From e5e094d3708038c0f8a59f47b776353467b7f4dc Mon Sep 17 00:00:00 2001 From: kingchenc Date: Fri, 12 Jun 2026 23:31:21 +0200 Subject: [PATCH] chore(supply-chain): suppress jackson false positive in the Maven sub-scans (#287) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Follow-up to #272. The root `osv-scanner.toml` cleared the OpenSSF Scorecard Vulnerabilities check from score 5 to 9 (the two pyo3 advisories, which live in `Cargo.lock` at the root). One finding remained — `GHSA-72hv-8253-57qq` (jackson-core 3.x async-parser DoS) — because OSV-Scanner resolves its config relative to each manifest, and the repo-root config does not cover the Maven sub-directory scans. This adds the same not-affected suppression next to the two Maven manifests (`bindings/java`, `examples/java`). `tools.jackson.core:jackson-core` 3.x is not a dependency of this project: full Maven resolution (publishing-plugin tree + project trees) resolves only jackson `2.16.1` / `2.17.1`; tools.jackson 3.x appears nowhere. OSV-Scanner's own resolver flags it as a false positive. --- bindings/java/osv-scanner.toml | 12 ++++++++++++ examples/java/osv-scanner.toml | 12 ++++++++++++ 2 files changed, 24 insertions(+) create mode 100644 bindings/java/osv-scanner.toml create mode 100644 examples/java/osv-scanner.toml diff --git a/bindings/java/osv-scanner.toml b/bindings/java/osv-scanner.toml new file mode 100644 index 00000000..bddbe49f --- /dev/null +++ b/bindings/java/osv-scanner.toml @@ -0,0 +1,12 @@ +# OSV-Scanner suppression for this Maven manifest. OSV-Scanner looks for an +# osv-scanner.toml next to each manifest it scans, and the repo-root config does +# not cover Maven sub-directory scans — so the jackson finding is suppressed +# here as well. See the root osv-scanner.toml and the SECURITY.md VEX section. +# +# tools.jackson.core:jackson-core 3.x is NOT a dependency of this project. Full +# Maven resolution (the publishing plugin tree and the project dependency tree) +# resolves only jackson 2.16.1 / 2.17.1; tools.jackson 3.x appears nowhere. +# OSV-Scanner's own resolver flags it as a false positive. +[[IgnoredVulns]] +id = "GHSA-72hv-8253-57qq" +reason = "tools.jackson.core:jackson-core 3.x is not a dependency; only jackson 2.x resolves. Not affected." diff --git a/examples/java/osv-scanner.toml b/examples/java/osv-scanner.toml new file mode 100644 index 00000000..dd68d0cd --- /dev/null +++ b/examples/java/osv-scanner.toml @@ -0,0 +1,12 @@ +# OSV-Scanner suppression for this Maven manifest. OSV-Scanner looks for an +# osv-scanner.toml next to each manifest it scans, and the repo-root config does +# not cover Maven sub-directory scans — so the jackson finding is suppressed +# here as well. See the root osv-scanner.toml and the SECURITY.md VEX section. +# +# tools.jackson.core:jackson-core 3.x is NOT a dependency of this project. This +# example resolves only com.fasterxml.jackson.core:jackson-databind 2.17.1 (and +# its 2.x jackson-core); tools.jackson 3.x appears nowhere. OSV-Scanner's own +# resolver flags it as a false positive. +[[IgnoredVulns]] +id = "GHSA-72hv-8253-57qq" +reason = "tools.jackson.core:jackson-core 3.x is not a dependency; only jackson 2.x resolves. Not affected."