Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

ErrorUsing Cli dependency check No documents exist. #415

Closed
gonzaloFer opened this issue Dec 4, 2015 · 16 comments
Closed

ErrorUsing Cli dependency check No documents exist. #415

gonzaloFer opened this issue Dec 4, 2015 · 16 comments

Comments

@gonzaloFer
Copy link

Hi!

I am getting this error after execute comand line tool:

dic 04, 2015 12:42:49 PM org.owasp.dependencycheck.Engine doUpdates
INFORMACIÓN: Checking for updates
dic 04, 2015 12:42:50 PM org.owasp.dependencycheck.data.update.NvdCveUpdater update
ADVERTENCIA: Unable to download the NVD CVE data; the results may not include the most recent CPE/CVEs from the NVD.
dic 04, 2015 12:42:51 PM org.owasp.dependencycheck.Engine doUpdates
INFORMACIÓN: Check for updates complete
dic 04, 2015 12:42:52 PM org.owasp.dependencycheck.Engine analyzeDependencies
GRAVE: No documents exist

And also getting these messages en .log file:
.
.
.
<errors start here!!>:

2015-12-04 13:09:24,953 org.owasp.dependencycheck.Engine:325
ERROR - No documents exist

Unable to continue dependency-check analysis.
2015-12-04 13:09:24,956 org.owasp.dependencycheck.Engine:326
DEBUG -
org.owasp.dependencycheck.exception.NoDataException: No documents exist
at org.owasp.dependencycheck.Engine.ensureDataExists(Engine.java:497) ~[dependency-check-core-1.3.2.jar:1.3.2]
at org.owasp.dependencycheck.Engine.analyzeDependencies(Engine.java:323) ~[dependency-check-core-1.3.2.jar:1.3.2]
at org.owasp.dependencycheck.App.runScan(App.java:201) [dependency-check-cli-1.3.2.jar:1.3.2]
at org.owasp.dependencycheck.App.run(App.java:123) [dependency-check-cli-1.3.2.jar:1.3.2]
at org.owasp.dependencycheck.App.main(App.java:64) [dependency-check-cli-1.3.2.jar:1.3.2]
2015-12-04 13:09:25,020 org.owasp.dependencycheck.data.nvdcve.CveDB:83
DEBUG - Database dialect: H2
2015-12-04 13:09:25,148 org.owasp.dependencycheck.reporting.VelocityLoggerRedirect:68
DEBUG - Initializing Velocity, Calling init()...
2015-12-04 13:09:25,148 org.owasp.dependencycheck.reporting.VelocityLoggerRedirect:68
DEBUG - Starting Apache Velocity v1.7 (compiled: 2010-11-19 12:14:37)
2015-12-04 13:09:25,148 org.owasp.dependencycheck.reporting.VelocityLoggerRedirect:68
DEBUG - Default Properties File: org/apache/velocity/runtime/defaults/velocity.properties
2015-12-04 13:09:25,149 org.owasp.dependencycheck.reporting.VelocityLoggerRedirect:68
DEBUG - Trying to use logger class org.owasp.dependencycheck.reporting.VelocityLoggerRedirect
2015-12-04 13:09:25,149 org.owasp.dependencycheck.reporting.VelocityLoggerRedirect:68
DEBUG - Using logger class org.owasp.dependencycheck.reporting.VelocityLoggerRedirect
2015-12-04 13:09:25,151 org.owasp.dependencycheck.reporting.VelocityLoggerRedirect:68
DEBUG - ResourceLoader instantiated: org.apache.velocity.runtime.resource.loader.FileResourceLoader
2015-12-04 13:09:25,152 org.owasp.dependencycheck.reporting.VelocityLoggerRedirect:68
DEBUG - Do unicode file recognition: false
2015-12-04 13:09:25,152 org.owasp.dependencycheck.reporting.VelocityLoggerRedirect:68
DEBUG - FileResourceLoader : adding path '.'
2015-12-04 13:09:25,157 org.owasp.dependencycheck.reporting.VelocityLoggerRedirect:68
DEBUG - ResourceCache: initialized (class org.apache.velocity.runtime.resource.ResourceCacheImpl) with class java.util.Collections$SynchronizedMap cache map.
2015-12-04 13:09:25,158 org.owasp.dependencycheck.reporting.VelocityLoggerRedirect:68
DEBUG - Loaded System Directive: org.apache.velocity.runtime.directive.Stop
