Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Allow disabling poetry scans when running experimental scans #5142

Closed
jamur2 opened this issue Dec 12, 2022 · 0 comments · Fixed by #5160
Closed

Allow disabling poetry scans when running experimental scans #5142

jamur2 opened this issue Dec 12, 2022 · 0 comments · Fixed by #5160
Labels

Comments

@jamur2
Copy link

jamur2 commented Dec 12, 2022

Describe the bug
#5025 added support for scanning poetry-style Python dependencies (thanks, by the way!). However, it looks like when running with --enableExperimental, you cannot disable the poetry scan.

It looks like a --disablePoetry flag was intended to be introduced in https://github.com/nerdinand/DependencyCheck/blob/afd165b02ad0bfa1e46845797f19c6bbeb058768/cli/src/main/java/org/owasp/dependencycheck/CliParser.java#L1249, but wasn't actually added to the addAdvancedOptions list in https://github.com/nerdinand/DependencyCheck/blob/afd165b02ad0bfa1e46845797f19c6bbeb058768/cli/src/main/java/org/owasp/dependencycheck/CliParser.java#L343. I think just adding that option there would fix the issue?

Version of dependency-check used
7.4.1

Log file

No log file is generated when invalid command line options are provided, but the output looks like:

$ dependency-check . -f HTML -s . --enableExperimental --disablePoetry 
Unrecognized option: --disablePoetry
usage: Dependency-Check Core [--advancedHelp] [--enableExperimental]
       [--exclude <pattern>] [-f <format>] [--failOnCVSS <score>] [-h]
       [--junitFailOnCVSS <score>] [-l <file>] [-n] [-o <path>]
       [--prettyPrint] [--project <name>] [-s <path>] [--suppression
       <file>] [-v]

To Reproduce
Run dependency-check with the --disablePoetry flag.

Eg.,

$ dependency-check . -f HTML -s . --enableExperimental --disablePoetry 

Expected behavior
All scans (including experimental) will be run, except for Poetry dependencies.

Additional context
None.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant