From 2e24eda00d5ede79cb1d6472cc1491532cb42615 Mon Sep 17 00:00:00 2001 From: Jeremy Long Date: Wed, 14 May 2014 19:17:47 -0400 Subject: [PATCH] fixed false positives related to Apache POI and MS Office CPE/CVE per issue #126 Former-commit-id: 8cc26dc25ef613dd308388452c08a9f5852843ad --- .../dependencycheck/analyzer/FalsePositiveAnalyzer.java | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/FalsePositiveAnalyzer.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/FalsePositiveAnalyzer.java index 29acf74df..76078e19c 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/FalsePositiveAnalyzer.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/FalsePositiveAnalyzer.java @@ -250,6 +250,14 @@ public class FalsePositiveAnalyzer extends AbstractAnalyzer { || dependency.getFileName().toLowerCase().endsWith(".dll") || dependency.getFileName().toLowerCase().endsWith(".exe"))) { itr.remove(); + } else if ((i.getValue().startsWith("cpe:/a:microsoft:excel") + || i.getValue().startsWith("cpe:/a:microsoft:word") + || i.getValue().startsWith("cpe:/a:microsoft:visio") + || i.getValue().startsWith("cpe:/a:microsoft:powerpoint") + || i.getValue().startsWith("cpe:/a:microsoft:office")) + && (dependency.getFileName().toLowerCase().endsWith(".jar") + || dependency.getFileName().toLowerCase().endsWith("pom.xml"))) { + itr.remove(); } else if (i.getValue().startsWith("cpe:/a:apache:maven") && !dependency.getFileName().toLowerCase().matches("maven-core-[\\d\\.]+\\.jar")) { itr.remove();