Skip to content
This repository was archived by the owner on Sep 27, 2025. It is now read-only.

Commit b6c5ec3

Browse files
jeremylongjeremylong
authored
fix: allow hosted suppressions file to be disabled (#5509)
1 parent c0b2c0b commit b6c5ec3

File tree

16 files changed

+82
-23
lines changed

16 files changed

+82
-23
lines changed

‎ant/src/main/java/org/owasp/dependencycheck/taskdefs/Update.java‎

Lines changed: 23 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -109,9 +109,13 @@ public class Update extends Purge {
109109
*/
110110
private Integer hostedSuppressionsValidForHours;
111111
/**
112-
* Whether or not the hosted suppressions file will be updated regardless of the `autoupdate` settings. Defaults to false.
112+
* Whether the hosted suppressions file will be updated regardless of the `autoupdate` settings. Defaults to false.
113113
*/
114114
private Boolean hostedSuppressionsForceUpdate;
115+
/**
116+
* Whether the hosted suppressions file will be used. Defaults to true.
117+
*/
118+
private Boolean hostedSuppressionsEnabled;
115119

116120
/**
117121
* Specify the first year of NVD CVE data to download; default is 2002.
@@ -475,6 +479,23 @@ public void setHostedSuppressionsForceUpdate(final Boolean hostedSuppressionsFor
475479
this.hostedSuppressionsForceUpdate = hostedSuppressionsForceUpdate;
476480
}
477481

482+
/**
483+
* Get the value of hostedSuppressionsEnabled.
484+
*
485+
* @return the value of hostedSuppressionsEnabled
486+
*/
487+
public Boolean isHostedSuppressionsEnabled() {
488+
return hostedSuppressionsEnabled;
489+
}
490+
/**
491+
* Set the value of hostedSuppressionsEnabled.
492+
*
493+
* @param hostedSuppressionsEnabled new value of hostedSuppressionsEnabled
494+
*/
495+
public void setHostedSuppressionsEnabled(Boolean hostedSuppressionsEnabled) {
496+
this.hostedSuppressionsEnabled = hostedSuppressionsEnabled;
497+
}
498+
478499
/**
479500
* Executes the update by initializing the settings, downloads the NVD XML
480501
* data, and then processes the data storing it in the local database.
@@ -539,6 +560,7 @@ protected void populateSettings() throws BuildException {
539560
getSettings().setIntIfNotNull(Settings.KEYS.CVE_START_YEAR, cveStartYear);
540561
getSettings().setIntIfNotNull(Settings.KEYS.HOSTED_SUPPRESSIONS_VALID_FOR_HOURS, hostedSuppressionsValidForHours);
541562
getSettings().setBooleanIfNotNull(Settings.KEYS.HOSTED_SUPPRESSIONS_FORCEUPDATE, hostedSuppressionsForceUpdate);
563+
getSettings().setBooleanIfNotNull(Settings.KEYS.HOSTED_SUPPRESSIONS_ENABLED, hostedSuppressionsEnabled);
542564
if (cveValidForHours != null) {
543565
if (cveValidForHours >= 0) {
544566
getSettings().setInt(Settings.KEYS.CVE_CHECK_VALID_FOR_HOURS, cveValidForHours);

‎ant/src/site/markdown/config-update.md‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,7 @@ databaseDriverPath | The path to the database driver JAR file; only used if th
4545
connectionString | The connection string used to connect to the database. See using a [database server](../data/database.html). |  
4646
databaseUser | The username used when connecting to the database. |  
4747
databasePassword | The password used when connecting to the database. |  
48-
hostedSuppressionsUrl | The URL to a mirrored copy of the hosted suppressions file for internet-constrained environments | https://jeremylong.github.io/DependencyCheck/suppressions/publishedSuppressions.xml
49-
hostedSuppressionsValidForHours | Sets the number of hours to wait before checking for new updates of the hosted suppressions file | 2
48+
hostedSuppressionsEnabled | Whether the hosted suppression file will be used. | true
49+
hostedSuppressionsUrl | The URL to a mirrored copy of the hosted suppressions file for internet-constrained environments | https://jeremylong.github.io/DependencyCheck/suppressions/publishedSuppressions.xml
50+
hostedSuppressionsValidForHours | Sets the number of hours to wait before checking for new updates of the hosted suppressions file | 2
5051
hostedSuppressionsForceUpdate | Sets whether the hosted suppressions file should update regardless of the `autoupdate` and validForHours settings | false

