Skip to content
Novus Examples
xml3.6 KB

OWASP Dependency-Check Report (XML)

The XML twin of the Dependency-Check report — the form most Maven and Jenkins integrations consume — carrying the same four SAMPLE findings inside a namespaced analysis element. Advisory identifiers use the invented NOVUS-SAMPLE namespace with SAMPLE-CVE aliases; no identifier here refers to a published CVE, GHSA or OSV record, and no package named exists.

Conversion testingSchema validationError handling
Preview — first 50 linesxml
<?xml version="1.0" encoding="UTF-8"?>
<analysis xmlns="https://jeremylong.github.io/DependencyCheck/dependency-check.2.5.xsd">
  <scanInfo><engineVersion>0.0.0-sample</engineVersion></scanInfo>
  <projectInfo>
    <name>orchard-gateway</name>
    <reportDate>2026-01-01T00:00:00Z</reportDate>
    <credits>Advisory identifiers use the invented NOVUS-SAMPLE namespace with SAMPLE-CVE aliases; no identifier here refers to a published CVE, GHSA or OSV record, and no package named exists.</credits>
  </projectInfo>
  <dependencies>
    <dependency>
      <fileName>example-logger-3.4.1.tgz</fileName>
      <sha256>7fb72ea58987e5327259b66384f96f5e657c3ce5225b8891c567cac6b58430ec</sha256>
      <vulnerabilities>
        <vulnerability source="NOVUS-SAMPLE">
          <name>NOVUS-SAMPLE-2026-0001</name>
          <severity>HIGH</severity>
          <cvssV3><baseScore>8.1</baseScore><baseSeverity>HIGH</baseSeverity></cvssV3>
          <cwes><cwe>CWE-20</cwe></cwes>
          <description>SAMPLE advisory: fabricated improper-input-validation issue in a fictional logging library.</description>
          <vulnerableSoftware>
            <software versionEndExcluding="3.5.0">pkg:npm/example-logger@3.4.1</software>
          </vulnerableSoftware>
        </vulnerability>
      </vulnerabilities>
    </dependency>
    <dependency>
      <fileName>example-cache-0.9.2.tgz</fileName>
      <sha256>f7af2ad2d3c3daaa5991b0eae38ffa151a2e2f3bf0f2bdd7333adc3a1dc860f7</sha256>
      <vulnerabilities>
        <vulnerability source="NOVUS-SAMPLE">
          <name>NOVUS-SAMPLE-2026-0002</name>
          <severity>CRITICAL</severity>
          <cvssV3><baseScore>9.3</baseScore><baseSeverity>CRITICAL</baseSeverity></cvssV3>
          <cwes><cwe>CWE-502</cwe></cwes>
          <description>SAMPLE advisory: fabricated unsafe-deserialisation issue in a fictional cache library.</description>
          <vulnerableSoftware>
            <software versionEndExcluding="0.9.5">pkg:npm/example-cache@0.9.2</software>
          </vulnerableSoftware>
        </vulnerability>
      </vulnerabilities>
    </dependency>
    <dependency>
      <fileName>example-yaml-lite-1.1.7.tgz</fileName>
      <sha256>d7094de3c8e15621381e5f9f02c0eecb9977d249a8a06ab2b0a34f5344a039af</sha256>
      <vulnerabilities>
        <vulnerability source="NOVUS-SAMPLE">
          <name>NOVUS-SAMPLE-2026-0003</name>
          <severity>MEDIUM</severity>
          <cvssV3><baseScore>5.4</baseScore><baseSeverity>MEDIUM</baseSeverity></cvssV3>
          <cwes><cwe>CWE-400</cwe></cwes>
… 76 lines total — download for the full file.

Specifications

Seed
51200
Sample Only
true
Tool
Dependency-Check-shaped
Serialisation
XML
Dependencies
4
Namespaced
true
Line Endings
LF

Testing contract

Reference control
Scenario
Parse a namespaced XML report and diff it against its JSON twin.
Expected result
Both files yield the same four advisory ids, severities and base scores; an XPath that ignores the default namespace finds nothing and fails the test.

What is a .xml file?

XML (Extensible Markup Language) is a verbose, self-describing markup language using nested tags, attributes, and namespaces to represent structured, hierarchical data. It supports schemas, entities, and validation and underlies many document and data formats. It remains common in enterprise, publishing, and interchange contexts.

How to use this file

Use an example XML file to test parsers, namespace and schema validation, XPath queries, and protection against entity-expansion and external-entity attacks.

How to use this file for testing

“OWASP Dependency-Check Report (XML)” is a deterministic Novus Examples fixture for Conversion testing, Schema validation, Error handling. The same content exported across many formats and linked as a group, so you can convert one and diff against the expected twin.

Documented properties for this file: seed 51200 · LF. Compare results against paired or grouped companions on this page when present (clean↔damaged, searchable↔scanned, or format twins) so scores stay reproducible across runs.

Download the file once, keep the path stable in CI or local scripts, and treat the spec table as the contract: dimensions, seeds, field lists, and roles are intentional. Corrupt or invalid samples are labelled as such — expect parsers to fail loudly rather than silently accept them.

SBOM, lockfile, provenance, and advisory fixtures describe the same fabricated component tree across formats, so a converter or scanner can be diffed against a known answer. Every package name, version, hash, and advisory ID is invented — never treat a finding here as real.

Code examples

import xml.etree.ElementTree as ET

tree = ET.parse("dependency-check-report.xml")
root = tree.getroot()
print(root.tag, [c.tag for c in root][:5])

Related files

Generated by generation/supply_chain.py. Free for any use, no attribution required — license.