private void processPom ( Dependency dependency , MavenArtifact ma ) throws IOException , AnalysisException { File pomFile = null ; try { final File baseDir = getSettings ( ) . getTempDirectory ( ) ; pomFile = File . createTempFile ( "pom" , ".xml" , baseDir ) ; Files . delete ( pomFile . toPath ( ) ) ; LOGGER . debug ( "Downloading {}" , ma . getPomUrl ( ) ) ; final Downloader downloader = new Downloader ( getSettings ( ) ) ; downloader . fetchFile ( new URL ( ma . getPomUrl ( ) ) , pomFile ) ; PomUtils . analyzePOM ( dependency , pomFile ) ; } catch ( DownloadFailedException ex ) { LOGGER . warn ( "Unable to download pom.xml for {} from Artifactory; " + "this could result in undetected CPE/CVEs." , dependency . getFileName ( ) ) ; } finally { if ( pomFile != null && pomFile . exists ( ) && ! FileUtils . deleteQuietly ( pomFile ) ) { LOGGER . debug ( "Failed to delete temporary pom file {}" , pomFile ) ; pomFile . deleteOnExit ( ) ; } } }
If necessary downloads the pom . xml from Central and adds the evidence to the dependency .