Merge pull request #5180 from jeremylong/matzi/main

fix: Make OSS Index URL configurable via CLI
jeremylong · Dec 24, 2022 · a4d8c99 · a4d8c99
2 parents 8b8bc8d + 39ecfe8
commit a4d8c99
Show file tree

Hide file tree

Showing 3 changed files with 12 additions and 3 deletions.
diff --git a/cli/src/main/java/org/owasp/dependencycheck/App.java b/cli/src/main/java/org/owasp/dependencycheck/App.java
@@ -580,6 +580,8 @@ protected void populateSettings(CliParser cli) throws InvalidSettingException {
                 cli.hasOption(CliParser.ARGUMENT.DISABLE_NODE_AUDIT_SKIPDEV));
         settings.setBooleanIfNotNull(Settings.KEYS.ANALYZER_NEXUS_ENABLED,
                 cli.hasOption(CliParser.ARGUMENT.ENABLE_NEXUS));
+        settings.setStringIfNotEmpty(Settings.KEYS.ANALYZER_OSSINDEX_URL,
+                cli.getStringArgument(CliParser.ARGUMENT.OSSINDEX_URL));
         settings.setStringIfNotEmpty(Settings.KEYS.ANALYZER_OSSINDEX_USER,
                 cli.getStringArgument(CliParser.ARGUMENT.OSSINDEX_USERNAME));
         settings.setStringIfNotEmpty(Settings.KEYS.ANALYZER_OSSINDEX_PASSWORD,

diff --git a/cli/src/main/java/org/owasp/dependencycheck/CliParser.java b/cli/src/main/java/org/owasp/dependencycheck/CliParser.java
@@ -389,6 +389,8 @@ private void addAdvancedOptions(final Options options) {
                 .addOption(newOptionWithArg(ARGUMENT.PATH_TO_BUNDLE_AUDIT_WORKING_DIRECTORY, "path",
                         "The path to working directory that the bundle-audit command should be executed from when "
                         + "doing Gem bundle analysis."))
+                .addOption(newOptionWithArg(ARGUMENT.OSSINDEX_URL, "url",
+                        "Alternative URL for the OSS Index. If not set the public Sonatype OSS Index will be used."))
                 .addOption(newOptionWithArg(ARGUMENT.OSSINDEX_USERNAME, "username",
                         "The username to authenticate to Sonatype's OSS Index. If not set the Sonatype OSS Index "
                         + "Analyzer will use an unauthenticated connection."))
@@ -1305,6 +1307,10 @@ public static class ARGUMENT {
          * locally.
          */
         public static final String DISABLE_OSSINDEX_CACHE = "disableOssIndexCache";
+        /**
+         * The alternative URL for the Sonatype OSS Index.
+         */
+        public static final String OSSINDEX_URL = "ossIndexUrl";
         /**
          * The username for the Sonatype OSS Index.
          */

diff --git a/cli/src/site/markdown/arguments.md b/cli/src/site/markdown/arguments.md
@@ -58,8 +58,8 @@ Advanced Options
 |       | \-\-disableRubygems                   |                 | Sets whether the [experimental](../analyzers/index.html) Ruby Gemspec Analyzer will be used.                                                                                                           | &nbsp; |
 |       | \-\-disableBundleAudit                |                 | Sets whether the [experimental](../analyzers/index.html) Ruby Bundler Audit Analyzer will be used.                                                                                                     | &nbsp; |
 |       | \-\-disableCocoapodsAnalyzer          |                 | Sets whether the [experimental](../analyzers/index.html) Cocoapods Analyzer will be used.                                                                                                              | &nbsp; |
-|       | \-\-disableSwiftPackageManagerAnalyzer |                 | Sets whether the [experimental](../analyzers/index.html) Swift Package Manager Analyzer will be used.                                                                                                  | &nbsp; |
-|       | \-\-disableSwiftPackageResolvedAnalyzer|                 | Sets whether the [experimental](../analyzers/index.html) Swift Package Resolved Analyzer will be used.                                                                                                 | &nbsp; |
+|       | \-\-disableSwiftPackageManagerAnalyzer |                 | Sets whether the [experimental](../analyzers/index.html) Swift Package Manager Analyzer will be used.                                                                                                 | &nbsp; |
+|       | \-\-disableSwiftPackageResolvedAnalyzer|                 | Sets whether the [experimental](../analyzers/index.html) Swift Package Resolved Analyzer will be used.                                                                                                | &nbsp; |
 |       | \-\-disableAutoconf                   |                 | Sets whether the [experimental](../analyzers/index.html) Autoconf Analyzer will be used.                                                                                                               | &nbsp; |
 |       | \-\-disableOpenSSL                    |                 | Sets whether the OpenSSL Analyzer will be used.                                                                                                                                                        | &nbsp; |
 |       | \-\-disableCmake                      |                 | Sets whether the [experimental](../analyzers/index.html) Cmake Analyzer will be disabled.                                                                                                              | &nbsp; |
@@ -73,7 +73,8 @@ Advanced Options
 |       | \-\-disableOssIndexCache              |                 | When the argument is present the OSS Index Analyzer will not cache results. By default results are cached for 24 hours.                                                                                | &nbsp; |
 |       | \-\-ossIndexUsername                  | \<username\>    | The optional username to connect to Sonatype's OSS Index.                                                                                                                                              | &nbsp; |
 |       | \-\-ossIndexPassword                  | \<password\>    | The optional password to connect to Sonatype's OSS Index.                                                                                                                                              | &nbsp; |
-|       | \-\-ossIndexRemoteErrorWarnOnly       |                 | Whether we should only warn about Sonatype OSS Index remote errors instead of failing completely.                                                                                                                                         | &nbsp; |
+|       | \-\-ossIndexRemoteErrorWarnOnly       |                 | Whether we should only warn about Sonatype OSS Index remote errors instead of failing completely.                                                                                                      | &nbsp; |
+|       | \-\-ossIndexUrl                       | \<url\>         | Alternative URL for the OSS Index. If not set the public Sonatype OSS Index will be used.                                                                                                              | https://ossindex.sonatype.org |
 |       | \-\-disableCentral                    |                 | Sets whether the Central Analyzer will be used. **Disabling this analyzer is not recommended as it could lead to false negatives (e.g. libraries that have vulnerabilities may not be reported correctly).** If this analyzer is being disabled there is a good chance you also want to disable the Artifactory or Nexus Analyzer. | &nbsp; |
 |       | \-\-disableCentralCache               |                 | When the argument is present the Central Analyzer will not cache results locally. By default results are cached locally for 30 days.                                                                   | &nbsp; |
 |       | \-\-enableNexus                       |                 | Sets whether the Nexus Analyzer will be used (requires Nexus v2 or Pro v3). You can configure the Nexus URL to utilize an internally hosted Nexus server.                                              | &nbsp; |