Merge pull request #4753 from yarisvt/main

Added local node_module check for NodePackageAnalyzer
jeremylong · Aug 19, 2022 · 1e25e18 · 1e25e18
2 parents b4b432a + a00db29
commit 1e25e18
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/core/src/main/java/org/owasp/dependencycheck/analyzer/NodePackageAnalyzer.java b/core/src/main/java/org/owasp/dependencycheck/analyzer/NodePackageAnalyzer.java
@@ -297,10 +297,10 @@ public static boolean shouldSkipDependency(String name, String version, boolean
 
         // this seems to produce crash sometimes, I need to tests
         // using a local node_module is not supported by npm audit, it crash
-        if (Objects.nonNull(version) && version.startsWith("file:")) {
+        if (Objects.nonNull(version) && (version.startsWith("file:") || version.matches("^[.~]{0,2}/.*"))) {
             LOGGER.warn("dependency skipped: package.json contain an local node_module for {} seems to be "
                     + "located {} npm audit doesn't support locally referenced modules",
-                    name, version.replace("file:", ""));
+                    name, version);
             return true;
         }
         return false;