Skip to content

Commit 18af98b

Browse files
chadlwilsonchadlwilson
authored
chore(fp): remove duplicate Jetty FPs already handled in hosted suppressions (dependency-check#8486)
Signed-off-by: Chad Wilson <29788154+chadlwilson@users.noreply.github.com>
1 parent ee87671 commit 18af98b

1 file changed

Lines changed: 18 additions & 135 deletions

File tree

‎core/src/main/resources/dependencycheck-base-suppression.xml‎

Lines changed: 18 additions & 135 deletions
Original file line numberDiff line numberDiff line change
@@ -152,14 +152,6 @@
152152
<packageUrl regex="true">^pkg:swift/swift\-log@.*$</packageUrl>
153153
<cpe>cpe:/a:apple:swift</cpe>
154154
</suppress>
155-
<suppress base="true">
156-
<notes><![CDATA[
157-
FP in jetty as jetty-jakarta-servlet-api is identified as a low version jetty
158-
]]></notes>
159-
<packageUrl regex="true">^pkg:maven/org\.eclipse\.jetty\.toolchain/jetty\-jakarta\-servlet\-api@.*$</packageUrl>
160-
<cpe>cpe:/a:eclipse:jetty</cpe>
161-
<cpe>cpe:/a:jetty:jetty</cpe>
162-
</suppress>
163155
<suppress base="true">
164156
<notes><![CDATA[
165157
FP per #3331
@@ -529,7 +521,6 @@
529521
<suppress base="true">
530522
<notes><![CDATA[
531523
FP per #2453
532-
TODO - there are likely several other testcontainer suppressions that should be added
533524
]]></notes>
534525
<packageUrl regex="true">^pkg:maven/org\.testcontainers/postgresql@.*$</packageUrl>
535526
<cpe>cpe:/a:postgresql:postgresql</cpe>
@@ -571,13 +562,6 @@
571562
<packageUrl regex="true">^pkg:maven/org\.bouncycastle.*$</packageUrl>
572563
<cpe>cpe:/a:oracle:jdk</cpe>
573564
</suppress>
574-
<suppress base="true">
575-
<notes><![CDATA[
576-
FP per #2247 CVE candidate was withdrawn by the CNA
577-
]]></notes>
578-
<packageUrl regex="true">^pkg:maven/org\.owasp\.antisamy/antisamy@.*$</packageUrl>
579-
<vulnerabilityName>CVE-2018-1000643</vulnerabilityName>
580-
</suppress>
581565
<suppress base="true">
582566
<notes><![CDATA[
583567
This suppresses false positives identified on spring security.
@@ -1465,49 +1449,25 @@
14651449
<gav regex="true">^org\.apache\.httpcomponents:httpmime:.*$</gav>
14661450
<cpe>cpe:/a:apache:httpclient</cpe>
14671451
</suppress>
1468-
<suppress base="true">
1469-
<notes><![CDATA[
1470-
FP per #2554
1471-
]]></notes>
1472-
<packageUrl regex="true">^pkg:maven/org\.eclipse\.jetty\.alpn/alpn\-api@.*$</packageUrl>
1473-
<cpe>cpe:/a:jetty:jetty</cpe>
1474-
<cpe>cpe:/a:eclipse:jetty</cpe>
1475-
<cpe>cpe:/a:mortbay_jetty:jetty</cpe>
1476-
<cpe>cpe:/a:mortbay:jetty</cpe>
1477-
</suppress>
14781452
<suppress base="true">
14791453
<notes><![CDATA[
14801454
FP per #2553
14811455
]]></notes>
14821456
<packageUrl regex="true">^pkg:maven/org\.eclipse\.jetty/jetty\-reactive\-httpclient@.*$</packageUrl>
1483-
<cpe>cpe:/a:jetty:jetty</cpe>
1484-
