Uploading OWASP Dependency Check Results

[nicolas-amegacorp]

Hello everyone,

I have a GitHub Workflow file that runs Dependency-Check, outputs the results in XML and then uploads to DefectDojo.

My problem is that the test is shown on DefectDojo and Engagements but it is empty, even though if I run cat and see the contents of my output xml file there are findings that should be uploaded.

Here is my workflow:

      - name: Install OWASP Dependency-Check
        uses: dependency-check/Dependency-Check_Action@main
        env:
          JAVA_OPTS: "-Xmx2G"
        with:
          project: "Some.Project"
          path: "src/"
          format: "XML"
          out: "./dependency-check-report.xml"
          args: "--log ./dependency-check-debug.log"

Upload Step:

      - name: Upload Dependency-Check XML Results to DefectDojo
        if: env.continue_upload == 'true'
        run: |
            curl -X POST "${{ secrets.DEFECTDOJO_URL }}/api/v2/import-scan/" \
            -H "Authorization: Token ${{ secrets.DEFECTDOJO_API_KEY }}" \
            -F "file=@./dependency-check-report.xml" \
            -F "scan_type=Dependency Check Scan" \
            -F "test_title=$project_name" \
            -F "engagement=${{ secrets.ENGAGEMENT_ID }}" \
            -F "auto_create_context=true" \
            -F "deduplication_on_engagement=true" \
            -F "verified=False" \
            -F "active=True" \
            -F "scan_date=$(date +'%Y-%m-%d')"

[mtesauro]

Just as FYI:

The #defectdojo Slack channel on OWASP's Slack instance usually has much more back and forth then GH discussions.

Info on joining is at https://github.com/DefectDojo/django-DefectDojo?tab=readme-ov-file#community-getting-involved-and-updates

[nicolas-amegacorp]

thanks for taking the time to let me know