dependency-check / dependency-check/DependencyCheck
No Username and Password settings for the custom retireJsUrl triggers a 401 Error
- Dominant language
- Java
- Stars
- 7.7k
- Forks
- 1.4k
- Avg merge
- 9d 22h
- Merged PRs (30d)
- 13
Description
**Describe the bug**
No username / password settings for the custom retireJsUrl triggers a 401 Error.
**Version of dependency-check used**
The problem occurs using version 7.0.4.1 of the gradle plugin
**Log file**
Error retrieving https://repository.XXX.com/repository/retirejs/jsrepository.json; received response code 401; Unauthorized
Failed to initialize the RetireJS repo
org.owasp.dependencycheck.data.update.exception.UpdateException: Failed to initialize the RetireJS repo
at org.owasp.dependencycheck.data.update.RetireJSDataSource.initializeRetireJsRepo(RetireJSDataSource.java:140)
at org.owasp.dependencycheck.data.update.RetireJSDataSource.update(RetireJSDataSource.java:89)
**To Reproduce**
Steps to reproduce the behavior:
Set the retireJsUrl to an internal URL protected by username/pw
Since in RetireJSDataSource.Java ->initializeRetireJsRepo Method -> downloader.fetchFile(repoUrl, repoFile) is called without a SETTINGS username of password, the connection fails
**Expected behavior**
A SETTINGS Username & Password like for the CVE is provided for the RetireJS
Contributor guide
Assessment
This issue has not been assessed yet.