【发布时间】:2020-10-04 20:27:29
【问题描述】:
我想通过 Maven 为我的 PL/SQL 项目运行分析。我使用这个版本的插件:
<groupId>org.sonarsource.scanner.maven</groupId>
<artifactId>sonar-maven-plugin</artifactId>
<version>3.4.0.905</version>
使用mvn sonar:sonar 运行良好,直到连接到数据库以检索数据字典信息。运行mvn -X sonar:sonar 后,我得到以下堆栈跟踪:
[DEBUG] 13:26:02.222 Unable to decrypt property sonar.plsql.jdbc.password
org.sonatype.plexus.components.sec.dispatcher.SecDispatcherException: org.sonatype.plexus.components.cipher.PlexusCipherException: java.lang.ArrayIndexOutOfBoundsException
at org.sonatype.plexus.components.sec.dispatcher.DefaultSecDispatcher.decrypt (DefaultSecDispatcher.java:121)
at org.sonarsource.scanner.maven.bootstrap.PropertyDecryptor.decrypt (PropertyDecryptor.java:56)
at org.sonarsource.scanner.maven.bootstrap.PropertyDecryptor.decryptProperties (PropertyDecryptor.java:45)
at org.sonarsource.scanner.maven.bootstrap.ScannerFactory.createGlobalProperties (ScannerFactory.java:76)
at org.sonarsource.scanner.maven.SonarQubeMojo.execute (SonarQubeMojo.java:103)
at org.apache.maven.plugin.DefaultBuildPluginManager.executeMojo (DefaultBuildPluginManager.java:137)
at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:210)
at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:156)
at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:148)
at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:117)
at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:81)
at org.apache.maven.lifecycle.internal.builder.singlethreaded.SingleThreadedBuilder.build (SingleThreadedBuilder.java:56)
at org.apache.maven.lifecycle.internal.LifecycleStarter.execute (LifecycleStarter.java:128)
at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:305)
at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:192)
at org.apache.maven.DefaultMaven.execute (DefaultMaven.java:105)
at org.apache.maven.cli.MavenCli.execute (MavenCli.java:956)
at org.apache.maven.cli.MavenCli.doMain (MavenCli.java:288)
at org.apache.maven.cli.MavenCli.main (MavenCli.java:192)
at sun.reflect.NativeMethodAccessorImpl.invoke0 (Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke (NativeMethodAccessorImpl.java:62)
at sun.reflect.DelegatingMethodAccessorImpl.invoke (DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke (Method.java:498)
at org.codehaus.plexus.classworlds.launcher.Launcher.launchEnhanced (Launcher.java:289)
at org.codehaus.plexus.classworlds.launcher.Launcher.launch (Launcher.java:229)
at org.codehaus.plexus.classworlds.launcher.Launcher.mainWithExitCode (Launcher.java:415)
at org.codehaus.plexus.classworlds.launcher.Launcher.main (Launcher.java:356)
Caused by: org.sonatype.plexus.components.cipher.PlexusCipherException: java.lang.ArrayIndexOutOfBoundsException
at org.sonatype.plexus.components.cipher.PBECipher.decrypt64 (PBECipher.java:193)
at org.sonatype.plexus.components.cipher.DefaultPlexusCipher.decrypt (DefaultPlexusCipher.java:72)
at org.sonatype.plexus.components.sec.dispatcher.DefaultSecDispatcher.decrypt (DefaultSecDispatcher.java:96)
at org.sonarsource.scanner.maven.bootstrap.PropertyDecryptor.decrypt (PropertyDecryptor.java:56)
at org.sonarsource.scanner.maven.bootstrap.PropertyDecryptor.decryptProperties (PropertyDecryptor.java:45)
at org.sonarsource.scanner.maven.bootstrap.ScannerFactory.createGlobalProperties (ScannerFactory.java:76)
at org.sonarsource.scanner.maven.SonarQubeMojo.execute (SonarQubeMojo.java:103)
at org.apache.maven.plugin.DefaultBuildPluginManager.executeMojo (DefaultBuildPluginManager.java:137)
at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:210)
at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:156)
at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:148)
at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:117)
at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:81)
