fix: Avoid FPs when Composer product name has php#7486
Merged
aikebah merged 1 commit intodependency-check:mainfrom Mar 1, 2025
Merged
fix: Avoid FPs when Composer product name has php#7486aikebah merged 1 commit intodependency-check:mainfrom
aikebah merged 1 commit intodependency-check:mainfrom
Conversation
Previously, only PHP package's vendor (product URL's namespace) was considered as evidence. As of DependencyCheck v12, specifically change from b51921f, the product (name) is also being considered as evidence. This results in new false positives. PHP Composer checks are affected, for example, considering package `pkg:composer/phpunit/php-timer@6.0.0` as `cpe:2.3:a:php:php:6.0:*:*:*:*:*:*:*` resulting in 17 CVEs (including Critical). This commit adds two new suppression rules: one for php as the prefix, and one for php as the suffix. Both can be observed in the wild. Additionally, underscore is sometimes used instead of hyphen, and should be respected. Furthermore, there is `symfony/polyfill-php83` which adds number suffix, which should also be suppressed as it currently maps to the base `cpe:/a:php:php`.
Collaborator
|
Thanks for the PR |
aikebah
approved these changes
Mar 1, 2025
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description of Change
Previously, only PHP package's vendor (product URL's namespace) was considered as evidence. As of DependencyCheck v12, specifically change from #7295, the product (name) is also being considered as evidence.
This results in new false positives, as noticed in #7444. PHP Composer checks are affected, for example, considering package
pkg:composer/phpunit/php-timer@6.0.0ascpe:2.3:a:php:php:6.0:*:*:*:*:*:*:*resulting in 17 CVEs (including Critical).This commit adds two new suppression rules: one for php as the prefix, and one for php as the suffix. Both can be observed in the wild. Additionally, underscore is sometimes used instead of hyphen, and should be respected. Furthermore, there is
symfony/polyfill-php83which adds number suffix, which should also be suppressed as it currently maps to the basecpe:/a:php:php.Related issues
Have test cases been added to cover the new functionality?
no