diff --git a/dependency-check-maven/src/main/java/org/owasp/dependencycheck/maven/ArtifactScopeExcluded.java b/dependency-check-maven/src/main/java/org/owasp/dependencycheck/maven/ArtifactScopeExcluded.java index d1afd71c7..0ee4e83d4 100644 --- a/dependency-check-maven/src/main/java/org/owasp/dependencycheck/maven/ArtifactScopeExcluded.java +++ b/dependency-check-maven/src/main/java/org/owasp/dependencycheck/maven/ArtifactScopeExcluded.java @@ -19,6 +19,8 @@ package org.owasp.dependencycheck.maven; import org.owasp.dependencycheck.utils.Filter; +import static org.apache.maven.artifact.Artifact.SCOPE_RUNTIME_PLUS_SYSTEM; + /** * Tests is the artifact should be included in the scan (i.e. is the * dependency in a scope that is being scanned). @@ -55,6 +57,9 @@ public class ArtifactScopeExcluded extends Filter { if (skipRuntimeScope && org.apache.maven.artifact.Artifact.SCOPE_RUNTIME.equals(scope)) { return true; } + if (skipRuntimeScope && skipSystemScope && org.apache.maven.artifact.Artifact.SCOPE_COMPILE_PLUS_RUNTIME.equals(SCOPE_RUNTIME_PLUS_SYSTEM)) { + return true; + } return false; }