dependency-check / dependency-check/DependencyCheck

https.proxyUser / Password not supported

Open
#6,478 2 comments 0 reactions 0 assignees View on GitHub
bug maven
Dominant language
Java
Stars
7.7k
Forks
1.4k
Avg merge
9d 22h
Merged PRs (30d)
13

Description

**Describe the bug**
To connect via a proxy using authentication, you [should do](https://jeremylong.github.io/DependencyCheck/data/proxy.html):

> JAVA_OPTS="-Dhttp**s**.proxyHost=yourhost -Dhttp**s**.proxyPort=yourport -Dhttp**s**.proxyUser=youruser -Dhttp**s**.proxyPassword=yourpassword"

However, in [BaseDependencyCheckMojo.java](https://github.com/jeremylong/DependencyCheck/blob/main/maven/src/main/java/org/owasp/dependencycheck/maven/BaseDependencyCheckMojo.java) line 2218 and on, only the http.proxyXXX variables are read, not the http**s**.proxyXXX

This will eventually lead to URLConnectionFactory:112 do a url.openConnection() without a proxy, and this non-OWASP java class eventually uses [https.proxyHost and https.proxyPort](https://docs.oracle.com/en%2Fjava%2Fjavase%2F11%2Fdocs%2Fapi%2F%2F/java.base/java/net/doc-files/net-properties.html), but not the proxyUser/proxyPassword settings, and this causes a 407 authentication error on the proxy server (and you spend hours on debugging).

A workaround is to use

> JAVA_OPTS="-Dhttp.proxyHost=yourhost -Dhttp.proxyPort=yourport -Dhttp.proxyUser=youruser -Dhttp.proxyPassword=yourpassword -Djdk.http.auth.tunneling.disabledSchemes="

(thus without the 's', contrary to the documentation, and added -Djdk.http.auth.tunneling.disabledSchemes= ).

**Version of dependency-check used**
The problem occurs using version 9.0.9 of the maven plugin

**Log file**
UpdateException: Failed to initialize the RetireJS repo
caused by DownloadFailedException: Download failed, unable to copy 'https://raw.githubusercontent.com/Retirejs/retire.js/master/repository/jsrepository.json' to '..../.m2/repository/org/owasp/dependency-check-utils/9.0.9/../../dependency-check-data/9.0/jsrepository.json'; Error downloading file https://raw.githubusercontent.com/Retirejs/retire.js/master/repository/jsrepository.json; unable to connect.
caused by DownloadFailedException: Error downloading file https://raw.githubusercontent.com/Retirejs/retire.js/master/repository/jsrepository.json; unable to connect.
caused by IOException: Unable to tunnel through proxy. Proxy returns "HTTP/1.1 407 Proxy Authentication Required"

**To Reproduce**
Steps to reproduce the behavior:
```
export JAVA_OPTS="-Dhttps.proxyHost=yourhost -Dhttps.proxyPort=yourport -Dhttps.proxyUser=youruser -Dhttps.proxyPassword=yourpassword"
mvn org.owasp:dependency-check-maven:check

```

**Expected behavior**
no 407 errors on the proxy server, AND/OR documentation fixed. But since the urls fetched are https protocol, it makes more sense to support http**s**.proxyXXX variables.

**Additional context**
I think the best solution would be to add to BaseDependencyCheckMojo.java:2218:
```
+ } else if (System.getProperty("https.proxyHost") != null) {
+ settings.setString(Settings.KEYS.PROXY_SERVER, System.getProperty("https.proxyHost", ""));
+ etc etc with https.
} else if (System.getProperty("http.proxyHost") != null) {
//else use standard Java system properties
settings.setString(Settings.KEYS.PROXY_SERVER, System.getProperty("http.proxyHost", ""));
etc etc with http
```

i.e. first check for https settings, then for http.
However, theoretically, people could override URL's to be http, and could need different proxy servers and credentials for http vs https, and then it would still fail. But I think this theoretical case doesn't occur in practice.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.