search

jeremylong / DependencyCheck

OWASP dependency-check is a software composition analysis utility that detects publicly disclosed vulnerabilities in application dependencies.
https://owasp.org/www-project-dependency-check/
Apache License 2.0
6.32k stars 1.26k forks source link

Any way to configure mojo.properties at runtime? #6184

Open theangrydev opened 9 months ago

theangrydev commented 9 months ago

I notice that mojo.properties has quite a few properties that are not exposed by the Maven plugin.

Is there any way to provide this at runtime to the plugin?

I guess adding a <dependency> inside the <plugin> might work to add another item to the classpath, but would require building a JAR just for this purpose.

jeremylong commented 9 months ago

At the moment, no. But if you set the value as an environment variable ODC will pick that up. What properties do you want to change?

theangrydev commented 9 months ago

I was hoping to be able to set the cve.cpe.startswith.filter

jeremylong commented 9 months ago

What did you want to change with the starts with filter?

theangrydev commented 9 months ago

I noticed the recent issues with the NVD API and this seemed to be a key parameter, end goal is/was to stabilise my CI builds that use the plugin, that are currently failing due to intermittent HTTP error issues with the NVD API

jeremylong commented 9 months ago

9.0.2 should be fine now.