diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/FalsePositiveAnalyzer.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/FalsePositiveAnalyzer.java index 29acf74df..76078e19c 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/FalsePositiveAnalyzer.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/FalsePositiveAnalyzer.java @@ -250,6 +250,14 @@ public class FalsePositiveAnalyzer extends AbstractAnalyzer { || dependency.getFileName().toLowerCase().endsWith(".dll") || dependency.getFileName().toLowerCase().endsWith(".exe"))) { itr.remove(); + } else if ((i.getValue().startsWith("cpe:/a:microsoft:excel") + || i.getValue().startsWith("cpe:/a:microsoft:word") + || i.getValue().startsWith("cpe:/a:microsoft:visio") + || i.getValue().startsWith("cpe:/a:microsoft:powerpoint") + || i.getValue().startsWith("cpe:/a:microsoft:office")) + && (dependency.getFileName().toLowerCase().endsWith(".jar") + || dependency.getFileName().toLowerCase().endsWith("pom.xml"))) { + itr.remove(); } else if (i.getValue().startsWith("cpe:/a:apache:maven") && !dependency.getFileName().toLowerCase().matches("maven-core-[\\d\\.]+\\.jar")) { itr.remove();