Uploaded image for project: 'Build'
  1. Build
  2. BUILD-373

Implement OWASP Dependency Check for selected webapps

    XMLWordPrintable

    Details

    • Type: Task
    • Status: Closed
    • Priority: Major
    • Resolution: Fixed
    • Affects Version/s: None
    • Fix Version/s: Build Resources 1.6.8, POMs 38
    • Component/s: Poms
    • Labels:
      None
    • Epic Link:
    • Sprint:
      6.2 Ramp-up 19, 6.2 Ramp-up 20
    • Story Points:
      8

      Description

      1. implement suppressions (false-positives), likely through plugin configuration in parent POMs
      2. provide a default suppressionFile in build-resources module
      3. also configure a project-specific location, so that projects can add more suppressions, without requiring parent pom re-release
      4. let's not bind the check goal to any phase yet
      5. for local run: mvn dependency-check:check, typically mostly relevant in webapps
      6. for CI runs: add a separate pipeline step to magnoliaPacksPipeline I believe, invoking the mvn command above
      7. add a report configuration for site-generation, using the aggregate goal on module parent (nice to have)
      8. estimate load on CI from vulnerability database updates

      Initial research goal (fulfilled): estimate initial effort to discard false positives such as the one mentioned on the CVE scans research log.
      => suppressions may not be that hard, and upon second look amount of false-positives seems manageable.

        Checklists

        Acceptance criteria

          Attachments

            Issue Links

              Activity

                People

                Assignee:
                dai.ha Dai Ha
                Reporter:
                mgeljic Mikaël Geljić
                Votes:
                0 Vote for this issue
                Watchers:
                1 Start watching this issue

                  Dates

                  Created:
                  Updated:
                  Resolved:

                    Checklists

                    Task DoR

                      Time Tracking

                      Estimated:
                      Original Estimate - Not Specified
                      Not Specified
                      Remaining:
                      Remaining Estimate - 0d
                      0d
                      Logged:
                      Time Spent - 5.75d
                      5.75d