[JIRA] (JENKINS-58648) Dependency-check publisher 5.0.2 does not show Results

[mbarzanti@gmail.com (JIRA)]

Marco Barzanti updated an issue

Jenkins / JENKINS-58648 Dependency-check publisher 5.0.2 does not show Results Change By: Marco Barzanti Summary: Dependency-check publisher 5.0.2 does not show Results Add Comment

This message was sent by Atlassian Jira (v7.11.2#711002-sha1:fdc329d)

[mbarzanti@gmail.com (JIRA)]

Marco Barzanti updated an issue

Jenkins / JENKINS-58648 Dependency-check publisher 5.0.2 does not show Results Change By: Marco Barzanti

I'm using ODC 5.0.2 Jenkins Plugin. It always sets results to UNSTABLE with or without defined thresholds and does not show neither Trends nor Results. Build Arguments: --project DCTest --scan OSSTest --enableExperimental --disableArchive --log SRSCAdep.log --cveValidForHours 24 --enableRetired --junitFailOnCVSS 11 Publisher is configured h3. Possible Bug This is the Job's console output: --- — Started by user Administrator Running as SYSTEM Building in workspace /var/lib/jenkins/jobs/DCTest/workspace [DependencyCheck] [INFO] Checking for updates [DependencyCheck] [INFO] Skipping NVD check since last check was within 24 hours. [DependencyCheck] [INFO] Skipping RetireJS update since last update was within 24 hours. [DependencyCheck] [INFO] Check for updates complete (10 ms) [DependencyCheck] [INFO] [DependencyCheck] [DependencyCheck] Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies; false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided is at the user’s risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever arising out of or in connection with the use of this tool, the analysis performed, or the resulting report. [DependencyCheck] [DependencyCheck] [DependencyCheck] [INFO] Analysis Started [DependencyCheck] [INFO] Finished File Name Analyzer (0 seconds) [DependencyCheck] [INFO] Finished Jar Analyzer (0 seconds) [DependencyCheck] [INFO] Finished Central Analyzer (0 seconds) [DependencyCheck] [INFO] Finished Assembly Analyzer (0 seconds) [DependencyCheck] [INFO] Finished Python Package Analyzer (0 seconds) [DependencyCheck] [INFO] Finished Dependency Merging Analyzer (0 seconds) [DependencyCheck] [INFO] Finished Version Filter Analyzer (0 seconds) [DependencyCheck] [INFO] Finished Hint Analyzer (0 seconds) [DependencyCheck] [INFO] Created CPE Index (3 seconds) [DependencyCheck] [INFO] Finished CPE Analyzer (5 seconds) [DependencyCheck] [INFO] Finished False Positive Analyzer (0 seconds) [DependencyCheck] [INFO] Finished NVD CVE Analyzer (0 seconds) [DependencyCheck] 00:00 INFO: Vulnerability found: jquery below 1.9.0b1 [DependencyCheck] 00:00 INFO: Vulnerability found: jquery below 1.12.0 [DependencyCheck] 00:00 INFO: Vulnerability found: jquery below 1.12.0 [DependencyCheck] 00:00 INFO: Vulnerability found: jquery below 3.4.0 [DependencyCheck] 00:01 INFO: Vulnerability found: bootstrap below 4.3.1 [DependencyCheck] 00:01 INFO: Vulnerability found: bootstrap below 4.1.2 [DependencyCheck] 00:01 INFO: Vulnerability found: bootstrap below 4.1.2 [DependencyCheck] 00:01 INFO: Vulnerability found: bootstrap below 4.1.2 [DependencyCheck] [INFO] Finished RetireJS Analyzer (4 seconds) [DependencyCheck] [INFO] Finished Sonatype OSS Index Analyzer (0 seconds) [DependencyCheck] [INFO] Finished Vulnerability Suppression Analyzer (0 seconds) [DependencyCheck] [INFO] Finished Dependency Bundling Analyzer (1 seconds) [DependencyCheck] [INFO] Analysis Complete (14 seconds) Build step 'Invoke Dependency-Check' changed build result to SUCCESS [DependencyCheck] Collecting Dependency-Check artifact [DependencyCheck] Unable to find Dependency-Check reports to parse Build step 'Publish Dependency-Check results' changed build result to UNSTABLE Finished: UNSTABLE h4. Log Attached log contains no errors

Add Comment

[steve.springett@owasp.org (JIRA)]

Steve Springett commented on JENKINS-58648

Re: Dependency-check publisher 5.0.2 does not show Results This is the clue:

[DependencyCheck] Unable to find Dependency-Check reports to parse

What does the job configuration have for 'artifact'?

