Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Issues and hotspots doesn't include dependency-check vulnerabilities #952

Open
arturkasperek opened this issue Jun 4, 2024 · 5 comments
Labels

Comments

@arturkasperek
Copy link

Describe the bug
I'm using the following settings when running the scanner:

        -Dsonar.dependencyCheck.securityHotspot=true \
        -Dsonar.dependencyCheck.jsonReportPath=owasp-reports/dependency-check-report.json \
        -Dsonar.dependencyCheck.htmlReportPath=owasp-reports/dependency-check-report.html \
        -Dsonar.dependencyCheck.xmlReportPath=owasp-reports/dependency-check-report.xml \

I don't see any errors on SQ server or gitlabCI job dependency check logs. After all, I can see an extra item to access the report:
Zrzut ekranu 2024-06-4 o 14 42 37

It has vulnerabilities and right now don't sure why they are not included either on Issues or Security hotspots
In previous versions I saw that dependency check sonar plugin was also reporting on Issues - don't sure why it doesn't work

Versions (please complete the following information):

  • dependency-check: v9.2.0
  • sonarqube: 10.4.1.88267
  • dependency-check-sonar-plugin: 5.0.0
@Reamer
Copy link
Member

Reamer commented Jun 4, 2024

xmlReportPath is deprecated and removed.
Security Hotspot Feature is deprecated as well.

@arturkasperek
Copy link
Author

@Reamer hm - can I somehow integrate deps scan audit with sq native issues?

@Erry91
Copy link

Erry91 commented Jun 14, 2024

I am also interested in how to make vulnerabilities detections reported in the dependency-check scan appear in either "Issues" or "Security Hotspots"

@Reamer
Copy link
Member

Reamer commented Jun 14, 2024

@Reamer hm - can I somehow integrate deps scan audit with sq native issues?

Try deactivating the security hotspot feature.

@mutzbraten
Copy link

mutzbraten commented Jul 11, 2024

xmlReportPath is deprecated and removed. Security Hotspot Feature is deprecated as well.

Where do I find documentation about the deprecation of security hotspot feature?
Is there any alternative suggested?
Does this mean, the bug will not be fixed?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

4 participants