HttpRequest request = HttpRequest.newBuilder()
.uri(URI.create(apiUrl))
.header("Authorization", "Bearer " + config.getApiKey())
.header("Content-Type", "application/json")
.POST(HttpRequest.BodyPublishers.ofString(requestBody))
.build();
// Execute API call
HttpResponse<String> response = httpClient.send(request, 
HttpResponse.BodyHandlers.ofString());
if (response.statusCode() == 200) {
vulnerabilities = parseVulnerabilityResponse(response.body(), dependency);
} else {
throw new IOException("API request failed: " + response.statusCode());
}
} catch (Exception e) {
// Fallback to local vulnerability database
vulnerabilities = checkLocalVulnerabilityDatabase(dependency);
}
return vulnerabilities;
}
/**
* Build vulnerability check request
*/
private String buildVulnerabilityRequest(Dependency dependency) {
Map<String, Object> request = new HashMap<>();
request.put("coordinates", dependency.getCoordinates());
request.put("version", dependency.getVersion());
request.put("ecosystem", "maven"); // or "gradle"
// Convert to JSON
return new JSONObject(request).toString();
}
/**
* Parse vulnerability API response
*/
private List<Vulnerability> parseVulnerabilityResponse(String responseBody, 
Dependency dependency) {
List<Vulnerability> vulnerabilities = new ArrayList<>();
try {
JSONObject json = new JSONObject(responseBody);
JSONArray vulnsArray = json.getJSONArray("vulnerabilities");
for (int i = 0; i < vulnsArray.length(); i++) {
JSONObject vulnJson = vulnsArray.getJSONObject(i);
Vulnerability vulnerability = parseVulnerability(vulnJson, dependency);
vulnerabilities.add(vulnerability);
}
} catch (Exception e) {
throw new RuntimeException("Failed to parse vulnerability response", e);
}
return vulnerabilities;
}
/**
* Parse individual vulnerability
*/
private Vulnerability parseVulnerability(JSONObject vulnJson, Dependency dependency) {
Vulnerability vuln = new Vulnerability();
vuln.setId(vulnJson.getString("cve"));
vuln.setTitle(vulnJson.getString("title"));
vuln.setDescription(vulnJson.optString("description", ""));
vuln.setSeverity(SeverityLevel.fromString(vulnJson.getString("severity")));
vuln.setCvssScore(vulnJson.optDouble("cvss_score", 0.0));
vuln.setCweId(vulnJson.optString("cwe", ""));
vuln.setPublishedDate(parseDate(vulnJson.optString("published_date")));
vuln.setAffectedDependency(dependency);
// Parse remediation information
if (vulnJson.has("remediation")) {
JSONObject remediation = vulnJson.getJSONObject("remediation");
vuln.setRemediation(remediation.optString("recommendation", ""));
vuln.setFixedVersion(remediation.optString("fixed_version", ""));
}
// Parse exploit information
if (vulnJson.has("exploit")) {
JSONObject exploit = vulnJson.getJSONObject("exploit");
vuln.setExploitAvailable(exploit.optBoolean("available", false));
vuln.setExploitMaturity(exploit.optString("maturity", ""));
}
return vuln;
}
/**
* Fallback to local vulnerability database
*/
private List<Vulnerability> checkLocalVulnerabilityDatabase(Dependency dependency) {
// Implement local vulnerability database check
return new ArrayList<>();
}
/**
* Analyze dependency health metrics
*/
private void analyzeDependencyHealth(List<Dependency> dependencies, ScanResult result) {
DependencyHealthMetrics metrics = new DependencyHealthMetrics();
for (Dependency dependency : dependencies) {
metrics.analyzeDependency(dependency);
}
result.setHealthMetrics(metrics);
// Add metrics to result
result.addMetric("outdated_dependencies", metrics.getOutdatedCount());
result.addMetric("unmaintained_dependencies", metrics.getUnmaintainedCount());
result.addMetric("average_dependency_age", metrics.getAverageAgeInMonths());
}
/**
* Process and enrich scan results
*/
private void processScanResults(ScanResult result) {
// Process vulnerabilities
vulnProcessor.processVulnerabilities(result);
// Calculate risk scores
calculateRiskScores(result);
// Generate remediation guidance
generateRemediationGuidance(result);
// Update dependency graph
buildDependencyGraph(result);
}
/**
* Calculate overall risk scores
*/
private void calculateRiskScores(ScanResult result) {
RiskCalculator calculator = new RiskCalculator();
RiskAssessment assessment = calculator.assessRisk(result);
result.setRiskAssessment(assessment);
}
/**
* Generate remediation guidance
*/
private void generateRemediationGuidance(ScanResult result) {
RemediationEngine engine = new RemediationEngine();
RemediationPlan plan = engine.generateRemediationPlan(result);
result.setRemediationPlan(plan);
}
/**
* Build dependency graph with vulnerability information
*/
private void buildDependencyGraph(ScanResult result) {
DependencyGraphBuilder builder = new DependencyGraphBuilder();
DependencyGraph graph = builder.buildGraph(result.getDependencies(), 
result.getVulnerabilities());
result.setDependencyGraph(graph);
}
/**
* Generate comprehensive reports
*/
private void generateReports(ScanResult result) {
try {
// HTML Report
if (config.isHtmlReportEnabled()) {
Path htmlReport = reportGenerator.generateHtmlReport(result);
result.addReport(htmlReport, ReportType.HTML);
}
// JSON Report
if (config.isJsonReportEnabled()) {
Path jsonReport = reportGenerator.generateJsonReport(result);
result.addReport(jsonReport, ReportType.JSON);
}
// SARIF Report for GitHub
if (config.isSarifReportEnabled()) {
Path sarifReport = reportGenerator.generateSarifReport(result);
result.addReport(sarifReport, ReportType.SARIF);
}
// SPDX Report for license compliance
if (config.isSpdxReportEnabled()) {
Path spdxReport = reportGenerator.generateSpdxReport(result);
result.addReport(spdxReport, ReportType.SPDX);
}
// CSV Report for spreadsheet analysis
if (config.isCsvReportEnabled()) {
Path csvReport = reportGenerator.generateCsvReport(result);
result.addReport(csvReport, ReportType.CSV);
}
} catch (Exception e) {
result.addError(new ScanError("Report generation failed", e));
}
}
/**
* Upload results to Veracode platform
*/
private void uploadResults(ScanResult result) {
try {
VeracodeUploader uploader = new VeracodeUploader(config);
UploadResult uploadResult = uploader.uploadScanResults(result);
result.setUploadResult(uploadResult);
} catch (Exception e) {
result.addError(new ScanError("Results upload failed", e));
}
}
/**
* Validate project structure
*/
private void validateProjectStructure(ProjectContext context) {
List<String> errors = new ArrayList<>();
if (!Files.exists(context.getProjectDir())) {
errors.add("Project directory does not exist: " + context.getProjectDir());
}
// Check for build files
if (!hasBuildFile(context.getProjectDir())) {
errors.add("No build file (pom.xml, build.gradle) found");
}
// Validate API configuration
if (!config.isValid()) {
errors.add("SourceClear configuration is invalid");
}
if (!errors.isEmpty()) {
throw new ScanValidationException("Project validation failed: " + 
String.join(", ", errors));
}
}
private boolean hasBuildFile(Path projectDir) {
return Files.exists(projectDir.resolve("pom.xml")) ||
Files.exists(projectDir.resolve("build.gradle")) ||
Files.exists(projectDir.resolve("build.gradle.kts"));
}
/**
* Create HTTP client with proper configuration
*/
private HttpClient createHttpClient() {
return HttpClient.newBuilder()
.connectTimeout(Duration.ofSeconds(30))
.sslContext(createSSLContext())
.build();
}
private SSLContext createSSLContext() {
try {
return SSLContext.getDefault();
} catch (Exception e) {
throw new RuntimeException("Failed to create SSL context", e);
}
}
private Date parseDate(String dateString) {
try {
// Implement date parsing logic
return new Date(); // Placeholder
} catch (Exception e) {
return new Date();
}
}
public void shutdown() {
scanExecutor.shutdown();
try {
if (!scanExecutor.awaitTermination(60, TimeUnit.SECONDS)) {
scanExecutor.shutdownNow();
}
} catch (InterruptedException e) {
scanExecutor.shutdownNow();
Thread.currentThread().interrupt();
}
}
}

