Maven Dependency Scope Applied

To get started, we are going to take an example of a typical three-layer app to analyze the module boundaries and the challenges faced in managing them.
The typical Maven module configuration for this kind of structure would look something like this.
Our main concern here is that this setup needs to provide the level of encapsulation we desire for our modules.
It would still be possible to use any public classes declared in the dao module within both the service and the web modules.
This could break down the initial design and result in a tightly-coupled application as it grows and evolves.
Given the above, let's have a look at how we can improve this solution to gain better control over module boundaries by restructuring our initial app sample a bit and updating its pom.
Two new modules have been added in this improved version: the dao-api and the service-api.
Apart from the default compile scope, some dependencies now have the runtime scope.
Compile: This is the default scope, used if none is specified.
Compile dependencies are available in all classpaths of a project.
Those dependencies are propagated to dependent projects.
Runtime: This scope indicates that the dependency is not required for compilation, but is for execution.
Maven includes a dependency with this scope in the runtime and test classpaths but not the compile classpath.
The result of this configuration is that only the DAO interfaces from the dao-api are available in the service module, ensuring that there's no exposure of the dao internals.
The same applies to the web module regarding the service.
While adding new modules might require more effort and might be considered as an extra complexity, it is a reasonable trade-off for improved encapsulation, which is essential to adhere to the chosen design.
Through this article, we have shed light on a simple yet frequently overlooked approach to managing dependencies in the multi-module project with Maven.
While it may require a fair amount of effort, its application can result in a significant improvement in the control of module boundaries.
This is particularly true when possible alternatives like the Java Platform Module System or ArchUnit are not viable for some reason.
Opinions expressed by DZone contributors are their own.


This Cyber News was published on feeds.dzone.com. Publication date: Mon, 22 Jan 2024 17:43:03 +0000


