From c8dd0e49a2c4a832818e0ceb7deb1436eae92077 Mon Sep 17 00:00:00 2001
From: Jose Raul Barreras <barreras@unl.edu>
Date: Fri, 31 May 2019 16:56:10 -0500
Subject: [PATCH] add OWASP dependency-check
---
.gitlab-ci.yml | 1 +
Makefile | 7 ++++++-
README.md | 3 ++-
dependency-check/Dockerfile | 36 ++++++++++++++++++++++++++++++++++
dependency-check/entrypoint.sh | 17 ++++++++++++++++
examples/dependency-check.md | 35 +++++++++++++++++++++++++++++++++
6 files changed, 97 insertions(+), 2 deletions(-)
create mode 100644 dependency-check/Dockerfile
create mode 100644 dependency-check/entrypoint.sh
create mode 100644 examples/dependency-check.md
diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index b0829d5..095d53a 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -34,6 +34,7 @@ test:
script:
- docker run --rm its-registry.unl.edu/unl-its/docker-ci/static-code-analysis sonar-scanner -v
- docker run --rm -v "${PWD}:/work" -w /work its-registry.unl.edu/unl-its/docker-ci/detect-secrets -s
+ - docker run --rm -v "${PWD}:/work" -w /work its-registry.unl.edu/unl-its/docker-ci/dependency-check -v
Push to Container Registry:
after_script:
diff --git a/Makefile b/Makefile
index e73972a..5667b3f 100644
--- a/Makefile
+++ b/Makefile
@@ -20,7 +20,7 @@ BUILD_ARGS := --build-arg VCS_REF=$(GIT_COMMIT)
.PHONY: all clean test $(DOCKERFILES) static-code-analysis mobile delete_dangling_images security publish
-all: php-lint php-unit-test magento2 mobile static-code-analysis detect-secrets
+all: php-lint php-unit-test magento2 mobile static-code-analysis detect-secrets dependency-check
# Image Groups
####################
@@ -104,6 +104,11 @@ detect-secrets: detect-secrets/Dockerfile
docker build $(BUILD_ARGS) -t ${REPO_ORG}/detect-secrets detect-secrets/
+# dependency-check
+# ################
+dependency-check: dependency-check/Dockerfile
+ docker build $(BUILD_ARGS) -t ${REPO_ORG}/dependency-check dependency-check/
+
#IMAGES_TO_SCAN = $(shell docker images --format '{{.Repository}}:{{.Tag}}' | grep unl-its )
#security:
# @docker login -u ${TENABLE_IO_ACCESS_KEY} -p ${TENABLE_IO_SECRET_KEY} registry.cloud.tenable.com
diff --git a/README.md b/README.md
index 0b470a5..79f1f50 100644
--- a/README.md
+++ b/README.md
@@ -11,6 +11,7 @@ This file is automatically updated after execute `git commit` based on the conte
### Available tools
+ - its-registry.unl.edu/unl-its/docker-ci/dependency-check:latest
- its-registry.unl.edu/unl-its/docker-ci/detect-secrets:latest
- its-registry.unl.edu/unl-its/docker-ci/magento2-unit-test:latest
- its-registry.unl.edu/unl-its/docker-ci/magento2-xml-lint:latest
@@ -27,4 +28,4 @@ This file is automatically updated after execute `git commit` based on the conte
- its-registry.unl.edu/unl-its/docker-ci/static-code-analysis:python
-
_Last update: Fri May 31 12:11:19 CDT 2019_
+
_Last update: Fri May 31 16:56:10 CDT 2019_
diff --git a/dependency-check/Dockerfile b/dependency-check/Dockerfile
new file mode 100644
index 0000000..93f3a7f
--- /dev/null
+++ b/dependency-check/Dockerfile
@@ -0,0 +1,36 @@
+FROM adoptopenjdk/openjdk8:alpine
+
+ARG BUILD_DATE
+ARG VCS_REF
