How to check your Java dependencies for OWASP vulnerabilities and security issues

The OWASP dependency-check provides monitoring of the libraries you use in your Java project to identify the use of known vulnerable components.

It produces an individual analysis report for the issue of “Using Components with Known Vulnerabilities” which is listed in the OWASP Top Ten 2017.

Gradle plugin

The gradle plugin can create a report of known vulnerable components that are included in the build of your project. You include it in your build.gradle:

buildscript {
  repositories {
    mavenCentral()
  }
  dependencies {
    classpath 'org.owasp:dependency-check-gradle:3.1.2'
  }
}
apply plugin: 'org.owasp.dependencycheck'

Afterwards you should integrate the check into your build system by using the command:

./gradlew dependencyCheckAnalyze

Integration with Gitlab CI

If you are using Gitlab CI and you do not want to execute the check on every CI build, because your dependencies do not change that often and the check itself can take a few minutes depending on the libraries you are using, you can schedule a pipeline in your project and restrict the task’s execution to that scheduled (nightly) build. Here is an excerpt for your .gitlab-ci.yml file that you place in your project root folder:

stages:
  - dependencyCheck
  # etc.

dependencyCheck:
  stage: dependencyCheck
  only:
  - schedules
  script:
  - ./gradlew dependencyCheckAnalyze
  artifacts:
  name: "${CI_JOB_ID}_${CI_JOB_NAME}"
  when: always
  expire_in: 30 day
  paths:
    - build/reports/dependency-check-report.html

When executed, the plugin will create the dependency check HTML report and Gitlab will archive it for 30 days.

Configurations

You can configure the gradle plugin by applying a closure in your build.gradle like the one below that will fail the build when a CVSS score equal to or above a level 5 is identified:

dependencyCheck {
  failBuildOnCVSS = 5
  failOnError = true
  suppressionFile = 'config/dependencyCheck/suppressions.xml'
  analyzers {
  experimentalEnabled = true
  archiveEnabled = true
  jarEnabled = true
  centralEnabled = true
  nexusEnabled = true
  pyDistributionEnabled = false
  pyPackageEnabled = false
  rubygemsEnabled = false
  opensslEnabled = false
  nuspecEnabled = false
  assemblyEnabled = false
  cmakeEnabled = false
  autoconfEnabled = true
  composerEnabled = false
  nodeEnabled = true
  nspEnabled = false
  cocoapodsEnabled = false
  swiftEnabled = false
  }
}

Personally, I like to put configurations like this one in separate files (e.g. in gradle/plugins) and apply their contents to the build.gradle like this:

apply from: "gradle/plugins/dependency-check.gradle"

Suppressions

In the configuration example above I defined my path to a suppression file relative to the build.gradle:

dependencyCheck {
  suppressionFile = 'config/dependencyCheck/suppressions.xml'
}

In config/dependencyCheck/suppressions.xml I can define which warnings should be ignored. This way I can define False Positives or known (minor) issues I want or have to ignore until a dependency update. Example:

<xml version="1.0" encoding="UTF-8">
<suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.1.xsd">
  <suppress>
    <notes><![CDATA[
  file name: async-http-client-netty-utils-2.1.0-alpha25.jar
  ]]></notes>
    <gav regex="true">^org\.asynchttpclient:async-http-client-netty-utils:.*$</gav>
    <cve>CVE-2014-3488</cve>
  </suppress>
</suppressions>

You can also create hints for False Negatives.