search

jeremylong / DependencyCheck

OWASP dependency-check is a software composition analysis utility that detects publicly disclosed vulnerabilities in application dependencies.
https://owasp.org/www-project-dependency-check/
Apache License 2.0
6.32k stars 1.26k forks source link

Improvements to database model (specifically SQL Server) #5580

Open pacorreia opened 1 year ago

pacorreia commented 1 year ago

Hi team,

Recently I started a POC for a centralized database to host OWASP Dep Check data. We're aiming for Azure SQL Database.

Immediately on the first attempt I noticed a really slow performance, when compared with H2.

Even a local MSSQL was not performing as expected.

I tracked down the root cause to several tables that don't have clustered indexes, neither non-clustered indexes, and/or unique columns identifying uniquely each row.

For a relational database this is a big problem.

For example the table cpeEntry, there's a store procedure 'insert_software', that is doing a clustered index scan over all text fields! this really slows down all updates.

Any chance there's some work in progress? I guess that changing the data model would also mean significant changes in the scanner as well.

I'm available to help improve the database model

paulinachlewinska commented 8 months ago

Hi, How did you connect to get the scan running to Azure SQL, which machine and can you share your obfuscated connection string? I'm trying to do the same but cant connect to my azure db . Cheers