From 3665dc270cf190158f6f8a2b33e9402931a9f097 Mon Sep 17 00:00:00 2001
From: Joe Di Pol <joe.dipol@oracle.com>
Date: Fri, 20 Sep 2024 13:36:46 -0700
Subject: [PATCH] Suppress DOMPurify

---
 etc/dependency-check-suppression.xml | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/etc/dependency-check-suppression.xml b/etc/dependency-check-suppression.xml
index 8f0bbc27599..1efa0467bff 100644
--- a/etc/dependency-check-suppression.xml
+++ b/etc/dependency-check-suppression.xml
@@ -2,6 +2,20 @@
 <suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">
 <!-- For information see https://jeremylong.github.io/DependencyCheck/general/suppression.html -->
 
+<!--
+    This CVE is against DOMPurify brought in by javascript in the smallrye UI component.
+    In 4.x we made this component "provided". We can't do that in 2.x and 3.x due to compatiblity concerns.
+    Also, this is primarily a developer feature and not intended for a production runtime.
+-->
+
+<suppress>
+   <notes><![CDATA[
+   file name: smallrye-open-api-ui-2.0.26.jar: swagger-ui-bundle.js
+   ]]></notes>
+   <packageUrl regex="true">^pkg:javascript/DOMPurify@.*$</packageUrl>
+   <vulnerabilityName>CVE-2024-45801</vulnerabilityName>
+</suppress>
+
 <!-- This CVE is against the etcd server. We ship a Java client -->
 <suppress>
    <notes><![CDATA[