Skip to content

Commit 7adce45

Browse files
jeremylongjeremylong
authored
Merge pull request #1149 from aikebah/upstream-issue-1145
Proposed fix for issue #1145
2 parents 781e538 + 518b66b commit 7adce45

File tree

7 files changed

+241
-39
lines changed

7 files changed

+241
-39
lines changed

‎core/src/main/java/org/owasp/dependencycheck/xml/suppression/SuppressionHandler.java

Lines changed: 18 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,8 +18,12 @@
1818
package org.owasp.dependencycheck.xml.suppression;
1919

2020
import java.util.ArrayList;
21+
import java.util.Calendar;
2122
import java.util.List;
2223
import javax.annotation.concurrent.NotThreadSafe;
24+
import javax.xml.bind.DatatypeConverter;
25+
import org.slf4j.Logger;
26+
import org.slf4j.LoggerFactory;
2327
import org.xml.sax.Attributes;
2428
import org.xml.sax.SAXException;
2529
import org.xml.sax.helpers.DefaultHandler;
@@ -32,6 +36,11 @@
3236
@NotThreadSafe
3337
public class SuppressionHandler extends DefaultHandler {
3438

39+
/**
40+
* The logger.
41+
*/
42+
private static final Logger LOGGER = LoggerFactory.getLogger(SuppressionHandler.class);
43+
3544
/**
3645
* The suppress node, indicates the start of a new rule.
3746
*/
@@ -117,6 +126,10 @@ public void startElement(String uri, String localName, String qName, Attributes
117126
} else {
118127
rule.setBase(false);
119128
}
129+
final String until = currentAttributes.getValue("until");
130+
if (until != null) {
131+
rule.setUntil(DatatypeConverter.parseDate(until));
132+
}
120133
}
121134
}
122135

@@ -133,7 +146,11 @@ public void endElement(String uri, String localName, String qName) throws SAXExc
133146
if (null != qName) {
134147
switch (qName) {
135148
case SUPPRESS:
136-
suppressionRules.add(rule);
149+
if (rule.getUntil() != null && rule.getUntil().before(Calendar.getInstance())) {
150+
LOGGER.info("Suppression is expired for rule: {}", rule);
151+
} else {
152+
suppressionRules.add(rule);
153+
}
137154
rule = null;
138155
break;
139156
case FILE_PATH:

‎core/src/main/java/org/owasp/dependencycheck/xml/suppression/SuppressionParser.java

Lines changed: 19 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -51,13 +51,17 @@ public class SuppressionParser {
5151
*/
5252
private static final Logger LOGGER = LoggerFactory.getLogger(SuppressionParser.class);
5353
/**
54-
* The suppression schema file location.
54+
* The suppression schema file location for v 1.2
5555
*/
56-
public static final String SUPPRESSION_SCHEMA = "schema/dependency-suppression.1.1.xsd";
56+
public static final String SUPPRESSION_SCHEMA_1_2 = "schema/dependency-suppression.1.2.xsd";
5757
/**
58-
* The old suppression schema file location.
58+
* The suppression schema file location for v1.1.
5959
*/
60-
private static final String OLD_SUPPRESSION_SCHEMA = "schema/suppression.xsd";
60+
public static final String SUPPRESSION_SCHEMA_1_1 = "schema/dependency-suppression.1.1.xsd";
61+
/**
62+
* The old suppression schema file location for v1.0.
63+
*/
64+
private static final String SUPPRESSION_SCHEMA_1_0 = "schema/suppression.xsd";
6165

6266
/**
6367
* Parses the given XML file and returns a list of the suppression rules
@@ -68,19 +72,11 @@ public class SuppressionParser {
6872
* @throws SuppressionParseException thrown if the XML file cannot be parsed
6973
*/
7074
public List<SuppressionRule> parseSuppressionRules(File file) throws SuppressionParseException {
71-
try {
72-
try (FileInputStream fis = new FileInputStream(file)) {
73-
return parseSuppressionRules(fis);
74-
} catch (IOException ex) {
75-
LOGGER.debug("", ex);
76-
throw new SuppressionParseException(ex);
77-
}
78-
} catch (SAXException ex) {
79-
try (FileInputStream fis = new FileInputStream(file)) {
80-
return parseSuppressionRules(fis, OLD_SUPPRESSION_SCHEMA);
81-
} catch (SAXException | IOException ex1) {
82-
throw new SuppressionParseException(ex);
83-
}
75+
try (FileInputStream fis = new FileInputStream(file)) {
76+
return parseSuppressionRules(fis);
77+
} catch (SAXException | IOException ex) {
78+
LOGGER.debug("", ex);
79+
throw new SuppressionParseException(ex);
8480
}
8581
}
8682

