dependency-check / dependency-check/DependencyCheck

No Username and Password settings for the custom retireJsUrl triggers a 401 Error

Open
#4,477 2 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Java
Stars
7.7k
Forks
1.4k
Avg merge
9d 22h
Merged PRs (30d)
13

Description

**Describe the bug**

No username / password settings for the custom retireJsUrl triggers a 401 Error.

**Version of dependency-check used**
The problem occurs using version 7.0.4.1 of the gradle plugin

**Log file**

Error retrieving https://repository.XXX.com/repository/retirejs/jsrepository.json; received response code 401; Unauthorized
Failed to initialize the RetireJS repo
org.owasp.dependencycheck.data.update.exception.UpdateException: Failed to initialize the RetireJS repo
at org.owasp.dependencycheck.data.update.RetireJSDataSource.initializeRetireJsRepo(RetireJSDataSource.java:140)
at org.owasp.dependencycheck.data.update.RetireJSDataSource.update(RetireJSDataSource.java:89)

**To Reproduce**
Steps to reproduce the behavior:

Set the retireJsUrl to an internal URL protected by username/pw
Since in RetireJSDataSource.Java ->initializeRetireJsRepo Method -> downloader.fetchFile(repoUrl, repoFile) is called without a SETTINGS username of password, the connection fails

**Expected behavior**
A SETTINGS Username & Password like for the CVE is provided for the RetireJS

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.