Uploaded image for project: 'Build'
  1. Build
  2. BUILD-373

Implement OWASP Dependency Check for selected webapps

    XMLWordPrintable

    Details

    • Type: Task
    • Status: Closed
    • Priority: Major
    • Resolution: Fixed
    • Affects Version/s: None
    • Fix Version/s: Build Resources 1.6.8, POMs 38
    • Component/s: Poms
    • Labels:
      None
    • Epic Link:
    • Sprint:
      6.2 Ramp-up 19, 6.2 Ramp-up 20
    • Story Points:
      8

      Description

      1. implement suppressions (false-positives), likely through plugin configuration in parent POMs
      2. provide a default suppressionFile in build-resources module
      3. also configure a project-specific location, so that projects can add more suppressions, without requiring parent pom re-release
      4. let's not bind the check goal to any phase yet
      5. for local run: mvn dependency-check:check, typically mostly relevant in webapps
      6. for CI runs: add a separate pipeline step to magnoliaPacksPipeline I believe, invoking the mvn command above
      7. add a report configuration for site-generation, using the aggregate goal on module parent (nice to have)
      8. estimate load on CI from vulnerability database updates

      Initial research goal (fulfilled): estimate initial effort to discard false positives such as the one mentioned on the CVE scans research log.
      => suppressions may not be that hard, and upon second look amount of false-positives seems manageable.

        Attachments

          Issue Links

            Activity

              People

              Assignee:
              dai.ha Dai Ha
              Reporter:
              mgeljic Mikaël Geljić
              Votes:
              0 Vote for this issue
              Watchers:
              1 Start watching this issue

                Dates

                Created:
                Updated:
                Resolved:

                  Time Tracking

                  Estimated:
                  Original Estimate - Not Specified
                  Not Specified
                  Remaining:
                  Remaining Estimate - 0d
                  0d
                  Logged:
                  Time Spent - 5.75d
                  5.75d