+ARG VERSION
+LABEL org.label-schema.build-date=$BUILD_DATE \
+ org.label-schema.name="OWASP Dependency Check" \
+ org.label-schema.description="Docker image for dependency checking" \
+ org.label-schema.vcs-ref=$VCS_REF \
+ org.label-schema.vendor="University of Nebraska - Lincoln" \
+ org.label-schema.version="0.1.0" \
+ org.label-schema.schema-version="1.0" \
+ maintainer="J.R. Barreras <rbarrerasmilanes@nebraska.edu>"
+
+#ENV DEPENDENCY_CHECK_VERSION 4.0.2-release
+ENV DEPENDENCY_CHECK_VERSION 5.0.0-M3-release
+
+
+WORKDIR /opt
+
+RUN apk add --no-cache curl jq su-exec && \
+ curl --insecure -o ./dependency-check.zip -L https://dl.bintray.com/jeremy-long/owasp/dependency-check-${DEPENDENCY_CHECK_VERSION}.zip && \
+ unzip dependency-check.zip && \
+ rm dependency-check.zip && \
+ /opt/dependency-check/bin/dependency-check.sh --updateonly
+
+
+ENV PATH $PATH:/opt/dependency-check/bin
+
+WORKDIR /work
+
+COPY entrypoint.sh /usr/local/bin/
+RUN chmod +x /usr/local/bin/entrypoint.sh
+ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]
+
+CMD ["/usr/local/bin/entrypoint.sh"]
diff --git a/dependency-check/entrypoint.sh b/dependency-check/entrypoint.sh
new file mode 100644
index 0000000..becbcac
--- /dev/null
+++ b/dependency-check/entrypoint.sh
@@ -0,0 +1,17 @@
+#!/bin/sh
+set -e
+
+if [ $1 == '-v' ]; then
+ dependency-check.sh -v
+ exit 0
+fi
+
+dependency-check.sh -n --project ${CI_PROJECT_NAMESPACE} -s ./ -f JSON
+cat dependency-check-report.json | jq '.dependencies | .[] | select (.vulnerabilities) | [.fileName, .filePath, .vulnerabilities]' | sed -e "s/\"\/work\///g"
+RESULT=`cat dependency-check-report.json | jq '.dependencies | .[] | select (.vulnerabilities) | [.fileName, .filePath, .vulnerabilities] | length == 0' | sed -e "s/\"\/work\///g"`
+
+if [ "${RESULT}" = "" ]; then
+ exit 0
+else
+ exit 1
+fi
diff --git a/examples/dependency-check.md b/examples/dependency-check.md
new file mode 100644
index 0000000..f2160c1
--- /dev/null
+++ b/examples/dependency-check.md
@@ -0,0 +1,35 @@
+# Dependecy check example
+
+## Parameters
+
+| Argument | Description |
+| :------- | :--------------------------- |
+| -v | Prints Dependency Check version and exit |
+| without parameters | Scans the current directory (must be a git repo) |
+
+
+## Detect outdated dependencies in the current project using [OWASP DependencyCheck](https://www.owasp.org/index.php/OWASP_Dependency_Check)
+
+- One 'analysis' stage with one job
+- Allows the job to fail without impacting the rest of the CI (allow_failure: true)
+
+
+``` yml
+stages:
+ - analysis
+variables:
+ stage: analysis
+ tags:
+ - docker
+ script:
+ - docker run --rm -v "${PWD}:/work" -w /work its-registry.unl.edu/unl-its/docker-ci/detect-secrets -s -e 4.5
+ - docker run --rm -v "${PWD}:/work" -w /work its-registry.unl.edu/unl-its/docker-ci/dependency-check
+ allow_failure: true
+```
+
+## Scan the current directory (must be a git repo)
+
+``` bash
+docker run -it --rm -v "${PWD}:/work" -w /work -e CI_PROJECT_NAMESPACE=`basename $(git rev-parse --show-toplevel)` its-registry.unl.edu/unl-its/docker-ci/dependency-check
+
+```
--
GitLab