search

sonatype-nexus-community / DevAudit

Open-source, cross-platform, multi-purpose security auditing tool
BSD 3-Clause "New" or "Revised" License
360 stars 74 forks source link

Error in First method in GetPackages task when csproj file doesn't contain any packagereferences #143

Open amolpatty opened 3 years ago

amolpatty commented 3 years ago

SCANNING: XXXXX.csproj ...

INFO: due to OSS index rate limiting waiting 10 seconds before scanning ... 19:48:38<01> [AUDIT] [WARNING] The Docker host root directory is not mounted on the DevAudit Docker image at /hostroot so no chroot for executables is possible. 19:48:38<01> [AUDIT] [SUCCESS] Detected operating system of environment is debian. 19:48:39<01> [AUDIT] [SUCCESS] Detected operating system version of environment is buster/sid. 19:48:40<01> [AUDIT] [INFO] Using .NET Core package source configuration file /app/XXXXX.csproj. 19:48:40<01> [HOST] [INFO] Using OSS Index as default package vulnerabilities data source for .NET Core package source. 19:48:40<01> [AUDIT] [STATUS] Scanning .NET Core packages. 19:48:40<06> [AUDIT] [INFO] Reading packages from .NET Core C# .csproj file. 19:48:42<06> [AUDIT] [INFO] Scanning NuGet transitive dependencies for .NETCoreApp3.1... 19:48:42<01> [AUDIT] [ERROR] Error in First method in GetPackages task. 19:48:42<01> [AUDIT] [ERROR] Exception occurred. DEBUG: Result from devaudit script: >252<

`

netcoreapp3.1

`

mcallaghan-geotab commented 3 years ago

The "verdict" here seems to be that devaudit explodes if there isn't a single PackageReference entry