Proxy Settings Issue After Upgrading from 10 to 12.1.0

[habazie]

Hello
Has anything been changed with the proxy settings? I am trying to upgrade maven plugin owasp-dependency-check from version 10 to 12.1.0.
I need to set -DsuppressionFiles=http://xyz../publishedSuppressions.xml. The previous settings with MAVEN_OPTS worked, but now they don't.
It also doesn't work when I add the proxy in the mvn command.
Other plugins are working correctly. I also had it set as JAVA_TOOLS_OPTIONS, but it didn't work. . On the server, the access via proxy works correctly.

I found this issue #7072, but as I mentioned, none of the options work for me. The same works fine in version 10.

I see that there have been some recent changes related to proxy: https://github.com/dependency-check/DependencyCheck/blob/v12.1.0/CHANGELOG.md
Please verify.

[aikebah]

The entire HTTP communication has switched to use Apache HTTPClient to allow harmonizing the proxy configuration to a single set that works for all parts. Before this Dependency-Check was using a mixture of own configuration and (within the clients for the OSSIndex API and NVD API) apache HTTPClient.

All of the standard system environment variables should work that are supported by Apache HTTPClient5.

See also the page on proxy configuration in github pages: https://dependency-check.github.io/DependencyCheck/data/proxy.html

Legacy configuration for proxies can be done, but it's better to use the documented new settings for the proxy, as there are external libraries in use for communication to NVD API and OSSIndex API that also take advantage of the http-proxy related system variables whereas they cannot honor proxy-settings that you set via the legacy proxy configs.

[habazie]

Thanks for your answer @aikebah . I am pretty sure that the option -DsuppressionFiles=http://xyz../publishedSuppressions.xml doesn't work with a proxy. I seriously tried all possible options, but nothing helped. NVD databases were downloaded successfully with the same options. Like I said, version 10 works well.

When I have a corporate proxy set (without nonproxy), I should not be able to download suppressionFiles from internal servers. But it still works, as if the proxy settings do not affect this for -DsuppressionFiles.

Maybe a change introduced in version 12.0.0 affected this behavior?
e9087d5
49ac494

Best regards!

[aikebah]

It does work with a proxy, assuming they are not excluded from being proxied by some config setting.

Apache HTTP Client 5 starts off from the standard java ProxySelector when system-properties are taken into account.

https://github.com/apache/httpcomponents-client/blob/3b5c815f5c524ca76e51da365318a825b864d3db/httpclient5/src/main/java/org/apache/hc/client5/http/impl/classic/HttpClientBuilder.java#L1003

Given the symptom you describe (internal hosts accessed directly despite you not setting a nonProxyHosts) there appears to be a system setting already excluding the internal hosts from the proxying.

[habazie]

@aikebah

I was running a Docker container with a Maven image, and variables were passed correctly using options like -e JAVA_TOOL_OPTIONS. I also tried using MAVEN_OPTS.

As I mentioned, the exact same configuration (only changing the version number from 10 to 12 and using a new data directory) stops working. I really don't see any error in the configuration.

I checked the system proxy visibility using the env command, and everything looks fine.

The process stops at:
[DEBUG] Loading suppression rules from 'https://dependency-check.github.io/DependencyCheck/suppressions/publishedSuppressions.xml'

I downloaded the publishedSuppressions.xml file locally and pointed to it manually - then it works.

Can someone with a corporate proxy confirm if the proxy configuration actually works with suppressionFiles?

[habazie]

In my case, the process stopped at this step:
https://github.com/dependency-check/DependencyCheck/blob/main/core/src/main/java/org/owasp/dependencycheck/analyzer/AbstractSuppressionAnalyzer.java#L349C1-L350C115
Downloader.getInstance().fetchFile(url, file, false, Settings.KEYS.SUPPRESSION_FILE_USER, Settings.KEYS.SUPPRESSION_FILE_PASSWORD, Settings.KEYS.SUPPRESSION_FILE_BEARER_TOKEN);
I added a logger at this step and built the plugin locally. This is where it stopped.
I also added a logger before this line :list.addAll(parser.parseSuppressionRules(file)); https://github.com/dependency-check/DependencyCheck/blob/main/core/src/main/java/org/owasp/dependencycheck/analyzer/AbstractSuppressionAnalyzer.java#L395
but it never appeared in the logs.

However, there is no error message because there is no timeout. I believe it got stuck due to a proxy issue or something else.
I tried all possible solutions: MAVEN_OPTS, JAVA_TOOL_OPTIONS, and configuring the proxy in settings.xml, but nothing worked.
Maven recommends using settings.xml https://gitlab.com/to-be-continuous/maven/-/issues/39

EDIT:
@aikebah I also tried with the Docker image https://hub.docker.com/layers/owasp/dependency-check/12.1.0/images/sha256-60ee7af9cf80ac009761e397b2d4ba5ddbf072c2a0ead1c068dc24dc62155600 and I have the same problem.
Version 10 works fine.