search

jeremylong / DependencyCheck

OWASP dependency-check is a software composition analysis utility that detects publicly disclosed vulnerabilities in application dependencies.
https://owasp.org/www-project-dependency-check/
Apache License 2.0
5.96k stars 1.21k forks source link

Do not use inline styles, scripts and image in dependency-check-report.html due to CSP #6576

Open robertoschwald opened 1 month ago

robertoschwald commented 1 month ago

Currently, the Gradle generated dependency-check-report.html holds inline-styles and scripts. This is blocked by CSP if you serve the file by a server, like via Jenkins publishHTML.

The only way to get the page working currently is to lower CSP by

style-src 'self' 'unsafe-inline' and for script-src (this is strongly disscuraged)

Better is to externalize the styles, scripts and images into separate files and reference in dependency-check-report.html

Only possible way is to download the report html to get it working.

aikebah commented 1 month ago

For your purpose I think it would suffice to switch your setup to use the report type JENKINS instead of report type HTML, which was added in response to https://github.com/jeremylong/DependencyCheck/issues/5039

robertoschwald commented 1 month ago

Unfortunately, not really. The inline-styles are still blocked by CSP. Cleanest solution would be to split JS and css into seperate files in JENKINS type report, so we can publish them with the html page.

jeremylong commented 1 month ago

The purpose of having it all bundled is to have a single file that is completely contained so that it can easily be viewed offline. Regarding the JENKINS report - we accept PRs.

LorenDorez commented 2 days ago

What about pushing the js and css to a CDN and then linking to that in the HTML?

This also impact the SonarQube plugin/extension. With the CDN files we can then request SonarSource to add to their CSP header?

Or maybe a new version output for SQ that doesn't use any inline js for hiding/expanding sections and just show them all by default?

LorenDorez commented 2 days ago

I see a special html with no JS was added for Jenkins can we possibly expose that via the Azure plugin as I don't have that as an option in the dropdown

aikebah commented 2 days ago

@LorenDorez That would be something to raise with https://github.com/dependency-check/azuredevops (I assume that's the Azure plugin you're talking about)

but by picking 'ALL' as the format in that plugin should, among others, also create the Jenkins report as an output format from your scan

LorenDorez commented 2 days ago

I was wanting to avoid the extra overhead of all since I didn't need all formats. I'll post a issue on the azure one