search

jeremylong / DependencyCheck

OWASP dependency-check is a software composition analysis utility that detects publicly disclosed vulnerabilities in application dependencies.
https://owasp.org/www-project-dependency-check/
Apache License 2.0
6.32k stars 1.26k forks source link

DependencyCheck is scanning wrong directory #2968

Open kazigk opened 3 years ago

kazigk commented 3 years ago

Describe the bug DependencyCheck is looking for files outside of scan directory when bcrypt is one of the npm packages.

Version of dependency-check used Dependency-Check Core version 6.0.3

Log file

λ ZenBook fun → pwd
/home/kazi/fun
λ ZenBook fun → dependency-check.sh -s . -o .
[INFO]

Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies; false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided is at the user’s risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.

[INFO] Analysis Started
[INFO] Finished Archive Analyzer (0 seconds)
[INFO] Finished File Name Analyzer (0 seconds)
[WARN] No lock file exists - this will result in false negatives; please run `npm install --package-lock`
[WARN] Analyzing `/tmp/dctempf857d667-0d58-48b7-95cd-a025c65d4b37/check11785941332466291854tmp/2/package/package.json` - however, the node_modules directory does not exist. Please run `npm install` prior to running dependency-check
[INFO] Finished Node.js Package Analyzer (0 seconds)
[INFO] Finished Dependency Merging Analyzer (0 seconds)
[INFO] Finished Version Filter Analyzer (0 seconds)
[INFO] Finished Hint Analyzer (0 seconds)
[INFO] Created CPE Index (1 seconds)
[INFO] Finished CPE Analyzer (1 seconds)
[INFO] Finished False Positive Analyzer (0 seconds)
[INFO] Finished NVD CVE Analyzer (0 seconds)
[INFO] Finished Node Audit Analyzer (0 seconds)
[WARN] Retire JS repository is empty or missing - attempting to force the update
[INFO] Finished RetireJS Analyzer (1 seconds)
[WARN] Unable to determine Package-URL identifiers for 255 dependencies
[INFO] Finished Sonatype OSS Index Analyzer (0 seconds)
[INFO] Finished Vulnerability Suppression Analyzer (0 seconds)
[INFO] Finished Dependency Bundling Analyzer (0 seconds)
[INFO] Analysis Complete (3 seconds)

To Reproduce

npm i --save bcrypt
dependency-check.sh -s . -o .
jeremylong commented 3 years ago

Please see the release notes. I would highly recommend using:

dependency-check.sh --disableNodeJS -s . -o .

The NodeJS analyzer will be re-worked soon and will be used to only scan the vendors directory if it exists.

In this case the actual bug is that an archive was found that contained a package.json, dependency-check tries to extract it to a temporary directory for scanning and the warning is thrown because the node_modules directory (if it exists) is not also extracted.