The dependency-check gradle plugin allows projects to monitor dependent libraries for known, published vulnerabilities.
Current latest version is 1.4.5.1
. This version should be feature complete with
the other OWASP dependency-check tools.
Below are the quick start instructions. Please see the documentation site for more detailed information on configuration and usage.
Install from Maven central repo
buildscript {
repositories {
mavenCentral()
}
dependencies {
classpath 'org.owasp:dependency-check-gradle:1.4.5.1'
}
}
apply plugin: 'org.owasp.dependencycheck'
Once gradle plugin applied, run following gradle task to check dependencies:
gradle dependencyCheck --info
The reports will be generated automatically under build/reports
directory.
If your project includes multiple sub-projects, the report will be generated for each sub-project in their own build/reports
.
Questions List:
- What if I'm behind a proxy?
- What if my project includes multiple sub-project? How can I use this plugin for each of them including the root project?
- How to customize the report directory?
Maybe you have to use proxy to access internet, in this case, you could configure proxy settings for this plugin (in addition you should read the proxy configuration page):
dependencyCheck {
proxy {
server = "127.0.0.1" // required, the server name or IP address of the proxy
port = 3128 // required, the port number of the proxy
// optional, the proxy server might require username
// username = "username"
// optional, the proxy server might require password
// password = "password"
}
}
In addition, if the proxy only allow HTTP GET
or POST
methods, you will find that the update process will always fail,
the root cause is that every time you run dependencyCheck
task, it will try to query the latest timestamp to determine whether need to perform an update action,
and for performance reason the HTTP method it uses by default is HEAD
, which probably is disabled or not supported by the proxy. To avoid this problem, you can simply change the HTTP method by below configuration:
dependencyCheck {
quickQueryTimestamp = false // when set to false, it means use HTTP GET method to query timestamp. (default value is true)
}
What if my project includes multiple sub-project? How can I use this plugin for each of them including the root project?
Try put 'apply plugin: "dependency-check"' inside the 'allprojects' or 'subprojects' if you'd like to check all sub-projects only, see below:
(1) For all projects including root project:
buildscript {
repositories {
mavenCentral()
}
dependencies {
classpath 'org.owasp:dependency-check-gradle:1.4.5.1'
}
}
allprojects {
apply plugin: 'org.owasp.dependencycheck'
}
(2) For all sub-projects:
buildscript {
repositories {
mavenCentral()
}
dependencies {
classpath 'org.owasp:dependency-check-gradle:1.4.5.1'
}
}
subprojects {
apply plugin: 'org.owasp.dependencycheck'
}
In this way, the dependency check will be executed for all projects (including root project) or just sub projects.
By default, all reports will be placed under build/reports
folder, to change the default reporting folder name modify the configuration section like this:
subprojects {
apply plugin: 'org.owasp.dependencycheck'
dependencyCheck {
outputDirectory = "security-report"
}
}