livingsocial / lein-dependency-check

A leiningen plugin for detecting vulnerable project dependencies

lein-dependency-check

A Leiningen plugin for detecting vulnerable project dependencies. Basic clojure wrapper for OWASP Dependency Check.

Configuration

As a User-Level Plugin:

To run dependency-check without having to add it to every Leiningen project as a project-level plugin, add dependency-check to the :plugins vector of your :user profile. E.g., a ~/.lein/profiles.clj with dependency-check as a plugin -

{:user {:plugins [[com.livingsocial/lein-dependency-check "1.4.0"]]}}

If you are on Leiningen 1.x do lein plugin install lein-dependency-check 1.4.0.

As a Project-Level Plugin:

Add [com.livingsocial/lein-dependency-check "1.4.0"] to the :plugins vector of your project.clj.

Project-level configuration may be provided under a :dependency-check key in your project.clj. Currently supported options are:

• log log each vulnerability found to stdout
• throw throw an exception after analysis and reporting if vulnerabilities are found, eg. to fail a build
• min-cvss-v3 minimum CVSSv3 score required to :throw (number from 0.0 to 10.0), defaults to 0.0
• properties-file Specifies a file that contains properties to merge with default values
• output-format Vector of desired output formats: xml, csv, json, html, vuln, all
• output-directory Directory to output results to
• suppression-file Path to the suppression XML file

Usage

To generate a dependency-check-report.html report file to the current project's target directory, run:

$ lein dependency-check

To generate the report in XML format, run:

$ lein dependency-check --output-format :xml

To generate the report in multiple formats, run:

$ lein dependency-check --output-format :xml,:json,:html,:csv

To write the report to a different directory (e.g., /tmp), run:

$ lein dependency-check --output-directory /tmp

To set logging to stdout:

$ lein dependency-check --log

To set throw error when vulnerabilities found:

$ lein dependency-check --throw

To only throw if there are vulnerabilities with or above a given CVSSv3:

$ lein dependency-check --throw --min-cvss-v3 5

To set a suppression file:

$ lein dependency-check --suppression-file /suppression.xml

To set a properties file:

$ lein dependency-check --properties-file /dependencycheck.properties

Suppressing False Positives

Support for suppressing false positives can be utilized by creating suppression.xml in your project's root directory.

Suppression snippets can be copied from the HTML report file directly into suppression.xml. Upon rerun of lein-dependency-check, the suppression file will be used and warnings will not be present in report.

For more information about dependency-check suppression system see https://jeremylong.github.io/DependencyCheck/general/suppression.html

License

Copyright © 2016 LivingSocial

Distributed as open source under the terms of the MIT License.

lein-dependency-check's Issues

Upgrade to dependency-check-core 3.0.0

Several breaking changes were made from 2.x to the 3.0.0 release. The primary change is that the settings is no longer a singleton and a few constructor and methods were changed. The PR to upgrade the gradle plugin from 2.x to 3.0.0 may provide a good roadmap.

The good news is that dependency-check-core is now threadsafe and you can have multiple instances running in parallel.

Dependency Check configuration modification?

I'm looking to overwrite the default dependency-check configuration in dependencycheck.properties in the underlying owasp dependency check jar so that it only executes the analyzers I want. There are certain dependencies in my project which are scanned by other CVE scanners and I don't want them scanned again. However placing a dependencycheck.properties file on the classpath doesn't disable the analyzers. Instead, should I modify src/lein_dependency_check/core.clj scan-files function to disable the dependency checks by reading from a file?

Any advice would be appreciated.

Does this throw if vulnerabilities are found?

If not, could it be an option? I would like to fail my build if vulnerabilities are found.

Unable to connect to the database (if using outside Lein)

Hi again,

I'm interested in using this as a library, as opposed to a Lein plugin.

Luckily, the code appears ready to use. But it fails in the following way:

You can see my attempt in the upper half, and its evaluation in the lower one.

Does it sound familiar?

Thanks - Victor

org.owasp.dependencycheck incompatibility - missing Vulnerability.getCvssScore method

I'm using [com.livingsocial/lein-dependency-check "1.1.3"] which uses [org.owasp/dependency-check-core "5.2.1"].

