Exploring OWASP Dependency Check in Jenkins: A Step-by-Step Guide

Overview

OWASP Dependency Check is a crucial tool in the realm of software composition analysis, aiding in the identification of project dependencies with known vulnerabilities. This guide provides step-by-step instructions on setting up OWASP Dependency Check in Jenkins for efficient vulnerability detection.

Installation

Open Jenkins and navigate to the Jenkins home page.
Click on "Manage Jenkins" in the left-hand sidebar.
Select "Manage Plugins" from the options.
In the "Available" tab, search for "OWASP Dependency-Check Plugin" in the filter box.
Check the checkbox next to the plugin and click on the "Install without restart" button.
Once the installation is complete, go back to the Jenkins home page.

Setting up OWASP Dependency Check in Jenkins

Click on "New Item" in the left-hand sidebar to create a new Jenkins job.
Enter a name for your job and select the type of job you want to create (e.g., Freestyle project or Pipeline).
Configure the job as per your requirements (e.g., source code management, build triggers, etc.).
Scroll down to the "Build" section and click on the "Add build step" dropdown.
Select "Invoke OWASP Dependency-Check" from the dropdown.
Configure the plugin settings according to your needs, specifying the path to your project, any additional arguments, and choosing the appropriate OWASP Dependency-Check installation.
Save the job configuration.
Before running the job, ensure you've set up the desired OWASP Dependency-Check installation in Jenkins (Go to "Manage Jenkins" > "Global Tool Configuration").

Installation Options for OWASP Dependency Check

Option 1: Downloading the Standalone JAR

Go to the OWASP Dependency Check releases page.
Download the latest version of the standalone JAR file (dependency-check.jar).
Ensure you have Java 8 or higher installed on your system.

Run the tool using the following command:

  java -jar dependency-check.jar --project <project-name> --scan <path-to-project>

Option 2: Using Package Managers

Maven

Add the following plugin to your pom.xml file:

  <build>
    <plugins>
      <plugin>
        <groupId>org.owasp</groupId>
        <artifactId>dependency-check-maven</artifactId>
        <version>INSERT_VERSION_HERE</version>
        <executions>
          <execution>
            <goals>
              <goal>check</goal>
            </goals>
          </execution>
        </executions>
      </plugin>
    </plugins>
  </build>

Run mvn dependency-check:check to analyze your project.

Usage

Once installed, run OWASP Dependency Check against your project to identify vulnerabilities:

For the standalone JAR:

java -jar dependency-check.jar --project <project-name> --scan <path-to-project>

For Maven:

mvn dependency-check:check

Make sure to replace <project-name> with your project's name and <path-to-project> with the project's directory.

Configuration

OWASP Dependency Check offers various configuration options. Refer to the Configuration Guide for detailed information.

Reporting

OWASP Dependency Check generates comprehensive reports about identified vulnerabilities. Reports can be found at:

For the standalone JAR: <path-to-project>/target/dependency-check-report.html
For Maven: <path-to-project>/target/dependency-check-report.html
For Gradle: <path-to-project>/build/reports/dependency-check-report.html

Open the HTML report in your web browser to view vulnerability details.

Resources

Jenkins Pipeline Integration

pipeline {
    agent any

    tools {
        jdk 'jdk11'
        maven 'maven3'
    }

    environment {
        SCANNER_HOME = tool 'sonar-scanner'
    }

    stages {
        // ... Previous stages ...

        stage('OWASP Dependency Check') {
            steps {
                dependencyCheck additionalArguments: '--scan target/', odcInstallation: 'owasp'
            }
        }

        stage('Publish OWASP Dependency Check Report') {
            steps {
                publishHTML(target: [
                    allowMissing: false,
                    alwaysLinkToLastBuild: true,
                    keepAll: true,
                    reportDir: 'target',
                    reportFiles: 'dependency-check-report.html',
                    reportName: 'OWASP Dependency Check Report'
                ])
            }
        }

        // ... Subsequent stages ...
    }
}

Feel free to customize the pipeline according to your specific project structure and needs.

Kiran Pawar's Blog