Added OWASP Dependency check #82
Conversation
| <suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd"> | ||
| <suppress> | ||
| <notes><![CDATA[This is a JS dependency.]]></notes> | ||
| <cve>CVE-2021-41251</cve> |
There was a problem hiding this comment.
(Major/Question)
How exactly is the JS dependency recognized?
If we are affected by this false-positive(?) then all other users of "owasp" will have a similar experience, right?
There was a problem hiding this comment.
It linked me to a dependency called cloud-sdk-js@core 1.0. I guessed it saw our openAI module use com.sap.ai.sdk:core:0.1.0-SNAPSHOT and thought it was good enough of a match...
I don't think this plugin is great, just better than blackduck hopefully.
@CharlesDuboisSAP , is this specifically for the vulnerability? |
| - name: "Build SDK" | ||
| run: | | ||
| MVN_ARGS="${{ env.MVN_MULTI_THREADED_ARGS }} clean install -DskipTests -DskipFormatting" | ||
| mvn $MVN_ARGS |
There was a problem hiding this comment.
(Explanation)
mvn install is necessary, otherwise the dependency-check will fail on missing core:0.1.0-SNAPSHOT.
| env: | ||
| SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK }} | ||
| SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK | ||
| #TODO: Blackduck and security rating steps |
There was a problem hiding this comment.
(Explanation)
With this change, we're not running dependency checks on PR commits.
Instead it's happening on main commits (merges).
| mvn $MVN_ARGS | ||
| - name: "OWASP Dependency check" | ||
| run: mvn org.owasp:dependency-check-maven:10.0.4:check -DnvdApiKey=$NVD_API_KEY -DfailBuildOnCVSS=7 -DskipProvidedScope=true -DsuppressionFile=.pipeline/dependency-check-suppression.xml |
There was a problem hiding this comment.
(Comment)
Be aware, having static plugin version in yaml (instead of pom) increases maintenance.
Context
AI/ai-sdk-java-backlog#65.
This is the equivalent of blackduck. It scans our dependencies and compares it to the
National Vulnerability Database.This is done on every commit.
Feature scope:
Successful run