Skip to content

Commit 9acbb33

Browse files
chadlwilsonchadlwilson
authored
feat: improve Sonatype Guide / OSS Index cache handling and insufficient credits error reporting (dependency-check#8451)
Signed-off-by: Chad Wilson <29788154+chadlwilson@users.noreply.github.com>
1 parent a64b366 commit 9acbb33

20 files changed

Lines changed: 563 additions & 438 deletions

File tree

‎ant/src/main/java/org/owasp/dependencycheck/taskdefs/Check.java‎

Lines changed: 57 additions & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -17,13 +17,6 @@
1717
*/
1818
package org.owasp.dependencycheck.taskdefs;
1919

20-
import java.io.File;
21-
import java.util.ArrayList;
22-
import java.util.List;
23-
import java.util.stream.Collectors;
24-
import java.util.stream.Stream;
25-
import javax.annotation.concurrent.NotThreadSafe;
26-
2720
import org.apache.tools.ant.BuildException;
2821
import org.apache.tools.ant.Project;
2922
import org.apache.tools.ant.types.EnumeratedAttribute;
@@ -34,6 +27,7 @@
3427
import org.apache.tools.ant.types.resources.Resources;
3528
import org.owasp.dependencycheck.Engine;
3629
import org.owasp.dependencycheck.agent.DependencyCheckScanAgent;
30+
import org.owasp.dependencycheck.ant.logging.AntTaskHolder;
3731
import org.owasp.dependencycheck.data.nvdcve.DatabaseException;
3832
import org.owasp.dependencycheck.dependency.Dependency;
3933
import org.owasp.dependencycheck.dependency.Vulnerability;
@@ -46,7 +40,13 @@
4640
import org.owasp.dependencycheck.utils.Settings;
4741
import org.owasp.dependencycheck.utils.SeverityUtil;
4842
import org.owasp.dependencycheck.utils.scarf.TelemetryCollector;
49-
import org.owasp.dependencycheck.ant.logging.AntTaskHolder;
43+
44+
import javax.annotation.concurrent.NotThreadSafe;
45+
import java.io.File;
46+
import java.util.ArrayList;
47+
import java.util.List;
48+
import java.util.stream.Collectors;
49+
import java.util.stream.Stream;
5050

5151
//CSOFF: MethodCount
5252
/**
@@ -354,23 +354,27 @@ public class Check extends Update {
354354
/**
355355
* Whether or not the Sonatype OSS Index analyzer is enabled.
356356
*/
357-
private Boolean ossindexAnalyzerEnabled;
357+
private Boolean ossIndexAnalyzerEnabled;
358358
/**
359359
* Whether or not the Sonatype OSS Index analyzer should cache results.
360360
*/
361-
private Boolean ossindexAnalyzerUseCache;
361+
private Boolean ossIndexAnalyzerUseCache;
362+
/**
363+
* The number of hours to wait before checking for new updates on individual packages/components from Sonatype OSS Index.
364+
*/
365+
private Integer ossIndexAnalyzerCacheValidForHours;
362366
/**
363367
* URL of the Sonatype OSS Index service.
364368
*/
365-
private String ossindexAnalyzerUrl;
369+
private String ossIndexAnalyzerUrl;
366370
/**
367371
* The username to use for the Sonatype OSS Index service.
368372
*/
369-
private String ossindexAnalyzerUsername;
373+
private String ossIndexAnalyzerUsername;
370374
/**
371375
* The password to use for the Sonatype OSS Index service.
372376
*/
373-
private String ossindexAnalyzerPassword;
377+
private String ossIndexAnalyzerPassword;
374378
/**
375379
* Whether we should only warn about Sonatype OSS Index remote errors
376380
* instead of failing completely.
@@ -1226,16 +1230,16 @@ public void setPathToDotnetCore(String pathToCore) {
12261230
}
12271231

12281232
/**
1229-
* Set value of {@link #ossindexAnalyzerEnabled}.
1233+
* Set value of {@link #ossIndexAnalyzerEnabled}.
12301234
*
1231-
* @param ossindexAnalyzerEnabled new value of ossindexAnalyzerEnabled
1235+
* @param ossIndexAnalyzerEnabled new value of ossIndexAnalyzerEnabled
12321236
* @deprecated Use {@link #setOssIndexAnalyzerEnabled(Boolean)} instead.
12331237
*/
12341238
@Deprecated
1235-
public void setOssindexAnalyzerEnabled(Boolean ossindexAnalyzerEnabled) {
1239+
public void setOssindexAnalyzerEnabled(Boolean ossIndexAnalyzerEnabled) {
12361240
log("'ossindexAnalyzerEnabled' is deprecated and may be removed in the next major release, please migrate to 'ossIndexAnalyzerEnabled'",
12371241
Project.MSG_WARN);
1238-
this.ossindexAnalyzerEnabled = ossindexAnalyzerEnabled;
1242+
this.ossIndexAnalyzerEnabled = ossIndexAnalyzerEnabled;
12391243
}
12401244

