[FP]: selenium detected as archive_project #7460
Comments
|
Maven Coordinates <dependency>
<groupId>androidx.lifecycle</groupId>
<artifactId>lifecycle-viewmodel</artifactId>
<version>2.8.7</version>
</dependency>Suppression rule: <suppress base="true">
<notes><![CDATA[
FP per issue #7460
]]></notes>
<packageUrl regex="true">^pkg:maven/androidx\.lifecycle/lifecycle-viewmodel@.*$</packageUrl>
<cpe>cpe:/a:selenium:selenium</cpe>
</suppress>Link to test results: https://github.com/dependency-check/DependencyCheck/actions/runs/13490721479 |
|
Maven Coordinates <dependency>
<groupId>androidx.lifecycle</groupId>
<artifactId>lifecycle-viewmodel</artifactId>
<version>2.8.7</version>
</dependency>Suppression rule: <suppress base="true">
<notes><![CDATA[
FP per issue #7460
]]></notes>
<packageUrl regex="true">^pkg:maven/androidx\.lifecycle/lifecycle-viewmodel@.*$</packageUrl>
<cpe>cpe:/a:selenium:selenium</cpe>
</suppress>Link to test results: https://github.com/dependency-check/DependencyCheck/actions/runs/13497211357 |
|
It’s hard to understand how this could have anything to do with selenium. |
|
I don't understand it either. Looks like this automation doesn't make the same connection either which seems weird. We don't do anything special with the analysis. We started getting a few of these after updating to 12.1.0. Even weirder was that some would show up when we ran it locally, but not on the CI or vice versa. |
|
Yeah, it's perhaps related to #7295 but would need to to look at the evidence in the report to see if that makes more sense. |
|
File Path: /home/user/.gradle/caches/8.9/transforms/2480adcee23ed3cbc8ff47c62139c768/transformed/lifecycle-viewmodel-2.8.7/jars/classes.jar Evidence:
Identifiers
|
|
@jeremylong @aikebah do you know why/how the evidence for the artifact at https://mvnrepository.com/artifact/androidx.lifecycle/lifecycle-viewmodel/2.8.7 is collecting all this information for seemingly completely unrelated things/versions? They claim they are coming from Is it that the These kind of false positives because of seemingly dodgy evidence are a pretty big noise problem :-( |
|
@chadlwilson That would likely mean a massive sha1 hash collision is at play. Most logical explanation reason would be an 'empty' jar |
|
Interesting. The "jars" for things like this project are basically empty (no classes in them) as they are aar predominantly, but not fully empty. I'm not sure what Having said that, many other pieces of evidence are coming, allegedly, from "pom" not just central? Does a sha collision also explain the pom evidence problems? Nevertheless if it is indeed this, we should be able to fix such false positives I'd imagine. Whether that's inside the Gradle plugin with the specific |
|
I can confirm the jar file is empty |
|
What is the sha1 hash of classes.jar? |
|
Package URl
pkg:maven/androidx.lifecycle/[email protected]
CPE
cpe:2.3:a:selenium:selenium:2.8.7:*:*:*:*:*:*:*CVE
No response
ODC Integration
{"label" => "Gradle Plugin"}
ODC Version
12.1.0
Description
After suppressing this one it also matches with
cpe:/a:archive_project:archiveandcpe:/a:digital-ant:digital_ant.We got a few of these sorts of issues after updating from 10.0.2 to 12.1.0, prompted by the recent parsing error.
The text was updated successfully, but these errors were encountered: