🔐 How to Use OWASP Dependency-Check for Android and iOS Projects

When developing mobile apps, it’s crucial to keep third-party dependencies secure. OWASP Dependency-Check is an open-source tool that helps detect known vulnerabilities (CVEs) in software libraries. In this article, we’ll explore how to use it for both Android and iOS projects and integrate it into your CI/CD pipeline like Jenkins.

---

✅ What is OWASP Dependency-Check?

OWASP Dependency-Check is a Software Composition Analysis (SCA) tool. It scans your project’s dependencies and checks for known vulnerabilities using data from the National Vulnerability Database (NVD).

---

🟢 Using OWASP Dependency-Check for Android

Android apps typically use Gradle, which means you can scan .jar and .aar files from your build outputs.

🔧 Step-by-Step Guide

1️⃣ Install Dependency-Check CLI

You can download the latest release from GitHub:
👉 https://github.com/jeremylong/DependencyCheck/releases

If you're on macOS, you can also use Homebrew:

bash
brew install dependency-check

---

2️⃣ Run a Scan

Use the CLI to scan your Android project directory:

bash
dependency-check --project "MyAndroidApp" \
  --scan /path/to/your/project \
  --format "HTML" \
  --out reports/

📁 Tip: To scan only the *.jar and *.aar files in your build directory:

bash
dependency-check --scan ./app/build/intermediates/ \
  --format HTML \
  --out reports/

---

3️⃣ Integrate with Jenkins

Add the Dependency-Check command in a Jenkins build step (Shell or Pipeline) and archive the report for visibility.

---

🍏 Using OWASP Dependency-Check for iOS

iOS projects commonly use:

• CocoaPods → Podfile.lock

• Swift Package Manager (SPM) → Package.resolved

• Carthage → Cartfile.resolved

However, OWASP Dependency-Check doesn't natively support iOS package managers. But don’t worry—there are workarounds!

---

✅ Workarounds for iOS

🔹 Option 1: Manual Dependency Entry

Extract dependency names from Podfile.lock or Package.resolved and manually create a dependency-check.xml file to scan.

---

🔹 Option 2: Scan Compiled Frameworks

If you’re using prebuilt .framework or .xcframework files:

bash
dependency-check --project "MyiOSApp" \
  --scan ./Frameworks/ \
  --format "HTML" \
  --out reports/

---

🔹 Option 3: Use Alternative Tools

For better iOS support, consider these tools:

• Snyk: Supports CocoaPods and SPM natively

• CycloneDX + OWASP Dependency-Track: Generate a Bill of Materials (BOM) and analyze vulnerabilities

---

🔄 Jenkins Integration (Optional)

Here’s a simple Jenkins shell step:

bash
#!/bin/bash
dependency-check \
  --project "MyMobileApp" \
  --scan "$WORKSPACE/app/build" \
  --format "HTML" \
  --out "$WORKSPACE/reports"

You can archive or email the report after each build.

---

📌 Summary

Platform	Usage with OWASP Dependency-Check	Notes
Android	Scan .jar and .aar files in Gradle output	✅ Fully supported
iOS	Manual dependency listing or scan .framework	⚠️ Limited native support

---

🧩 Final Thoughts

OWASP Dependency-Check is a powerful tool for securing your mobile apps during development. While Android support is strong, iOS may require additional steps or alternative tools. Still, integrating security scanning in your CI/CD pipeline is a huge win for your DevSecOps practice!