<cpe>cpe:/a:eclipse:jetty</cpe>
14851457
<cpe>cpe:/a:mortbay_jetty:jetty</cpe>
14861458
<cpe>cpe:/a:mortbay:jetty</cpe>
1487-
</suppress>
1488-
<suppress base="true">
1489-
<notes><![CDATA[
1490-
FP per #1515
1491-
]]></notes>
1492-
<gav regex="true">^org\.eclipse\.jetty\.alpn:alpn-api:.*$</gav>
1459+
<cpe>cpe:/a:jetty:jetty</cpe>
14931460
<cpe>cpe:/a:eclipse:jetty</cpe>
14941461
</suppress>
14951462
<suppress base="true">
14961463
<notes><![CDATA[
1497-
Resolve FP that caused ant task IT to fail.
1498-
]]></notes>
1499-
<gav regex="true">^jetty:org\.mortbay\.jetty:.*$</gav>
1500-
<cpe>cpe:/a:apache:http_server</cpe>
1501-
<cpe>cpe:/a:apache:apache_http_server</cpe>
1502-
<cpe>cpe:/a:free_java_web_server:free_java_web_server</cpe>
1503-
</suppress>
1504-
<suppress base="true">
1505-
<notes><![CDATA[
1506-
FP on jetty-proxy
1464+
general FP cleanup
15071465
]]></notes>
1508-
<gav regex="true">^org\.eclipse\.jetty:jetty-proxy:.*$</gav>
1509-
<cpe>cpe:/a:eclipse:jetty</cpe>
1466+
<packageUrl regex="true">^pkg:maven/org\.eclipse\.jetty\.websocket/websocket-api@.*$</packageUrl>
1467+
<cpe>cpe:/a:mortbay_jetty:jetty</cpe>
1468+
<cpe>cpe:/a:mortbay:jetty</cpe>
15101469
<cpe>cpe:/a:jetty:jetty</cpe>
1470+
<cpe>cpe:/a:eclipse:jetty</cpe>
15111471
</suppress>
15121472
<suppress base="true">
15131473
<notes><![CDATA[
@@ -1523,13 +1483,6 @@
15231483
<gav regex="true">^com\.amazonaws:aws-android-sdk-cognitoidentityprovider-asf:.*$</gav>
15241484
<cpe>cpe:/a:android:android_sdk</cpe>
15251485
</suppress>
1526-
<suppress base="true">
1527-
<notes><![CDATA[
1528-
Supression to remove incorrect match from the OSS Index per #2281.
1529-
]]></notes>
1530-
<packageUrl>pkg:maven/org.jsoup/jsoup@1.8.3</packageUrl>
1531-
<vulnerabilityName>CVE-2015-6748</vulnerabilityName>
1532-
</suppress>
15331486
<suppress base="true">
15341487
<notes><![CDATA[
15351488
Hazelcast-AWS is not Hazelcast (see #2330)
@@ -1887,15 +1840,11 @@
18871840
<notes><![CDATA[
18881841
drop wizard false positives
18891842
]]></notes>
1890-
<gav regex="true">io\.dropwizard:dropwizard-jetty:.*</gav>
1891-
<cpe>cpe:/a:jetty:jetty</cpe>
1892-
</suppress>
1893-
<suppress base="true">
1894-
<notes><![CDATA[
1895-
drop wizard false positives
1896-
]]></notes>
1897-
<gav regex="true">io\.dropwizard\.metrics:metrics-jetty:.*</gav>
1843+
<packageUrl regex="true">^pkg:maven/io\.dropwizard/dropwizard-jetty@.*$</packageUrl>
1844+
<cpe>cpe:/a:mortbay_jetty:jetty</cpe>
1845+
<cpe>cpe:/a:mortbay:jetty</cpe>
18981846
<cpe>cpe:/a:jetty:jetty</cpe>
1847+
<cpe>cpe:/a:eclipse:jetty</cpe>
18991848
</suppress>
19001849
<suppress base="true">
19011850
<notes><![CDATA[
@@ -1927,13 +1876,6 @@
19271876
<packageUrl regex="true">^pkg:maven/org\.scala\-lang/scalap@.*$</packageUrl>
19281877
<cpe>cpe:/a:scala-lang:scala</cpe>
19291878
