Chapter 4. Configuring IntelliJ to use Dependency Analytics
You can gain access to Red Hat’s Trusted Profile Analyzer service by using the Dependency Analytics plugin for Jet Brains' IntelliJ IDEA application. With this plugin you get access to the latest open source vulnerability information, and insights about your application’s dependent packages. The Red Hat Dependency Analytics plugin uses the following data sources for the most up-to-date vulnerability information available:
- The ONGuard service, integrates the Open Source Vulnerability (OSV) and the National Vulnerability Database (NVD) data sources. When given a set of packages to the ONGuard service, a query to OSV retrieves the associated vulnerability information, and then a query to NVD for public Common Vulnerability and Exposures (CVE) information.
Dependency Analytics supports the following programming languages:
- Maven
- Node
- Python
- Go
The Dependency Analytics extension is an online service maintained by Red Hat. Dependency Analytics only accesses your manifest files to analyze your application dependencies before displaying the results.
Prerequisites
- Install IntelliJ IDEA on your workstation.
-
For Maven projects, analyzing a
pom.xmlfile, you must have themvnbinary in your system’sPATHenvironment. -
For Node projects, analyzing a
package.jsonfile, you must have thenpmbinary in your system’sPATHenvironment. -
For Go projects, analyzing a
go.modfile, you must have thegobinary in your system’sPATHenvironment. -
For Python projects, analyzing a
requirements.txtfile, you must have thepython3/pip3orpython/pipbinaries in your system’sPATHenvironment.
Procedure
- Open the IntelliJ application.
- From the file menu, click Settings , and click Plugins.
- Search the Marketplace for Red Hat Dependency Analytics.
- Click the INSTALL button to install the plug-in.
To start scanning your application for security vulnerabilities, and view the vulnerability report, you can do one of the following:
- Open a manifest file, hover over a dependency marked by the inline Component Analysis, indicated by the wavy-red line under a dependency, and click Detailed Vulnerability Report.
- Right click on a manifest file in the Project window, and click Dependency Analytics Report.
Additional resources
- Red Hat’s Dependency Analytics Jet Brains marketplace page.
- The GitHub project.