Data Models and Configuration

package com.titliel.veracode;
import java.nio.file.Path;
import java.util.*;
/**
* Project context for SourceClear scanning
*/
public class ProjectContext {
private final Path projectDir;
private final String projectName;
private final String version;
private final BuildTool buildTool;
private final Map<String, String> properties;
private final List<String> scanIncludes;
private final List<String> scanExcludes;
public ProjectContext(Path projectDir, String projectName) {
this.projectDir = projectDir;
this.projectName = projectName;
this.version = "1.0.0";
this.buildTool = detectBuildTool(projectDir);
this.properties = new HashMap<>();
this.scanIncludes = new ArrayList<>();
this.scanExcludes = new ArrayList<>();
// Default excludes
this.scanExcludes.add("**/test/**");
this.scanExcludes.add("**/target/**");
this.scanExcludes.add("**/build/**");
this.scanExcludes.add("**/node_modules/**");
}
// Builder pattern
public static class Builder {
private Path projectDir;
private String projectName;
private String version = "1.0.0";
private BuildTool buildTool;
private Map<String, String> properties = new HashMap<>();
private List<String> includes = new ArrayList<>();
private List<String> excludes = new ArrayList<>();
public Builder setProjectDir(Path projectDir) {
this.projectDir = projectDir;
return this;
}
public Builder setProjectName(String projectName) {
this.projectName = projectName;
return this;
}
public Builder setVersion(String version) {
this.version = version;
return this;
}
public Builder setBuildTool(BuildTool buildTool) {
this.buildTool = buildTool;
return this;
}
public Builder addProperty(String key, String value) {
this.properties.put(key, value);
return this;
}
public Builder addInclude(String pattern) {
this.includes.add(pattern);
return this;
}
public Builder addExclude(String pattern) {
this.excludes.add(pattern);
return this;
}
public ProjectContext build() {
ProjectContext context = new ProjectContext(projectDir, projectName);
context.version = version;
context.buildTool = buildTool != null ? buildTool : context.buildTool;
context.properties.putAll(properties);
context.scanIncludes.addAll(includes);
context.scanExcludes.addAll(excludes);
return context;
}
}
private static BuildTool detectBuildTool(Path projectDir) {
if (Files.exists(projectDir.resolve("pom.xml"))) {
return BuildTool.MAVEN;
} else if (Files.exists(projectDir.resolve("build.gradle")) || 
Files.exists(projectDir.resolve("build.gradle.kts"))) {
return BuildTool.GRADLE;
}
return BuildTool.UNKNOWN;
}
// Getters
public Path getProjectDir() { return projectDir; }
public String getProjectName() { return projectName; }
public String getVersion() { return version; }
public BuildTool getBuildTool() { return buildTool; }
public Map<String, String> getProperties() { return Collections.unmodifiableMap(properties); }
public List<String> getScanIncludes() { return Collections.unmodifiableList(scanIncludes); }
public List<String> getScanExcludes() { return Collections.unmodifiableList(scanExcludes); }
}
/**
* Comprehensive scan result container
*/
public class ScanResult {
private final ProjectContext context;
private final ScanType scanType;
private final List<Vulnerability> vulnerabilities;
private final List<LicenseViolation> licenseViolations;
private final List<Dependency> dependencies;
private final List<ScanError> errors;
private final Map<ReportType, Path> reports;
private final Map<String, Object> metrics;
private PolicyCheckResult policyResult;
private RiskAssessment riskAssessment;
private RemediationPlan remediationPlan;
private DependencyGraph dependencyGraph;
private DependencyHealthMetrics healthMetrics;
private UploadResult uploadResult;
private long scanDuration;
private Date scanTimestamp;
public ScanResult(ProjectContext context) {
this(context, ScanType.COMPREHENSIVE);
}
public ScanResult(ProjectContext context, ScanType scanType) {
this.context = context;
this.scanType = scanType;
this.vulnerabilities = new ArrayList<>();
this.licenseViolations = new ArrayList<>();
this.dependencies = new ArrayList<>();
this.errors = new ArrayList<>();
this.reports = new HashMap<>();
this.metrics = new HashMap<>();
this.scanTimestamp = new Date();
}
// Add methods
public void addVulnerability(Vulnerability vulnerability) {
this.vulnerabilities.add(vulnerability);
}
public void addVulnerabilities(List<Vulnerability> vulnerabilities) {
this.vulnerabilities.addAll(vulnerabilities);
}
public void addLicenseViolation(LicenseViolation violation) {
this.licenseViolations.add(violation);
}
public void addDependency(Dependency dependency) {
this.dependencies.add(dependency);
}
public void addError(ScanError error) {
this.errors.add(error);
}
public void addReport(Path reportPath, ReportType reportType) {
this.reports.put(reportType, reportPath);
}
public void addMetric(String key, Object value) {
this.metrics.put(key, value);
}
public void merge(ScanResult other) {
this.vulnerabilities.addAll(other.vulnerabilities);
this.licenseViolations.addAll(other.licenseViolations);
this.dependencies.addAll(other.dependencies);
this.errors.addAll(other.errors);
this.reports.putAll(other.reports);
this.metrics.putAll(other.metrics);
}
// Getters and setters
public ProjectContext getContext() { return context; }
public ScanType getScanType() { return scanType; }
public List<Vulnerability> getVulnerabilities() { return Collections.unmodifiableList(vulnerabilities); }
public List<LicenseViolation> getLicenseViolations() { return Collections.unmodifiableList(licenseViolations); }
public List<Dependency> getDependencies() { return Collections.unmodifiableList(dependencies); }
public void setDependencies(List<Dependency> dependencies) { this.dependencies.clear(); this.dependencies.addAll(dependencies); }
public List<ScanError> getErrors() { return Collections.unmodifiableList(errors); }
public Map<ReportType, Path> getReports() { return Collections.unmodifiableMap(reports); }
public Map<String, Object> getMetrics() { return Collections.unmodifiableMap(metrics); }
public PolicyCheckResult getPolicyResult() { return policyResult; }
public void setPolicyResult(PolicyCheckResult policyResult) { this.policyResult = policyResult; }
public RiskAssessment getRiskAssessment() { return riskAssessment; }
public void setRiskAssessment(RiskAssessment riskAssessment) { this.riskAssessment = riskAssessment; }
public RemediationPlan getRemediationPlan() { return remediationPlan; }
public void setRemediationPlan(RemediationPlan remediationPlan) { this.remediationPlan = remediationPlan; }
public DependencyGraph getDependencyGraph() { return dependencyGraph; }
public void setDependencyGraph(DependencyGraph dependencyGraph) { this.dependencyGraph = dependencyGraph; }
public DependencyHealthMetrics getHealthMetrics() { return healthMetrics; }
public void setHealthMetrics(DependencyHealthMetrics healthMetrics) { this.healthMetrics = healthMetrics; }
public UploadResult getUploadResult() { return uploadResult; }
public void setUploadResult(UploadResult uploadResult) { this.uploadResult = uploadResult; }
public long getScanDuration() { return scanDuration; }
public void setScanDuration(long scanDuration) { this.scanDuration = scanDuration; }
public Date getScanTimestamp() { return scanTimestamp; }
// Statistics methods
public int getTotalVulnerabilities() { return vulnerabilities.size(); }
public int getCriticalVulnerabilities() { return countVulnerabilitiesBySeverity(SeverityLevel.CRITICAL); }
public int getHighVulnerabilities() { return countVulnerabilitiesBySeverity(SeverityLevel.HIGH); }
public int getMediumVulnerabilities() { return countVulnerabilitiesBySeverity(SeverityLevel.MEDIUM); }
public int getLowVulnerabilities() { return countVulnerabilitiesBySeverity(SeverityLevel.LOW); }
