DependencyTrack / DependencyTrack/dependency-track

Policy Management - Using Wildcards with Vulnerability ID

Open
#5,798 0 comments 1 reaction 0 assignees View on GitHub
enhancement
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior

Hello, I would like to detect Malware supply chain attacks in Policy policy.
As a result, I want to mark the value of the Vulnerability ID as MAL*, but the value in src/main/java/org/dependencytrack/policy/VulnerabilityIdPolicyEvaluator.java is **equals**, so DT only recognizes the exact ID value.
I would like to ask if it is possible to change the value to **matches** logic.

### Proposed Behavior

I would like to allow wildcards in the values of the [Policy Management] - [Vulnerability ID].

### Checklist

- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this enhancement was already requested

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.