12411245
/**
@@ -1244,20 +1248,20 @@ public void setOssindexAnalyzerEnabled(Boolean ossindexAnalyzerEnabled) {
12441248
* @param ossIndexAnalyzerEnabled new value of ossIndexAnalyzerEnabled
12451249
*/
12461250
public void setOssIndexAnalyzerEnabled(Boolean ossIndexAnalyzerEnabled) {
1247-
this.ossindexAnalyzerEnabled = ossIndexAnalyzerEnabled;
1251+
this.ossIndexAnalyzerEnabled = ossIndexAnalyzerEnabled;
12481252
}
12491253

12501254
/**
1251-
* Set value of {@link #ossindexAnalyzerUseCache}.
1255+
* Set value of {@link #ossIndexAnalyzerUseCache}.
12521256
*
1253-
* @param ossindexAnalyzerUseCache new value of ossindexAnalyzerUseCache
1257+
* @param ossIndexAnalyzerUseCache new value of ossIndexAnalyzerUseCache
12541258
* @deprecated Use {@link #setOssIndexAnalyzerUseCache(Boolean)} instead.
12551259
*/
12561260
@Deprecated
1257-
public void setOssindexAnalyzerUseCache(Boolean ossindexAnalyzerUseCache) {
1261+
public void setOssindexAnalyzerUseCache(Boolean ossIndexAnalyzerUseCache) {
12581262
log("'ossindexAnalyzerUseCache' is deprecated and may be removed in the next major release, please migrate to 'ossIndexAnalyzerUseCache'",
12591263
Project.MSG_WARN);
1260-
this.ossindexAnalyzerUseCache = ossindexAnalyzerUseCache;
1264+
this.ossIndexAnalyzerUseCache = ossIndexAnalyzerUseCache;
12611265
}
12621266

12631267
/**
@@ -1266,20 +1270,29 @@ public void setOssindexAnalyzerUseCache(Boolean ossindexAnalyzerUseCache) {
12661270
* @param ossIndexAnalyzerUseCache new value of ossIndexAnalyzerUseCache
12671271
*/
12681272
public void setOssIndexAnalyzerUseCache(Boolean ossIndexAnalyzerUseCache) {
1269-
this.ossindexAnalyzerUseCache = ossIndexAnalyzerUseCache;
1273+
this.ossIndexAnalyzerUseCache = ossIndexAnalyzerUseCache;
1274+
}
1275+
1276+
/**
1277+
* Set value of {@link #ossIndexAnalyzerCacheValidForHours}.
1278+
*
1279+
* @param ossIndexAnalyzerCacheValidForHours new value of ossIndexAnalyzerCacheValidForHours
1280+
*/
1281+
public void setOssIndexAnalyzerCacheValidForHours(Integer ossIndexAnalyzerCacheValidForHours) {
1282+
this.ossIndexAnalyzerCacheValidForHours = ossIndexAnalyzerCacheValidForHours;
12701283
}
12711284

12721285
/**
1273-
* Set value of {@link #ossindexAnalyzerUrl}.
1286+
* Set value of {@link #ossIndexAnalyzerUrl}.
12741287
*
1275-
* @param ossindexAnalyzerUrl new value of ossindexAnalyzerUrl
1288+
* @param ossIndexAnalyzerUrl new value of ossIndexAnalyzerUrl
12761289
* @deprecated Use {@link #setOssIndexAnalyzerUrl(String)} instead.
12771290
*/
12781291
@Deprecated
1279-
public void setOssindexAnalyzerUrl(String ossindexAnalyzerUrl) {
1292+
public void setOssindexAnalyzerUrl(String ossIndexAnalyzerUrl) {
12801293
log("'ossindexAnalyzerUrl' is deprecated and may be removed in the next major release, please migrate to 'ossIndexAnalyzerUrl'",
12811294
Project.MSG_WARN);
1282-
this.ossindexAnalyzerUrl = ossindexAnalyzerUrl;
1295+
this.ossIndexAnalyzerUrl = ossIndexAnalyzerUrl;
12831296
}
12841297

