dependency-check / dependency-check/DependencyCheck

Improved database upgrade experience

Open
#3,436 0 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Java
Stars
7.7k
Forks
1.4k
Avg merge
9d 22h
Merged PRs (30d)
13

Description

Currently if you hit an issue updating the schema, you'll get a non-specific error like this:

```
[ERROR] One or more fatal errors occurred
[ERROR] Unable to connect to the dependency-check database
```

If you rerun it with e.g. `dependency-check -log /dev/stdout -s .` part of the output will include more details:

```
org.owasp.dependencycheck.data.nvdcve.DatabaseException: unable to upgrade the database schema - please run the dependency-check purge command to remove the existing database
at org.owasp.dependencycheck.data.nvdcve.DatabaseManager.updateSchema(DatabaseManager.java:422)
at org.owasp.dependencycheck.data.nvdcve.DatabaseManager.ensureSchemaVersion(DatabaseManager.java:491)
at org.owasp.dependencycheck.data.nvdcve.DatabaseManager.initialize(DatabaseManager.java:214)
at org.owasp.dependencycheck.data.nvdcve.DatabaseManager.(DatabaseManager.java:123)
at org.owasp.dependencycheck.data.nvdcve.CveDB.(CveDB.java:238)
at org.owasp.dependencycheck.Engine.openDatabase(Engine.java:987)
at org.owasp.dependencycheck.Engine.doUpdates(Engine.java:863)
at org.owasp.dependencycheck.Engine.initializeAndUpdateDatabase(Engine.java:680)
at org.owasp.dependencycheck.Engine.analyzeDependencies(Engine.java:606)
at org.owasp.dependencycheck.App.runScan(App.java:254)
at org.owasp.dependencycheck.App.run(App.java:186)
at org.owasp.dependencycheck.App.main(App.java:81)
2021-06-10 14:13:34,650 org.owasp.dependencycheck.utils.WriteLock:240
DEBUG - Lock released (main) 35a3b24da5b9b9b1a6369aa1eddc029a @ 2021-06-10 14:13:34.65
[ERROR] One or more fatal errors occurred
```

That would give the impression that you could run "dependency-check purge" to purge the database but that will give an error. The `--help` output has nothing about purging but if you look at the README there is mention of the otherwise undocumented "--purge" option.

There are a couple of improvements which could make this smoother:

1. Include the error message in the standard output level — `DatabaseException` should always be exceptional so it seems like there'd be no downside to always emitting an ERROR-level message for those.
2. Add `--purge` to the CLI help
3. Simply attempt to purge the database automatically when this happens — it doesn't seem like any database instance should ever have irreplaceable information and anyone who encounters this is going to need to delete the database at some point.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.