‎ant/src/site/markdown/configuration.md‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -154,6 +154,7 @@ databaseDriverPath | The path to the database driver JAR file; only used if th
154154
connectionString | The connection string used to connect to the database. See using a [database server](../data/database.html). |  
155155
databaseUser | The username used when connecting to the database. |  
156156
databasePassword | The password used when connecting to the database. |  
157-
hostedSuppressionsUrl | The URL to a mirrored copy of the hosted suppressions file for internet-constrained environments | https://jeremylong.github.io/DependencyCheck/suppressions/publishedSuppressions.xml
158-
hostedSuppressionsValidForHours | Sets the number of hours to wait before checking for new updates of the hosted suppressions file | 2
157+
hostedSuppressionsEnabled | Whether the hosted suppression file will be used. | true
158+
hostedSuppressionsUrl | The URL to a mirrored copy of the hosted suppressions file for internet-constrained environments | https://jeremylong.github.io/DependencyCheck/suppressions/publishedSuppressions.xml
159+
hostedSuppressionsValidForHours | Sets the number of hours to wait before checking for new updates of the hosted suppressions file | 2
159160
hostedSuppressionsForceUpdate | Sets whether the hosted suppressions file should update regardless of the `autoupdate` and validForHours settings | false

‎cli/src/main/java/org/owasp/dependencycheck/App.java‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -663,6 +663,8 @@ protected void populateSettings(CliParser cli) throws InvalidSettingException {
663663

664664
settings.setStringIfNotNull(Settings.KEYS.HOSTED_SUPPRESSIONS_URL,
665665
cli.getStringArgument(CliParser.ARGUMENT.HOSTED_SUPPRESSIONS_URL));
666+
settings.setBoolean(Settings.KEYS.HOSTED_SUPPRESSIONS_ENABLED,
667+
!cli.isDisabled(CliParser.ARGUMENT.DISABLE_HOSTED_SUPPRESSIONS, Settings.KEYS.HOSTED_SUPPRESSIONS_ENABLED));
666668
settings.setBooleanIfNotNull(Settings.KEYS.HOSTED_SUPPRESSIONS_FORCEUPDATE,
667669
cli.hasOption(CliParser.ARGUMENT.HOSTED_SUPPRESSIONS_FORCEUPDATE));
668670
settings.setIntIfNotNull(Settings.KEYS.HOSTED_SUPPRESSIONS_VALID_FOR_HOURS,

‎cli/src/main/java/org/owasp/dependencycheck/CliParser.java‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -499,6 +499,7 @@ private void addAdvancedOptions(final Options options) {
499499
.addOption(newOption(ARGUMENT.ENABLE_NEXUS, "Enable the Nexus Analyzer."))
500500
.addOption(newOption(ARGUMENT.ARTIFACTORY_ENABLED, "Whether the Artifactory Analyzer should be enabled."))
501501
.addOption(newOption(ARGUMENT.PURGE_NVD, "Purges the local NVD data cache"))
502+
.addOption(newOption(ARGUMENT.DISABLE_HOSTED_SUPPRESSIONS, "Disable the usage of the hosted suppressions file"))
502503
.addOption(newOption(ARGUMENT.HOSTED_SUPPRESSIONS_FORCEUPDATE, "Force the hosted suppressions file to update even"
503504
+ " if autoupdate is disabled"))
504505
.addOption(newOptionWithArg(ARGUMENT.HOSTED_SUPPRESSIONS_VALID_FOR_HOURS, "hours",
@@ -1521,6 +1522,10 @@ public static class ARGUMENT {
15211522
* when generating the JUNIT report format.
15221523
*/
15231524
public static final String FAIL_JUNIT_ON_CVSS = "junitFailOnCVSS";
1525+
/**
1526+
* The CLI argument to set the number of hours to wait before re-checking hosted suppressions file for updates.
1527+
*/
1528+
public static final String DISABLE_HOSTED_SUPPRESSIONS = "disableHostedSuppressions";
15241529
/**
15251530
* The CLI argument to set the number of hours to wait before re-checking hosted suppressions file for updates.
15261531
*/

‎cli/src/main/resources/completion-for-dependency-check.sh‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,7 @@ _odc_completions()
4444
--disableFileName
4545
--disableGolangDep
4646
--disableGolangMod
47+
--disableHostedSuppressions
4748
--disableJar
4849
--disableMavenInstall
4950
--disableMixAudit