at org.apache.maven.lifecycle.internal.builder.singlethreaded.SingleThreadedBuilder.build (SingleThreadedBuilder.java:56)
at org.apache.maven.lifecycle.internal.LifecycleStarter.execute (LifecycleStarter.java:128)
at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:305)
at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:192)
at org.apache.maven.DefaultMaven.execute (DefaultMaven.java:105)
at org.apache.maven.cli.MavenCli.execute (MavenCli.java:956)
at org.apache.maven.cli.MavenCli.doMain (MavenCli.java:288)
at org.apache.maven.cli.MavenCli.main (MavenCli.java:192)
at sun.reflect.NativeMethodAccessorImpl.invoke0 (Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke (NativeMethodAccessorImpl.java:62)
at sun.reflect.DelegatingMethodAccessorImpl.invoke (DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke (Method.java:498)
at org.codehaus.plexus.classworlds.launcher.Launcher.launchEnhanced (Launcher.java:289)
at org.codehaus.plexus.classworlds.launcher.Launcher.launch (Launcher.java:229)
at org.codehaus.plexus.classworlds.launcher.Launcher.mainWithExitCode (Launcher.java:415)
at org.codehaus.plexus.classworlds.launcher.Launcher.main (Launcher.java:356)
Caused by: java.lang.ArrayIndexOutOfBoundsException
at java.lang.System.arraycopy (Native Method)
at org.sonatype.plexus.components.cipher.PBECipher.decrypt64 (PBECipher.java:181)
at org.sonatype.plexus.components.cipher.DefaultPlexusCipher.decrypt (DefaultPlexusCipher.java:72)
at org.sonatype.plexus.components.sec.dispatcher.DefaultSecDispatcher.decrypt (DefaultSecDispatcher.java:96)
at org.sonarsource.scanner.maven.bootstrap.PropertyDecryptor.decrypt (PropertyDecryptor.java:56)
at org.sonarsource.scanner.maven.bootstrap.PropertyDecryptor.decryptProperties (PropertyDecryptor.java:45)
at org.sonarsource.scanner.maven.bootstrap.ScannerFactory.createGlobalProperties (ScannerFactory.java:76)
at org.sonarsource.scanner.maven.SonarQubeMojo.execute (SonarQubeMojo.java:103)
at org.apache.maven.plugin.DefaultBuildPluginManager.executeMojo (DefaultBuildPluginManager.java:137)
at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:210)
at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:156)
at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:148)
at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:117)
at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:81)
at org.apache.maven.lifecycle.internal.builder.singlethreaded.SingleThreadedBuilder.build (SingleThreadedBuilder.java:56)
at org.apache.maven.lifecycle.internal.LifecycleStarter.execute (LifecycleStarter.java:128)
at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:305)
at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:192)
at org.apache.maven.DefaultMaven.execute (DefaultMaven.java:105)
at org.apache.maven.cli.MavenCli.execute (MavenCli.java:956)
at org.apache.maven.cli.MavenCli.doMain (MavenCli.java:288)
at org.apache.maven.cli.MavenCli.main (MavenCli.java:192)
at sun.reflect.NativeMethodAccessorImpl.invoke0 (Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke (NativeMethodAccessorImpl.java:62)
at sun.reflect.DelegatingMethodAccessorImpl.invoke (DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke (Method.java:498)
at org.codehaus.plexus.classworlds.launcher.Launcher.launchEnhanced (Launcher.java:289)
at org.codehaus.plexus.classworlds.launcher.Launcher.launch (Launcher.java:229)
at org.codehaus.plexus.classworlds.launcher.Launcher.mainWithExitCode (Launcher.java:415)
at org.codehaus.plexus.classworlds.launcher.Launcher.main (Launcher.java:356)
[DEBUG] 13:26:02.284 Unable to decrypt property sonar.plsql.jdbc.password
org.sonatype.plexus.components.sec.dispatcher.SecDispatcherException: org.sonatype.plexus.components.cipher.PlexusCipherException: java.lang.ArrayIndexOutOfBoundsException
