From 3bd952e5c543d8420ddc79145b199ac6c4976deb Mon Sep 17 00:00:00 2001 From: Jeremy Long Date: Wed, 15 Jan 2014 20:43:09 -0500 Subject: [PATCH] added information on suppressing false positives to the site Former-commit-id: 84c0f3175c7a749bc2d5fe05d7b4e4d23a518fab --- .../src/site/markdown/configuration.md | 2 +- .../src/site/markdown/arguments.md | 2 +- .../main/resources/templates/HtmlReport.vsl | 2 ++ .../src/site/markdown/configuration.md | 14 +++++----- src/site/markdown/suppression.md | 28 +++++++++++++++++++ src/site/site.xml | 5 ++++ 6 files changed, 44 insertions(+), 9 deletions(-) create mode 100644 src/site/markdown/suppression.md diff --git a/dependency-check-ant/src/site/markdown/configuration.md b/dependency-check-ant/src/site/markdown/configuration.md index 018c919d7..ef1616118 100644 --- a/dependency-check-ant/src/site/markdown/configuration.md +++ b/dependency-check-ant/src/site/markdown/configuration.md @@ -29,7 +29,7 @@ FailBuildOn | If set and a CVE is found that is greater then the speci AutoUpdate | If set to false the NVD CVE data is not automatically updated. Setting this to false could result in false negatives. However, this may be required in some environments. The default value is true. | Optional DataDirectory | The directory where dependency-check will store data used for analysis. Defaults to a folder called, called 'dependency-check-data', that is in the same directory as the dependency-check-ant jar file was installed in. *It is not recommended to change this.* | Optional LogFile | The file path to write verbose logging information. | Optional -SuppressionFile | An XML file conforming to the suppression schema that suppresses findings; this is used to hide false positives. | Optional +SuppressionFile | An XML file conforming to the suppression schema that suppresses findings; this is used to hide [false positives](../suppression.html). | Optional ProxyUrl | Defines the proxy used to connect to the Internet. | Optional ProxyPort | Defines the port for the proxy. | Optional ProxyUsername | Defines the proxy user name. | Optional diff --git a/dependency-check-cli/src/site/markdown/arguments.md b/dependency-check-cli/src/site/markdown/arguments.md index 4a8890867..aa8708ed2 100644 --- a/dependency-check-cli/src/site/markdown/arguments.md +++ b/dependency-check-cli/src/site/markdown/arguments.md @@ -17,6 +17,6 @@ Short | Argument Name | Parameter | Description | Requirement \-pp | \-\-proxypass | \ | The proxy password to use when downloading resources. | Optional \-pu | \-\-proxyuser | \ | The proxy username to use when downloading resources. | Optional \-s | \-\-scan | \ | The path to scan \- this option can be specified multiple times. | - \-sf | \-\-suppression | \ | The file path to the suppression XML file. | Optional + \-sf | \-\-suppression | \ | The file path to the suppression XML file; used to suppress [false positives](../suppression.html). | Optional \-u | \-\-proxyurl | \ | The proxy url to use when downloading resources. | Optional \-v | \-\-version | | Print the version information. | Optional \ No newline at end of file diff --git a/dependency-check-core/src/main/resources/templates/HtmlReport.vsl b/dependency-check-core/src/main/resources/templates/HtmlReport.vsl index 99a18deb1..ec94cd73a 100644 --- a/dependency-check-core/src/main/resources/templates/HtmlReport.vsl +++ b/dependency-check-core/src/main/resources/templates/HtmlReport.vsl @@ -548,8 +548,10 @@ Copyright (c) 2012 Jeremy Long. All Rights Reserved. #else
  • $esc.html($id.type): $esc.html($id.value) #end + #if ($id.type=="cpe") ##yes, we are HTML Encoding into JavaScript... the escape utils don't have a JS Encode and I haven't written one yet    + #end #if( $id.description )
    $esc.html($id.description) #end diff --git a/dependency-check-maven/src/site/markdown/configuration.md b/dependency-check-maven/src/site/markdown/configuration.md index 642d756de..2cb0c023d 100644 --- a/dependency-check-maven/src/site/markdown/configuration.md +++ b/dependency-check-maven/src/site/markdown/configuration.md @@ -8,10 +8,10 @@ autoUpdate | Sets whether auto-updating of the NVD CVE/CPE data is enab externalReport | When using as a Site plugin this parameter sets whether or not the external report format should be used. | false failBuildOnCVSS | Specifies if the build should be failed if a CVSS score above a specified level is identified. The default is 11 which means since the CVSS scores are 0-10, by default the build will never fail. | 11 format | The report format to be generated (HTML, XML, VULN, ALL). This configuration option has no affect if using this within the Site plugin unless the externalReport is set to true. | HTML -logFile | The file path to write verbose logging information. | -suppressionFile | The file path to the XML suppression file \- used to support suppressing false positives | -connectionTimeout | The Connection Timeout. | -proxyUrl | The Proxy URL. | -proxyPort | The Proxy Port. | -proxyUsername | Defines the proxy user name. | -proxyPassword | Defines the proxy password. | +logFile | The file path to write verbose logging information. | +suppressionFile | The file path to the XML suppression file \- used to suppress [false positives](../suppression.html) | +connectionTimeout | The Connection Timeout. | +proxyUrl | The Proxy URL. | +proxyPort | The Proxy Port. | +proxyUsername | Defines the proxy user name. | +proxyPassword | Defines the proxy password. | diff --git a/src/site/markdown/suppression.md b/src/site/markdown/suppression.md new file mode 100644 index 000000000..c50e11196 --- /dev/null +++ b/src/site/markdown/suppression.md @@ -0,0 +1,28 @@ +Suppressing False Positives +==================== +Due to how dependency-check identifies libraries false positives may occur (a CPE was identified that is incorrect). Suppressing these false positives is fairly easy using the HTML report. In the report next to each CPE identified (and on CVE entries) there is a suppress button. Clicking the suppression button will create a dialogue box which you can simple hit Control-C to copy the XML that you would place into a suppression XML file. If this is the first time you are creating the suppression file you should click the "Complete XML Doc" button on the top of the dialogue box to add the necessary schema elements. + +A sample suppression file would look like: + +```xml + + + + + 66734244CE86857018B023A8C56AE0635C56B6A1 + cpe:/a:apache:struts:2.0.0 + + +``` +The above XML file will suppress the cpe:/a:apache:struts:2.0.0 from any file with the a matching SHA1 hash. + +The full schema for suppression files can be found here: [suppression.xsd](https://github.com/jeremylong/DependencyCheck/blob/master/dependency-check-core/src/main/resources/schema/suppression.xsd "Suppression Schema") + +Please see the appropriate configuration option in each interfaces configuration guide: + +- [Command Line Tool](dependency-check-cli/arguments.html) +- [Maven Plugin](dependency-check-maven/configuration.html) +- [Ant Task](dependency-check-ant/configuration.html) +- [Jenkins Plugin](dependency-check-jenkins/index.html) diff --git a/src/site/site.xml b/src/site/site.xml index d237582c5..105c3519e 100644 --- a/src/site/site.xml +++ b/src/site/site.xml @@ -57,6 +57,11 @@ Copyright (c) 2013 Jeremy Long. All Rights Reserved. + + + Suppressing False Positives + + The core dependency-check library