open-telemetry
/
opentelemetry-java-contrib
mirror of https://github.com/open-telemetry/opentelemetry-java-contrib.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Suppress false positive OWASP violation (#1705)

This commit is contained in:
Trask Stalnaker 2025-02-06 19:19:00 -08:00 committed by GitHub
parent 01f7d32de6
commit 5cdcd59fcd
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
2 changed files with 14 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
buildSrc/src/main/kotlin/otel.java-conventions.gradle.kts
View File

@ -192,6 +192,7 @@ afterEvaluate {
dependencyCheck { dependencyCheck {
scanConfigurations = mutableListOf("runtimeClasspath") scanConfigurations = mutableListOf("runtimeClasspath")
suppressionFile = "buildscripts/dependency-check-suppressions.xml"
failBuildOnCVSS = 7.0f // fail on high or critical CVE failBuildOnCVSS = 7.0f // fail on high or critical CVE
nvd.apiKey = System.getenv("NVD_API_KEY") nvd.apiKey = System.getenv("NVD_API_KEY")
nvd.delay = 3500 // until next dependency check release (https://github.com/jeremylong/DependencyCheck/pull/6333) nvd.delay = 3500 // until next dependency check release (https://github.com/jeremylong/DependencyCheck/pull/6333)

13
buildscripts/dependency-check-suppressions.xml Normal file
View File

@ -0,0 +1,13 @@
<?xml version="1.0" encoding="UTF-8"?>
<suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">
<suppress>
<!-- this package is misidentified by OWASP as an Android app named "Wire" -->
<packageUrl regex="true">^pkg:maven/com\.squareup\.wire/wire-runtime-jvm@.*$</packageUrl>
<cpe>cpe:/a:wire:wire</cpe>
</suppress>
<suppress>
<!-- this package is misidentified by OWASP as Prometheus server -->
<packageUrl regex="true">^pkg:maven/io\.opentelemetry/opentelemetry-exporter-prometheus@.*$</packageUrl>
<cpe>cpe:/a:prometheus:prometheus</cpe>
</suppress>
</suppressions>