search

jeremylong / DependencyCheck

OWASP dependency-check is a software composition analysis utility that detects publicly disclosed vulnerabilities in application dependencies.
https://owasp.org/www-project-dependency-check/
Apache License 2.0
6.42k stars 1.28k forks source link

authentication credentials for hostedSuppressionsUrl #5387

Open robocrock opened 1 year ago

robocrock commented 1 year ago

Hi!

We are running the dependency checker as maven plugin in a ci/cd-runner without internet access. The runner has however access to a local service which is able to mirror the suppression-url. The service requires authentication in order to access the url.

It seems when specifying the hostedSuppressionsUrl setting, the plugin is trying to access the local service, but it seems the suppressionFileUser and suppressionFilePassword is not used when accessing hostedSuppressionsUrl?

It it possible to specify username and password/access-token in any way for the hostedSuppressionsUrl, or is it something that would be considered useful in an upcominge update?

aikebah commented 1 year ago

As we already support a similar case for retireJS mirrors with the retireJsUser/Password parameters I think this is a valid enhancement request.

robocrock commented 1 year ago

If this is accepted, then maybe if it is not too much more work, the same could be configured for the knownExploitedUrl also? We currently have this disabled for the same reason, that username and password/access-token cannot be specified.

YaroslavYakymenko commented 1 year ago

We created an artifactory mirror for the CISA website but authentication for knownExploitedUrl is not supported.