Uploaded image for project: 'Magnolia DX Core'
  1. Magnolia DX Core
  2. MGNLEE-603

DXCore - Implement OWASP Dependency Check for selected webapps

    XMLWordPrintable

Details

    • Task
    • Resolution: Done
    • Major
    • 6.2
    • None
    • build / bundling
    • None
    • 2

    Description

      1. implement suppressions (false-positives), likely through plugin configuration in parent POMs
      2. provide a default suppressionFile in build-resources module
      3. also configure a project-specific location, so that projects can add more suppressions, without requiring parent pom re-release
      4. let's not bind the check goal to any phase yet
      5. for local run: mvn dependency-check:check, typically mostly relevant in webapps
      6. for CI runs: add a separate pipeline step to magnoliaPacksPipeline I believe, invoking the mvn command above
      7. add a report configuration for site-generation, using the aggregate goal on module parent (nice to have)
      8. estimate load on CI from vulnerability database updates

      Initial research goal (fulfilled): estimate initial effort to discard false positives such as the one mentioned on the CVE scans research log.
      => suppressions may not be that hard, and upon second look amount of false-positives seems manageable.

      Checklists

        Acceptance criteria

        Attachments

          Issue Links

            Activity

              People

                dai.ha Dai Ha
                dai.ha Dai Ha
                Votes:
                0 Vote for this issue
                Watchers:
                1 Start watching this issue

                Dates

                  Created:
                  Updated:
                  Resolved:

                  Checklists

                    Task DoR

                    Time Tracking

                      Estimated:
                      Original Estimate - Not Specified
                      Not Specified
                      Remaining:
                      Time Spent - 3h Remaining Estimate - 1h
                      1h
                      Logged:
                      Time Spent - 3h Remaining Estimate - 1h
                      3h