Describe the bug
Our CICD can't access the internet directly. Therefore we use an intermediate Artifactory which can do so. We use this Artifactory with the following properties:
- central.content.url
- analyzer.central.url
However, since version 11.0.0 our current setup became unusable, because it doenst support UserInfo in the URI anymore. Our Artifactory requires authentication, so the URI we set for the 'central.content.url' and 'analyzer.central.url' looks like this:
https://:<ENCRYPTED_PASSWORD>@<HOST_NAME>/artifactory/repo1/
This worked fine in previous versions before 11.0.0, and we dont see any other option to set authentication for these two url properties with the use of other properties.
Version of dependency-check used
11.0.0 via the owasp/dependency-check-action:latest Docker image
Log file
[INFO] Analysis Started
[INFO] Finished Archive Analyzer (4 seconds)
[INFO] Finished File Name Analyzer (0 seconds)
[INFO] Finished Jar Analyzer (1 seconds)
[ERROR] Could not connect to Central search. Analysis failed.
java.io.IOException: Finally failed connecting to Central search. Giving up after 7 tries.
at org.owasp.dependencycheck.analyzer.CentralAnalyzer.fetchMavenArtifacts(CentralAnalyzer.java:362)
at org.owasp.dependencycheck.analyzer.CentralAnalyzer.analyzeDependency(CentralAnalyzer.java:228)
at org.owasp.dependencycheck.analyzer.AbstractAnalyzer.analyze(AbstractAnalyzer.java:131)
at org.owasp.dependencycheck.AnalysisTask.call(AnalysisTask.java:88)
at org.owasp.dependencycheck.AnalysisTask.call(AnalysisTask.java:37)
at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:317)
at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1144)
at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:642)
at java.base/java.lang.Thread.run(Thread.java:1583)
Caused by: org.apache.hc.client5.http.ClientProtocolException: Request URI authority contains deprecated userinfo component
at org.apache.hc.client5.http.impl.classic.InternalHttpClient.doExecute(InternalHttpClient.java:177)
at org.apache.hc.client5.http.impl.classic.CloseableHttpClient.execute(CloseableHttpClient.java:245)
at org.apache.hc.client5.http.impl.classic.CloseableHttpClient.execute(CloseableHttpClient.java:188)
at org.apache.hc.client5.http.impl.classic.CloseableHttpClient.execute(CloseableHttpClient.java:162)
at org.owasp.dependencycheck.utils.Downloader.fetchAndHandle(Downloader.java:568)
at org.owasp.dependencycheck.data.central.CentralSearch.searchSha1(CentralSearch.java:179)
at org.owasp.dependencycheck.analyzer.CentralAnalyzer.fetchMavenArtifacts(CentralAnalyzer.java:339)
... 8 common frames omitted
Caused by: org.apache.hc.core5.http.ProtocolException: Request URI authority contains deprecated userinfo component
at org.apache.hc.client5.http.impl.classic.ProtocolExec.execute(ProtocolExec.java:145)
at org.apache.hc.client5.http.impl.classic.ExecChainElement.execute(ExecChainElement.java:51)
at org.apache.hc.client5.http.impl.classic.ContentCompressionExec.execute(ContentCompressionExec.java:150)
at org.apache.hc.client5.http.impl.classic.ExecChainElement.execute(ExecChainElement.java:51)
at org.apache.hc.client5.http.impl.classic.HttpRequestRetryExec.execute(HttpRequestRetryExec.java:113)
at org.apache.hc.client5.http.impl.classic.ExecChainElement.execute(ExecChainElement.java:51)
at org.apache.hc.client5.http.impl.classic.RedirectExec.execute(RedirectExec.java:110)
at org.apache.hc.client5.http.impl.classic.ExecChainElement.execute(ExecChainElement.java:51)
at org.apache.hc.client5.http.impl.classic.InternalHttpClient.doExecute(InternalHttpClient.java:174)
... 14 common frames omitted
[WARN] An error occurred while analyzing '/builds/PST/webservices/sequencenumber-webservice/input/findsecbugs-plugin-1.13.0.jar' (Central Analyzer).
To Reproduce
Steps to reproduce the behavior:
- Make use of the owasp/dependency-check-action:latest Docker
- Set the scan to use custom properties file
- Add both a custom 'central.content.url' and 'analyzer.central.url' with use of the UserInfo component in the url.
