diff --git a/dependency-check-maven/src/main/java/org/owasp/dependencycheck/maven/DependencyCheckMojo.java b/dependency-check-maven/src/main/java/org/owasp/dependencycheck/maven/DependencyCheckMojo.java index 784ea9eb2..cf4174215 100644 --- a/dependency-check-maven/src/main/java/org/owasp/dependencycheck/maven/DependencyCheckMojo.java +++ b/dependency-check-maven/src/main/java/org/owasp/dependencycheck/maven/DependencyCheckMojo.java @@ -248,7 +248,31 @@ public class DependencyCheckMojo extends AbstractMojo implements MavenMultiPageR */ @Parameter(property = "skipProvidedScope", defaultValue = "false", required = false) private boolean skipProvidedScope = false; - + /** + * The data directory, hold DC SQL DB. + */ + @Parameter(property = "dataDirectory", defaultValue = "", required = false) + private String dataDirectory; + /** + * Data Mirror URL for CVE 1.2 + */ + @Parameter(property = "cveUrl12Modified", defaultValue = "", required = false) + private String cveUrl12Modified; + /** + * Data Mirror URL for CVE 2.0 + */ + @Parameter(property = "cveUrl20Modified", defaultValue = "", required = false) + private String cveUrl20Modified; + /** + * Base Data Mirror URL for CVE 1.2 + */ + @Parameter(property = "cveUrl12Base", defaultValue = "", required = false) + private String cveUrl12Base; + /** + * Data Mirror URL for CVE 2.0 + */ + @Parameter(property = "cveUrl20Base", defaultValue = "", required = false) + private String cveUrl20Base; // /** @@ -265,16 +289,19 @@ public class DependencyCheckMojo extends AbstractMojo implements MavenMultiPageR final Engine engine = new Engine(); final Set artifacts = project.getArtifacts(); for (Artifact a : artifacts) { - if (skipTestScope && Artifact.SCOPE_TEST.equals(a.getScope())) - continue; - - if (skipProvidedScope && Artifact.SCOPE_PROVIDED.equals(a.getScope())) + if (skipTestScope && Artifact.SCOPE_TEST.equals(a.getScope())) { continue; + } - if (skipRuntimeScope && !Artifact.SCOPE_RUNTIME.equals(a.getScope())) + if (skipProvidedScope && Artifact.SCOPE_PROVIDED.equals(a.getScope())) { continue; + } - engine.scan(a.getFile().getAbsolutePath()); + if (skipRuntimeScope && !Artifact.SCOPE_RUNTIME.equals(a.getScope())) { + continue; + } + + engine.scan(a.getFile().getAbsolutePath()); } engine.analyzeDependencies(); return engine; @@ -734,9 +761,30 @@ public class DependencyCheckMojo extends AbstractMojo implements MavenMultiPageR if (zipExtensions != null && !zipExtensions.isEmpty()) { Settings.setString(Settings.KEYS.ADDITIONAL_ZIP_EXTENSIONS, zipExtensions); } + + // Scope Exclusion Settings.setBoolean(Settings.KEYS.SKIP_TEST_SCOPE, skipTestScope); Settings.setBoolean(Settings.KEYS.SKIP_RUNTIME_SCOPE, skipRuntimeScope); Settings.setBoolean(Settings.KEYS.SKIP_PROVIDED_SCOPE, skipProvidedScope); + + // Data Directory + if (dataDirectory != null && !dataDirectory.isEmpty()) { + Settings.setString(Settings.KEYS.DATA_DIRECTORY, dataDirectory); + } + + // CVE Data Mirroring + if (cveUrl12Modified != null && !cveUrl12Modified.isEmpty()) { + Settings.setString(Settings.KEYS.CVE_MODIFIED_12_URL, cveUrl12Modified); + } + if (cveUrl20Modified != null && !cveUrl20Modified.isEmpty()) { + Settings.setString(Settings.KEYS.CVE_MODIFIED_20_URL, cveUrl20Modified); + } + if (cveUrl12Base != null && !cveUrl12Base.isEmpty()) { + Settings.setString(Settings.KEYS.CVE_SCHEMA_1_2, cveUrl12Base); + } + if (cveUrl20Base != null && !cveUrl20Base.isEmpty()) { + Settings.setString(Settings.KEYS.CVE_SCHEMA_2_0, cveUrl20Base); + } } /** diff --git a/dependency-check-maven/src/site/markdown/configuration.md b/dependency-check-maven/src/site/markdown/configuration.md index 99427a1b7..da8a4f3c1 100644 --- a/dependency-check-maven/src/site/markdown/configuration.md +++ b/dependency-check-maven/src/site/markdown/configuration.md @@ -23,6 +23,11 @@ connectionString | The connection string used to connect to the database. | databaseUser | The username used when connecting to the database. | databasePassword | The password used when connecting to the database. | zipExtensions | A comma-separated list of additional file extensions to be treated like a ZIP file, the contents will be extracted and analyzed. | -skipTestScope | Should be skip analysis for artifacts with Test Scope (default: true) | -skipProvidedScope | Should be skip analysis for artifacts with Provided Scope (default: false) | -skipRuntimeScope | Should be skip analysis for artifacts with Runtime Scope (default: false) | +skipTestScope | Should be skip analysis for artifacts with Test Scope | true +skipProvidedScope | Should be skip analysis for artifacts with Provided Scope | false +skipRuntimeScope | Should be skip analysis for artifacts with Runtime Scope | false +dataDirectory | Data directory to hold SQL CVEs contents. This should generally not be changed. | +cveUrl12Modified | URL for the modified CVE 1.2 | http://nvd.nist.gov/download/nvdcve-modified.xml +cveUrl20Modified | URL for the modified CVE 2.0 | http://static.nvd.nist.gov/feeds/xml/cve/nvdcve-2.0-modified.xml +cveUrl12Base | Base URL for each year's CVE 1.2, the %d will be replaced with the year | http://nvd.nist.gov/download/nvdcve-%d.xml +cveUrl20Base | Base URL for each year's CVE 2.0, the %d will be replaced with the year | http://static.nvd.nist.gov/feeds/xml/cve/nvdcve-2.0-%d.xml diff --git a/dependency-check-maven/src/site/markdown/usage.md.vm b/dependency-check-maven/src/site/markdown/usage.md.vm index dc1ffc1b0..33bdaea06 100644 --- a/dependency-check-maven/src/site/markdown/usage.md.vm +++ b/dependency-check-maven/src/site/markdown/usage.md.vm @@ -135,4 +135,38 @@ Create the DependencyCheck-report.html and skip artifacts no bundled in distribu ... ``` +Example 5: +--------------------- +Create the DependencyCheck-report.html and use internal mirroring of CVE contents + +```xml + + + + ... + + org.owasp + dependency-check-maven + ${project.version} + + http://internal-mirror.mycorp.com/downloads/nist/nvdcve-modified.xml + http://internal-mirror.mycorp.com/downloads/nist/nvdcve-2.0-modified.xml + http://internal-mirror.mycorp.com/downloads/nist/nvdcve-%d.xml + http://internal-mirror.mycorp.com/downloads/nist/nvdcve-2.0-%d.xml + + + + + check + + + + + ... + + ... + + ... + +```