View Javadoc

    1   /*
    2    * This file is part of dependency-check-core.
    3    *
    4    * Dependency-check-core is free software: you can redistribute it and/or modify it
    5    * under the terms of the GNU General Public License as published by the Free
    6    * Software Foundation, either version 3 of the License, or (at your option) any
    7    * later version.
    8    *
    9    * Dependency-check-core is distributed in the hope that it will be useful, but
    10   * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
    11   * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
    12   * details.
    13   *
    14   * You should have received a copy of the GNU General Public License along with
    15   * dependency-check-core. If not, see http://www.gnu.org/licenses/.
    16   *
    17   * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
    18   */
    19  package org.owasp.dependencycheck.dependency;
    20
    21  import java.io.Serializable;
    22  import java.util.Set;
    23  import java.util.SortedSet;
    24  import java.util.TreeSet;
    25
    26  /**
    27   * Contains the information about a vulnerability.
    28   *
    29   * @author Jeremy Long (jeremy.long@owasp.org)
    30   */
    31  public class Vulnerability implements Serializable, Comparable<Vulnerability> {
    32
    33      /**
    34       * The serial version uid.
    35       */
    36      private static final long serialVersionUID = 307319490326651052L;
    37      /**
    38       * The name of the vulnerability.
    39       */
    40      private String name;
    41
    42      /**
    43       * Get the value of name.
    44       *
    45       * @return the value of name
    46       */
    47      public String getName() {
    48          return name;
    49      }
    50
    51      /**
    52       * Set the value of name.
    53       *
    54       * @param name new value of name
    55       */
    56      public void setName(String name) {
    57          this.name = name;
    58      }
    59      /**
    60       * the description of the vulnerability.
    61       */
    62      private String description;
    63
    64      /**
    65       * Get the value of description.
    66       *
    67       * @return the value of description
    68       */
    69      public String getDescription() {
    70          return description;
    71      }
    72
    73      /**
    74       * Set the value of description.
    75       *
    76       * @param description new value of description
    77       */
    78      public void setDescription(String description) {
    79          this.description = description;
    80      }
    81      /**
    82       * References for this vulnerability.
    83       */
    84      private SortedSet<Reference> references = new TreeSet<Reference>();
    85
    86      /**
    87       * Get the value of references.
    88       *
    89       * @return the value of references
    90       */
    91      public Set<Reference> getReferences() {
    92          return references;
    93      }
    94
    95      /**
    96       * Set the value of references.
    97       *
    98       * @param references new value of references
    99       */
    100     public void setReferences(SortedSet<Reference> references) {
    101         this.references = references;
    102     }
    103
    104     /**
    105      * Adds a reference to the references collection.
    106      *
    107      * @param ref a reference for the vulnerability
    108      */
    109     public void addReference(Reference ref) {
    110         this.references.add(ref);
    111     }
    112
    113     /**
    114      * Adds a reference.
    115      *
    116      * @param referenceSource the source of the reference
    117      * @param referenceName the referenceName of the reference
    118      * @param referenceUrl the url of the reference
    119      */
    120     public void addReference(String referenceSource, String referenceName, String referenceUrl) {
    121         final Reference ref = new Reference();
    122         ref.setSource(referenceSource);
    123         ref.setName(referenceName);
    124         ref.setUrl(referenceUrl);
    125         this.references.add(ref);
    126     }
    127     /**
    128      * A set of vulnerable software.
    129      */
    130     private SortedSet<VulnerableSoftware> vulnerableSoftware = new TreeSet<VulnerableSoftware>();
    131
    132     /**
    133      * Get the value of vulnerableSoftware.
    134      *
    135      * @return the value of vulnerableSoftware
    136      */
    137     public Set<VulnerableSoftware> getVulnerableSoftware() {
    138         return vulnerableSoftware;
    139     }
    140
    141     /**
    142      * Set the value of vulnerableSoftware.
