Limit CLJ_WATSON_* env vars to known properties?

[seancorfield]

As implemented, the CLJ_WATSON_* env var machinery could be used to set any Java system property that isn't already specified on the command-line.

Should we limit this to only properties that DC core knows about? That would mean reading dependencycheck.properties from the classpath and using those core properties as a check list.

Concern: not all core properties need be listed in that file -- I suspect some optional ones are omitted so it would be impossible to override those via env vars if we added this check. Does that matter?

[lread]

Concern: not all core properties need be listed in that file -- I suspect some optional ones are omitted so it would be impossible to override those via env vars if we added this check. Does that matter?

Good question, but I don't think it matters.

[samumbach]

I doubt there's any security concern here, as anyone who could inject a CLJ_WATSON_SOME_OTHER_PROPERTY=... env var into a process could presumably inject a -Dsome.other.property=... JVM argument instead.

There might be some value to warning for unknown keys to prevent fat-fingering (e.g., CLJ_WATSON_NDV_API_KEY=...), but you wouldn't expect any Java process to warn if you fat-fingered a JVM system property name (e.g., -Dndv.api.key=...).

I'm inclined not to make any change and continue to blindly translate all CLJ_WATSON_* env vars to JVM system properties. This leaves the system open to support all current and future properties.

[seancorfield]

Regarding my concern about disallowing env vars for properties that are not in the default DC properties file on the classpath, Sam pointed out that there are some properties with - in their names and some with mixedCase names and those already cannot be specified via env vars, since there's no mapping.

At this point, I'm inclined to do nothing here (and close this issue out), and take up the issue again only if someone demonstrates a specific need for better checking.

[samumbach]

I think there are only 2 DependencyCheck properties that suffer this limitation:

• proxy.disableSchemas
• analyzer.ossindex.remote-error.warn-only

$ git grep 'public static final String' -- utils/src/main/java/org/owasp/dependencycheck/utils/Settings.java | cut -d\" -f2 | grep -v '^[a-z0-9._]*$'
proxy.disableSchemas
analyzer.ossindex.remote-error.warn-only