"failed to request component-reports" should include the failure

[hakanai]

I have a number of PRs blocked by this:

Caused by: org.owasp.dependencycheck.exception.ExceptionCollection
    Failed to request component-reports
    at org.owasp.dependencycheck.Engine.analyzeDependencies(Engine.java:719)
    at org.owasp.dependencycheck.Engine$analyzeDependencies$0.call(Unknown source)
    at org.owasp.dependencycheck.gradle.tasks.AbstractAnalyze.analyze(AbstractAnalyze.groovy:88)
    ... 170 more

But it doesn't include the actual exception, so it's impossible to act on the error.

The actual cause for an exception should always be included when throwing your own exception.

Versions:

• dependency-check-gradle 5.3.2.1
• Gradle 5.2.1
• Java 11

[jeremylong]

I'd start by enabling debug logging. There is an issue with the stack traces sometimes with gradle that we are working on. However, enabling debug logging will get you the info you need as the actual exception is logged:

https://github.com/jeremylong/DependencyCheck/blob/ee08a7c4764e90537ac9d412c52e9a6fc09c10f2/core/src/main/java/org/owasp/dependencycheck/analyzer/OssIndexAnalyzer.java#L144-L147

[hakanai]

Hmm, that shows throwing an AnalysisException, but the exception I'm getting is an ExceptionCollection. Could there be a place where the AnalysisException is caught and aggregated ionto an ExceptionCollection, but the stack track isn't included at that point?

With current versions of Java it's possible to attach multiple causes to an exception via addSuppressed, so maybe it's possible to do that here?

[hakanai]

Culprit:

https://github.com/jeremylong/DependencyCheck/blob/dbaac076a182bb8fe45872459990f3b309138f9e/core/src/main/java/org/owasp/dependencycheck/exception/ExceptionCollection.java#L59

Code here could possibly put the first exception in the list as the cause and then the rest as suppressed exceptions, so we'd get all the stack traces.

[jeremylong]

See the discussion here: jeremylong/DependencyCheck#2416

[hakanai]

Ack, at the very least my issue is a duplicate of that one so I'll close this one I guess, and watch that one.