java - 在一定依赖性下抑制OWASP的JAR结果

dependency-check-maven插件正确列出了以下问题：

swagger-codegen-generators-1.0.19.jar: gradle-wrapper.jar: CVE-2016-6199, CVE-2019-16370, CVE-2019-11065, CVE-2019-15052

无论如何，我想抑制gradle-wrapper.jar中swagger-codegen-generators-1.0.19.jar的CVE。

到目前为止我尝试过的是：

<!-- works, but does not restrict to swagger-codegen-generators dependency -->
<suppress>
  <filePath regex="true">.*\bgradle-wrapper\.jar</filePath>
  <cve>CVE-2016-6199</cve>
  <cve>CVE-2019-11065</cve>
  <cve>CVE-2019-15052</cve>
  <cve>CVE-2019-16370</cve>
</suppress>

<!-- does not match, due to other ignored CVEs the gav seems to be correct -->
<suppress>
  <gav regex="true">^io\.swagger\.codegen\.v3:swagger-codegen-generators:.*$</gav>
  <cve>CVE-2016-6199</cve>
  <cve>CVE-2019-11065</cve>
  <cve>CVE-2019-15052</cve>
  <cve>CVE-2019-16370</cve>
</suppress>

<!-- generated from the report; works, but does not restrict to swagger-codegen-generators dependency (sha1 of gradle-wrapper.jar) -->
<suppress>
  <notes><![CDATA[
    file name: swagger-codegen-generators-1.0.19.jar: gradle-wrapper.jar
  ]]></notes>
  <sha1>0f6f1fa2b59ae770ca14f975726bed8d6620ed9b</sha1>
  <cve>CVE-2016-6199</cve>
  <cve>CVE-2019-11065</cve>
  <cve>CVE-2019-15052</cve>
  <cve>CVE-2019-16370</cve>
</suppress>

最佳答案

我可以通过从报告文件target/dependency-check-report.html获得的文件路径来描述它。

<suppress>
  <filePath regex="true">.*\bswagger-codegen-generators.*\bgradle-wrapper\.jar</filePath>
  <cve>CVE-2016-6199</cve>
  <cve>CVE-2019-11065</cve>
  <cve>CVE-2019-15052</cve>
  <cve>CVE-2019-16370</cve>
</suppress>

关于java - 在一定依赖性下抑制OWASP的JAR结果，我们在Stack Overflow上找到一个类似的问题：https://stackoverflow.com/questions/61096524/