CVE Download Updates #3722
CVE Download Updates #3722
Conversation
jeremylong
commented
Oct 11, 2021
jeremylong
commented
- Make the CVE start year configurable.
- Add NVD CVE cache so if some downloads work but the update ultimate fails - re-running the update will use the cached data.
- Add 3 attempts to download JSON files from the NVD with a wait between each attempt.
boring-cyborg
bot
added
ant
|
This change plus the wait timeout should resolve #3710. |
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
| @@ -1267,6 +1273,7 @@ private ExceptionCollection collectDependencyManagementDependencies(Engine engin | |||
| * @return a collection of exceptions that may have occurred while resolving | |||
| * and scanning the dependencies | |||
| */ | |||
| //CSOFF: OperatorWrap | |||
| private ExceptionCollection collectMavenDependencies(Engine engine, MavenProject project, | |||
There was a problem hiding this comment.
Reporter: Checkstyle
Rule: com.puppycrawl.tools.checkstyle.checks.sizes.MethodLengthCheck
Severity: ERROR
File: maven/src/main/java/org/owasp/dependencycheck/maven/BaseDependencyCheckMojo.java L1277
Method length is 171 lines (max allowed is 160).
| } | ||
| final File nvdFile = new File(cache, filename); | ||
| FileUtils.copyFile(file, nvdFile); | ||
| nvdFile.setLastModified(Instant.now().toEpochMilli()); |
There was a problem hiding this comment.
Reporter: Spotbugs
Rule: RV_RETURN_VALUE_IGNORED_BAD_PRACTICE
Severity: INFO
File: core/src/main/java/org/owasp/dependencycheck/data/update/nvd/NvdCache.java L103
Source: org.owasp.dependencycheck.data.update.nvd.NvdCache
Method ignores exceptional return value <p> This method returns a value that is not checked. The return value should be checked since it can indicate an unusual or unexpected function execution. For example, the <code>File.delete()</code> method returns false if the file could not be successfully deleted (rather than throwing an Exception). If you don't check the result, you won't notice if the method invocation signals unexpected behavior by returning an atypical return value. </p>
