feat: add hostedSuppressionsAuthHeader option to provide credentials for the hosted suppression file

ant/src/main/java/org/owasp/dependencycheck/taskdefs/Purge.java

@@ -62,6 +62,11 @@ public class Purge extends Task {
      */
     private String hostedSuppressionsUrl = null;
 
+    /**
+     * The authorization header to hosted suppressions file with base FP suppressions.
+     */
+    private String hostedSuppressionsAuthHeader = null;
+
     /**
      * Construct a new DependencyCheckTask.
      */
@@ -131,6 +136,24 @@ public void setHostedSuppressionsUrl(final String hostedSuppressionsUrl) {
         this.hostedSuppressionsUrl = hostedSuppressionsUrl;
     }
 
+    /**
+     * Get the value of hostedSuppressionsAuthHeader.
+     *
+     * @return the value of hostedSuppressionsAuthHeader
+     */
+    public String getHostedSuppressionsAuthHeader() {
+        return hostedSuppressionsAuthHeader;
+    }
+
+    /**
+     * Set the value of hostedSuppressionsAuthHeader.
+     *
+     * @param hostedSuppressionsUrl new value of hostedSuppressionsAuthHeader
+     */
+    public void setHostedSuppressionsAuthHeader(final String hostedSuppressionsAuthHeader) {
+        this.hostedSuppressionsAuthHeader = hostedSuppressionsAuthHeader;
+    }
+
     /**
      * Sets the
      * {@link Thread#getContextClassLoader() Thread Context Class Loader} to the
@@ -214,6 +237,7 @@ protected void populateSettings() throws BuildException {
             log(msg, ex, Project.MSG_WARN);
         }
         settings.setStringIfNotEmpty(Settings.KEYS.HOSTED_SUPPRESSIONS_URL, hostedSuppressionsUrl);
+        settings.setStringIfNotEmpty(Settings.KEYS.HOSTED_SUPPRESSIONS_AUTH_HEADER, hostedSuppressionsAuthHeader);
         if (dataDirectory != null) {
             settings.setString(Settings.KEYS.DATA_DIRECTORY, dataDirectory);
         } else {

ant/src/site/markdown/config-purge.md

@@ -23,6 +23,7 @@ Advanced Configuration
 ====================
 The following properties can be configured in the plugin. However, they are less frequently changed.
 
-Property              | Description                                                                                      | Default Value
-----------------------|--------------------------------------------------------------------------------------------------|------------------
-hostedSuppressionsUrl | The URL to a mirrored copy of the hosted suppressions file for internet-constrained environments | https://jeremylong.github.io/DependencyCheck/suppressions/publishedSuppressions.xml
+Property                     | Description                                                                                      | Default Value
+-----------------------------|--------------------------------------------------------------------------------------------------|------------------
+hostedSuppressionsUrl        | The URL to a mirrored copy of the hosted suppressions file for internet-constrained environments | https://jeremylong.github.io/DependencyCheck/suppressions/publishedSuppressions.xml
+hostedSuppressionsAuthHeader | The authorization header to a mirrored copy of the hosted suppressions file for internet-constrained environments | 

ant/src/site/markdown/config-update.md

@@ -51,5 +51,6 @@ databaseUser         | The username used when connecting to the database.
 databasePassword     | The password used when connecting to the database.                                                                                                                                                                                 |  
 hostedSuppressionsEnabled | Whether the hosted suppression file will be used.                                                                                                                                                                                  | true
 hostedSuppressionsUrl | The URL to a mirrored copy of the hosted suppressions file for internet-constrained environments                                                                                                                                   | https://jeremylong.github.io/DependencyCheck/suppressions/publishedSuppressions.xml
+hostedSuppressionsAuthHeader | The authorization header to a mirrored copy of the hosted suppressions file for internet-constrained environments | 
 hostedSuppressionsValidForHours | Sets the number of hours to wait before checking for new updates of the hosted suppressions file                                                                                                                                   | 2
 hostedSuppressionsForceUpdate | Sets whether the hosted suppressions file should update regardless of the `autoupdate` and validForHours settings                                                                                                                  | false 