2015-12-04 13:09:25,159 org.owasp.dependencycheck.reporting.VelocityLoggerRedirect:68
DEBUG - Loaded System Directive: org.apache.velocity.runtime.directive.Define
2015-12-04 13:09:25,159 org.owasp.dependencycheck.reporting.VelocityLoggerRedirect:68
DEBUG - Loaded System Directive: org.apache.velocity.runtime.directive.Break
2015-12-04 13:09:25,160 org.owasp.dependencycheck.reporting.VelocityLoggerRedirect:68
DEBUG - Loaded System Directive: org.apache.velocity.runtime.directive.Evaluate
2015-12-04 13:09:25,160 org.owasp.dependencycheck.reporting.VelocityLoggerRedirect:68
DEBUG - Loaded System Directive: org.apache.velocity.runtime.directive.Literal
2015-12-04 13:09:25,161 org.owasp.dependencycheck.reporting.VelocityLoggerRedirect:68
DEBUG - Loaded System Directive: org.apache.velocity.runtime.directive.Macro
2015-12-04 13:09:25,162 org.owasp.dependencycheck.reporting.VelocityLoggerRedirect:68
DEBUG - Loaded System Directive: org.apache.velocity.runtime.directive.Parse
2015-12-04 13:09:25,162 org.owasp.dependencycheck.reporting.VelocityLoggerRedirect:68
DEBUG - Loaded System Directive: org.apache.velocity.runtime.directive.Include
2015-12-04 13:09:25,163 org.owasp.dependencycheck.reporting.VelocityLoggerRedirect:68
DEBUG - Loaded System Directive: org.apache.velocity.runtime.directive.Foreach
2015-12-04 13:09:25,179 org.owasp.dependencycheck.reporting.VelocityLoggerRedirect:68
DEBUG - Created '20' parsers.
2015-12-04 13:09:25,182 org.owasp.dependencycheck.reporting.VelocityLoggerRedirect:68
DEBUG - Velocimacro : "velocimacro.library" is not set. Trying default library: VM_global_library.vm
2015-12-04 13:09:25,182 org.owasp.dependencycheck.reporting.VelocityLoggerRedirect:68
DEBUG - Velocimacro : Default library not found.
2015-12-04 13:09:25,182 org.owasp.dependencycheck.reporting.VelocityLoggerRedirect:68
DEBUG - Velocimacro : allowInline = true : VMs can be defined inline in templates
2015-12-04 13:09:25,182 org.owasp.dependencycheck.reporting.VelocityLoggerRedirect:68
DEBUG - Velocimacro : allowInlineToOverride = false : VMs defined inline may NOT replace previous VM definitions
2015-12-04 13:09:25,182 org.owasp.dependencycheck.reporting.VelocityLoggerRedirect:68
DEBUG - Velocimacro : allowInlineLocal = false : VMs defined inline will be global in scope if allowed.
2015-12-04 13:09:25,182 org.owasp.dependencycheck.reporting.VelocityLoggerRedirect:68
DEBUG - Velocimacro : autoload off : VM system will not automatically reload global library macros
2015-12-04 13:09:25,213 org.owasp.dependencycheck.data.nvdcve.CveDB:163
DEBUG - Entering finalize
2015-12-04 13:09:25,213 org.owasp.dependencycheck.data.nvdcve.CveDB:163
DEBUG - Entering finalize
2015-12-04 13:09:25,300 org.owasp.dependencycheck.reporting.VelocityLoggerRedirect:68
DEBUG - Null reference [template 'templates/HtmlReport.vsl', line 635, column 46] : $cpeSort cannot be resolved.
2015-12-04 13:09:25,300 org.owasp.dependencycheck.reporting.VelocityLoggerRedirect:68
DEBUG - Null reference [template 'templates/HtmlReport.vsl', line 635, column 46] : $cpeSort cannot be resolved.
2015-12-04 13:09:25,301 org.owasp.dependencycheck.reporting.VelocityLoggerRedirect:68
DEBUG - Null reference [template 'templates/HtmlReport.vsl', line 635, column 46] : $cpeSort cannot be resolved.
2015-12-04 13:09:25,302 org.owasp.dependencycheck.reporting.VelocityLoggerRedirect:68

I am behind a proxy and I added the parameters, could you help me? Or where can I watch for checking examples. Thank you in advance.