</suppress>
1930-
<suppress base="true">
1931-
<notes><![CDATA[
1932-
Suppresses false positives per #1961. Scalap is not scala.
1933-
]]></notes>
1934-
<packageUrl regex="true">^pkg:maven/org\.scala\-lang/scalap@.*$</packageUrl>
1935-
<vulnerabilityName>CVE-2017-15288</vulnerabilityName>
1936-
</suppress>
19371879
<suppress base="true">
19381880
<notes><![CDATA[
19391881
Suppresses false positives per #1961. spark-sketch is not sketch - an vector drawing tool.
@@ -1955,28 +1897,15 @@
19551897
<packageUrl regex="true">^pkg:maven/com\.intellij/annotations@.*$</packageUrl>
19561898
<cpe>cpe:/a:jetbrains:intellij_idea</cpe>
19571899
</suppress>
1958-
<suppress base="true">
1959-
<notes><![CDATA[
1960-
drop wizard false positives. Updated per issue #796.
1961-
]]></notes>
1962-
<gav regex="true">org\.eclipse\.jetty\.toolchain\.setuid:jetty-setuid-java:.*</gav>
1963-
<cpe>cpe:/a:jetty:jetty</cpe>
1964-
<cpe>cpe:/a:eclipse:jetty</cpe>
1965-
</suppress>
1966-
<suppress base="true">
1967-
<notes><![CDATA[
1968-
drop wizard false positives
1969-
]]></notes>
1970-
<gav regex="true">org\.eclipse\.jetty\.http2:http2-hpack:.*</gav>
1971-
<cpe>cpe:/a:jetty:jetty</cpe>
1972-
<cpe>cpe:/a:eclipse:jetty</cpe>
1973-
</suppress>
19741900
<suppress base="true">
19751901
<notes><![CDATA[
19761902
FP on osgi bundle - the embedded jetty server is flagged instead of the bundle itself.
19771903
]]></notes>
19781904
<packageUrl regex="true">^pkg:maven/org\.ops4j\.pax\.web/pax\-web\-jetty\-bundle@.*$</packageUrl>
1905+
<cpe>cpe:/a:mortbay_jetty:jetty</cpe>
1906+
<cpe>cpe:/a:mortbay:jetty</cpe>
19791907
<cpe>cpe:/a:jetty:jetty</cpe>
1908+
<cpe>cpe:/a:eclipse:jetty</cpe>
19801909
</suppress>
19811910
<suppress base="true">
19821911
<notes><![CDATA[
@@ -2013,16 +1942,6 @@
20131942
<gav regex="true">io\.dropwizard\.metrics:metrics-httpclient:.*</gav>
20141943
<cpe>cpe:/a:apache:httpclient</cpe>
20151944
</suppress>
2016-
<suppress base="true">
2017-
<notes><![CDATA[
2018-
FP per issue https://github.com/dependency-check/dependency-check-gradle/issues/61
2019-
]]></notes>
2020-
<gav regex="true">^org\.eclipse\.jetty\.toolchain:jetty-schemas:.*$</gav>
2021-
<cpe>cpe:/a:mortbay_jetty:jetty</cpe>
2022-
<cpe>cpe:/a:mortbay:jetty</cpe>
2023-
<cpe>cpe:/a:jetty:jetty</cpe>
2024-
<cpe>cpe:/a:eclipse:jetty</cpe>
2025-
</suppress>
20261945
<suppress base="true">
20271946
<notes><![CDATA[
20281947
javax.transaction and javax.annotation (#1629) false positives
@@ -2393,7 +2312,10 @@
23932312
file name: keycloak-jetty-core-4.8.3.Final.jar
23942313
]]></notes>
23952314
<packageUrl regex="true">^pkg:maven/org\.keycloak/keycloak\-jetty\-core@.*$</packageUrl>
2315+
<cpe>cpe:/a:mortbay_jetty:jetty</cpe>
2316+
<cpe>cpe:/a:mortbay:jetty</cpe>
23962317
<cpe>cpe:/a:jetty:jetty</cpe>
2318+
