mas = searcher.searchSha1(dependency.getSha1sum());
+ final Confidence confidence = mas.size() > 1 ? Confidence.HIGH : Confidence.HIGHEST;
+ for (MavenArtifact ma : mas) {
+ LOGGER.fine(String.format("Central analyzer found artifact (%s) for dependency (%s)", ma.toString(), dependency.getFileName()));
+ dependency.addAsEvidence("central", ma, confidence);
+ boolean pomAnalyzed = false;
+ for (Evidence e : dependency.getVendorEvidence()) {
+ if ("pom".equals(e.getSource())) {
+ pomAnalyzed = true;
+ break;
+ }
+ }
+ if (!pomAnalyzed && ma.getPomUrl() != null) {
+ File pomFile = null;
+ try {
+ final File baseDir = Settings.getTempDirectory();
+ pomFile = File.createTempFile("pom", ".xml", baseDir);
+ if (!pomFile.delete()) {
+ final String msg = String.format("Unable to fetch pom.xml for %s from Central; "
+ + "this could result in undetected CPE/CVEs.", dependency.getFileName());
+ LOGGER.warning(msg);
+ LOGGER.fine("Unable to delete temp file");
+ }
+ LOGGER.fine(String.format("Downloading %s", ma.getPomUrl()));
+ Downloader.fetchFile(new URL(ma.getPomUrl()), pomFile);
+ pomUtil.analyzePOM(dependency, pomFile);
+
+ } catch (DownloadFailedException ex) {
+ final String msg = String.format("Unable to download pom.xml for %s from Central; "
+ + "this could result in undetected CPE/CVEs.", dependency.getFileName());
+ LOGGER.warning(msg);
+ } finally {
+ if (pomFile != null && !FileUtils.deleteQuietly(pomFile)) {
+ pomFile.deleteOnExit();
+ }
+ }
+ }
+
+ }
+ } catch (IllegalArgumentException iae) {
+ LOGGER.info(String.format("invalid sha1-hash on %s", dependency.getFileName()));
+ } catch (FileNotFoundException fnfe) {
+ LOGGER.fine(String.format("Artifact not found in repository: '%s", dependency.getFileName()));
+ } catch (IOException ioe) {
+ LOGGER.log(Level.FINE, "Could not connect to Central search", ioe);
+ errorFlag = true;
+ }
+ }
+
+}
diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/DependencyBundlingAnalyzer.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/DependencyBundlingAnalyzer.java
index 3c8a67471..fe1c653e4 100644
--- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/DependencyBundlingAnalyzer.java
+++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/DependencyBundlingAnalyzer.java
@@ -36,9 +36,9 @@ import org.owasp.dependencycheck.utils.LogUtils;
/**
*
- * This analyzer ensures dependencies that should be grouped together, to remove excess noise from the report, are
- * grouped. An example would be Spring, Spring Beans, Spring MVC, etc. If they are all for the same version and have the
- * same relative path then these should be grouped into a single dependency under the core/main library.
+ * This analyzer ensures dependencies that should be grouped together, to remove excess noise from the report, are grouped. An
+ * example would be Spring, Spring Beans, Spring MVC, etc. If they are all for the same version and have the same relative path
+ * then these should be grouped into a single dependency under the core/main library.
*
* Note, this grouping only works on dependencies with identified CVE entries
*
@@ -55,7 +55,7 @@ public class DependencyBundlingAnalyzer extends AbstractAnalyzer implements Anal
/**
* A pattern for obtaining the first part of a filename.
*/
- private static final Pattern STARTING_TEXT_PATTERN = Pattern.compile("^[a-zA-Z]*");
+ private static final Pattern STARTING_TEXT_PATTERN = Pattern.compile("^[a-zA-Z0-9]*");
/**
* a flag indicating if this analyzer has run. This analyzer only runs once.
*/
@@ -91,8 +91,8 @@ public class DependencyBundlingAnalyzer extends AbstractAnalyzer implements Anal
//
/**
- * Analyzes a set of dependencies. If they have been found to have the same base path and the same set of
- * identifiers they are likely related. The related dependencies are bundled into a single reportable item.
+ * Analyzes a set of dependencies. If they have been found to have the same base path and the same set of identifiers they are
+ * likely related. The related dependencies are bundled into a single reportable item.
*
* @param ignore this analyzer ignores the dependency being analyzed
* @param engine the engine that is scanning the dependencies
@@ -107,30 +107,34 @@ public class DependencyBundlingAnalyzer extends AbstractAnalyzer implements Anal
//for (Dependency nextDependency : engine.getDependencies()) {
while (mainIterator.hasNext()) {
final Dependency dependency = mainIterator.next();
- if (mainIterator.hasNext()) {
+ if (mainIterator.hasNext() && !dependenciesToRemove.contains(dependency)) {
final ListIterator subIterator = engine.getDependencies().listIterator(mainIterator.nextIndex());
while (subIterator.hasNext()) {
final Dependency nextDependency = subIterator.next();
if (hashesMatch(dependency, nextDependency)) {
- if (isCore(dependency, nextDependency)) {
+ if (firstPathIsShortest(dependency.getFilePath(), nextDependency.getFilePath())) {
mergeDependencies(dependency, nextDependency, dependenciesToRemove);
} else {
mergeDependencies(nextDependency, dependency, dependenciesToRemove);
+ break; //since we merged into the next dependency - skip forward to the next in mainIterator
}
} else if (isShadedJar(dependency, nextDependency)) {
if (dependency.getFileName().toLowerCase().endsWith("pom.xml")) {
- dependenciesToRemove.add(dependency);
+ mergeDependencies(nextDependency, dependency, dependenciesToRemove);
+ nextDependency.getRelatedDependencies().remove(dependency);
+ break;
} else {
- dependenciesToRemove.add(nextDependency);
+ mergeDependencies(dependency, nextDependency, dependenciesToRemove);
+ nextDependency.getRelatedDependencies().remove(nextDependency);
}
} else if (cpeIdentifiersMatch(dependency, nextDependency)
&& hasSameBasePath(dependency, nextDependency)
&& fileNameMatch(dependency, nextDependency)) {
-
if (isCore(dependency, nextDependency)) {
mergeDependencies(dependency, nextDependency, dependenciesToRemove);
} else {
mergeDependencies(nextDependency, dependency, dependenciesToRemove);
+ break; //since we merged into the next dependency - skip forward to the next in mainIterator
}
}
}
@@ -138,9 +142,7 @@ public class DependencyBundlingAnalyzer extends AbstractAnalyzer implements Anal
}
//removing dependencies here as ensuring correctness and avoiding ConcurrentUpdateExceptions
// was difficult because of the inner iterator.
- for (Dependency d : dependenciesToRemove) {
- engine.getDependencies().remove(d);
- }
+ engine.getDependencies().removeAll(dependenciesToRemove);
}
}
@@ -148,10 +150,10 @@ public class DependencyBundlingAnalyzer extends AbstractAnalyzer implements Anal
* Adds the relatedDependency to the dependency's related dependencies.
*
* @param dependency the main dependency
- * @param relatedDependency a collection of dependencies to be removed from the main analysis loop, this is the
- * source of dependencies to remove
- * @param dependenciesToRemove a collection of dependencies that will be removed from the main analysis loop, this
- * function adds to this collection
+ * @param relatedDependency a collection of dependencies to be removed from the main analysis loop, this is the source of
+ * dependencies to remove
+ * @param dependenciesToRemove a collection of dependencies that will be removed from the main analysis loop, this function
+ * adds to this collection
*/
private void mergeDependencies(final Dependency dependency, final Dependency relatedDependency, final Set dependenciesToRemove) {
dependency.addRelatedDependency(relatedDependency);
@@ -160,12 +162,14 @@ public class DependencyBundlingAnalyzer extends AbstractAnalyzer implements Anal
dependency.addRelatedDependency(i.next());
i.remove();
}
+ if (dependency.getSha1sum().equals(relatedDependency.getSha1sum())) {
+ dependency.addAllProjectReferences(relatedDependency.getProjectReferences());
+ }
dependenciesToRemove.add(relatedDependency);
}
/**
- * Attempts to trim a maven repo to a common base path. This is typically
- * [drive]\[repo_location]\repository\[path1]\[path2].
+ * Attempts to trim a maven repo to a common base path. This is typically [drive]\[repo_location]\repository\[path1]\[path2].
*
* @param path the path to trim
* @return a string representing the base path.
@@ -201,25 +205,8 @@ public class DependencyBundlingAnalyzer extends AbstractAnalyzer implements Anal
|| dependency2 == null || dependency2.getFileName() == null) {
return false;
}
- String fileName1 = dependency1.getFileName();
- String fileName2 = dependency2.getFileName();
-
- //update to deal with archive analyzer, the starting name maybe the same
- // as this is incorrectly looking at the starting path
- final File one = new File(fileName1);
- final File two = new File(fileName2);
- final String oneParent = one.getParent();
- final String twoParent = two.getParent();
- if (oneParent != null) {
- if (oneParent.equals(twoParent)) {
- fileName1 = one.getName();
- fileName2 = two.getName();
- } else {
- return false;
- }
- } else if (twoParent != null) {
- return false;
- }
+ final String fileName1 = dependency1.getActualFile().getName();
+ final String fileName2 = dependency2.getActualFile().getName();
//version check
final DependencyVersion version1 = DependencyVersionUtil.parseVersion(fileName1);
@@ -267,9 +254,11 @@ public class DependencyBundlingAnalyzer extends AbstractAnalyzer implements Anal
}
if (cpeCount1 > 0 && cpeCount1 == cpeCount2) {
for (Identifier i : dependency1.getIdentifiers()) {
- matches |= dependency2.getIdentifiers().contains(i);
- if (!matches) {
- break;
+ if ("cpe".equals(i.getType())) {
+ matches |= dependency2.getIdentifiers().contains(i);
+ if (!matches) {
+ break;
+ }
}
}
}
@@ -318,8 +307,8 @@ public class DependencyBundlingAnalyzer extends AbstractAnalyzer implements Anal
}
/**
- * This is likely a very broken attempt at determining if the 'left' dependency is the 'core' library in comparison
- * to the 'right' library.
+ * This is likely a very broken attempt at determining if the 'left' dependency is the 'core' library in comparison to the
+ * 'right' library.
*
* @param left the dependency to test
* @param right the dependency to test against
@@ -338,6 +327,10 @@ public class DependencyBundlingAnalyzer extends AbstractAnalyzer implements Anal
|| !rightName.contains("core") && leftName.contains("core")
|| !rightName.contains("kernel") && leftName.contains("kernel")) {
returnVal = true;
+// } else if (leftName.matches(".*struts2\\-core.*") && rightName.matches(".*xwork\\-core.*")) {
+// returnVal = true;
+// } else if (rightName.matches(".*struts2\\-core.*") && leftName.matches(".*xwork\\-core.*")) {
+// returnVal = false;
} else {
/*
* considered splitting the names up and comparing the components,
@@ -372,13 +365,12 @@ public class DependencyBundlingAnalyzer extends AbstractAnalyzer implements Anal
}
/**
- * Determines if the jar is shaded and the created pom.xml identified the same CPE as the jar - if so, the pom.xml
- * dependency should be removed.
+ * Determines if the jar is shaded and the created pom.xml identified the same CPE as the jar - if so, the pom.xml dependency
+ * should be removed.
*
* @param dependency a dependency to check
* @param nextDependency another dependency to check
- * @return true if on of the dependencies is a pom.xml and the identifiers between the two collections match;
- * otherwise false
+ * @return true if on of the dependencies is a pom.xml and the identifiers between the two collections match; otherwise false
*/
private boolean isShadedJar(Dependency dependency, Dependency nextDependency) {
final String mainName = dependency.getFileName().toLowerCase();
@@ -390,4 +382,43 @@ public class DependencyBundlingAnalyzer extends AbstractAnalyzer implements Anal
}
return false;
}
+
+ /**
+ * Determines which path is shortest; if path lengths are equal then we use compareTo of the string method to determine if the
+ * first path is smaller.
+ *
+ * @param left the first path to compare
+ * @param right the second path to compare
+ * @return true if the leftPath is the shortest; otherwise false
+ */
+ protected boolean firstPathIsShortest(String left, String right) {
+ final String leftPath = left.replace('\\', '/');
+ final String rightPath = right.replace('\\', '/');
+
+ final int leftCount = countChar(leftPath, '/');
+ final int rightCount = countChar(rightPath, '/');
+ if (leftCount == rightCount) {
+ return leftPath.compareTo(rightPath) <= 0;
+ } else {
+ return leftCount < rightCount;
+ }
+ }
+
+ /**
+ * Counts the number of times the character is present in the string.
+ *
+ * @param string the string to count the characters in
+ * @param c the character to count
+ * @return the number of times the character is present in the string
+ */
+ private int countChar(String string, char c) {
+ int count = 0;
+ final int max = string.length();
+ for (int i = 0; i < max; i++) {
+ if (c == string.charAt(i)) {
+ count++;
+ }
+ }
+ return count;
+ }
}
diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/FalsePositiveAnalyzer.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/FalsePositiveAnalyzer.java
index 3eb5d46c3..725e32ede 100644
--- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/FalsePositiveAnalyzer.java
+++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/FalsePositiveAnalyzer.java
@@ -93,12 +93,17 @@ public class FalsePositiveAnalyzer extends AbstractAnalyzer {
addFalseNegativeCPEs(dependency);
}
+ /**
+ * Removes inaccurate matches on springframework CPEs.
+ *
+ * @param dependency the dependency to test for and remove known inaccurate CPE matches
+ */
private void removeBadSpringMatches(Dependency dependency) {
String mustContain = null;
for (Identifier i : dependency.getIdentifiers()) {
if ("maven".contains(i.getType())) {
if (i.getValue() != null && i.getValue().startsWith("org.springframework.")) {
- int endPoint = i.getValue().indexOf(":", 19);
+ final int endPoint = i.getValue().indexOf(":", 19);
if (endPoint >= 0) {
mustContain = i.getValue().substring(19, endPoint).toLowerCase();
break;
@@ -107,9 +112,9 @@ public class FalsePositiveAnalyzer extends AbstractAnalyzer {
}
}
if (mustContain != null) {
- Iterator itr = dependency.getIdentifiers().iterator();
+ final Iterator itr = dependency.getIdentifiers().iterator();
while (itr.hasNext()) {
- Identifier i = itr.next();
+ final Identifier i = itr.next();
if ("cpe".contains(i.getType())
&& i.getValue() != null
&& i.getValue().startsWith("cpe:/a:springsource:")
@@ -117,7 +122,6 @@ public class FalsePositiveAnalyzer extends AbstractAnalyzer {
itr.remove();
//dependency.getIdentifiers().remove(i);
}
-
}
}
}
diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/FileNameAnalyzer.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/FileNameAnalyzer.java
index e4bc0a6b1..8910f704d 100644
--- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/FileNameAnalyzer.java
+++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/FileNameAnalyzer.java
@@ -73,7 +73,7 @@ public class FileNameAnalyzer extends AbstractAnalyzer implements Analyzer {
public void analyze(Dependency dependency, Engine engine) throws AnalysisException {
//strip any path information that may get added by ArchiveAnalyzer, etc.
- final File f = new File(dependency.getFileName());
+ final File f = dependency.getActualFile();
String fileName = f.getName();
//remove file extension
diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/FileTypeAnalyzer.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/FileTypeAnalyzer.java
index d22aad210..55f3c2f7b 100644
--- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/FileTypeAnalyzer.java
+++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/FileTypeAnalyzer.java
@@ -31,4 +31,9 @@ public interface FileTypeAnalyzer extends Analyzer {
* @return whether or not the specified file extension is supported by this analyzer.
*/
boolean supportsExtension(String extension);
+
+ /**
+ * Resets the analyzers state.
+ */
+ void reset();
}
diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/HintAnalyzer.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/HintAnalyzer.java
index 123f51f83..8d6f866e4 100644
--- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/HintAnalyzer.java
+++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/HintAnalyzer.java
@@ -19,6 +19,7 @@ package org.owasp.dependencycheck.analyzer;
import java.util.ArrayList;
import java.util.Iterator;
+import java.util.List;
import java.util.Set;
import org.owasp.dependencycheck.Engine;
import org.owasp.dependencycheck.analyzer.exception.AnalysisException;
@@ -64,8 +65,8 @@ public class HintAnalyzer extends AbstractAnalyzer implements Analyzer {
//
/**
- * The HintAnalyzer uses knowledge about a dependency to add additional information to help in identification of
- * identifiers or vulnerabilities.
+ * The HintAnalyzer uses knowledge about a dependency to add additional information to help in identification of identifiers
+ * or vulnerabilities.
