mirror of
https://github.com/ysoftdevs/DependencyCheck.git
synced 2026-01-14 07:43:40 +01:00
updated documentation
This commit is contained in:
Jeremy Long
@@ -0,0 +1,34 @@
|
||||
Tasks
|
||||
====================
|
||||
|
||||
Task | Description
|
||||
----------------------------------------------------|-----------------------
|
||||
[dependencyCheck](configuration.html) | Runs dependency-check against the project and generates a report.
|
||||
[dependencyCheckUpdate]](configuration-update.html) | Updates the local cache of the NVD data from NIST.
|
||||
dependencyCheckPurge | Deletes the local copy of the NVD. This is used to force a refresh of the data.
|
||||
|
||||
Configuration: dependencyCheckPurge
|
||||
====================
|
||||
|
||||
#### Example
|
||||
```groovy
|
||||
dependencyCheckPurge {
|
||||
}
|
||||
```
|
||||
|
||||
### Advanced Configuration
|
||||
|
||||
The following properties can be configured in the dependencyCheckPurge task. However, they are less frequently changed.
|
||||
|
||||
Config Group | Property | Description | Default Value
|
||||
-------------|-------------------|---------------------------------------------------------------------------------------------|------------------
|
||||
data | directory | Sets the data directory to hold SQL CVEs contents. This should generally not be changed. |
|
||||
|
||||
$H$H$H$H Example
|
||||
```groovy
|
||||
dependencyCheckPurge {
|
||||
data {
|
||||
directory='d:/nvd'
|
||||
}
|
||||
}
|
||||
```
|
||||
@@ -1,11 +1,11 @@
|
||||
Tasks
|
||||
====================
|
||||
|
||||
Task | Description
|
||||
------------------------------------------|-----------------------
|
||||
[dependencyCheck](configuration.html) | Runs dependency-check against the project and generates a report.
|
||||
dependencyCheckUpdate | Updates the local cache of the NVD data from NIST.
|
||||
[dependencyCheckPurge](config-purge.html) | Deletes the local copy of the NVD. This is used to force a refresh of the data.
|
||||
Task | Description
|
||||
-------------------------------------------------|-----------------------
|
||||
[dependencyCheck](configuration.html) | Runs dependency-check against the project and generates a report.
|
||||
dependencyCheckUpdate | Updates the local cache of the NVD data from NIST.
|
||||
[dependencyCheckPurge](configuration-purge.html) | Deletes the local copy of the NVD. This is used to force a refresh of the data.
|
||||
|
||||
Configuration: dependencyCheckUpdate
|
||||
====================
|
||||
@@ -13,24 +13,16 @@ The following properties can be configured for the dependencyCheckUpdate task:
|
||||
|
||||
Property | Description | Default Value
|
||||
---------------------|------------------------------------|------------------
|
||||
autoUpdate | Sets whether auto-updating of the NVD CVE/CPE data is enabled. It is not recommended that this be turned to false. | true
|
||||
cveValidForHours | Sets the number of hours to wait before checking for new updates from the NVD. | 4
|
||||
failBuildOnCVSS | Specifies if the build should be failed if a CVSS score above a specified level is identified. The default is 11; since the CVSS scores are 0-10, by default the build will never fail. | 11
|
||||
format | The report format to be generated (HTML, XML, VULN, ALL). | HTML
|
||||
reportsDirName | The location to write the report(s). This directory will be located in the build directory. | reports
|
||||
skipTestGroups | When set to true (the default) all dependency groups that being with 'test' will be skipped. | true
|
||||
suppressionFile | The file path to the XML suppression file \- used to suppress [false positives](../general/suppression.html) |
|
||||
|
||||
$H$H$H$H Example
|
||||
#### Example
|
||||
```groovy
|
||||
dependencyCheck {
|
||||
autoUpdate=false
|
||||
dependencyCheckUpdate {
|
||||
cveValidForHours=1
|
||||
format=ALL
|
||||
}
|
||||
```
|
||||
|
||||
$H$H$H Proxy Configuration
|
||||
### Proxy Configuration
|
||||
|
||||
Property | Description | Default Value
|
||||
------------------|------------------------------------|------------------
|
||||
@@ -40,9 +32,9 @@ username | Defines the proxy user name. |
|
||||
password | Defines the proxy password. |
|
||||
connectionTimeout | The URL Connection Timeout. |
|
||||
|
||||
$H$H$H$H Example
|
||||
#### Example
|
||||
```groovy
|
||||
dependencyCheck {
|
||||
dependencyCheckUpdate {
|
||||
proxy {
|
||||
server=some.proxy.server
|
||||
port=8989
|
||||
@@ -50,7 +42,7 @@ dependencyCheck {
|
||||
}
|
||||
```
|
||||
|
||||
$H$H$H Advanced Configuration
|
||||
### Advanced Configuration
|
||||
|
||||
The following properties can be configured in the dependencyCheck task. However, they are less frequently changed. One exception
|
||||
may be the cvedUrl properties, which can be used to host a mirror of the NVD within an enterprise environment.
