Skip to content

Latest commit

 

History

History
44 lines (33 loc) · 2.24 KB

README.md

File metadata and controls

44 lines (33 loc) · 2.24 KB
Raw

OWASP Dependency Check Pipe

This pipe is used to perform OWASP dependency checks using jeremylong/DependencyCheck

YAML Definition

Add the following your bitbucket-pipelines.yml file:

      - step:
          name: "Code Standards check"
          script:
            - pipe: docker://aligent/owasp-dependency-check-pipe
              variables:
                SCAN_PATH: "./composer.lock"
                CVSS_FAIL_LEVEL: "1"

Variables

Variable Usage
SCAN_PATH Relative paths to scan. Default: repository root.
CVSS_FAIL_LEVEL (Optional) If the score set between 0 and 10 the exit code from dependency-check will indicate if a vulnerability with a CVSS score equal to or higher was identified.
SUPPRESSION_FILE_PATH (Optional) Path to a suppression list
DISABLE_OSSINDEX (Optional) Disable OSS Index Analysis. Boolean
OSSINDEX_USERNAME (Optional) Provide OSS Index Username. Disregarded when DISABLE_OSSINDEX is set True
OSSINDEX_PASSWORD (Optional) Provide OSS Index Password. Disregarded when DISABLE_OSSINDEX is set True
NVD_API_KEY (Optional) Provide an API key for NVD.
OUTPUT_PATH (Optional) Path to output test results.
UPDATE_DB (Optional) Pass true if that database should be updated. Defaults to false
EXTRA_ARGS (Optional) Extra arguments to pass to dependency-check. i.e --disableRetireJS

⚠️ For npm/yarn projects, you should provide the directory containing package-lock.json or yarn.lock and node-modules as SCAN_PATH.

Development

The following command with world-writable test-results directory under project root can be used to invoke the pipe locally:

docker run --rm -e OUTPUT_PATH="/tmp/test-results/" -e CVSS_FAIL_LEVEL=1 -e SCAN_PATH=./composer.lock -v $PWD:/build --workdir=/build aligent/owasp-dependency-check-pipe

Commits published to the main branch will trigger an automated build.