public int getTotalLicenseViolations() { return licenseViolations.size(); }
public int getCriticalLicenseViolations() { return countLicenseViolationsBySeverity(SeverityLevel.CRITICAL); }
public boolean hasCriticalIssues() {
return getCriticalVulnerabilities() > 0 || getCriticalLicenseViolations() > 0;
}
public boolean isScanSuccessful() {
return errors.isEmpty();
}
public boolean isPolicyCompliant() {
return policyResult != null && policyResult.isCompliant();
}
private int countVulnerabilitiesBySeverity(SeverityLevel severity) {
return (int) vulnerabilities.stream()
.filter(v -> v.getSeverity() == severity)
.count();
}
private int countLicenseViolationsBySeverity(SeverityLevel severity) {
return (int) licenseViolations.stream()
.filter(v -> v.getSeverity() == severity)
.count();
}
}
/**
* Dependency representation
*/
public class Dependency {
private final String groupId;
private final String artifactId;
private final String version;
private final String scope;
private final List<License> licenses;
private final Date lastUpdated;
private final DependencyHealth health;
public Dependency(String groupId, String artifactId, String version, String scope) {
this.groupId = groupId;
this.artifactId = artifactId;
this.version = version;
this.scope = scope;
this.licenses = new ArrayList<>();
this.lastUpdated = new Date();
this.health = new DependencyHealth();
}
// Getters
public String getGroupId() { return groupId; }
public String getArtifactId() { return artifactId; }
public String getVersion() { return version; }
public String getScope() { return scope; }
public List<License> getLicenses() { return Collections.unmodifiableList(licenses); }
public Date getLastUpdated() { return lastUpdated; }
public DependencyHealth getHealth() { return health; }
public String getCoordinates() {
return groupId + ":" + artifactId + ":" + version;
}
public void addLicense(License license) {
this.licenses.add(license);
}
@Override
public boolean equals(Object o) {
if (this == o) return true;
if (o == null || getClass() != o.getClass()) return false;
Dependency that = (Dependency) o;
return Objects.equals(groupId, that.groupId) &&
Objects.equals(artifactId, that.artifactId) &&
Objects.equals(version, that.version);
}
@Override
public int hashCode() {
return Objects.hash(groupId, artifactId, version);
}
}
/**
* Vulnerability representation
*/
public class Vulnerability {
private String id;
private String title;
private String description;
private SeverityLevel severity;
private double cvssScore;
private String cweId;
private Date publishedDate;
private Dependency affectedDependency;
private String remediation;
private String fixedVersion;
private boolean exploitAvailable;
private String exploitMaturity;
private Map<String, Object> metadata;
public Vulnerability() {
this.metadata = new HashMap<>();
}
// Getters and setters
public String getId() { return id; }
public void setId(String id) { this.id = id; }
public String getTitle() { return title; }
public void setTitle(String title) { this.title = title; }
public String getDescription() { return description; }
public void setDescription(String description) { this.description = description; }
public SeverityLevel getSeverity() { return severity; }
public void setSeverity(SeverityLevel severity) { this.severity = severity; }
public double getCvssScore() { return cvssScore; }
public void setCvssScore(double cvssScore) { this.cvssScore = cvssScore; }
public String getCweId() { return cweId; }
public void setCweId(String cweId) { this.cweId = cweId; }
public Date getPublishedDate() { return publishedDate; }
public void setPublishedDate(Date publishedDate) { this.publishedDate = publishedDate; }
public Dependency getAffectedDependency() { return affectedDependency; }
public void setAffectedDependency(Dependency affectedDependency) { this.affectedDependency = affectedDependency; }
public String getRemediation() { return remediation; }
public void setRemediation(String remediation) { this.remediation = remediation; }
public String getFixedVersion() { return fixedVersion; }
public void setFixedVersion(String fixedVersion) { this.fixedVersion = fixedVersion; }
public boolean isExploitAvailable() { return exploitAvailable; }
public void setExploitAvailable(boolean exploitAvailable) { this.exploitAvailable = exploitAvailable; }
public String getExploitMaturity() { return exploitMaturity; }
public void setExploitMaturity(String exploitMaturity) { this.exploitMaturity = exploitMaturity; }
public Map<String, Object> getMetadata() { return Collections.unmodifiableMap(metadata); }
public void addMetadata(String key, Object value) { this.metadata.put(key, value); }
}
/**
* License violation representation
*/
public class LicenseViolation {
private final License license;
private final Dependency dependency;
private final String violationType;
private final SeverityLevel severity;
private final String description;
public LicenseViolation(License license, Dependency dependency, String violationType, 
SeverityLevel severity, String description) {
this.license = license;
this.dependency = dependency;
this.violationType = violationType;
this.severity = severity;
this.description = description;
}
// Getters
public License getLicense() { return license; }
public Dependency getDependency() { return dependency; }
public String getViolationType() { return violationType; }
public SeverityLevel getSeverity() { return severity; }
public String getDescription() { return description; }
}
/**
* Enums and supporting classes
*/
public enum ScanType {
DEPENDENCY_INVENTORY, LICENSE_COMPLIANCE, VULNERABILITY_ANALYSIS, 
POLICY_COMPLIANCE, COMPREHENSIVE
}
public enum BuildTool {
MAVEN, GRADLE, UNKNOWN
}
public enum SeverityLevel {
CRITICAL, HIGH, MEDIUM, LOW, INFO;
public static SeverityLevel fromString(String severity) {
try {
return SeverityLevel.valueOf(severity.toUpperCase());
} catch (IllegalArgumentException e) {
return INFO;
}
}
}
public enum ReportType {
HTML, JSON, SARIF, SPDX, CSV, PDF
}
/**
* License information
*/
public class License {
private final String id;
private final String name;
private final String url;
private final boolean osiApproved;
private final RiskLevel riskLevel;
public License(String id, String name, String url, boolean osiApproved, RiskLevel riskLevel) {
this.id = id;
this.name = name;
this.url = url;
this.osiApproved = osiApproved;
this.riskLevel = riskLevel;
}
// Getters
public String getId() { return id; }
public String getName() { return name; }
public String getUrl() { return url; }
public boolean isOsiApproved() { return osiApproved; }
public RiskLevel getRiskLevel() { return riskLevel; }
}
public enum RiskLevel {
HIGH, MEDIUM, LOW, NONE
}
/**
* Dependency health metrics
*/
public class DependencyHealth {
private boolean outdated;
private boolean unmaintained;
private boolean deprecated;
private int monthsSinceUpdate;
private int vulnerabilityCount;
private double healthScore;
// Getters and setters
public boolean isOutdated() { return outdated; }
public void setOutdated(boolean outdated) { this.outdated = outdated; }
public boolean isUnmaintained() { return unmaintained; }
public void setUnmaintained(boolean unmaintained) { this.unmaintained = unmaintained; }
public boolean isDeprecated() { return deprecated; }
public void setDeprecated(boolean deprecated) { this.deprecated = deprecated; }
public int getMonthsSinceUpdate() { return monthsSinceUpdate; }
public void setMonthsSinceUpdate(int monthsSinceUpdate) { this.monthsSinceUpdate = monthsSinceUpdate; }
public int getVulnerabilityCount() { return vulnerabilityCount; }
public void setVulnerabilityCount(int vulnerabilityCount) { this.vulnerabilityCount = vulnerabilityCount; }
public double getHealthScore() { return healthScore; }
public void setHealthScore(double healthScore) { this.healthScore = healthScore; }
}

