Suppress warnings for compile only dependencies. Fail build on CVSS o…

…ver 7
cedar-policy · Nov 8, 2023 · 601ed3a · 601ed3a
1 parent 149a47d
commit 601ed3a
Show file tree

Hide file tree

Showing 3 changed files with 73 additions and 14 deletions.
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -48,12 +48,4 @@ jobs:
         with:
           project: 'CedarJava'
           path: 'CedarJava'
-          format: 'HTML'
-          args: >
-            --failOnCVSS 7
-            --enableRetired
-      - name: Upload Test results
-        uses: actions/upload-artifact@master
-        with:
-           name: Depcheck report
-           path: ${{github.workspace}}/reports
+          format: 'HTML'
diff --git a/CedarJava/build.gradle b/CedarJava/build.gradle
@@ -38,6 +38,13 @@ apply plugin: 'com.github.spotbugs'
 
 apply plugin: 'org.owasp.dependencycheck'
 
+check.dependsOn dependencyCheckAnalyze
+dependencyCheck {
+    format='HTML'
+    failBuildOnCVSS=7
+    suppressionFile='suppressions.xml'
+}
+
 /*
  Configures the JaCoCo "jacoco" plugin. Remove this if you want to skip
  these checks and report generation.
@@ -70,12 +77,12 @@ repositories {
 dependencies {
     // Do not upgrade to Jackson 3.x without addressing stack overflow issues in ValueCedarDeserializer
     // The upgrade should be reviewed by AppSec
-    implementation 'com.fasterxml.jackson.core:jackson-databind:2.15.0'
-    implementation 'com.fasterxml.jackson.datatype:jackson-datatype-jdk8:2.15.0'
-    implementation 'org.slf4j:slf4j-api:2.0.7'
+    implementation 'com.fasterxml.jackson.core:jackson-databind:2.15.3'
+    implementation 'com.fasterxml.jackson.datatype:jackson-datatype-jdk8:2.15.3'
+    implementation 'org.slf4j:slf4j-api:2.0.9'
     implementation 'org.apache.commons:commons-text:1.10.0'
-    implementation 'org.apache.logging.log4j:log4j-core:2.20.0'
-    implementation 'org.apache.logging.log4j:log4j-to-slf4j:2.20.0'
+    implementation 'org.apache.logging.log4j:log4j-core:2.21.1'
+    implementation 'org.apache.logging.log4j:log4j-to-slf4j:2.21.1'
     implementation 'com.google.guava:guava:32.1.3-jre'
 
     compileOnly 'com.google.code.findbugs:findbugs:3.0.1'

diff --git a/CedarJava/suppressions.xml b/CedarJava/suppressions.xml
@@ -0,0 +1,60 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!-- These are for compile time only dependencies (mostly spotbugs and findbugs) -->
+<suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">
+   <suppress>
+      <notes><![CDATA[
+      file name: AppleJavaExtensions-1.4.jar
+      ]]></notes>
+      <packageUrl regex="true">^pkg:maven/com\.apple/AppleJavaExtensions@.*$</packageUrl>
+      <cpe>cpe:/a:apple:java</cpe>
+   </suppress>
+   <suppress>
+      <notes><![CDATA[
+      file name: bcel-findbugs-6.0.jar
+      ]]></notes>
+      <packageUrl regex="true">^pkg:maven/com\.google\.code\.findbugs/bcel\-findbugs@.*$</packageUrl>
+      <cpe>cpe:/a:apache:commons_bcel</cpe>
+   </suppress>
+   <suppress>
+      <notes><![CDATA[
+      file name: bcel-6.5.0.jar
+      ]]></notes>
+      <packageUrl regex="true">^pkg:maven/org\.apache\.bcel/bcel@.*$</packageUrl>
+      <cpe>cpe:/a:apache:commons_bcel</cpe>
+   </suppress>
+   <suppress>
+      <notes><![CDATA[
+      file name: dom4j-1.6.1.jar
+      ]]></notes>
+      <packageUrl regex="true">^pkg:maven/dom4j/dom4j@.*$</packageUrl>
+      <cpe>cpe:/a:dom4j_project:dom4j</cpe>
+   </suppress>
+   <suppress>
+      <notes><![CDATA[
+      file name: dom4j-2.1.3.jar
+      ]]></notes>
+      <packageUrl regex="true">^pkg:maven/org\.dom4j/dom4j@.*$</packageUrl>
+      <cpe>cpe:/a:dom4j_project:dom4j</cpe>
+   </suppress>
+   <suppress>
+        <notes><![CDATA[
+        file name: bcel-6.5.0.jar
+        ]]></notes>
+        <packageUrl regex="true">^pkg:maven/org\.apache\.bcel/bcel@.*$</packageUrl>
+        <vulnerabilityName>CVE-2022-42920</vulnerabilityName>
+    </suppress>
+    <suppress>
+        <notes><![CDATA[
+        file name: dom4j-1.6.1.jar
+        ]]></notes>
+        <packageUrl regex="true">^pkg:maven/dom4j/dom4j@.*$</packageUrl>
+        <vulnerabilityName>CVE-2020-10683</vulnerabilityName>
+    </suppress>
+    <suppress>
+        <notes><![CDATA[
+        file name: dom4j-1.6.1.jar
+        ]]></notes>
+        <packageUrl regex="true">^pkg:maven/dom4j/dom4j@.*$</packageUrl>
+        <vulnerabilityName>CVE-2018-1000632</vulnerabilityName>
+    </suppress>
+</suppressions>