    143      *
    144      * @param vulnerableSoftware new value of vulnerableSoftware
    145      */
    146     public void setVulnerableSoftware(SortedSet<VulnerableSoftware> vulnerableSoftware) {
    147         this.vulnerableSoftware = vulnerableSoftware;
    148     }
    149
    150     /**
    151      * Adds an entry for vulnerable software.
    152      *
    153      * @param cpe string representation of a CPE entry
    154      * @return if the add succeeded
    155      */
    156     public boolean addVulnerableSoftware(String cpe) {
    157         return addVulnerableSoftware(cpe, null);
    158     }
    159
    160     /**
    161      * Adds an entry for vulnerable software.
    162      *
    163      * @param cpe string representation of a cpe
    164      * @param previousVersion the previous version (previousVersion - cpe would
    165      * be considered vulnerable)
    166      * @return if the add succeeded
    167      */
    168     public boolean addVulnerableSoftware(String cpe, String previousVersion) {
    169         final VulnerableSoftware vs = new VulnerableSoftware();
    170         vs.setCpe(cpe);
    171         if (previousVersion != null) {
    172             vs.setPreviousVersion(previousVersion);
    173         }
    174         return updateVulnerableSoftware(vs);
    175     }
    176
    177     /**
    178      * Adds or updates a vulnerable software entry.
    179      *
    180      * @param vulnSoftware the vulnerable software
    181      * @return if the update succeeded
    182      */
    183     public boolean updateVulnerableSoftware(VulnerableSoftware vulnSoftware) {
    184         if (vulnerableSoftware.contains(vulnSoftware)) {
    185             vulnerableSoftware.remove(vulnSoftware);
    186         }
    187         return vulnerableSoftware.add(vulnSoftware);
    188     }
    189     /**
    190      * The CWE for the vulnerability.
    191      */
    192     private String cwe;
    193
    194     /**
    195      * Get the value of cwe.
    196      *
    197      * @return the value of cwe
    198      */
    199     public String getCwe() {
    200         return cwe;
    201     }
    202
    203     /**
    204      * Set the value of cwe.
    205      *
    206      * @param cwe new value of cwe
    207      */
    208     public void setCwe(String cwe) {
    209         this.cwe = cwe;
    210     }
    211     /**
    212      * CVSS Score.
    213      */
    214     private float cvssScore;
    215
    216     /**
    217      * Get the value of cvssScore.
    218      *
    219      * @return the value of cvssScore
    220      */
    221     public float getCvssScore() {
    222         return cvssScore;
    223     }
    224
    225     /**
    226      * Set the value of cvssScore.
    227      *
    228      * @param cvssScore new value of cvssScore
    229      */
    230     public void setCvssScore(float cvssScore) {
    231         this.cvssScore = cvssScore;
    232     }
    233     /**
    234      * CVSS Access Vector.
    235      */
    236     private String cvssAccessVector;
    237
    238     /**
    239      * Get the value of cvssAccessVector.
    240      *
    241      * @return the value of cvssAccessVector
    242      */
    243     public String getCvssAccessVector() {
    244         return cvssAccessVector;
    245     }
    246
    247     /**
    248      * Set the value of cvssAccessVector.
    249      *
    250      * @param cvssAccessVector new value of cvssAccessVector
    251      */
    252     public void setCvssAccessVector(String cvssAccessVector) {
    253         this.cvssAccessVector = cvssAccessVector;
    254     }
    255     /**
    256      * CVSS Access Complexity.
    257      */
    258     private String cvssAccessComplexity;
    259
    260     /**
    261      * Get the value of cvssAccessComplexity.
    262      *
    263      * @return the value of cvssAccessComplexity
    264      */
    265     public String getCvssAccessComplexity() {
    266         return cvssAccessComplexity;
    267     }
    268
    269     /**
    270      * Set the value of cvssAccessComplexity.
    271      *
    272      * @param cvssAccessComplexity new value of cvssAccessComplexity
    273      */
    274     public void setCvssAccessComplexity(String cvssAccessComplexity) {
    275         this.cvssAccessComplexity = cvssAccessComplexity;
    276     }
    277     /**
    278      * CVSS Authentication.
