[druid] branch 0.22.0 updated: suppress false positive cve (#11699) (#11702)

[cw...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

cwylie pushed a commit to branch 0.22.0
in repository https://gitbox.apache.org/repos/asf/druid.git


The following commit(s) were added to refs/heads/0.22.0 by this push:
     new 5c59d77  suppress false positive cve (#11699) (#11702)
5c59d77 is described below

commit 5c59d7760ecc55ed7ef3dd16255c73d82c2b3b8f
Author: Clint Wylie <cw...@apache.org>
AuthorDate: Tue Sep 14 01:26:29 2021 -0700

    suppress false positive cve (#11699) (#11702)
    
    * suppress false positive cve
    
    * update comment, dont run tests on changes to owasp-dependency-check-suppressions.xml
---
 check_test_suite.py                     |  2 +-
 check_test_suite_test.py                |  2 +-
 owasp-dependency-check-suppressions.xml | 10 ++++++++++
 3 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/check_test_suite.py b/check_test_suite.py
index ec21353..3de4047 100755
--- a/check_test_suite.py
+++ b/check_test_suite.py
@@ -29,7 +29,7 @@ always_run_jobs = ['license checks', '(openjdk8) packaging check', '(openjdk11)
 ignore_prefixes = ['.github', '.idea', '.asf.yaml', '.backportrc.json', '.codecov.yml', '.dockerignore', '.gitignore',
                    '.lgtm.yml', 'CONTRIBUTING.md', 'setup-hooks.sh', 'upload.sh', 'dev', 'distribution/docker',
                    'distribution/asf-release-process-guide.md', '.travis.yml', 'check_test_suite.py',
-                   'check_test_suite_test.py']
+                   'check_test_suite_test.py', 'owasp-dependency-check-suppressions.xml']
 
 # these files are docs changes
 # if changes are limited to this set then we can skip web-console and java
diff --git a/check_test_suite_test.py b/check_test_suite_test.py
index 2cefd446..18446ea 100755
--- a/check_test_suite_test.py
+++ b/check_test_suite_test.py
@@ -77,7 +77,7 @@ class CheckTestSuite(unittest.TestCase):
             ['check_test_suite_test.py'],
             ['website/core/Footer.js'],
             ['web-console/src/views/index.ts'],
-            ['check_test_suite_test.py', 'website/core/Footer.js', 'web-console/unified-console.html']
+            ['check_test_suite_test.py', 'website/core/Footer.js', 'web-console/unified-console.html', 'owasp-dependency-check-suppressions.xml']
         ]
         some_java_diffs = [
             ['core/src/main/java/org/apache/druid/math/expr/Expr.java'],
diff --git a/owasp-dependency-check-suppressions.xml b/owasp-dependency-check-suppressions.xml
index 9b46f22..aa83c41 100644
--- a/owasp-dependency-check-suppressions.xml
+++ b/owasp-dependency-check-suppressions.xml
@@ -26,6 +26,7 @@
     <packageUrl regex="true">^pkg:maven/org\.apache\.druid/druid\-indexing\-hadoop@.*$</packageUrl>
     <cve>CVE-2012-4449</cve>
     <cve>CVE-2017-3162</cve>
+    <cve>CVE-2018-8009</cve>
   </suppress>
   <suppress>
     <!-- druid-processing.jar is mistaken for org.processing:processing -->
@@ -387,4 +388,13 @@
     <packageUrl regex="true">^pkg:maven/org\.apache\.thrift/libthrift@0.13.0$</packageUrl>
     <cve>CVE-2020-13949</cve>
   </suppress>
+  <suppress>
+    <!--
+    the scanner misattributes this to Apache DataSketches
+    the actual vulnerability affects some collaboration tool called Sketch, and impacts some 'library feeds' feature
+    which seems to relate to how the tool handles sharing designs or something, so we are doing a blanket ignore
+    because it seems nearly impossible for us to be affected by this
+     -->
+    <cve>CVE-2021-40531</cve>
+  </suppress>
 </suppressions>

---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@druid.apache.org
For additional commands, e-mail: commits-help@druid.apache.org