‎cli/src/site/markdown/arguments.md‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -118,6 +118,7 @@ Advanced Options
118118
| | \-\-dbUser | \<user\> | The username used to connect to the database. | &nbsp; |
119119
| \-d | \-\-data | \<path\> | The location of the data directory used to store persistent data. This option should generally not be set. | &nbsp; |
120120
| | \-\-purge | | Delete the local copy of the NVD. This is used to force a refresh of the data. | &nbsp; |
121-
| | \-\-hostedSuppressionsForceUpdate | | Whether the hosted suppressions file will update regardless of the `noupdate` argument. | false |
122-
| | \-\-hostedSuppressionsValidForHours | \<hours\> | The number of hours to wait before checking for new updates of the hosted suppressions file | 2 |
123-
| | \-\-hostedSuppressionsUrl | \<url\> | The URL to a mirrored copy of the hosted suppressions file for internet-constrained environments | https://jeremylong.github.io/DependencyCheck/suppressions/publishedSuppressions.xml |
121+
| | \-\-disableHostedSuppressions | | Whether the usage of the hosted suppressions file will be disabled. | false |
122+
| | \-\-hostedSuppressionsForceUpdate | | Whether the hosted suppressions file will update regardless of the `noupdate` argument. | false |
123+
| | \-\-hostedSuppressionsValidForHours | \<hours\> | The number of hours to wait before checking for new updates of the hosted suppressions file | 2 |
124+
| | \-\-hostedSuppressionsUrl | \<url\> | The URL to a mirrored copy of the hosted suppressions file for internet-constrained environments | https://jeremylong.github.io/DependencyCheck/suppressions/publishedSuppressions.xml |

‎core/src/main/java/org/owasp/dependencycheck/analyzer/AbstractSuppressionAnalyzer.java‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -230,6 +230,10 @@ private void loadPackagedSuppressionBaseData(final SuppressionParser parser, fin
230230
private void loadHostedSuppressionBaseData(final SuppressionParser parser, final Engine engine) {
231231
final File repoFile;
232232
boolean repoEmpty = false;
233+
final boolean enabled = getSettings().getBoolean(Settings.KEYS.HOSTED_SUPPRESSIONS_ENABLED, true);
234+
if (!enabled) {
235+
return;
236+
}
233237
final boolean autoupdate = getSettings().getBoolean(Settings.KEYS.AUTO_UPDATE, true);
234238
final boolean forceupdate = getSettings().getBoolean(Settings.KEYS.HOSTED_SUPPRESSIONS_FORCEUPDATE, false);
235239

‎core/src/main/java/org/owasp/dependencycheck/data/update/HostedSuppressionsDataSource.java‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -66,7 +66,8 @@ public boolean update(Engine engine) throws UpdateException {
6666
final boolean forceupdate = settings.getBoolean(Settings.KEYS.HOSTED_SUPPRESSIONS_FORCEUPDATE, false);
6767
final boolean cpeSuppressionEnabled = settings.getBoolean(Settings.KEYS.ANALYZER_CPE_SUPPRESSION_ENABLED, true);
6868
final boolean vulnSuppressionEnabled = settings.getBoolean(Settings.KEYS.ANALYZER_VULNERABILITY_SUPPRESSION_ENABLED, true);
69-
final boolean enabled = cpeSuppressionEnabled || vulnSuppressionEnabled;
69+
boolean enabled = settings.getBoolean(Settings.KEYS.HOSTED_SUPPRESSIONS_ENABLED, true);
70+
enabled = enabled && (cpeSuppressionEnabled || vulnSuppressionEnabled);
7071
try {
7172
final URL url = new URL(configuredUrl);
7273
final File filepath = new File(url.getPath());

‎core/src/main/resources/dependencycheck.properties‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -172,6 +172,10 @@ database.batchinsert.maxsize=1000
172172
analyzer.artifactory.enabled=false
173173
odc.reports.pretty.print=false
174174

175+
hosted.suppressions.enabled=true
176+
hosted.suppressions.url=https://jeremylong.github.io/DependencyCheck/suppressions/publishedSuppressions.xml
177+
hosted.suppressions.validforhours=2
178+
175179
## The following controls the max query limit used in the CPE searches for each ecosystem
176180
odc.ecosystem.maxquerylimit.native=1000
177181
odc.ecosystem.maxquerylimit.default=100

0 commit comments

Comments
 (0)