|
||||
@@ -69,48 +61,11 @@ data | connectionString | The connection string used to connect to the
|
||||
data | username | The username used when connecting to the database. |
|
||||
data | password | The password used when connecting to the database. |
|
||||
|
||||
$H$H$H$H Example
|
||||
#### Example
|
||||
```groovy
|
||||
dependencyCheck {
|
||||
dependencyCheckUpdate {
|
||||
data {
|
||||
directory='d:/nvd'
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
$H$H$H Analyzer Configuration
|
||||
|
||||
In addition to the above, the dependencyCheck plugin can be configured to enable or disable specific
|
||||
analyzers by configuring the `analyzer` section. Note, specific file type analyzers will automatically
|
||||
disable themselves if no file types that they support are detected - so specifically disabling the
|
||||
analyzers is likely not needed.
|
||||
|
||||
Property | Description | Default Value
|
||||
----------------------|---------------------------------------------------------------------------|------------------
|
||||
archiveEnabled | Sets whether the Archive Analyzer will be used. | true
|
||||
zipExtensions | A comma-separated list of additional file extensions to be treated like a ZIP file, the contents will be extracted and analyzed. |
|
||||
jarEnabled | Sets whether Jar Analyzer will be used. | true
|
||||
centralEnabled | Sets whether Central Analyzer will be used. If this analyzer is being disabled there is a good chance you also want to disable the Nexus Analyzer (see below). | true
|
||||
nexusEnabled | Sets whether Nexus Analyzer will be used. This analyzer is superceded by the Central Analyzer; however, you can configure this to run against a Nexus Pro installation. | true
|
||||
nexusUrl | Defines the Nexus Server's web service end point (example http://domain.enterprise/service/local/). If not set the Nexus Analyzer will be disabled. |
|
||||
nexusUsesProxy | Whether or not the defined proxy should be used when connecting to Nexus. | true
|
||||
pyDistributionEnabled | Sets whether the Python Distribution Analyzer will be used. | true
|
||||
pyPackageEnabled | Sets whether the Python Package Analyzer will be used. | true
|
||||
rubygemsEnabled | Sets whether the Ruby Gemspec Analyzer will be used. | true
|
||||
opensslEnabled | Sets whether or not the openssl Analyzer should be used. | true
|
||||
cmakeEnabled | Sets whether or not the CMake Analyzer should be used. | true
|
||||
autoconfEnabled | Sets whether or not the autoconf Analyzer should be used. | true
|
||||
composerEnabled | Sets whether or not the PHP Composer Lock File Analyzer should be used. | true
|
||||
nodeEnabled | Sets whether or not the Node.js Analyzer should be used. | true
|
||||
nuspecEnabled | Sets whether or not the .NET Nuget Nuspec Analyzer will be used. | true
|
||||
assemblyEnabled | Sets whether or not the .NET Assembly Analyzer should be used. | true
|
||||
pathToMono | The path to Mono for .NET assembly analysis on non-windows systems. |
|
||||
|
||||
$H$H$H$H Example
|
||||
```groovy
|
||||
dependencyCheck {
|
||||
analyzer {
|
||||
assemblyEnabled=false
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
@@ -1,11 +1,11 @@
|
||||
Tasks
|
||||
====================
|
||||
|
||||
Task | Description
|
||||
--------------------------------------------|-----------------------
|
||||
dependencyCheck | Runs dependency-check against the project and generates a report.
|
||||
[dependencyCheckUpdate](config-update.html) | Updates the local cache of the NVD data from NIST.
|
||||
[dependencyCheckPurge](config-purge.html) | Deletes the local copy of the NVD. This is used to force a refresh of the data.
|
||||
Task | Description
|
||||
---------------------------------------------------|-----------------------
|
||||
dependencyCheck | Runs dependency-check against the project and generates a report.
