From e5a91cc6563eafbbaac93e58c97ae5ba4dd7f4ed Mon Sep 17 00:00:00 2001
From: Sven Kubiak <sk@svenkubiak.de>
Date: Sun, 26 Jun 2022 16:04:11 +0200
Subject: [PATCH] Added OWASP check

---
 .gitlab-ci.yml |  8 ++++++++
 pom.xml        | 27 +++++++++++++++++++++++++++
 2 files changed, 35 insertions(+)

diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index d6e23ae..3a07f70 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -3,6 +3,7 @@ image: maven:3.8.4-openjdk-17
 stages:
   - test
   - sonar
+  . owasp
 
 variables:
   MAVEN_OPTS: "-Dhttps.protocols=TLSv1.2 -Dmaven.repo.local=.m2/repository -Dorg.slf4j.simpleLogger.log.org.apache.maven.cli.transfer.Slf4jMavenTransferListener=WARN -Dorg.slf4j.simpleLogger.showDateTime=true -Djava.awt.headless=true"
@@ -12,6 +13,13 @@ cache:
   paths:
     - .m2/repository
 
+owasp:
+  stage: owasp
+  script:
+  - mvn $MAVEN_CLI_OPTS -Denforcer.skip clean dependency-check:check
+  only:
+  - schedules
+
 test:
   stage: test
   script: mvn $MAVEN_CLI_OPTS clean verify
diff --git a/pom.xml b/pom.xml
index e35c086..fbf5b21 100644
--- a/pom.xml
+++ b/pom.xml
@@ -109,6 +109,33 @@
 					</dependency>
 				</dependencies>
 			</plugin>
+						<plugin>
+					<groupId>org.owasp</groupId>
+					<artifactId>dependency-check-maven</artifactId>
+					<version>7.1.1</version>
+					<configuration>
+						<cveValidForHours>12</cveValidForHours>
+						<failBuildOnCVSS>1</failBuildOnCVSS>
+						<!--
+						<suppressionFiles>
+							<suppressionFile>${maven.multiModuleProjectDirectory}/owasp-suppression.xml</suppressionFile>
+						</suppressionFiles>
+						-->
+						<assemblyAnalyzerEnabled>false</assemblyAnalyzerEnabled>
+						<composerAnalyzerEnabled>false</composerAnalyzerEnabled>
+						<nodeAuditAnalyzerEnabled>false</nodeAuditAnalyzerEnabled>
+						<nuspecAnalyzerEnabled>false</nuspecAnalyzerEnabled>
+						<cocoapodsAnalyzerEnabled>false</cocoapodsAnalyzerEnabled>
+						<golangDepEnabled>false</golangDepEnabled>
+					</configuration>
+					<executions>
+						<execution>
+							<goals>
+								<goal>check</goal>
+							</goals>
+						</execution>
+					</executions>
+				</plugin>
 			<plugin>
 				<groupId>org.apache.maven.plugins</groupId>
 				<artifactId>maven-javadoc-plugin</artifactId>