Description
I am using SonarQube v10.6 and version 5.0 of the plugin. Dependency check runs from this docker image and it uses the latest version. It runs on gitlab-ci.
This is the command that runs the scanner in the CI
/usr/share/dependency-check/bin/dependency-check.sh
--scan "./"
--format ALL
--project "$CI_PROJECT_NAME"
--enableExperimental
--failOnCVSS 0
--suppression /suppressions/npm_fp_suppression.xml
--suppression /suppressions/npm_na_suppressions.xml
Note the --enableExperimental flag because I am using composer as a package manager.
The scanner generates the reports successfully and I keep the artifacts; HTML and JSON. Those artifacts are then passed to SonarQube and it successfuly loads the plugin and import those files as per logs here:
DEBUG: Plugins loaded:
DEBUG: * Dependency-Check 5.0.0 (dependencycheck)
...
...
...
DEBUG: Sensors : Dependency-Check -> Zero Coverage Sensor
INFO: Sensor Dependency-Check [dependencycheck]
INFO: Dependency-Check - Start
INFO: Using JSON-Reportparser
INFO: No project configuration file, e.g. pom.xml, *.gradle, *.gradle.kts, package-lock.json found, therefore it isn't possible to correctly link dependencies with files.
INFO: Linking 101 dependencies
...
...
...
DEBUG: Saving Metrics to project DependencyCheckMetric [inputcomponent=[key=project], totalDependencies=101, vulnerableDependencies=2, vulnerabilityCount=4, highIssuesCount=1, mediumIssuesCount=0, lowIssuesCount=1]
DEBUG: Save measures on [key=project]
INFO: Upload Dependency-Check HTML-Report
INFO: Dependency-Check - End
INFO: Sensor Dependency-Check [dependencycheck] (done) | time=3903ms
As you can see the scanner didn't check composer.lock but the reported metrics contain information about those vulnerabilities. Now let me show you how it looks when it's created on SonarQube:
The security hotspot: No information about the vulnerabilities. These are all different vulnerabilities from the code
The issues: Show no vulnerability
The metrics: Show this conclusion
But when you clicn anything you just see the files tree
The HTML works as expected
And it shows vulnerabilities reported by dependency check
Now what's wrong with what I am doing? Why the dependencies are not showing on SonarQube with details about the CVE and other details?