|
||||
[dependencyCheckUpdate](configuration-update.html) | Updates the local cache of the NVD data from NIST.
|
||||
[dependencyCheckPurge](configuration-purge.html) | Deletes the local copy of the NVD. This is used to force a refresh of the data.
|
||||
|
||||
Configuration: dependencyCheck
|
||||
====================
|
||||
@@ -21,7 +21,7 @@ reportsDirName | The location to write the report(s). This directory will
|
||||
skipTestGroups | When set to true (the default) all dependency groups that being with 'test' will be skipped. | true
|
||||
suppressionFile | The file path to the XML suppression file \- used to suppress [false positives](../general/suppression.html) |
|
||||
|
||||
$H$H$H$H Example
|
||||
#### Example
|
||||
```groovy
|
||||
dependencyCheck {
|
||||
autoUpdate=false
|
||||
@@ -30,7 +30,7 @@ dependencyCheck {
|
||||
}
|
||||
```
|
||||
|
||||
$H$H$H Proxy Configuration
|
||||
### Proxy Configuration
|
||||
|
||||
Property | Description | Default Value
|
||||
------------------|------------------------------------|------------------
|
||||
@@ -40,7 +40,7 @@ username | Defines the proxy user name. |
|
||||
password | Defines the proxy password. |
|
||||
connectionTimeout | The URL Connection Timeout. |
|
||||
|
||||
$H$H$H$H Example
|
||||
#### Example
|
||||
```groovy
|
||||
dependencyCheck {
|
||||
proxy {
|
||||
@@ -50,7 +50,7 @@ dependencyCheck {
|
||||
}
|
||||
```
|
||||
|
||||
$H$H$H Advanced Configuration
|
||||
### Advanced Configuration
|
||||
|
||||
The following properties can be configured in the dependencyCheck task. However, they are less frequently changed. One exception
|
||||
may be the cvedUrl properties, which can be used to host a mirror of the NVD within an enterprise environment.
|
||||
@@ -69,7 +69,7 @@ data | connectionString | The connection string used to connect to the
|
||||
data | username | The username used when connecting to the database. |
|
||||
data | password | The password used when connecting to the database. |
|
||||
|
||||
$H$H$H$H Example
|
||||
#### Example
|
||||
```groovy
|
||||
dependencyCheck {
|
||||
data {
|
||||
@@ -78,7 +78,7 @@ dependencyCheck {
|
||||
}
|
||||
```
|
||||
|
||||
$H$H$H Analyzer Configuration
|
||||
### Analyzer Configuration
|
||||
|
||||
In addition to the above, the dependencyCheck plugin can be configured to enable or disable specific
|
||||
analyzers by configuring the `analyzer` section. Note, specific file type analyzers will automatically
|
||||
@@ -106,7 +106,7 @@ nuspecEnabled | Sets whether or not the .NET Nuget Nuspec Analyzer will
|
||||
assemblyEnabled | Sets whether or not the .NET Assembly Analyzer should be used. | true
|
||||
pathToMono | The path to Mono for .NET assembly analysis on non-windows systems. |
|
||||
|
||||
$H$H$H$H Example
|
||||
#### Example
|
||||
```groovy
|
||||
dependencyCheck {
|
||||
analyzer {
|
||||
|
||||
@@ -107,63 +107,66 @@ Copyright (c) 2013 Jeremy Long. All Rights Reserved.
