diff --git a/libraries/owasp_dep_check/README.md b/libraries/owasp_dep_check/README.md index 43ff3959..677f5409 100644 --- a/libraries/owasp_dep_check/README.md +++ b/libraries/owasp_dep_check/README.md @@ -31,6 +31,7 @@ OWASP Dependency Check Library Configuration Options | `allow_suppression_file` | Allows whitelisting vulnerabilities using a suppression XML file | `true` | | `suppression_file` | Path to the suppression file (see [here](https://jeremylong.github.io/DependencyCheck/general/suppression.html) for how to create a suppression file) | `dependency-check-suppression.xml` | | `image_tag` | The tag for the scanner Docker image used | `7.3.0-8.6-2` | +| `skip_node_audit` | Skips the node audit with `--disableNodeAudit` if set to true. This can be useful if you have other mechanisms to audit npm packages (ex: npm audit). | | ## Example Configuration Snippet diff --git a/libraries/owasp_dep_check/steps/application_dependency_scan.groovy b/libraries/owasp_dep_check/steps/application_dependency_scan.groovy index 0a2d563c..dc3ce04f 100644 --- a/libraries/owasp_dep_check/steps/application_dependency_scan.groovy +++ b/libraries/owasp_dep_check/steps/application_dependency_scan.groovy @@ -42,6 +42,11 @@ void call() { echo "\"${suppressionFile}\" does not exist. Skipping suppression." } } + + Boolean skipNodeAudit = config?.skip_node_audit ?: false + if (skipNodeAudit) { + args += " --disableNodeAudit" + } // perform the scan try {