DependencyCheck
DependencyCheck copied to clipboard
jeremylong
Do not use inline styles, scripts and image in dependency-check-report.html due to CSP
Currently, the Gradle generated dependency-check-report.html holds inline-styles and scripts. This is blocked by CSP if you serve the file by a server, like via Jenkins publishHTML.
The only way to get the page working currently is to lower CSP by
style-src 'self' 'unsafe-inline' and for script-src (this is strongly disscuraged)
Better is to externalize the styles, scripts and images into separate files and reference in dependency-check-report.html
Only possible way is to download the report html to get it working.
For your purpose I think it would suffice to switch your setup to use the report type JENKINS instead of report type HTML, which was added in response to https://github.com/jeremylong/DependencyCheck/issues/5039
Unfortunately, not really. The inline-styles are still blocked by CSP. Cleanest solution would be to split JS and css into seperate files in JENKINS type report, so we can publish them with the html page.
The purpose of having it all bundled is to have a single file that is completely contained so that it can easily be viewed offline. Regarding the JENKINS report - we accept PRs.
What about pushing the js and css to a CDN and then linking to that in the HTML?
This also impact the SonarQube plugin/extension. With the CDN files we can then request SonarSource to add to their CSP header?
Or maybe a new version output for SQ that doesn't use any inline js for hiding/expanding sections and just show them all by default?
I see a special html with no JS was added for Jenkins can we possibly expose that via the Azure plugin as I don't have that as an option in the dropdown
@LorenDorez That would be something to raise with https://github.com/dependency-check/azuredevops (I assume that's the Azure plugin you're talking about)
but by picking 'ALL' as the format in that plugin should, among others, also create the Jenkins report as an output format from your scan
I was wanting to avoid the extra overhead of all since I didn't need all formats. I'll post a issue on the azure one