Error passing JAVA_OPTS with spaces and quotes

[Silwing]

Describe the bug
We are using the Dependency Check Jenkins plugin.
To relax the Jenkins content security policy we have set JAVA_OPTS as described here: https://wiki.jenkins.io/display/JENKINS/Configuring+Content+Security+Policy
However when doing that running dependency-check.sh generates the following error:
Error: Could not find or load main class 'self'

** Version of dependency-check used **
The problem occurs using version 5.2.2 of the the cli.

To Reproduce
Steps to reproduce the behavior:

1. Run the following: export JAVA_OPTS=-Dhudson.model.DirectoryBrowserSupport.CSP="default-src 'self' 'unsafe-inline';"
2. Run dependency-check.sh
3. See error

Expected behavior
Expected to print usage text.

Additional context
Jenkins has had the same issue described here with attached fix as well: jenkinsci/docker#213

[jeremylong]

The script is generated by the appassembler plugin. I have opened a ticket with the appropriate team.

[vweng]

This space issue not only exists in JAVA_OPT, but also in any params passed in. e.g. --scan /var/jenkins_home/workspace/jenkins dev/test abc/. The solution is to use bash array feature to replace the exec at the bottom of dependency-check.sh to the following:

CMDS=("$JAVACMD" -classpath "$CLASSPATH" -Dapp.name="dependency-check" -Dapp.pid="$$" -Dapp.repo="$REPO" -Dapp.home="$BASEDIR" -Dbasedir="$BASEDIR" org.owasp.dependencycheck.App)

for arg; do
CMDS+=("$arg")
done
exec "${CMDS[@]}"

[jeremylong]

@vweng The problem with your solution above is that it removes the $JAVA_OPTS entirely.

[jeremylong]

@Silwing can you use:

export JENKINS_OPTS=-Dhudson.model.DirectoryBrowserSupport.CSP="default-src 'self' 'unsafe-inline';"

[vweng]

@jeremylong Sorry, here is the scripts with updated JAVA_OPTS included, note the dependency-check.sh must be updated to use #!/bin/bash:

s="${JAVA_OPTS:1} -"
CMDS=("$JAVACMD");
while [[ $s ]]; do
CMDS+=( "-${s%%" -"}" );
s=${s#" -"};
done;

CMDS+=( -classpath "$CLASSPATH" -Dapp.name="dependency-check" -Dapp.pid="$$" -Dapp.repo="$REPO" -Dapp.home="$BASEDIR" -Dbasedir="$BASEDIR" org.owasp.dependencycheck.App )

for arg; do
CMDS+=("$arg")
done

exec "${CMDS[@]}"