dependency-check / dependency-check/DependencyCheck
Respect `<skipProvidedScope>` for `<scanPlugins>`
- Dominant language
- Java
- Stars
- 7.7k
- Forks
- 1.4k
- Avg merge
- 9d 22h
- Merged PRs (30d)
- 13
Description
**Is your feature request related to a problem? Please describe.**
#5001 added support for scanning Maven plugins. However, as pointed out in https://github.com/jeremylong/DependencyCheck/issues/4035#issuecomment-1383807598 Dependency Check currently considers all dependencies of plugins, including `provided` ones which are actually provided by the Maven installation and are therefore mostly irrelevant for checking vulnerabilities.
This renders the `` feature a bit useless because plugins often try to support old Maven versions (and therefore potentially vulnerable old `provided` dependencies) which leads to false positives.
**Describe the solution you'd like**
Either:
- `` should respect the existing `` option (and possibly other options as well?)
- or there should be a new dedicated option to exclude `provided` dependencies of plugins
- or Dependency Check should ignore `provided` dependencies of plugins by default
**Describe alternatives you've considered**
_See bullet points above_
**Additional context**
Even though as mentioned in https://github.com/jeremylong/DependencyCheck/issues/4035#issuecomment-1383878642 the Maven Dependency Plugin currently behaves the same way (which might also be a bug there), Dependency Check does not necessarily have to stick to that behavior (unless there are of course technical limitations) because the use case for Dependency Check is quite different.
**Reproduction steps**
1. Create a `pom.xml` with the following content
```xml
4.0.0
com.mycompany.app
my-app
1.0.0-SNAPSHOT
pom
org.owasp
dependency-check-maven
8.3.1
check
false
true
true
```
2. Run `mvn verify`
:x: Issue: It shows a lot of vulnerabilities, including for example multiple for `maven-core-3.1.0.jar`, even though that is a [`provided` dependency](https://github.com/jeremylong/DependencyCheck/blob/6d1d84b4fd423754dde772914b3a55557a116623/maven/pom.xml#L121-L123)
Contributor guide
Assessment
This issue has not been assessed yet.