From 7d761d2600787d373639abe5e20ed51805880cd8 Mon Sep 17 00:00:00 2001
From: Albin <albin@mullvad.net>
Date: Fri, 7 Jun 2024 10:44:56 +0200
Subject: [PATCH 1/3] Push suppression of CVE-2018-1000840

Pushing the suppression a few months so that
we can revisit it after bumping to K2.
---
 android/config/dependency-check-suppression.xml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/android/config/dependency-check-suppression.xml b/android/config/dependency-check-suppression.xml
index 5415813d1a1e..c7fd525968f4 100644
--- a/android/config/dependency-check-suppression.xml
+++ b/android/config/dependency-check-suppression.xml
@@ -18,7 +18,7 @@
         <packageUrl regex="true">^pkg:maven/com\.squareup\.okio/okio@.*$</packageUrl>
         <cve>CVE-2023-3635</cve>
     </suppress>
-    <suppress until="2024-06-01Z">
+    <suppress until="2024-09-01Z">
         <notes><![CDATA[
           This CVE only affect programs using loadXML and is derived from using ksp.
           We do not use the loadXML, ksp is used to generate navigation paths in our code

From 33be62329b449c54cef482c6578fb0b0bc92dc72 Mon Sep 17 00:00:00 2001
From: Albin <albin@mullvad.net>
Date: Fri, 7 Jun 2024 10:46:22 +0200
Subject: [PATCH 2/3] Remove outdated suppression for CVE-2023-3635

---
 android/config/dependency-check-suppression.xml | 10 ----------
 android/test/test-suppression.xml               | 10 ----------
 2 files changed, 20 deletions(-)

diff --git a/android/config/dependency-check-suppression.xml b/android/config/dependency-check-suppression.xml
index c7fd525968f4..cfc9a57563cc 100644
--- a/android/config/dependency-check-suppression.xml
+++ b/android/config/dependency-check-suppression.xml
@@ -8,16 +8,6 @@
         <packageUrl regex="true">^pkg:maven/org\.jetbrains\.kotlin/kotlin\-stdlib.*@.*$</packageUrl>
         <cve>CVE-2022-24329</cve>
     </suppress>
-    <suppress until="2024-06-01Z">
-        <notes><![CDATA[
-        This CVE only affect the leakCanary build type which is limited to memory leak testing etc.
-        This will most likely be solved by bumping to a future version of the leakcanary dependency
-        where a fixed version of okio is used.
-        https://nvd.nist.gov/vuln/detail/CVE-2023-3635
-        ]]></notes>
-        <packageUrl regex="true">^pkg:maven/com\.squareup\.okio/okio@.*$</packageUrl>
-        <cve>CVE-2023-3635</cve>
-    </suppress>
     <suppress until="2024-09-01Z">
         <notes><![CDATA[
           This CVE only affect programs using loadXML and is derived from using ksp.
diff --git a/android/test/test-suppression.xml b/android/test/test-suppression.xml
index 2e379e906229..ef8f8c470262 100644
--- a/android/test/test-suppression.xml
+++ b/android/test/test-suppression.xml
@@ -1,15 +1,5 @@
 <?xml version="1.0" encoding="UTF-8"?>
 <suppressions xmlns="https://jeremylong.github.io/DependencyCheck/dependency-suppression.1.3.xsd">
-    <suppress until="2024-06-01Z">
-        <notes><![CDATA[
-        This CVE only affect the leakCanary build type which is limited to memory leak testing etc.
-        This will most likely be solved by bumping to a future version of the leakcanary dependency
-        where a fixed version of okio is used.
-        https://nvd.nist.gov/vuln/detail/CVE-2023-3635
-        ]]></notes>
-        <packageUrl regex="true">^pkg:maven/com\.squareup\.okio/okio.*@.*$</packageUrl>
-        <cve>CVE-2023-3635</cve>
-    </suppress>
     <suppress until="2024-09-01Z">
         <notes><![CDATA[
             False-positive related to Drupal rather than Android development.

From b6099763bd38e16c9b6ded06be180f971818db35 Mon Sep 17 00:00:00 2001
From: Albin <albin@mullvad.net>
Date: Fri, 7 Jun 2024 11:23:58 +0200
Subject: [PATCH 3/3] Suppress gRPC CVEs

These CVEs are a combination of a false-positive
and CVEs not affecting our app.
---
 android/config/dependency-check-suppression.xml | 16 ++++++++++++++++
 android/test/test-suppression.xml               |  9 +++++++++
 2 files changed, 25 insertions(+)

diff --git a/android/config/dependency-check-suppression.xml b/android/config/dependency-check-suppression.xml
index cfc9a57563cc..589b5d5317fa 100644
--- a/android/config/dependency-check-suppression.xml
+++ b/android/config/dependency-check-suppression.xml
@@ -25,4 +25,20 @@
         <packageUrl regex="true">^pkg:maven/androidx\.test\.services/storage@.*$</packageUrl>
         <cve>CVE-2014-9152</cve>
     </suppress>
+    <suppress until="2024-12-01Z">
+        <notes><![CDATA[
+            False-positive only affecting javascript gRPC packages.
+        ]]></notes>
+        <packageUrl regex="true">^pkg:maven/io\.grpc/protoc\-gen\-grpc\-kotlin@.*$</packageUrl>
+        <cve>CVE-2020-7768</cve>
+    </suppress>
+    <suppress until="2024-12-01Z">
+        <notes><![CDATA[
+            No impact on this app since it uses UDS rather than HTTP2.
+        ]]></notes>
+        <packageUrl regex="true">^pkg:maven/io\.grpc/.*@.*$</packageUrl>
+        <cve>CVE-2023-32732</cve>
+        <cve>CVE-2023-33953</cve>
+        <cve>CVE-2023-44487</cve>
+    </suppress>
 </suppressions>
diff --git a/android/test/test-suppression.xml b/android/test/test-suppression.xml
index ef8f8c470262..fac53625c9a1 100644
--- a/android/test/test-suppression.xml
+++ b/android/test/test-suppression.xml
@@ -8,4 +8,13 @@
         <packageUrl regex="true">^pkg:maven/androidx\.test\.services/storage@.*$</packageUrl>
         <cve>CVE-2014-9152</cve>
     </suppress>
+    <suppress until="2024-12-01Z">
+        <notes><![CDATA[
+            No impact on this app since it uses UDS rather than HTTP2.
+        ]]></notes>
+        <packageUrl regex="true">^pkg:maven/io\.grpc/grpc.*-stub@.*$</packageUrl>
+        <cve>CVE-2023-32732</cve>
+        <cve>CVE-2023-33953</cve>
+        <cve>CVE-2023-44487</cve>
+    </suppress>
 </suppressions>