diff --git a/src/site/markdown/suppression.md b/src/site/markdown/suppression.md index c50e11196..5d10a6dc5 100644 --- a/src/site/markdown/suppression.md +++ b/src/site/markdown/suppression.md @@ -18,6 +18,55 @@ A sample suppression file would look like: ``` The above XML file will suppress the cpe:/a:apache:struts:2.0.0 from any file with the a matching SHA1 hash. +The following shows some other ways to suppress individual findings. Note the ways to select files using either +the sha1 hash or the filePath (the filePath can also be a regex). Additionally, there are several things that +can be suppressed - individual CPEs, individual CVEs, or all CVE entries below a specified CVSS score. The most common +would be suppressing CPEs based off of SHA1 hashes or filePath (regexes) - these entries can be generated using the +HTML version of the report. The other common scenario would be to ignore all CVEs below a certain CVSS threshold. + +```xml + + + + + c:\path\to\some.jar + cpe:/a:csv:csv:1.0 + + + + .*\btest\.jar + cpe:/a:jboss:jboss + + + + .*\btest\.jar + CVE-2013-1337 + + + + 384FAA82E193D4E4B0546059CA09572654BC3970 + CVE-2013-1337 + + + + 7 + + +``` + The full schema for suppression files can be found here: [suppression.xsd](https://github.com/jeremylong/DependencyCheck/blob/master/dependency-check-core/src/main/resources/schema/suppression.xsd "Suppression Schema") Please see the appropriate configuration option in each interfaces configuration guide: