Skip to content
This repository was archived by the owner on Sep 27, 2025. It is now read-only.

Commit 20e344c

Browse files
drijkersbqdrijkersbq
authored
fix: 7093 add username/password properties to be able to authenticate for central.content.url and analyzer.central.url again (#7169)
1 parent 6a13d58 commit 20e344c

File tree

5 files changed

+52
-0
lines changed

5 files changed

+52
-0
lines changed

‎cli/src/main/java/org/owasp/dependencycheck/App.java‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -604,6 +604,10 @@ protected void populateSettings(CliParser cli) throws InvalidSettingException {
604604
cli.hasOption(CliParser.ARGUMENT.ENABLE_NEXUS));
605605
settings.setStringIfNotEmpty(Settings.KEYS.ANALYZER_CENTRAL_URL,
606606
cli.getStringArgument(CliParser.ARGUMENT.CENTRAL_URL));
607+
settings.setStringIfNotEmpty(Settings.KEYS.ANALYZER_CENTRAL_USER,
608+
cli.getStringArgument(CliParser.ARGUMENT.CENTRAL_USERNAME));
609+
settings.setStringIfNotEmpty(Settings.KEYS.ANALYZER_CENTRAL_PASSWORD,
610+
cli.getStringArgument(CliParser.ARGUMENT.CENTRAL_PASSWORD));
607611
settings.setStringIfNotEmpty(Settings.KEYS.ANALYZER_OSSINDEX_URL,
608612
cli.getStringArgument(CliParser.ARGUMENT.OSSINDEX_URL));
609613
settings.setStringIfNotEmpty(Settings.KEYS.ANALYZER_OSSINDEX_USER,

‎cli/src/main/java/org/owasp/dependencycheck/CliParser.java‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1360,6 +1360,14 @@ public static class ARGUMENT {
13601360
* The alternative URL for Maven Central Search.
13611361
*/
13621362
public static final String CENTRAL_URL = "centralUrl";
1363+
/**
1364+
* The username for the alternative Maven Central Search.
1365+
*/
1366+
public static final String CENTRAL_USERNAME = "centralUsername";
1367+
/**
1368+
* The password for the alternative Maven Central Search.
1369+
*/
1370+
public static final String CENTRAL_PASSWORD = "centralPassword";
13631371
/**
13641372
* Disables the Nexus Analyzer.
13651373
*/

‎cli/src/site/markdown/arguments.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -86,6 +86,8 @@ Advanced Options
8686
| | \-\-disableCentral | | Sets whether the Central Analyzer will be used. **Disabling this analyzer is not recommended as it could lead to false negatives (e.g. libraries that have vulnerabilities may not be reported correctly).** If this analyzer is being disabled there is a good chance you also want to disable the Artifactory or Nexus Analyzer. |   |
8787
| | \-\-disableCentralCache | | When the argument is present the Central Analyzer will not cache results locally. By default results are cached locally for 30 days. |   |
8888
| | \-\-centralUrl | | Alternative URL for Maven Central Search. If not set the public Sonatype Maven Central will be used. | https://search.maven.org/solrsearch/select |
89+
| | \-\-centralUsername | | The username to authenticate to the alternative Maven Central url set by the 'centralUrl' argument. If not set it will use an unauthenticated connection. |   |
90+
| | \-\-centralPassword | | The password to authenticate to the alternative Maven Central url set by the 'centralUrl' argument. If not set it will use an unauthenticated connection. |   |
8991
| | \-\-enableNexus | | Sets whether the Nexus Analyzer will be used (requires Nexus v2 or Pro v3). You can configure the Nexus URL to utilize an internally hosted Nexus server. |   |
9092
| | \-\-enableArtifactory | | Sets whether Artifactory analyzer will be used |   |
9193
| | \-\-artifactoryUrl | \<url\> | The Artifactory server URL. | &nbsp; |

