Merge pull request #320 from hmcts/update-dependency-check

Update dependency check

Author: Michael1142

README.md

@@ -53,17 +53,29 @@ It only scans runtime configurations by default.  This can be overridden in proj
 
 ### Usage
 
-`./gradlew dependencyCheckAggregate`
+You can request a [NVD API key](https://nvd.nist.gov/developers/request-an-api-key) to improve Dependency Check performance and avoid NVD rate limiting.
+
+It can be provided via an environment variable:
+
+```bash
+export NVD_API_KEY=YOUR_KEY
+```
+
+Or via a Gradle property:
+
+```bash
+./gradlew dependencyCheckAggregate -PPdependencyCheck.nvd.apiKey=YOUR_KEY
+```
 
 ### Suppressions
 
-Due to the way the dependency checker works, false positives are an [expected occurence.](https://jeremylong.github.io/DependencyCheck/general/suppression.html)
+Due to the way the dependency checker works, false positives are an [expected occurrence.](https://jeremylong.github.io/DependencyCheck/general/suppression.html)
 
 Provide the dependency checker with the path to your [suppression file](https://jeremylong.github.io/DependencyCheck/general/suppression.html):
 
 ```groovy
 dependencyCheck {
-  suppressionFile = 'path/to/supression.xml'
+  suppressionFile = 'path/to/suppressions.xml'
 }
 ```
 

build.gradle

@@ -7,10 +7,11 @@ plugins {
 
 repositories {
     mavenCentral()
+    maven { url "https://plugins.gradle.org/m2/" }
 }
 
 dependencies {
-    implementation 'org.owasp:dependency-check-gradle:10.0.3'
+    implementation 'org.owasp:dependency-check-gradle:12.2.0'
     implementation 'org.apache.maven:maven-artifact:3.9.10'
     compileOnly 'org.projectlombok:lombok:1.18.38'
     annotationProcessor 'org.projectlombok:lombok:1.18.38'
@@ -30,10 +31,8 @@ compileJava {
     options.compilerArgs += ["-Werror"]
 }
 
-def version = System.getenv("RELEASE_VERSION")?.replace("refs/tags/", "") ?: "DEV-SNAPSHOT"
-
 group = 'uk.gov.hmcts.reform'
-project.version = version
+project.version = System.getenv("RELEASE_VERSION")?.replace("refs/tags/", "") ?: "DEV-SNAPSHOT"
 
 gradlePlugin {
     // Define the plugin

src/main/java/uk/gov/hmcts/tools/DependencyCheckSetup.java

@@ -36,6 +36,26 @@ public static void apply(Project project) {
         project.getPlugins().apply(DependencyCheckPlugin.class);
 
         DependencyCheckExtension extension = project.getExtensions().getByType(DependencyCheckExtension.class);
+
+        Project root = project.getRootProject();
+
+        // Gradle property: -PdependencyCheck.nvd.apiKey=...
+        String apiKey = (String) root.findProperty("dependencyCheck.nvd.apiKey");
+
+        // JVM system property: -DdependencyCheck.nvd.apiKey=...
+        if (apiKey == null || apiKey.isBlank()) {
+            apiKey = System.getProperty("dependencyCheck.nvd.apiKey");
+        }
+
+        // Environment variable
+        if (apiKey == null || apiKey.isBlank()) {
+            apiKey = System.getenv("NVD_API_KEY");
+        }
+
+        if (apiKey != null && !apiKey.isBlank()) {
+            extension.getNvd().setApiKey(apiKey);
+        }
+
         extension.setFailBuildOnCVSS(0f);
 
         // Match the CNP pipeline which disables these checks