Dependency Resolution and Analysis

package com.titliel.veracode;
import java.io.*;
import java.nio.file.*;
import java.util.*;
import javax.xml.parsers.DocumentBuilder;
import javax.xml.parsers.DocumentBuilderFactory;
import org.w3c.dom.Document;
import org.w3c.dom.Element;
import org.w3c.dom.NodeList;
/**
* Dependency resolver for different build tools
*/
public class DependencyResolver {
public List<Dependency> resolveDependencies(ProjectContext context) {
switch (context.getBuildTool()) {
case MAVEN:
return resolveMavenDependencies(context);
case GRADLE:
return resolveGradleDependencies(context);
default:
throw new UnsupportedOperationException(
"Unsupported build tool: " + context.getBuildTool());
}
}
/**
* Resolve Maven dependencies from pom.xml
*/
private List<Dependency> resolveMavenDependencies(ProjectContext context) {
List<Dependency> dependencies = new ArrayList<>();
try {
Path pomFile = context.getProjectDir().resolve("pom.xml");
DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
DocumentBuilder builder = factory.newDocumentBuilder();
Document document = builder.parse(pomFile.toFile());
// Parse dependencies
NodeList dependencyNodes = document.getElementsByTagName("dependency");
for (int i = 0; i < dependencyNodes.getLength(); i++) {
Element dependencyElement = (Element) dependencyNodes.item(i);
Dependency dependency = parseMavenDependency(dependencyElement);
if (dependency != null) {
dependencies.add(dependency);
}
}
// Parse dependency management
parseDependencyManagement(document, dependencies);
// Resolve transitive dependencies (simplified)
resolveTransitiveDependencies(dependencies, context);
} catch (Exception e) {
throw new RuntimeException("Failed to resolve Maven dependencies", e);
}
return dependencies;
}
/**
* Parse individual Maven dependency
*/
private Dependency parseMavenDependency(Element dependencyElement) {
String groupId = getElementText(dependencyElement, "groupId");
String artifactId = getElementText(dependencyElement, "artifactId");
String version = getElementText(dependencyElement, "version");
String scope = getElementText(dependencyElement, "scope", "compile");
if (groupId == null || artifactId == null || version == null) {
return null;
}
Dependency dependency = new Dependency(groupId, artifactId, version, scope);
// Parse licenses
NodeList licenseNodes = dependencyElement.getElementsByTagName("license");
for (int i = 0; i < licenseNodes.getLength(); i++) {
Element licenseElement = (Element) licenseNodes.item(i);
License license = parseMavenLicense(licenseElement);
if (license != null) {
dependency.addLicense(license);
}
}
return dependency;
}
/**
* Parse Maven license information
*/
private License parseMavenLicense(Element licenseElement) {
String name = getElementText(licenseElement, "name");
String url = getElementText(licenseElement, "url");
if (name == null) {
return null;
}
// Determine license ID and risk level
String licenseId = inferLicenseId(name);
RiskLevel riskLevel = assessLicenseRisk(licenseId);
return new License(licenseId, name, url, isOsiApproved(licenseId), riskLevel);
}
/**
* Parse dependency management section
*/
private void parseDependencyManagement(Document document, List<Dependency> dependencies) {
// Implement dependency management parsing
// This would handle version inheritance and BOM imports
}
/**
* Resolve transitive dependencies (simplified)
*/
private void resolveTransitiveDependencies(List<Dependency> directDependencies, 
ProjectContext context) {
// In a real implementation, this would use Maven/Gradle APIs
// to resolve the complete dependency tree
Set<Dependency> allDependencies = new HashSet<>(directDependencies);
for (Dependency directDep : directDependencies) {
List<Dependency> transitive = resolveTransitiveForDependency(directDep, context);
allDependencies.addAll(transitive);
}
directDependencies.clear();
directDependencies.addAll(allDependencies);
}
private List<Dependency> resolveTransitiveForDependency(Dependency dependency, 
ProjectContext context) {
// Simplified transitive dependency resolution
// Real implementation would require dependency graph resolution
return new ArrayList<>();
}
/**
* Resolve Gradle dependencies
*/
private List<Dependency> resolveGradleDependencies(ProjectContext context) {
List<Dependency> dependencies = new ArrayList<>();
try {
// Execute gradle dependencies command
ProcessBuilder processBuilder = new ProcessBuilder(
"gradle", "dependencies", "--configuration", "compileClasspath");
processBuilder.directory(context.getProjectDir().toFile());
Process process = processBuilder.start();
String output = readProcessOutput(process);
dependencies = parseGradleDependencies(output);
} catch (Exception e) {
// Fallback to parsing build.gradle directly
dependencies = parseGradleBuildFile(context.getProjectDir());
}
return dependencies;
}
/**
* Parse Gradle dependencies output
*/
private List<Dependency> parseGradleDependencies(String output) {
List<Dependency> dependencies = new ArrayList<>();
// Implement Gradle dependencies output parsing
// This is a simplified version
String[] lines = output.split("\n");
for (String line : lines) {
if (line.contains("---") && line.contains(":")) {
Dependency dependency = parseGradleDependencyLine(line);
if (dependency != null) {
dependencies.add(dependency);
}
}
}
return dependencies;
}
private Dependency parseGradleDependencyLine(String line) {
// Simplified Gradle dependency parsing
// Real implementation would be more complex
try {
String[] parts = line.trim().split(":");
if (parts.length >= 3) {
String groupId = parts[0];
String artifactId = parts[1];
String version = parts[2].split(" ")[0]; // Remove extra info
return new Dependency(groupId, artifactId, version, "compile");
}
} catch (Exception e) {
// Skip malformed lines
}
return null;
}
/**
* Parse Gradle build file directly
*/
private List<Dependency> parseGradleBuildFile(Path projectDir) {
// Implement Gradle build file parsing
return new ArrayList<>();
}
// Utility methods
private String getElementText(Element parent, String tagName) {
return getElementText(parent, tagName, null);
}
private String getElementText(Element parent, String tagName, String defaultValue) {
NodeList nodes = parent.getElementsByTagName(tagName);
if (nodes.getLength() > 0) {
return nodes.item(0).getTextContent().trim();
}
return defaultValue;
}
private String readProcessOutput(Process process) throws IOException {
try (BufferedReader reader = new BufferedReader(
new InputStreamReader(process.getInputStream()))) {
StringBuilder output = new StringBuilder();
String line;
while ((line = reader.readLine()) != null) {
output.append(line).append("\n");
}
return output.toString();
}
}
private String inferLicenseId(String licenseName) {
// Map common license names to SPDX IDs
Map<String, String> licenseMap = new HashMap<>();
licenseMap.put("Apache License 2.0", "Apache-2.0");
licenseMap.put("MIT License", "MIT");
licenseMap.put("GPL 3.0", "GPL-3.0");
// Add more mappings
return licenseMap.getOrDefault(licenseName, "UNKNOWN");
}
private RiskLevel assessLicenseRisk(String licenseId) {
Map<String, RiskLevel> riskMap = new HashMap<>();
riskMap.put("GPL-3.0", RiskLevel.HIGH);
riskMap.put("AGPL-3.0", RiskLevel.HIGH);
riskMap.put("LGPL-3.0", RiskLevel.MEDIUM);
riskMap.put("Apache-2.0", RiskLevel.LOW);
riskMap.put("MIT", RiskLevel.LOW);
riskMap.put("BSD-2-Clause", RiskLevel.LOW);
riskMap.put("BSD-3-Clause", RiskLevel.LOW);
return riskMap.getOrDefault(licenseId, RiskLevel.MEDIUM);
}
private boolean isOsiApproved(String licenseId) {
Set<String> osiApproved = Set.of(
"Apache-2.0", "MIT", "BSD-2-Clause", "BSD-3-Clause", 
"GPL-3.0", "LGPL-3.0"
);
return osiApproved.contains(licenseId);
}
}
/**
* License analyzer for compliance checking
*/
class LicenseAnalyzer {
public List<LicenseViolation> analyzeLicenses(ProjectContext context) {
List<LicenseViolation> violations = new ArrayList<>();
try {
DependencyResolver resolver = new DependencyResolver();
List<Dependency> dependencies = resolver.resolveDependencies(context);
for (Dependency dependency : dependencies) {
for (License license : dependency.getLicenses()) {
LicenseViolation violation = checkLicenseCompliance(license, dependency);
if (violation != null) {
violations.add(violation);
}
}
}
} catch (Exception e) {
throw new RuntimeException("License analysis failed", e);
}
return violations;
}
private LicenseViolation checkLicenseCompliance(License license, Dependency dependency) {
// Check against organizational policy
if (license.getRiskLevel() == RiskLevel.HIGH) {
return new LicenseViolation(
license, dependency, "HIGH_RISK_LICENSE", 
SeverityLevel.CRITICAL,
"High-risk license detected: " + license.getName()
);
}
if (!license.isOsiApproved()) {
return new LicenseViolation(
license, dependency, "NON_OSI_APPROVED", 
SeverityLevel.MEDIUM,
"Non-OSI approved license: " + license.getName()
);
}
// Add more license policy checks
return null;
}
}