@@ -94,23 +90,13 @@ public List<SuppressionRule> parseSuppressionRules(File file) throws Suppression
9490
* @throws SAXException thrown if the XML cannot be parsed
9591
*/
9692
public List<SuppressionRule> parseSuppressionRules(InputStream inputStream) throws SuppressionParseException, SAXException {
97-
return parseSuppressionRules(inputStream, SUPPRESSION_SCHEMA);
98-
}
99-
100-
/**
101-
* Parses the given XML stream and returns a list of the suppression rules
102-
* contained.
103-
*
104-
* @param inputStream an InputStream containing suppression rules
105-
* @param schema the schema used to validate the XML stream
106-
* @return a list of suppression rules
107-
* @throws SuppressionParseException thrown if the XML cannot be parsed
108-
* @throws SAXException thrown if the XML cannot be parsed
109-
*/
110-
private List<SuppressionRule> parseSuppressionRules(InputStream inputStream, String schema) throws SuppressionParseException, SAXException {
111-
try (InputStream schemaStream = FileUtils.getResourceAsStream(schema)) {
93+
try (
94+
InputStream schemaStream12 = FileUtils.getResourceAsStream(SUPPRESSION_SCHEMA_1_2);
95+
InputStream schemaStream11 = FileUtils.getResourceAsStream(SUPPRESSION_SCHEMA_1_1);
96+
InputStream schemaStream10 = FileUtils.getResourceAsStream(SUPPRESSION_SCHEMA_1_0);
97+
) {
11298
final SuppressionHandler handler = new SuppressionHandler();
113-
final SAXParser saxParser = XmlUtils.buildSecureSaxParser(schemaStream);
99+
final SAXParser saxParser = XmlUtils.buildSecureSaxParser(schemaStream12, schemaStream11, schemaStream10);
114100
final XMLReader xmlReader = saxParser.getXMLReader();
115101
xmlReader.setErrorHandler(new SuppressionErrorHandler());
116102
xmlReader.setContentHandler(handler);

‎core/src/main/java/org/owasp/dependencycheck/xml/suppression/SuppressionRule.java

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,11 +18,13 @@
1818
package org.owasp.dependencycheck.xml.suppression;
1919

2020
import java.util.ArrayList;
21+
import java.util.Calendar;
2122
import java.util.HashSet;
2223
import java.util.Iterator;
2324
import java.util.List;
2425
import java.util.Set;
2526
import javax.annotation.concurrent.NotThreadSafe;
27+
import javax.xml.bind.DatatypeConverter;
2628
import org.owasp.dependencycheck.dependency.Dependency;
2729
import org.owasp.dependencycheck.dependency.Identifier;
2830
import org.owasp.dependencycheck.dependency.Vulnerability;
@@ -76,6 +78,30 @@ public class SuppressionRule {
7678
*/
7779
private boolean base;
7880

81+
/**
82+
* A date until which the suppression is to be retained. This can be used
83+
* to make a temporary suppression that auto-expires to suppress a CVE
84+
* while waiting for the vulnerability fix of the dependency to be
85+
* released.
86+
*/
87+
private Calendar until;
88+
89+
/**
90+
* Get the (@code{nullable}) value of until
91+
* @return the value of until
92+
*/
93+
public Calendar getUntil() {
94+
return until;
95+
}
96+
97+
/**
98+
* Set the value of until
99+
* @param until new value of until
100+
*/
101+
public void setUntil(Calendar until) {
102+
this.until = until;
103+
}
104+
79105
/**
80106
* Get the value of filePath.
81107
*
@@ -502,6 +528,9 @@ protected boolean identifierMatches(String identifierType, PropertyType suppress
502528
public String toString() {
503529
final StringBuilder sb = new StringBuilder(64);
504530
sb.append("SuppressionRule{");
531+
if (until != null) {
532+
sb.append("until=").append(DatatypeConverter.printDate(until)).append(',');
533+
}
505534
if (filePath != null) {
506535
sb.append("filePath=").append(filePath).append(',');
507536
}

