我正在运行一个Spring Boot Kotlin项目，需要抑制以下两个依赖：

• 依赖项：swagger-ui-5.32.0.jar: swagger-ui-bundle.js
  包：pkg:javascript/[email protected]
• 依赖项：swagger-ui-5.32.0.jar: swagger-ui-es-bundle.js
  包：pkg:javascript/[email protected]

我尝试创建这个dependency-check-supressions.xml文件：

<?xml version="1.0" encoding="UTF-8"?>
<suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">
    <!-- ========================================================= -->
    <!-- Swagger UI bundled DOMPurify (RetireJS advisories) -->
    <!-- ========================================================= -->
    <suppress>
        <notes>
            DOMPurify is bundled inside swagger-ui WebJar bundles only.
            Suppress RetireJS/GHSA findings for swagger-ui-bundle.js and
            swagger-ui-es-bundle.js in internal API documentation usage.
            Risk accepted.
        </notes>

        <filePath regex="true">
            ^.*/swagger-ui-(es-)?bundle\.js$
        </filePath>

        <packageUrl regex="true">
            ^pkg:javascript/DOMPurify@3\.2\.6$
        </packageUrl>

        <!-- RetireJS / GHSA advisories -->
        <vulnerabilityName>GHSA-h8r8-wccr-v5f2</vulnerabilityName>
        <vulnerabilityName>GHSA-cjmm-f4jc-qw8r</vulnerabilityName>
        <vulnerabilityName>GHSA-cj63-jhhr-wcxv</vulnerabilityName>
    </suppress>



</suppressions>

然而它给出了错误：

InitializationException: 在初始化抑制分析器时发生警告：无法加载 /home/jenkins/agent/workspace/ngslogg_renovate_all-minor-patch/client/../dependency-check-suppressions.xml，原因是org.owasp.dependencycheck.xml.suppression.SuppressionParseException: org.xml.sax.SAXException: Line=107, Column=34: cvc-complex-type.2.4.a: Invalid content was found starting with element '{"https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd":packageUrl}'。

One of '{"https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd":cpe, "https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd":cve, "https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd":vulnerabilityName, "https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd":cwe, "https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd":cvssBelow}' is expected..

解决方案

这个问题也让我很困惑。原因是在这种情况下vulnerabilityName是包含换行符等的完整描述。因此vulnerabilityName需要把这些内容也考虑在内。 我通过以下方式解决了这个问题：

        <packageUrl regex="true">^pkg:javascript/DOMPurify@3\.2\.6$</packageUrl>
        <!-- (?s) enables DOTALL so . matches newlines — the vulnerability "name" is
             the full multi-line description text, not a short CVE/GHSA identifier -->
        <vulnerabilityName regex="true">(?s).*</vulnerabilityName>

这可能还可以进一步优化。