When :throw is set to true when vulnerabilities are found, the plugin fails with:

Caused by: java.lang.IllegalArgumentException: No matching field found: getCvssScore for class org.owasp.dependencycheck.dependency.Vulnerability
	at clojure.lang.Reflector.getInstanceField(Reflector.java:271)
	at clojure.lang.Reflector.invokeNoArgInstanceMember(Reflector.java:315)
	at lein_dependency_check.core$handle_vulnerabilities$fn__53.invoke(core.clj:73)

as 5.2.1 version of owasp dependency check now has two distinct CVSS scores: v2 and v3 instead of a single CVSS property.

.net could not be found

I have a pretty basic setup, just switched to 1.4 so that I can get past the xml->json migration, but now I'm getting an error about .net and I can't figure out how to suppress it:

2020-07-15 12:03:21,023 [main] ERROR org.owasp.dependencycheck.analyzer.AssemblyAnalyzer - ----------------------------------------------------
2020-07-15 12:03:21,025 [main] ERROR org.owasp.dependencycheck.analyzer.AssemblyAnalyzer - .NET Assembly Analyzer could not be initialized and at least one 'exe' or 'dll' was scanned. The 'dotnet' executable could not be found on the path; either disable the Assembly Analyzer or configure the path dotnet core.
2020-07-15 12:03:21,025 [main] ERROR org.owasp.dependencycheck.analyzer.AssemblyAnalyzer - ----------------------------------------------------

Reports vulnerable when no vulnerabilities found

Whoops, my apologies - bug in my last PR!

https://travis-ci.org/brabster/crucible/builds/280344591

"Generating report..."
"Done."
Exception in thread "main" clojure.lang.ExceptionInfo: Vulnerable Dependencies! {:vulnerable ()}, compiling:(/tmp/form-init4712519819586855050.clj:1:73)

Fix on the way...

Option to log any vulnerabilities found instead of/as well as report file

I'd like to be able to see any vulnerabilities found directly in the build log.

ERROR: Job failed: exit code 242

Hello,
I'm using Gitlab CI and i want to add a dependecy-check stage in my pipeline but i got this error all the time, can any one help me with this error ?

This the error:

[INFO] Analysis Started [INFO] Finished Archive Analyzer (3 seconds) [INFO] Finished File Name Analyzer (0 seconds) [INFO] Finished Jar Analyzer (0 seconds) [INFO] Finished Central Analyzer (1 seconds) [INFO] Finished Dependency Merging Analyzer (0 seconds) [INFO] Finished Version Filter Analyzer (0 seconds) [INFO] Finished Hint Analyzer (0 seconds) [INFO] Created CPE Index (7 seconds) [WARN] Unable to parse suppression xml file 'dependency_check_suppressions.xml' [WARN] org.owasp.dependencycheck.xml.suppression.SuppressionParseException: org.xml.sax.SAXException: Line=6, Column=99: cvc-elt.1.a: Cannot find the declaration of element 'xs:schema'. [ERROR] Exception occurred initializing CPE Analyzer. [INFO] Finished CPE Analyzer (8 seconds) [INFO] Finished False Positive Analyzer (0 seconds) [INFO] Finished NVD CVE Analyzer (0 seconds) [INFO] Finished RetireJS Analyzer (2 seconds) [INFO] Finished Sonatype OSS Index Analyzer (0 seconds) [WARN] Unable to parse suppression xml file 'dependency_check_suppressions.xml' [WARN] org.owasp.dependencycheck.xml.suppression.SuppressionParseException: org.xml.sax.SAXException: Line=6, Column=99: cvc-elt.1.a: Cannot find the declaration of element 'xs:schema'. [ERROR] Exception occurred initializing Vulnerability Suppression Analyzer. [INFO] Finished Vulnerability Suppression Analyzer (0 seconds) [INFO] Finished Dependency Bundling Analyzer (0 seconds) [INFO] Analysis Complete (15 seconds) [ERROR] Warn initializing the suppression analyzer: Failed to load dependency_check_suppressions.xml, caused by org.owasp.dependencycheck.xml.suppression.SuppressionParseException: org.xml.sax.SAXException: Line=6, Column=99: cvc-elt.1.a: Cannot find the declaration of element 'xs:schema'.. [ERROR] Warn initializing the suppression analyzer: Failed to load dependency_check_suppressions.xml, caused by org.owasp.dependencycheck.xml.suppression.SuppressionParseException: org.xml.sax.SAXException: Line=6, Column=99: cvc-elt.1.a: Cannot find the declaration of element 'xs:schema'.. Uploading artifacts... dependency-check-out/dependency-check-report.*: found 4 matching files Uploading artifacts to coordinator... ok id=2009442 responseStatus=201 Created token=TunH7rgy ERROR: Job failed: exit code 242