*
* @param dependency The dependency being analyzed
* @param engine The scanning engine
@@ -84,24 +85,39 @@ public class HintAnalyzer extends AbstractAnalyzer implements Analyzer {
Confidence.HIGH);
final Evidence springTest3 = new Evidence("Manifest",
+ "Implementation-Title",
+ "spring-core",
+ Confidence.HIGH);
+
+ final Evidence springTest4 = new Evidence("Manifest",
"Bundle-Vendor",
"SpringSource",
Confidence.HIGH);
- Set evidence = dependency.getProductEvidence().getEvidence();
- if (evidence.contains(springTest1) || evidence.contains(springTest2)) {
- dependency.getProductEvidence().addEvidence("hint analyzer", "product", "springsource_spring_framework", Confidence.HIGH);
+ final Evidence springTest5 = new Evidence("jar",
+ "package name",
+ "springframework",
+ Confidence.LOW);
+
+ //springsource/vware problem
+ final Set product = dependency.getProductEvidence().getEvidence();
+ final Set vendor = dependency.getVendorEvidence().getEvidence();
+
+ if (product.contains(springTest1) || product.contains(springTest2) || product.contains(springTest3)
+ || (dependency.getFileName().contains("spring") && (product.contains(springTest5) || vendor.contains(springTest5)))) {
+ dependency.getProductEvidence().addEvidence("hint analyzer", "product", "springsource spring framework", Confidence.HIGH);
dependency.getVendorEvidence().addEvidence("hint analyzer", "vendor", "SpringSource", Confidence.HIGH);
dependency.getVendorEvidence().addEvidence("hint analyzer", "vendor", "vmware", Confidence.HIGH);
}
- evidence = dependency.getVendorEvidence().getEvidence();
- if (evidence.contains(springTest3)) {
+ if (vendor.contains(springTest4)) {
dependency.getProductEvidence().addEvidence("hint analyzer", "product", "springsource_spring_framework", Confidence.HIGH);
dependency.getVendorEvidence().addEvidence("hint analyzer", "vendor", "vmware", Confidence.HIGH);
}
+
+ //sun/oracle problem
final Iterator itr = dependency.getVendorEvidence().iterator();
- final ArrayList newEntries = new ArrayList();
+ final List newEntries = new ArrayList();
while (itr.hasNext()) {
final Evidence e = itr.next();
if ("sun".equalsIgnoreCase(e.getValue(false))) {
diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/JarAnalyzer.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/JarAnalyzer.java
index 97e934840..5adf7968f 100644
--- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/JarAnalyzer.java
+++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/JarAnalyzer.java
@@ -46,13 +46,6 @@ import java.util.logging.Level;
import java.util.logging.Logger;
import java.util.regex.Pattern;
import java.util.zip.ZipEntry;
-import javax.xml.bind.JAXBContext;
-import javax.xml.bind.JAXBElement;
-import javax.xml.bind.JAXBException;
-import javax.xml.bind.Unmarshaller;
-import javax.xml.parsers.ParserConfigurationException;
-import javax.xml.parsers.SAXParser;
-import javax.xml.parsers.SAXParserFactory;
import javax.xml.transform.sax.SAXSource;
import org.jsoup.Jsoup;
import org.owasp.dependencycheck.Engine;
@@ -60,7 +53,7 @@ import org.owasp.dependencycheck.analyzer.exception.AnalysisException;
import org.owasp.dependencycheck.dependency.Confidence;
import org.owasp.dependencycheck.dependency.Dependency;
import org.owasp.dependencycheck.dependency.EvidenceCollection;
-import org.owasp.dependencycheck.jaxb.pom.MavenNamespaceFilter;
+import org.owasp.dependencycheck.jaxb.pom.PomUtils;
import org.owasp.dependencycheck.jaxb.pom.generated.License;
import org.owasp.dependencycheck.jaxb.pom.generated.Model;
import org.owasp.dependencycheck.jaxb.pom.generated.Organization;
@@ -68,9 +61,6 @@ import org.owasp.dependencycheck.utils.FileUtils;
import org.owasp.dependencycheck.utils.NonClosingStream;
import org.owasp.dependencycheck.utils.Settings;
import org.xml.sax.InputSource;
-import org.xml.sax.SAXException;
-import org.xml.sax.XMLFilter;
-import org.xml.sax.XMLReader;
/**
* Used to load a JAR file and collect information that can be used to determine the associated CPE.
@@ -158,24 +148,18 @@ public class JarAnalyzer extends AbstractFileTypeAnalyzer {
* A pattern to detect HTML within text.
*/
private static final Pattern HTML_DETECTION_PATTERN = Pattern.compile("\\<[a-z]+.*/?\\>", Pattern.CASE_INSENSITIVE);
+
/**
- * The unmarshaller used to parse the pom.xml from a JAR file.
+ * The POM Utility for parsing POM files.
*/
- private Unmarshaller pomUnmarshaller;
+ private PomUtils pomUtils = null;
//
/**
* Constructs a new JarAnalyzer.
*/
public JarAnalyzer() {
- try {
- //final JAXBContext jaxbContext = JAXBContext.newInstance("org.owasp.dependencycheck.jaxb.pom.generated");
- final JAXBContext jaxbContext = JAXBContext.newInstance(Model.class);
- pomUnmarshaller = jaxbContext.createUnmarshaller();
- } catch (JAXBException ex) { //guess we will just have a null pointer exception later...
- LOGGER.log(Level.SEVERE, "Unable to load parser. See the log for more details.");
- LOGGER.log(Level.FINE, null, ex);
- }
+ pomUtils = new PomUtils();
}
//
@@ -243,7 +227,7 @@ public class JarAnalyzer extends AbstractFileTypeAnalyzer {
@Override
public void analyzeFileType(Dependency dependency, Engine engine) throws AnalysisException {
try {
- final ArrayList classNames = collectClassNames(dependency);
+ final List classNames = collectClassNames(dependency);
final String fileName = dependency.getFileName().toLowerCase();
if (classNames.isEmpty()
&& (fileName.endsWith("-sources.jar")
@@ -262,8 +246,8 @@ public class JarAnalyzer extends AbstractFileTypeAnalyzer {
}
/**
- * Attempts to find a pom.xml within the JAR file. If found it extracts information and adds it to the evidence.
- * This will attempt to interpolate the strings contained within the pom.properties if one exists.
+ * Attempts to find a pom.xml within the JAR file. If found it extracts information and adds it to the evidence. This will
+ * attempt to interpolate the strings contained within the pom.properties if one exists.
*
* @param dependency the dependency being analyzed
* @param classes a collection of class name information
@@ -271,7 +255,7 @@ public class JarAnalyzer extends AbstractFileTypeAnalyzer {
* @throws AnalysisException is thrown if there is an exception parsing the pom
* @return whether or not evidence was added to the dependency
*/
- protected boolean analyzePOM(Dependency dependency, ArrayList classes, Engine engine) throws AnalysisException {
+ protected boolean analyzePOM(Dependency dependency, List classes, Engine engine) throws AnalysisException {
boolean foundSomething = false;
final JarFile jar;
try {
@@ -293,13 +277,23 @@ public class JarAnalyzer extends AbstractFileTypeAnalyzer {
LOGGER.log(Level.FINE, msg, ex);
return false;
}
+ File externalPom = null;
if (pomEntries.isEmpty()) {
- return false;
+ String pomPath = dependency.getActualFilePath();
+ pomPath = pomPath.substring(0, pomPath.lastIndexOf('.')) + ".pom";
+ externalPom = new File(pomPath);
+ if (externalPom.isFile()) {
+ pomEntries.add(pomPath);
+ } else {
+ return false;
+ }
}
for (String path : pomEntries) {
Properties pomProperties = null;
try {
- pomProperties = retrievePomProperties(path, jar);
+ if (externalPom == null) {
+ pomProperties = retrievePomProperties(path, jar);
+ }
} catch (IOException ex) {
LOGGER.log(Level.FINEST, "ignore this, failed reading a non-existent pom.properties", ex);
}
@@ -313,11 +307,11 @@ public class JarAnalyzer extends AbstractFileTypeAnalyzer {
final String displayPath = String.format("%s%s%s",
dependency.getFilePath(),
File.separator,
- path); //.replaceAll("[\\/]", File.separator));
+ path);
final String displayName = String.format("%s%s%s",
dependency.getFileName(),
File.separator,
- path); //.replaceAll("[\\/]", File.separator));
+ path);
newDependency.setFileName(displayName);
newDependency.setFilePath(displayPath);
@@ -325,7 +319,11 @@ public class JarAnalyzer extends AbstractFileTypeAnalyzer {
engine.getDependencies().add(newDependency);
Collections.sort(engine.getDependencies());
} else {
- pom = retrievePom(path, jar);
+ if (externalPom == null) {
+ pom = retrievePom(path, jar);
+ } else {
+ pom = pomUtils.readPom(externalPom);
+ }
foundSomething |= setPomEvidence(dependency, pom, pomProperties, classes);
}
} catch (AnalysisException ex) {
@@ -410,7 +408,7 @@ public class JarAnalyzer extends AbstractFileTypeAnalyzer {
fos = new FileOutputStream(file);
bos = new BufferedOutputStream(fos, BUFFER_SIZE);
int count;
- final byte data[] = new byte[BUFFER_SIZE];
+ final byte[] data = new byte[BUFFER_SIZE];
while ((count = input.read(data, 0, BUFFER_SIZE)) != -1) {
bos.write(data, 0, count);
}
@@ -432,7 +430,7 @@ public class JarAnalyzer extends AbstractFileTypeAnalyzer {
final InputStreamReader reader = new InputStreamReader(fis, "UTF-8");
final InputSource xml = new InputSource(reader);
final SAXSource source = new SAXSource(xml);
- model = readPom(source);
+ model = pomUtils.readPom(source);
} catch (FileNotFoundException ex) {
final String msg = String.format("Unable to parse pom '%s' in jar '%s' (File Not Found)", path, jar.getName());
LOGGER.log(Level.WARNING, msg);
@@ -502,7 +500,7 @@ public class JarAnalyzer extends AbstractFileTypeAnalyzer {
final InputStreamReader reader = new InputStreamReader(stream, "UTF-8");
final InputSource xml = new InputSource(reader);
final SAXSource source = new SAXSource(xml);
- model = readPom(source);
+ model = pomUtils.readPom(source);
} catch (SecurityException ex) {
final String msg = String.format("Unable to parse pom '%s' in jar '%s'; invalid signature", path, jar.getName());
LOGGER.log(Level.WARNING, msg);
@@ -523,49 +521,17 @@ public class JarAnalyzer extends AbstractFileTypeAnalyzer {
return model;
}
- /**
- * Retrieves the specified POM from a jar file and converts it to a Model.
- *
- * @param source the SAXSource input stream to read the POM from
- * @return returns the POM object
- * @throws AnalysisException is thrown if there is an exception extracting or parsing the POM
- * {@link org.owasp.dependencycheck.jaxb.pom.generated.Model} object
- */
- private Model readPom(SAXSource source) throws AnalysisException {
- Model model = null;
- try {
- final XMLFilter filter = new MavenNamespaceFilter();
- final SAXParserFactory spf = SAXParserFactory.newInstance();
- final SAXParser sp = spf.newSAXParser();
- final XMLReader xr = sp.getXMLReader();
- filter.setParent(xr);
- final JAXBElement el = pomUnmarshaller.unmarshal(source, Model.class);
- model = el.getValue();
- } catch (SecurityException ex) {
- throw new AnalysisException(ex);
- } catch (ParserConfigurationException ex) {
- throw new AnalysisException(ex);
- } catch (SAXException ex) {
- throw new AnalysisException(ex);
- } catch (JAXBException ex) {
- throw new AnalysisException(ex);
- } catch (Throwable ex) {
- throw new AnalysisException(ex);
- }
- return model;
- }
-
/**
* Sets evidence from the pom on the supplied dependency.
*
* @param dependency the dependency to set data on
* @param pom the information from the pom
* @param pomProperties the pom properties file (null if none exists)
- * @param classes a collection of ClassNameInformation - containing data about the fully qualified class names
- * within the JAR file being analyzed
+ * @param classes a collection of ClassNameInformation - containing data about the fully qualified class names within the JAR
+ * file being analyzed
* @return true if there was evidence within the pom that we could use; otherwise false
*/
- private boolean setPomEvidence(Dependency dependency, Model pom, Properties pomProperties, ArrayList classes) {
+ private boolean setPomEvidence(Dependency dependency, Model pom, Properties pomProperties, List classes) {
boolean foundSomething = false;
boolean addAsIdentifier = true;
if (pom == null) {
@@ -583,9 +549,6 @@ public class JarAnalyzer extends AbstractFileTypeAnalyzer {
final String originalGroupID = groupid;
if (groupid != null && !groupid.isEmpty()) {
- if (groupid.startsWith("org.") || groupid.startsWith("com.")) {
- groupid = groupid.substring(4);
- }
foundSomething = true;
dependency.getVendorEvidence().addEvidence("pom", "groupid", groupid, Confidence.HIGHEST);
dependency.getProductEvidence().addEvidence("pom", "groupid", groupid, Confidence.LOW);
@@ -689,17 +652,17 @@ public class JarAnalyzer extends AbstractFileTypeAnalyzer {
}
/**
- * Analyzes the path information of the classes contained within the JarAnalyzer to try and determine possible
- * vendor or product names. If any are found they are stored in the packageVendor and packageProduct hashSets.
+ * Analyzes the path information of the classes contained within the JarAnalyzer to try and determine possible vendor or
+ * product names. If any are found they are stored in the packageVendor and packageProduct hashSets.
*
* @param classNames a list of class names
* @param dependency a dependency to analyze
* @param addPackagesAsEvidence a flag indicating whether or not package names should be added as evidence.
*/
- protected void analyzePackageNames(ArrayList classNames,
+ protected void analyzePackageNames(List classNames,
Dependency dependency, boolean addPackagesAsEvidence) {
- final HashMap vendorIdentifiers = new HashMap();
- final HashMap productIdentifiers = new HashMap();
+ final Map vendorIdentifiers = new HashMap();
+ final Map productIdentifiers = new HashMap();
analyzeFullyQualifiedClassNames(classNames, vendorIdentifiers, productIdentifiers);
final int classCount = classNames.size();
@@ -741,7 +704,7 @@ public class JarAnalyzer extends AbstractFileTypeAnalyzer {
* @return whether evidence was identified parsing the manifest
* @throws IOException if there is an issue reading the JAR file
*/
- protected boolean parseManifest(Dependency dependency, ArrayList classInformation) throws IOException {
+ protected boolean parseManifest(Dependency dependency, List classInformation) throws IOException {
boolean foundSomething = false;
JarFile jar = null;
try {
@@ -898,18 +861,17 @@ public class JarAnalyzer extends AbstractFileTypeAnalyzer {
}
/**
- * Adds a description to the given dependency. If the description contains one of the following strings beyond 100
- * characters, then the description used will be trimmed to that position:
+ * Adds a description to the given dependency. If the description contains one of the following strings beyond 100 characters,
+ * then the description used will be trimmed to that position:
* - "such as"
- "like "
- "will use "
- "* uses "
*
* @param dependency a dependency
* @param description the description
* @param source the source of the evidence
* @param key the "name" of the evidence
- * @return if the description is trimmed, the trimmed version is returned; otherwise the original description is
- * returned
+ * @return if the description is trimmed, the trimmed version is returned; otherwise the original description is returned
*/
- private String addDescription(Dependency dependency, String description, String source, String key) {
+ public static String addDescription(Dependency dependency, String description, String source, String key) {
if (dependency.getDescription() == null) {
dependency.setDescription(description);
}
@@ -1014,12 +976,11 @@ public class JarAnalyzer extends AbstractFileTypeAnalyzer {
/**
*
- * A utility function that will interpolate strings based on values given in the properties file. It will also
- * interpolate the strings contained within the properties file so that properties can reference other
- * properties.
+ * A utility function that will interpolate strings based on values given in the properties file. It will also interpolate the
+ * strings contained within the properties file so that properties can reference other properties.
*
- * Note: if there is no property found the reference will be removed. In other words, if the interpolated
- * string will be replaced with an empty string.
+ * Note: if there is no property found the reference will be removed. In other words, if the interpolated string will
+ * be replaced with an empty string.
*
*
* Example:
@@ -1039,13 +1000,13 @@ public class JarAnalyzer extends AbstractFileTypeAnalyzer {
* @param properties a collection of properties that may be referenced within the text.
* @return the interpolated text.
*/
- protected String interpolateString(String text, Properties properties) {
- Properties props = properties;
+ public static String interpolateString(String text, Properties properties) {
+ final Properties props = properties;
if (text == null) {
return text;
}
if (props == null) {
- props = new Properties();
+ return text;
}
final int pos = text.indexOf("${");
@@ -1083,14 +1044,14 @@ public class JarAnalyzer extends AbstractFileTypeAnalyzer {
}
/**
- * Cycles through an enumeration of JarEntries, contained within the dependency, and returns a list of the class
- * names. This does not include core Java package names (i.e. java.* or javax.*).
+ * Cycles through an enumeration of JarEntries, contained within the dependency, and returns a list of the class names. This
+ * does not include core Java package names (i.e. java.* or javax.*).
*
* @param dependency the dependency being analyzed
* @return an list of fully qualified class names
*/
- private ArrayList collectClassNames(Dependency dependency) {
- final ArrayList classNames = new ArrayList();
+ private List collectClassNames(Dependency dependency) {
+ final List classNames = new ArrayList();
JarFile jar = null;
try {
jar = new JarFile(dependency.getActualFilePath());
@@ -1121,17 +1082,17 @@ public class JarAnalyzer extends AbstractFileTypeAnalyzer {
}
/**
- * Cycles through the list of class names and places the package levels 0-3 into the provided maps for vendor and
- * product. This is helpful when analyzing vendor/product as many times this is included in the package name.
+ * Cycles through the list of class names and places the package levels 0-3 into the provided maps for vendor and product.
+ * This is helpful when analyzing vendor/product as many times this is included in the package name.
*
* @param classNames a list of class names
* @param vendor HashMap of possible vendor names from package names (e.g. owasp)
* @param product HashMap of possible product names from package names (e.g. dependencycheck)
*/
- private void analyzeFullyQualifiedClassNames(ArrayList classNames,
- HashMap vendor, HashMap product) {
+ private void analyzeFullyQualifiedClassNames(List classNames,
+ Map vendor, Map product) {
for (ClassNameInformation entry : classNames) {
- final ArrayList list = entry.getPackageStructure();
+ final List list = entry.getPackageStructure();
addEntry(vendor, list.get(0));
if (list.size() == 2) {
@@ -1153,13 +1114,13 @@ public class JarAnalyzer extends AbstractFileTypeAnalyzer {
}
/**
- * Adds an entry to the specified collection and sets the Integer (e.g. the count) to 1. If the entry already exists
- * in the collection then the Integer is incremented by 1.
+ * Adds an entry to the specified collection and sets the Integer (e.g. the count) to 1. If the entry already exists in the
+ * collection then the Integer is incremented by 1.
*
* @param collection a collection of strings and their occurrence count
* @param key the key to add to the collection
*/
- private void addEntry(HashMap collection, String key) {
+ private void addEntry(Map collection, String key) {
if (collection.containsKey(key)) {
collection.put(key, collection.get(key) + 1);
} else {
@@ -1168,15 +1129,15 @@ public class JarAnalyzer extends AbstractFileTypeAnalyzer {
}
/**
- * Cycles through the collection of class name information to see if parts of the package names are contained in the
- * provided value. If found, it will be added as the HIGHEST confidence evidence because we have more then one
- * source corroborating the value.
+ * Cycles through the collection of class name information to see if parts of the package names are contained in the provided
+ * value. If found, it will be added as the HIGHEST confidence evidence because we have more then one source corroborating the
+ * value.