<cpe>cpe:/a:eclipse:jetty</cpe>
23972319
</suppress>
23982320
<suppress base="true">
23992321
<notes><![CDATA[
@@ -3079,6 +3001,8 @@
30793001
general FP cleanup
30803002
]]></notes>
30813003
<filePath regex="true">.*winstone-?(\d*\.?){0,3}\.jar</filePath>
3004+
<cpe>cpe:/a:mortbay_jetty:jetty</cpe>
3005+
<cpe>cpe:/a:mortbay:jetty</cpe>
30823006
<cpe>cpe:/a:jetty:jetty</cpe>
30833007
<cpe>cpe:/a:eclipse:jetty</cpe>
30843008
</suppress>
@@ -3103,22 +3027,6 @@
31033027
<packageUrl regex="true">^pkg:maven/org\.apache\.aries\.transaction/org\.apache\.aries\.transaction\.manager@.*$</packageUrl>
31043028
<cpe>cpe:/a:apache:geronimo</cpe>
31053029
</suppress>
3106-
<suppress base="true">
3107-
<notes><![CDATA[
3108-
general FP cleanup
3109-
]]></notes>
3110-
<gav regex="true">^org\.eclipse\.jetty\.orbit:javax\.annotation:.*$</gav>
3111-
<cpe>cpe:/a:eclipse:jetty</cpe>
3112-
<cpe>cpe:/a:jetty:jetty</cpe>
3113-
</suppress>
3114-
<suppress base="true">
3115-
<notes><![CDATA[
3116-
general FP cleanup
3117-
]]></notes>
3118-
<gav regex="true">^org\.eclipse\.jetty\.websocket:websocket-api:.*$</gav>
3119-
<cpe>cpe:/a:eclipse:jetty</cpe>
3120-
<cpe>cpe:/a:jetty:jetty</cpe>
3121-
</suppress>
31223030
<suppress base="true">
31233031
<notes><![CDATA[
31243032
general FP cleanup: com.amazonaws is a drupal project
@@ -3190,22 +3098,6 @@
31903098
<gav regex="true">^org\.apache\.maven\.scm:maven-scm-provider-git-commons:.*$</gav>
31913099
<cpe>cpe:/a:git-scm:git</cpe>
31923100
</suppress>
3193-
<suppress base="true">
3194-
<notes><![CDATA[
3195-
general FP cleanup
3196-
]]></notes>
3197-
<gav regex="true">^org\.eclipse\.jetty\.orbit:org\.apache\.taglibs\.standard\.glassfish:.*$</gav>
3198-
<cpe>cpe:/a:jetty:jetty</cpe>
3199-
<cpe>cpe:/a:eclipse:jetty</cpe>
3200-
</suppress>
3201-
<suppress base="true">
3202-
<notes><![CDATA[
3203-
general FP cleanup
3204-
]]></notes>
3205-
<gav regex="true">^org\.eclipse\.jetty\.orbit:com\.sun\.el:.*$</gav>
3206-
<cpe>cpe:/a:jetty:jetty</cpe>
3207-
<cpe>cpe:/a:eclipse:jetty</cpe>
3208-
</suppress>
32093101
<suppress base="true">
32103102
<notes><![CDATA[
32113103
general FP cleanup: client vs. server mismatch
@@ -4343,15 +4235,6 @@
43434235
<cpe>cpe:/a:akka:akka</cpe>
43444236
<cpe>cpe:/a:lightbend:akka</cpe>
43454237
</suppress>
4346-
<suppress base="true">
4347-
<notes><![CDATA[
4348-
FP per issue #4442; Eclipse Orbit is bundling thirdparty libraries as OSGI bundle, so org.eclipse.jetty.orbit libs
4349-
should not be linked to Jetty
4350-
]]></notes>
4351-
<packageUrl regex="true">^pkg:maven/org\.eclipse\.jetty\.orbit/.*$</packageUrl>
4352-
<cpe>cpe:/a:jetty:jetty</cpe>
4353-
<cpe>cpe:/a:eclipse:jetty</cpe>
4354-
</suppress>
43554238
<suppress base="true">
43564239
<notes><![CDATA[
43574240
FP per issue #4439

0 commit comments

Comments
 (0)