From 31beddd0684c85337335d705a1fc5b1922864003 Mon Sep 17 00:00:00 2001
From: Joe Di Pol <joe.dipol@oracle.com>
Date: Fri, 20 Sep 2024 14:59:40 -0700
Subject: [PATCH] Suppression for smallrye-open-api-ui

---
 etc/dependency-check-suppression.xml | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/etc/dependency-check-suppression.xml b/etc/dependency-check-suppression.xml
index 889c4c35533..771312c2cb0 100644
--- a/etc/dependency-check-suppression.xml
+++ b/etc/dependency-check-suppression.xml
@@ -2,6 +2,21 @@
 <suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">
 <!-- For information see https://jeremylong.github.io/DependencyCheck/general/suppression.html -->
 
+<!--
+    This CVE is against DOMPurify brought in by javascript in the smallrye UI component.
+    In 4.x we made this component "provided". We can't do that in 2.x and 3.x due to compatiblity concerns.
+    Also, this is primarily a developer feature and not intended for a production runtime.
+-->
+
+<suppress>
+   <notes><![CDATA[
+   file name: smallrye-open-api-ui-2.0.26.jar: swagger-ui-bundle.js
+   ]]></notes>
+   <packageUrl regex="true">^pkg:javascript/DOMPurify@.*$</packageUrl>
+   <vulnerabilityName>CVE-2024-45801</vulnerabilityName>
+</suppress>
+
+
 <!-- This CVE is against the etcd server. We use the Java client
 -->
 <suppress>