*
* @param classes a collection of class name information
* @param value the value to check to see if it contains a package name
* @param evidence the evidence collection to add new entries too
*/
- private void addMatchingValues(ArrayList classes, String value, EvidenceCollection evidence) {
+ private void addMatchingValues(List classes, String value, EvidenceCollection evidence) {
if (value == null || value.isEmpty() || classes == null || classes.isEmpty()) {
return;
}
@@ -1211,7 +1172,7 @@ public class JarAnalyzer extends AbstractFileTypeAnalyzer {
* @param pomProperties the properties, used for string interpolation
* @param dependency the dependency to add license information too
*/
- private void extractLicense(Model pom, Properties pomProperties, Dependency dependency) {
+ public static void extractLicense(Model pom, Properties pomProperties, Dependency dependency) {
//license
if (pom.getLicenses() != null) {
String license = null;
@@ -1252,9 +1213,9 @@ public class JarAnalyzer extends AbstractFileTypeAnalyzer {
/**
*
- * Stores information about a given class name. This class will keep the fully qualified class name and a list
- * of the important parts of the package structure. Up to the first four levels of the package structure are
- * stored, excluding a leading "org" or "com". Example:
+ * Stores information about a given class name. This class will keep the fully qualified class name and a list of the
+ * important parts of the package structure. Up to the first four levels of the package structure are stored, excluding a
+ * leading "org" or "com". Example:
* ClassNameInformation obj = new ClassNameInformation("org.owasp.dependencycheck.analyzer.JarAnalyzer");
* System.out.println(obj.getName());
* for (String p : obj.getPackageStructure())
diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/NexusAnalyzer.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/NexusAnalyzer.java
index dbee6a5d7..7d5650db6 100644
--- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/NexusAnalyzer.java
+++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/NexusAnalyzer.java
@@ -17,6 +17,7 @@
*/
package org.owasp.dependencycheck.analyzer;
+import java.io.File;
import java.io.FileNotFoundException;
import java.io.IOException;
import java.net.MalformedURLException;
@@ -24,13 +25,18 @@ import java.net.URL;
import java.util.Set;
import java.util.logging.Level;
import java.util.logging.Logger;
+import org.apache.commons.io.FileUtils;
import org.owasp.dependencycheck.Engine;
import org.owasp.dependencycheck.analyzer.exception.AnalysisException;
import org.owasp.dependencycheck.data.nexus.MavenArtifact;
import org.owasp.dependencycheck.data.nexus.NexusSearch;
import org.owasp.dependencycheck.dependency.Confidence;
import org.owasp.dependencycheck.dependency.Dependency;
-import org.owasp.dependencycheck.dependency.Identifier;
+import org.owasp.dependencycheck.dependency.Evidence;
+import org.owasp.dependencycheck.jaxb.pom.PomUtils;
+import org.owasp.dependencycheck.utils.InvalidSettingException;
+import org.owasp.dependencycheck.utils.DownloadFailedException;
+import org.owasp.dependencycheck.utils.Downloader;
import org.owasp.dependencycheck.utils.Settings;
/**
@@ -49,6 +55,11 @@ import org.owasp.dependencycheck.utils.Settings;
*/
public class NexusAnalyzer extends AbstractFileTypeAnalyzer {
+ /**
+ * The default URL - this will be used by the CentralAnalyzer to determine whether to enable this.
+ */
+ public static final String DEFAULT_URL = "https://repository.sonatype.org/service/local/";
+
/**
* The logger.
*/
@@ -74,6 +85,51 @@ public class NexusAnalyzer extends AbstractFileTypeAnalyzer {
*/
private NexusSearch searcher;
+ /**
+ * Field indicating if the analyzer is enabled.
+ */
+ private final boolean enabled = checkEnabled();
+ /**
+ * Field for doing POM work
+ */
+ private final PomUtils pomUtil = new PomUtils();
+
+ /**
+ * Determines if this analyzer is enabled
+ *
+ * @return true if the analyzer is enabled; otherwise false
+ */
+ private boolean checkEnabled() {
+ /* Enable this analyzer ONLY if the Nexus URL has been set to something
+ other than the default one (if it's the default one, we'll use the
+ central one) and it's enabled by the user.
+ */
+ boolean retval = false;
+ try {
+ if ((!DEFAULT_URL.equals(Settings.getString(Settings.KEYS.ANALYZER_NEXUS_URL)))
+ && Settings.getBoolean(Settings.KEYS.ANALYZER_NEXUS_ENABLED)) {
+ LOGGER.info("Enabling Nexus analyzer");
+ retval = true;
+ } else {
+ LOGGER.fine("Nexus analyzer disabled, using Central instead");
+ }
+ } catch (InvalidSettingException ise) {
+ LOGGER.warning("Invalid setting. Disabling Nexus analyzer");
+ }
+
+ return retval;
+ }
+
+ /**
+ * Determine whether to enable this analyzer or not.
+ *
+ * @return whether the analyzer should be enabled
+ */
+ @Override
+ public boolean isEnabled() {
+ return enabled;
+ }
+
/**
* Initializes the analyzer once before any analysis is performed.
*
@@ -150,29 +206,42 @@ public class NexusAnalyzer extends AbstractFileTypeAnalyzer {
*/
@Override
public void analyzeFileType(Dependency dependency, Engine engine) throws AnalysisException {
+ if (!isEnabled()) {
+ return;
+ }
try {
final MavenArtifact ma = searcher.searchSha1(dependency.getSha1sum());
- if (ma.getGroupId() != null && !"".equals(ma.getGroupId())) {
- dependency.getVendorEvidence().addEvidence("nexus", "groupid", ma.getGroupId(), Confidence.HIGH);
- }
- if (ma.getArtifactId() != null && !"".equals(ma.getArtifactId())) {
- dependency.getProductEvidence().addEvidence("nexus", "artifactid", ma.getArtifactId(), Confidence.HIGH);
- }
- if (ma.getVersion() != null && !"".equals(ma.getVersion())) {
- dependency.getVersionEvidence().addEvidence("nexus", "version", ma.getVersion(), Confidence.HIGH);
- }
- if (ma.getArtifactUrl() != null && !"".equals(ma.getArtifactUrl())) {
- boolean found = false;
- for (Identifier i : dependency.getIdentifiers()) {
- if ("maven".equals(i.getType()) && i.getValue().equals(ma.toString())) {
- found = true;
- i.setConfidence(Confidence.HIGHEST);
- i.setUrl(ma.getArtifactUrl());
- break;
- }
+ dependency.addAsEvidence("nexus", ma, Confidence.HIGH);
+ boolean pomAnalyzed = false;
+ LOGGER.fine("POM URL " + ma.getPomUrl());
+ for (Evidence e : dependency.getVendorEvidence()) {
+ if ("pom".equals(e.getSource())) {
+ pomAnalyzed = true;
+ break;
}
- if (!found) {
- dependency.addIdentifier("maven", ma.toString(), ma.getArtifactUrl(), Confidence.HIGHEST);
+ }
+ if (!pomAnalyzed && ma.getPomUrl() != null) {
+ File pomFile = null;
+ try {
+ final File baseDir = Settings.getTempDirectory();
+ pomFile = File.createTempFile("pom", ".xml", baseDir);
+ if (!pomFile.delete()) {
+ final String msg = String.format("Unable to fetch pom.xml for %s from Nexus repository; "
+ + "this could result in undetected CPE/CVEs.", dependency.getFileName());
+ LOGGER.warning(msg);
+ LOGGER.fine("Unable to delete temp file");
+ }
+ LOGGER.fine(String.format("Downloading %s", ma.getPomUrl()));
+ Downloader.fetchFile(new URL(ma.getPomUrl()), pomFile);
+ pomUtil.analyzePOM(dependency, pomFile);
+ } catch (DownloadFailedException ex) {
+ final String msg = String.format("Unable to download pom.xml for %s from Nexus repository; "
+ + "this could result in undetected CPE/CVEs.", dependency.getFileName());
+ LOGGER.warning(msg);
+ } finally {
+ if (pomFile != null && !FileUtils.deleteQuietly(pomFile)) {
+ pomFile.deleteOnExit();
+ }
}
}
} catch (IllegalArgumentException iae) {
diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/central/CentralSearch.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/central/CentralSearch.java
new file mode 100644
index 000000000..5699cbeb2
--- /dev/null
+++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/central/CentralSearch.java
@@ -0,0 +1,161 @@
+/*
+ * This file is part of dependency-check-core.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * Copyright (c) 2014 Jeremy Long. All Rights Reserved.
+ */
+package org.owasp.dependencycheck.data.central;
+
+import java.io.FileNotFoundException;
+import java.io.IOException;
+import java.net.HttpURLConnection;
+import java.net.URL;
+import java.util.ArrayList;
+import java.util.List;
+import java.util.logging.Logger;
+import javax.xml.parsers.DocumentBuilder;
+import javax.xml.parsers.DocumentBuilderFactory;
+import javax.xml.xpath.XPath;
+import javax.xml.xpath.XPathConstants;
+import javax.xml.xpath.XPathFactory;
+import org.owasp.dependencycheck.data.nexus.MavenArtifact;
+import org.owasp.dependencycheck.utils.Settings;
+import org.owasp.dependencycheck.utils.URLConnectionFactory;
+import org.w3c.dom.Document;
+import org.w3c.dom.NodeList;
+
+/**
+ * Class of methods to search Maven Central via Central.
+ *
+ * @author colezlaw
+ */
+public class CentralSearch {
+
+ /**
+ * The URL for the Central service
+ */
+ private final URL rootURL;
+
+ /**
+ * Whether to use the Proxy when making requests
+ */
+ private boolean useProxy;
+
+ /**
+ * Used for logging.
+ */
+ private static final Logger LOGGER = Logger.getLogger(CentralSearch.class.getName());
+
+ /**
+ * Creates a NexusSearch for the given repository URL.
+ *
+ * @param rootURL the URL of the repository on which searches should execute. Only parameters are added to this (so it should
+ * end in /select)
+ */
+ public CentralSearch(URL rootURL) {
+ this.rootURL = rootURL;
+ if (null != Settings.getString(Settings.KEYS.PROXY_SERVER)) {
+ useProxy = true;
+ LOGGER.fine("Using proxy");
+ } else {
+ useProxy = false;
+ LOGGER.fine("Not using proxy");
+ }
+ }
+
+ /**
+ * Searches the configured Central URL for the given sha1 hash. If the artifact is found, a MavenArtifact is
+ * populated with the GAV.
+ *
+ * @param sha1 the SHA-1 hash string for which to search
+ * @return the populated Maven GAV.
+ * @throws IOException if it's unable to connect to the specified repository or if the specified artifact is not found.
+ */
+ public List searchSha1(String sha1) throws IOException {
+ if (null == sha1 || !sha1.matches("^[0-9A-Fa-f]{40}$")) {
+ throw new IllegalArgumentException("Invalid SHA1 format");
+ }
+
+ final URL url = new URL(rootURL + String.format("?q=1:\"%s\"&wt=xml", sha1));
+
+ LOGGER.fine(String.format("Searching Central url %s", url.toString()));
+
+ // Determine if we need to use a proxy. The rules:
+ // 1) If the proxy is set, AND the setting is set to true, use the proxy
+ // 2) Otherwise, don't use the proxy (either the proxy isn't configured,
+ // or proxy is specifically set to false)
+ final HttpURLConnection conn = URLConnectionFactory.createHttpURLConnection(url, useProxy);
+
+ conn.setDoOutput(true);
+
+ // JSON would be more elegant, but there's not currently a dependency
+ // on JSON, so don't want to add one just for this
+ conn.addRequestProperty("Accept", "application/xml");
+ conn.connect();
+
+ if (conn.getResponseCode() == 200) {
+ boolean missing = false;
+ try {
+ final DocumentBuilder builder = DocumentBuilderFactory
+ .newInstance().newDocumentBuilder();
+ final Document doc = builder.parse(conn.getInputStream());
+ final XPath xpath = XPathFactory.newInstance().newXPath();
+ final String numFound = xpath.evaluate("/response/result/@numFound", doc);
+ if ("0".equals(numFound)) {
+ missing = true;
+ } else {
+ final ArrayList result = new ArrayList();
+ final NodeList docs = (NodeList) xpath.evaluate("/response/result/doc", doc, XPathConstants.NODESET);
+ for (int i = 0; i < docs.getLength(); i++) {
+ final String g = xpath.evaluate("./str[@name='g']", docs.item(i));
+ LOGGER.finest(String.format("GroupId: %s", g));
+ final String a = xpath.evaluate("./str[@name='a']", docs.item(i));
+ LOGGER.finest(String.format("ArtifactId: %s", a));
+ final String v = xpath.evaluate("./str[@name='v']", docs.item(i));
+ final NodeList atts = (NodeList) xpath.evaluate("./arr[@name='ec']/str", docs.item(i), XPathConstants.NODESET);
+ boolean pomAvailable = false;
+ boolean jarAvailable = false;
+ for (int x = 0; x < atts.getLength(); x++) {
+ final String tmp = xpath.evaluate(".", atts.item(x));
+ if (".pom".equals(tmp)) {
+ pomAvailable = true;
+ } else if (".jar".equals(tmp)) {
+ jarAvailable = true;
+ }
+ }
+ LOGGER.finest(String.format("Version: %s", v));
+ result.add(new MavenArtifact(g, a, v, jarAvailable, pomAvailable));
+ }
+
+ return result;
+ }
+ } catch (Throwable e) {
+ // Anything else is jacked up XML stuff that we really can't recover
+ // from well
+ throw new IOException(e.getMessage(), e);
+ }
+
+ if (missing) {
+ throw new FileNotFoundException("Artifact not found in Central");
+ }
+ } else {
+ final String msg = String.format("Could not connect to Central received response code: %d %s",
+ conn.getResponseCode(), conn.getResponseMessage());
+ LOGGER.fine(msg);
+ throw new IOException(msg);
+ }
+
+ return null;
+ }
+}
diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/central/package-info.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/central/package-info.java
new file mode 100644
index 000000000..9b51647d6
--- /dev/null
+++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/central/package-info.java
@@ -0,0 +1,14 @@
+/**
+ *
+ *
+ * org.owasp.dependencycheck.data.central
+ *
+ *
+ *
+ * Contains classes related to searching Maven Central.
+ *
+ * These are used to abstract Maven Central searching away from OWASP Dependency Check so they can be reused elsewhere.
+ *
+ *
+ */
+package org.owasp.dependencycheck.data.central;
diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/cpe/CpeMemoryIndex.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/cpe/CpeMemoryIndex.java
index fa35d5eb3..355d82506 100644
--- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/cpe/CpeMemoryIndex.java
+++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/cpe/CpeMemoryIndex.java
@@ -48,12 +48,13 @@ import org.owasp.dependencycheck.data.nvdcve.DatabaseException;
import org.owasp.dependencycheck.utils.Pair;
/**
- * An in memory lucene index that contains the vendor/product combinations from the CPE (application) identifiers within
- * the NVD CVE data.
+ * An in memory lucene index that contains the vendor/product combinations from the CPE (application) identifiers within the NVD
+ * CVE data.
*
* @author Jeremy Long
*/
public final class CpeMemoryIndex {
+
/**
* The logger.
*/
@@ -61,7 +62,7 @@ public final class CpeMemoryIndex {
/**
* singleton instance.
*/
- private static CpeMemoryIndex instance = new CpeMemoryIndex();
+ private static final CpeMemoryIndex INSTANCE = new CpeMemoryIndex();
/**
* private constructor for singleton.
@@ -75,7 +76,7 @@ public final class CpeMemoryIndex {
* @return the instance of the CpeMemoryIndex
*/
public static CpeMemoryIndex getInstance() {
- return instance;
+ return INSTANCE;
}
/**
* The in memory Lucene index.
@@ -113,18 +114,20 @@ public final class CpeMemoryIndex {
* @throws IndexException thrown if there is an error creating the index
*/
public void open(CveDB cve) throws IndexException {
- if (!openState) {
- index = new RAMDirectory();
- buildIndex(cve);
- try {
- indexReader = DirectoryReader.open(index);
- } catch (IOException ex) {
- throw new IndexException(ex);
+ synchronized (INSTANCE) {
+ if (!openState) {
+ index = new RAMDirectory();
+ buildIndex(cve);
+ try {
+ indexReader = DirectoryReader.open(index);
+ } catch (IOException ex) {
+ throw new IndexException(ex);
+ }
+ indexSearcher = new IndexSearcher(indexReader);
+ searchingAnalyzer = createSearchingAnalyzer();
+ queryParser = new QueryParser(LuceneUtils.CURRENT_VERSION, Fields.DOCUMENT_KEY, searchingAnalyzer);
+ openState = true;
}
- indexSearcher = new IndexSearcher(indexReader);
- searchingAnalyzer = createSearchingAnalyzer();
- queryParser = new QueryParser(LuceneUtils.CURRENT_VERSION, Fields.DOCUMENT_KEY, searchingAnalyzer);
- openState = true;
}
}
/**
@@ -160,7 +163,7 @@ public final class CpeMemoryIndex {
*/
@SuppressWarnings("unchecked")
private Analyzer createSearchingAnalyzer() {
- final Map fieldAnalyzers = new HashMap();
+ final Map fieldAnalyzers = new HashMap();
fieldAnalyzers.put(Fields.DOCUMENT_KEY, new KeywordAnalyzer());
productSearchFieldAnalyzer = new SearchFieldAnalyzer(LuceneUtils.CURRENT_VERSION);
vendorSearchFieldAnalyzer = new SearchFieldAnalyzer(LuceneUtils.CURRENT_VERSION);
diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/cwe/CweDB.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/cwe/CweDB.java
index ce2410ec5..ca67107f3 100644
--- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/cwe/CweDB.java
+++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/cwe/CweDB.java
@@ -29,10 +29,12 @@ import java.util.logging.Logger;
* @author Jeremy Long
*/
public final class CweDB {
+
/**
* The Logger.
*/
private static final Logger LOGGER = Logger.getLogger(CweDB.class.getName());
+
/**
* Empty private constructor as this is a utility class.
*/
@@ -55,7 +57,9 @@ public final class CweDB {
final String filePath = "data/cwe.hashmap.serialized";
final InputStream input = CweDB.class.getClassLoader().getResourceAsStream(filePath);
oin = new ObjectInputStream(input);
- return (HashMap) oin.readObject();
+ @SuppressWarnings("unchecked")
+ final HashMap ret = (HashMap) oin.readObject();
+ return ret;
} catch (ClassNotFoundException ex) {
LOGGER.log(Level.WARNING, "Unable to load CWE data. This should not be an issue.");
LOGGER.log(Level.FINE, null, ex);
diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/lucene/AbstractTokenizingFilter.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/lucene/AbstractTokenizingFilter.java
index a45b653fe..6d06d74c6 100644
--- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/lucene/AbstractTokenizingFilter.java
+++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/lucene/AbstractTokenizingFilter.java
@@ -72,7 +72,7 @@ public abstract class AbstractTokenizingFilter extends TokenFilter {
* @return whether or not a new term was added
*/
protected boolean addTerm() {
- final boolean termAdded = tokens.size() > 0;
+ final boolean termAdded = !tokens.isEmpty();
if (termAdded) {
final String term = tokens.pop();
clearAttributes();
diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/lucene/FieldAnalyzer.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/lucene/FieldAnalyzer.java
index e1810e38f..700034c9d 100644
--- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/lucene/FieldAnalyzer.java
+++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/lucene/FieldAnalyzer.java
@@ -29,8 +29,8 @@ import org.apache.lucene.util.Version;
/**
*
- * A Lucene Analyzer that utilizes the WhitespaceTokenizer, WordDelimiterFilter, LowerCaseFilter, and StopFilter. The
- * intended purpose of this Analyzer is to index the CPE fields vendor and product.