‎core/src/main/resources/schema/dependency-suppression.1.2.xsd

Lines changed: 66 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<xs:schema id="suppressions"
3+
xmlns:xs="http://www.w3.org/2001/XMLSchema"
4+
elementFormDefault="qualified"
5+
targetNamespace="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.2.xsd"
6+
xmlns:dc="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.2.xsd">
7+
8+
<xs:complexType name="regexStringType">
9+
<xs:simpleContent>
10+
<xs:extension base="xs:string">
11+
<xs:attribute name="regex" use="optional" type="xs:boolean" default="false"/>
12+
<xs:attribute name="caseSensitive" use="optional" type="xs:boolean" default="false"/>
13+
</xs:extension>
14+
</xs:simpleContent>
15+
</xs:complexType>
16+
<xs:simpleType name="cvssScoreType">
17+
<xs:restriction base="xs:decimal">
18+
<xs:minInclusive value="0"/>
19+
<xs:maxInclusive value="10"/>
20+
</xs:restriction>
21+
</xs:simpleType>
22+
<xs:simpleType name="cveType">
23+
<xs:restriction base="xs:string">
24+
<xs:pattern value="((\w+\-)?CVE\-\d\d\d\d\-\d+|\d+)"/>
25+
</xs:restriction>
26+
</xs:simpleType>
27+
<xs:simpleType name="sha1Type">
28+
<xs:restriction base="xs:string">
29+
<xs:pattern value="[a-fA-F0-9]{40}"/>
30+
</xs:restriction>
31+
</xs:simpleType>
32+
<xs:element name="suppressions">
33+
<xs:complexType>
34+
<xs:sequence minOccurs="0" maxOccurs="unbounded">
35+
<xs:element name="suppress">
36+
<xs:complexType>
37+
<xs:sequence minOccurs="1" maxOccurs="1">
38+
<xs:sequence minOccurs="0" maxOccurs="1">
39+
<xs:element name="notes" type="xs:string"/>
40+
</xs:sequence>
41+
<xs:choice minOccurs="0" maxOccurs="1">
42+
<xs:element name="filePath" type="dc:regexStringType"/>
43+
<xs:element name="sha1" type="dc:sha1Type"/>
44+
<xs:element name="gav" type="dc:regexStringType"/>
45+
</xs:choice>
46+
<xs:choice minOccurs="1" maxOccurs="unbounded">
47+
<xs:element name="cpe" type="dc:regexStringType"/>
48+
<xs:element name="cve" type="dc:cveType"/>
49+
<xs:element name="cwe" type="xs:positiveInteger"/>
50+
<xs:element name="cvssBelow" type="dc:cvssScoreType"/>
51+
</xs:choice>
52+
</xs:sequence>
53+
<xs:attribute name="base" use="optional" type="xs:boolean" default="false"/>
54+
<xs:attribute name="until" use="optional" type="xs:date">
55+
<xs:annotation>
56+
<xs:documentation>
57+
When specified the suppression will only be active when the specified date is still in the future. On and after the 'until' date the suppression will no longer be active.
58+
</xs:documentation>
59+
</xs:annotation>
60+
</xs:attribute>
61+
</xs:complexType>
62+
</xs:element>
63+
</xs:sequence>
64+
</xs:complexType>
65+
</xs:element>
66+
</xs:schema>

‎core/src/test/java/org/owasp/dependencycheck/xml/suppression/SuppressionParserTest.java

Lines changed: 26 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -19,8 +19,7 @@
1919

2020
import java.io.File;
2121
import java.util.List;
22-
23-
import static org.junit.Assert.assertTrue;
22+
import org.junit.Assert;
2423

2524
import org.junit.Test;
2625
import org.owasp.dependencycheck.BaseTest;
@@ -33,14 +32,36 @@
3332
public class SuppressionParserTest extends BaseTest {
3433

3534
/**
36-
* Test of parseSuppressionRules method, of class SuppressionParser.
35+
* Test of parseSuppressionRules method, of class SuppressionParser for the v1.0 suppressions XML Schema.
3736
*/
3837
@Test
39-
public void testParseSuppressionRules() throws Exception {
38+
public void testParseSuppressionRulesV1dot0() throws Exception {
4039
//File file = new File(this.getClass().getClassLoader().getResource("suppressions.xml").getPath());
4140
File file = BaseTest.getResourceAsFile(this, "suppressions.xml");
4241
SuppressionParser instance = new SuppressionParser();
4342
List<SuppressionRule> result = instance.parseSuppressionRules(file);
44-
assertTrue(result.size() > 3);
43+
Assert.assertEquals(5, result.size());
44+
}
45+
/**
46+
* Test of parseSuppressionRules method, of class SuppressionParser for the v1.1 suppressions XML Schema.
47+
*/
48+
@Test
49+
public void testParseSuppressionRulesV1dot1() throws Exception {
50+
//File file = new File(this.getClass().getClassLoader().getResource("suppressions.xml").getPath());
51+
File file = BaseTest.getResourceAsFile(this, "suppressions_1_1.xml");
52+
SuppressionParser instance = new SuppressionParser();
53+
List<SuppressionRule> result = instance.parseSuppressionRules(file);
54+
Assert.assertEquals(5, result.size());
55+
}
56+
/**
57+
* Test of parseSuppressionRules method, of class SuppressionParser for the v1.2 suppressions XML Schema.
58+
*/
59+
@Test
60+
public void testParseSuppressionRulesV1dot2() throws Exception {
61+
//File file = new File(this.getClass().getClassLoader().getResource("suppressions.xml").getPath());
62+
File file = BaseTest.getResourceAsFile(this, "suppressions_1_2.xml");
63+
SuppressionParser instance = new SuppressionParser();
64+
List<SuppressionRule> result = instance.parseSuppressionRules(file);
65+
Assert.assertEquals(4, result.size());
4566
}
4667
}

