dependency-check / dependency-check/DependencyCheck

Respect `<skipProvidedScope>` for `<scanPlugins>`

Open
#5,825 1 comment 1 reaction 0 assignees View on GitHub
enhancement
Dominant language
Java
Stars
7.7k
Forks
1.4k
Avg merge
9d 22h
Merged PRs (30d)
13

Description

**Is your feature request related to a problem? Please describe.**
#5001 added support for scanning Maven plugins. However, as pointed out in https://github.com/jeremylong/DependencyCheck/issues/4035#issuecomment-1383807598 Dependency Check currently considers all dependencies of plugins, including `provided` ones which are actually provided by the Maven installation and are therefore mostly irrelevant for checking vulnerabilities.

This renders the `` feature a bit useless because plugins often try to support old Maven versions (and therefore potentially vulnerable old `provided` dependencies) which leads to false positives.

**Describe the solution you'd like**
Either:
- `` should respect the existing `` option (and possibly other options as well?)
- or there should be a new dedicated option to exclude `provided` dependencies of plugins
- or Dependency Check should ignore `provided` dependencies of plugins by default

**Describe alternatives you've considered**
_See bullet points above_

**Additional context**
Even though as mentioned in https://github.com/jeremylong/DependencyCheck/issues/4035#issuecomment-1383878642 the Maven Dependency Plugin currently behaves the same way (which might also be a bug there), Dependency Check does not necessarily have to stick to that behavior (unless there are of course technical limitations) because the use case for Dependency Check is quite different.

**Reproduction steps**
1. Create a `pom.xml` with the following content
```xml

4.0.0

com.mycompany.app
my-app
1.0.0-SNAPSHOT
pom




org.owasp
dependency-check-maven
8.3.1



check


false
true
true







```
2. Run `mvn verify`
:x: Issue: It shows a lot of vulnerabilities, including for example multiple for `maven-core-3.1.0.jar`, even though that is a [`provided` dependency](https://github.com/jeremylong/DependencyCheck/blob/6d1d84b4fd423754dde772914b3a55557a116623/maven/pom.xml#L121-L123)

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.