at org.sonatype.plexus.components.sec.dispatcher.DefaultSecDispatcher.decrypt (DefaultSecDispatcher.java:121)
at org.sonarsource.scanner.maven.bootstrap.PropertyDecryptor.decrypt (PropertyDecryptor.java:56)
at org.sonarsource.scanner.maven.bootstrap.PropertyDecryptor.decryptProperties (PropertyDecryptor.java:45)
at org.sonarsource.scanner.maven.bootstrap.ScannerFactory.createGlobalProperties (ScannerFactory.java:76)
at org.sonarsource.scanner.maven.bootstrap.ScannerFactory.create (ScannerFactory.java:61)
at org.sonarsource.scanner.maven.SonarQubeMojo.execute (SonarQubeMojo.java:107)
at org.apache.maven.plugin.DefaultBuildPluginManager.executeMojo (DefaultBuildPluginManager.java:137)
at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:210)
at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:156)
at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:148)
at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:117)
at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:81)
at org.apache.maven.lifecycle.internal.builder.singlethreaded.SingleThreadedBuilder.build (SingleThreadedBuilder.java:56)
at org.apache.maven.lifecycle.internal.LifecycleStarter.execute (LifecycleStarter.java:128)
at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:305)
at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:192)
at org.apache.maven.DefaultMaven.execute (DefaultMaven.java:105)
at org.apache.maven.cli.MavenCli.execute (MavenCli.java:956)
at org.apache.maven.cli.MavenCli.doMain (MavenCli.java:288)
at org.apache.maven.cli.MavenCli.main (MavenCli.java:192)
at sun.reflect.NativeMethodAccessorImpl.invoke0 (Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke (NativeMethodAccessorImpl.java:62)
at sun.reflect.DelegatingMethodAccessorImpl.invoke (DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke (Method.java:498)
at org.codehaus.plexus.classworlds.launcher.Launcher.launchEnhanced (Launcher.java:289)
at org.codehaus.plexus.classworlds.launcher.Launcher.launch (Launcher.java:229)
at org.codehaus.plexus.classworlds.launcher.Launcher.mainWithExitCode (Launcher.java:415)
at org.codehaus.plexus.classworlds.launcher.Launcher.main (Launcher.java:356)
Caused by: org.sonatype.plexus.components.cipher.PlexusCipherException: java.lang.ArrayIndexOutOfBoundsException
at org.sonatype.plexus.components.cipher.PBECipher.decrypt64 (PBECipher.java:193)
at org.sonatype.plexus.components.cipher.DefaultPlexusCipher.decrypt (DefaultPlexusCipher.java:72)
at org.sonatype.plexus.components.sec.dispatcher.DefaultSecDispatcher.decrypt (DefaultSecDispatcher.java:96)
at org.sonarsource.scanner.maven.bootstrap.PropertyDecryptor.decrypt (PropertyDecryptor.java:56)
at org.sonarsource.scanner.maven.bootstrap.PropertyDecryptor.decryptProperties (PropertyDecryptor.java:45)
at org.sonarsource.scanner.maven.bootstrap.ScannerFactory.createGlobalProperties (ScannerFactory.java:76)
at org.sonarsource.scanner.maven.bootstrap.ScannerFactory.create (ScannerFactory.java:61)
at org.sonarsource.scanner.maven.SonarQubeMojo.execute (SonarQubeMojo.java:107)
at org.apache.maven.plugin.DefaultBuildPluginManager.executeMojo (DefaultBuildPluginManager.java:137)
at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:210)
at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:156)
at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:148)
at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:117)
at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:81)
at org.apache.maven.lifecycle.internal.builder.singlethreaded.SingleThreadedBuilder.build (SingleThreadedBuilder.java:56)
at org.apache.maven.lifecycle.internal.LifecycleStarter.execute (LifecycleStarter.java:128)
at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:305)
at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:192)
at org.apache.maven.DefaultMaven.execute (DefaultMaven.java:105)
at org.apache.maven.cli.MavenCli.execute (MavenCli.java:956)
at org.apache.maven.cli.MavenCli.doMain (MavenCli.java:288)
at org.apache.maven.cli.MavenCli.main (MavenCli.java:192)
at sun.reflect.NativeMethodAccessorImpl.invoke0 (Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke (NativeMethodAccessorImpl.java:62)
at sun.reflect.DelegatingMethodAccessorImpl.invoke (DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke (Method.java:498)
at org.codehaus.plexus.classworlds.launcher.Launcher.launchEnhanced (Launcher.java:289)
at org.codehaus.plexus.classworlds.launcher.Launcher.launch (Launcher.java:229)
at org.codehaus.plexus.classworlds.launcher.Launcher.mainWithExitCode (Launcher.java:415)
at org.codehaus.plexus.classworlds.launcher.Launcher.main (Launcher.java:356)
Caused by: java.lang.ArrayIndexOutOfBoundsException
at java.lang.System.arraycopy (Native Method)
at org.sonatype.plexus.components.cipher.PBECipher.decrypt64 (PBECipher.java:181)
at org.sonatype.plexus.components.cipher.DefaultPlexusCipher.decrypt (DefaultPlexusCipher.java:72)
at org.sonatype.plexus.components.sec.dispatcher.DefaultSecDispatcher.decrypt (DefaultSecDispatcher.java:96)
at org.sonarsource.scanner.maven.bootstrap.PropertyDecryptor.decrypt (PropertyDecryptor.java:56)
at org.sonarsource.scanner.maven.bootstrap.PropertyDecryptor.decryptProperties (PropertyDecryptor.java:45)
at org.sonarsource.scanner.maven.bootstrap.ScannerFactory.createGlobalProperties (ScannerFactory.java:76)
at org.sonarsource.scanner.maven.bootstrap.ScannerFactory.create (ScannerFactory.java:61)
at org.sonarsource.scanner.maven.SonarQubeMojo.execute (SonarQubeMojo.java:107)
at org.apache.maven.plugin.DefaultBuildPluginManager.executeMojo (DefaultBuildPluginManager.java:137)
at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:210)
at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:156)
at org.apache.maven.lifecycle.internal.MojoExecutor.execute (MojoExecutor.java:148)
at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:117)
at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject (LifecycleModuleBuilder.java:81)
at org.apache.maven.lifecycle.internal.builder.singlethreaded.SingleThreadedBuilder.build (SingleThreadedBuilder.java:56)
at org.apache.maven.lifecycle.internal.LifecycleStarter.execute (LifecycleStarter.java:128)
at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:305)
at org.apache.maven.DefaultMaven.doExecute (DefaultMaven.java:192)
at org.apache.maven.DefaultMaven.execute (DefaultMaven.java:105)
at org.apache.maven.cli.MavenCli.execute (MavenCli.java:956)
at org.apache.maven.cli.MavenCli.doMain (MavenCli.java:288)
at org.apache.maven.cli.MavenCli.main (MavenCli.java:192)
at sun.reflect.NativeMethodAccessorImpl.invoke0 (Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke (NativeMethodAccessorImpl.java:62)
at sun.reflect.DelegatingMethodAccessorImpl.invoke (DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke (Method.java:498)
at org.codehaus.plexus.classworlds.launcher.Launcher.launchEnhanced (Launcher.java:289)
at org.codehaus.plexus.classworlds.launcher.Launcher.launch (Launcher.java:229)
at org.codehaus.plexus.classworlds.launcher.Launcher.mainWithExitCode (Launcher.java:415)
at org.codehaus.plexus.classworlds.launcher.Launcher.main (Launcher.java:356)
我将pom.xml 中的sonar.plsql.jdbc.password 设置为${settings.servers.db-dev.password},并且此参数在我的settings.xml 文件中设置。我仔细检查了 Maven 是否读取了正确的 settings.xml 文件。
实际上,在输出的最后,我从 db 收到 logon denied 错误,这意味着插件尝试连接(它是否使用 ${settings.servers.db-dev.password} 作为纯文本密码?)到 db 虽然之前它未能获得密码。
所以我的问题是:
- 为什么 Maven 插件不能通过参数字符串获取密码?我很好奇,因为他可以将
username作为参数字符串传递。 (我的密码是 maven 加密还是纯文本都没关系) - 如果这是已知行为,那么是否有任何其他方法可以加密您的数据库密码并将其传递给声纳 maven 插件?