12851298
/**
@@ -1288,20 +1301,20 @@ public void setOssindexAnalyzerUrl(String ossindexAnalyzerUrl) {
12881301
* @param ossIndexAnalyzerUrl new value of ossIndexAnalyzerUrl
12891302
*/
12901303
public void setOssIndexAnalyzerUrl(String ossIndexAnalyzerUrl) {
1291-
this.ossindexAnalyzerUrl = ossIndexAnalyzerUrl;
1304+
this.ossIndexAnalyzerUrl = ossIndexAnalyzerUrl;
12921305
}
12931306

12941307
/**
1295-
* Set value of {@link #ossindexAnalyzerUsername}.
1308+
* Set value of {@link #ossIndexAnalyzerUsername}.
12961309
*
1297-
* @param ossindexAnalyzerUsername new value of ossindexAnalyzerUsername
1310+
* @param ossIndexAnalyzerUsername new value of ossIndexAnalyzerUsername
12981311
* @deprecated Use {@link #setOssIndexAnalyzerUsername(String)} instead.
12991312
*/
13001313
@Deprecated
1301-
public void setOssindexAnalyzerUsername(String ossindexAnalyzerUsername) {
1314+
public void setOssindexAnalyzerUsername(String ossIndexAnalyzerUsername) {
13021315
log("'ossindexAnalyzerUsername' is deprecated and may be removed in the next major release, please migrate to 'ossIndexAnalyzerUsername'",
13031316
Project.MSG_WARN);
1304-
this.ossindexAnalyzerUsername = ossindexAnalyzerUsername;
1317+
this.ossIndexAnalyzerUsername = ossIndexAnalyzerUsername;
13051318
}
13061319

13071320
/**
@@ -1310,20 +1323,20 @@ public void setOssindexAnalyzerUsername(String ossindexAnalyzerUsername) {
13101323
* @param ossIndexAnalyzerUsername new value of ossIndexAnalyzerUsername
13111324
*/
13121325
public void setOssIndexAnalyzerUsername(String ossIndexAnalyzerUsername) {
1313-
this.ossindexAnalyzerUsername = ossIndexAnalyzerUsername;
1326+
this.ossIndexAnalyzerUsername = ossIndexAnalyzerUsername;
13141327
}
13151328

13161329
/**
1317-
* Set value of {@link #ossindexAnalyzerPassword}.
1330+
* Set value of {@link #ossIndexAnalyzerPassword}.
13181331
*
1319-
* @param ossindexAnalyzerPassword new value of ossindexAnalyzerPassword
1332+
* @param ossIndexAnalyzerPassword new value of ossIndexAnalyzerPassword
13201333
* @deprecated Use {@link #setOssIndexAnalyzerPassword(String)} instead.
13211334
*/
13221335
@Deprecated
1323-
public void setOssindexAnalyzerPassword(String ossindexAnalyzerPassword) {
1336+
public void setOssindexAnalyzerPassword(String ossIndexAnalyzerPassword) {
13241337
log("'ossindexAnalyzerPassword' is deprecated and may be removed in the next major release, please migrate to 'ossIndexAnalyzerPassword'",
13251338
Project.MSG_WARN);
1326-
this.ossindexAnalyzerPassword = ossindexAnalyzerPassword;
1339+
this.ossIndexAnalyzerPassword = ossIndexAnalyzerPassword;
13271340
}
13281341

13291342
/**
@@ -1332,7 +1345,7 @@ public void setOssindexAnalyzerPassword(String ossindexAnalyzerPassword) {
13321345
* @param ossIndexAnalyzerPassword new value of ossIndexAnalyzerPassword
13331346
*/
13341347
public void setOssIndexAnalyzerPassword(String ossIndexAnalyzerPassword) {
1335-
this.ossindexAnalyzerPassword = ossIndexAnalyzerPassword;
1348+
this.ossIndexAnalyzerPassword = ossIndexAnalyzerPassword;
13361349
}
13371350

13381351
/**
@@ -1609,11 +1622,12 @@ protected void populateSettings() throws BuildException {
16091622
getSettings().setBooleanIfNotNull(Settings.KEYS.ANALYZER_NEXUS_USES_PROXY, nexusUsesProxy);
16101623
getSettings().setStringIfNotEmpty(Settings.KEYS.ADDITIONAL_ZIP_EXTENSIONS, zipExtensions);
16111624
getSettings().setStringIfNotEmpty(Settings.KEYS.ANALYZER_ASSEMBLY_DOTNET_PATH, pathToCore);
1612-
getSettings().setBooleanIfNotNull(Settings.KEYS.ANALYZER_OSSINDEX_ENABLED, ossindexAnalyzerEnabled);
1613-
getSettings().setStringIfNotEmpty(Settings.KEYS.ANALYZER_OSSINDEX_URL, ossindexAnalyzerUrl);
1614-
getSettings().setStringIfNotEmpty(Settings.KEYS.ANALYZER_OSSINDEX_USER, ossindexAnalyzerUsername);
1615-
getSettings().setStringIfNotEmpty(Settings.KEYS.ANALYZER_OSSINDEX_PASSWORD, ossindexAnalyzerPassword);
1616-
getSettings().setBooleanIfNotNull(Settings.KEYS.ANALYZER_OSSINDEX_USE_CACHE, ossindexAnalyzerUseCache);
1625+
getSettings().setBooleanIfNotNull(Settings.KEYS.ANALYZER_OSSINDEX_ENABLED, ossIndexAnalyzerEnabled);
1626+
getSettings().setStringIfNotEmpty(Settings.KEYS.ANALYZER_OSSINDEX_URL, ossIndexAnalyzerUrl);
1627+
getSettings().setStringIfNotEmpty(Settings.KEYS.ANALYZER_OSSINDEX_USER, ossIndexAnalyzerUsername);
1628+
getSettings().setStringIfNotEmpty(Settings.KEYS.ANALYZER_OSSINDEX_PASSWORD, ossIndexAnalyzerPassword);
1629+
getSettings().setBooleanIfNotNull(Settings.KEYS.ANALYZER_OSSINDEX_USE_CACHE, ossIndexAnalyzerUseCache);
1630+
getSettings().setIntIfNotNull(Settings.KEYS.ANALYZER_OSSINDEX_CACHE_VALID_FOR_HOURS, ossIndexAnalyzerCacheValidForHours);
16171631
getSettings().setBooleanIfNotNull(Settings.KEYS.ANALYZER_OSSINDEX_WARN_ONLY_ON_REMOTE_ERRORS, ossIndexAnalyzerWarnOnlyOnRemoteErrors);
16181632
getSettings().setFloat(Settings.KEYS.JUNIT_FAIL_ON_CVSS, junitFailOnCVSS);
16191633
getSettings().setBooleanIfNotNull(Settings.KEYS.FAIL_ON_UNUSED_SUPPRESSION_RULE, failBuildOnUnusedSuppressionRule);

‎ant/src/site/markdown/configuration.md‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -85,7 +85,8 @@ be needed.
8585
| knownExploitedEnabled | Sets whether the Known Exploited Vulnerability update and analyzer are enabled. | true |
8686
| knownExploitedUrl | Sets URL to the CISA Known Exploited Vulnerabilities JSON data feed. | https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json |
8787
| ossIndexAnalyzerEnabled | Sets whether the [OSS Index Analyzer](../analyzers/oss-index-analyzer.html) will be enabled. This analyzer requires an internet connection, and authentication is mandatory. *Deprecated alias: `ossindexAnalyzerEnabled`* | true |
88-
| ossIndexAnalyzerUseCache | Sets whether the OSS Index Analyzer will cache results. Cached results expire after 24 hours. *Deprecated alias: `ossindexAnalyzerUseCache`* | true |
88+
| ossIndexAnalyzerUseCache | Sets whether the OSS Index Analyzer will cache results. *Deprecated alias: `ossindexAnalyzerUseCache`* | true |
89+
| ossIndexAnalyzerCacheValidForHours | The number of hours to wait before checking for new updates on individual packages/components from Sonatype OSS Index. | 24 |
8990
| ossIndexAnalyzerUrl | Alternative base URL for the OSS Index API. If not set the public Sonatype OSS Index API on Sonatype Guide will be used. *Deprecated alias: `ossindexAnalyzerUrl`* | https://api.guide.sonatype.com |
9091
| ossIndexAnalyzerUsername | *(deprecated)* Sets the OSS Index API username for use with legacy OSS Index API tokens. Username is not required after migration to using Sonatype Guide personal access token as password. *Deprecated alias: `ossindexAnalyzerUsername`* | &nbsp; |
9192
| ossIndexAnalyzerPassword | Sets the Sonatype Guide personal access token or (deprecated) legacy OSS Index API token to authenticate with. *Deprecated alias: `ossindexAnalyzerPassword`* | &nbsp; |

‎ant/src/test/resources/build.xml‎

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -3,14 +3,14 @@
33

44
<taskdef name="dependency-check" classname="org.owasp.dependencycheck.taskdefs.Check" />
55

6-
<!-- HACK: disabling ossindex analyzer as it may cause failures due to rate-limiting -->
6+
<!-- HACK: disabling Sonatype oss index analyzer as it may cause failures due to authentication/rate-limiting -->
77