Regards,
Gonzalo

@jeremylong
Copy link
Owner

First, there is a bug in 1.3.2 that was discovered shortly after its release (one of those bugs where it works on my system) - I will be releasing 1.3.3 shortly.

Second, are you behind a proxy? You may need to configure the proxy for dependency-check to be able to reach out to the Internet. See http://jeremylong.github.io/DependencyCheck/data/index.html.

Best Regards,

Jeremy

@gonzaloFer
Copy link
Author

Thank you for answering. I am behind a proxy indeed, actually the exit I put was with proxy parameters. I used something like this:
sudo ./dependency-check.sh --project "project" --scan ".../lib" -f HTML --proxyserver proxy --proxyport 8080 --proxypass password --proxyuser user --log dc.log

Am I using correctly? This was the exit:

Exception in thread "main" java.util.NoSuchElementException
at java.util.StringTokenizer.nextToken(StringTokenizer.java:349)
at sun.net.www.protocol.http.HttpURLConnection.doTunneling(HttpURLConnection.java:2017)
at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:183)
at sun.net.www.protocol.https.HttpsURLConnectionImpl.connect(HttpsURLConnectionImpl.java:153)
at org.owasp.dependencycheck.utils.Downloader.getLastModified(Downloader.java:235)
at org.owasp.dependencycheck.data.update.nvd.UpdateableNvdCve.add(UpdateableNvdCve.java:94)
at org.owasp.dependencycheck.data.update.NvdCveUpdater.retrieveCurrentTimestampsFromWeb(NvdCveUpdater.java:299)
at org.owasp.dependencycheck.data.update.NvdCveUpdater.getUpdatesNeeded(NvdCveUpdater.java:231)
at org.owasp.dependencycheck.data.update.NvdCveUpdater.update(NvdCveUpdater.java:70)
at org.owasp.dependencycheck.Engine.doUpdates(Engine.java:433)
at org.owasp.dependencycheck.Engine.analyzeDependencies(Engine.java:318)
at org.owasp.dependencycheck.App.runScan(App.java:201)
at org.owasp.dependencycheck.App.run(App.java:123)
at org.owasp.dependencycheck.App.main(App.java:64)

Is it because of the bug?
Thanks Jeremy.

Best Regards

@jeremylong
Copy link
Owner

I just realized you ran this with sudo - my guess is there is a permission problem with accessing the database directory. By default the data directory for the CLI would be a sibling of the bin and repo directory; that directory must exist and allow read/write. You can change the default data directory using the --data property. Let me know if that helps?

--Jeremy

@gonzaloFer
Copy link
Author

Sorry Jeremy, you mean change the directory data (with --data ) instead of....? Which is the default data directory for the CLI?

The exit now is:

INFO - Checking for updates
2015-12-11 13:40:10,630 org.owasp.dependencycheck.data.nvdcve.CveDB:83
DEBUG - Database dialect: H2
2015-12-11 13:40:10,632 org.owasp.dependencycheck.data.update.NvdCveUpdater:113
INFO - Skipping NVD check since last check was within 4 hours.
2015-12-11 13:40:10,632 org.owasp.dependencycheck.data.update.NvdCveUpdater:114
DEBUG - Last NVD was at 1449837001914, and now 1449837610632 is within 14400000 ms.
2015-12-11 13:40:10,807 org.owasp.dependencycheck.data.nvdcve.CveDB:83
DEBUG - Database dialect: H2
2015-12-11 13:40:10,807 org.owasp.dependencycheck.data.update.EngineVersionCheck:87
DEBUG - Begin Engine Version Check
2015-12-11 13:40:10,808 org.owasp.dependencycheck.data.update.EngineVersionCheck:93
DEBUG - Last checked: 1449837518265
2015-12-11 13:40:10,808 org.owasp.dependencycheck.data.update.EngineVersionCheck:94
DEBUG - Now: 1449837610807
2015-12-11 13:40:10,808 org.owasp.dependencycheck.data.update.EngineVersionCheck:95
DEBUG - Current version: 1.3.2
2015-12-11 13:40:10,808 org.owasp.dependencycheck.data.update.EngineVersionCheck:150
DEBUG - Upgrade not needed
2015-12-11 13:40:10,810 org.owasp.dependencycheck.data.nvdcve.CveDB:163
DEBUG - Entering finalize
2015-12-11 13:40:10,913 org.owasp.dependencycheck.Engine:440
INFO - Check for updates complete (354 ms)
2015-12-11 13:40:10,976 org.owasp.dependencycheck.data.nvdcve.CveDB:83
DEBUG - Database dialect: H2
2015-12-11 13:40:11,082 org.owasp.dependencycheck.Engine:325
ERROR - No documents exist

