Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fp fixes #4584

Merged
merged 15 commits into from Jun 11, 2022
Merged

Fp fixes #4584

Changes from all commits
Commits
Show all changes
15 commits
Select commit Hold shift + click to select a range
c9fe358
Merge two spring-security-rsa suppressions into one and add suppressi…
aikebah Jun 2, 2022
8186305
Extend CPE list for spring-boot-starter-security; fixes #4563
aikebah Jun 2, 2022
c68e378
Fix false CPE match for jakartaee-migration utility; fixes #4560
aikebah Jun 2, 2022
349809e
Suppress additional false CPEs identified in gradle plugin; fixes #4561
aikebah Jun 6, 2022
1caf899
Suppress FP CPE-match for NPM archiver package; fixes #4554
aikebah Jun 6, 2022
a4e91d3
Extend suppression rule for false CPE google:gson to also cover googl…
aikebah Jun 6, 2022
4ec4f55
Suppress false CPE-match; fixes #4540
aikebah Jun 6, 2022
af654f2
Suppress FP CPE match for brave-propagation-aws; fixes #4524
aikebah Jun 6, 2022
2167e2d
Suppress false CPE matches for spring-security-saml extension project
aikebah Jun 8, 2022
629bf74
Extend suppressed CPEs for spring-security-oauth2 library
aikebah Jun 8, 2022
a00930e
Suppress false CPE match for quarkus-micrometer-registry-prometheus
aikebah Jun 8, 2022
3d985ef
Suppress rabbitMQ CPE by technology mismatch, RabbitMQ is in Erlang
aikebah Jun 8, 2022
4449409
Suppress FP CPE match for activemq-artemis-native
aikebah Jun 8, 2022
9ea003e
Suppress false CPE match for spring-ws library
aikebah Jun 8, 2022
823e71a
Merge branch 'main' into fp-fixes
aikebah Jun 8, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
97 changes: 79 additions & 18 deletions core/src/main/resources/dependencycheck-base-suppression.xml
View file
Open in desktop
Expand Up @@ -599,11 +599,14 @@
</suppress>
<suppress base="true">
<notes><![CDATA[
False positive per #3622. Spring-boot-starter-oauth2-client gets flagged with wrong spring CPEs.
False positive per #3622, #4561. Spring-boot-starter-oauth2-client gets flagged with wrong spring CPEs.
]]></notes>
<packageUrl regex="true">^pkg:maven/org\.springframework\.boot/spring\-boot\-starter\-oauth2\-client@.*$</packageUrl>
<cpe>cpe:/a:pivotal:spring_security_oauth</cpe>
<cpe>cpe:/a:pivotal:spring_security</cpe>
<cpe>cpe:/a:pivotal_software:spring_security_oauth</cpe>
<cpe>cpe:/a:pivotal_software:spring_security</cpe>
<cpe>cpe:/a:vmware:spring_security</cpe>
</suppress>
<suppress base="true">
<notes><![CDATA[
Expand Down Expand Up @@ -680,6 +683,7 @@
59. docker:docker is a go implementation #4025
60. travis-ci:travis_ci is ci server software build in ruby/shell/go #4025
61. cpe:/a:storage_project:storage is software build in go (the github.com/containers/storage project) #4436
62. cpe:/a:pivotal_software:rabbitmq is software build in Erlang #4178
]]></notes>
<filePath regex="true">.*(\.(dll|jar|ear|war|pom|nupkg|nuspec|aar)|pom\.xml|package.json|packages.config)$</filePath>
<cpe>cpe:/a:sandbox:sandbox</cpe>
Expand Down Expand Up @@ -743,6 +747,7 @@
<cpe>cpe:/a:docker:docker</cpe>
<cpe>cpe:/a:travis-ci:travis_ci</cpe>
<cpe>cpe:/a:storage_project:storage</cpe>
<cpe>cpe:/a:pivotal_software:rabbitmq</cpe>
</suppress>
<suppress base="true">
<notes><![CDATA[
Expand Down Expand Up @@ -915,11 +920,14 @@
</suppress>
<suppress base="true">
<notes><![CDATA[
FP per #1665
]]></notes>
<packageUrl regex="true">^pkg:maven/org\.springframework\.security/spring\-security\-rsa@.*$</packageUrl>
Suppresses false positives per issue #1665, #3219, #4562.
]]></notes>
<packageUrl regex="true">^pkg:maven/org\.springframework\.security/spring-security-rsa.*$</packageUrl>
<cpe>cpe:/a:pivotal:spring_security_oauth</cpe>
<cpe>cpe:/a:pivotal_software:spring_security</cpe>
<cpe>cpe:/a:vmware:spring_security</cpe>
<cpe>cpe:/a:vmware:springsource_spring_security</cpe>
<cpe>cpe:/a:security-framework_project:security-framework</cpe>
</suppress>
<suppress base="true">
<notes><![CDATA[
Expand Down Expand Up @@ -969,10 +977,11 @@
</suppress>
<suppress base="true">
<notes><![CDATA[
Supress false positives per issue #1872
Supress false positives per issue #1872, #4577
]]></notes>
<gav regex="true">^org\.springframework\.security\.oauth:spring-security-oauth2:.*$</gav>
