DependencyCheck: RetireJS analyzer broken

Looks like retireJS have changed the expression at https://github.com/RetireJS/retire.js/commit/7007575f637b840016edf8a9512d608f00795b1b as of a few minutes ago, so this is working again with the default retireJsUrl again now (although you may have to purge cache as noted above).

Hello, this worked for me

<plugin>
                        <groupId>org.owasp</groupId>
                        <artifactId>dependency-check-maven</artifactId>
                        <version>7.1.1</version>
                        <configuration>
                            <retireJsUrl>
                                https://raw.githubusercontent.com/RetireJS/retire.js/33b4076ce87f3898b81af4fc1770a7b65aa54bcb/repository/jsrepository.json
                            </retireJsUrl>
                        </configuration>
                        <executions>
                            <execution>
                                <goals>
                                    <goal>check</goal>
                                </goals>
                            </execution>
                        </executions>
                    </plugin>

The workaround so far is to add:

<retireJsUrl>https://raw.githubusercontent.com/Retirejs/retire.js/3.0.6/repository/jsrepository.json</retireJsUrl>

Alternate workaround is <retireJsUrl>https://raw.githubusercontent.com/RetireJS/retire.js/33b4076ce87f3898b81af4fc1770a7b65aa54bcb/repository/jsrepository.json</retureJsUrl> which is the commit immediately before the problematic one. Going back to 3.0.6 is quite a way back in history.

Equivalent fix for gradle plugin (w/ Groovy) is

dependencyCheck {
  analyzers {
    retirejs {
      // Repository version locked due to https://github.com/jeremylong/DependencyCheck/issues/4695
      retireJsUrl = 'https://raw.githubusercontent.com/RetireJS/retire.js/33b4076ce87f3898b81af4fc1770a7b65aa54bcb/repository/jsrepository.json'
    }
  }
}

I don’t have to provide jsrepostory.json. Is this issue fixed now?

@workwithprashant Yes. 3 replies above yours..

Hi, I have tried adding --retireJsUrl https://raw.githubusercontent.com/Retirejs/retire.js/3.0.6/repository/jsrepository.json in my command line but it is still not working, any suggestions?

Deleting ~/.gradle/dependency-check-data/7.0/jsrepository.json worked for me.

remove ~/.m2/repository/org/owasp/dependency-check-data/7.0/jsrepository.json

was suggested as well

for CLI users, if you’re still having issue when adding this flag

--retireJsUrl https://raw.githubusercontent.com/RetireJS/retire.js/33b4076ce87f3898b81af4fc1770a7b65aa54bcb/repository/jsrepository.json

try to purge first --purge to delete the local copy

(updated to avoid copypastes, based on @chadlwilson 's comment)

The workaround so far is to add:

<retireJsUrl>https://raw.githubusercontent.com/RetireJS/retire.js/33b4076ce87f3898b81af4fc1770a7b65aa54bcb/repository/jsrepository.json'</retireJsUrl>

configuration to the plugin, and remove ~/.m2/repository/org/owasp/dependency-check-data/7.0/jsrepository.json. Forcing update won’t help (see https://github.com/jeremylong/DependencyCheck/issues/4696)

These steps worked for me:

mvn dependency:purge-local-repository
rm -rf ~/.m2/repository/org/owasp/dependency-check-data/7.0/jsrepository.json

Run the job again !!

this broke ALL of our builds 😦. since we all embed Redoc UI for rendenring Swagger OpenAPI. Every Java / Gradle build now fails across entire company…hope there is a permanent fix soon 😕

I suspect there may not be unless retirejs folks rollback the commit. And I suspect they probably won’t be so keen to do that, as the issue seems to be with assumptions made in the parsing library that OWASP Dependency Check uses rather than an issue with the feed itself.

However, if you have put OWASP dependency check on the critical path for every build - rather than something that happens on schedule (say, daily) for each codebase - I’d hope you are in a position to easily lock the RetireJS feed as suggested, since ability to change easily is really the only way to mitigate a live external dependency like this, whether it’s RetireJS or NVD or OSSINDEX.

this broke ALL of our builds 😦. since we all embed Redoc UI for rendenring Swagger OpenAPI. Every Java / Gradle build now fails across entire company…hope there is a permanent fix soon 😕

I filed a proposed fix for burp-retire-js at https://github.com/h3xstream/burp-retire-js/pull/74

@chadlwilson any idea how to implement this Kotlin DSL? I don’t see any config for RetireJSAnalyzer in 7.1.1

configure<DependencyCheckPlugin> {
 // no retireJsUrl var in here
}

My bad It was import issue, I was able to configure this

configure<org.owasp.dependencycheck.gradle.extension.DependencyCheckExtension> {
        format = org.owasp.dependencycheck.reporting.ReportGenerator.Format.HTML
        outputDirectory = "${project.buildDir}/reports"
        failBuildOnCVSS = 7f
        // Repository version locked due to https://github.com/jeremylong/DependencyCheck/issues/4695
        analyzers.retirejs.retireJsUrl = "https://raw.githubusercontent.com/RetireJS/retire.js/33b4076ce87f3898b81af4fc1770a7b65aa54bcb/repository/jsrepository.json"
    }