Unable to continue dependency-check analysis.
2015-12-11 13:40:11,084 org.owasp.dependencycheck.Engine:326
DEBUG -
org.owasp.dependencycheck.exception.NoDataException: No documents exist
at org.owasp.dependencycheck.Engine.ensureDataExists(Engine.java:497) ~[dependency-check-core-1.3.2.jar:1.3.2]
at org.owasp.dependencycheck.Engine.analyzeDependencies(Engine.java:323) ~[dependency-check-core-1.3.2.jar:1.3.2]
at org.owasp.dependencycheck.App.runScan(App.java:201) [dependency-check-cli-1.3.2.jar:1.3.2]
at org.owasp.dependencycheck.App.run(App.java:123) [dependency-check-cli-1.3.2.jar:1.3.2]
at org.owasp.dependencycheck.App.main(App.java:64) [dependency-check-cli-1.3.2.jar:1.3.2]
2015-12-11 13:40:11,144 org.owasp.dependencycheck.data.nvdcve.CveDB:83
DEBUG - Database dialect: H2
2015-12-11 13:40:11,276 org.owasp.dependencycheck.reporting.VelocityLoggerRedirect:68
DEBUG - Initializing Velocity, Calling init()...
2015-12-11 13:40:11,277 org.owasp.dependencycheck.reporting.VelocityLoggerRedirect:68
DEBUG - Starting Apache Velocity v1.7 (compiled: 2010-11-19 12:14:37)
2015-12-11 13:40:11,277 org.owasp.dependencycheck.reporting.VelocityLoggerRedirect:68
DEBUG - Default Properties File: org/apache/velocity/runtime/defaults/velocity.properties
2015-12-11 13:40:11,277 org.owasp.dependencycheck.reporting.VelocityLoggerRedirect:68
DEBUG - Trying to use logger class org.owasp.dependencycheck.reporting.VelocityLoggerRedirect
2015-12-11 13:40:11,277 org.owasp.dependencycheck.reporting.VelocityLoggerRedirect:68
DEBUG - Using logger class org.owasp.dependencycheck.reporting.VelocityLoggerRedirect
2015-12-11 13:40:11,280 org.owasp.dependencycheck.reporting.VelocityLoggerRedirect:68
DEBUG - ResourceLoader instantiated: org.apache.velocity.runtime.resource.loader.FileResourceLoader
2015-12-11 13:40:11,281 org.owasp.dependencycheck.reporting.VelocityLoggerRedirect:68
DEBUG - Do unicode file recognition: false
2015-12-11 13:40:11,282 org.owasp.dependencycheck.reporting.VelocityLoggerRedirect:68
DEBUG - FileResourceLoader : adding path '.'
2015-12-11 13:40:11,290 org.owasp.dependencycheck.reporting.VelocityLoggerRedirect:68
DEBUG - ResourceCache: initialized (class org.apache.velocity.runtime.resource.ResourceCacheImpl) with class java.util.Collections$SynchronizedMap cache map.
2015-12-11 13:40:11,291 org.owasp.dependencycheck.reporting.VelocityLoggerRedirect:68
DEBUG - Loaded System Directive: org.apache.velocity.runtime.directive.Stop
2015-12-11 13:40:11,292 org.owasp.dependencycheck.reporting.VelocityLoggerRedirect:68
DEBUG - Loaded System Directive: org.apache.velocity.runtime.directive.Define
2015-12-11 13:40:11,292 org.owasp.dependencycheck.reporting.VelocityLoggerRedirect:68
DEBUG - Loaded System Directive: org.apache.velocity.runtime.directive.Break
2015-12-11 13:40:11,293 org.owasp.dependencycheck.reporting.VelocityLoggerRedirect:68
DEBUG - Loaded System Directive: org.apache.velocity.runtime.directive.Evaluate
2015-12-11 13:40:11,293 org.owasp.dependencycheck.reporting.VelocityLoggerRedirect:68
DEBUG - Loaded System Directive: org.apache.velocity.runtime.directive.Literal
2015-12-11 13:40:11,294 org.owasp.dependencycheck.reporting.VelocityLoggerRedirect:68
DEBUG - Loaded System Directive: org.apache.velocity.runtime.directive.Macro
2015-12-11 13:40:11,295 org.owasp.dependencycheck.reporting.VelocityLoggerRedirect:68
DEBUG - Loaded System Directive: org.apache.velocity.runtime.directive.Parse
2015-12-11 13:40:11,296 org.owasp.dependencycheck.reporting.VelocityLoggerRedirect:68
DEBUG - Loaded System Directive: org.apache.velocity.runtime.directive.Include
2015-12-11 13:40:11,297 org.owasp.dependencycheck.reporting.VelocityLoggerRedirect:68
DEBUG - Loaded System Directive: org.apache.velocity.runtime.directive.Foreach
2015-12-11 13:40:11,317 org.owasp.dependencycheck.reporting.VelocityLoggerRedirect:68
DEBUG - Created '20' parsers.
2015-12-11 13:40:11,320 org.owasp.dependencycheck.reporting.VelocityLoggerRedirect:68
DEBUG - Velocimacro : "velocimacro.library" is not set. Trying default library: VM_global_library.vm
2015-12-11 13:40:11,321 org.owasp.dependencycheck.reporting.VelocityLoggerRedirect:68
DEBUG - Velocimacro : Default library not found.
2015-12-11 13:40:11,321 org.owasp.dependencycheck.reporting.VelocityLoggerRedirect:68
DEBUG - Velocimacro : allowInline = true : VMs can be defined inline in templates
2015-12-11 13:40:11,321 org.owasp.dependencycheck.reporting.VelocityLoggerRedirect:68
DEBUG - Velocimacro : allowInlineToOverride = false : VMs defined inline may NOT replace previous VM definitions
2015-12-11 13:40:11,321 org.owasp.dependencycheck.reporting.VelocityLoggerRedirect:68
DEBUG - Velocimacro : allowInlineLocal = false : VMs defined inline will be global in scope if allowed.
2015-12-11 13:40:11,321 org.owasp.dependencycheck.reporting.VelocityLoggerRedirect:68
DEBUG - Velocimacro : autoload off : VM system will not automatically reload global library macros
2015-12-11 13:40:11,356 org.owasp.dependencycheck.data.nvdcve.CveDB:163
DEBUG - Entering finalize
2015-12-11 13:40:11,356 org.owasp.dependencycheck.data.nvdcve.CveDB:163
DEBUG - Entering finalize
2015-12-11 13:40:11,443 org.owasp.dependencycheck.reporting.VelocityLoggerRedirect:68
DEBUG - Null reference [template 'templates/HtmlReport.vsl', line 635, column 46] : $cpeSort cannot be resolved.

