iabudiab.maven.plugins.dependencytrack.suppressions.SuppressCveOfPurl Maven / Gradle / Ivy

Go to download

Show more of this group Show more artifacts with this name
Show all versions of dependency-track-maven-plugin Show documentation

Maven plugin for interacting with Dependency Track

There is a newer version: 2.4.2

Show newest version

package iabudiab.maven.plugins.dependencytrack.suppressions;

import java.time.LocalDate;
import java.util.regex.Matcher;
import java.util.regex.Pattern;

import com.fasterxml.jackson.annotation.JsonTypeName;
import iabudiab.maven.plugins.dependencytrack.client.model.Finding;
import lombok.Data;

@Data
@JsonTypeName("cve-of-purl")
public class SuppressCveOfPurl implements Suppression {

	private String type = "cve-of-purl";

	private String notes;
	private LocalDate expiration = LocalDate.MAX;
	private String purl;
	private String cve;

	private boolean regex = false;

	@Override
	public boolean shouldSuppress(Finding finding) {
		if (isExpired()) {
			return false;
		}

		if (!cve.equals(finding.getVulnerability().getVulnId())) {
			return false;
		}

		if (regex) {
			Pattern pattern = Pattern.compile(purl);
			Matcher matcher = pattern.matcher(finding.getComponent().getPurl());
			return matcher.find();
		} else {
			return purl.equals(finding.getComponent().getPurl());
		}
	}

	@Override
	public CharSequence print() {
		StringBuilder builder = new StringBuilder();
		builder.append("- By CVE: ");
		builder.append(cve);

		builder.append(" of PURL");
		if (regex) {
			builder.append(" [exact match]: ");
		} else {
			builder.append(" [as regex]: ");
		}

		builder.append("[").append(purl).append("]");
		builder.append(" [Expired: ").append(isExpired() ? "yes": "no").append("]");
		return builder.toString();
	}
}