Skip to content

Commit 812793d

Browse files
framayojeremylong
framayo
and
jeremylong
authored
fix: Update to support OSS Index Authentication Requirements (#7920)
Co-authored-by: Jeremy Long <jeremy.long@gmail.com>
1 parent fc289ea commit 812793d

File tree

3 files changed

+97
-16
lines changed

3 files changed

+97
-16
lines changed

‎core/src/main/java/org/owasp/dependencycheck/analyzer/OssIndexAnalyzer.java‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,9 @@
3737
import org.owasp.dependencycheck.dependency.VulnerableSoftwareBuilder;
3838
import org.owasp.dependencycheck.dependency.naming.Identifier;
3939
import org.owasp.dependencycheck.dependency.naming.PurlIdentifier;
40+
import org.owasp.dependencycheck.exception.InitializationException;
4041
import org.owasp.dependencycheck.utils.Settings;
42+
import org.owasp.dependencycheck.utils.Settings.KEYS;
4143
import org.slf4j.Logger;
4244
import org.slf4j.LoggerFactory;
4345
import us.springett.parsers.cpe.exceptions.CpeValidationException;
@@ -127,6 +129,16 @@ protected void closeAnalyzer() throws Exception {
127129
}
128130
}
129131

132+
@Override
133+
protected void prepareAnalyzer(Engine engine) throws InitializationException {
134+
synchronized (FETCH_MUTIX) {
135+
if (StringUtils.isEmpty(getSettings().getString(KEYS.ANALYZER_OSSINDEX_USER, StringUtils.EMPTY)) ||
136+
StringUtils.isEmpty(getSettings().getString(KEYS.ANALYZER_OSSINDEX_PASSWORD, StringUtils.EMPTY))) {
137+
throw new InitializationException("Error initializing OSS Index analyzer due to missing user/password credentials. Authentication is now required: https://ossindex.sonatype.org/doc/auth-required");
138+
}
139+
}
140+
}
141+
130142
@Override
131143
protected void analyzeDependency(final Dependency dependency, final Engine engine) throws AnalysisException {
132144
// batch request component-reports for all dependencies

‎core/src/test/java/org/owasp/dependencycheck/analyzer/OssIndexAnalyzerTest.java‎

Lines changed: 79 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -8,14 +8,19 @@
88
import org.owasp.dependencycheck.dependency.Dependency;
99
import org.owasp.dependencycheck.dependency.naming.Identifier;
1010
import org.owasp.dependencycheck.dependency.naming.PurlIdentifier;
11+
import org.owasp.dependencycheck.exception.InitializationException;
1112
import org.owasp.dependencycheck.utils.Settings;
13+
import org.owasp.dependencycheck.utils.Settings.KEYS;
14+
1215
import org.sonatype.goodies.packageurl.PackageUrl;
1316
import org.sonatype.ossindex.service.api.componentreport.ComponentReport;
1417
import org.sonatype.ossindex.service.client.OssindexClient;
1518
import org.sonatype.ossindex.service.client.transport.Transport;
1619

1720
import java.net.SocketTimeoutException;
21+
import java.net.URI;
1822
import java.util.Collections;
23+
import java.util.HashMap;
1924
import java.util.List;
2025
import java.util.Map;
2126
import java.util.concurrent.ExecutionException;
@@ -25,6 +30,7 @@
2530

2631
import static org.junit.jupiter.api.Assertions.assertDoesNotThrow;
2732
import static org.junit.jupiter.api.Assertions.assertEquals;
33+
import static org.junit.jupiter.api.Assertions.assertThrows;
2834
import static org.junit.jupiter.api.Assertions.assertTrue;
2935

3036
class OssIndexAnalyzerTest extends BaseTest {
@@ -42,10 +48,12 @@ void should_enrich_be_included_in_mutex_to_prevent_NPE()
4248
Dependency dependency = new Dependency();
4349
dependency.addSoftwareIdentifier(identifier);
4450
Settings settings = getSettings();
51+
setCredentials(settings);
4552
Engine engine = new Engine(settings);
4653
engine.setDependencies(Collections.singletonList(dependency));
4754

