## dependency-check-core

## Tag List Report

The following document contains the listing of user tags found in the code. Below is the summary of the occurrences per tag.

Tag Class | Total number of occurrences | Tag strings used by tag class
--- | --- | ---
Todo Work | 32 | todo, FIXME

Each tag is detailed below:

### Todo Work

Number of occurrences found in the code: 32

org.owasp.dependencycheck.analyzer.ArchiveAnalyzer | Line
--- | ---
- can we get more evidence from the parent? EAR contains module name, etc. | 206
org.owasp.dependencycheck.analyzer.CPEAnalyzer | Line
- likely need to change the split... not sure if this will work for CPE with special chars | 446
the following isn't quite right is it? need to think about this guessing game a bit more. | 585
org.owasp.dependencycheck.analyzer.CPEAnalyzerTest | Line
- yeah, not a very good test as the results are the same with or without weighting... | 243
fix this assert Assert.assertEquals(expResult, result.get(0).getName()); | 251
org.owasp.dependencycheck.analyzer.FalsePositiveAnalyzer | Line
fix the version problem below | 152
- can we utilize the pom's groupid and artifactId to filter??? most of these are due to low quality data. Other idea would be to say any CPE found based on LOW confidence evidence should have a different CPE type? (this might be a better solution then just removing the URL for "best-guess" matches). | 264
move this startswith expression to a configuration file? | 275
org.owasp.dependencycheck.analyzer.JarAnalyzer | Line
remove weighting | 516
change this to a regex? | 633
validate that the starts with is correct... or does it start with a ./ or /? // is it different on different platforms? if (entry.startsWith("META-INF/maven/")) { //trim the meta-inf/maven and pom.xml... final String pomPath = entry.substring(15, entry.length() - 8).toLowerCase(); final String[] parts = pomPath.split("/"); if (parts == null || parts.length != 2) { //misplaced pom? //TODO add logging to FINE possiblePoms.add(entry); } parts[0] = parts[0].replace('.', '/'); parts[1] = parts[1].replace('.', '/'); for (ClassNameInformation cni : classes) { final String name = cni.getName(); if (StringUtils.containsIgnoreCase(name, parts[0])) { addEntry(usePoms, entry); } if (StringUtils.containsIgnoreCase(name, parts[1])) { addEntry(usePoms, entry); } } } else { // we have a JAR file with an incorrect POM layout... //TODO add logging to FINE possiblePoms.add(entry); } } List<String> retValue; if (usePoms.isEmpty()) { if (possiblePoms.isEmpty()) { retValue = pomEntries; } else { retValue = possiblePoms; } } else { retValue = new ArrayList<String>(); int maxCount = 0; for (Map.Entry<String, Integer> entry : usePoms.entrySet()) { final int current = entry.getValue().intValue(); if (current > maxCount) { maxCount = current; retValue.clear(); retValue.add(entry.getKey()); } else if (current == maxCount) { retValue.add(entry.getKey()); } } } return retValue; | 977
add logging to FINE possiblePoms.add(entry); } parts[0] = parts[0].replace('.', '/'); parts[1] = parts[1].replace('.', '/'); for (ClassNameInformation cni : classes) { final String name = cni.getName(); if (StringUtils.containsIgnoreCase(name, parts[0])) { addEntry(usePoms, entry); } if (StringUtils.containsIgnoreCase(name, parts[1])) { addEntry(usePoms, entry); } } } else { // we have a JAR file with an incorrect POM layout... //TODO add logging to FINE possiblePoms.add(entry); } } List<String> retValue; if (usePoms.isEmpty()) { if (possiblePoms.isEmpty()) { retValue = pomEntries; } else { retValue = possiblePoms; } } else { retValue = new ArrayList<String>(); int maxCount = 0; for (Map.Entry<String, Integer> entry : usePoms.entrySet()) { final int current = entry.getValue().intValue(); if (current > maxCount) { maxCount = current; retValue.clear(); retValue.add(entry.getKey()); } else if (current == maxCount) { retValue.add(entry.getKey()); } } } return retValue; | 984
add logging to FINE possiblePoms.add(entry); } } List<String> retValue; if (usePoms.isEmpty()) { if (possiblePoms.isEmpty()) { retValue = pomEntries; } else { retValue = possiblePoms; } } else { retValue = new ArrayList<String>(); int maxCount = 0; for (Map.Entry<String, Integer> entry : usePoms.entrySet()) { final int current = entry.getValue().intValue(); if (current > maxCount) { maxCount = current; retValue.clear(); retValue.add(entry.getKey()); } else if (current == maxCount) { retValue.add(entry.getKey()); } } } return retValue; | 999
org.owasp.dependencycheck.analyzer.NvdCveAnalyzer | Line
- remove this comment block after additional testing is completed note - valid match functionality has been moved into the CveDB class. // for (Vulnerability v : vulns) { // if (isValidMatch(dependency, v)) { // dependency.addVulnerability(v); // } // } | 110