Policy Engine and Risk Assessment

package com.titliel.veracode;
import java.util.*;
/**
* Policy engine for security and compliance checks
*/
public class PolicyEngine {
private final List<PolicyRule> rules;
private final PolicyConfig config;
public PolicyEngine() {
this.config = PolicyConfig.getInstance();
this.rules = loadPolicyRules();
}
public PolicyCheckResult evaluatePolicy(ScanResult scanResult) {
PolicyCheckResult result = new PolicyCheckResult();
for (PolicyRule rule : rules) {
if (rule.isEnabled()) {
PolicyViolation violation = rule.evaluate(scanResult);
if (violation != null) {
result.addViolation(violation);
}
}
}
result.setCompliant(result.getViolations().isEmpty());
return result;
}
private List<PolicyRule> loadPolicyRules() {
List<PolicyRule> rules = new ArrayList<>();
// Critical vulnerability policy
rules.add(new CriticalVulnerabilityPolicy());
// High vulnerability count policy
rules.add(new HighVulnerabilityCountPolicy());
// License compliance policy
rules.add(new LicenseCompliancePolicy());
// Outdated dependencies policy
rules.add(new OutdatedDependenciesPolicy());
// Custom organizational policies
rules.addAll(loadCustomPolicies());
return rules;
}
private List<PolicyRule> loadCustomPolicies() {
// Load custom policies from configuration
return new ArrayList<>();
}
}
/**
* Policy rule interface
*/
interface PolicyRule {
boolean isEnabled();
PolicyViolation evaluate(ScanResult scanResult);
}
/**
* Critical vulnerability policy
*/
class CriticalVulnerabilityPolicy implements PolicyRule {
@Override
public boolean isEnabled() {
return true; // Typically enabled by default
}
@Override
public PolicyViolation evaluate(ScanResult scanResult) {
if (scanResult.getCriticalVulnerabilities() > 0) {
return new PolicyViolation(
"CRITICAL_VULNERABILITIES",
SeverityLevel.CRITICAL,
"Critical vulnerabilities detected: " + 
scanResult.getCriticalVulnerabilities(),
"Fix all critical vulnerabilities before deployment"
);
}
return null;
}
}
/**
* High vulnerability count policy
*/
class HighVulnerabilityCountPolicy implements PolicyRule {
private static final int MAX_HIGH_VULNERABILITIES = 10;
@Override
public boolean isEnabled() {
return true;
}
@Override
public PolicyViolation evaluate(ScanResult scanResult) {
if (scanResult.getHighVulnerabilities() > MAX_HIGH_VULNERABILITIES) {
return new PolicyViolation(
"EXCESSIVE_HIGH_VULNERABILITIES",
SeverityLevel.HIGH,
"Too many high severity vulnerabilities: " + 
scanResult.getHighVulnerabilities() + " (max: " + MAX_HIGH_VULNERABILITIES + ")",
"Reduce high severity vulnerabilities below threshold"
);
}
return null;
}
}
/**
* License compliance policy
*/
class LicenseCompliancePolicy implements PolicyRule {
@Override
public boolean isEnabled() {
return true;
}
@Override
public PolicyViolation evaluate(ScanResult scanResult) {
if (scanResult.getCriticalLicenseViolations() > 0) {
return new PolicyViolation(
"CRITICAL_LICENSE_VIOLATIONS",
SeverityLevel.CRITICAL,
"Critical license violations detected: " + 
scanResult.getCriticalLicenseViolations(),
"Remove or replace dependencies with critical license violations"
);
}
return null;
}
}
/**
* Outdated dependencies policy
*/
class OutdatedDependenciesPolicy implements PolicyRule {
private static final double MAX_OUTDATED_PERCENTAGE = 0.2; // 20%
@Override
public boolean isEnabled() {
return true;
}
@Override
public PolicyViolation evaluate(ScanResult scanResult) {
DependencyHealthMetrics metrics = scanResult.getHealthMetrics();
if (metrics != null) {
double outdatedPercentage = (double) metrics.getOutdatedCount() / 
scanResult.getDependencies().size();
if (outdatedPercentage > MAX_OUTDATED_PERCENTAGE) {
return new PolicyViolation(
"EXCESSIVE_OUTDATED_DEPENDENCIES",
SeverityLevel.MEDIUM,
String.format("Too many outdated dependencies: %.1f%% (max: %.1f%%)", 
outdatedPercentage * 100, MAX_OUTDATED_PERCENTAGE * 100),
"Update outdated dependencies to recent versions"
);
}
}
return null;
}
}
/**
* Policy check result
*/
public class PolicyCheckResult {
private final List<PolicyViolation> violations;
private boolean compliant;
public PolicyCheckResult() {
this.violations = new ArrayList<>();
this.compliant = true;
}
public void addViolation(PolicyViolation violation) {
this.violations.add(violation);
this.compliant = false;
}
// Getters
public List<PolicyViolation> getViolations() { return Collections.unmodifiableList(violations); }
public boolean isCompliant() { return compliant; }
public void setCompliant(boolean compliant) { this.compliant = compliant; }
}
/**
* Policy violation representation
*/
public class PolicyViolation {
private final String ruleId;
private final SeverityLevel severity;
