Overview | Package | Class | Use | Tree | Deprecated | Index | Help
PREV CLASS NEXT CLASS | FRAMES NO FRAMES
SUMMARY: NESTED | FIELD | CONSTR | METHOD | DETAIL: FIELD | CONSTR | METHOD

## org.owasp.dependencycheck.data.nvdcve
Class CveDB

    java.lang.Object
      org.owasp.dependencycheck.data.nvdcve.CveDB

    public class CveDB

extends Object

The database holding information about the NVD CVE data.

Author:
  Jeremy Long (jeremy.long@owasp.org)

Field Summary
`static String` | `CLEANUP_ORPHANS` SQL Statement to cleanup orphan entries.
`static String` | `DB_SCHEMA_VERSION` The version of the current DB Schema.
`static String` | `DB_STRUCTURE_RESOURCE` Resource location for SQL file used to create the database schema.
`static String` | `DELETE_REFERENCE` SQL Statement to delete references by vulnerability ID.
`static String` | `DELETE_SOFTWARE` SQL Statement to delete software by vulnerability ID.
`static String` | `DELETE_VULNERABILITY` SQL Statement to delete a vulnerability by CVE.
`static String` | `INSERT_CPE` SQL Statement to insert a new cpe.
`static String` | `INSERT_REFERENCE` SQL Statement to insert a new reference.
`static String` | `INSERT_SOFTWARE` SQL Statement to insert a new software.
`static String` | `INSERT_VULNERABILITY` SQL Statement to insert a new vulnerability.
`static String` | `SELECT_CPE_ENTRIES` SQL Statement to find the CPE entry based on the vendor and product.
`static String` | `SELECT_CPE_ID` SQL Statement to get a CPEProductID.
`static String` | `SELECT_CVE_FROM_SOFTWARE` SQL Statement to find CVE entries based on CPE data.
`static String` | `SELECT_REFERENCE` SQL Statement to select references by CVEID.
`static String` | `SELECT_SOFTWARE` SQL Statement to select software by CVEID.
`static String` | `SELECT_VULNERABILITY` SQL Statement to select a vulnerability by CVEID.
`static String` | `SELECT_VULNERABILITY_ID` SQL Statement to select a vulnerability's primary key.
`static String` | `UPDATE_VULNERABILITY` SQL Statement to update a vulnerability.

Constructor Summary
`CveDB()`

Method Summary
`void` | `cleanupDatabase()` It is possible that orphaned rows may be generated during database updates.
`void` | `close()` Closes the DB4O database.
`void` | `commit()` Commits all completed transactions.
`protected void` | `createTables()` Creates the database structure (tables and indexes) to store the CVE data
`protected void` | `finalize()` Cleans up the object and ensures that "close" has been called.
`Set<VulnerableSoftware>` | `getCPEs(String vendor, String product)` Searches the CPE entries in the database and retrieves all entries for a given vendor and product combination.
`static File` | `getDataDirectory()` Retrieves the directory that the JAR file exists in so that we can ensure we always use a common data directory.
`List<Vulnerability>` | `getVulnerabilities(String cpeStr)` Retrieves the vulnerabilities associated with the specified CPE.
`void` | `open()` Opens the database connection.
`void` | `updateVulnerability(Vulnerability vuln)` Updates the vulnerability within the database.

Methods inherited from class java.lang.Object
`clone, equals, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

Field Detail

### DB_STRUCTURE_RESOURCE

    public static final String DB_STRUCTURE_RESOURCE

  Resource location for SQL file used to create the database schema.

  See Also:
    Constant Field Values

### DB_SCHEMA_VERSION

    public static final String DB_SCHEMA_VERSION

  The version of the current DB Schema.

  See Also:
    Constant Field Values

### DELETE_REFERENCE

    public static final String DELETE_REFERENCE

  SQL Statement to delete references by vulnerability ID.

  See Also:
    Constant Field Values

### DELETE_SOFTWARE

    public static final String DELETE_SOFTWARE

  SQL Statement to delete software by vulnerability ID.

  See Also:
    Constant Field Values

### DELETE_VULNERABILITY

    public static final String DELETE_VULNERABILITY

  SQL Statement to delete a vulnerability by CVE.

  See Also:
    Constant Field Values

### CLEANUP_ORPHANS

    public static final String CLEANUP_ORPHANS

  SQL Statement to cleanup orphan entries. Yes, the db schema could be a little tighter, but what we have works well to keep the data file size down a bit.

  See Also:
    Constant Field Values

### INSERT_REFERENCE

    public static final String INSERT_REFERENCE

  SQL Statement to insert a new reference.

  See Also:
    Constant Field Values

### INSERT_SOFTWARE

    public static final String INSERT_SOFTWARE

  SQL Statement to insert a new software.

  See Also:
    Constant Field Values

### INSERT_CPE

    public static final String INSERT_CPE

  SQL Statement to insert a new cpe.