Cyber News related to Maven Dependency Scope Applied

Maven Dependency Scope Applied - To get started, we are going to take an example of a typical three-layer app to analyze the module boundaries and the challenges faced in managing them. The typical Maven module configuration for this kind of structure would look something like this. ...
1 year ago Feeds.dzone.com
CVE-2023-35946 - Gradle is a build tool with a focus on build automation and support for multi-language development. When Gradle writes a dependency into its dependency cache, it uses the dependency's coordinates to compute a file location. With specially crafted ...
1 year ago
CVE-2022-23630 - Gradle is a build tool with a focus on build automation and support for multi-language development. In some cases, Gradle may skip that verification and accept a dependency that would otherwise fail the build as an untrusted external artifact. This ...
3 years ago
CVE-2022-46751 - Improper Restriction of XML External Entity Reference, XML Injection (aka Blind XPath Injection) vulnerability in Apache Software Foundation Apache Ivy.This issue affects any version of Apache Ivy prior to 2.5.2. ...
5 months ago
CVE-2023-49898 - In streampark, there is a project module that integrates Maven's compilation capability. However, there is no check on the compilation parameters of Maven. allowing attackers to insert commands for remote command execution, The prerequisite for a ...
1 year ago Tenable.com
CVE-2024-36115 - Reposilite is an open source, lightweight and easy-to-use repository manager for Maven based artifacts in JVM ecosystem. As a Maven repository manager, Reposilite provides the ability to view the artifacts content in the browser, as well as perform ...
8 months ago
CVE-2021-39134 - `@npmcli/arborist`, the library that calculates dependency trees and manages the `node_modules` folder hierarchy for the npm command line interface, aims to guarantee that package dependency contracts will be met, and the extraction of package ...
2 years ago
CVE-2021-26291 - Apache Maven will follow repositories that are defined in a dependency’s Project Object Model (pom) which may be surprising to some users, resulting in potential risk if a malicious actor takes over that repository or is able to insert themselves ...
2 years ago
CVE-2021-29427 - In Gradle from version 5.1 and before version 7.0 there is a vulnerability which can lead to information disclosure and/or dependency poisoning. Repository content filtering is a security control Gradle introduced to help users specify what ...
3 years ago
CVE-2022-39350 - @dependencytrack/frontend is a Single Page Application (SPA) used in Dependency-Track, an open source Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Due to the common practice of ...
2 years ago
CVE-2022-31156 - Gradle is a build tool. Dependency verification is a security feature in Gradle Build Tool that was introduced to allow validation of external dependencies either through their checksum or cryptographic signatures. In versions 6.2 through 7.4.2, ...
1 year ago
CVE-2023-35143 - Jenkins Maven Repository Server Plugin 1.10 and earlier does not escape the versions of build artifacts on the Build Artifacts As Maven Repository page, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to ...
1 year ago
CVE-2024-36116 - Reposilite is an open source, lightweight and easy-to-use repository manager for Maven based artifacts in JVM ecosystem. Reposilite provides support for JavaDocs files, which are archives that contain documentation for artifacts. Specifically, ...
8 months ago
CVE-2024-47197 - Exposure of Sensitive Information to an Unauthorized Actor, Insecure Storage of Sensitive Information vulnerability in Maven Archetype Plugin. ...
5 months ago
CVE-2025-24355 - Updatecli is a tool used to apply file update strategies. Prior to version 0.93.0, private maven repository credentials may be leaked in application logs in case of unsuccessful retrieval operation. During the execution of an updatecli pipeline which ...
1 month ago Tenable.com
CVE-2023-50713 - Speckle Server provides server, frontend, 3D viewer, and other JavaScript utilities for the Speckle 3D data platform. A vulnerability in versions prior to 2.17.6 affects users who: authorized an application which requested a 'token write' scope or, ...
1 year ago Tenable.com
CVE-2017-1000397 - Jenkins Maven Plugin 2.17 and earlier bundled a version of the commons-httpclient library with the vulnerability CVE-2012-6153 that incorrectly verified SSL certificates, making it susceptible to man-in-the-middle attacks. Maven Plugin 3.0 no longer ...
7 years ago
CVE-2023-26053 - Gradle is a build tool with a focus on build automation and support for multi-language development. This is a collision attack on long IDs (64bits) for PGP keys. Users of dependency verification in Gradle are vulnerable if they use long IDs for PGP ...
1 year ago
CVE-2025-27137 - Dependency-Track is a component analysis platform that allows organizations to identify and reduce risk in the software supply chain. Dependency-Track allows users with the `SYSTEM_CONFIGURATION` permission to customize notification templates. ...
2 weeks ago Tenable.com
CVE-2024-45310 - runc is a CLI tool for spawning and running containers according to the OCI specification. runc 1.1.13 and earlier, as well as 1.2.0-rc2 and earlier, can be tricked into creating empty files or directories in arbitrary locations in the host ...
2 weeks ago
CVE-2023-28959 - An Improper Check or Handling of Exceptional Conditions vulnerability in packet processing of Juniper Networks Junos OS on QFX10002 allows an unauthenticated, adjacent attacker on the local broadcast domain sending a malformed packet to the device, ...
1 year ago
CVE-2013-0253 - The default configuration of Apache Maven 3.0.4, when using Maven Wagon 2.1, disables SSL certificate checks, which allows remote attackers to spoof servers via a man-in-the-middle (MITM) attack. ...
5 years ago
CVE-2019-20343 - The MojoHaus Exec Maven plugin 1.1.1 for Maven allows code execution via a crafted XML document because a configuration element (within a plugin element) can specify an arbitrary program in an executable element (and can also specify arbitrary ...
5 years ago
CVE-2020-10721 - A flaw was found in the fabric8-maven-plugin 4.0.0 and later. When using a wildfly-swarm or thorntail custom configuration, a malicious YAML configuration file on the local machine executing the maven plug-in could allow for deserialization of ...
4 years ago
CVE-2023-35144 - Jenkins Maven Repository Server Plugin 1.10 and earlier does not escape project and build display names on the Build Artifacts As Maven Repository page, resulting in a stored cross-site scripting (XSS) vulnerability. ...
1 year ago

Cyber Trends (last 7 days)