- Run the scan
Expected behavior
The scan can connect to the Artifactory as it could before version 11.0.0
Describe the bug
Our CICD can't access the internet directly. Therefore we use an intermediate Artifactory which can do so. We use this Artifactory with the following properties:
However, since version 11.0.0 our current setup became unusable, because it doenst support UserInfo in the URI anymore. Our Artifactory requires authentication, so the URI we set for the 'central.content.url' and 'analyzer.central.url' looks like this:
https://:<ENCRYPTED_PASSWORD>@<HOST_NAME>/artifactory/repo1/
This worked fine in previous versions before 11.0.0, and we dont see any other option to set authentication for these two url properties with the use of other properties.
Version of dependency-check used
11.0.0 via the owasp/dependency-check-action:latest Docker image
Log file
[INFO] Analysis Started
[INFO] Finished Archive Analyzer (4 seconds)
[INFO] Finished File Name Analyzer (0 seconds)
[INFO] Finished Jar Analyzer (1 seconds)
[ERROR] Could not connect to Central search. Analysis failed.
java.io.IOException: Finally failed connecting to Central search. Giving up after 7 tries.
at org.owasp.dependencycheck.analyzer.CentralAnalyzer.fetchMavenArtifacts(CentralAnalyzer.java:362)
at org.owasp.dependencycheck.analyzer.CentralAnalyzer.analyzeDependency(CentralAnalyzer.java:228)
at org.owasp.dependencycheck.analyzer.AbstractAnalyzer.analyze(AbstractAnalyzer.java:131)
at org.owasp.dependencycheck.AnalysisTask.call(AnalysisTask.java:88)
at org.owasp.dependencycheck.AnalysisTask.call(AnalysisTask.java:37)
at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:317)
at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1144)
at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:642)
at java.base/java.lang.Thread.run(Thread.java:1583)
Caused by: org.apache.hc.client5.http.ClientProtocolException: Request URI authority contains deprecated userinfo component
at org.apache.hc.client5.http.impl.classic.InternalHttpClient.doExecute(InternalHttpClient.java:177)
at org.apache.hc.client5.http.impl.classic.CloseableHttpClient.execute(CloseableHttpClient.java:245)
at org.apache.hc.client5.http.impl.classic.CloseableHttpClient.execute(CloseableHttpClient.java:188)
at org.apache.hc.client5.http.impl.classic.CloseableHttpClient.execute(CloseableHttpClient.java:162)
at org.owasp.dependencycheck.utils.Downloader.fetchAndHandle(Downloader.java:568)
at org.owasp.dependencycheck.data.central.CentralSearch.searchSha1(CentralSearch.java:179)
at org.owasp.dependencycheck.analyzer.CentralAnalyzer.fetchMavenArtifacts(CentralAnalyzer.java:339)
... 8 common frames omitted
Caused by: org.apache.hc.core5.http.ProtocolException: Request URI authority contains deprecated userinfo component
at org.apache.hc.client5.http.impl.classic.ProtocolExec.execute(ProtocolExec.java:145)
at org.apache.hc.client5.http.impl.classic.ExecChainElement.execute(ExecChainElement.java:51)
at org.apache.hc.client5.http.impl.classic.ContentCompressionExec.execute(ContentCompressionExec.java:150)
at org.apache.hc.client5.http.impl.classic.ExecChainElement.execute(ExecChainElement.java:51)
at org.apache.hc.client5.http.impl.classic.HttpRequestRetryExec.execute(HttpRequestRetryExec.java:113)
at org.apache.hc.client5.http.impl.classic.ExecChainElement.execute(ExecChainElement.java:51)
at org.apache.hc.client5.http.impl.classic.RedirectExec.execute(RedirectExec.java:110)
at org.apache.hc.client5.http.impl.classic.ExecChainElement.execute(ExecChainElement.java:51)
at org.apache.hc.client5.http.impl.classic.InternalHttpClient.doExecute(InternalHttpClient.java:174)
... 14 common frames omitted
[WARN] An error occurred while analyzing '/builds/PST/webservices/sequencenumber-webservice/input/findsecbugs-plugin-1.13.0.jar' (Central Analyzer).
To Reproduce
Steps to reproduce the behavior:
Expected behavior
The scan can connect to the Artifactory as it could before version 11.0.0