DependencyCheck: NullPointerException: Cannot invoke "org.sonatype.goodies.packageurl.PackageUrl.toString()" because "coordinates" is null
Analysis failing since this morning with Sonatype OSS Index Analyzer
both dependency-check-maven:7.1.0 and dependency-check-maven:6.5.3 are impacted
May 25 06:25:11 [ERROR] Failed to execute goal org.owasp:dependency-check-maven:7.1.0:aggregate (default) on project : One or more exceptions occurred during dependency-check analysis: One or more exceptions occurred during analysis:
May 25 06:25:11 [ERROR] AnalysisException: Failed to request component-reports
May 25 06:25:11 [ERROR] caused by NullPointerException: Cannot invoke "org.sonatype.goodies.packageurl.PackageUrl.toString()" because "coordinates" is null
About this issue
- Original URL
- State: closed
- Created 2 years ago
- Reactions: 25
- Comments: 53 (4 by maintainers)
Commits related to this issue
- Workaround for depencency check issue 4535 https://github.com/jeremylong/DependencyCheck/issues/4535 — committed to FraunhoferIOSB/FROST-Client by hylkevds 2 years ago
Hi All, Sonatype OSSI Product Manager here. Firstly, sorry that this caused you all trouble. The best path here is to make authenticated requests as not only will that increase your rate limit but will also provide you with the most complete/accurate data.
We are also investigating whether we can increase the anonymous rate limit specifically for Dependency Check and Dependency Track. I’ll drop an update here later today.
For mvn users, you can, for the moment, disable the OSS Index analyzer, add the following to your plugin configuration:
<ossindexAnalyzerEnabled>false</ossindexAnalyzerEnabled>@jeremylong Thanks, well spotted. Looks like this is another bug. We’re investigating now.
Could be as I receive the following error along the mentioned error:
It works by providing valid Sonatype credentials. Register at https://ossindex.sonatype.org/user/register.
For Maven users:
Specify a server in your Maven settings
~/.m2/settings.xml(default location)Configure the
dependency-check-mavenplugin in yourpom.xmlWhen using Maven, you can also skip it via the
mvncommand to avoid having to adapt your plugin configuration in thepom.xml:@norrs Thanks, that one has been reported a few times now and we’re looking at it. Think we’re getting to the bottom of this one NPE at a time. Hopefully this is the last 😅
I have just tested one pipeline on my side and it works now, thanks for quick feedback and fixes @jlstephens89 @jeremylong !! 🙏 I’m still waiting reports from all pipelines but it is progressing thanks for that!
Getting some errors, but the build is successful:
Not getting those warnings if I use credentials on the gradle plugin
I’m getting these errors:
Thanks for the help, it is now fully resolved from my side!
@jlstephens89, I too am still seeing errors
Failed to fetch component-report for: pkg:maven/org.glassfish.jersey.core/jersey-common@2.5.1 java.lang.NullPointerException at org.owasp.dependencycheck.analyzer.OssIndexAnalyzer.transform(OssIndexAnalyzer.java:350) at org.owasp.dependencycheck.analyzer.OssIndexAnalyzer.lambda$enrich$5(OssIndexAnalyzer.java:256) at java.base/java.util.stream.ReferencePipeline$3$1.accept(ReferencePipeline.java:195) at java.base/java.util.ArrayList$ArrayListSpliterator.forEachRemaining(ArrayList.java:1655) at java.base/java.util.stream.AbstractPipeline.copyInto(AbstractPipeline.java:484) at java.base/java.util.stream.AbstractPipeline.wrapAndCopyInto(AbstractPipeline.java:474) at java.base/java.util.stream.ForEachOps$ForEachOp.evaluateSequential(ForEachOps.java:150) at java.base/java.util.stream.ForEachOps$ForEachOp$OfRef.evaluateSequential(ForEachOps.java:173) at java.base/java.util.stream.AbstractPipeline.evaluate(AbstractPipeline.java:234) at java.base/java.util.stream.ReferencePipeline.forEachOrdered(ReferencePipeline.java:502) at org.owasp.dependencycheck.analyzer.OssIndexAnalyzer.enrich(OssIndexAnalyzer.java:257) at org.owasp.dependencycheck.analyzer.OssIndexAnalyzer.analyzeDependency(OssIndexAnalyzer.java:163) at org.owasp.dependencycheck.analyzer.AbstractAnalyzer.analyze(AbstractAnalyzer.java:131) at org.owasp.dependencycheck.AnalysisTask.call(AnalysisTask.java:88) at org.owasp.dependencycheck.AnalysisTask.call(AnalysisTask.java:37) at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264) at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128) at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628) at java.base/java.lang.Thread.run(Thread.java:829)
Okay we’ve fixed the bug that was dropping the coordinates field and released. That should remove the NPE. We’ve hopefully also sorted the rate limit issue. It’d be great if someone could test and let me know.
@jlstephens89: After supressing the found vulnerability, I still get a warning with NPE, But org.owasp:dependency-check-maven:aggregate report runs successfully tho.
Log:
Do you want us to keep reporting the NPEs of artifacts we find in our builds? Or create new separate issue for each of em?
🤔 This might be another error than the given issue title.
@norrs Its more likely that our research team have found that the public CVE information is incorrect. Our team of researchers go much deeper than anything else that is publicly available. Email me privately at jstephens@sonatype.com with the component and CVE information and I’ll pass it on to the research team to double check for you and get you some more information.
Hello, thanks for the comment. I have provided a stack trace in a comment above:
https://github.com/jeremylong/DependencyCheck/issues/4535#issuecomment-1137269719
@jlstephens89 thanks for your help but it still doesn’t work in my case. I can still see the NPEs and it still raises some dependencies as vulnerable. If I disable the analyser it works ok, so no NPEs nor vulnerabilities.
Do I need to do anything in my gradle file? I am using the version 7.1.0.1 of the dependencycheck plugin.
Fix released and tested for the latest NPE’s. Test again and let me know if there are any more issues (also super sorry to disrupt everyone’s day!)
Also getting those exceptions, for the packages:
@jlstephens89 Seems to be working for me on latest version. Tested both in our AWS pipeline running the OWASP scan and locally on my dev machine. Seem to have found a new identified vulnerability as well.
spring-security-crypto-5.7.1.jar: CVE-2020-5408(6.5).Thanks.
edit: command issued:
mvn -DskipTests=true --no-transfer-progress -Powasp clean org.owasp:dependency-check-maven:aggregateour owasp profile:
See https://github.com/jeremylong/DependencyCheck/issues/4539#issuecomment-1137183801
@jlstephens89 see my email about the missing coordinates in the API response causing an NPE…
For maven users, it helps with
For gradle users you can disable OSS index by adding following line to your dependencycheck plugin: analyzers.ossIndexEnabled = false Checked with org.owasp.dependencycheck version “7.1.0.1”