private final String description;
private final String remediation;
public PolicyViolation(String ruleId, SeverityLevel severity, 
String description, String remediation) {
this.ruleId = ruleId;
this.severity = severity;
this.description = description;
this.remediation = remediation;
}
// Getters
public String getRuleId() { return ruleId; }
public SeverityLevel getSeverity() { return severity; }
public String getDescription() { return description; }
public String getRemediation() { return remediation; }
}
/**
* Risk assessment calculator
*/
public class RiskCalculator {
public RiskAssessment assessRisk(ScanResult scanResult) {
RiskAssessment assessment = new RiskAssessment();
// Calculate vulnerability risk
double vulnerabilityRisk = calculateVulnerabilityRisk(scanResult);
assessment.setVulnerabilityRisk(vulnerabilityRisk);
// Calculate license risk
double licenseRisk = calculateLicenseRisk(scanResult);
assessment.setLicenseRisk(licenseRisk);
// Calculate dependency health risk
double healthRisk = calculateHealthRisk(scanResult);
assessment.setHealthRisk(healthRisk);
// Calculate overall risk
double overallRisk = calculateOverallRisk(vulnerabilityRisk, licenseRisk, healthRisk);
assessment.setOverallRisk(overallRisk);
assessment.setRiskLevel(determineRiskLevel(overallRisk));
return assessment;
}
private double calculateVulnerabilityRisk(ScanResult scanResult) {
double risk = 0.0;
risk += scanResult.getCriticalVulnerabilities() * 10.0;
risk += scanResult.getHighVulnerabilities() * 5.0;
risk += scanResult.getMediumVulnerabilities() * 2.0;
risk += scanResult.getLowVulnerabilities() * 0.5;
// Normalize based on total dependencies
int totalDeps = scanResult.getDependencies().size();
if (totalDeps > 0) {
risk = (risk / totalDeps) * 10.0; // Scale to 0-10
}
return Math.min(risk, 10.0);
}
private double calculateLicenseRisk(ScanResult scanResult) {
double risk = 0.0;
risk += scanResult.getCriticalLicenseViolations() * 8.0;
risk += (scanResult.getTotalLicenseViolations() - 
scanResult.getCriticalLicenseViolations()) * 3.0;
return Math.min(risk, 10.0);
}
private double calculateHealthRisk(ScanResult scanResult) {
DependencyHealthMetrics metrics = scanResult.getHealthMetrics();
if (metrics == null) return 0.0;
double risk = 0.0;
risk += metrics.getOutdatedCount() * 0.5;
risk += metrics.getUnmaintainedCount() * 2.0;
// Average age factor
if (metrics.getAverageAgeInMonths() > 24) {
risk += 3.0;
} else if (metrics.getAverageAgeInMonths() > 12) {
risk += 1.5;
}
return Math.min(risk, 10.0);
}
private double calculateOverallRisk(double vulnRisk, double licenseRisk, double healthRisk) {
// Weighted average based on importance
return (vulnRisk * 0.6) + (licenseRisk * 0.3) + (healthRisk * 0.1);
}
private RiskLevel determineRiskLevel(double riskScore) {
if (riskScore >= 7.5) return RiskLevel.HIGH;
if (riskScore >= 5.0) return RiskLevel.MEDIUM;
if (riskScore >= 2.5) return RiskLevel.LOW;
return RiskLevel.NONE;
}
}
/**
* Risk assessment result
*/
public class RiskAssessment {
private double overallRisk;
private double vulnerabilityRisk;
private double licenseRisk;
private double healthRisk;
private RiskLevel riskLevel;
// Getters and setters
public double getOverallRisk() { return overallRisk; }
public void setOverallRisk(double overallRisk) { this.overallRisk = overallRisk; }
public double getVulnerabilityRisk() { return vulnerabilityRisk; }
public void setVulnerabilityRisk(double vulnerabilityRisk) { this.vulnerabilityRisk = vulnerabilityRisk; }
public double getLicenseRisk() { return licenseRisk; }
public void setLicenseRisk(double licenseRisk) { this.licenseRisk = licenseRisk; }
public double getHealthRisk() { return healthRisk; }
public void setHealthRisk(double healthRisk) { this.healthRisk = healthRisk; }
public RiskLevel getRiskLevel() { return riskLevel; }
public void setRiskLevel(RiskLevel riskLevel) { this.riskLevel = riskLevel; }
}
/**
* Dependency health metrics calculator
*/
public class DependencyHealthMetrics {
private int outdatedCount = 0;
private int unmaintainedCount = 0;
private int totalMonths = 0;
private int dependencyCount = 0;
public void analyzeDependency(Dependency dependency) {
dependencyCount++;
DependencyHealth health = dependency.getHealth();
if (health.isOutdated()) {
outdatedCount++;
}
if (health.isUnmaintained()) {
unmaintainedCount++;
}
if (health.getMonthsSinceUpdate() > 0) {
totalMonths += health.getMonthsSinceUpdate();
}
}
// Getters
public int getOutdatedCount() { return outdatedCount; }
public int getUnmaintainedCount() { return unmaintainedCount; }
public double getAverageAgeInMonths() { 
return dependencyCount > 0 ? (double) totalMonths / dependencyCount : 0.0; 
}
}