4855
analyzer.initialize(settings);
56+
analyzer.prepareAnalyzer(engine);
4957

5058
String expectedOutput = "https://ossindex.sonatype.org/component/pkg:maven/test/test@1.0";
5159

@@ -75,6 +83,11 @@ void should_enrich_be_included_in_mutex_to_prevent_NPE()
7583
*/
7684
static final class SproutOssIndexAnalyzer extends OssIndexAnalyzer {
7785
private Future<?> pendingClosureTask;
86+
@Override
87+
OssindexClient newOssIndexClient() {
88+
return new OssIndexClientOk();
89+
}
90+
7891
@Override
7992
void enrich(Dependency dependency) {
8093
ExecutorService executor = Executors.newSingleThreadExecutor();
@@ -93,19 +106,46 @@ void awaitPendingClosure() throws ExecutionException, InterruptedException {
93106
}
94107
}
95108

109+
private static final class OssIndexClientOk implements OssindexClient {
110+
111+
@Override
112+
public Map<PackageUrl, ComponentReport> requestComponentReports(List<PackageUrl> coordinates) throws Exception {
113+
HashMap<PackageUrl, ComponentReport> reports = new HashMap<>();
114+
ComponentReport report = new ComponentReport();
115+
PackageUrl packageUrl = coordinates.get(0);
116+
report.setCoordinates(packageUrl);
117+
report.setReference(new URI("https://ossindex.sonatype.org/component/pkg:maven/test/test@1.0?utm_source=dependency-check&utm_medium=integration&utm_content=12.1.4-SNAPSHOT"));
118+
reports.put(packageUrl, report);
119+
return reports;
120+
}
121+
122+
@Override
123+
public ComponentReport requestComponentReport(PackageUrl coordinates) throws Exception {
124+
return new ComponentReport();
125+
}
126+
127+
@Override
128+
public void close() {
129+
130+
}
131+
}
132+
96133
@Test
97134
void should_analyzeDependency_return_a_dedicated_error_message_when_403_response_from_sonatype() throws Exception {
98135
// Given
99136
OssIndexAnalyzer analyzer = new OssIndexAnalyzerThrowing403();
100-
analyzer.initialize(getSettings());
137+
Settings settings = getSettings();
138+
setCredentials(settings);
139+
Engine engine = new Engine(settings);
140+
141+
analyzer.initialize(settings);
142+
analyzer.prepareAnalyzer(engine);
101143

102144
Identifier identifier = new PurlIdentifier("maven", "test", "test", "1.0",
103145
Confidence.HIGHEST);
104146

105147
Dependency dependency = new Dependency();
106148
dependency.addSoftwareIdentifier(identifier);
107-
Settings settings = getSettings();
108-
Engine engine = new Engine(settings);
109149
engine.setDependencies(Collections.singletonList(dependency));
110150

111151
// When
@@ -126,17 +166,19 @@ void should_analyzeDependency_return_a_dedicated_error_message_when_403_response
126166
void should_analyzeDependency_only_warn_when_transport_error_from_sonatype() throws Exception {
127167
// Given
128168
OssIndexAnalyzer analyzer = new OssIndexAnalyzerThrowing502();
169+
Settings settings = getSettings();
170+
setCredentials(settings);
171+
settings.setBoolean(Settings.KEYS.ANALYZER_OSSINDEX_WARN_ONLY_ON_REMOTE_ERRORS, true);
172+
Engine engine = new Engine(settings);
129173

130-
getSettings().setBoolean(Settings.KEYS.ANALYZER_OSSINDEX_WARN_ONLY_ON_REMOTE_ERRORS, true);
131-
analyzer.initialize(getSettings());
174+
analyzer.initialize(settings);
175+
analyzer.prepareAnalyzer(engine);
132176

133177
Identifier identifier = new PurlIdentifier("maven", "test", "test", "1.0",
134178
Confidence.HIGHEST);
135179

136180
Dependency dependency = new Dependency();
137181
dependency.addSoftwareIdentifier(identifier);
138-
Settings settings = getSettings();
139-
Engine engine = new Engine(settings);
140182

141183
// When
142184
try (engine) {
@@ -148,22 +190,23 @@ void should_analyzeDependency_only_warn_when_transport_error_from_sonatype() thr
148190
}
149191
}
150192