Add Comment

[mbarzanti@gmail.com (JIRA)]

Marco Barzanti commented on JENKINS-58648

Re: Dependency-check publisher 5.0.2 does not show Results

I changed cli arguments as follows: --project DCTest --scan "/var/lib/jenkins/workspace/OSSTest-src" --enableExperimental --disableArchive --log SRSCAdep.log --cveValidForHours 24 --enableRetired --junitFailOnCVSS 11 --out "/var/lib/jenkins/workspace/OSSTest" Nothing was changed, no results and I had:

[DependencyCheck] Unable to find Dependency-Check reports to parse

Add Comment

[milkyman@web.de (JIRA)]

Horst Krause commented on JENKINS-58648

Re: Dependency-check publisher 5.0.2 does not show Results

Same for us, when updating from DependencyCheck v4 to v5. It looks like the default path for report search was "**/dependency-check-report.xml" in v4 and has changed to "dependency-check-report.xml" in v5. We had this field empty in all our job configs. For v4 this was fine. With v5 the report is not found any more and additionally when a job was triggered the empty report path field changed to "dependency-check-report.xml". So our solution was to change the report path in all jobs to "**/dependency-check-report.xml". Now the reports are found again.

Add Comment

This message was sent by Atlassian Jira (v7.13.6#713006-sha1:cc4451f)

[milkyman@web.de (JIRA)]

Horst Krause edited a comment on JENKINS-58648

Re: Dependency-check publisher 5.0.2 does not show Results

Same for us, when updating from DependencyCheck v4 to v5. It looks like the default path for report search was "**/dependency-check-report.xml" in v4 and has changed to "dependency-check-report.xml" in v5.

We had this field empty in all our job configs. For v4 this was fine. With v5 the report is reports are not found any more and additionally when a job was is triggered the empty report path field is changed automatically to "dependency-check-report.xml".

So our solution was to change the report path in all jobs to "**/dependency-check-report.xml". Now the reports are found again.

Add Comment

[milkyman@web.de (JIRA)]

Horst Krause edited a comment on JENKINS-58648

Re: Dependency-check publisher 5.0.2 does not show Results

Same for us, when updating from DependencyCheck v4 to v5. It looks like the default path for report search was "**/dependency-check-report.xml" in v4 and has changed to "dependency-check-report.xml" in v5.

We had this field empty in all our job configs. For v4 this was fine. With v5 the reports are not found any more and additionally when a job is triggered the empty report path field is changed automatically to "dependency-check-report.xml".

So our solution was to change the report path in all jobs to "**/dependency-check-report.xml". Now the reports are found again.

Update: I realized that [https://wiki.jenkins.io/display/JENKINS/OWASP+Dependency-Check+Plugin] announces a 5.0.2 in july which "Changed the default artifact pattern to **/dependency-check-report.xml". But we are still running 5.0.1 because the 5.0.2 is not available in our jenkins 2.190.2. So perhaps the issue creator should check if the proper version is running in his installation. And I'll investigate, why 5.0.2 is not available for us...

Add Comment

[milkyman@web.de (JIRA)]

And I'll investigate, why 5.0.2 is not available for us... BTW: Die report file does exist in the jobs workspace? ;)

Add Comment

[steve.springett@owasp.org (JIRA)]

Steve Springett commented on JENKINS-58648

Re: Dependency-check publisher 5.0.2 does not show Results

Also note that https://wiki.jenkins.io/display/JENKINS/OWASP+Dependency-Check+Plugin is readonly and cannot be modified. v5.0.2 is not the current release. Currently release is 5.1.0 https://plugins.jenkins.io/dependency-check-jenkins-plugin

Add Comment