DependencyTrack / DependencyTrack/dependency-track

Fuzzy Matching as project setting instead of global

Open
#5,577 1 comment 1 reaction 0 assignees View on GitHub
enhancement
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior

Currently fuzzy matching setting is a global setting which affects all projects. We have a Dependency Track instance running in your company and different departments are using it. Some are now wanting to scan with Fuzzy Matching while the others are complaining about too many False Positives.

### Proposed Behavior

I would suggest the following:

1. Adding a toggle button to the project creation dialog allowing to enable/disable the fuzzying on per project level.
2. Marking the vulnerabilities found by fuzzying with a flag, which allows filtering them later in the UI. Probably the code section where to flag them could be [here](https://github.com/DependencyTrack/dependency-track/blob/a4ed39ff22d33edeb8fbe15b4cd93d070517cd3d/src/main/java/org/dependencytrack/search/FuzzyVulnerableSoftwareSearchManager.java#L143) and [here](https://github.com/DependencyTrack/dependency-track/blob/a4ed39ff22d33edeb8fbe15b4cd93d070517cd3d/src/main/java/org/dependencytrack/search/FuzzyVulnerableSoftwareSearchManager.java#L129)

### Checklist

- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this enhancement was already requested

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.