    279      */
    280     private String cvssAuthentication;
    281
    282     /**
    283      * Get the value of cvssAuthentication.
    284      *
    285      * @return the value of cvssAuthentication
    286      */
    287     public String getCvssAuthentication() {
    288         return cvssAuthentication;
    289     }
    290
    291     /**
    292      * Set the value of cvssAuthentication.
    293      *
    294      * @param cvssAuthentication new value of cvssAuthentication
    295      */
    296     public void setCvssAuthentication(String cvssAuthentication) {
    297         this.cvssAuthentication = cvssAuthentication;
    298     }
    299     /**
    300      * CVSS Confidentiality Impact.
    301      */
    302     private String cvssConfidentialityImpact;
    303
    304     /**
    305      * Get the value of cvssConfidentialityImpact.
    306      *
    307      * @return the value of cvssConfidentialityImpact
    308      */
    309     public String getCvssConfidentialityImpact() {
    310         return cvssConfidentialityImpact;
    311     }
    312
    313     /**
    314      * Set the value of cvssConfidentialityImpact.
    315      *
    316      * @param cvssConfidentialityImpact new value of cvssConfidentialityImpact
    317      */
    318     public void setCvssConfidentialityImpact(String cvssConfidentialityImpact) {
    319         this.cvssConfidentialityImpact = cvssConfidentialityImpact;
    320     }
    321     /**
    322      * CVSS Integrity Impact.
    323      */
    324     private String cvssIntegrityImpact;
    325
    326     /**
    327      * Get the value of cvssIntegrityImpact.
    328      *
    329      * @return the value of cvssIntegrityImpact
    330      */
    331     public String getCvssIntegrityImpact() {
    332         return cvssIntegrityImpact;
    333     }
    334
    335     /**
    336      * Set the value of cvssIntegrityImpact.
    337      *
    338      * @param cvssIntegrityImpact new value of cvssIntegrityImpact
    339      */
    340     public void setCvssIntegrityImpact(String cvssIntegrityImpact) {
    341         this.cvssIntegrityImpact = cvssIntegrityImpact;
    342     }
    343     /**
    344      * CVSS Availability Impact.
    345      */
    346     private String cvssAvailabilityImpact;
    347
    348     /**
    349      * Get the value of cvssAvailabilityImpact.
    350      *
    351      * @return the value of cvssAvailabilityImpact
    352      */
    353     public String getCvssAvailabilityImpact() {
    354         return cvssAvailabilityImpact;
    355     }
    356
    357     /**
    358      * Set the value of cvssAvailabilityImpact.
    359      *
    360      * @param cvssAvailabilityImpact new value of cvssAvailabilityImpact
    361      */
    362     public void setCvssAvailabilityImpact(String cvssAvailabilityImpact) {
    363         this.cvssAvailabilityImpact = cvssAvailabilityImpact;
    364     }
    365
    366     @Override
    367     public boolean equals(Object obj) {
    368         if (obj == null) {
    369             return false;
    370         }
    371         if (getClass() != obj.getClass()) {
    372             return false;
    373         }
    374         final Vulnerability other = (Vulnerability) obj;
    375         if ((this.name == null) ? (other.name != null) : !this.name.equals(other.name)) {
    376             return false;
    377         }
    378         return true;
    379     }
    380
    381     @Override
    382     public int hashCode() {
    383         int hash = 5;
    384         hash = 41 * hash + (this.name != null ? this.name.hashCode() : 0);
    385         return hash;
    386     }
    387
    388     /**
    389      * Compares two vulnerabilities.
    390      *
    391      * @param v a vulnerability to be compared
    392      * @return a negative integer, zero, or a positive integer as this object is
    393      * less than, equal to, or greater than the specified vulnerability
    394      */
    395     public int compareTo(Vulnerability v) {
    396         return v.getName().compareTo(this.getName());
    397     }
    398 }