+ * A Lucene Analyzer that utilizes the WhitespaceTokenizer, WordDelimiterFilter, LowerCaseFilter, and StopFilter. The intended
+ * purpose of this Analyzer is to index the CPE fields vendor and product.
*
* @author Jeremy Long
*/
diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/lucene/LuceneUtils.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/lucene/LuceneUtils.java
index 1b59283d8..cbe6f1d32 100644
--- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/lucene/LuceneUtils.java
+++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/lucene/LuceneUtils.java
@@ -17,6 +17,7 @@
*/
package org.owasp.dependencycheck.data.lucene;
+import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
import org.apache.lucene.util.Version;
/**
@@ -28,10 +29,10 @@ import org.apache.lucene.util.Version;
public final class LuceneUtils {
/**
- * The current version of Lucene being used. Declaring this one place so an upgrade doesn't require hunting through
- * the code base.
+ * The current version of Lucene being used. Declaring this one place so an upgrade doesn't require hunting through the code
+ * base.
*/
- public static final Version CURRENT_VERSION = Version.LUCENE_45;
+ public static final Version CURRENT_VERSION = Version.LUCENE_47;
/**
* Private constructor as this is a utility class.
@@ -46,7 +47,7 @@ public final class LuceneUtils {
* @param text the data to be escaped
*/
@SuppressWarnings("fallthrough")
- @edu.umd.cs.findbugs.annotations.SuppressWarnings(
+ @SuppressFBWarnings(
value = "SF_SWITCH_NO_DEFAULT",
justification = "The switch below does have a default.")
public static void appendEscapedLuceneQuery(StringBuilder buf,
diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/lucene/SearchFieldAnalyzer.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/lucene/SearchFieldAnalyzer.java
index 7b40e08ed..634287f5f 100644
--- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/lucene/SearchFieldAnalyzer.java
+++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/lucene/SearchFieldAnalyzer.java
@@ -39,8 +39,7 @@ public class SearchFieldAnalyzer extends Analyzer {
*/
private final Version version;
/**
- * A local reference to the TokenPairConcatenatingFilter so that we can clear any left over state if this analyzer
- * is re-used.
+ * A local reference to the TokenPairConcatenatingFilter so that we can clear any left over state if this analyzer is re-used.
*/
private TokenPairConcatenatingFilter concatenatingFilter;
@@ -85,8 +84,7 @@ public class SearchFieldAnalyzer extends Analyzer {
/**
*
- * Resets the analyzer and clears any internal state data that may have been left-over from previous uses of the
- * analyzer.
+ * Resets the analyzer and clears any internal state data that may have been left-over from previous uses of the analyzer.
*
* If this analyzer is re-used this method must be called between uses.
*/
diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/lucene/SearchVersionAnalyzer.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/lucene/SearchVersionAnalyzer.java
deleted file mode 100644
index 995a6d751..000000000
--- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/lucene/SearchVersionAnalyzer.java
+++ /dev/null
@@ -1,72 +0,0 @@
-/*
- * This file is part of dependency-check-core.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- *
- * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
- */
-package org.owasp.dependencycheck.data.lucene;
-
-import java.io.Reader;
-import org.apache.lucene.analysis.Analyzer;
-import org.apache.lucene.analysis.TokenStream;
-import org.apache.lucene.analysis.Tokenizer;
-import org.apache.lucene.analysis.core.LowerCaseFilter;
-import org.apache.lucene.analysis.core.WhitespaceTokenizer;
-import org.apache.lucene.util.Version;
-
-/**
- * SearchVersionAnalyzer is a Lucene Analyzer used to analyze version information.
- *
- * @author Jeremy Long
- * @deprecated version information is no longer stored in lucene
- */
-@Deprecated
-public class SearchVersionAnalyzer extends Analyzer {
- //TODO consider implementing payloads/custom attributes...
- // use custom attributes for major, minor, x, x, x, rcx
- // these can then be used to weight the score for searches on the version.
- // see http://lucene.apache.org/core/3_6_1/api/core/org/apache/lucene/analysis/package-summary.html#package_description
- // look at this article to implement
- // http://www.codewrecks.com/blog/index.php/2012/08/25/index-your-blog-using-tags-and-lucene-net/
-
- /**
- * The Lucene Version used.
- */
- private final Version version;
-
- /**
- * Creates a new SearchVersionAnalyzer.
- *
- * @param version the Lucene version
- */
- public SearchVersionAnalyzer(Version version) {
- this.version = version;
- }
-
- /**
- * Creates the TokenStreamComponents
- *
- * @param fieldName the field name being analyzed
- * @param reader the reader containing the input
- * @return the TokenStreamComponents
- */
- @Override
- protected TokenStreamComponents createComponents(String fieldName, Reader reader) {
- final Tokenizer source = new WhitespaceTokenizer(version, reader);
- TokenStream stream = source;
- stream = new LowerCaseFilter(version, stream);
- stream = new VersionTokenizingFilter(stream);
- return new TokenStreamComponents(source, stream);
- }
-}
diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/lucene/TokenPairConcatenatingFilter.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/lucene/TokenPairConcatenatingFilter.java
index 3a5c52a8a..69c9c0769 100644
--- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/lucene/TokenPairConcatenatingFilter.java
+++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/lucene/TokenPairConcatenatingFilter.java
@@ -92,7 +92,7 @@ public final class TokenPairConcatenatingFilter extends TokenFilter {
//if we have a previousTerm - write it out as its own token concatenated
// with the current word (if one is available).
- if (previousWord != null && words.size() > 0) {
+ if (previousWord != null && !words.isEmpty()) {
final String word = words.getFirst();
clearAttributes();
termAtt.append(previousWord).append(word);
@@ -100,7 +100,7 @@ public final class TokenPairConcatenatingFilter extends TokenFilter {
return true;
}
//if we have words, write it out as a single token
- if (words.size() > 0) {
+ if (!words.isEmpty()) {
final String word = words.removeFirst();
clearAttributes();
termAtt.append(word);
diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/lucene/UrlTokenizingFilter.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/lucene/UrlTokenizingFilter.java
index e5f47221a..a02253123 100644
--- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/lucene/UrlTokenizingFilter.java
+++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/lucene/UrlTokenizingFilter.java
@@ -60,7 +60,7 @@ public final class UrlTokenizingFilter extends AbstractTokenizingFilter {
public boolean incrementToken() throws IOException {
final LinkedList tokens = getTokens();
final CharTermAttribute termAtt = getTermAtt();
- if (tokens.size() == 0 && input.incrementToken()) {
+ if (tokens.isEmpty() && input.incrementToken()) {
final String text = new String(termAtt.buffer(), 0, termAtt.length());
if (UrlStringUtils.containsUrl(text)) {
final String[] parts = text.split("\\s");
diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/lucene/VersionAnalyzer.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/lucene/VersionAnalyzer.java
deleted file mode 100644
index b5510f480..000000000
--- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/lucene/VersionAnalyzer.java
+++ /dev/null
@@ -1,71 +0,0 @@
-/*
- * This file is part of dependency-check-core.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- *
- * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
- */
-package org.owasp.dependencycheck.data.lucene;
-
-import java.io.Reader;
-import org.apache.lucene.analysis.Analyzer;
-import org.apache.lucene.analysis.TokenStream;
-import org.apache.lucene.analysis.Tokenizer;
-import org.apache.lucene.analysis.core.LowerCaseFilter;
-import org.apache.lucene.analysis.core.WhitespaceTokenizer;
-import org.apache.lucene.util.Version;
-
-/**
- * VersionAnalyzer is a Lucene Analyzer used to analyze version information.
- *
- * @author Jeremy Long
- * @deprecated version information is no longer stored in lucene
- */
-@Deprecated
-public class VersionAnalyzer extends Analyzer {
- //TODO consider implementing payloads/custom attributes...
- // use custom attributes for major, minor, x, x, x, rcx
- // these can then be used to weight the score for searches on the version.
- // see http://lucene.apache.org/core/3_6_1/api/core/org/apache/lucene/analysis/package-summary.html#package_description
- // look at this article to implement
- // http://www.codewrecks.com/blog/index.php/2012/08/25/index-your-blog-using-tags-and-lucene-net/
-
- /**
- * The Lucene Version used.
- */
- private final Version version;
-
- /**
- * Creates a new VersionAnalyzer.
- *
- * @param version the Lucene version
- */
- public VersionAnalyzer(Version version) {
- this.version = version;
- }
-
- /**
- * Creates the TokenStreamComponents
- *
- * @param fieldName the field name being analyzed
- * @param reader the reader containing the input
- * @return the TokenStreamComponents
- */
- @Override
- protected TokenStreamComponents createComponents(String fieldName, Reader reader) {
- final Tokenizer source = new WhitespaceTokenizer(version, reader);
- TokenStream stream = source;
- stream = new LowerCaseFilter(version, stream);
- return new TokenStreamComponents(source, stream);
- }
-}
diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/lucene/VersionTokenizingFilter.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/lucene/VersionTokenizingFilter.java
deleted file mode 100644
index 3b4d8bf48..000000000
--- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/lucene/VersionTokenizingFilter.java
+++ /dev/null
@@ -1,98 +0,0 @@
-/*
- * This file is part of dependency-check-core.
- *
- * Licensed under the Apache License, Version 2.0 (the "License");
- * you may not use this file except in compliance with the License.
- * You may obtain a copy of the License at
- *
- * http://www.apache.org/licenses/LICENSE-2.0
- *
- * Unless required by applicable law or agreed to in writing, software
- * distributed under the License is distributed on an "AS IS" BASIS,
- * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
- * See the License for the specific language governing permissions and
- * limitations under the License.
- *
- * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
- */
-package org.owasp.dependencycheck.data.lucene;
-
-import java.io.IOException;
-import java.util.LinkedList;
-import org.apache.lucene.analysis.TokenStream;
-import org.apache.lucene.analysis.tokenattributes.CharTermAttribute;
-
-/**
- *
- * Takes a TokenStream and splits or adds tokens to correctly index version numbers.
- *
- * Example: "3.0.0.RELEASE" -> "3 3.0 3.0.0 RELEASE 3.0.0.RELEASE".
- *
- * @author Jeremy Long
- * @deprecated version information is no longer stored in lucene
- */
-@Deprecated
-public final class VersionTokenizingFilter extends AbstractTokenizingFilter {
-
- /**
- * Constructs a new VersionTokenizingFilter.
- *
- * @param stream the TokenStream that this filter will process
- */
- public VersionTokenizingFilter(TokenStream stream) {
- super(stream);
- }
-
- /**
- * Increments the underlying TokenStream and sets CharTermAttributes to construct an expanded set of tokens by
- * concatenating tokens with the previous token.
- *
- * @return whether or not we have hit the end of the TokenStream
- * @throws IOException is thrown when an IOException occurs
- */
- @Override
- public boolean incrementToken() throws IOException {
- final LinkedList tokens = getTokens();
- final CharTermAttribute termAtt = getTermAtt();
- if (tokens.size() == 0 && input.incrementToken()) {
- final String version = new String(termAtt.buffer(), 0, termAtt.length());
- final String[] toAnalyze = version.split("[_-]");
- //ensure we analyze the whole string as one too
- analyzeVersion(version);
- for (String str : toAnalyze) {
- analyzeVersion(str);
- }
- }
- return addTerm();
- }
-
- /**
- *
- * Analyzes the version and adds several copies of the version as different tokens. For example, the version 1.2.7
- * would create the tokens 1 1.2 1.2.7. This is useful in discovering the correct version - sometimes a maintenance
- * or build number will throw off the version identification.
- *
- *
- * expected format:&nbps;major.minor[.maintenance[.build]]
- *
- * @param version the version to analyze
- */
- private void analyzeVersion(String version) {
- //todo should we also be splitting on dash or underscore? we would need
- // to incorporate the dash or underscore back in...
- final LinkedList tokens = getTokens();
- final String[] versionParts = version.split("\\.");
- String dottedVersion = null;
- for (String current : versionParts) {
- if (!current.matches("^/d+$")) {
- tokens.add(current);
- }
- if (dottedVersion == null) {
- dottedVersion = current;
- } else {
- dottedVersion = dottedVersion + "." + current;
- }
- tokens.add(dottedVersion);
- }
- }
-}
diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nexus/MavenArtifact.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nexus/MavenArtifact.java
index 559f4f8bf..ad020c1f3 100644
--- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nexus/MavenArtifact.java
+++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nexus/MavenArtifact.java
@@ -24,6 +24,11 @@ package org.owasp.dependencycheck.data.nexus;
*/
public class MavenArtifact {
+ /**
+ * The base URL for download artifacts from Central.
+ */
+ private static final String CENTRAL_CONTENT_URL = "http://search.maven.org/remotecontent?filepath=";
+
/**
* The groupId
*/
@@ -43,6 +48,10 @@ public class MavenArtifact {
* The artifact url. This may change depending on which Nexus server the search took place.
*/
private String artifactUrl;
+ /**
+ * The url to download the POM from.
+ */
+ private String pomUrl;
/**
* Creates an empty MavenArtifact.
@@ -58,9 +67,34 @@ public class MavenArtifact {
* @param version the version
*/
public MavenArtifact(String groupId, String artifactId, String version) {
- setGroupId(groupId);
- setArtifactId(artifactId);
- setVersion(version);
+ this.groupId = groupId;
+ this.artifactId = artifactId;
+ this.version = version;
+ }
+
+ /**
+ * Creates a MavenArtifact with the given attributes.
+ *
+ * @param groupId the groupId
+ * @param artifactId the artifactId
+ * @param version the version
+ * @param jarAvailable if the jar file is available from central
+ * @param pomAvailable if the pom file is available from central
+ */
+ public MavenArtifact(String groupId, String artifactId, String version, boolean jarAvailable, boolean pomAvailable) {
+ this.groupId = groupId;
+ this.artifactId = artifactId;
+ this.version = version;
+ if (jarAvailable) {
+ //org/springframework/spring-core/3.2.0.RELEASE/spring-core-3.2.0.RELEASE.pom
+ this.artifactUrl = this.CENTRAL_CONTENT_URL + groupId.replace('.', '/') + "/" + artifactId.replace('.', '/') + "/"
+ + version + "/" + artifactId + "-" + version + ".jar";
+ }
+ if (pomAvailable) {
+ //org/springframework/spring-core/3.2.0.RELEASE/spring-core-3.2.0.RELEASE.pom
+ this.pomUrl = this.CENTRAL_CONTENT_URL + groupId.replace('.', '/') + "/" + artifactId.replace('.', '/') + "/"
+ + version + "/" + artifactId + "-" + version + ".pom";
+ }
}
/**
@@ -72,10 +106,10 @@ public class MavenArtifact {
* @param url the artifactLink url
*/
public MavenArtifact(String groupId, String artifactId, String version, String url) {
- setGroupId(groupId);
- setArtifactId(artifactId);
- setVersion(version);
- setArtifactUrl(url);
+ this.groupId = groupId;
+ this.artifactId = artifactId;
+ this.version = version;
+ this.artifactUrl = url;
}
/**
@@ -159,6 +193,25 @@ public class MavenArtifact {
public String getArtifactUrl() {
return artifactUrl;
}
+
+ /**
+ * Get the value of pomUrl.
+ *
+ * @return the value of pomUrl
+ */
+ public String getPomUrl() {
+ return pomUrl;
+ }
+
+ /**
+ * Set the value of pomUrl.
+ *
+ * @param pomUrl new value of pomUrl
+ */
+ public void setPomUrl(String pomUrl) {
+ this.pomUrl = pomUrl;
+ }
+
}
// vim: cc=120:sw=4:ts=4:sts=4
diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nexus/NexusSearch.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nexus/NexusSearch.java
index ec406a916..a1a66ab25 100644
--- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nexus/NexusSearch.java
+++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nexus/NexusSearch.java
@@ -40,26 +40,32 @@ import org.w3c.dom.Document;
public class NexusSearch {
/**
- * The root URL for the Nexus repository service
+ * The root URL for the Nexus repository service.
*/
private final URL rootURL;
/**
- * Whether to use the Proxy when making requests
+ * Whether to use the Proxy when making requests.
*/
private boolean useProxy;
-
+ /**
+ * The username to use if the Nexus requires authentication.
+ */
+ private String userName = null;
+ /**
+ * The password to use if the Nexus requires authentication.
+ */
+ private char[] password;
/**
* Used for logging.
*/
- private static final Logger LOGGER = Logger.getLogger(NexusSearch.class
- .getName());
+ private static final Logger LOGGER = Logger.getLogger(NexusSearch.class.getName());
/**
* Creates a NexusSearch for the given repository URL.
*
- * @param rootURL the root URL of the repository on which searches should execute. full URL's are calculated
- * relative to this URL, so it should end with a /
+ * @param rootURL the root URL of the repository on which searches should execute. full URL's are calculated relative to this
+ * URL, so it should end with a /
*/
public NexusSearch(URL rootURL) {
this.rootURL = rootURL;
@@ -78,13 +84,12 @@ public class NexusSearch {
}
/**
- * Searches the configured Nexus repository for the given sha1 hash. If the artifact is found, a
- * MavenArtifact is populated with the coordinate information.
+ * Searches the configured Nexus repository for the given sha1 hash. If the artifact is found, a MavenArtifact is
+ * populated with the coordinate information.
*
* @param sha1 The SHA-1 hash string for which to search
* @return the populated Maven coordinates
- * @throws IOException if it's unable to connect to the specified repository or if the specified artifact is not
- * found.
+ * @throws IOException if it's unable to connect to the specified repository or if the specified artifact is not found.