<packageUrl regex="true">^pkg:maven/org\.springframework\.security\.oauth/spring-security-oauth2@.*$</packageUrl>
<cpe>cpe:/a:pivotal_software:spring_security</cpe>
<cpe>cpe:/a:vmware:spring_security</cpe>
</suppress>
<suppress base="true">
<notes><![CDATA[
Expand All @@ -992,15 +1001,6 @@
<cpe>cpe:/a:vmware:springsource_spring_security</cpe>
<cpe>cpe:/a:security-framework_project:security-framework</cpe>
</suppress>
<suppress base="true">
<notes><![CDATA[
Suppresses false positives per issue #3219.
]]></notes>
<packageUrl regex="true">^pkg:maven/org\.springframework\.security/spring-security-rsa.*$</packageUrl>
<cpe>cpe:/a:pivotal_software:spring_security</cpe>
<cpe>cpe:/a:vmware:springsource_spring_security</cpe>
<cpe>cpe:/a:security-framework_project:security-framework</cpe>
</suppress>
<suppress base="true">
<notes><![CDATA[
Suppresses false positives per issue 2246
Expand Down Expand Up @@ -2924,10 +2924,12 @@
</suppress>
<suppress base="true">
<notes><![CDATA[
spring-boot-starter-security is not the same as spring-security, See #1975
spring-boot-starter-security is not the same as spring-security, See #1975, #4563
]]></notes>
<gav regex="true">^org\.springframework\.boot:spring-boot-starter-security:.*$</gav>
<cpe>cpe:/a:pivotal_software:spring_security</cpe>
<cpe>cpe:/a:vmware:spring_security</cpe>
<cpe>cpe:/a:vmware:springsource_spring_security</cpe>
</suppress>
<suppress base="true">
<notes><![CDATA[
Expand Down Expand Up @@ -5247,9 +5249,9 @@
</suppress>
<suppress base="true">
<notes><![CDATA[
FP per issue #4487
FP per issue #4487, FP per issue #4551
]]></notes>
<packageUrl regex="true">^pkg:maven/com\.google\.http-client/google-http-client-gson@.*$</packageUrl>
<packageUrl regex="true">^pkg:maven/com\.google\.(?!code\.gson).*/.*gson.*$</packageUrl>
<cpe>cpe:/a:google:gson</cpe>
</suppress>
<suppress base="true">
Expand Down Expand Up @@ -5327,6 +5329,65 @@
</suppress>
<suppress base="true">
<notes><![CDATA[
FP per issue #4560. Tomcat jakartaee-migration utility is other project than Apache Tomcat itself
]]></notes>
<packageUrl regex="true">^pkg:maven/org\.apache\.tomcat/jakartaee-migration@.*$</packageUrl>
<cpe>cpe:/a:apache:tomcat</cpe>
</suppress>
<suppress base="true">
<notes><![CDATA[
FP per issue #4554; archiver_project:archiver is a go-module, not the NPM package
]]></notes>
<packageUrl regex="true">^pkg:npm/archiver@.*$</packageUrl>
<cpe>cpe:/a:archiver_project:archiver</cpe>
</suppress>
<suppress base="true">
<notes><![CDATA[
FP per issue #4540
]]></notes>
<packageUrl regex="true">^pkg:maven/tyrex/tyrex@.*$</packageUrl>
<cpe>cpe:/a:sun:j2ee</cpe>
</suppress>
<suppress base="true">
<notes><![CDATA[
FP per issue #4524; Zipkin Brave-aws is not the Brave desktop browser
]]></notes>
<packageUrl regex="true">^pkg:maven/io\.zipkin\.aws/brave-propagation-aws@.*$</packageUrl>
<cpe>cpe:/a:brave:brave</cpe>
</suppress>
<suppress base="true">
<notes><![CDATA[
FP per issue #4576; spring-security-saml2-core is an (end-of-life) extension project separate from spring-security https://github.com/spring-projects/spring-security-saml
]]></notes>
<packageUrl regex="true">^pkg:maven/org\.springframework\.security\.extensions/spring-security-saml2-core@.*$</packageUrl>
<cpe>cpe:/a:saml_project:saml</cpe>
<cpe>cpe:/a:vmware:spring_security</cpe>
</suppress>
<suppress base="true">
<notes><![CDATA[
FP per issue #4205;
]]></notes>
<packageUrl regex="true">^pkg:maven/io\.quarkus/quarkus-micrometer-registry-prometheus@.*$</packageUrl>
<cpe>cpe:/a:prometheus:prometheus</cpe>
</suppress>
<suppress base="true">
<notes><![CDATA[
FP per issue #3888;
]]></notes>
<packageUrl regex="true">^pkg:maven/org\.apache\.activemq/activemq\-artemis\-native@.*$</packageUrl>
<cpe>cpe:/a:apache:activemq</cpe>
<cpe>cpe:/a:apache:activemq_artemis</cpe>
</suppress>
<suppress base="true">
<notes><![CDATA[
FP per issue #3811
]]></notes>
<packageUrl regex="true">^pkg:maven/org\.springframework\.ws/spring\-ws\-security@.*$</packageUrl>
<cpe>cpe:/a:vmware:spring_security</cpe>
<cpe>cpe:/a:pivotal_software:spring_security</cpe>
</suppress>
<suppress base="true">
<notes><![CDATA[
FP per issues #4581, #4582
]]></notes>
<packageUrl regex="true">^pkg:maven/org\.springframework\.cloud/spring-cloud-dataflow-rest-.*$</packageUrl>
Expand Down