{"uuid": "0c8ce7ef-be2e-4f98-b4fe-c9d521007d1e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2020-36518", "type": "seen", "source": "https://gist.github.com/Amsamms/06da2b8090146b5a5144ffa554ad291a", "content": "# Verification image for an OSV-SCALIBR Leiningen (project.clj) software inventory extractor.\n#\n#   Approved PRP issue : https://github.com/google/osv-scalibr/issues/1953\n#   Distribution method: Leiningen / project.clj  (Clojure build tool, deps from Maven Central + Clojars)\n#   OSV ecosystem      : Maven\n#\n# The project.clj below is not a toy: Leiningen itself resolves every declared dependency\n# during the build (so every coordinate is real and downloadable), then writes the\n# equivalent Maven pom.xml, which serves as ground truth for the expected extractor output.\n# It covers the cases a project.clj extractor has to get right:\n#\n#   1. namespaced coordinate            [org.clojure/clojure \"1.11.1\"]      -> org.clojure:clojure\n#   2. bare symbol, group == artifact   [cheshire \"5.13.0\"]                 -> cheshire:cheshire\n#   3. trailing options after version   [ring/ring-core \"1.12.2\" :exclusions [...]]\n#   4. plain Java artifact              [com.fasterxml.jackson.core/jackson-databind \"2.9.8\"]\n#   5. profile-scoped dependency        :profiles {:dev {:dependencies [...]}}\n#\n# Cases 1 and 4 carry real OSV.dev records (GHSA-vr64-r9qj-h27f for clojure 1.11.1,\n# and dozens of GHSA records for jackson-databind 2.9.8), so a scan should report findings.\n#\n# Build:\n#   docker build -t leiningen-testbed .\n# Inspect the manifest the image contains:\n#   docker run --rm leiningen-testbed\n# Ground truth (Maven coordinates as Leiningen itself resolves them):\n#   docker run --rm leiningen-testbed cat /app/pom.xml\n# Scan it with OSV-SCALIBR once the extractor exists:\n#   docker run --rm leiningen-testbed cat /app/project.clj > project.clj\n#   scalibr --root=. --result=-\n\nFROM docker.io/library/clojure:temurin-21-lein-2.13.0-bookworm-slim\n\nENV LEIN_ROOT=1\nWORKDIR /app\n\nRUN printf '%s\\n' \\\n    '(defproject leiningen-osv-testbed \"0.1.0\"' \\\n    '  :description \"Real project.clj for verifying an OSV-SCALIBR Leiningen extractor\"' \\\n    '  :dependencies [[org.clojure/clojure \"1.11.1\"]' \\\n    '                 [cheshire \"5.13.0\"]' \\\n    '                 [ring/ring-core \"1.12.2\" :exclusions [commons-io]]' \\\n    '                 [com.fasterxml.jackson.core/jackson-databind \"2.9.8\"]]' \\\n    '  :profiles {:dev {:dependencies [[org.clojure/test.check \"1.1.1\"]]}})' \\\n    > project.clj\n\n# Resolve every dependency from Maven Central / Clojars (fails if any coordinate is fake),\n# keep the resolved tree for reference, and emit the equivalent Maven pom.xml.\nRUN lein deps \\\n && lein deps :tree > deps-tree.txt 2>&1 \\\n && lein pom\n\n# Fail the build loudly unless Leiningen mapped every declared dependency to the expected\n# Maven coordinate, so the image is only ever published in a state useful for verification.\nRUN tr -d ' \\n\\t' < pom.xml > /tmp/pom.flat \\\n && grep -q 'org.clojureclojure1.11.1' /tmp/pom.flat \\\n && grep -q 'cheshirecheshire5.13.0' /tmp/pom.flat \\\n && grep -q 'ringring-core1.12.2' /tmp/pom.flat \\\n && grep -q 'com.fasterxml.jackson.corejackson-databind2.9.8' /tmp/pom.flat \\\n && grep -q 'org.clojuretest.check1.1.1' /tmp/pom.flat \\\n && echo \"OK: all 5 declared dependencies resolved and mapped to Maven coordinates\"\n\nCMD [\"cat\", \"/app/project.clj\"]\n\n\n# Verification testbed for an OSV-SCALIBR Leiningen (`project.clj`) extractor\n\nThis Dockerfile builds a container holding a **real Leiningen `project.clj`**, for verifying the\nsoftware inventory extraction plugin proposed in:\n\n- Approved PRP issue: https://github.com/google/osv-scalibr/issues/1953\n\n**Distribution method:** Leiningen / `project.clj`, the manifest of the most established Clojure\nbuild tool. Dependencies come from Maven Central and [Clojars](https://clojars.org).