From 38eb3395570d58aa59613d3bde7d9ac3f15c3f8a Mon Sep 17 00:00:00 2001
From: Ariel Weisberg <aweisberg@apple.com>
Date: Fri, 22 Mar 2024 16:26:29 -0400
Subject: [PATCH] Add support for providing nvdDatafeedUrl to OWASP

patch by Ariel Weisberg; reviewed by Berenguer Blasi for CASSANDRA-19484
---
 .build/build-owasp.xml | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/.build/build-owasp.xml b/.build/build-owasp.xml
index e14f310b15..f5f1bc1edb 100644
--- a/.build/build-owasp.xml
+++ b/.build/build-owasp.xml
@@ -17,7 +17,8 @@
   ~ limitations under the License.
   -->
 <project basedir="." name="apache-cassandra-owasp-tasks"
-         xmlns:unless="ant:unless">
+         xmlns:unless="ant:unless"
+         xmlns:if="ant:if">
     <property name="dependency-check.version" value="9.0.5"/>
     <property name="dependency-check.home" value="${tmp.dir}/dependency-check-ant-${dependency-check.version}"/>
     <property name="dependency-check.archive.dir"
@@ -47,6 +48,7 @@
 
     <target name="-run-owasp-scan" description="Dependency-Check Analysis"
             depends="-dependency-check-init,resolver-dist-lib">
+        <property name="nvd.api.key" value="dummy" if:set="env.NVD_DATAFEED_URL" />
         <fail unless:set="nvd.api.key">
             Please set the nvd.api.key property to your NVD API key. It is recommended to put that property into your
             ~/.ant/build.properties file. You can get your API key from https://nvd.nist.gov/developers/request-an-api-key
@@ -85,6 +87,9 @@
 
             (1) https://nvd.nist.gov/vuln-metrics/cvss
         -->
+        <condition property="nvdDatafeedUrl" value="${env.NVD_DATAFEED_URL}" else="">
+            <isset property="env.NVD_DATAFEED_URL" />
+        </condition>
         <dependency-check projectname="Apache Cassandra"
                           nvdApiKey="${nvd.api.key}"
                           reportoutputdirectory="${dependency-check.report.dir}"
@@ -96,7 +101,8 @@
                           failBuildOnCVSS="1"
                           assemblyAnalyzerEnabled="false"
                           dataDirectory="${nvd.data.dir}"
-                          suppressionFile="${basedir}/.build/dependency-check-suppressions.xml">
+                          suppressionFile="${basedir}/.build/dependency-check-suppressions.xml"
+                          nvdDatafeedUrl="${nvdDatafeedUrl}">
             <fileset refid="dependencies_to_check"/>
         </dependency-check>
     </target>