Thank you so much.

@jeremylong
Copy link
Owner

When you unzip the CLI you should have the following folders:

dependency-check
--bin
--repo

When you run the tool the first time, it creates a data folder:

dependency-check
--bin
--data
--repo

First thing to try is to delete the data folder and re-run dependency-check with the correct proxy settings. If that fails, double check that the data folder is created and is writtable. If you need to you can specify a different data directory to point to a folder that you setup with the correct permissions:

dependency-check.sh --data /some/data/directory ...

@gonzaloFer
Copy link
Author

Hi!

It doesnt work, I think is not about permissions problem but maybe I am wrong. Perhaps the problem is because of the proxy, the main error appears this way:

org.owasp.dependencycheck.exception.NoDataException: No documents exist
at org.owasp.dependencycheck.Engine.ensureDataExists(Engine.java:497) ~[dependency-check-core-1.3.2.jar:1.3.2]
at org.owasp.dependencycheck.Engine.analyzeDependencies(Engine.java:323) ~[dependency-check-core-1.3.2.jar:1.3.2]
at org.owasp.dependencycheck.App.runScan(App.java:201) [dependency-check-cli-1.3.2.jar:1.3.2]
at org.owasp.dependencycheck.App.run(App.java:123) [dependency-check-cli-1.3.2.jar:1.3.2]
at org.owasp.dependencycheck.App.main(App.java:64) [dependency-check-cli-1.3.2.jar:1.3.2]
2015-12-11 12:48:12,421 org.owasp.dependencycheck.data.nvdcve.CveDB:83
DEBUG - Database dialect: H2
2015-12-11 12:48:12,558 org.owasp.dependencycheck.reporting.VelocityLoggerRedirect:68

Thanks and Regards.