88
<target name="test.fileset">
99
<dependency-check
1010
projectName="My Project"
1111
reportOutputDirectory="${project.build.directory}"
1212
autoupdate="false"
13-
ossindexAnalyzerEnabled="false"
13+
ossIndexAnalyzerEnabled="false"
1414
centralAnalyzerEnabled="false"
1515
reportFormat="HTML">
1616

@@ -32,7 +32,7 @@
3232
projectName="My Project"
3333
reportOutputDirectory="${project.build.directory}"
3434
autoupdate="false"
35-
ossindexAnalyzerEnabled="false"
35+
ossIndexAnalyzerEnabled="false"
3636
centralAnalyzerEnabled="false"
3737
reportFormat="XML">
3838
<!-- Scan specific files -->
@@ -46,7 +46,7 @@
4646
projectName="My Project"
4747
reportOutputDirectory="${project.build.directory}"
4848
autoupdate="false"
49-
ossindexAnalyzerEnabled="false"
49+
ossIndexAnalyzerEnabled="false"
5050
centralAnalyzerEnabled="false"
5151
reportFormat="CSV">
5252

@@ -63,7 +63,7 @@
6363
projectName="test formatBAD"
6464
reportOutputDirectory="${project.build.directory}"
6565
autoupdate="false"
66-
ossindexAnalyzerEnabled="false"
66+
ossIndexAnalyzerEnabled="false"
6767
centralAnalyzerEnabled="false"
6868
reportFormat="BAD">
6969
</dependency-check>
@@ -74,7 +74,7 @@
7474
projectName="test formatNested"
7575
reportOutputDirectory="${project.build.directory}"
7676
autoupdate="false"
77-
ossindexAnalyzerEnabled="false"
77+
ossIndexAnalyzerEnabled="false"
7878
centralAnalyzerEnabled="false">
7979
<reportFormat format="HTML"/>
8080
<reportFormat format="CSV"/>
@@ -90,7 +90,7 @@
9090
projectName="test formatBADNested"
9191
reportOutputDirectory="${project.build.directory}"
9292
autoupdate="false"
93-
ossindexAnalyzerEnabled="false"
93+
ossIndexAnalyzerEnabled="false"
9494
centralAnalyzerEnabled="false">
9595
<reportFormat format="BAD"/>
9696
<!-- Scan a single file -->
@@ -106,7 +106,7 @@
106106
reportOutputDirectory="${project.build.directory}"
107107
reportFormat="XML"
108108
autoupdate="false"
109-
ossindexAnalyzerEnabled="false"
109+
ossIndexAnalyzerEnabled="false"
110110
centralAnalyzerEnabled="false"
111111
failBuildOnCVSS="3">
112112
<fileset dir="${project.build.directory}/test-classes/jars">
@@ -120,7 +120,7 @@
120120
projectName="test retireJS configuration"
121121
reportOutputDirectory="${project.build.directory}/retirejs-report.html"
122122
autoupdate="false"
123-
ossindexAnalyzerEnabled="false"
123+
ossIndexAnalyzerEnabled="false"
124124
centralAnalyzerEnabled="false"
125125
retireJsFilterNonVulnerable="true">
126126
<retireJsFilter regex="copyright.*jeremy long" />
@@ -139,7 +139,7 @@
139139
projectName="test suppression"
140140
reportOutputDirectory="${project.build.directory}/suppression-report.html"
141141
autoupdate="false"
142-
ossindexAnalyzerEnabled="false"
142+
ossIndexAnalyzerEnabled="false"
143143
centralAnalyzerEnabled="false"
144144
failBuildOnCVSS="3">
145145
<suppressionfile path="${project.build.directory}/test-classes/test-suppression1.xml" />
@@ -157,7 +157,7 @@
157157
projectName="test suppression"
158158
reportOutputDirectory="${project.build.directory}/suppression-single-report.html"
159159
autoupdate="false"
160-
ossindexAnalyzerEnabled="false"
160+
ossIndexAnalyzerEnabled="false"
161161
centralAnalyzerEnabled="false"
162162
failBuildOnCVSS="3"
163163
suppressionFile="${project.build.directory}/test-classes/test-suppression.xml">
@@ -171,7 +171,7 @@
171171
projectName="test suppression"
172172
reportOutputDirectory="${project.build.directory}/suppression-multiple-report.html"
173173
autoupdate="false"
174-
ossindexAnalyzerEnabled="false"
174+
ossIndexAnalyzerEnabled="false"
175175
centralAnalyzerEnabled="false"
176176
failBuildOnCVSS="3"
177177
suppressionFile="${project.build.directory}/test-classes/test-suppression1.xml">

0 commit comments

Comments
 (0)