java langauge

Java Overview

Java is a high-level, object-oriented programming language widely used by developers. Endor Labs supports scanning and monitoring of Java projects. Using Endor Labs, application security engineers and developers can:

System specifications for deep scan

Before you proceed to run a deep scan, ensure that your system meets the following specification.

Project Size Processor Memory
Small projects 4-core processor 16 GB
Mid-size projects 8-core processor 32 GB
Large projects 16-core processor 64 GB

Software prerequisites

Endor Labs requires the following prerequisites in place for successful scans.

Build Java projects

You must build your Java projects before running a scan. Also verify that packages exist in the local package caches and build artifacts exist in the standard locations.

Use Gradle

To analyze your software built with Gradle, Endor Labs requires a successful build. For a quick scan, locate the dependencies in the local package manager cache. The standard $GRADLE_USER_HOME/caches or /User/<username>/.gradle/caches directory must exist and contain downloaded dependencies. For a deep scan, also generate the target artifact on the file system. To build your project with Gradle, use the following procedure:

  1. If you would like to run a scan against a custom configuration, specify the Gradle configuration by setting an environment variable.
   export endorGradleJavaConfiguration="<configuration>"

When there is no configuration, endorctl uses runtimeClasspath by default. If neither the user-specified nor the default configuration exists in the project, endorctl falls back to the following configurations, in order:

  1. runtimeClasspath
  2. runtime
  3. compileClasspath
  4. compile

If endorctl does not find the listed configurations in the project, it selects the first available configuration in alphabetical order.

  1. Ensure that you can resolve the dependencies for your project without errors by running the following command: For Gradle wrapper:
   ./gradlew dependencies

For Gradle:

gradle dependencies
  1. Run ./gradlew assemble or gradle assemble to resolve dependencies and create an artifact for deep analysis.

Override subproject level configuration

In a multi-build project, if you set the environment variable endorGradleJavaConfiguration=[GlobalConfiguration], endorctl uses the specified configuration for dependency resolution across all projects and subprojects in the hierarchy below.

\n--- Project ':samples'
     +--- Project ':samples:compare'
     +--- Project ':samples:crawler'
     +--- Project ':samples:guide'
     +--- Project ':samples:simple-client'
     +--- Project ':samples:slack'
     +--- Project ':samples:static-server'
     +--- Project ':samples:tlssurvey'
     +--- Project ':samples:unixdomainsockets'

To override the configuration only for the :samples:crawler and :samples:guide subprojects, follow these steps:

  1. Navigate to the root workspace, where you execute endorctl scan, and run ./gradlew projects to list all projects and their names.
  2. Run the following command at the root of the workspace:
   echo ":samples:crawler=testRuntimeClasspath,:samples:guide=macroBenchMarkClasspath" >> .endorproperties

This creates a new file named .endorproperties in your root directory. This enables different configurations for the specified subprojects in the file. 3. Run endorctl scan.

At this point, all other projects will adhere to the GlobalConfiguration. However, the :samples:crawler subproject will use the testRuntimeClasspath configuration, and the :samples:guide subproject will use the macroBenchMarkClasspath configuration.

Enable monorepo mode for Gradle multi-module projects

For large Gradle multi-module projects, you can enable monorepo mode to reduce scan time. When enabled, Endor Labs runs a single Gradle command across all subprojects under each Gradle Wrapper hierarchy. It reuses the output for dependency resolution instead of invoking Gradle separately for each subproject. Your project must meet the following requirements to use monorepo mode:

To enable monorepo mode, set the ENDOR_SCAN_GRADLE_MONOREPO_MODE environment variable before running a scan:

export ENDOR_SCAN_GRADLE_MONOREPO_MODE=true
endorctl scan

Use Maven

To analyze your software built with Maven, Endor Labs requires a successful build. For a quick scan, locate the dependencies in the local package manager cache. The standard .m2 cache must exist and contain downloaded dependencies. For a deep scan, also generate the target artifact on the file system. To build your project with Maven, use the following procedure:

  1. Ensure that you can resolve the dependencies for your project without error by running the following command.
   mvn dependency:tree

  1. Run mvn install and make sure the build is successful.

    If you want to skip the execution of tests during the build, you can use -DskipTests to quickly build and install your projects.

   mvn install -DskipTests
  1. If you have multiple Java modules not referenced in the root pom.xml file, make sure to run mvn install separately in all the directories.

Scan Maven projects that use CI-friendly versions

Maven multi-module projects can declare their version with the CI-friendly placeholders ${revision}, ${sha1}, and ${changelist}. Endor Labs resolves dependencies one module at a time, so Maven reads each sibling module from the local repository instead of the reactor. If an installed POM still holds an unresolved placeholder, the scan fails with an error similar to the following.

