依赖扫描（SCA）#

/**
 * CVSS 评分组成
 */
public class CVSSScore {
    // 基本评分（不随时间变化）
    double baseScore;

    // 时间评分（随时间推移可修复性变化）
    double temporalScore;

    // 环境评分（根据组织环境调整）
    double environmentalScore;

    // 攻击向量
    enum AttackVector { NETWORK, ADJACENT, LOCAL, PHYSICAL }

    // 攻击复杂度
    enum AttackComplexity { LOW, HIGH }

    // 影响类型
    enum Impact { NONE, LOW, HIGH }
}

public class LicenseComplianceService {

    private static final Set<String> APPROVED_LICENSES = Set.of(
        "Apache-2.0",
        "MIT",
        "BSD-2-Clause",
        "BSD-3-Clause",
        "ISC"
    );

    private static final Set<String> COPYLEFT_LICENSES = Set.of(
        "GPL-2.0-only",
        "GPL-3.0-only",
        "AGPL-3.0-only"
    );

    /**
     * 检查许可证合规性
     */
    public ComplianceResult checkLicense(Dependency dep) {
        String license = dep.getLicense();

        if (APPROVED_LICENSES.contains(license)) {
            return ComplianceResult.APPROVED;
        }

        if (COPYLEFT_LICENSES.contains(license)) {
            return ComplianceResult.NEEDS_REVIEW;  // 需要法律团队审核
        }

        return ComplianceResult.BLOCKED;  // 阻止使用
    }
}

@Service
public class DependencyUpdateService {

    /**
     * 生成依赖更新 PR
     */
    public PullRequest createUpdatePR(String dependency, String currentVersion,
                                       String fixedVersion, String cveId) {
        String title = String.format("fix: upgrade %s to %s (CVE-%s)",
                                     dependency, fixedVersion, cveId);

        String body = String.format("""
            ## Security Update Required

            **CVE**: %s
            **CVSS**: %s
            **Current Version**: %s
            **Fixed Version**: %s

            ### Impact
            [漏洞影响描述]

            ### Verification
            [ ] 单元测试通过
            [ ] 集成测试通过
            [ ] 手动验证
            """, cveId, "9.8", currentVersion, fixedVersion);

        // 创建 PR
        return githubClient.createPullRequest(title, body);
    }
}

@Service
public class VulnerabilityValidator {

    /**
     * 验证漏洞是否真正影响项目
     */
    public VulnerabilityImpact assessImpact(CVEDetail cve, ProjectContext context) {
        // 1. 检查传递依赖是否已覆盖
        boolean transitiveOverride = hasTransitiveVersionOverride(cve, context);

        // 2. 检查代码是否实际调用了漏洞代码路径
        boolean codePathUsed = isVulnerableCodePathUsed(cve, context);

        // 3. 检查是否有缓解措施
        boolean mitigated = hasMitigatingControls(cve, context);

        if (transitiveOverride || !codePathUsed || mitigated) {
            return VulnerabilityImpact.LOW;  // 降低严重性
        }

        return VulnerabilityImpact.fromCVSS(cve.getCVSSScore());
    }
}