*/
public MavenArtifact searchSha1(String sha1) throws IOException {
if (null == sha1 || !sha1.matches("^[0-9A-Fa-f]{40}$")) {
@@ -99,10 +104,9 @@ public class NexusSearch {
// Determine if we need to use a proxy. The rules:
// 1) If the proxy is set, AND the setting is set to true, use the proxy
// 2) Otherwise, don't use the proxy (either the proxy isn't configured,
- // or proxy is specifically
- // set to false
- final HttpURLConnection conn = URLConnectionFactory.createHttpURLConnection(url, useProxy);
-
+ // or proxy is specifically set to false
+ HttpURLConnection conn;
+ conn = URLConnectionFactory.createHttpURLConnection(url, useProxy);
conn.setDoOutput(true);
// JSON would be more elegant, but there's not currently a dependency
@@ -131,7 +135,18 @@ public class NexusSearch {
.evaluate(
"/org.sonatype.nexus.rest.model.NexusArtifact/artifactLink",
doc);
- return new MavenArtifact(groupId, artifactId, version, link);
+ final String pomLink = xpath
+ .evaluate(
+ "/org.sonatype.nexus.rest.model.NexusArtifact/pomLink",
+ doc);
+ final MavenArtifact ma = new MavenArtifact(groupId, artifactId, version);
+ if (link != null && !"".equals(link)) {
+ ma.setArtifactUrl(link);
+ }
+ if (pomLink != null && !"".equals(pomLink)) {
+ ma.setPomUrl(pomLink);
+ }
+ return ma;
} catch (Throwable e) {
// Anything else is jacked-up XML stuff that we really can't recover
// from well
@@ -153,8 +168,10 @@ public class NexusSearch {
* @return whether the repository is listening and returns the /status URL correctly
*/
public boolean preflightRequest() {
+ HttpURLConnection conn;
try {
- final HttpURLConnection conn = URLConnectionFactory.createHttpURLConnection(new URL(rootURL, "status"), useProxy);
+ URL url = new URL(rootURL, "status");
+ conn = URLConnectionFactory.createHttpURLConnection(url, useProxy);
conn.addRequestProperty("Accept", "application/xml");
conn.connect();
if (conn.getResponseCode() != 200) {
diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nvdcve/CveDB.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nvdcve/CveDB.java
index da6b2ae58..44998262f 100644
--- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nvdcve/CveDB.java
+++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nvdcve/CveDB.java
@@ -17,6 +17,7 @@
*/
package org.owasp.dependencycheck.data.nvdcve;
+import java.io.IOException;
import java.io.UnsupportedEncodingException;
import java.sql.Connection;
import java.sql.PreparedStatement;
@@ -24,8 +25,10 @@ import java.sql.ResultSet;
import java.sql.SQLException;
import java.sql.Statement;
import java.util.ArrayList;
+import java.util.HashMap;
import java.util.HashSet;
import java.util.List;
+import java.util.Map;
import java.util.Map.Entry;
import java.util.Properties;
import java.util.Set;
@@ -39,6 +42,7 @@ import org.owasp.dependencycheck.utils.DBUtils;
import org.owasp.dependencycheck.utils.DependencyVersion;
import org.owasp.dependencycheck.utils.DependencyVersionUtil;
import org.owasp.dependencycheck.utils.Pair;
+import org.owasp.dependencycheck.utils.Settings;
/**
* The database holding information about the NVD CVE data.
@@ -57,8 +61,8 @@ public class CveDB {
private Connection conn;
/**
- * Creates a new CveDB object and opens the database connection. Note, the connection must be closed by the caller
- * by calling the close method.
+ * Creates a new CveDB object and opens the database connection. Note, the connection must be closed by the caller by calling
+ * the close method.
*
* @throws DatabaseException thrown if there is an exception opening the database.
*/
@@ -87,7 +91,9 @@ public class CveDB {
* @throws DatabaseException thrown if there is an error opening the database connection
*/
public final void open() throws DatabaseException {
- conn = ConnectionFactory.getConnection();
+ if (!isOpen()) {
+ conn = ConnectionFactory.getConnection();
+ }
}
/**
@@ -170,8 +176,8 @@ public class CveDB {
*/
private static final String DELETE_VULNERABILITY = "DELETE FROM vulnerability WHERE id = ?";
/**
- * SQL Statement to cleanup orphan entries. Yes, the db schema could be a little tighter, but what we have works
- * well to keep the data file size down a bit.
+ * SQL Statement to cleanup orphan entries. Yes, the db schema could be a little tighter, but what we have works well to keep
+ * the data file size down a bit.
*/
private static final String CLEANUP_ORPHANS = "DELETE FROM CpeEntry WHERE id not in (SELECT CPEEntryId FROM Software); ";
/**
@@ -208,7 +214,8 @@ public class CveDB {
private static final String SELECT_CVE_FROM_SOFTWARE = "SELECT cve, cpe, previousVersion "
+ "FROM software INNER JOIN vulnerability ON vulnerability.id = software.cveId "
+ "INNER JOIN cpeEntry ON cpeEntry.id = software.cpeEntryId "
- + "WHERE vendor = ? AND product = ?";
+ + "WHERE vendor = ? AND product = ? "
+ + "ORDER BY cve, cpe"; //, previousVersion
//unfortunately, the version info is too complicated to do in a select. Need to filter this afterwards
// + " AND (version = '-' OR previousVersion IS NOT NULL OR version=?)";
//
@@ -266,8 +273,8 @@ public class CveDB {
//
/**
- * Searches the CPE entries in the database and retrieves all entries for a given vendor and product combination.
- * The returned list will include all versions of the product that are registered in the NVD CVE data.
+ * Searches the CPE entries in the database and retrieves all entries for a given vendor and product combination. The returned
+ * list will include all versions of the product that are registered in the NVD CVE data.
*
* @param vendor the identified vendor name of the dependency being analyzed
* @param product the identified name of the product of the dependency being analyzed
@@ -306,14 +313,14 @@ public class CveDB {
* @throws DatabaseException thrown when there is an error retrieving the data from the DB
*/
public Set> getVendorProductList() throws DatabaseException {
- final HashSet data = new HashSet>();
+ final Set> data = new HashSet>();
ResultSet rs = null;
PreparedStatement ps = null;
try {
ps = getConnection().prepareStatement(SELECT_VENDOR_PRODUCT_LIST);
rs = ps.executeQuery();
while (rs.next()) {
- data.add(new Pair(rs.getString(1), rs.getString(2)));
+ data.add(new Pair(rs.getString(1), rs.getString(2)));
}
} catch (SQLException ex) {
final String msg = "An unexpected SQL Exception occurred; please see the verbose log for more details.";
@@ -452,30 +459,41 @@ public class CveDB {
final List vulnerabilities = new ArrayList();
PreparedStatement ps;
- final HashSet cveEntries = new HashSet();
try {
ps = getConnection().prepareStatement(SELECT_CVE_FROM_SOFTWARE);
ps.setString(1, cpe.getVendor());
ps.setString(2, cpe.getProduct());
rs = ps.executeQuery();
+ String currentCVE = "";
+
+ final Map vulnSoftware = new HashMap();
while (rs.next()) {
final String cveId = rs.getString(1);
+ if (!currentCVE.equals(cveId)) { //check for match and add
+ final Entry matchedCPE = getMatchingSoftware(vulnSoftware, cpe.getVendor(), cpe.getProduct(), detectedVersion);
+ if (matchedCPE != null) {
+ final Vulnerability v = getVulnerability(currentCVE);
+ v.setMatchedCPE(matchedCPE.getKey(), matchedCPE.getValue() ? "Y" : null);
+ vulnerabilities.add(v);
+ }
+ vulnSoftware.clear();
+ currentCVE = cveId;
+ }
+
final String cpeId = rs.getString(2);
final String previous = rs.getString(3);
- if (!cveEntries.contains(cveId) && isAffected(cpe.getVendor(), cpe.getProduct(), detectedVersion, cpeId, previous)) {
- cveEntries.add(cveId);
- final Vulnerability v = getVulnerability(cveId);
- v.setMatchedCPE(cpeId, previous);
- vulnerabilities.add(v);
- }
+ final Boolean p = previous != null && !previous.isEmpty();
+ vulnSoftware.put(cpeId, p);
+ }
+ //remember to process the last set of CVE/CPE entries
+ final Entry matchedCPE = getMatchingSoftware(vulnSoftware, cpe.getVendor(), cpe.getProduct(), detectedVersion);
+ if (matchedCPE != null) {
+ final Vulnerability v = getVulnerability(currentCVE);
+ v.setMatchedCPE(matchedCPE.getKey(), matchedCPE.getValue() ? "Y" : null);
+ vulnerabilities.add(v);
}
DBUtils.closeResultSet(rs);
DBUtils.closeStatement(ps);
-// for (String cve : cveEntries) {
-// final Vulnerability v = getVulnerability(cve);
-// vulnerabilities.add(v);
-// }
-
} catch (SQLException ex) {
throw new DatabaseException("Exception retrieving vulnerability for " + cpeStr, ex);
} finally {
@@ -701,8 +719,45 @@ public class CveDB {
}
/**
- * It is possible that orphaned rows may be generated during database updates. This should be called after all
- * updates have been completed to ensure orphan entries are removed.
+ * Checks to see if data exists so that analysis can be performed.
+ *
+ * @return true if data exists; otherwise false
+ */
+ public boolean dataExists() {
+ Statement cs = null;
+ ResultSet rs = null;
+ try {
+ cs = conn.createStatement();
+ rs = cs.executeQuery("SELECT COUNT(*) records FROM cpeEntry");
+ if (rs.next()) {
+ if (rs.getInt(1) > 0) {
+ return true;
+ }
+ }
+ } catch (SQLException ex) {
+ String dd;
+ try {
+ dd = Settings.getDataDirectory().getAbsolutePath();
+ } catch (IOException ex1) {
+ dd = Settings.getString(Settings.KEYS.DATA_DIRECTORY);
+ }
+ final String msg = String.format("Unable to access the local database.%n%nEnsure that '%s' is a writable directory. "
+ + "If the problem persist try deleting the files in '%s' and running %s again. If the problem continues, please "
+ + "create a log file (see documentation at http://jeremylong.github.io/DependencyCheck/) and open a ticket at "
+ + "https://github.com/jeremylong/DependencyCheck/issues and include the log file.%n%n",
+ dd, dd, Settings.getString(Settings.KEYS.APPLICATION_VAME));
+ LOGGER.log(Level.SEVERE, msg);
+ LOGGER.log(Level.FINE, "", ex);
+ } finally {
+ DBUtils.closeResultSet(rs);
+ DBUtils.closeStatement(cs);
+ }
+ return false;
+ }
+
+ /**
+ * It is possible that orphaned rows may be generated during database updates. This should be called after all updates have
+ * been completed to ensure orphan entries are removed.
*/
public void cleanupDatabase() {
PreparedStatement ps = null;
@@ -721,46 +776,80 @@ public class CveDB {
}
/**
- * Determines if the given identifiedVersion is affected by the given cpeId and previous version flag. A non-null,
- * non-empty string passed to the previous version argument indicates that all previous versions are affected.
+ * Determines if the given identifiedVersion is affected by the given cpeId and previous version flag. A non-null, non-empty
+ * string passed to the previous version argument indicates that all previous versions are affected.
*
* @param vendor the vendor of the dependency being analyzed
* @param product the product name of the dependency being analyzed
+ * @param vulnerableSoftware a map of the vulnerable software with a boolean indicating if all previous versions are affected
* @param identifiedVersion the identified version of the dependency being analyzed
- * @param cpeId the cpe identifier of software that has a known vulnerability
- * @param previous a flag indicating if previous versions of the product are vulnerable
* @return true if the identified version is affected, otherwise false
*/
- private boolean isAffected(String vendor, String product, DependencyVersion identifiedVersion, String cpeId, String previous) {
- boolean affected = false;
- final boolean isStruts = "apache".equals(vendor) && "struts".equals(product);
- final DependencyVersion v = parseDependencyVersion(cpeId);
- final boolean prevAffected = previous != null && !previous.isEmpty();
- if (v == null || "-".equals(v.toString())) { //all versions
- affected = true;
- } else if (identifiedVersion == null || "-".equals(identifiedVersion.toString())) {
- if (prevAffected) {
- affected = true;
+ Entry getMatchingSoftware(Map vulnerableSoftware, String vendor, String product,
+ DependencyVersion identifiedVersion) {
+
+ final boolean isVersionTwoADifferentProduct = "apache".equals(vendor) && "struts".equals(product);
+
+ final Set majorVersionsAffectingAllPrevious = new HashSet();
+ final boolean matchesAnyPrevious = identifiedVersion == null || "-".equals(identifiedVersion.toString());
+ String majorVersionMatch = null;
+ for (Entry entry : vulnerableSoftware.entrySet()) {
+ final DependencyVersion v = parseDependencyVersion(entry.getKey());
+ if (v == null || "-".equals(v.toString())) { //all versions
+ return entry;
}
- } else if (identifiedVersion.equals(v) || (prevAffected && identifiedVersion.compareTo(v) < 0)) {
- if (isStruts) { //struts 2 vulns don't affect struts 1
- if (identifiedVersion.getVersionParts().get(0).equals(v.getVersionParts().get(0))) {
- affected = true;
+ if (entry.getValue()) {
+ if (matchesAnyPrevious) {
+ return entry;
}
- } else {
- affected = true;
+ if (identifiedVersion != null && identifiedVersion.getVersionParts().get(0).equals(v.getVersionParts().get(0))) {
+ majorVersionMatch = v.getVersionParts().get(0);
+ }
+ majorVersionsAffectingAllPrevious.add(v.getVersionParts().get(0));
}
}
- /*
- * TODO consider utilizing the matchThreeVersion method to get additional results. However, this
- * might also introduce false positives.
- */
- return affected;
+ if (matchesAnyPrevious) {
+ return null;
+ }
+
+ final boolean canSkipVersions = majorVersionMatch != null && majorVersionsAffectingAllPrevious.size() > 1;
+ //yes, we are iterating over this twice. The first time we are skipping versions those that affect all versions
+ //then later we process those that affect all versions. This could be done with sorting...
+ for (Entry entry : vulnerableSoftware.entrySet()) {
+ if (!entry.getValue()) {
+ final DependencyVersion v = parseDependencyVersion(entry.getKey());
+ //this can't dereference a null 'majorVersionMatch' as canSkipVersions accounts for this.
+ if (canSkipVersions && !majorVersionMatch.equals(v.getVersionParts().get(0))) {
+ continue;
+ }
+ //this can't dereference a null 'identifiedVersion' because if it was null we would have exited
+ //in the above loop or just after loop (if matchesAnyPrevious return null).
+ if (identifiedVersion.equals(v)) {
+ return entry;
+ }
+ }
+ }
+ for (Entry entry : vulnerableSoftware.entrySet()) {
+ if (entry.getValue()) {
+ final DependencyVersion v = parseDependencyVersion(entry.getKey());
+ //this can't dereference a null 'majorVersionMatch' as canSkipVersions accounts for this.
+ if (canSkipVersions && !majorVersionMatch.equals(v.getVersionParts().get(0))) {
+ continue;
+ }
+ //this can't dereference a null 'identifiedVersion' because if it was null we would have exited
+ //in the above loop or just after loop (if matchesAnyPrevious return null).
+ if (entry.getValue() && identifiedVersion.compareTo(v) <= 0) {
+ if (!(isVersionTwoADifferentProduct && !identifiedVersion.getVersionParts().get(0).equals(v.getVersionParts().get(0)))) {
+ return entry;
+ }
+ }
+ }
+ }
+ return null;
}
/**
- * Parses the version (including revision) from a CPE identifier. If no version is identified then a '-' is
- * returned.
+ * Parses the version (including revision) from a CPE identifier. If no version is identified then a '-' is returned.
*
* @param cpeStr a cpe identifier
* @return a dependency version
@@ -784,9 +873,9 @@ public class CveDB {
*/
private DependencyVersion parseDependencyVersion(VulnerableSoftware cpe) {
DependencyVersion cpeVersion;
- if (cpe.getVersion() != null && cpe.getVersion().length() > 0) {
+ if (cpe.getVersion() != null && !cpe.getVersion().isEmpty()) {
String versionText;
- if (cpe.getRevision() != null && cpe.getRevision().length() > 0) {
+ if (cpe.getRevision() != null && !cpe.getRevision().isEmpty()) {
versionText = String.format("%s.%s", cpe.getVersion(), cpe.getRevision());
} else {
versionText = cpe.getVersion();
diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nvdcve/DatabaseProperties.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nvdcve/DatabaseProperties.java
index cadcb2ae6..8b90dd0fa 100644
--- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nvdcve/DatabaseProperties.java
+++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nvdcve/DatabaseProperties.java
@@ -91,7 +91,7 @@ public class DatabaseProperties {
}
/**
- * Writes a properties file containing the last updated date to the VULNERABLE_CPE directory.
+ * Saves the last updated information to the properties file.
*
* @param updatedValue the updated NVD CVE entry
* @throws UpdateException is thrown if there is an update exception
@@ -100,8 +100,19 @@ public class DatabaseProperties {
if (updatedValue == null) {
return;
}
- properties.put(LAST_UPDATED_BASE + updatedValue.getId(), String.valueOf(updatedValue.getTimestamp()));
- cveDB.saveProperty(LAST_UPDATED_BASE + updatedValue.getId(), String.valueOf(updatedValue.getTimestamp()));
+ save(LAST_UPDATED_BASE + updatedValue.getId(), String.valueOf(updatedValue.getTimestamp()));
+ }
+
+ /**
+ * Saves the key value pair to the properties store.
+ *
+ * @param key the property key
+ * @param value the property value
+ * @throws UpdateException is thrown if there is an update exception
+ */
+ public void save(String key, String value) throws UpdateException {
+ properties.put(key, value);
+ cveDB.saveProperty(key, value);
}
/**
@@ -142,8 +153,8 @@ public class DatabaseProperties {
*
* @return a map of the database meta data
*/
- public Map getMetaData() {
- final TreeMap map = new TreeMap();
+ public Map getMetaData() {
+ final Map map = new TreeMap();
for (Entry entry : properties.entrySet()) {
final String key = (String) entry.getKey();
if (!"version".equals(key)) {
@@ -156,10 +167,10 @@ public class DatabaseProperties {
map.put(key, formatted);
} catch (Throwable ex) { //deliberately being broad in this catch clause
LOGGER.log(Level.FINE, "Unable to parse timestamp from DB", ex);
- map.put(key, entry.getValue());
+ map.put(key, (String) entry.getValue());
}
} else {
- map.put(key, entry.getValue());
+ map.put(key, (String) entry.getValue());
}
}
}
diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nvdcve/DriverLoader.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nvdcve/DriverLoader.java
index fbce2e8a8..127b43673 100644
--- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nvdcve/DriverLoader.java
+++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nvdcve/DriverLoader.java
@@ -27,6 +27,7 @@ import java.sql.Driver;
import java.sql.DriverManager;
import java.sql.SQLException;
import java.util.ArrayList;
+import java.util.List;
import java.util.logging.Level;
import java.util.logging.Logger;
@@ -75,7 +76,7 @@ public final class DriverLoader {
*/
public static Driver load(String className, String pathToDriver) throws DriverLoadException {
final URLClassLoader parent = (URLClassLoader) ClassLoader.getSystemClassLoader();
- final ArrayList urls = new ArrayList();
+ final List urls = new ArrayList();
final String[] paths = pathToDriver.split(File.pathSeparator);
for (String path : paths) {
final File file = new File(path);
diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/update/EngineVersionCheck.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/update/EngineVersionCheck.java
new file mode 100644
index 000000000..035d4e49b
--- /dev/null
+++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/update/EngineVersionCheck.java
@@ -0,0 +1,214 @@
+/*
+ * This file is part of dependency-check-core.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * Copyright (c) 2014 Jeremy Long. All Rights Reserved.
