Spring4shell utility to list out relevant package versions

find_spring4shell.sh

#!/usr/bin/env nix-shell
#!nix-shell -i bash -p xmlstarlet maven
# shellcheck shell=bash disable=SC1008

set -euo pipefail

function do_the_thing {
  cd "$1"
  tmpfile="$(mktemp)"
  trap 'rm -f "$tmpfile"' RETURN

  MVNCMD="mvn"
  if [ -x mvnw ]; then
    MVNCMD="./mvnw"
  fi

  "$MVNCMD" dependency:resolve >/dev/null 2>&1 # download deps first
  "$MVNCMD" help:effective-pom -Doutput="$tmpfile" >/dev/null 2>&1

  # list out every org.springframework dependency
  xmlstarlet sel -t -m '//*/_:dependency[starts-with(_:groupId,"org.springframework.")]' \
    -v '_:groupId' \
    -o ':' \
    -v '_:artifactId' \
    -o ':' \
    -v '_:version' \
    -n "$tmpfile"

  xmlstarlet sel -t -m '//*/_:dependency[starts-with(_:groupId,"org.apache.tomcat")]' \
    -v '_:groupId' \
    -o ':' \
    -v '_:artifactId' \
    -o ':' \
    -v '_:version' \
    -n "$tmpfile"

  cd -
}

for dir in `find . -name 'pom.xml' -exec dirname {} \;`; do
  echo "### START CHECKING ON DIRECTORY ${dir} ###"
  do_the_thing "$dir"
  echo "### COMPLETED:                  ${dir} ###"
  echo
done