Can dependency-check scan remote repositiories?

jeremylong / DependencyCheck

OWASP dependency-check is a software composition analysis utility that detects publicly disclosed vulnerabilities in application dependencies.

https://owasp.org/www-project-dependency-check/

Apache License 2.0

6.31k stars 1.26k forks source link

Can dependency-check scan remote repositiories? #6782

Open eve1ynjiang opened 2 months ago

eve1ynjiang commented 2 months ago

In the --scan parameter is there a way to access a github repository remotely? Or do I have to clone it and store it locally?

aikebah commented 2 months ago

The path to scan - this option can be specified multiple times. It is also possible to specify Ant style paths (e.g. ‘directory/*/.jar’); if using an Ant style path it is highly recommended that you use single quotes around the path so that the shell itself does not automatically perform replacements

path to scan, so no, you cannot scan repositories, you have to clone it on the filesystem.