Giters

jeremylong / DependencyCheck

OWASP dependency-check is a software composition analysis utility that detects publicly disclosed vulnerabilities in application dependencies.

Home Page:https://owasp.org/www-project-dependency-check/

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

How does the Hosted Suppression File work when using a Database Server?

juanmanuelromeraferrio opened this issue · comments

commented

Hi,

I'm implementing Dependency Check using a Database Server. Before this, I was using the CLI App with an update using an H2 Database, and the check process was using the Database hosted on the same machine where the update process was running.

I verified that the update process is responsible for copying the Hosted Suppression File to the specified Database Path, which worked fine in my last implementation.

Now, with the Database Server, on the machines where I execute the check process, I don't set a data path because the Database is on a Server.

Consequently, I'm encountering the following warning:

WARN - Hosted Suppressions file is empty or missing - attempting to force the update

How should I solve this?

commented

hosted suppression file is unrelated to the database.

the database holds NVD vulnerability data

various other 'internet access required' resources can be published on an intranet and then customized for the URL

https://jeremylong.github.io/DependencyCheck/data/index.html

commented

hosted suppression file is unrelated to the database.

the database holds NVD vulnerability data

various other 'internet access required' resources can be published on an intranet and then customized for the URL

https://jeremylong.github.io/DependencyCheck/data/index.html

Please can you tell me how to use it on an intranet

commented

@Lzmupupup How about you read the documentation linked (including its subpages and the tool documentation pages on the various *url configuration settings? The various pages tell you what to do.

Then tell us what you did and what's still breaking for you

commented

Hi @aikebah,

Hi,

I'm using a centralized database, so I decided to upload the publishSuppression.xml generated by the update process to my company's Artifactory.

Then, on the clients that execute the check process, my idea is to download this file and share it with Dependency Check CLI Tool.

If I add the --disableHostedSuppressions arg and include the publishedSuppression.xml in the --suppression files list, would the behavior be the same as using the Hosted Suppression File?

Thanks!

commented

@juanmanuelromeraferrio That would yield the same result indeed.
Note that instead of disabling it you could also use the --hostedSuppressionsUrl to point to the Artifactory URL for the hosted suppressions file.
For the en-result it would not matter, as the hosted suppressions and the project-supplied suppressions get merged together into a single set of suppression rules.