  See Also:
    Constant Field Values

### SELECT_CPE_ID

    public static final String SELECT_CPE_ID

  SQL Statement to get a CPEProductID.

  See Also:
    Constant Field Values

### INSERT_VULNERABILITY

    public static final String INSERT_VULNERABILITY

  SQL Statement to insert a new vulnerability.

  See Also:
    Constant Field Values

### UPDATE_VULNERABILITY

    public static final String UPDATE_VULNERABILITY

  SQL Statement to update a vulnerability.

  See Also:
    Constant Field Values

### SELECT_CVE_FROM_SOFTWARE

    public static final String SELECT_CVE_FROM_SOFTWARE

  SQL Statement to find CVE entries based on CPE data.

  See Also:
    Constant Field Values

### SELECT_CPE_ENTRIES

    public static final String SELECT_CPE_ENTRIES

  SQL Statement to find the CPE entry based on the vendor and product.

  See Also:
    Constant Field Values

### SELECT_REFERENCE

    public static final String SELECT_REFERENCE

  SQL Statement to select references by CVEID.

  See Also:
    Constant Field Values

### SELECT_SOFTWARE

    public static final String SELECT_SOFTWARE

  SQL Statement to select software by CVEID.

  See Also:
    Constant Field Values

### SELECT_VULNERABILITY

    public static final String SELECT_VULNERABILITY

  SQL Statement to select a vulnerability by CVEID.

  See Also:
    Constant Field Values

### SELECT_VULNERABILITY_ID

    public static final String SELECT_VULNERABILITY_ID

  SQL Statement to select a vulnerability's primary key.

  See Also:
    Constant Field Values

Constructor Detail

### CveDB

    public CveDB()

Method Detail

### open

    public void open()
              throws IOException,
                     SQLException,
                     DatabaseException,
                     ClassNotFoundException

  Opens the database connection. If the database does not exist, it will create a new one.

  Throws:
    `IOException` - thrown if there is an IO Exception
    `SQLException` - thrown if there is a SQL Exception
    `DatabaseException` - thrown if there is an error initializing a new database
    `ClassNotFoundException` - thrown if the h2 database driver cannot be loaded

### commit

    public void commit()
                throws SQLException

  Commits all completed transactions.

  Throws:
    `SQLException` - thrown if a SQL Exception occurs

### finalize

    protected void finalize()
                     throws Throwable

  Cleans up the object and ensures that "close" has been called.

  Overrides:
    `finalize` in class `Object`
  Throws:
    `Throwable` - thrown if there is a problem

### close

    public void close()

  Closes the DB4O database. Close should be called on this object when it is done being used.

### getCPEs

    public Set<VulnerableSoftware> getCPEs(String vendor,
                                           String product)

  Searches the CPE entries in the database and retrieves all entries for a given vendor and product combination. The returned list will include all versions of the product that are registered in the NVD CVE data.

  Parameters:
    `vendor` - the identified vendor name of the dependency being analyzed
    `product` - the identified name of the product of the dependency being analyzed
  Returns:
    a set of vulnerable software

### getVulnerabilities

    public List<Vulnerability> getVulnerabilities(String cpeStr)
                                           throws DatabaseException

  Retrieves the vulnerabilities associated with the specified CPE.

  Parameters:
    `cpeStr` - the CPE name
  Returns:
    a list of Vulnerabilities
  Throws:
    `DatabaseException` - thrown if there is an exception retrieving data

### updateVulnerability

    public void updateVulnerability(Vulnerability vuln)
                             throws DatabaseException

  Updates the vulnerability within the database. If the vulnerability does not exist it will be added.

  Parameters:
    `vuln` - the vulnerability to add to the database
  Throws:
    `DatabaseException` - is thrown if the database

### getDataDirectory

    public static File getDataDirectory()
                                 throws IOException

  Retrieves the directory that the JAR file exists in so that we can ensure we always use a common data directory.

  Returns:
    the data directory for this index.
  Throws:
    `IOException` - is thrown if an IOException occurs of course...

### cleanupDatabase

    public void cleanupDatabase()

  It is possible that orphaned rows may be generated during database updates. This should be called after all updates have been completed to ensure orphan entries are removed.

### createTables

    protected void createTables()
                         throws SQLException,
                                DatabaseException

  Creates the database structure (tables and indexes) to store the CVE data

  Throws:
    `SQLException` - thrown if there is a sql exception
    `DatabaseException` - thrown if there is a database exception

Overview | Package | Class | Use | Tree | Deprecated | Index | Help
PREV CLASS NEXT CLASS | FRAMES NO FRAMES
SUMMARY: NESTED | FIELD | CONSTR | METHOD | DETAIL: FIELD | CONSTR | METHOD

Copyright © 2012-2013 OWASP. All Rights Reserved.