\n**OSV ecosystem:** `Maven` (every Leiningen coordinate is a Maven `groupId:artifactId`).\n\n## Why it is built, not just copied in\n\nLeiningen itself resolves every declared dependency during the build, so every coordinate in the\nmanifest is real and downloadable (a typo fails the build). It then runs `lein pom`, and the\nresulting `pom.xml` is Leiningen's own statement of the Maven coordinates, i.e. the ground truth\nfor what the extractor should report. The dependency set exercises the cases a `project.clj`\nextractor has to get right:\n\n| Case | Declaration | Expected Maven coordinate |\n|---|---|---|\n| Namespaced coordinate | `[org.clojure/clojure \"1.11.1\"]` | `org.clojure:clojure` 1.11.1 |\n| Bare symbol (group == artifact) | `[cheshire \"5.13.0\"]` | `cheshire:cheshire` 5.13.0 |\n| Options after the version | `[ring/ring-core \"1.12.2\" :exclusions [commons-io]]` | `ring:ring-core` 1.12.2 |\n| Plain Java artifact | `[com.fasterxml.jackson.core/jackson-databind \"2.9.8\"]` | `com.fasterxml.jackson.core:jackson-databind` 2.9.8 |\n| Profile-scoped dependency | `:profiles {:dev {:dependencies [[org.clojure/test.check \"1.1.1\"]]}}` | `org.clojure:test.check` 1.1.1 (test scope) |\n\nTwo of these carry real OSV.dev records, so a scan should produce findings (queried via\n`api.osv.dev/v1/query`, ecosystem `Maven`):\n\n- `org.clojure:clojure` 1.11.1: GHSA-vr64-r9qj-h27f (CVE-2024-22871)\n- `com.fasterxml.jackson.core:jackson-databind` 2.9.8: 59 records, e.g. GHSA-288c-cq4h-88gq\n  (CVE-2020-25649), GHSA-57j2-w4cx-62h2 (CVE-2020-36518)\n\nThe build has a self-check step that fails loudly unless all five declared dependencies appear in\nthe generated `pom.xml` with the expected `groupId`, `artifactId` and `version`.\n\n## Usage\n\n```sh\ndocker build -t leiningen-testbed .\ndocker run --rm leiningen-testbed                        # prints the project.clj\ndocker run --rm leiningen-testbed cat /app/pom.xml       # Leiningen's own Maven mapping\ndocker run --rm leiningen-testbed cat /app/deps-tree.txt # full resolved tree (lein deps :tree)\n```\n\nTo scan it with OSV-SCALIBR once the extractor exists:\n\n```sh\ndocker run --rm leiningen-testbed cat /app/project.clj > project.clj\nscalibr --root=. --result=-\n```\n\n## Verified output\n\nBuilt and run successfully (podman 3.4.4 on linux/arm64; base\n`clojure:temurin-21-lein-2.13.0-bookworm-slim` = Leiningen 2.13.0 on Java 21.0.12.1; image\n449 MB). The base image is multi-arch (amd64 and arm64). `docker run --rm leiningen-testbed`\nprints:\n\n```clojure\n(defproject leiningen-osv-testbed \"0.1.0\"\n  :description \"Real project.clj for verifying an OSV-SCALIBR Leiningen extractor\"\n  :dependencies [[org.clojure/clojure \"1.11.1\"]\n                 [cheshire \"5.13.0\"]\n                 [ring/ring-core \"1.12.2\" :exclusions [commons-io]]\n                 [com.fasterxml.jackson.core/jackson-databind \"2.9.8\"]]\n  :profiles {:dev {:dependencies [[org.clojure/test.check \"1.1.1\"]]}})\n```\n\nand the self-check step printed\n`OK: all 5 declared dependencies resolved and mapped to Maven coordinates`.\n\nNote on `deps-tree.txt`: it also lists `nrepl` and `org.nrepl/incomplete`, which Leiningen injects\ninto its default dev profile on its own. They are not declared in `project.clj`, and an extractor\nreading the manifest should not report them.\n", "creation_timestamp": "2026-10-06T01:14:59.000000Z"}