G

@jeremylong
Copy link
Owner

If the DB file is being created then it isn't a permissions issue. The
issue is with the proxy. You should see something like this in the logs if
it can download the data from the NVD:

Checking for updates
NVD CVE requires several updates; this could take a couple of minutes.
Download Started for NVD CVE - 2002
Download Started for NVD CVE - 2004
Download Started for NVD CVE - 2003
Download Complete for NVD CVE - 2003 (950 ms)
Download Started for NVD CVE - 2005
Processing Started for NVD CVE - 2003
Download Complete for NVD CVE - 2004 (1528 ms)
Download Started for NVD CVE - 2006
Download Complete for NVD CVE - 2002 (1913 ms)
Download Started for NVD CVE - 2007
Download Complete for NVD CVE - 2005 (1365 ms)
Download Started for NVD CVE - 2008
Download Complete for NVD CVE - 2007 (2711 ms)
Download Started for NVD CVE - 2009
Download Complete for NVD CVE - 2008 (3646 ms)
Download Complete for NVD CVE - 2009 (2812 ms)
Processing Complete for NVD CVE - 2003 (5548 ms)
Download Complete for NVD CVE - 2006 (4920 ms)
Processing Started for NVD CVE - 2004
Download Started for NVD CVE - 2011
Download Started for NVD CVE - 2010
Download Started for NVD CVE - 2012
Download Complete for NVD CVE - 2012 (3847 ms)
Download Started for NVD CVE - 2013
Download Complete for NVD CVE - 2010 (4341 ms)
Download Started for NVD CVE - 2014
Processing Complete for NVD CVE - 2004 (4602 ms)
Processing Started for NVD CVE - 2002
Download Complete for NVD CVE - 2011 (7995 ms)
Download Started for NVD CVE - 2015
Download Complete for NVD CVE - 2014 (3656 ms)
Download Started for NVD CVE - Modified
Download Complete for NVD CVE - Modified (192 ms)
Download Complete for NVD CVE - 2013 (4804 ms)
Download Complete for NVD CVE - 2015 (1414 ms)
Processing Complete for NVD CVE - 2002 (4808 ms)
Processing Started for NVD CVE - 2005
...

If you do not see that, the issue is definately with the proxy. Just to
double check, delete the data directory and re-run dependency-check and
look at the logs. If it fails, you should delete the data directory before
trying again.

--Jeremy

On Wed, Dec 16, 2015 at 6:22 AM, gonzaloFer notifications@github.com
wrote:

Hi!

It doesnt work, I think is not about permissions problem but maybe I am
wrong. Perhaps the problem is because of the proxy, the main error appears
this way:

org.owasp.dependencycheck.exception.NoDataException: No documents exist
at org.owasp.dependencycheck.Engine.ensureDataExists(Engine.java:497)
~[dependency-check-core-1.3.2.jar:1.3.2]
at org.owasp.dependencycheck.Engine.analyzeDependencies(Engine.java:323)
~[dependency-check-core-1.3.2.jar:1.3.2]
at org.owasp.dependencycheck.App.runScan(App.java:201)
[dependency-check-cli-1.3.2.jar:1.3.2]
at org.owasp.dependencycheck.App.run(App.java:123)
[dependency-check-cli-1.3.2.jar:1.3.2]
at org.owasp.dependencycheck.App.main(App.java:64)
[dependency-check-cli-1.3.2.jar:1.3.2]
2015-12-11 12:48:12,421 org.owasp.dependencycheck.data.nvdcve.CveDB:83
DEBUG - Database dialect: H2
2015-12-11 12:48:12,558
org.owasp.dependencycheck.reporting.VelocityLoggerRedirect:68

Thanks and Regards.

G


Reply to this email directly or view it on GitHub
#415 (comment)
.

@gonzaloFer
Copy link
Author

Hi,
The last thing Jeremy, I think you are right and definetely is a proxy issue, however I paste another out in log:

DEBUG -
org.owasp.dependencycheck.exception.NoDataException: No documents exist
at org.owasp.dependencycheck.Engine.ensureDataExists(Engine.java:497) ~[dependency-check-core-1.3.3.jar:1.3.3]
at org.owasp.dependencycheck.Engine.analyzeDependencies(Engine.java:323) ~[dependency-check-core-1.3.3.jar:1.3.3]
at org.owasp.dependencycheck.App.runScan(App.java:201) [dependency-check-cli-1.3.3.jar:1.3.3]
at org.owasp.dependencycheck.App.run(App.java:123) [dependency-check-cli-1.3.3.jar:1.3.3]
at org.owasp.dependencycheck.App.main(App.java:64) [dependency-check-cli-1.3.3.jar:1.3.3]

I dont know if can help to solve this problem. Thanks.