‎utils/src/main/java/org/owasp/dependencycheck/utils/Downloader.java‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -175,6 +175,8 @@ public void configure(Settings settings) throws InvalidSettingException {
175175
tryAddHostedSuppressionCredentials(settings, credentialsProvider);
176176
tryAddKEVCredentials(settings, credentialsProvider);
177177
tryAddNexusAnalyzerCredentials(settings, credentialsProvider);
178+
tryAddCentralAnalyzerCredentials(settings, credentialsProvider);
179+
tryAddCentralContentCredentials(settings, credentialsProvider);
178180
tryAddNVDApiDatafeed(settings, credentialsProvider);
179181
httpClientBuilder.setDefaultCredentialsProvider(credentialsProvider);
180182
httpClientBuilderExplicitNoproxy.setDefaultCredentialsProvider(credentialsProvider);
@@ -220,6 +222,26 @@ private void tryAddNexusAnalyzerCredentials(Settings settings, CredentialsStore
220222
}
221223
}
222224

225+
private void tryAddCentralAnalyzerCredentials(Settings settings, CredentialsStore credentialsStore) throws InvalidSettingException {
226+
if (settings.getString(Settings.KEYS.ANALYZER_CENTRAL_PASSWORD) != null) {
227+
addUserPasswordCreds(settings, credentialsStore,
228+
Settings.KEYS.ANALYZER_CENTRAL_USER,
229+
Settings.KEYS.ANALYZER_CENTRAL_URL,
230+
Settings.KEYS.ANALYZER_CENTRAL_PASSWORD,
231+
"Central Analyzer");
232+
}
233+
}
234+
235+
private void tryAddCentralContentCredentials(Settings settings, CredentialsStore credentialsStore) throws InvalidSettingException {
236+
if (settings.getString(Settings.KEYS.CENTRAL_CONTENT_PASSWORD) != null) {
237+
addUserPasswordCreds(settings, credentialsStore,
238+
Settings.KEYS.CENTRAL_CONTENT_USER,
239+
Settings.KEYS.CENTRAL_CONTENT_URL,
240+
Settings.KEYS.CENTRAL_CONTENT_PASSWORD,
241+
"Central Content");
242+
}
243+
}
244+
223245
private void tryAddNVDApiDatafeed(Settings settings, CredentialsStore credentialsStore) throws InvalidSettingException {
224246
if (settings.getString(Settings.KEYS.NVD_API_DATAFEED_PASSWORD) != null) {
225247
addUserPasswordCreds(settings, credentialsStore,

‎utils/src/main/java/org/owasp/dependencycheck/utils/Settings.java‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -620,6 +620,14 @@ public static final class KEYS {
620620
* Key for the URL to obtain content from Maven Central.
621621
*/
622622
public static final String CENTRAL_CONTENT_URL = "central.content.url";
623+
/**
624+
* Key for the Username to obtain content from Maven Central.
625+
*/
626+
public static final String CENTRAL_CONTENT_USER = "central.content.username";
627+
/**
628+
* Key for the Password to obtain content from Maven Central.
629+
*/
630+
public static final String CENTRAL_CONTENT_PASSWORD = "central.content.password";
623631
/**
624632
* The properties key for whether the Central analyzer should use
625633
* parallel processing.
@@ -656,6 +664,14 @@ public static final class KEYS {
656664
* The properties key for the Central search URL.
657665
*/
658666
public static final String ANALYZER_CENTRAL_URL = "analyzer.central.url";
667+
/**
668+
* The properties key for the Central search username.
669+
*/
670+
public static final String ANALYZER_CENTRAL_USER = "analyzer.central.username";
671+
/**
672+
* The properties key for the Central search password.
673+
*/
674+
public static final String ANALYZER_CENTRAL_PASSWORD = "analyzer.central.password";
659675
/**
660676
* The properties key for the Central search query.
661677
*/

0 commit comments

Comments
 (0)