"HTTP/1.0 403 Forbidden" from proxy after upgrading to 2.1.0

[Kaj Hejer]

Hi

After upgrading from 2.0.1 to 2.1.0 i now get the stacktrace bellow. I havn't changed anything in my proxyconfig, only the version number for dependency-check-maven.

I use proxy config in the mvn commandline ("-Dproxy.server...") since I havn't looked into procyconfig in settings.xml yet.


[ERROR] Failed to execute goal org.owasp:dependency-check-maven:2.1.0:check (default-cli) on project nettskjema: One or more exceptions occurred during dependency-check analysis: One or more exceptions occurred during dependency-check analysis

[ERROR] Unable to tunnel through proxy. Proxy returns "HTTP/1.0 403 Forbidden"

[ERROR] -> [Help 1]

org.apache.maven.lifecycle.LifecycleExecutionException: Failed to execute goal org.owasp:dependency-check-maven:2.1.0:check (default-cli) on project nettskjema: One or more exceptions occurred during dependency-check analysis
at org.apache.maven.lifecycle.internal.MojoExecutor.execute(MojoExecutor.java:213)
at org.apache.maven.lifecycle.internal.MojoExecutor.execute(MojoExecutor.java:154)
at org.apache.maven.lifecycle.internal.MojoExecutor.execute(MojoExecutor.java:146)
at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject(LifecycleModuleBuilder.java:117)
at org.apache.maven.lifecycle.internal.LifecycleModuleBuilder.buildProject(LifecycleModuleBuilder.java:81)
at org.apache.maven.lifecycle.internal.builder.singlethreaded.SingleThreadedBuilder.build(SingleThreadedBuilder.java:51)
at org.apache.maven.lifecycle.internal.LifecycleStarter.execute(LifecycleStarter.java:128)
at org.apache.maven.DefaultMaven.doExecute(DefaultMaven.java:309)
at org.apache.maven.DefaultMaven.doExecute(DefaultMaven.java:194)
at org.apache.maven.DefaultMaven.execute(DefaultMaven.java:107)
at org.jvnet.hudson.maven3.launcher.Maven35Launcher.main(Maven35Launcher.java:130)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:498)
at org.codehaus.plexus.classworlds.launcher.Launcher.launchEnhanced(Launcher.java:289)
at org.codehaus.plexus.classworlds.launcher.Launcher.launch(Launcher.java:229)
at jenkins.maven3.agent.Maven35Main.launch(Maven35Main.java:176)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:498)
at hudson.maven.Maven3Builder.call(Maven3Builder.java:139)
at hudson.maven.Maven3Builder.call(Maven3Builder.java:70)
at hudson.remoting.UserRequest.perform(UserRequest.java:181)
at hudson.remoting.UserRequest.perform(UserRequest.java:52)
at hudson.remoting.Request$2.run(Request.java:336)
at hudson.remoting.InterceptingExecutorService$1.call(InterceptingExecutorService.java:68)
at java.util.concurrent.FutureTask.run(FutureTask.java:266)
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
at java.lang.Thread.run(Thread.java:748)
Caused by: org.apache.maven.plugin.MojoExecutionException: One or more exceptions occurred during dependency-check analysis
at org.owasp.dependencycheck.maven.CheckMojo.runCheck(CheckMojo.java:128)
at org.owasp.dependencycheck.maven.BaseDependencyCheckMojo.execute(BaseDependencyCheckMojo.java:526)
at org.apache.maven.plugin.DefaultBuildPluginManager.executeMojo(DefaultBuildPluginManager.java:134)
at org.apache.maven.lifecycle.internal.MojoExecutor.execute(MojoExecutor.java:208)
... 31 more
Caused by: org.owasp.dependencycheck.exception.ExceptionCollection: One or more exceptions occurred during dependency-check analysis
Unable to tunnel through proxy. Proxy returns "HTTP/1.0 403 Forbidden"
at org.owasp.dependencycheck.Engine.analyzeDependencies(Engine.java:649)
at org.owasp.dependencycheck.maven.CheckMojo.runCheck(CheckMojo.java:105)
... 34 more


-Kaj :)

[Kaj Hejer]

Sorry, one thing I forgot to write is that can there be any new urls that need to be added to the whitelist of the proxy when using version 2.1.0?

Thanks!


-Kaj :)

[Jeremy Long]

With 2.1.0 the NSP Analyzer was added which does reach out to https://api.nodesecurity.io/check

--Jeremy

-Kaj :)

--
You received this message because you are subscribed to the Google Groups "Dependency Check" group.
To unsubscribe from this group and stop receiving emails from it, send an email to dependency-check+unsubscribe@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[Kaj Hejer]

Great, thanks!


-Kaj :)