View Javadoc

    1   /*
    2    * This file is part of dependency-check-core.
    3    *
    4    * Dependency-check-core is free software: you can redistribute it and/or modify it
    5    * under the terms of the GNU General Public License as published by the Free
    6    * Software Foundation, either version 3 of the License, or (at your option) any
    7    * later version.
    8    *
    9    * Dependency-check-core is distributed in the hope that it will be useful, but
    10   * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
    11   * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
    12   * details.
    13   *
    14   * You should have received a copy of the GNU General Public License along with
    15   * dependency-check-core. If not, see http://www.gnu.org/licenses/.
    16   *
    17   * Copyright (c) 2013 Jeremy Long. All Rights Reserved.
    18   */
    19  package org.owasp.dependencycheck.utils;
    20
    21  import java.util.ArrayList;
    22  import java.util.regex.Matcher;
    23  import java.util.regex.Pattern;
    24
    25  /**
    26   * <p>A utility class to extract version numbers from file names (or other
    27   * strings containing version numbers.</p>
    28   *
    29   * @author Jeremy Long (jeremy.long@owasp.org)
    30   */
    31  public final class DependencyVersionUtil {
    32
    33      /**
    34       * Regular expression to extract version numbers from file names.
    35       */
    36      private static final Pattern RX_VERSION = Pattern.compile("\\d+(\\.\\d{1,6})+(\\.?([_-](release|beta|alpha)|[a-zA-Z_-]{1,3}\\d{1,8}))?");
    37      /**
    38       * Regular expression to extract a single version number without periods.
    39       * This is a last ditch effort just to check in case we are missing a
    40       * version number using the previous regex.
    41       */
    42      private static final Pattern RX_SINGLE_VERSION = Pattern.compile("\\d+(\\.?([_-](release|beta|alpha)|[a-zA-Z_-]{1,3}\\d{1,8}))?");
    43
    44      /**
    45       * Private constructor for utility class.
    46       */
    47      private DependencyVersionUtil() {
    48      }
    49
    50      /**
    51       * <p>A utility class to extract version numbers from file names (or other
    52       * strings containing version numbers.<br/>
    53       * Example:<br/>
    54       * Give the file name: library-name-1.4.1r2-release.jar<br/>
    55       * This function would return: 1.4.1.r2</p>
    56       *
    57       * @param text the text being analyzed
    58       * @return a DependencyVersion containing the version
    59       */
    60      public static DependencyVersion parseVersion(String text) {
    61          if (text == null) {
    62              return null;
    63          }
    64          //'-' is a special case used within the CVE entries, just include it as the version.
    65          if ("-".equals(text)) {
    66              final DependencyVersion dv = new DependencyVersion();
    67              final ArrayList<String> list = new ArrayList<String>();
    68              list.add(text);
    69              dv.setVersionParts(list);
    70              return dv;
    71          }
    72          String version = null;
    73          Matcher matcher = RX_VERSION.matcher(text);
    74          if (matcher.find()) {
    75              version = matcher.group();
    76          }
    77          //throw away the results if there are two things that look like version numbers
    78          if (matcher.find()) {
    79              return null;
    80          }
    81          if (version == null) {
    82              matcher = RX_SINGLE_VERSION.matcher(text);
    83              if (matcher.find()) {
    84                  version = matcher.group();
    85              } else {
    86                  return null;
    87              }
    88              //throw away the results if there are two things that look like version numbers
    89              if (matcher.find()) {
    90                  return null;
    91              }
    92          }
    93          return new DependencyVersion(version);
    94      }
    95  }