And this is my script:

`dependency-check:
stage: pre-analysis
allow_failure: true
image:
name: owasp/dependency-check
entrypoint: [""]
before_script:
- mkdir /usr/share/dependency-check/datas || true
- mkdir -p dependency-check/datas
- mkdir -p dependency-check-out
- PROXY_HOST=$(echo ${http_proxy} | sed -e "s/[^/]//([^@]@)?([^:/])./\2/")
- PROXY_PORT=$(echo ${http_proxy} | sed -e 's,^.:,:,g' -e 's,.:([0-9]).,\1,g' -e 's,[^0-9],,g')
script:
- /usr/share/dependency-check/bin/dependency-check.sh
--scan .
--format 'ALL'
--project "$CI_PROJECT_NAME"
--failOnCVSS 7
--disableNodeJS
--disableNodeAudit
--suppression=dependency_check_suppressions.xml
--data=dependency-check/datas
--out=dependency-check-out
--proxyserver=${PROXY_HOST}
--proxyport=${PROXY_PORT}
artifacts:
name: "${CI_JOB_ID}_${CI_JOB_NAME}"
when: always
expire_in: 1 week
paths:
- dependency-check-out/dependency-check-report.*
cache:
key: dependency-check-data
paths:
- dependency-check/datas

only:
refs:
- master
except:
variables:
- $DISABLE_DEP_CHECK`

i'm using the dependency_check_suppressions.xml
Link: https://github.com/jeremylong/DependencyCheck/blob/master/core/src/main/resources/schema/dependency-suppression.1.1.xsd

Many thanks !

Minimum severity to throw option?

Hi,

Thanks for maintaining this plugin.

Our organization has a policy to address any high or critical issues according to the CVSS scale. This means that sometimes we choose not to immediately address low / medium issues. I'd like our build to fail if there are any issues above a particular CVSS score but otherwise just log and create the report.

Basically, I want the "failBuildOnCVSS" option documented here:
https://jeremylong.github.io/DependencyCheck/dependency-check-maven/configuration.html#bodyColumn

Would you be interested in adding this feature? I may be able to create a PR.

Latest release not reflected in README

README suggests 1.0.4, while there's a later release.

Name of Output file

Is there a way to change the name of the dependency check report file to anything I like?

Upgrade to dependency-check 5.0.0

We just released 5.0.0 of the core library. There were several breaking changes in this release. See the release notes for 5.0.0-M1, M2, M3, and the final 5.0.0 release: https://github.com/jeremylong/DependencyCheck/blob/master/RELEASE_NOTES.md

You can see what the scala plugin did to move from 4.x to 5.0.0 here: albuch/sbt-dependency-check#72

add suppression list support in order to filter out false positives

There may be cases where DependencyCheck includes false positives. Support for suppression lists (e.g.,
https://jeremylong.github.io/DependencyCheck/general/suppression.html) would help these filter out.

Version of OWASP dependency check is out of date

Version of OWASP dep-check plugin quite out of date. New version has (at least) much improved logging that would have helped debug a TLS issue that I had running on Travis.

(btw, if you use Travis for CI then they have a cron build feature that you could use to run https://github.com/xsc/lein-ancient to detect when new versions of deps become available)