UPD:这是我的 pom.xml 带有服务器扩展的文章:
<extensions>
<extension>
<groupId>com.github.shyiko.servers-maven-extension</groupId>
<artifactId>servers-maven-extension</artifactId>
<version>1.3.1</version>
</extension>
</extensions>
这是一个声纳配置:
<sonar.login>${spdb-beholder.sonar.login}</sonar.login>
<sonar.host.url>${spdb-beholder.sonar.host}</sonar.host.url>
<sonar.plsql.jdbc.url>${liquibase.url}</sonar.plsql.jdbc.url>
<sonar.plsql.jdbc.user>${settings.servers.db-dev.username}</sonar.plsql.jdbc.user>
<sonar.plsql.jdbc.password>${settings.servers.db-dev.password}</sonar.plsql.jdbc.password>
<sonar.plsql.jdbc.defaultSchema>${liquibase.user.owner}</sonar.plsql.jdbc.defaultSchema>
<sonar.projectName>spdb-beholder</sonar.projectName>
<sonar.projectKey>spdb-beholder</sonar.projectKey>
<sonar.plsql.file.suffixes>sql,vw,pkb</sonar.plsql.file.suffixes>
<sonar.sources>src/main/resources/migration/compiled</sonar.sources>
<sonar.tests>src/main/resources/migration/tests</sonar.tests>
<sonar.plsql.jdbc.driver>${liquibase.driver}</sonar.plsql.jdbc.driver>
<sonar.plsql.jdbc.driver.path>${project.build.directory}/lib/ojdbc8-12.2.0.1.jar</sonar.plsql.jdbc.driver.path>
<sonar.plsql.jdbc.driver.class>oracle.jdbc.OracleDriver</sonar.plsql.jdbc.driver.class>
<sonar.sourceEncoding>UTF-8</sonar.sourceEncoding>
<sonar.language>plsql</sonar.language>
<sonar.coverageReportPaths>${project.build.directory}/coverage-sonar-reporter.xml</sonar.coverageReportPaths>
<sonar.testExecutionReportPaths>${project.build.directory}/sonar-test-reporter.xml</sonar.testExecutionReportPaths>
我还检查了这是否有效:
<sonar.plsql.jdbc.user>${settings.servers.db-dev.username}</sonar.plsql.jdbc.user>
<sonar.plsql.jdbc.password>unencryptedpasswordfordb</sonar.plsql.jdbc.password>
它没有。所以不取决于你传入${}参数是什么参数。
我发现了这篇文章:https://docs.sonarqube.org/latest/instance-administration/security/#header-6 我不太喜欢它,因为我必须在本地机器上保存密钥,因为我还要测试向 Sonar 发布的测试结果。
【问题讨论】:
-
首先我建议升级到最新版本的插件此外,您能否展示一下您是如何配置整个故事的?通常您通过访问令牌而不是数据库访问 SonarQube?(请详细解释)..为什么? `通过参数字符串获取密码是什么意思? `?
-
是的,我使用令牌和主机地址连接到 Sonar,它运行良好。但是在分析 pl/sql 源代码(它是一种 Oracle 数据库过程语言)时,Sonar 想要连接到 DB 以获取数据字典的内容。 “参数字符串”是指
${settings.servers.db-dev.password}字符串。我会在问题中添加一些额外的信息。 -
我认为,docs.sonarqube.org/latest/instance-administration/security/… 不应该打扰你 - 它只是用于 sonarqube 服务器配置。通过查看 sonar-scanner-maven-plugin 的代码,每个属性,其中有名称
password,将尝试通过 mavens 密码加密基础设施解密.. 从查看源代码,我看不出,为什么即使是未加密的值也会被尝试解密 -
一步一步看:如果使用
mvn -x sonar:sonar运行...你能在属性列表中看到你的settings.xml 中的值,这些值被移交给插件执行吗? -
@RobertKleinschmager 不,实际上。就是这样:
[DEBUG] Configuration: <?xml version="1.0" encoding="UTF-8"?> <configuration> <mojoExecution default-value="${mojoExecution}"/> <session default-value="${session}"/> <skip default-value="false">${sonar.skip}</skip> </configuration>恐怕server引用只能在configuration标记中处理,而不能在properties部分处理。我还使用 liquibase maven 插件,它在configuration部分下有用户名/密码,即使使用加密的 db-password 也可以很好地与servers配合使用。
标签: maven sonarqube maven-3 sonarqube-scan