+ */
+package org.owasp.dependencycheck.data.update;
+
+import java.io.IOException;
+import java.net.HttpURLConnection;
+import java.net.MalformedURLException;
+import java.net.URL;
+import java.util.Date;
+import java.util.logging.Level;
+import java.util.logging.Logger;
+import org.apache.commons.io.IOUtils;
+import org.owasp.dependencycheck.data.nvdcve.CveDB;
+import org.owasp.dependencycheck.data.nvdcve.DatabaseException;
+import org.owasp.dependencycheck.data.nvdcve.DatabaseProperties;
+import org.owasp.dependencycheck.data.update.exception.UpdateException;
+import org.owasp.dependencycheck.utils.DateUtil;
+import org.owasp.dependencycheck.utils.DependencyVersion;
+import org.owasp.dependencycheck.utils.Settings;
+import org.owasp.dependencycheck.utils.URLConnectionFactory;
+import org.owasp.dependencycheck.utils.URLConnectionFailureException;
+
+/**
+ *
+ * @author Jeremy Long
+ */
+public class EngineVersionCheck implements CachedWebDataSource {
+
+ /**
+ * Static logger.
+ */
+ private static final Logger LOGGER = Logger.getLogger(EngineVersionCheck.class.getName());
+ /**
+ * The property key indicating when the last version check occurred.
+ */
+ public static final String ENGINE_VERSION_CHECKED_ON = "VersionCheckOn";
+ /**
+ * The property key indicating when the last version check occurred.
+ */
+ public static final String CURRENT_ENGINE_RELEASE = "CurrentEngineRelease";
+ /**
+ * Reference to the Cve Database.
+ */
+ private CveDB cveDB = null;
+
+ /**
+ * The version retrieved from the database properties or web to check against.
+ */
+ private String updateToVersion;
+
+ /**
+ * Getter for updateToVersion - only used for testing. Represents the version retrieved from the database.
+ *
+ * @return the version to test
+ */
+ protected String getUpdateToVersion() {
+ return updateToVersion;
+ }
+
+ /**
+ * Setter for updateToVersion - only used for testing. Represents the version retrieved from the database.
+ *
+ * @param version the version to test
+ */
+ protected void setUpdateToVersion(String version) {
+ updateToVersion = version;
+ }
+
+ @Override
+ public void update() throws UpdateException {
+ try {
+ openDatabase();
+ LOGGER.fine("Begin Engine Version Check");
+ final DatabaseProperties properties = cveDB.getDatabaseProperties();
+ final long lastChecked = Long.parseLong(properties.getProperty(ENGINE_VERSION_CHECKED_ON, "0"));
+ final long now = (new Date()).getTime();
+ updateToVersion = properties.getProperty(CURRENT_ENGINE_RELEASE, "");
+ final String currentVersion = Settings.getString(Settings.KEYS.APPLICATION_VERSION, "0.0.0");
+ LOGGER.fine("Last checked: " + lastChecked);
+ LOGGER.fine("Now: " + now);
+ LOGGER.fine("Current version: " + currentVersion);
+ final boolean updateNeeded = shouldUpdate(lastChecked, now, properties, currentVersion);
+ if (updateNeeded) {
+ final String msg = String.format("A new version of dependency-check is available. Consider updating to version %s.",
+ updateToVersion);
+ LOGGER.warning(msg);
+ }
+ } catch (DatabaseException ex) {
+ LOGGER.log(Level.FINE, "Database Exception opening databases to retrieve properties", ex);
+ throw new UpdateException("Error occured updating database properties.");
+ } finally {
+ closeDatabase();
+ }
+ }
+
+ /**
+ * Determines if a new version of the dependency-check engine has been released.
+ *
+ * @param lastChecked the epoch time of the last version check
+ * @param now the current epoch time
+ * @param properties the database properties object
+ * @param currentVersion the current version of dependency-check
+ * @return true if a newer version of the database has been released; otherwise false
+ * @throws UpdateException thrown if there is an error connecting to the github documentation site or accessing the
+ * local database.
+ */
+ protected boolean shouldUpdate(final long lastChecked, final long now, final DatabaseProperties properties,
+ String currentVersion) throws UpdateException {
+ //check every 30 days if we know there is an update, otherwise check every 7 days
+ int checkRange = 30;
+ if (updateToVersion.isEmpty()) {
+ checkRange = 7;
+ }
+ if (!DateUtil.withinDateRange(lastChecked, now, checkRange)) {
+ LOGGER.fine("Checking web for new version.");
+ final String currentRelease = getCurrentReleaseVersion();
+ if (currentRelease != null) {
+ final DependencyVersion v = new DependencyVersion(currentRelease);
+ if (v.getVersionParts() != null && v.getVersionParts().size() >= 3) {
+ updateToVersion = v.toString();
+ if (!currentRelease.equals(updateToVersion)) {
+ properties.save(CURRENT_ENGINE_RELEASE, updateToVersion);
+ } else {
+ properties.save(CURRENT_ENGINE_RELEASE, "");
+ }
+ properties.save(ENGINE_VERSION_CHECKED_ON, Long.toString(now));
+ }
+ }
+ LOGGER.log(Level.FINE, "Current Release: {0}", updateToVersion);
+ }
+ final DependencyVersion running = new DependencyVersion(currentVersion);
+ final DependencyVersion released = new DependencyVersion(updateToVersion);
+ if (running.compareTo(released) < 0) {
+ LOGGER.fine("Upgrade recommended");
+ return true;
+ }
+ LOGGER.fine("Upgrade not needed");
+ return false;
+ }
+
+ /**
+ * Opens the CVE and CPE data stores.
+ *
+ * @throws DatabaseException thrown if a data store cannot be opened
+ */
+ protected final void openDatabase() throws DatabaseException {
+ if (cveDB != null) {
+ return;
+ }
+ cveDB = new CveDB();
+ cveDB.open();
+ }
+
+ /**
+ * Closes the CVE and CPE data stores.
+ */
+ protected void closeDatabase() {
+ if (cveDB != null) {
+ try {
+ cveDB.close();
+ } catch (Throwable ignore) {
+ LOGGER.log(Level.FINEST, "Error closing the cveDB", ignore);
+ }
+ }
+ }
+
+ /**
+ * Retrieves the current released version number from the github documentation site.
+ *
+ * @return the current released version number
+ */
+ protected String getCurrentReleaseVersion() {
+ HttpURLConnection conn = null;
+ try {
+ final String str = Settings.getString(Settings.KEYS.ENGINE_VERSION_CHECK_URL, "http://jeremylong.github.io/DependencyCheck/current.txt");
+ final URL url = new URL(str);
+ conn = URLConnectionFactory.createHttpURLConnection(url);
+ conn.connect();
+ if (conn.getResponseCode() != 200) {
+ return null;
+ }
+ final String releaseVersion = IOUtils.toString(conn.getInputStream(), "UTF-8");
+ if (releaseVersion != null) {
+ return releaseVersion.trim();
+ }
+ } catch (MalformedURLException ex) {
+ LOGGER.log(Level.FINE, "unable to retrieve current release version of dependency-check", ex);
+ } catch (URLConnectionFailureException ex) {
+ LOGGER.log(Level.FINE, "unable to retrieve current release version of dependency-check", ex);
+ } catch (IOException ex) {
+ LOGGER.log(Level.FINE, "unable to retrieve current release version of dependency-check", ex);
+ } finally {
+ if (conn != null) {
+ conn.disconnect();
+ }
+ }
+ return null;
+ }
+}
diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/update/StandardUpdate.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/update/StandardUpdate.java
index 89a7fc6bd..169f039ca 100644
--- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/update/StandardUpdate.java
+++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/update/StandardUpdate.java
@@ -36,6 +36,7 @@ import org.owasp.dependencycheck.data.update.exception.InvalidDataException;
import org.owasp.dependencycheck.data.update.exception.UpdateException;
import org.owasp.dependencycheck.data.update.task.DownloadTask;
import org.owasp.dependencycheck.data.update.task.ProcessTask;
+import org.owasp.dependencycheck.utils.DateUtil;
import org.owasp.dependencycheck.utils.DownloadFailedException;
import org.owasp.dependencycheck.utils.InvalidSettingException;
import org.owasp.dependencycheck.utils.Settings;
@@ -220,7 +221,7 @@ public class StandardUpdate {
final int days = Settings.getInt(Settings.KEYS.CVE_MODIFIED_VALID_FOR_DAYS, 7);
if (lastUpdated == updates.getTimeStamp(MODIFIED)) {
updates.clear(); //we don't need to update anything.
- } else if (withinRange(lastUpdated, now.getTime(), days)) {
+ } else if (DateUtil.withinDateRange(lastUpdated, now.getTime(), days)) {
for (NvdCveInfo entry : updates) {
if (MODIFIED.equals(entry.getId())) {
entry.setNeedsUpdate(true);
@@ -317,19 +318,4 @@ public class StandardUpdate {
throw new UpdateException("Error updating the CPE/CVE data, please see the log file for more details.");
}
}
-
- /**
- * Determines if the epoch date is within the range specified of the compareTo epoch time. This takes the
- * (compareTo-date)/1000/60/60/24 to get the number of days. If the calculated days is less then the range the date
- * is considered valid.
- *
- * @param date the date to be checked.
- * @param compareTo the date to compare to.
- * @param range the range in days to be considered valid.
- * @return whether or not the date is within the range.
- */
- protected boolean withinRange(long date, long compareTo, int range) {
- final double differenceInDays = (compareTo - date) / 1000.0 / 60.0 / 60.0 / 24.0;
- return differenceInDays < range;
- }
}
diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/update/task/DownloadTask.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/update/task/DownloadTask.java
index 5c3fba161..e15541312 100644
--- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/update/task/DownloadTask.java
+++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/update/task/DownloadTask.java
@@ -18,6 +18,9 @@
package org.owasp.dependencycheck.data.update.task;
import java.io.File;
+import java.io.FileInputStream;
+import java.io.FileNotFoundException;
+import java.io.FileOutputStream;
import java.io.IOException;
import java.net.URL;
import java.util.concurrent.Callable;
@@ -25,6 +28,8 @@ import java.util.concurrent.ExecutorService;
import java.util.concurrent.Future;
import java.util.logging.Level;
import java.util.logging.Logger;
+import java.util.zip.GZIPInputStream;
+import org.apache.commons.io.FileUtils;
import org.owasp.dependencycheck.data.nvdcve.CveDB;
import org.owasp.dependencycheck.data.update.NvdCveInfo;
import org.owasp.dependencycheck.data.update.exception.UpdateException;
@@ -195,10 +200,18 @@ public class DownloadTask implements Callable> {
LOGGER.log(Level.FINE, null, ex);
return null;
}
+ if (url1.toExternalForm().endsWith(".xml.gz")) {
+ extractGzip(first);
+ }
+ if (url2.toExternalForm().endsWith(".xml.gz")) {
+ extractGzip(second);
+ }
msg = String.format("Download Complete for NVD CVE - %s", nvdCveInfo.getId());
LOGGER.log(Level.INFO, msg);
-
+ if (this.processorService == null) {
+ return null;
+ }
final ProcessTask task = new ProcessTask(cveDB, this, settings);
return this.processorService.submit(task);
@@ -237,4 +250,56 @@ public class DownloadTask implements Callable> {
}
}
}
+
+ /**
+ * Extracts the file contained in a gzip archive. The extracted file is placed in the exact same path as the file
+ * specified.
+ *
+ * @param file the archive file
+ * @throws FileNotFoundException thrown if the file does not exist
+ * @throws IOException thrown if there is an error extracting the file.
+ */
+ private void extractGzip(File file) throws FileNotFoundException, IOException {
+ final String originalPath = file.getPath();
+ final File gzip = new File(originalPath + ".gz");
+ if (gzip.isFile() && !gzip.delete()) {
+ gzip.deleteOnExit();
+ }
+ if (!file.renameTo(gzip)) {
+ throw new IOException("Unable to rename '" + file.getPath() + "'");
+ }
+ final File newfile = new File(originalPath);
+
+ final byte[] buffer = new byte[4096];
+
+ GZIPInputStream cin = null;
+ FileOutputStream out = null;
+ try {
+ cin = new GZIPInputStream(new FileInputStream(gzip));
+ out = new FileOutputStream(newfile);
+
+ int len;
+ while ((len = cin.read(buffer)) > 0) {
+ out.write(buffer, 0, len);
+ }
+ } finally {
+ if (cin != null) {
+ try {
+ cin.close();
+ } catch (IOException ex) {
+ LOGGER.log(Level.FINEST, "ignore", ex);
+ }
+ }
+ if (out != null) {
+ try {
+ out.close();
+ } catch (IOException ex) {
+ LOGGER.log(Level.FINEST, "ignore", ex);
+ }
+ }
+ if (gzip.isFile()) {
+ FileUtils.deleteQuietly(gzip);
+ }
+ }
+ }
}
diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/dependency/Dependency.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/dependency/Dependency.java
index 9ce32d38d..bad622829 100644
--- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/dependency/Dependency.java
+++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/dependency/Dependency.java
@@ -21,18 +21,22 @@ import java.io.File;
import java.io.IOException;
import java.io.Serializable;
import java.security.NoSuchAlgorithmException;
+import java.util.ArrayList;
+import java.util.HashSet;
+import java.util.List;
import java.util.Set;
import java.util.SortedSet;
import java.util.TreeSet;
import java.util.logging.Level;
import java.util.logging.Logger;
+import org.owasp.dependencycheck.data.nexus.MavenArtifact;
import org.owasp.dependencycheck.utils.Checksum;
import org.owasp.dependencycheck.utils.FileUtils;
/**
- * A program dependency. This object is one of the core components within DependencyCheck. It is used to collect
- * information about the dependency in the form of evidence. The Evidence is then used to determine if there are any
- * known, published, vulnerabilities associated with the program dependency.
+ * A program dependency. This object is one of the core components within DependencyCheck. It is used to collect information about
+ * the dependency in the form of evidence. The Evidence is then used to determine if there are any known, published,
+ * vulnerabilities associated with the program dependency.
*
* @author Jeremy Long
*/
@@ -120,8 +124,8 @@ public class Dependency implements Serializable, Comparable {
}
/**
- * Returns the file name of the dependency with the backslash escaped for use in JavaScript. This is a complete hack
- * as I could not get the replace to work in the template itself.
+ * Returns the file name of the dependency with the backslash escaped for use in JavaScript. This is a complete hack as I
+ * could not get the replace to work in the template itself.
*
* @return the file name of the dependency with the backslash escaped for use in JavaScript
*/
@@ -193,8 +197,7 @@ public class Dependency implements Serializable, Comparable {
}
/**
- * Returns the file name to display in reports; if no display file name has been set it will default to the actual
- * file name.
+ * Returns the file name to display in reports; if no display file name has been set it will default to the actual file name.
*
* @return the file name to display
*/
@@ -209,8 +212,8 @@ public class Dependency implements Serializable, Comparable {
*
* Gets the file path of the dependency.
*
- * NOTE: This may not be the actual path of the file on disk. The actual path of the file on disk can be
- * obtained via the getActualFilePath().
+ * NOTE: This may not be the actual path of the file on disk. The actual path of the file on disk can be obtained via
+ * the getActualFilePath().
*
* @return the file path of the dependency
*/
@@ -316,6 +319,43 @@ public class Dependency implements Serializable, Comparable {
this.identifiers.add(i);
}
+ /**
+ * Adds the maven artifact as evidence.
+ *
+ * @param source The source of the evidence
+ * @param mavenArtifact The maven artifact
+ * @param confidence The confidence level of this evidence
+ */
+ public void addAsEvidence(String source, MavenArtifact mavenArtifact, Confidence confidence) {
+ if (mavenArtifact.getGroupId() != null && !mavenArtifact.getGroupId().isEmpty()) {
+ this.getVendorEvidence().addEvidence(source, "groupid", mavenArtifact.getGroupId(), confidence);
+ }
+ if (mavenArtifact.getArtifactId() != null && !mavenArtifact.getArtifactId().isEmpty()) {
+ this.getProductEvidence().addEvidence(source, "artifactid", mavenArtifact.getArtifactId(), confidence);
+ }
+ if (mavenArtifact.getVersion() != null && !mavenArtifact.getVersion().isEmpty()) {
+ this.getVersionEvidence().addEvidence(source, "version", mavenArtifact.getVersion(), confidence);
+ }
+ if (mavenArtifact.getArtifactUrl() != null && !mavenArtifact.getArtifactUrl().isEmpty()) {
+ boolean found = false;
+ for (Identifier i : this.getIdentifiers()) {
+ if ("maven".equals(i.getType()) && i.getValue().equals(mavenArtifact.toString())) {
+ found = true;
+ i.setConfidence(Confidence.HIGHEST);
+ final String url = "http://search.maven.org/#search|ga|1|1%3A%22" + this.getSha1sum() + "%22";
+ i.setUrl(url);
+ //i.setUrl(mavenArtifact.getArtifactUrl());
+ LOGGER.fine(String.format("Already found identifier %s. Confidence set to highest", i.getValue()));
+ break;
+ }
+ }
+ if (!found) {
+ LOGGER.fine(String.format("Adding new maven identifier %s", mavenArtifact.toString()));
+ this.addIdentifier("maven", mavenArtifact.toString(), mavenArtifact.getArtifactUrl(), Confidence.HIGHEST);
+ }
+ }
+ }
+
/**
* Adds an entry to the list of detected Identifiers for the dependency file.
*
@@ -324,6 +364,7 @@ public class Dependency implements Serializable, Comparable {
public void addIdentifier(Identifier identifier) {
this.identifiers.add(identifier);
}
+
/**
* A set of identifiers that have been suppressed.
