Comments (9)
When adding a component, the dropdown is also a text input field, so you can start typing. Once one component is added, the vendor, component name, and version fields will be populated. As you add more components, there will be more choices in the dropdown.
from dependency-track.
Ah, okay. Thanks!
So are the false positives that are displayed for, say, OpenSSL 1.0.2g caused by dependency-check?
Is there any way to filter them out?
from dependency-track.
Yes, this is caused by dependency-check and can be filtered out using a suppression file. Refer to https://jeremylong.github.io/DependencyCheck/general/suppression.html
Suppressions are global in Dependency-Track, meaning that it's currently not possible to suppress a finding for one application and not another one. The benefit is that you can suppress a finding and all applications with that dependency will now inherent that suppression.
it's been a while since I've worked on the 1.x codebase (the master branch is all 2.x and quite different), but I believe the suppression file goes into ~/.dependency-track directory.
from dependency-track.
Just to follow up for the purposes of anyone else reading this thread - on Windows the file to create is C:\Users\username\dependency-track\data\suppressions.xml.
I can see in the Tomcat output (and in dependency-check-report.html) that the suppressions are being correctly applied and the total as shown by the graph on the Dashboard is correctly excluding the suppressions, but the numbers shown next to the Applications and the CVEs listed on the Vulnerabilities page do not exclude the suppressions.
Is there an easy way to fix this or do I need to edit the database by hand?
(Should I just be using the master branch and building it myself?!)
from dependency-track.
v2.0.0 (in the master branch) is currently in heavy development. I'll make sure this gets fixed in this version.
from dependency-track.
FWIW if I remove the component, restart Tomcat and add it again I get the correct number in the Applications pane, but sadly the Vunerabilities page is still not filtered.
from dependency-track.
(I also couldn't open the database using java -cp ../repo/com/h2database/h2/1.3.176/h2-1.3.176.jar org.h2.tools.Server -tcp -web
as I get a "Unique index or primary key violation" error.)
from dependency-track.
FYI, I have branched the project to make the source tree more clear.
- The only stable version (which can also be downloaded in a ready-to-deploy war) is 1.0.x.
- The master and 1.0-stable branches are in sync and should provide an easy way to compile your own war resulting in a working application.
- The 2.0-dev-springboot branch is unstable and has many issues. I do not intend to ever release this version. Just too many issues overall. This work was previously performed in the master branch but has since been reverted and separated to its own branch.
- All new development is being done in the 3.0-dev branch and is a complete rewrite of Dependency-Track from the ground up using modern technologies and an API-first design. It also doesn't rely on Spring.
from dependency-track.
This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.
from dependency-track.
Related Issues (20)
- False Alerts on Old Versions of Dependencies in Slack Notifications HOT 1
- Add a warning or an error when the bom version is not supported HOT 2
- Unable to Login to Depenedency Track even part of LDAP group mapped with Administartors team
- false postive delected by dependency track HOT 1
- Upgrade DependencyTrack apiserver fails without exception on computing severity where value is NULL HOT 3
- CVE-2020-4682 not returned for project having IBM MQ vulnerable dependency HOT 2
- Dependency Track API fails to start in Fargate Task HOT 3
- Error during the OSV download task for the GIT ecosystem HOT 2
- Update to SPDX License List 3.24.0
- CycloneDX BOM validation fails when URLs contain %-encoded '[' and ']' characters HOT 3
- /vulnerabilityAudit - "Show inactive projects" filter is inverted HOT 2
- Dependency tracker not loading HOT 2
- VEX export returns invalid cyclonedx HOT 1
- dependencytrack/apiserver not running while configuring Postgresql db with Docker Compose HOT 4
- Usability of VulnerabilityAudit HOT 1
- H2 Database error preventing Dependency Track to run HOT 1
- Can't get teams synchronized/OIDC groups added with GitLab OIDC HOT 7
- [create vulnerability->general -> cwe] Click +, the list page turns without data
- Usage of Dependency tracker 4.11.3 getting blockage HOT 2
- Use stricter identity comparison when merging components HOT 5
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from dependency-track.