A suggestion/enhancement! it would be great (for CI / gitlab / etc) - if ANY vulnerabilities are found, the tool returns non-zero
consider:
$ dotnet-ossindex (params) ./FooMySolution.sln
...
10 project(s) found
No packages affected
No packages affected
etc
$ echo $?
0
but ... if we find vulnerabilities
$ dotnet-ossindex (params) ./FooMySolution.sln
...
10 project(s) found
No packages affected
1 package(s) affected
Package: pkg:nuget/jQuery@3.3.0
Reference: https://ossindex.sonatype.org/component/pkg:nuget/jQuery@3.3.0
Vulnerabilities: - MEDIUM [CVE-2019-11358] Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")
- MEDIUM CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
etc
$ echo $?
0
suggestion is that the tool returns a non-zero return code if ANY vulnerabilities are found;
(certainly up for debate or configuration if the user wants to filter or exclude certain severity?)
A suggestion/enhancement! it would be great (for CI / gitlab / etc) - if ANY vulnerabilities are found, the tool returns non-zero
consider:
but ... if we find vulnerabilities
suggestion is that the tool returns a non-zero return code if ANY vulnerabilities are found;
(certainly up for debate or configuration if the user wants to filter or exclude certain severity?)