java - 抑制某些依赖项中 JAR 的 OWASP 结果

Question

dependency-check-maven插件正确列出了以下问题:

swagger-codegen-generators-1.0.19.jar: gradle-wrapper.jar: CVE-2016-6199, CVE-2019-16370, CVE-2019-11065, CVE-2019-15052

无论如何，我想抑制 gradle-wrapper.jar 内 swagger-codegen-generators-1.0.19.jar 的 CVE .

到目前为止我已经尝试过:

<!-- works, but does not restrict to swagger-codegen-generators dependency -->
<suppress>
  <filePath regex="true">.*\bgradle-wrapper\.jar</filePath>
  <cve>CVE-2016-6199</cve>
  <cve>CVE-2019-11065</cve>
  <cve>CVE-2019-15052</cve>
  <cve>CVE-2019-16370</cve>
</suppress>

<!-- does not match, due to other ignored CVEs the gav seems to be correct -->
<suppress>
  <gav regex="true">^io\.swagger\.codegen\.v3:swagger-codegen-generators:.*$</gav>
  <cve>CVE-2016-6199</cve>
  <cve>CVE-2019-11065</cve>
  <cve>CVE-2019-15052</cve>
  <cve>CVE-2019-16370</cve>
</suppress>

<!-- generated from the report; works, but does not restrict to swagger-codegen-generators dependency (sha1 of gradle-wrapper.jar) -->
<suppress>
  <notes><![CDATA[
    file name: swagger-codegen-generators-1.0.19.jar: gradle-wrapper.jar
  ]]></notes>
  <sha1>0f6f1fa2b59ae770ca14f975726bed8d6620ed9b</sha1>
  <cve>CVE-2016-6199</cve>
  <cve>CVE-2019-11065</cve>
  <cve>CVE-2019-15052</cve>
  <cve>CVE-2019-16370</cve>
</suppress>

Answer 1

我能够通过从报告文件 target/dependency-check-report.html 获得的文件路径来描述它。

<suppress>
  <filePath regex="true">.*\bswagger-codegen-generators.*\bgradle-wrapper\.jar</filePath>
  <cve>CVE-2016-6199</cve>
  <cve>CVE-2019-11065</cve>
  <cve>CVE-2019-15052</cve>
  <cve>CVE-2019-16370</cve>
</suppress>