*/
@@ -441,6 +482,7 @@ public class Dependency implements Serializable, Comparable {
public EvidenceCollection getVersionEvidence() {
return this.versionEvidence;
}
+
/**
* The description of the JAR file.
*/
@@ -463,6 +505,7 @@ public class Dependency implements Serializable, Comparable {
public void setDescription(String description) {
this.description = description;
}
+
/**
* The license that this dependency uses.
*/
@@ -485,6 +528,7 @@ public class Dependency implements Serializable, Comparable {
public void setLicense(String license) {
this.license = license;
}
+
/**
* A list of vulnerabilities for this dependency.
*/
@@ -540,6 +584,7 @@ public class Dependency implements Serializable, Comparable {
public void addVulnerability(Vulnerability vulnerability) {
this.vulnerabilities.add(vulnerability);
}
+
/**
* A collection of related dependencies.
*/
@@ -554,6 +599,47 @@ public class Dependency implements Serializable, Comparable {
return relatedDependencies;
}
+ /**
+ * A list of projects that reference this dependency.
+ */
+ private Set projectReferences = new HashSet();
+
+ /**
+ * Get the value of projectReferences.
+ *
+ * @return the value of projectReferences
+ */
+ public Set getProjectReferences() {
+ return projectReferences;
+ }
+
+ /**
+ * Set the value of projectReferences.
+ *
+ * @param projectReferences new value of projectReferences
+ */
+ public void setProjectReferences(Set projectReferences) {
+ this.projectReferences = projectReferences;
+ }
+
+ /**
+ * Adds a project reference.
+ *
+ * @param projectReference a project reference
+ */
+ public void addProjectReference(String projectReference) {
+ this.projectReferences.add(projectReference);
+ }
+
+ /**
+ * Add a collection of project reference.
+ *
+ * @param projectReferences a set of project references
+ */
+ public void addAllProjectReferences(Set projectReferences) {
+ this.projectReferences.addAll(projectReferences);
+ }
+
/**
* Set the value of relatedDependencies.
*
@@ -569,7 +655,46 @@ public class Dependency implements Serializable, Comparable {
* @param dependency a reference to the related dependency
*/
public void addRelatedDependency(Dependency dependency) {
- relatedDependencies.add(dependency);
+ if (this == dependency) {
+ LOGGER.warning("Attempted to add a circular reference - please post the log file to issue #172 here "
+ + "https://github.com/jeremylong/DependencyCheck/issues/172 ");
+ LOGGER.log(Level.FINE, "this: {0}", this.toString());
+ LOGGER.log(Level.FINE, "dependency: {0}", dependency.toString());
+ } else {
+ relatedDependencies.add(dependency);
+ }
+ }
+
+ /**
+ * A list of available versions.
+ */
+ private List availableVersions = new ArrayList();
+
+ /**
+ * Get the value of availableVersions.
+ *
+ * @return the value of availableVersions
+ */
+ public List getAvailableVersions() {
+ return availableVersions;
+ }
+
+ /**
+ * Set the value of availableVersions.
+ *
+ * @param availableVersions new value of availableVersions
+ */
+ public void setAvailableVersions(List availableVersions) {
+ this.availableVersions = availableVersions;
+ }
+
+ /**
+ * Adds a version to the available version list.
+ *
+ * @param version the version to add to the list
+ */
+ public void addAvailableVersion(String version) {
+ this.availableVersions.add(version);
}
/**
@@ -579,7 +704,7 @@ public class Dependency implements Serializable, Comparable {
* @return an integer representing the natural ordering
*/
public int compareTo(Dependency o) {
- return this.getFileName().compareToIgnoreCase(o.getFileName());
+ return this.getFilePath().compareToIgnoreCase(o.getFilePath());
}
/**
@@ -640,6 +765,15 @@ public class Dependency implements Serializable, Comparable {
&& (this.relatedDependencies == null || !this.relatedDependencies.equals(other.relatedDependencies))) {
return false;
}
+ if (this.projectReferences != other.projectReferences
+ && (this.projectReferences == null || !this.projectReferences.equals(other.projectReferences))) {
+ return false;
+ }
+ if (this.availableVersions != other.availableVersions
+ && (this.availableVersions == null || !this.availableVersions.equals(other.availableVersions))) {
+ return false;
+ }
+
return true;
}
@@ -665,6 +799,8 @@ public class Dependency implements Serializable, Comparable {
hash = 47 * hash + (this.license != null ? this.license.hashCode() : 0);
hash = 47 * hash + (this.vulnerabilities != null ? this.vulnerabilities.hashCode() : 0);
hash = 47 * hash + (this.relatedDependencies != null ? this.relatedDependencies.hashCode() : 0);
+ hash = 47 * hash + (this.projectReferences != null ? this.projectReferences.hashCode() : 0);
+ hash = 47 * hash + (this.availableVersions != null ? this.availableVersions.hashCode() : 0);
return hash;
}
diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/dependency/Identifier.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/dependency/Identifier.java
index 3f64b2faa..edd0f9a65 100644
--- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/dependency/Identifier.java
+++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/dependency/Identifier.java
@@ -25,6 +25,15 @@ import java.io.Serializable;
*/
public class Identifier implements Serializable, Comparable {
+ /**
+ * Default constructor. Should only be used for automatic class
+ * creation as is the case with many XML parsers (for the parsing
+ * of the Dependency-Check XML report). For all other use-cases,
+ * please use the non-default constructors.
+ */
+ public Identifier() {
+ }
+
/**
* Constructs a new Identifier with the specified data.
*
diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/jaxb/pom/PomUtils.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/jaxb/pom/PomUtils.java
new file mode 100644
index 000000000..ff4e9d732
--- /dev/null
+++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/jaxb/pom/PomUtils.java
@@ -0,0 +1,226 @@
+/*
+ * This file is part of dependency-check-core.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * Copyright (c) 2015 Jeremy Long. All Rights Reserved.
+ */
+package org.owasp.dependencycheck.jaxb.pom;
+
+import java.io.File;
+import java.io.FileInputStream;
+import java.io.IOException;
+import java.io.InputStreamReader;
+import java.util.logging.Level;
+import java.util.logging.Logger;
+import javax.xml.bind.JAXBContext;
+import javax.xml.bind.JAXBElement;
+import javax.xml.bind.JAXBException;
+import javax.xml.bind.Unmarshaller;
+import javax.xml.parsers.ParserConfigurationException;
+import javax.xml.parsers.SAXParser;
+import javax.xml.parsers.SAXParserFactory;
+import javax.xml.transform.sax.SAXSource;
+
+import org.owasp.dependencycheck.analyzer.JarAnalyzer;
+import org.owasp.dependencycheck.analyzer.exception.AnalysisException;
+import org.owasp.dependencycheck.dependency.Confidence;
+import org.owasp.dependencycheck.dependency.Dependency;
+import org.owasp.dependencycheck.jaxb.pom.generated.Model;
+import org.owasp.dependencycheck.jaxb.pom.generated.Organization;
+import org.xml.sax.InputSource;
+import org.xml.sax.SAXException;
+import org.xml.sax.XMLFilter;
+import org.xml.sax.XMLReader;
+
+/**
+ *
+ * @author jeremy
+ */
+public class PomUtils {
+
+ /**
+ * The logger.
+ */
+ private static final Logger LOGGER = Logger.getLogger(PomUtils.class.getName());
+
+ /**
+ * The unmarshaller used to parse the pom.xml from a JAR file.
+ */
+ private Unmarshaller pomUnmarshaller;
+
+ /**
+ * Constructs a new POM Utility.
+ */
+ public PomUtils() {
+ try {
+ //final JAXBContext jaxbContext = JAXBContext.newInstance("org.owasp.dependencycheck.jaxb.pom.generated");
+ final JAXBContext jaxbContext = JAXBContext.newInstance(Model.class);
+ pomUnmarshaller = jaxbContext.createUnmarshaller();
+ } catch (JAXBException ex) { //guess we will just have a null pointer exception later...
+ LOGGER.log(Level.SEVERE, "Unable to load parser. See the log for more details.");
+ LOGGER.log(Level.FINE, null, ex);
+ }
+ }
+
+ /**
+ * Reads in the specified POM and converts it to a Model.
+ *
+ * @param file the pom.xml file
+ * @return returns a
+ * @throws AnalysisException is thrown if there is an exception extracting or parsing the POM
+ * {@link org.owasp.dependencycheck.jaxb.pom.generated.Model} object
+ */
+ public Model readPom(File file) throws AnalysisException {
+ Model model = null;
+ try {
+ final FileInputStream stream = new FileInputStream(file);
+ final InputStreamReader reader = new InputStreamReader(stream, "UTF-8");
+ final InputSource xml = new InputSource(reader);
+ final SAXSource source = new SAXSource(xml);
+ model = readPom(source);
+ } catch (SecurityException ex) {
+ final String msg = String.format("Unable to parse pom '%s'; invalid signature", file.getPath());
+ LOGGER.log(Level.WARNING, msg);
+ LOGGER.log(Level.FINE, "", ex);
+ throw new AnalysisException(ex);
+ } catch (IOException ex) {
+ final String msg = String.format("Unable to parse pom '%s'(IO Exception)", file.getPath());
+ LOGGER.log(Level.WARNING, msg);
+ LOGGER.log(Level.FINE, "", ex);
+ throw new AnalysisException(ex);
+ } catch (Throwable ex) {
+ final String msg = String.format("Unexpected error during parsing of the pom '%s'", file.getPath());
+ LOGGER.log(Level.WARNING, msg);
+ LOGGER.log(Level.FINE, "", ex);
+ throw new AnalysisException(ex);
+ }
+ return model;
+ }
+
+ /**
+ * Retrieves the specified POM from a jar file and converts it to a Model.
+ *
+ * @param source the SAXSource input stream to read the POM from
+ * @return returns the POM object
+ * @throws AnalysisException is thrown if there is an exception extracting or parsing the POM
+ * {@link org.owasp.dependencycheck.jaxb.pom.generated.Model} object
+ */
+ public Model readPom(SAXSource source) throws AnalysisException {
+ Model model = null;
+ try {
+ final XMLFilter filter = new MavenNamespaceFilter();
+ final SAXParserFactory spf = SAXParserFactory.newInstance();
+ final SAXParser sp = spf.newSAXParser();
+ final XMLReader xr = sp.getXMLReader();
+ filter.setParent(xr);
+ final JAXBElement el = pomUnmarshaller.unmarshal(source, Model.class);
+ model = el.getValue();
+ } catch (SecurityException ex) {
+ throw new AnalysisException(ex);
+ } catch (ParserConfigurationException ex) {
+ throw new AnalysisException(ex);
+ } catch (SAXException ex) {
+ throw new AnalysisException(ex);
+ } catch (JAXBException ex) {
+ throw new AnalysisException(ex);
+ } catch (Throwable ex) {
+ throw new AnalysisException(ex);
+ }
+ return model;
+ }
+
+ /**
+ * Reads in the pom file and adds elements as evidence to the given dependency.
+ *
+ * @param dependency the dependency being analyzed
+ * @param pomFile the pom file to read
+ * @throws AnalysisException is thrown if there is an exception parsing the pom
+ */
+ public void analyzePOM(Dependency dependency, File pomFile) throws AnalysisException {
+ final Model pom = this.readPom(pomFile);
+
+ String groupid = pom.getGroupId();
+ String parentGroupId = null;
+
+ if (pom.getParent() != null) {
+ parentGroupId = pom.getParent().getGroupId();
+ if ((groupid == null || groupid.isEmpty()) && parentGroupId != null && !parentGroupId.isEmpty()) {
+ groupid = parentGroupId;
+ }
+ }
+ if (groupid != null && !groupid.isEmpty()) {
+ dependency.getVendorEvidence().addEvidence("pom", "groupid", groupid, Confidence.HIGHEST);
+ dependency.getProductEvidence().addEvidence("pom", "groupid", groupid, Confidence.LOW);
+ if (parentGroupId != null && !parentGroupId.isEmpty() && !parentGroupId.equals(groupid)) {
+ dependency.getVendorEvidence().addEvidence("pom", "parent-groupid", parentGroupId, Confidence.MEDIUM);
+ dependency.getProductEvidence().addEvidence("pom", "parent-groupid", parentGroupId, Confidence.LOW);
+ }
+ }
+ String artifactid = pom.getArtifactId();
+ String parentArtifactId = null;
+ if (pom.getParent() != null) {
+ parentArtifactId = pom.getParent().getArtifactId();
+ if ((artifactid == null || artifactid.isEmpty()) && parentArtifactId != null && !parentArtifactId.isEmpty()) {
+ artifactid = parentArtifactId;
+ }
+ }
+ if (artifactid != null && !artifactid.isEmpty()) {
+ if (artifactid.startsWith("org.") || artifactid.startsWith("com.")) {
+ artifactid = artifactid.substring(4);
+ }
+ dependency.getProductEvidence().addEvidence("pom", "artifactid", artifactid, Confidence.HIGHEST);
+ dependency.getVendorEvidence().addEvidence("pom", "artifactid", artifactid, Confidence.LOW);
+ if (parentArtifactId != null && !parentArtifactId.isEmpty() && !parentArtifactId.equals(artifactid)) {
+ dependency.getProductEvidence().addEvidence("pom", "parent-artifactid", parentArtifactId, Confidence.MEDIUM);
+ dependency.getVendorEvidence().addEvidence("pom", "parent-artifactid", parentArtifactId, Confidence.LOW);
+ }
+ }
+ //version
+ String version = pom.getVersion();
+ String parentVersion = null;
+ if (pom.getParent() != null) {
+ parentVersion = pom.getParent().getVersion();
+ if ((version == null || version.isEmpty()) && parentVersion != null && !parentVersion.isEmpty()) {
+ version = parentVersion;
+ }
+ }
+ if (version != null && !version.isEmpty()) {
+ dependency.getVersionEvidence().addEvidence("pom", "version", version, Confidence.HIGHEST);
+ if (parentVersion != null && !parentVersion.isEmpty() && !parentVersion.equals(version)) {
+ dependency.getVersionEvidence().addEvidence("pom", "parent-version", version, Confidence.LOW);
+ }
+ }
+
+ final Organization org = pom.getOrganization();
+ if (org != null) {
+ final String orgName = org.getName();
+ if (orgName != null && !orgName.isEmpty()) {
+ dependency.getVendorEvidence().addEvidence("pom", "organization name", orgName, Confidence.HIGH);
+ }
+ }
+ final String pomName = pom.getName();
+ if (pomName != null && !pomName.isEmpty()) {
+ dependency.getProductEvidence().addEvidence("pom", "name", pomName, Confidence.HIGH);
+ dependency.getVendorEvidence().addEvidence("pom", "name", pomName, Confidence.HIGH);
+ }
+
+ if (pom.getDescription() != null) {
+ final String description = pom.getDescription();
+ if (description != null && !description.isEmpty()) {
+ JarAnalyzer.addDescription(dependency, description, "pom", "description");
+ }
+ }
+ JarAnalyzer.extractLicense(pom, null, dependency);
+ }
+}
diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/ObjectFactory.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/ObjectFactory.java
index e315aee91..e190ad93b 100644
--- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/ObjectFactory.java
+++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/jaxb/pom/generated/ObjectFactory.java
@@ -31,7 +31,7 @@ import javax.xml.namespace.QName;
@XmlRegistry
public class ObjectFactory {
- private final static QName _Project_QNAME = new QName("http://maven.apache.org/POM/4.0.0", "project");
+ private static final QName _Project_QNAME = new QName("http://maven.apache.org/POM/4.0.0", "project");
/**
* Create a new ObjectFactory that can be used to create new instances of schema derived classes for package: org.owasp.dependencycheck.analyzer.pom.generated
diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/reporting/ReportGenerator.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/reporting/ReportGenerator.java
index d437ebd1f..e2322b7df 100644
--- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/reporting/ReportGenerator.java
+++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/reporting/ReportGenerator.java
@@ -113,7 +113,7 @@ public class ReportGenerator {
context.put("scanDate", scanDate);
context.put("scanDateXML", scanDateXML);
context.put("enc", enc);
- context.put("version", Settings.getString("application.version", "Unknown"));
+ context.put("version", Settings.getString(Settings.KEYS.APPLICATION_VERSION, "Unknown"));
}
/**
@@ -137,6 +137,26 @@ public class ReportGenerator {
return new VelocityContext();
}
+ /**
+ * Generates the Dependency Reports for the identified dependencies.
+ *
+ * @param outputStream the OutputStream to send the generated report to
+ * @param format the format the report should be written in
+ * @throws IOException is thrown when the template file does not exist
+ * @throws Exception is thrown if there is an error writing out the reports.
+ */
+ public void generateReports(OutputStream outputStream, Format format) throws IOException, Exception {
+ if (format == Format.XML || format == Format.ALL) {
+ generateReport("XmlReport", outputStream);
+ }
+ if (format == Format.HTML || format == Format.ALL) {
+ generateReport("HtmlReport", outputStream);
+ }
+ if (format == Format.VULN || format == Format.ALL) {
+ generateReport("VulnerabilityReport", outputStream);
+ }
+ }
+
/**
* Generates the Dependency Reports for the identified dependencies.
*
@@ -167,15 +187,28 @@ public class ReportGenerator {
*/
public void generateReports(String outputDir, String outputFormat) throws IOException, Exception {
final String format = outputFormat.toUpperCase();
+ final String pathToCheck = outputDir.toLowerCase();
if (format.matches("^(XML|HTML|VULN|ALL)$")) {
if ("XML".equalsIgnoreCase(format)) {
- generateReports(outputDir, Format.XML);
+ if (pathToCheck.endsWith(".xml")) {
+ generateReport("XmlReport", outputDir);
+ } else {
+ generateReports(outputDir, Format.XML);
+ }
}
if ("HTML".equalsIgnoreCase(format)) {
- generateReports(outputDir, Format.HTML);
+ if (pathToCheck.endsWith(".html") || pathToCheck.endsWith(".htm")) {
+ generateReport("HtmlReport", outputDir);
+ } else {
+ generateReports(outputDir, Format.HTML);
+ }
}
if ("VULN".equalsIgnoreCase(format)) {
- generateReports(outputDir, Format.VULN);
+ if (pathToCheck.endsWith(".html") || pathToCheck.endsWith(".htm")) {
+ generateReport("VulnReport", outputDir);
+ } else {
+ generateReports(outputDir, Format.VULN);
+ }
}
if ("ALL".equalsIgnoreCase(format)) {
generateReports(outputDir, Format.ALL);
@@ -189,11 +222,11 @@ public class ReportGenerator {
* template file.
