Describe the bug
The --nvdValidForHours seems to not work as expected. The log says:
DEBUG - Last NVD API was at 2023-11-28T14:57:24Z, and now 2023-12-04T12:43:31.049266Z[UTC] is within 86400 s.
But that is wrong, the november 18th is not withing 24 hours of december 4th.
I had a look at the code and I think I know why. In the NvdApiDataSource there is this code:
final Duration duration = Duration.between(now, lastChecked);
final long difference = duration.getSeconds();
proceed = difference > validForSeconds;
The Duration.between method returns a negative value if the end is before the start. Since it is called with now as the first parameter (start), the end is always before the start, so the number is negative. A negative value is never greater than any positive number, so proceed is always false.
Version of dependency-check used
The problem occurs using version 9.0.2 of the cli (cli, gradle plugin, maven plugin, etc.)
Log file
DEBUG - Last NVD API was at 2023-11-28T14:57:24Z, and now 2023-12-04T12:43:31.049266Z[UTC] is within 86400 s.
To Reproduce
Steps to reproduce the behavior:
- Download an nvd-cache into a folder
- Run the cli tool with that folder configured
- Wait a day
- Update the nvd-cache
- Run the cli tool with the updated ncd-cache and the --log option to see the debug output
- Check the debug log for the message that tells you that it doesn't want to check the API because it is within the configured seconds
Expected behavior
The parameter nvdValidForHours should work as described in the documentation
Describe the bug
The --nvdValidForHours seems to not work as expected. The log says:
DEBUG - Last NVD API was at 2023-11-28T14:57:24Z, and now 2023-12-04T12:43:31.049266Z[UTC] is within 86400 s.But that is wrong, the november 18th is not withing 24 hours of december 4th.
I had a look at the code and I think I know why. In the
NvdApiDataSourcethere is this code:The
Duration.betweenmethod returns a negative value if the end is before the start. Since it is called withnowas the first parameter (start), the end is always before the start, so the number is negative. A negative value is never greater than any positive number, so proceed is always false.Version of dependency-check used
The problem occurs using version 9.0.2 of the cli (cli, gradle plugin, maven plugin, etc.)
Log file
DEBUG - Last NVD API was at 2023-11-28T14:57:24Z, and now 2023-12-04T12:43:31.049266Z[UTC] is within 86400 s.To Reproduce
Steps to reproduce the behavior:
Expected behavior
The parameter
nvdValidForHoursshould work as described in the documentation