‎core/src/test/resources/suppressions_1_1.xml

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<suppressions
3+
xmlns:xsi='http://www.w3.org/2001/XMLSchema-instance'
4+
xmlns='https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.1.xsd'
5+
xsi:schemaLocation='https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.1.xsd'>
6+
<suppress>
7+
<notes><![CDATA[
8+
This suppresses cpe:/a:csv:csv:1.0 for some.jar in the "c:\path\to" directory.
9+
]]></notes>
10+
<filePath>c:\path\to\some.jar</filePath>
11+
<cpe>cpe:/a:csv:csv:1.0</cpe>
12+
</suppress>
13+
<suppress base="true">
14+
<notes><![CDATA[
15+
This suppresses any jboss:jboss cpe for any test.jar in any directory.
16+
]]></notes>
17+
<filePath regex="true">.*\btest\.jar</filePath>
18+
<cpe>cpe:/a:jboss:jboss</cpe>
19+
</suppress>
20+
<suppress>
21+
<notes><![CDATA[
22+
This suppresses a specific cve for any test.jar in any directory.
23+
]]></notes>
24+
<filePath regex="true">.*\btest\.jar</filePath>
25+
<cve>CVE-2013-1337</cve>
26+
</suppress>
27+
<suppress>
28+
<notes><![CDATA[
29+
This suppresses a specific cve for any dependency in any directory that has the specified sha1 checksum.
30+
]]></notes>
31+
<sha1>384FAA82E193D4E4B0546059CA09572654BC3970</sha1>
32+
<cve>CVE-2013-1337</cve>
33+
</suppress>
34+
<suppress>
35+
<notes><![CDATA[
36+
This suppresses all CVE entries that have a score below CVSS 7.
37+
]]></notes>
38+
<cvssBelow>7</cvssBelow>
39+
</suppress>
40+
</suppressions>

‎core/src/test/resources/suppressions_1_2.xml

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<suppressions
3+
xmlns:xsi='http://www.w3.org/2001/XMLSchema-instance'
4+
xmlns='https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.2.xsd'
5+
xsi:schemaLocation='https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.2.xsd'>
6+
<suppress>
7+
<notes><![CDATA[
8+
This suppresses cpe:/a:csv:csv:1.0 for some.jar in the "c:\path\to" directory.
9+
]]></notes>
10+
<filePath>c:\path\to\some.jar</filePath>
11+
<cpe>cpe:/a:csv:csv:1.0</cpe>
12+
</suppress>
13+
<suppress base="true">
14+
<notes><![CDATA[
15+
This suppresses any jboss:jboss cpe for any test.jar in any directory.
16+
]]></notes>
17+
<filePath regex="true">.*\btest\.jar</filePath>
18+
<cpe>cpe:/a:jboss:jboss</cpe>
19+
</suppress>
20+
<suppress>
21+
<notes><![CDATA[
22+
This suppresses a specific cve for any test.jar in any directory.
23+
]]></notes>
24+
<filePath regex="true">.*\btest\.jar</filePath>
25+
<cve>CVE-2013-1337</cve>
26+
</suppress>
27+
<suppress until="2014-01-01Z">
28+
<notes><![CDATA[
29+
This suppresses a specific cve for any dependency in any directory that has the specified sha1 checksum. If current date is not yet on or beyond 1 Jan 2014
30+
]]></notes>
31+
<sha1>384FAA82E193D4E4B0546059CA09572654BC3970</sha1>
32+
<cve>CVE-2013-1337</cve>
33+
</suppress>
34+
<suppress until="9999-03-25Z">
35+
<notes><![CDATA[
36+
This suppresses all CVE entries that have a score below CVSS 7.
37+
But only if current date is not yet on or beyond 31 Dec 9999
38+
(which is expected to be sufficiently far in the future to have this
39+
rule still be active when the test-cases run)
40+
]]></notes>
41+
<cvssBelow>7</cvssBelow>
42+
</suppress>
43+
</suppressions>

0 commit comments

Comments
 (0)