risdenk commented on code in PR #1226:
URL: https://github.com/apache/solr/pull/1226#discussion_r1044679162
##########
gradle/validation/owasp-dependency-check/exclusions.xml:
##########
@@ -51,4 +51,25 @@
<packageUrl
regex="true">^pkg:maven/org\.carrot2\.shaded/carrot2\-guava@.*$</packageUrl>
<cpe>cpe:/a:google:guava</cpe>
</suppress>
+ <suppress>
+ <notes><![CDATA[Apache Calcite Avatica has separate releases from Apache
Calcite]]></notes>
+ <packageUrl
regex="true">^pkg:maven/org\.apache\.calcite\.avatica/.*@.*$</packageUrl>
+ <cpe>cpe:/a:apache:calcite</cpe>
Review Comment:
This ensures that Apache Calcite CVEs don't get attributed to the Apache
Calcite Avatica jars.
##########
gradle/validation/owasp-dependency-check/exclusions.xml:
##########
@@ -51,4 +51,25 @@
<packageUrl
regex="true">^pkg:maven/org\.carrot2\.shaded/carrot2\-guava@.*$</packageUrl>
<cpe>cpe:/a:google:guava</cpe>
</suppress>
+ <suppress>
+ <notes><![CDATA[Apache Calcite Avatica has separate releases from Apache
Calcite]]></notes>
+ <packageUrl
regex="true">^pkg:maven/org\.apache\.calcite\.avatica/.*@.*$</packageUrl>
+ <cpe>cpe:/a:apache:calcite</cpe>
+ </suppress>
+ <suppress>
+ <notes><![CDATA[jetty-servlet-api has separate releases from Jetty
itself]]></notes>
+ <packageUrl
regex="true">^pkg:maven/org\.eclipse\.jetty\.toolchain/jetty\-servlet\-api@.*$</packageUrl>
Review Comment:
This was flagging all Jetty CVEs against jetty-servlet-api which is wrong.
##########
gradle/validation/owasp-dependency-check/exclusions.xml:
##########
@@ -51,4 +51,25 @@
<packageUrl
regex="true">^pkg:maven/org\.carrot2\.shaded/carrot2\-guava@.*$</packageUrl>
<cpe>cpe:/a:google:guava</cpe>
</suppress>
+ <suppress>
+ <notes><![CDATA[Apache Calcite Avatica has separate releases from Apache
Calcite]]></notes>
+ <packageUrl
regex="true">^pkg:maven/org\.apache\.calcite\.avatica/.*@.*$</packageUrl>
+ <cpe>cpe:/a:apache:calcite</cpe>
+ </suppress>
+ <suppress>
+ <notes><![CDATA[jetty-servlet-api has separate releases from Jetty
itself]]></notes>
+ <packageUrl
regex="true">^pkg:maven/org\.eclipse\.jetty\.toolchain/jetty\-servlet\-api@.*$</packageUrl>
+ <cpe>cpe:/a:eclipse:jetty</cpe>
+ <cpe>cpe:/a:jetty:jetty</cpe>
+ </suppress>
+ <suppress>
+ <notes><![CDATA[hadoop-shaded-guava-1.1.1.jar is not Apache Hadoop
1.1.1]]></notes>
+ <packageUrl
regex="true">^pkg:maven/org\.apache\.hadoop\.thirdparty/hadoop\-shaded\-guava@.*$</packageUrl>
+ <cpe>cpe:/a:apache:hadoop:1.1.1</cpe>
+ </suppress>
+ <suppress>
+ <notes><![CDATA[hadoop-client-runtime-3.*.jar is not Apache Hadoop
1.1.1]]></notes>
+ <packageUrl
regex="true">^pkg:maven/org\.apache\.hadoop/hadoop\-client\-runtime@3.*$</packageUrl>
+ <cpe>cpe:/a:apache:hadoop:1.1.1</cpe>
Review Comment:
idk why this was getting flagged as Apache Hadoop 1.1.1 - but its 3.3.4
based on the jar name. Added a very specific suppression for this.
##########
gradle/validation/owasp-dependency-check/exclusions.xml:
##########
@@ -51,4 +51,25 @@
<packageUrl
regex="true">^pkg:maven/org\.carrot2\.shaded/carrot2\-guava@.*$</packageUrl>
<cpe>cpe:/a:google:guava</cpe>
</suppress>
+ <suppress>
+ <notes><![CDATA[Apache Calcite Avatica has separate releases from Apache
Calcite]]></notes>
+ <packageUrl
regex="true">^pkg:maven/org\.apache\.calcite\.avatica/.*@.*$</packageUrl>
+ <cpe>cpe:/a:apache:calcite</cpe>
+ </suppress>
+ <suppress>
+ <notes><![CDATA[jetty-servlet-api has separate releases from Jetty
itself]]></notes>
+ <packageUrl
regex="true">^pkg:maven/org\.eclipse\.jetty\.toolchain/jetty\-servlet\-api@.*$</packageUrl>
+ <cpe>cpe:/a:eclipse:jetty</cpe>
+ <cpe>cpe:/a:jetty:jetty</cpe>
+ </suppress>
+ <suppress>
+ <notes><![CDATA[hadoop-shaded-guava-1.1.1.jar is not Apache Hadoop
1.1.1]]></notes>
+ <packageUrl
regex="true">^pkg:maven/org\.apache\.hadoop\.thirdparty/hadoop\-shaded\-guava@.*$</packageUrl>
+ <cpe>cpe:/a:apache:hadoop:1.1.1</cpe>
Review Comment:
Apache Hadoop 1.1.1 is a very old release. hadoop-shaded-guava is a
thirdparty shaded jar that uses different versioning/release cycle from Apache
Hadoop.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscr...@solr.apache.org
For queries about this service, please contact Infrastructure at:
us...@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscr...@solr.apache.org
For additional commands, e-mail: issues-h...@solr.apache.org
