dependency-check / dependency-check/DependencyCheck
Annotate the CVEs with a comment for tracking
- Dominant language
- Java
- Stars
- 7.7k
- Forks
- 1.4k
- Avg merge
- 9d 22h
- Merged PRs (30d)
- 13
Description
For each CVE suppressed in the suppressions.xml file (tag CVE-2015-1832), would it be possible to annotate the generated HTML report with a comment? The comment could be passed in the tags in suppressions.xml file, and it could be in HTML format, so that I can explain why it is suppressed, and with hyperlinks?
Can we have the same comment for the CVEs that are not in suppressions.xml, so that I can provide some references for each CVE active and under investigation? You can use another file to pass this information, similar to suppressions.xml.
The idea is that when I open the HTML report file, each CVE has a comment with explanation and references.
Contributor guide
Assessment
This issue has not been assessed yet.