Bug: dep-scan picking up findings from CMakeLists.txt files

[gcatto]

Expected Behavior

I have started using dep-scan on a number of projects across a number of languages. I noticed I was getting strange malicious findings when running it on a C++ project. From what I can tell in the documentation, etc., C++ support only mentions Conan files (e.g., conanfile.txt).

Actual Behavior

dep-scan seems to be using CMakeLists.txt files in some way as reporting on findings as a result

Steps to Reproduce

1. Create a directory for this new dummy project
2. Within that directory, create a Test sub-directory
3. Within the Test sub-directory, create a CMakeLists.txt file with the following contents:

project(Test)

4. Run dep-scan this way:

depscan --src . --reports-dir ./dep-scan-reports --no-banner --explain --debug --type cpp

5. Get malicious findings in the output

Note that adding a Conan file (e.g., conanfile.txt) does not seem to change anything.

Additional Information

I am on depscan 5.4.1

[prabhu]

@gcatto Could you kindly retest with 5.4.3? We fixed #320 recently which appears to be similar issue.

[gcatto]

That does seem to help. Thanks kindly for your prompt response, @prabhu !

[gcatto]

@prabhu follow-up question, if you don't mind. When I run the command like this locally on my development machine (where I have cdxgen and depscan installed), I don't get any findings:

depscan --src . --reports-dir ./dep-scan-reports --no-banner --explain --debug --type cpp

When I run the same command as part of my CI process, where it is running within a container, it reports a bunch of container/OS findings. Is there any way to suppress those, since I have type set to cpp? Thanks!

[prabhu]

@gcatto No idea. Can you share the sbom generated in the CI? Or run cdxgen separately with the environment variable CDXGEN_DEBUG_MODE=true and share the output.

[gcatto]

@prabhu is it okay if I email them to you, instead of posting here? Is your email address on https://github.com/prabhu okay to use?

[prabhu]

prabhu at appthreat dot com

[gcatto]

Sent! Hopefully the files make it through. Thank you!