dependency-check / dependency-check/DependencyCheck
SonaType Nexus' Node Audit API incompatible (Not in GZIP format)?
Open
enhancement
- Dominant language
- Java
- Stars
- 7.7k
- Forks
- 1.4k
- Avg merge
- 9d 22h
- Merged PRs (30d)
- 13
Description
We use Nexus to mirror npmjs.org and `node audit` works with this setup.
Running OWASP Dependency Check 12.1.1 with Nexus Pro 3.77 fails with `Invalid payload submitted to Node Audit API`. Properties: `analyzer.node.audit.url=https://nexus.domain/repository/npm-mirror/-/npm/v1/security/audits`.
nexus.log: `java.util.zip.ZipException: Not in GZIP format`.
I took the payload JSON from DependencyCheck trace logs, gzip'd it, and pushed it to Nexus' audit API using `curl`. This yielded a proper looking response with vulnerability data. Is our Nexus setup at fault, or should DependencyCheck's nodejs analyzer be using compression?
Contributor guide
Assessment
This issue has not been assessed yet.