title: Fortify complains about Maven's pom.xml external schemas
body: <p>Based on Fortify (static code analyzer by HP) report, apparently the following lines of <strong>pom.xml</strong> is vulnerability:</p>
  
  <pre><code>    &lt;project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
           xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/maven-v4_0_0.xsd"&gt;
  ...
  </code></pre>
  
  <p>Because</p>
  
  <blockquote>
    <p><strong>Build Misconfiguration: External Maven Dependency Repository</strong>: This maven build script relies on external sources, which could allow an attacker to insert malicious code into the final product or to take control of the build machine.</p>
  </blockquote>
  
  <p>It's somewhat false-positive detection, but according to my company paranoid security policies I cannot suppress this. So now pom.xml looks like this:</p>
  
  <pre><code>&lt;project&gt;
  ...
  </code></pre>
  
  <p>It's still builds/compiles correctly. IDE still recognizes file as a valid  Maven Project Object Model file. Nothing bad happened. </p>
  
  <p>I was wondering is there any possible scenario where this modification might cause some real issues? For example some known tool or parser won't recognize this as a valid Maven's project file. Thanks.</p>