@jeremylong
Copy link
Owner

Here is what is going on.

  1. dependency-check is trying to reach out to the Internet to download the CVE data from the NVD; this fails
  2. Failures early in the pipeline (i.e. updating the CVE data) does not halt the dependency-check executioin - the assumption is we likely have data from a previous download and there is a temporary issue with the Internet connection or the NVD site is down (this has happened in the past). As such, execution continues.
  3. When dependency-check gets to a point that it needs CVE data to perform the analysis it does a double check to see if there is any useful data in the DB. Since there is not, it throws this error.

My best suggestions would be to hook up something like Wireshark and see what is actually going across the wire. My guess is there is something misconfigured with the proxy. See the Proxy Configuration section on the dependency-check Maven documentation site.

Jeremy

@jeremylong
Copy link
Owner

Have you been able to resolve your issue?

@jeremylong
Copy link
Owner

If you continue to have issues with the plugin, please open a new ticket as I believe this issue has been resolved.

@neerajv
Copy link

neerajv commented Nov 28, 2016

Hi,

After i did as wrote on :- http://jeremylong.github.io/DependencyCheck/data/mirrornvd.html

I am facing this issue : -

[root@gitlabserver neeraj]# sh dep-check-date.sh "NVD" "11/28/2016" --project virmani -s "/tmp/neeraj/my_code"
[INFO] Checking for updates
Exception in thread "main" java.lang.IllegalArgumentException: URI has an authority component
at java.io.File.(File.java:423)
at org.owasp.dependencycheck.utils.Downloader.getLastModified(Downloader.java:249)
at org.owasp.dependencycheck.utils.Downloader.getLastModified(Downloader.java:228)
at org.owasp.dependencycheck.data.update.nvd.UpdateableNvdCve.add(UpdateableNvdCve.java:101)
at org.owasp.dependencycheck.data.update.NvdCveUpdater.retrieveCurrentTimestampsFromWeb(NvdCveUpdater.java:330)
at org.owasp.dependencycheck.data.update.NvdCveUpdater.getUpdatesNeeded(NvdCveUpdater.java:259)
at org.owasp.dependencycheck.data.update.NvdCveUpdater.update(NvdCveUpdater.java:79)
at org.owasp.dependencycheck.Engine.doUpdates(Engine.java:678)
at org.owasp.dependencycheck.Engine.analyzeDependencies(Engine.java:489)
at org.owasp.dependencycheck.App.runScan(App.java:272)
at org.owasp.dependencycheck.App.run(App.java:164)
at org.owasp.dependencycheck.App.main(App.java:69)

With NoUpdate :-

[root@gitlabserver neeraj]# sh dep-check-date.sh "NVD" "11/28/2016" --project virmani -s "/tmp/neeraj/my_code" --noupdate
[ERROR] No documents exist

Unable to continue dependency-check analysis.
[ERROR] One or more fatal errors occurred
[ERROR] No documents exist

==========
My env :-
Java :- 1.8.0_91
Dependency Check version :- 1.4.4

Thanks,
Neeraj Virmani

@jeremylong
Copy link
Owner

Not sure what is in dep-check-date.sh. Based on googling the error message "URI has an authority component" I'm guessing that the URL you are providing is not valid.

@neerajv
Copy link

neerajv commented Nov 29, 2016

The Data folder should have some old database from any previous run to resolve the issue of " No documents exist"

For URI :- there has to be an extra / in the file , ie
--cveUrl20Modified file:///NVD/2016-11-28/nvdcve-2.0-Modified.xml.gz CORRECT

--cveUrl20Modified file://NVD/2016-11-28/nvdcve-2.0-Modified.xml.gz INCORRECT

Thanks,
Neeraj Virmani

@jeremylong
Copy link
Owner

so can this issue be closed?

--Jeremy

@lock
Copy link

lock bot commented Sep 28, 2018

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.

@lock lock bot locked and limited conversation to collaborators Sep 28, 2018
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants