OWASP Dependency-Check step configuration

Scan code repositories with OWASP Dependency Check.

You can scan your code repositories using OWASP Dependency-Check and ingest your scan results into Harness STO.

Important notes for running OWASP scans in STO

• You can utilize custom STO scan images and pipelines to run scans as a non-root user. For more details, refer Configure your pipeline to use STO images from private registry.

• STO supports three different approaches for loading self-signed certificates. For more information, refer Run STO scans with custom SSL certificates.

OWASP step configuration

The recommended workflow is to add an OWASP step to a Security or Build stage and then configure it as described below.

Scan Mode

Scan Configuration

Target

Type

Target and variant detection

Name

Variant

Workspace

Ingestion File

Log Level

Additional CLI flags

Use this field to run the OWASP dependency-check scan with additional CLI flags, for example:

--disableYarnAudit --log /shared/scan_logs/owasp.txt Use these flags to authenticate with the Sonatype OSS Index vulnerability database. Providing authentication helps avoid rate limits and improves the reliability of vulnerability lookups.

--ossIndexUsername and --ossIndexPassword Use these flags to authenticate with the OSS Index database to retrieve vulnerability information.

--disableOssIndex Use this flag to disable the OSS Index vulnerability database and to rely only on the NVD for vulnerability information.

With these flags, the scanner skips the yarn Audit Analyzer and outputs the log to a shared folder, where it can be accessed by a later step.

Fail on Severity

Settings

Additional Configuration

Advanced settings

Configure OWASP Dependency-Check as a Built-in Scanner

The OWASP Dependency-Check is available as a built-in scanner in STO. Configuring it as a built-in scanner enables the step to automatically perform scans using the free version without requiring any licenses. Follow these steps to set it up:

1. Search for SCA in the step palette or navigate to the Built-in Scanners section and select the SCA step.

2. Select OWASP Dependency-Check from the list of scanners.

3. Expand the Additional CLI Flags section if you want to configure optional CLI flags.

4. Click Add Scanner to save the configuration.

The scanner will automatically use the free version, detect scan targets, and can be further configured by clicking on the step whenever needed.

Proxy settings

Troubleshoot Yarn Audit Analyzer exceptions

The full exception is: [DependencyCheck] [ERROR] Exception occurred initializing Yarn Audit Analyzer

The OWASP scan step does not include a Yarn package out of the box. Harness seeks to keep these images as small and as lightweight as possible, and to minimize the number of vulnerabilities in each image.

To scan a repository that uses Yarn or another package that isn't in the base image, create a custom OWASP scanner image with the packages you need. For more information, go to Create custom scanner images. This topic includes a step-by-step workflow for creating a custom image with OWASP, Yarn, and PNPM.

If you get this message when scanning a repo that doesn't use Yarn, there might be an errant yarn.lock file somewhere in the repo. To disable the OWASP Yarn Audit Analyzer, add the option --disableYarnAudit to Additional CLI flags in the OWASP scan step.