ant/src/site/markdown/configuration.md

@@ -164,5 +164,6 @@ databaseUser         | The username used when connecting to the database.
 databasePassword     | The password used when connecting to the database.                                                                                                                                                                                 |  
 hostedSuppressionsEnabled | Whether the hosted suppression file will be used.                                                                                                                                                                                  | true
 hostedSuppressionsUrl | The URL to a mirrored copy of the hosted suppressions file for internet-constrained environments                                                                                                                                   | https://jeremylong.github.io/DependencyCheck/suppressions/publishedSuppressions.xml
+hostedSuppressionsAuthHeader | The authorization header to a mirrored copy of the hosted suppressions file for internet-constrained environments | 
 hostedSuppressionsValidForHours | Sets the number of hours to wait before checking for new updates of the hosted suppressions file                                                                                                                                   | 2
 hostedSuppressionsForceUpdate | Sets whether the hosted suppressions file should update regardless of the `autoupdate` and validForHours settings                                                                                                                  | false

cli/src/main/java/org/owasp/dependencycheck/CliParser.java

@@ -530,7 +530,10 @@ private void addAdvancedOptions(final Options options) {
                 .addOption(newOptionWithArg(ARGUMENT.HOSTED_SUPPRESSIONS_VALID_FOR_HOURS, "hours",
                         "The number of hours to wait before checking for new updates of the the hosted suppressions file."))
                 .addOption(newOptionWithArg(ARGUMENT.HOSTED_SUPPRESSIONS_URL, "url",
-                        "The URL for a mirrored hosted suppressions file"));
+                        "The URL for a mirrored hosted suppressions file"))
+                .addOption(newOptionWithArg(ARGUMENT.HOSTED_SUPPRESSIONS_AUTH_HEADER, "authorization header",
+                        "The authorization header for a mirrored hosted suppressions file"))
+                ;
 
     }
 
@@ -1600,5 +1603,10 @@ public static class ARGUMENT {
          * suppressions file .
          */
         public static final String HOSTED_SUPPRESSIONS_URL = "hostedSuppressionsUrl";
+        /**
+         * The CLI argument to set the location of a mirrored hosted
+         * suppressions file authorization header.
+         */
+        public static final String HOSTED_SUPPRESSIONS_AUTH_HEADER = "hostedSuppressionsAuthHeader";
     }
 }

cli/src/main/resources/completion-for-dependency-check.sh

@@ -78,6 +78,7 @@ _odc_completions()
             --hostedSuppressionsForceUpdate
             --hostedSuppressionsValidForHours <hours>
             --hostedSuppressionsUrl <url>
+            --hostedSuppressionsAuthHeader <authorization header>
             --junitFailOnCVSS <score>
         -l --log
         -n --noupdate

cli/src/site/markdown/arguments.md

@@ -130,3 +130,4 @@ Advanced Options
 |       | \-\-hostedSuppressionsForceUpdate     |                 | Whether the hosted suppressions file will update regardless of the `noupdate` argument.                                                                                                                                                                                                                                            | false         |
 |       | \-\-hostedSuppressionsValidForHours   | \<hours\>       | The number of hours to wait before checking for new updates of the hosted suppressions file                                                                                                                                                                                                                                        | 2             |
 |       | \-\-hostedSuppressionsUrl             | \<url\>         | The URL to a mirrored copy of the hosted suppressions file for internet-constrained environments                                                                                                                                                                                                                                   | https://jeremylong.github.io/DependencyCheck/suppressions/publishedSuppressions.xml |
+|       | \-\-hostedSuppressionsAuthHeader      | \<authorization header\> | The authorization header to a mirrored copy of the hosted suppressions file for internet-constrained environments                                                                                                                                                                                                                                   |  |

core/src/main/java/org/owasp/dependencycheck/data/update/HostedSuppressionsDataSource.java