Configuration Management

package com.titliel.veracode;
import java.io.*;
import java.util.*;
/**
* SourceClear configuration manager
*/
public class SourceClearConfig {
private static SourceClearConfig instance;
private final Properties properties;
private SourceClearConfig() {
this.properties = loadProperties();
}
public static synchronized SourceClearConfig getInstance() {
if (instance == null) {
instance = new SourceClearConfig();
}
return instance;
}
private Properties loadProperties() {
Properties props = new Properties();
// Load from system properties first
props.putAll(System.getProperties());
// Load from configuration file
try (InputStream input = getClass().getClassLoader()
.getResourceAsStream("sourceclear.properties")) {
if (input != null) {
props.load(input);
}
} catch (Exception e) {
// Use defaults
}
// Load from environment variables
loadFromEnvironment(props);
// Set defaults for missing properties
setDefaults(props);
return props;
}
private void loadFromEnvironment(Properties props) {
// API Key
String apiKey = System.getenv("SOURCECLEAR_API_KEY");
if (apiKey != null) {
props.setProperty("sourceclear.api.key", apiKey);
}
// API URL
String apiUrl = System.getenv("SOURCECLEAR_API_URL");
if (apiUrl != null) {
props.setProperty("sourceclear.api.url", apiUrl);
}
// Organization ID
String orgId = System.getenv("SOURCECLEAR_ORG_ID");
if (orgId != null) {
props.setProperty("sourceclear.org.id", orgId);
}
}
private void setDefaults(Properties props) {
props.setProperty("sourceclear.api.url", "https://api.sourceclear.com");
props.setProperty("sourceclear.thread.count", "4");
props.setProperty("sourceclear.upload.enabled", "true");
props.setProperty("sourceclear.report.html.enabled", "true");
props.setProperty("sourceclear.report.json.enabled", "true");
props.setProperty("sourceclear.report.sarif.enabled", "true");
props.setProperty("sourceclear.report.spdx.enabled", "false");
props.setProperty("sourceclear.report.csv.enabled", "false");
props.setProperty("sourceclear.timeout.seconds", "30");
}
// Getters
public String getApiKey() {
return properties.getProperty("sourceclear.api.key");
}
public String getApiBaseUrl() {
return properties.getProperty("sourceclear.api.url", "https://api.sourceclear.com");
}
public String getOrgId() {
return properties.getProperty("sourceclear.org.id");
}
public int getThreadCount() {
return Integer.parseInt(properties.getProperty("sourceclear.thread.count", "4"));
}
public int getTimeoutSeconds() {
return Integer.parseInt(properties.getProperty("sourceclear.timeout.seconds", "30"));
}
public boolean isUploadEnabled() {
return Boolean.parseBoolean(properties.getProperty("sourceclear.upload.enabled", "true"));
}
public boolean isHtmlReportEnabled() {
return Boolean.parseBoolean(properties.getProperty("sourceclear.report.html.enabled", "true"));
}
public boolean isJsonReportEnabled() {
return Boolean.parseBoolean(properties.getProperty("sourceclear.report.json.enabled", "true"));
}
public boolean isSarifReportEnabled() {
return Boolean.parseBoolean(properties.getProperty("sourceclear.report.sarif.enabled", "true"));
}
public boolean isSpdxReportEnabled() {
return Boolean.parseBoolean(properties.getProperty("sourceclear.report.spdx.enabled", "false"));
}
public boolean isCsvReportEnabled() {
return Boolean.parseBoolean(properties.getProperty("sourceclear.report.csv.enabled", "false"));
}
public boolean isValid() {
return getApiKey() != null && !getApiKey().isEmpty();
}
public void setProperty(String key, String value) {
properties.setProperty(key, value);
}
}
/**
* Policy configuration
*/
class PolicyConfig {
private static PolicyConfig instance;
private final Properties properties;
private PolicyConfig() {
this.properties = loadProperties();
}
public static synchronized PolicyConfig getInstance() {
if (instance == null) {
instance = new PolicyConfig();
}
return instance;
}
private Properties loadProperties() {
Properties props = new Properties();
// Load policy configuration
return props;
}
}

