Skip to content

Vulnerability description is used as vulnerability name #8402

@GunoH

Description

@GunoH

Precondition

  • I checked the issues list for existing open or closed reports of the same problem.

Describe the bug
For some specific vulnerabilities, it seems that Dependency Check uses the description of the vulnerability as vulnerability name. This looks pretty strange in the logs and reports (for org.springdoc:springdoc-openapi-starter-webmvc-ui:2.8.6):

Image

What's worse though, is that I cannot seem to suppress these vulnerabilities. Using the suppress button gives me an xml fragment with a multiline value for vulnerabilityName, which leads to parse errors at runtime, like for example:

Unable to parse suppression xml file 'suppressions.xml'
org.owasp.dependencycheck.xml.suppression.SuppressionParseException: org.xml.sax.SAXException: Line=33, Column=570: Open quote is expected for attribute "onclick" associated with an element type "img".

Version of dependency-check used
The problem occurs using version 12.2.0 of the gradle plugin.

Log file
https://gist.github.com/GunoH/ed48f53331da655658d640f07cd80932

To Reproduce
Steps to reproduce the behavior:

  1. Clone https://github.com/GunoH/dependency-check-suppressions.
  2. Run dependencyCheckAnalyze.
  3. Have a look at the logs and the html report.
  4. Add suppression using xml fragment from suppress button.
  5. Run dependencyCheckAnalyze again.

Expected behavior

  • Vulnerability name concise instead of unbounded
  • The suppress button gives me usable xml

Metadata

Metadata

Assignees

Labels

Type

Projects

No projects

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions