Report cannot be generated when XML generated by OWASP scanner includes vulnerability

[turing85]

Component: phoenix-actions/test-reporting@v10

The action fails to generate a report of an XML file, generated by the owasp dependecy check plugin for gradle, that contains a security vulnerability.

Logs of failed step (debug logging was enabled):

Run phoenix-actions/test-reporting@v10
  with:
    fail-on-error: true
    list-suites: all
    list-tests: all
    name: OWASP Report
    only-summary: false
    path: **/build/reports/owasp/*-junit.xml
    reporter: java-junit
    token: ***
    path-replace-backslashes: false
    max-annotations: 10
    output-to: checks
  env:
    JAVA_HOME: /opt/hostedtoolcache/Java_Temurin-Hotspot_jdk/17.0.6-10/x64
    JAVA_HOME_17_X64: /opt/hostedtoolcache/Java_Temurin-Hotspot_jdk/17.0.6-10/x64
Action was triggered by pull_request: using SHA from head of source branch
Check runs will be created with SHA=f4f66bc9b4c2f44316fe2af2a7b3caba29dcfb5f
::group::Listing all files tracked by git
Listing all files tracked by git
Found 116 files tracked by GitHub
Using test report parser 'java-junit'
::group::Creating test report OWASP Report
Creating test report OWASP Report
  Processing test results from build/reports/owasp/dependency-check-junit.xml
  Creating check run OWASP Report
  Creating report summary
  Generating check run summary
  ::endgroup::
Error: Cannot read properties of undefined (reading 'split')

The artifact containing the XML report that was processed is attached.

owasp-report.zip

[turing85]

Raised phoenix-actions/test-reporting#31 to resolve the issue.

[turing85]

The issue is only partially fixed, we are running on a local copy of the report-plugin. It can be closed when:

• Make failure text in JUnit report optional phoenix-actions/test-reporting#32 is merged,
• phoenix-actions/test-reporting produces a new release including the fix, and
• we incorporate the fixed version.