151-
152193
@Test
153194
void should_analyzeDependency_only_warn_when_socket_error_from_sonatype() throws Exception {
154195
// Given
155196
OssIndexAnalyzer analyzer = new OssIndexAnalyzerThrowingSocketTimeout();
197+
Settings settings = getSettings();
198+
setCredentials(settings);
199+
settings.setBoolean(Settings.KEYS.ANALYZER_OSSINDEX_WARN_ONLY_ON_REMOTE_ERRORS, true);
200+
analyzer.initialize(settings);
156201

157-
getSettings().setBoolean(Settings.KEYS.ANALYZER_OSSINDEX_WARN_ONLY_ON_REMOTE_ERRORS, true);
158-
analyzer.initialize(getSettings());
202+
Engine engine = new Engine(settings);
203+
analyzer.prepareAnalyzer(engine);
159204

160205
Identifier identifier = new PurlIdentifier("maven", "test", "test", "1.0",
161206
Confidence.HIGHEST);
162207

163208
Dependency dependency = new Dependency();
164209
dependency.addSoftwareIdentifier(identifier);
165-
Settings settings = getSettings();
166-
Engine engine = new Engine(settings);
167210

168211
// When
169212
try (engine) {
@@ -180,17 +223,19 @@ void should_analyzeDependency_only_warn_when_socket_error_from_sonatype() throws
180223
void should_analyzeDependency_fail_when_socket_error_from_sonatype() throws Exception {
181224
// Given
182225
OssIndexAnalyzer analyzer = new OssIndexAnalyzerThrowingSocketTimeout();
226+
Settings settings = getSettings();
227+
setCredentials(settings);
228+
settings.setBoolean(Settings.KEYS.ANALYZER_OSSINDEX_WARN_ONLY_ON_REMOTE_ERRORS, false);
229+
Engine engine = new Engine(settings);
183230

184-
getSettings().setBoolean(Settings.KEYS.ANALYZER_OSSINDEX_WARN_ONLY_ON_REMOTE_ERRORS, false);
185-
analyzer.initialize(getSettings());
231+
analyzer.initialize(settings);
232+
analyzer.prepareAnalyzer(engine);
186233

187234
Identifier identifier = new PurlIdentifier("maven", "test", "test", "1.0",
188235
Confidence.HIGHEST);
189236

190237
Dependency dependency = new Dependency();
191238
dependency.addSoftwareIdentifier(identifier);
192-
Settings settings = getSettings();
193-
Engine engine = new Engine(settings);
194239
engine.setDependencies(Collections.singletonList(dependency));
195240

196241
// When
@@ -206,7 +251,25 @@ void should_analyzeDependency_fail_when_socket_error_from_sonatype() throws Exce
206251
analyzer.close();
207252
}
208253

254+
@Test
255+
void should_prepareAnalyzer_fail_when_credentials_not_set() throws Exception {
256+
OssIndexAnalyzer analyzer = new OssIndexAnalyzer();
257+
Settings settings = getSettings();
258+
Engine engine = new Engine(settings);
259+
analyzer.initialize(settings);
260+
try {
261+
analyzer.prepareAnalyzer(engine);
262+
assertThrows(InitializationException.class, () -> analyzer.prepareAnalyzer(engine));
263+
} catch (InitializationException e) {
264+
analyzer.close();
265+
engine.close();
266+
}
267+
}
209268

269+
private static void setCredentials(final Settings settings) {
270+
settings.setString(KEYS.ANALYZER_OSSINDEX_USER, "user");
271+
settings.setString(KEYS.ANALYZER_OSSINDEX_PASSWORD, "pass");
272+
}
210273

211274
static final class OssIndexAnalyzerThrowing403 extends OssIndexAnalyzer {
212275
@Override

‎src/site/markdown/analyzers/oss-index-analyzer.md‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,3 +8,9 @@ identified vulnerabilities are included in the report. In addition, vulnerabilit
88
found in both the NVD and OSS Index may have additional references added.
99

1010
This analyzer requires an Internet connection.
11+
12+
Sonatype [announced](https://ossindex.sonatype.org/doc/auth-required) that OSS Index requires authentication.
13+
14+
You can get an API Token following these steps:
15+
1. [Sign In](https://ossindex.sonatype.org/user/signin) or [Sign Up](https://ossindex.sonatype.org/user/register) for free.
16+
2. Get the API Token from user Settings.

0 commit comments

Comments
 (0)