A Circle CI orb using OWASP Dependency Check to check for components with known security-vulnerablities. Supported variants:

• Gradle plugin
• Maven plugin
• Command Line Tool

Import the orb

orbs:
  owasp: entur/[email protected]

where x is the latest version from the orb registry.

To use the default executor, Docker Hub credentials must be set as the environment variables $DOCKERHUB_LOGIN and $DOCKERHUB_PASSWORD.

Configure a job

workflows:
  version: 2.1
  build:
    jobs:
      - owasp/gradle_owasp_dependency_check:
          executor: java_17
          context: global

Then add OWASP Gradle Plugin to your gradle build:

plugins {
    id 'org.owasp.dependencycheck' version '9.0.2'
}

dependencyCheck {
    analyzedTypes = ['jar'] // the default artifact types that will be analyzed.
    format = 'ALL' // CI-tools usually needs XML-reports, but humans needs HTML.
    failBuildOnCVSS = 7 // Specifies if the build should be failed if a CVSS score equal to or above a specified level is identified.
    suppressionFiles = ["$rootDir/owasp_suppressions.xml"] // specify a list of known issues which contain false-positives
    nvd {  
        apiKey = "${project.properties['NVD_API_KEY'] ?: System.env.NVD_API_KEY}"  
    }
}

where

• suppressions (false positives) are assumed to be in owasp_suppressions.xml in the root of the project.
• NVD_API_KEY is assumed to contain the NVD API Key via
  • ~/.gradle/gradle.properties, or
  • environment variable, or
  • command line parameter

The default OWASP plugin task is dependencyCheckAnalyze, for using other tasks, add a task parameter as so:

workflows:
  version: 2.1
  build:
    jobs:
      - owasp/gradle_owasp_dependency_check:
          executor: java_17
          context: global
          task: dependencyCheckAggregate

where task is one of dependencyCheckAnalyze, dependencyCheckAggregate, dependencyCheckUpdate, and dependencyCheckPurge.

Alternatively, use the wrapped_gradle_steps command to customize further.

Configure a job

workflows:
  version: 2.1
  build:
    jobs:
      - owasp/maven_owasp_dependency_check:
          executor: java_17
          context: global

Then add OWASP Maven Plugin to your Maven build:

<plugin>
    <groupId>org.owasp</groupId>
    <artifactId>dependency-check-maven</artifactId>
    <version>9.0.2</version>
    <configuration>
        <format>all</format>
        <failBuildOnCVSS>7</failBuildOnCVSS>
        <nvdApiKey>${NVD_API_KEY}</nvdApiKey>
        <suppressionFiles>  
            <suppresionFile>${basedir}/owasp_suppressions.xml</suppresionFile>  
        </suppressionFiles>        
    </configuration>
    <executions>
        <execution>
            <!-- run only using explicit command -->
            <id>check</id>
            <phase>none</phase>
        </execution>
    </executions>
</plugin>

• suppressions (false positives) are assumed to be in owasp_suppressions.xml in the root of the project.
• NVD_API_KEY is assumed to contain the NVD API via
  • ~/.m2/settings.xml, or
  • environment variable, or
  • command line parameter

In ~/.m2/settings.xml, add

<profiles>
  <!-- ... -->
  <profile>
    <id>properties</id>
    <properties>
      <!-- other properties -->
      <NVD_API_KEY>YOUR KEY HERE</NVD_API_KEY>
    </properties>
  </profile>
</profiles>    

with

<activeProfiles>
  <!-- ... -->
  <activeProfile>properties</activeProfile>
</activeProfiles>

The default OWASP plugin task is check, for using other tasks, add a task parameter as so:

workflows:
  version: 2.1
  build:
    jobs:
      - owasp/maven_owasp_dependency_check:
          executor: java_17
          task: aggregate
          context: global

The dependency plugin currently is not able to resolve artifacts before they are built. If internal submodule dependencies cannot reached in the build, add a few wrapped_pre_steps to do so.

workflows:
  version: 2.1
  build:
    jobs:
      - owasp/maven_owasp_dependency_check:
          executor: java_17
          context: global
          wrapped_pre_steps:
            - run:  mvn install -Dmaven.test.skip=true

Alternatively, use the wrapped_maven_steps command to customize further.

Configure a job

workflows:
  version: 2.1
  build:
    jobs:
      - owasp/commandline_owasp_dependency_check:
          executor: java_17
          context: global

The default OWASP arguments is --scan ./, for using other commands, add an arguments parameter as so:

workflows:
  version: 2.1
  build:
    jobs:
      - owasp/commandline_owasp_dependency_check:
          executor: java_17
          arguments: "--scan ./ --failOnCVSS 7 --suppression ./dependency-check-suppressions.xml --nvdApiKey $NVD_API_KEY"
          context: global

See the arguments page for further details. Note that --format, --data and --noupdate arguments are already appended by this orb (updating the database is performed in an individual previous step).

Use no_output_timeout parameter to avoid "Too long with no output (exceeded 10m0s): context deadline exceeded" error

The OWASP plugin checks for updates to its database every four hours, and the database is cached by the orb like so:

• Year
• Quarter (12 weeks)
• Month (4 weeks)
• Week
• Day
• 12 hours
• 4 hours

So for each working day, the first builds (in the morning) will check for updates, and last for four hours with potential cache refreshes every four clock hours (at 9, 13, 17, 21 and so on). In other words, the OWASP plugin will check for updates whenever four hours have passed, and will be able to persist those updates to CircleCI cache in maximum four hours - a compromise between time spent saving cache and time spent checking for updates.

Use the orb parameter cve_data_directory to configure non-standard data directory. Note that for Gradle builds this is necessary for plugin version <= 5.1.0.

Configuration examples (using default directories):

dependencyCheck {
    data {
        // must correspond with CircleCI-configuration
        directory = System.properties['user.home'] + "/.gradle/dependency-check-data" 
    }
}

for cve_data_directory parameter value ~/.gradle/dependency-check-data.

<configuration>
    <!-- must correspond with CircleCI-configuration -->
    <dataDirectory>${user.home}/.m2/repository/org/owasp/dependency-check-data</dataDirectory>
</configuration>

for cve_data_directory parameter value ~/.m2/repository/org/owasp/dependency-check-data.

See the orb source or CircleCI orb registry for further details.