failOnCVSS doesn't fail

[msaperst]

When adding the flag to fail when certain severity issues are found, the npm job doesn't fail. An error is thrown, but the npm job exit code is still a success (0). My set up is as follows in order to reproduce:

package.json

{
  ...
  "scripts": {
    "owasp": "owasp-dependency-check --scan package-lock.json -f HTML JSON --failOnCVSS 8"
    ...
  },
  ...
  "dependencies": {
    ...
    "owasp-dependency-check": "0.0.21",
  }
  ...
}

When I run the below command, the get the following:

npm run owasp

Error: Command failed: /path/to/project/dependency-check-bin/dependency-check/bin/dependency-check.sh --out=./dependency-check-reports --scan package-lock.json -f HTML JSON --failOnCVSS 8 --project="project" --data=/tmp/dependency-check-data

    at ChildProcess.exithandler (child_process.js:308:12)
    at ChildProcess.emit (events.js:315:20)
    at maybeClose (internal/child_process.js:1048:16)
    at Process.ChildProcess._handle.onexit (internal/child_process.js:288:5) {
  killed: false,
  code: 1,
  signal: null,
  cmd: '/path/to/project/dependency-check-bin/dependency-check/bin/dependency-check.sh --out=./dependency-check-reports --scan package-lock.json -f HTML JSON --failOnCVSS 8 --project="project" --data=/tmp/dependency-check-data'
}

And when I check the exit code with echo $?, I get:

% echo $?         
0

[msaperst]

As a note, when I run the same command with the failOnCVSS parameter, it all runs cleanly. And the report that generates does show critical vulnerabilities that SHOULD be causing the execution to fail

[centi]

I cannot reproduce this. Could you provide more information?

• the package-lock.json for which this fails
• what version of Node/NPM are you using?
• what version of java are you using?

[Christian-8]

Hi, I have the same error and it is so simple reproduce the case. Run

npm install ng @angular-architects/module-federation owasp-dependency-check
npx owasp-dependency-check --nodePackageSkipDevDependencies --log file1.log --failOnCVSS 7
echo $? 

The owasp-dependency-check fails with error 15 (you can see in console) but the echo $? returns 0. I have node16 and java 8 but I can reproduce it with node18 and java17.

I suppose that the problem (in current implementation) is in the "exec" command, it is asynchronous and it does not propagate the error