- remove this comment block after additional testing is completed The following check has been moved into the CveDB class. // /** // * <p>Determines if this is a valid vulnerability match for the given // * dependency. Specifically, this is concerned with ensuring the version // * numbers are correct.</p> // * <p>Currently, this is focused on the issues with the versions for Struts // * 1 and Struts 2. In the future this will due better matching on more // * version numbers.</p> // * // * @param dependency the dependency // * @param v the vulnerability // * @return returns true if the vulnerability is for the given dependency // */ // private boolean isValidMatch(final Dependency dependency, final Vulnerability v) { // //right now I only know of the issue with Struts1/2 // // start with fixing this problem. // // //TODO extend this solution to do better version matching for the vulnerable software. // boolean struts1 = false; // boolean struts2 = false; // for (Identifier i : dependency.getIdentifiers()) { // if (i.getValue().startsWith("cpe:/a:apache:struts:")) { // final char version = i.getValue().charAt(21); // if (version == '1') { // struts1 = true; // } // if (version == '2') { // struts2 = true; // } // } // } // if (!struts1 && !struts2) { // return true; //we are not looking at struts, so return true. // } // if (struts1 && struts2) { // return true; //there is a mismatch here, but we can't solve it here so we return valid. // } // if (struts1) { // boolean hasStruts1Vuln = false; // boolean hasStruts2PreviousVersion = false; // for (VulnerableSoftware vs : v.getVulnerableSoftware()) { // //TODO FIX THIS // //hasStruts2PreviousVersion |= vs.hasPreviousVersion() && vs.getName().charAt(21) == '2'; // //hasStruts1Vuln |= vs.getName().charAt(21) == '1'; // } // if (!hasStruts1Vuln && hasStruts2PreviousVersion) { // return false; // } // } // // return true; // } | 169
extend this solution to do better version matching for the vulnerable software. // boolean struts1 = false; // boolean struts2 = false; // for (Identifier i : dependency.getIdentifiers()) { // if (i.getValue().startsWith("cpe:/a:apache:struts:")) { // final char version = i.getValue().charAt(21); // if (version == '1') { // struts1 = true; // } // if (version == '2') { // struts2 = true; // } // } // } // if (!struts1 && !struts2) { // return true; //we are not looking at struts, so return true. // } // if (struts1 && struts2) { // return true; //there is a mismatch here, but we can't solve it here so we return valid. // } // if (struts1) { // boolean hasStruts1Vuln = false; // boolean hasStruts2PreviousVersion = false; // for (VulnerableSoftware vs : v.getVulnerableSoftware()) { // //TODO FIX THIS // //hasStruts2PreviousVersion |= vs.hasPreviousVersion() && vs.getName().charAt(21) == '2'; // //hasStruts1Vuln |= vs.getName().charAt(21) == '1'; // } // if (!hasStruts1Vuln && hasStruts2PreviousVersion) { // return false; // } // } // // return true; // } | 187
FIX THIS // //hasStruts2PreviousVersion |= vs.hasPreviousVersion() && vs.getName().charAt(21) == '2'; // //hasStruts1Vuln |= vs.getName().charAt(21) == '1'; // } // if (!hasStruts1Vuln && hasStruts2PreviousVersion) { // return false; // } // } // // return true; // } | 211
org.owasp.dependencycheck.concurrency.DirectorySpinLock | Line
uncomment this once support for 1.6 is dropped. if (lock != null) { try { lock.close(); } catch (IOException ex) { Logger.getLogger(DirectorySpinLock.class.getName()).log(Level.FINEST, "Unable to close file lock due to IO Exception", ex); } } | 227
org.owasp.dependencycheck.data.cpe.CpeIndexReader | Line
add spinlock (shared) | 80
remove spinlock (shared) | 93
org.owasp.dependencycheck.data.cpe.CpeIndexWriter | Line
add spinlock | 62
remove spinlock | 74
org.owasp.dependencycheck.data.lucene.SearchVersionAnalyzer | Line
consider implementing payloads/custom attributes... use custom attributes for major, minor, x, x, x, rcx these can then be used to weight the score for searches on the version. see http://lucene.apache.org/core/3_6_1/api/core/org/apache/lucene/analysis/package-summary.html#package_description look at this article to implement http://www.codewrecks.com/blog/index.php/2012/08/25/index-your-blog-using-tags-and-lucene-net/ | 38
org.owasp.dependencycheck.data.lucene.VersionAnalyzer | Line
consider implementing payloads/custom attributes... use custom attributes for major, minor, x, x, x, rcx these can then be used to weight the score for searches on the version. see http://lucene.apache.org/core/3_6_1/api/core/org/apache/lucene/analysis/package-summary.html#package_description look at this article to implement http://www.codewrecks.com/blog/index.php/2012/08/25/index-your-blog-using-tags-and-lucene-net/ | 37
org.owasp.dependencycheck.data.lucene.VersionTokenizingFilter | Line
should we also be splitting on dash or underscore? we would need to incorporate the dash or underscore back in... | 83
org.owasp.dependencycheck.data.nvdcve.CveDB | Line
consider utilizing the matchThreeVersion method to get additional results. However, this might also introduce false positives. | 674
org.owasp.dependencycheck.data.update.BatchUpdateTask | Line
add FTP? | 112
org.owasp.dependencycheck.data.update.BatchUpdateTaskTest | Line
add some actual asserts to check things. | 119
org.owasp.dependencycheck.data.update.StandardUpdateTaskIntegrationTest | Line
make this an actual test | 69
org.owasp.dependencycheck.dependency.EvidenceCollection | Line
consider changing the regex to only compare alpha-numeric (i.e. strip everything else) | 244
org.owasp.dependencycheck.utils.DependencyVersion | Line
steal better version of code from compareTo | 140
org.owasp.dependencycheck.utils.Downloader | Line
add the FPR protocol? | 134