Could not find artifact com.example:auth-server:pom:${revision}${changelist}

To scan a project that uses CI-friendly versions, do the following:

  1. Add the flatten-maven-plugin to your build and bind its flatten goal to the process-resources phase and its clean goal to the clean phase. Set flattenMode to resolveCiFriendliesOnly so the plugin installs POMs with the placeholders already resolved. For more information, refer to Maven CI friendly versions.
<plugin>
    <groupId>org.codehaus.mojo</groupId>
    <artifactId>flatten-maven-plugin</artifactId>
    <configuration>
      <updatePomFile>true</updatePomFile>
      <flattenMode>resolveCiFriendliesOnly</flattenMode>
    </configuration>
    <executions>
      <execution>
        <id>flatten</id>
        <phase>process-resources</phase>
        <goals><goal>flatten</goal></goals>
      </execution>
      <execution>
        <id>flatten-clean</id>
        <phase>clean</phase>
        <goals><goal>clean</goal></goals>
      </execution>
    </executions>
</plugin>
  1. Make sure the plugin is not skipped in the profile your build uses. A skipped execution installs POMs that still contain the placeholders.
  2. Build the project so the flattened POMs reach your local repository. Pass the same property values that you use in step 4. If the properties are not set in your POM, the build cannot resolve them.
mvn install -DskipTests -Drevision=3.13.2 -Dchangelist=-SNAPSHOT
  1. Pass the property values to endorctl in ENDOR_SCAN_JVM_PARAMETERS as a comma-separated list. Endor Labs adds the revision, sha1, and changelist properties to the help:effective-pom and dependency:tree commands that it runs.
export ENDOR_SCAN_JVM_PARAMETERS="-Xmx16384M,-Drevision=3.13.2,-Dchangelist=-SNAPSHOT"
endorctl scan --dependencies

Setting this variable replaces its default value. Keep a memory option such as -Xmx16384M in the list.

Scan projects without pom.xml

Endor Labs supports projects that do not use Maven or Gradle and have no pom.xml in the following cases.

Run the scans with the --quick-scan parameter if you prefer to scan the project without reachability.

Uber jars

If you have an uber jar (fat jar) that contains all application classes and dependency jars, set the environment variable ENDOR_JVM_USE_ARTIFACT_SCAN to true and run the scan.

export ENDOR_JVM_USE_ARTIFACT_SCAN=true
endorctl scan --package --path=<jar/ear/war location> --project-name=<project name>

For example:

export ENDOR_JVM_USE_ARTIFACT_SCAN=true
endorctl scan --package --path=/Users/johndoe/projects/project21.jar --project-name=Project21

Endor Labs identifies the dependencies of an uber jar from the nested .jar, .war, and .ear files it contains. Shaded jars are not supported. A shaded jar copies the dependency classes directly into the main jar and keeps no nested archives. Endor Labs finds nothing to identify, and the scan fails with the following error.

no java artifacts detected in provided package as a dependency. Unable to proceed with scan.

If your build produces a shaded jar, scan the project from source instead, or keep the dependency jars alongside the artifact and set ENDOR_JVM_USE_ARTIFACT_SCAN_CLASSPATH. See Application dependencies in classpath to scan with a separate dependency path.

Application dependencies in classpath

If you only have application dependency files (like jar, war, or ear) without an uber jar, set the path to these files in the environment variable ENDOR_JVM_USE_ARTIFACT_SCAN_CLASSPATH and run the scan.

export ENDOR_JVM_USE_ARTIFACT_SCAN=true
export ENDOR_JVM_USE_ARTIFACT_SCAN_CLASSPATH=<path that contains application depedencies>
endorctl scan --package --path=<jar/ear/war location> --project-name=<project name>

For example:

export ENDOR_JVM_USE_ARTIFACT_SCAN=true
export ENDOR_JVM_USE_ARTIFACT_SCAN_CLASSPATH=/Users/johndoe/caches/modules/files-2.1
endorctl scan --package --path=/Users/johndoe/projects/project21.jar --project-name=Project21

Scan the projects on JDK version 8

Endor Labs supports JDK versions between 11 and 27. You can still scan projects on JDK 8 using the following procedure:

  1. Build your Java project on JDK 8.

  2. After building, switch your Java home to JDK 11 or higher versions.

    export JAVA_HOME=/Library/Java/JavaVirtualMachines/openjdk-11.jdk/Contents/Home

  3. Run a scan.

Understand the scan process

Endor Labs analyzes your Java code and dependencies to detect known security issues, including open-source vulnerabilities and generates call graphs.

How Endor Labs resolves dependencies for package versions

Endor Labs resolves the dependencies for Java packages based on the following factors:

Known limitations

Troubleshoot errors

Here are a few error scenarios that you can check for and attempt to resolve them.

*Incompatible because this component declares a component for use during compile-time, compatible with Java version 21 and the consumer needed a component for use during runtime, compatible with Java version 17*

export ENDOR_SCAN_JVM_PARAMETERS="-Xmx32G"