Chapter 4. Configuring IntelliJ to use Dependency Analytics

Procedure

1. Open the IntelliJ application.
2. From the file menu, click Settings , and click Plugins.
3. Search the Marketplace for Red Hat Dependency Analytics.
4. Click the INSTALL button to install the plugin.

5. To start scanning your application for security vulnerabilities, and view the vulnerability report, you can do one of the following:

   • Open a manifest file, hover over a dependency marked by the inline Component Analysis, indicated by the wavy-red line under a dependency, and click Detailed Vulnerability Report.
   • Right click the manifest file in the Project window, and click Dependency Analytics Report.

6. If you want to exclude specific packages for analysis, you can use the exhortignore as a comment tag for your specific programming language.

   • For Maven, update the pom.xml file:

     ...
     <dependency> <!--exhortignore-->
       <groupId>...</groupId>
       <artifactId>...</artifactId>
       <version>...</version>
     </dependency>
     ...

     Copy to Clipboard Toggle word wrap

   • For Go, update the go.mod file:

     module github.com/trustify-da/SaaSi/deployer
     
     go 1.19
     
     require (
             github.com/davecgh/go-spew v1.1.1 // indirect exhortignore
             github.com/emicklei/go-restful/v3 v3.9.0 // indirect
             github.com/go-logr/logr v1.2.3 // indirect //exhortignore
     
     )
     ...

     Copy to Clipboard Toggle word wrap

   • For Python, update the requirements.txt file:

     ...
     click==8.0.4 #exhortignore
     ...

     Copy to Clipboard Toggle word wrap

   • For Gradle, update the build.gradle file:

     plugins {
     id 'java'
     }
     
     group = 'groupName'
     version = 'version'
     
     repositories {
         mavenCentral()
     }
     
     dependencies {
         implementation "groupId:artifactId:version" // exhortignore
     }
     test {
         useJUnitPlatform()
     }

     Copy to Clipboard Toggle word wrap