dependency-check / dependency-check/DependencyCheck

False detection of ASP.NET

Open
#1,846 0 comments 1 reaction 0 assignees View on GitHub
enhancement
Dominant language
Java
Stars
7.7k
Forks
1.4k
Avg merge
9d 22h
Merged PRs (30d)
13

Description

**Related Problem**
Im using ASP.NET Core and ASP.NET Core MVC (versions between 2.1.2 and 2.1.7) in my project. I get multiple false detections of ASP.NET. I haven't had a look on the CPE detection mechanism yet but I suspect this happens due to simple string matching (i.e. every appearance of the string 'ASP.NET Core'/'AspNetCore' obviously contains 'ASP.NET'/'AspNet' which probably causes this detection).

**Proposed Solution**
Only detect ASP.NET when the found string doesnt end with 'Core'.

**Additional context**
It is not really a big issue to suppress the CPE manually, however I feel like improving the CPE detection mechanism (not necessarily only for the false ASP.NET detection) would improve the usability of the Dependency Check.

EDIT: Actually suppressing the ASP.NET CPEs is not that easy (there is one false ASP.NET CPE for every version of ASP.NET Core I use in the project). When I suppress the CPE with cpe:/a:microsoft:asp.net it also suppresses all ASP.NET Core CPEs. Another option would be to suppress every single ASP.NET CPE separately, which is problematic since I use 5 different versions of ASP.NET Core. Therefore every time I update any of the ASP.NET Core I will probably have to change the suppression file.

Contributor guide

Open the contributing guide

Research direction

No file or test is named; begin by locating the CPE detection mechanism and reproduce the ASP.NET Core versions described in the report. Done means ASP.NET Core dependencies no longer produce false ASP.NET CPEs, while genuine ASP.NET detection remains intact.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.