@@ -132,7 +132,11 @@ private void fetchHostedSuppressions(Settings settings, URL repoUrl, File repoFi
             if (LOGGER.isDebugEnabled()) {
                 LOGGER.debug("Hosted Suppressions URL: {}", repoUrl.toExternalForm());
             }
-            Downloader.getInstance().fetchFile(repoUrl, repoFile);
+            LOGGER.trace("Downloading Hosted Suppressions file from '{}'", repoUrl);
+            Downloader.getInstance().fetchFile(repoUrl, repoFile,
+            		settings.useProxy(), 
+            		Settings.KEYS.HOSTED_SUPPRESSIONS_USER, Settings.KEYS.HOSTED_SUPPRESSIONS_PASSWORD, 
+            		Downloader.NO_PROPERTY_DEFINED, Settings.KEYS.HOSTED_SUPPRESSIONS_AUTH_HEADER);
         } catch (IOException | TooManyRequestsException | ResourceNotFoundException | WriteLockException ex) {
             throw new UpdateException("Failed to update the hosted suppressions file", ex);
         }

maven/src/main/java/org/owasp/dependencycheck/maven/BaseDependencyCheckMojo.java

@@ -1026,6 +1026,12 @@ public abstract class BaseDependencyCheckMojo extends AbstractMojo implements Ma
     @SuppressWarnings("CanBeFinal")
     @Parameter(property = "hostedSuppressionsUrl")
     private String hostedSuppressionsUrl;
+    /**
+     * The hosted suppressions authorization header.
+     */
+    @SuppressWarnings("CanBeFinal")
+    @Parameter(property = "hostedSuppressionsAuthHeader")
+    private String hostedSuppressionsAuthHeader;
     /**
      * Whether the hosted suppressions file will be updated regardless of the
      * `autoupdate` settings.
@@ -2379,6 +2385,7 @@ protected void populateSettings() {
         }
         settings.setIntIfNotNull(Settings.KEYS.HOSTED_SUPPRESSIONS_VALID_FOR_HOURS, hostedSuppressionsValidForHours);
         settings.setStringIfNotNull(Settings.KEYS.HOSTED_SUPPRESSIONS_URL, hostedSuppressionsUrl);
+        settings.setStringIfNotNull(Settings.KEYS.HOSTED_SUPPRESSIONS_AUTH_HEADER, hostedSuppressionsAuthHeader);
         settings.setBooleanIfNotNull(Settings.KEYS.HOSTED_SUPPRESSIONS_FORCEUPDATE, hostedSuppressionsForceUpdate);
         settings.setBooleanIfNotNull(Settings.KEYS.HOSTED_SUPPRESSIONS_ENABLED, hostedSuppressionsEnabled);
     }

maven/src/site/markdown/configuration.md

@@ -173,6 +173,7 @@ databasePassword         | The password used when connecting to the database.
 hostedSuppressionsEnabled      | Whether the hosted suppressions file will be used.                                                                                                                                                                                                                                                                | true
 hostedSuppressionsForceUpdate  | Whether the hosted suppressions file will update regardless of the `autoupdate` setting.                                                                                                                                                                                                                          | false
 hostedSuppressionsUrl          | The URL to a mirrored copy of the hosted suppressions file for internet-constrained environments.                                                                                                                                                                                                                 | https://jeremylong.github.io/DependencyCheck/suppressions/publishedSuppressions.xml
+hostedSuppressionsAuthHeader   | The authorization header to a mirrored copy of the hosted suppressions file for internet-constrained environments.                                                                                                                                                                                                    |
 hostedSuppressionsValidForHours| Sets the number of hours to wait before checking for new updates from the NVD.                                                                                                                                                                                                                                    | 2
 retireJsUrlServerId      | The id of a server defined in the settings.xml to retrieve the credentials (username and password) to connect to RetireJS instance.                                                                                                                                                                               |  
 retireJsUser             | If you don't want register user/password in settings.xml, you can specify user.                                                                                                                                                                                                                                   |