dependency-check / dependency-check/DependencyCheck

Enhance swift analyzer to be more git, swift, and OS aware

Open
#5,729 6 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Java
Stars
7.7k
Forks
1.4k
Avg merge
9d 22h
Merged PRs (30d)
13

Description

Swift scanner is producing a lot of false positives due to it not having awareness of git version, swift version, which OS it is running on, and whether the dependency is hosted on GH enterprise or not. For example, consider a project that is using `swift-collections@1.0.4` as a dependency while using latest swift 5.8 on MacOS. The scan will produce 5 false positives, at the time of this writing, for this dependency alone:
- [CVE-2018-4220](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-4220)
- [CVE-2022-3918](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-3918)
- [CVE-2020-9861](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-9861)
- [CVE-2022-1642](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-1642)
- [CVE-2019-8790](https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-8790)

All of them are related to old versions of swift or git client or distinctions between Linux and other OSes. Now, imagine a larger project that will have many such dependencies. The signal to noise ratio becomes very poor out of the gate as the user will be confronted with 50+ CVEs to review. When I onboarded a project recently, that was my experience. Normally I would be hesitant to suggest that the scanner be that aware of the environment but given how tightly integrated swift is with git and how many CVEs seem to be popping up on Linux alone, I think there is a strong case here to consider enhancing the scanner to improve its efficacy.

Another source of many CVEs is a possibility that dependencies may be coming from GH Enterprise server. I got a lot of CVEs that I had to suppress for dependencies hosted on GitHub. This one may also be worth considering as an enhancement since dependencies hosted on github.com can be safely assumed to not be coming from GH Enterpise.

What I would like to see if for the scanner to look at git client, swift version, OS, and be a little smarter about URLs to exclude a marge number of false positives.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.