Support Basic Auth for NVD Mirror Urls

If i’m using an url like this https://username:[e-mail]/nist-data-mirror/nvdcve-1.0-modified.json.gz i’m getting a [org.owasp.dependencycheck.utils.HttpResourceConnection] IO Exception connecting to. In the Debug Log there is the info that it’s an 401 Unauthorized.

We need a way to authorize not only for a proxy, but also for a mirror.

[vdotjansen]

@jeremylong I have added a pull request for this enhancement, could you have a quick look.

@devtribe, @artursmolarek & @bernermic could you test if my enhancement also works for your situations?

[bernermic]

I too tried the basic-auth way, which is not working. Finding this thread I tried to set proxyuser & proxypassword. But result stays the same.

dependencyCheck {
        cve {
        urlModified = "https://mirror.url/nvdcve-1.1-modified.json.gz"
        urlBase = "https://mirror.url/nvdcve-1.1-%d.json.gz"
    }
    proxy {
        username = "mirror-user"
        password = "mirror-password"
    }
}

Leads to [org.owasp.dependencycheck.utils.HttpResourceConnection] Error retrieving https://mirror.url/nvdcve-1.1-modified.meta; received response code 401.

Curl request against my mirror works as described above.

curl -I https://mirror-user:[e-mail]/nvdcve-1.1-modified.json.gz
HTTP/1.1 200 OK