dependency-check / dependency-check/DependencyCheck
[FP]: Muliple packages detected as homepage_project:homepage
- Dominant language
- Java
- Stars
- 7.7k
- Forks
- 1.4k
- Avg merge
- 9d 22h
- Merged PRs (30d)
- 13
Description
### Package URl
pkg:maven/com.querydsl/querydsl-core@5.0.0
### CPE
cpe:2.3:a:homepage_project:homepage:5.0.0:*:*:*:*:*:*:*
### CVE
_No response_
### ODC Integration
{"label"=>"Maven Plugin"}
### ODC Version
9.0.9
### Description
When POMs do not have their properties expanded correctly, dependency check still uses the variable as evidence. In an apparently common case, this leads to this evidence:
```
Vendor pom url ${project.homepage} Highest
Product pom url ${project.homepage} Medium
```
and a detection of `cpe:2.3:a:homepage_project:homepage`.
Rather than have to individually suppress this whenever it comes up, perhaps the analyser should simply discard any evidence that is a Maven property expression?
Contributor guide
Assessment
This issue has not been assessed yet.