|
||||
</item>
|
||||
</item>
|
||||
<item collapse="true" name="File Type Analyzers" href="./analyzers/index.html">
|
||||
<item name="Archive Analyzer" href="./analyzers/archive-analyzer.html">
|
||||
<item name="Archive" href="./analyzers/archive-analyzer.html">
|
||||
<description>Archive Analyzer</description>
|
||||
</item>
|
||||
<item name="Assembly Analyzer" href="./analyzers/assembly-analyzer.html">
|
||||
<item name="Assembly" href="./analyzers/assembly-analyzer.html">
|
||||
<description>Assembly Analyzer</description>
|
||||
</item>
|
||||
<item name="Autoconf Analyzer" href="./analyzers/autoconf.html">
|
||||
<item name="Autoconf" href="./analyzers/autoconf.html">
|
||||
<description>Autoconf Analyzer</description>
|
||||
</item>
|
||||
<item name="Central Analyzer" href="./analyzers/central-analyzer.html">
|
||||
<item name="Central" href="./analyzers/central-analyzer.html">
|
||||
<description>Central Analyzer</description>
|
||||
</item>
|
||||
<item name="CMake Analyzer" href="./analyzers/cmake.html">
|
||||
<item name="CMake" href="./analyzers/cmake.html">
|
||||
<description>CMake Analyzer</description>
|
||||
</item>
|
||||
<item name="Jar Analyzer" href="./analyzers/jar-analyzer.html">
|
||||
<item name="Jar" href="./analyzers/jar-analyzer.html">
|
||||
<description>Jar Analyzer</description>
|
||||
</item>
|
||||
<item name="Nexus Analyzer" href="./analyzers/nexus-analyzer.html">
|
||||
<item name="Nexus" href="./analyzers/nexus-analyzer.html">
|
||||
<description>Nexus Analyzer</description>
|
||||
</item>
|
||||
<item name="Node.js Analyzer" href="./analyzers/nodejs.html">
|
||||
<item name="Node.js" href="./analyzers/nodejs.html">
|
||||
<description>Node.js Analyzer</description>
|
||||
</item>
|
||||
<item name="Nuspec Analyzer" href="./analyzers/nuspec-analyzer.html">
|
||||
<item name="Nuspec" href="./analyzers/nuspec-analyzer.html">
|
||||
<description>Nuspec Analyzer</description>
|
||||
</item>
|
||||
<item name="OpenSSL Analyzer" href="./analyzers/openssl.html">
|
||||
<item name="OpenSSL" href="./analyzers/openssl.html">
|
||||
<description>OpenSSL Analyzer</description>
|
||||
</item>
|
||||
<item name="Python Analyzer" href="./analyzers/python.html">
|
||||
<item name="Python" href="./analyzers/python.html">
|
||||
<description>Python Analyzer</description>
|
||||
</item>
|
||||
<item name="Ruby Gemspec Analyzer" href="./analyzers/ruby-gemspec.html">
|
||||
<item name="Ruby Gemspec" href="./analyzers/ruby-gemspec.html">
|
||||
<description>Ruby Gemspec Analyzer</description>
|
||||
</item>
|
||||
</item>
|
||||
<item collapse="true" name="Modules" href="./modules.html">
|
||||
<item name="dependency-check-cli" href="./dependency-check-cli/index.html">
|
||||
<item name="CLI" href="./dependency-check-cli/index.html">
|
||||
<description>The command line interface for OWASP dependency-check.</description>
|
||||
</item>
|
||||
<item name="dependency-check-ant" href="./dependency-check-ant/index.html">
|
||||
<item name="Ant Task" href="./dependency-check-ant/index.html">
|
||||
<description>Ant task to run OWASP dependency-check.</description>
|
||||
</item>
|
||||
<item name="dependency-check-maven" href="./dependency-check-maven/index.html">
|
||||
<item name="Maven Plugin" href="./dependency-check-maven/index.html">
|
||||
<description>Maven plugin for OWASP dependency-check.</description>
|
||||
</item>
|
||||
<item name="dependency-check-gradle" href="./dependency-check-gradle/index.html">
|
||||
<item collapse="true" name="Gradle Plugin" href="./dependency-check-gradle/index.html">
|
||||
<description>Gradle plugin for OWASP dependency-check.</description>
|
||||
<item name="dependencyCheck" href="./dependency-check-gradle/configuration.html" />
|
||||
<item name="dependencyCheckUpdate" href="./dependency-check-gradle/configuration-update.html" />
|
||||
<item name="dependencyCheckPurge" href="./dependency-check-gradle/configuration-purge.html" />
|
||||
</item>
|
||||
<item name="dependency-check-jenkins" href="./dependency-check-jenkins/index.html">
|
||||
<item name="Jenkins Plugin" href="./dependency-check-jenkins/index.html">
|
||||
<description>A Jenkins plugin for OWASP dependency-check.</description>
|
||||
</item>
|
||||
<item name="dependency-check-core" href="./dependency-check-core/index.html">
|
||||
<item name="Core" href="./dependency-check-core/index.html">
|
||||
<description>The core OWASP dependency-check engine and reporting tool.</description>
|
||||
</item>
|
||||
<item name="dependency-check-utils" href="./dependency-check-utils/index.html">
|
||||
<item name="Utils" href="./dependency-check-utils/index.html">
|
||||
<description>A set of utility classes used by OWASP dependency-check.</description>
|
||||
</item>
|
||||
</item>
|
||||
|
||||
Reference in New Issue
Block a user