dependency-check / dependency-check/DependencyCheck

[FP]: Muliple packages detected as homepage_project:homepage

Open
#6,467 2 comments 0 reactions 0 assignees View on GitHub
enhancement maven
Dominant language
Java
Stars
7.7k
Forks
1.4k
Avg merge
9d 22h
Merged PRs (30d)
13

Description

### Package URl

pkg:maven/com.querydsl/querydsl-core@5.0.0

### CPE

cpe:2.3:a:homepage_project:homepage:5.0.0:*:*:*:*:*:*:*

### CVE

_No response_

### ODC Integration

{"label"=>"Maven Plugin"}

### ODC Version

9.0.9

### Description

When POMs do not have their properties expanded correctly, dependency check still uses the variable as evidence. In an apparently common case, this leads to this evidence:

```
Vendor pom url ${project.homepage} Highest
Product pom url ${project.homepage} Medium
```

and a detection of `cpe:2.3:a:homepage_project:homepage`.

Rather than have to individually suppress this whenever it comes up, perhaps the analyser should simply discard any evidence that is a Maven property expression?

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.