Usage Examples

package com.titliel.examples;
import com.titliel.veracode.TitlielSourceClearScanner;
import com.titliel.veracode.ProjectContext;
import com.titliel.veracode.ScanResult;
import java.nio.file.Paths;
/**
* Example usage of Titliel SourceClear Scanner
*/
public class SourceClearScanExample {
public static void main(String[] args) {
// Create project context
ProjectContext context = new ProjectContext.Builder()
.setProjectDir(Paths.get("/path/to/your/project"))
.setProjectName("my-spring-boot-app")
.setVersion("1.0.0")
.addExclude("**/generated/**")
.addProperty("java.version", "11")
.build();
// Create scanner
TitlielSourceClearScanner scanner = new TitlielSourceClearScanner();
try {
// Perform comprehensive scan
ScanResult result = scanner.scanProject(context);
// Analyze and act on results
processScanResults(result);
} finally {
scanner.shutdown();
}
}
private static void processScanResults(ScanResult result) {
System.out.println("=== Veracode SourceClear Scan Results ===");
System.out.println("Scan Duration: " + result.getScanDuration() + "ms");
System.out.println("Total Dependencies: " + result.getDependencies().size());
System.out.println("Total Vulnerabilities: " + result.getTotalVulnerabilities());
System.out.println("Critical: " + result.getCriticalVulnerabilities());
System.out.println("High: " + result.getHighVulnerabilities());
System.out.println("License Violations: " + result.getTotalLicenseViolations());
// Risk assessment
if (result.getRiskAssessment() != null) {
System.out.println("Overall Risk: " + result.getRiskAssessment().getOverallRisk());
System.out.println("Risk Level: " + result.getRiskAssessment().getRiskLevel());
}
// Policy compliance
if (result.getPolicyResult() != null) {
System.out.println("Policy Compliant: " + result.isPolicyCompliant());
if (!result.isPolicyCompliant()) {
System.out.println("Policy Violations:");
result.getPolicyResult().getViolations().forEach(violation -> 
System.out.println("  - " + violation.getDescription()));
}
}
// Critical issues check
if (result.hasCriticalIssues()) {
System.out.println("🚨 CRITICAL ISSUES DETECTED!");
// Fail build or trigger alerts
}
// Generate reports path
result.getReports().forEach((type, path) -> 
System.out.println("Report generated: " + type + " -> " + path));
}
}
/**
* CI/CD Integration Example
*/
class CICDIntegration {
public boolean performSecurityGate(ProjectContext context) {
TitlielSourceClearScanner scanner = new TitlielSourceClearScanner();
try {
ScanResult result = scanner.scanProject(context);
// Check policy compliance
if (!result.isPolicyCompliant()) {
System.err.println("Build failed: Policy violations detected");
logPolicyViolations(result);
return false;
}
// Check for critical vulnerabilities
if (result.hasCriticalIssues()) {
System.err.println("Build failed: Critical security issues detected");
return false;
}
// Check risk level
if (result.getRiskAssessment() != null && 
result.getRiskAssessment().getRiskLevel() == RiskLevel.HIGH) {
System.err.println("Build failed: High risk level detected");
return false;
}
System.out.println("Security gate passed");
return true;
} finally {
scanner.shutdown();
}
}
private void logPolicyViolations(ScanResult result) {
result.getPolicyResult().getViolations().forEach(violation -> {
System.err.println("Policy Violation: " + violation.getDescription());
System.err.println("  Remediation: " + violation.getRemediation());
});
}
public void generateComplianceReport(ProjectContext context) {
TitlielSourceClearScanner scanner = new TitlielSourceClearScanner();
try {
ScanResult result = scanner.scanProject(context);
// Generate compliance reports
if (result.getReports().containsKey(ReportType.SPDX)) {
uploadSpdxReport(result.getReports().get(ReportType.SPDX));
}
// Send to security dashboard
sendToSecurityDashboard(result);
} finally {
scanner.shutdown();
}
}
private void uploadSpdxReport(Path spdxReport) {
// Upload SPDX report to compliance system
System.out.println("Uploading SPDX report: " + spdxReport);
}
private void sendToSecurityDashboard(ScanResult result) {
// Send results to security dashboard
System.out.println("Sending scan results to security dashboard");
}
}
/**
* Remediation Workflow Example
*/
class RemediationWorkflow {
public void handleVulnerabilityRemediation(ScanResult result) {
if (result.getRemediationPlan() != null) {
RemediationPlan plan = result.getRemediationPlan();
System.out.println("=== Remediation Plan ===");
System.out.println("Total actions: " + plan.getActions().size());
System.out.println("Estimated effort: " + plan.getEstimatedEffort());
// Process remediation actions
for (RemediationAction action : plan.getActions()) {
processRemediationAction(action);
}
}
}
private void processRemediationAction(RemediationAction action) {
switch (action.getType()) {
case UPDATE_DEPENDENCY:
System.out.println("Update " + action.getDependency().getCoordinates() + 
" to version " + action.getTargetVersion());
break;
case REPLACE_DEPENDENCY:
System.out.println("Replace " + action.getDependency().getCoordinates() + 
" with alternative");
break;
case MITIGATE_VULNERABILITY:
System.out.println("Mitigate vulnerability: " + action.getVulnerability().getId());
break;
}
}
}

Maven Dependencies

<dependencies>
<!-- HTTP Client -->
<dependency>
<groupId>org.apache.httpcomponents.client5</groupId>
<artifactId>httpclient5</artifactId>
<version>5.2.1</version>
</dependency>
<!-- JSON Processing -->
<dependency>
<groupId>org.json</groupId>
<artifactId>json</artifactId>
<version>20230227</version>
</dependency>
<!-- XML Processing -->
<dependency>
<groupId>javax.xml.parsers</groupId>
<artifactId>jaxp-api</artifactId>
<version>1.4.5</version>
</dependency>
<!-- File Utilities -->
<dependency>
<groupId>commons-io</groupId>
<artifactId>commons-io</artifactId>
<version>2.11.0</version>
</dependency>
<!-- Logging -->
<dependency>
<groupId>org.slf4j</groupId>
<artifactId>slf4j-api</artifactId>
<version>2.0.7</version>
</dependency>
</dependencies>

Best Practices

1. Integration Strategy

  • Integrate early in SDLC
  • Use in CI/CD for automated scanning
  • Implement security gates

2. Policy Management

  • Define clear security policies
  • Implement organizational rules
  • Regular policy reviews

3. Remediation Workflow

  • Prioritize by severity and exploitability
  • Track remediation progress
  • Automate dependency updates

4. Compliance Reporting

  • Generate multiple report formats
  • Maintain audit trails
  • Integrate with GRC systems

5. Performance Optimization

  • Cache scan results
  • Use incremental scanning
  • Optimize API calls

This Titliel SourceClear integration provides comprehensive software composition analysis with advanced policy enforcement, risk assessment, and remediation guidance for enterprise Java applications.

Secure Java Supply Chain, Minimal Containers & Runtime Security (Alpine, Distroless, Signing, SBOM & Kubernetes Controls)

https://macronepal.com/blog/alpine-linux-security-in-java-complete-guide/
Explains how Alpine Linux is used as a lightweight base for Java containers to reduce image size and attack surface, while discussing tradeoffs like musl compatibility, CVE handling, and additional hardening requirements for production security.

https://macronepal.com/blog/the-minimalists-approach-building-ultra-secure-java-applications-with-scratch-base-images/
Explains using scratch base images for Java applications to create extremely minimal containers with almost zero attack surface, where only the compiled Java application and runtime dependencies exist.

https://macronepal.com/blog/distroless-containers-in-java-minimal-secure-containers-for-jvm-applications/
Explains distroless Java containers that remove shells, package managers, and unnecessary OS tools, significantly reducing vulnerabilities while improving security posture for JVM workloads.

https://macronepal.com/blog/revolutionizing-container-security-implementing-chainguard-images-for-java-applications/
Explains Chainguard images for Java, which are secure-by-default, CVE-minimized container images with SBOMs and cryptographic signing, designed for modern supply-chain security.

https://macronepal.com/blog/seccomp-filtering-in-java-comprehensive-security-sandboxing/
Explains seccomp syscall filtering in Linux to restrict what system calls Java applications can make, reducing the impact of exploits by limiting kernel-level access.

https://macronepal.com/blog/in-toto-attestations-in-java/
Explains in-toto framework integration in Java to create cryptographically verifiable attestations across the software supply chain, ensuring every build step is trusted and auditable.

https://macronepal.com/blog/fulcio-integration-in-java-code-signing-certificate-infrastructure/
Explains Fulcio integration for Java, which issues short-lived certificates for code signing in a zero-trust supply chain, enabling secure identity-based signing of artifacts.

https://macronepal.com/blog/tekton-supply-chain-in-java-comprehensive-ci-cd-pipeline-implementation/
Explains using Tekton CI/CD pipelines for Java applications to automate secure builds, testing, signing, and deployment with supply-chain security controls built in.

https://macronepal.com/blog/slsa-provenance-in-java-complete-guide-to-supply-chain-security-2/
Explains SLSA (Supply-chain Levels for Software Artifacts) provenance in Java builds, ensuring traceability of how software is built, from source code to final container image.

https://macronepal.com/blog/notary-project-in-java-complete-implementation-guide/
Explains the Notary Project for Java container security, enabling cryptographic signing and verification of container images and artifacts to prevent tampering in deployment pipelines.

Category : JAVA

Leave a Reply

Your email address will not be published. Required fields are marked *


Macro Nepal Helper