dependency-check / dependency-check/DependencyCheck

Annotate the CVEs with a comment for tracking

Open
#2,431 2 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Java
Stars
7.7k
Forks
1.4k
Avg merge
9d 22h
Merged PRs (30d)
13

Description

For each CVE suppressed in the suppressions.xml file (tag CVE-2015-1832), would it be possible to annotate the generated HTML report with a comment? The comment could be passed in the tags in suppressions.xml file, and it could be in HTML format, so that I can explain why it is suppressed, and with hyperlinks?

Can we have the same comment for the CVEs that are not in suppressions.xml, so that I can provide some references for each CVE active and under investigation? You can use another file to pass this information, similar to suppressions.xml.

The idea is that when I open the HTML report file, each CVE has a comment with explanation and references.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.