*
* @param templateName the name of the template to load.
- * @param outFileName the filename and path to write the report to.
+ * @param outputStream the OutputStream to write the report to.
* @throws IOException is thrown when the template file does not exist.
* @throws Exception is thrown when an exception occurs.
*/
- protected void generateReport(String templateName, String outFileName) throws IOException, Exception {
+ protected void generateReport(String templateName, OutputStream outputStream) throws IOException, Exception {
InputStream input = null;
String templatePath = null;
final File f = new File(templateName);
@@ -216,18 +249,8 @@ public class ReportGenerator {
final InputStreamReader reader = new InputStreamReader(input, "UTF-8");
OutputStreamWriter writer = null;
- OutputStream outputStream = null;
try {
- final File outDir = new File(outFileName).getParentFile();
- if (!outDir.exists()) {
- final boolean created = outDir.mkdirs();
- if (!created) {
- throw new Exception("Unable to create directory '" + outDir.getAbsolutePath() + "'.");
- }
- }
-
- outputStream = new FileOutputStream(outFileName);
writer = new OutputStreamWriter(outputStream, "UTF-8");
if (!engine.evaluate(context, writer, templatePath, reader)) {
@@ -256,4 +279,41 @@ public class ReportGenerator {
}
}
}
+
+ /**
+ * Generates a report from a given Velocity Template. The template name provided can be the name of a template
+ * contained in the jar file, such as 'XmlReport' or 'HtmlReport', or the template name can be the path to a
+ * template file.
+ *
+ * @param templateName the name of the template to load.
+ * @param outFileName the filename and path to write the report to.
+ * @throws IOException is thrown when the template file does not exist.
+ * @throws Exception is thrown when an exception occurs.
+ */
+ protected void generateReport(String templateName, String outFileName) throws Exception {
+ File outFile = new File(outFileName);
+ if (outFile.getParentFile() == null) {
+ outFile = new File(".", outFileName);
+ }
+ if (!outFile.getParentFile().exists()) {
+ final boolean created = outFile.getParentFile().mkdirs();
+ if (!created) {
+ throw new Exception("Unable to create directory '" + outFile.getParentFile().getAbsolutePath() + "'.");
+ }
+ }
+
+ OutputStream outputSteam = null;
+ try {
+ outputSteam = new FileOutputStream(outFile);
+ generateReport(templateName, outputSteam);
+ } finally {
+ if (outputSteam != null) {
+ try {
+ outputSteam.close();
+ } catch (IOException ex) {
+ LOGGER.log(Level.FINEST, "ignore", ex);
+ }
+ }
+ }
+ }
}
diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/suppression/SuppressionRule.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/suppression/SuppressionRule.java
index 1254d5ea5..7d75a79c3 100644
--- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/suppression/SuppressionRule.java
+++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/suppression/SuppressionRule.java
@@ -112,7 +112,7 @@ public class SuppressionRule {
* @return whether or not this suppression rule as CPE entries
*/
public boolean hasCpe() {
- return cpe.size() > 0;
+ return !cpe.isEmpty();
}
/**
* The list of cvssBelow scores.
@@ -152,7 +152,7 @@ public class SuppressionRule {
* @return whether or not this suppression rule has cvss suppressions
*/
public boolean hasCvssBelow() {
- return cvssBelow.size() > 0;
+ return !cvssBelow.isEmpty();
}
/**
* The list of cwe entries to suppress.
@@ -192,7 +192,7 @@ public class SuppressionRule {
* @return whether this suppression rule has CWE entries
*/
public boolean hasCwe() {
- return cwe.size() > 0;
+ return !cwe.isEmpty();
}
/**
* The list of cve entries to suppress.
@@ -232,7 +232,7 @@ public class SuppressionRule {
* @return whether this suppression rule has CVE entries
*/
public boolean hasCve() {
- return cve.size() > 0;
+ return !cve.isEmpty();
}
/**
* A Maven GAV to suppression.
@@ -266,10 +266,14 @@ public class SuppressionRule {
return gav != null;
}
+ /**
+ * A flag indicating whether or not the suppression rule is a core/base rule that should not be included in the
+ * resulting report in the "suppressed" section.
+ */
private boolean base;
/**
- * Get the value of base
+ * Get the value of base.
*
* @return the value of base
*/
@@ -278,7 +282,7 @@ public class SuppressionRule {
}
/**
- * Set the value of base
+ * Set the value of base.
*
* @param base new value of base
*/
@@ -446,28 +450,28 @@ public class SuppressionRule {
if (gav != null) {
sb.append("gav=").append(gav).append(",");
}
- if (cpe != null && cpe.size() > 0) {
+ if (cpe != null && !cpe.isEmpty()) {
sb.append("cpe={");
for (PropertyType pt : cpe) {
sb.append(pt).append(",");
}
sb.append("}");
}
- if (cwe != null && cwe.size() > 0) {
+ if (cwe != null && !cwe.isEmpty()) {
sb.append("cwe={");
for (String s : cwe) {
sb.append(s).append(",");
}
sb.append("}");
}
- if (cve != null && cve.size() > 0) {
+ if (cve != null && !cve.isEmpty()) {
sb.append("cve={");
for (String s : cve) {
sb.append(s).append(",");
}
sb.append("}");
}
- if (cvssBelow != null && cvssBelow.size() > 0) {
+ if (cvssBelow != null && !cvssBelow.isEmpty()) {
sb.append("cvssBelow={");
for (Float s : cvssBelow) {
sb.append(s).append(",");
diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/utils/DBUtils.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/utils/DBUtils.java
index 819e7a798..4ee930733 100644
--- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/utils/DBUtils.java
+++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/utils/DBUtils.java
@@ -54,7 +54,9 @@ public final class DBUtils {
int id = 0;
try {
rs = statement.getGeneratedKeys();
- rs.next();
+ if (!rs.next()) {
+ throw new DatabaseException("Unable to get primary key for inserted row");
+ }
id = rs.getInt(1);
} catch (SQLException ex) {
throw new DatabaseException("Unable to get primary key for inserted row");
diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/utils/DateUtil.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/utils/DateUtil.java
new file mode 100644
index 000000000..9ededbab5
--- /dev/null
+++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/utils/DateUtil.java
@@ -0,0 +1,46 @@
+/*
+ * This file is part of dependency-check-core.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * Copyright (c) 2014 Jeremy Long. All Rights Reserved.
+ */
+package org.owasp.dependencycheck.utils;
+
+/**
+ *
+ * @author Jeremy Long
+ */
+public final class DateUtil {
+
+ /**
+ * Private constructor for utility class.
+ */
+ private DateUtil() {
+ }
+
+ /**
+ * Determines if the epoch date is within the range specified of the compareTo epoch time. This takes the
+ * (compareTo-date)/1000/60/60/24 to get the number of days. If the calculated days is less then the range the date
+ * is considered valid.
+ *
+ * @param date the date to be checked.
+ * @param compareTo the date to compare to.
+ * @param range the range in days to be considered valid.
+ * @return whether or not the date is within the range.
+ */
+ public static boolean withinDateRange(long date, long compareTo, int range) {
+ final double differenceInDays = (compareTo - date) / 1000.0 / 60.0 / 60.0 / 24.0;
+ return differenceInDays < range;
+ }
+}
diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/utils/DependencyVersion.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/utils/DependencyVersion.java
index b0ba88311..1201c7ca0 100644
--- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/utils/DependencyVersion.java
+++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/utils/DependencyVersion.java
@@ -65,7 +65,7 @@ public class DependencyVersion implements Iterable, Comparable();
if (version != null) {
- final Pattern rx = Pattern.compile("(\\d+|[a-z]+\\d+|(release|beta|alpha)$)");
+ final Pattern rx = Pattern.compile("(\\d+[a-z]{1,3}$|[a-z]+\\d+|\\d+|(release|beta|alpha)$)");
final Matcher matcher = rx.matcher(version.toLowerCase());
while (matcher.find()) {
versionParts.add(matcher.group());
@@ -198,8 +198,8 @@ public class DependencyVersion implements Iterable, Comparable= 3) {
if (thisVersion.compareToIgnoreCase(otherVersion) >= 0) {
ret = false;
diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/utils/DependencyVersionUtil.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/utils/DependencyVersionUtil.java
index b67a5ac05..36991a93c 100644
--- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/utils/DependencyVersionUtil.java
+++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/utils/DependencyVersionUtil.java
@@ -18,6 +18,7 @@
package org.owasp.dependencycheck.utils;
import java.util.ArrayList;
+import java.util.List;
import java.util.regex.Matcher;
import java.util.regex.Pattern;
@@ -32,7 +33,7 @@ public final class DependencyVersionUtil {
/**
* Regular expression to extract version numbers from file names.
*/
- private static final Pattern RX_VERSION = Pattern.compile("\\d+(\\.\\d{1,6})+(\\.?([_-](release|beta|alpha)|[a-zA-Z_-]{1,3}\\d{1,8}))?");
+ private static final Pattern RX_VERSION = Pattern.compile("\\d+(\\.\\d{1,6})+(\\.?([_-](release|beta|alpha|\\d+)|[a-zA-Z_-]{1,3}\\d{0,8}))?");
/**
* Regular expression to extract a single version number without periods. This is a last ditch effort just to check
* in case we are missing a version number using the previous regex.
@@ -62,7 +63,7 @@ public final class DependencyVersionUtil {
//'-' is a special case used within the CVE entries, just include it as the version.
if ("-".equals(text)) {
final DependencyVersion dv = new DependencyVersion();
- final ArrayList list = new ArrayList();
+ final List list = new ArrayList();
list.add(text);
dv.setVersionParts(list);
return dv;
diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/utils/ExtractionUtil.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/utils/ExtractionUtil.java
index 3f0ae2b03..154e305aa 100644
--- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/utils/ExtractionUtil.java
+++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/utils/ExtractionUtil.java
@@ -107,7 +107,7 @@ public final class ExtractionUtil {
fos = new FileOutputStream(file);
bos = new BufferedOutputStream(fos, BUFFER_SIZE);
int count;
- final byte data[] = new byte[BUFFER_SIZE];
+ final byte[] data = new byte[BUFFER_SIZE];
while ((count = zis.read(data, 0, BUFFER_SIZE)) != -1) {
bos.write(data, 0, count);
}
diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/utils/UrlStringUtils.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/utils/UrlStringUtils.java
index bdec9b3e5..92f7ee71e 100644
--- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/utils/UrlStringUtils.java
+++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/utils/UrlStringUtils.java
@@ -23,6 +23,7 @@ import java.util.ArrayList;
import java.util.Arrays;
import java.util.HashSet;
import java.util.List;
+import java.util.Set;
import java.util.regex.Pattern;
/**
@@ -68,7 +69,7 @@ public final class UrlStringUtils {
/**
* A listing of domain parts that should not be used as evidence. Yes, this is an incomplete list.
*/
- private static final HashSet IGNORE_LIST = new HashSet(
+ private static final Set IGNORE_LIST = new HashSet(
Arrays.asList("www", "com", "org", "gov", "info", "name", "net", "pro", "tel", "mobi", "xxx"));
/**
@@ -86,7 +87,7 @@ public final class UrlStringUtils {
* @throws MalformedURLException thrown if the URL is malformed
*/
public static List extractImportantUrlData(String text) throws MalformedURLException {
- final ArrayList importantParts = new ArrayList();
+ final List importantParts = new ArrayList();
final URL url = new URL(text);
final String[] domain = url.getHost().split("\\.");
//add the domain except www and the tld.
diff --git a/dependency-check-core/src/main/resources/META-INF/services/org.owasp.dependencycheck.analyzer.Analyzer b/dependency-check-core/src/main/resources/META-INF/services/org.owasp.dependencycheck.analyzer.Analyzer
index d752f4294..f2c4509c0 100644
--- a/dependency-check-core/src/main/resources/META-INF/services/org.owasp.dependencycheck.analyzer.Analyzer
+++ b/dependency-check-core/src/main/resources/META-INF/services/org.owasp.dependencycheck.analyzer.Analyzer
@@ -8,6 +8,7 @@ org.owasp.dependencycheck.analyzer.CpeSuppressionAnalyzer
org.owasp.dependencycheck.analyzer.DependencyBundlingAnalyzer
org.owasp.dependencycheck.analyzer.NvdCveAnalyzer
org.owasp.dependencycheck.analyzer.VulnerabilitySuppressionAnalyzer
+org.owasp.dependencycheck.analyzer.CentralAnalyzer
org.owasp.dependencycheck.analyzer.NexusAnalyzer
org.owasp.dependencycheck.analyzer.NuspecAnalyzer
org.owasp.dependencycheck.analyzer.AssemblyAnalyzer
\ No newline at end of file
diff --git a/dependency-check-core/src/main/resources/META-INF/services/org.owasp.dependencycheck.data.update.CachedWebDataSource b/dependency-check-core/src/main/resources/META-INF/services/org.owasp.dependencycheck.data.update.CachedWebDataSource
index 4407069b5..73ca93754 100644
--- a/dependency-check-core/src/main/resources/META-INF/services/org.owasp.dependencycheck.data.update.CachedWebDataSource
+++ b/dependency-check-core/src/main/resources/META-INF/services/org.owasp.dependencycheck.data.update.CachedWebDataSource
@@ -1 +1,2 @@
-org.owasp.dependencycheck.data.update.NvdCveUpdater
\ No newline at end of file
+org.owasp.dependencycheck.data.update.NvdCveUpdater
+org.owasp.dependencycheck.data.update.EngineVersionCheck
\ No newline at end of file
diff --git a/dependency-check-core/src/main/resources/dependencycheck-base-suppression.xml b/dependency-check-core/src/main/resources/dependencycheck-base-suppression.xml
index 0b1518d1d..6b117e543 100644
--- a/dependency-check-core/src/main/resources/dependencycheck-base-suppression.xml
+++ b/dependency-check-core/src/main/resources/dependencycheck-base-suppression.xml
@@ -9,6 +9,15 @@
cpe:/a:springsource:spring_framework
cpe:/a:vmware:springsource_spring_framework
+
+
+ .*spring-security-[^\\/]*\.jar$
+ cpe:/a:mod_security:mod_security
+ cpe:/a:springsource:spring_framework
+ cpe:/a:vmware:springsource_spring_framework
+
- org\.glassfish\.jersey\.core:jersey-(client|common):.*
+ (com\.sun\.jersey|org\.glassfish\.jersey\.core):jersey-(client|common):.*
+ cpe:/a:oracle:glassfish
+ cpe:/a:oracle:oracle_client
+
+
+
+ org\.glassfish\.grizzly:grizzly-framework:.*
cpe:/a:oracle:glassfish
+
+
+ org\.forgerock\.opendj:opendj-ldap-sdk:.*
+ cpe:/a:ldap_project:ldap
+
+
+
+ org\.opensaml:xmltooling:.*
+ cpe:/a:shibboleth:opensaml
+
+
+
+ org\.opensaml:openws:.*
+ cpe:/a:internet2:opensaml
+
+
+
+ org\.opensaml:xmltooling:.*
+ cpe:/a:internet2:opensaml
+
+
\ No newline at end of file
diff --git a/dependency-check-core/src/main/resources/dependencycheck.properties b/dependency-check-core/src/main/resources/dependencycheck.properties
index 0090e0c50..6a737631c 100644
--- a/dependency-check-core/src/main/resources/dependencycheck.properties
+++ b/dependency-check-core/src/main/resources/dependencycheck.properties
@@ -3,6 +3,9 @@ application.version=${pom.version}
autoupdate=true
max.download.threads=3
+# the url to obtain the current engine version from
+engine.version.url=http://jeremylong.github.io/DependencyCheck/current.txt
+
#temp.directory defaults to System.getProperty("java.io.tmpdir")
#temp.directory=[path to temp directory]
@@ -40,11 +43,16 @@ data.driver_path=
cve.url.modified.validfordays=7
# the path to the modified nvd cve xml file.
-cve.url-1.2.modified=http://nvd.nist.gov/download/nvdcve-modified.xml
-cve.url-2.0.modified=http://static.nvd.nist.gov/feeds/xml/cve/nvdcve-2.0-modified.xml
+cve.url-1.2.modified=https://nvd.nist.gov/download/nvdcve-Modified.xml.gz
+#cve.url-1.2.modified=http://nvd.nist.gov/download/nvdcve-modified.xml
+cve.url-2.0.modified=https://nvd.nist.gov/feeds/xml/cve/nvdcve-2.0-Modified.xml.gz
+#cve.url-2.0.modified=http://static.nvd.nist.gov/feeds/xml/cve/nvdcve-2.0-modified.xml
cve.startyear=2002
-cve.url-2.0.base=http://static.nvd.nist.gov/feeds/xml/cve/nvdcve-2.0-%d.xml
-cve.url-1.2.base=http://nvd.nist.gov/download/nvdcve-%d.xml
+cve.url-1.2.base=https://nvd.nist.gov/download/nvdcve-%d.xml.gz
+#cve.url-1.2.base=http://nvd.nist.gov/download/nvdcve-%d.xml
+cve.url-2.0.base=https://nvd.nist.gov/feeds/xml/cve/nvdcve-2.0-%d.xml.gz
+#cve.url-2.0.base=http://static.nvd.nist.gov/feeds/xml/cve/nvdcve-2.0-%d.xml
+
# file type analyzer settings:
analyzer.archive.enabled=true
@@ -58,3 +66,7 @@ analyzer.nexus.url=https://repository.sonatype.org/service/local/
# If set to true, the proxy will still ONLY be used if the proxy properties (proxy.url, proxy.port)
# are configured
analyzer.nexus.proxy=true
+
+# the URL for searching search.maven.org for SHA-1 and whether it's enabled
+analyzer.central.enabled=true
+analyzer.central.url=http://search.maven.org/solrsearch/select
diff --git a/dependency-check-core/src/main/resources/templates/HtmlReport.vsl b/dependency-check-core/src/main/resources/templates/HtmlReport.vsl
index 6c6d88120..bf948426c 100644
--- a/dependency-check-core/src/main/resources/templates/HtmlReport.vsl
+++ b/dependency-check-core/src/main/resources/templates/HtmlReport.vsl
@@ -534,7 +534,7 @@ arising out of or in connection with the use of this tool, the analysis performe
$enc.html($prop.key): $enc.html($prop.value)
#end
- Display: Showing Vulnerable Dependencies
+ Display: Showing Vulnerable Dependencies (click to show all)
#set($lnkcnt=0)
@@ -606,22 +606,6 @@ arising out of or in connection with the use of this tool, the analysis performe
#end
-##
-## #set($lnkcnt=0)
-## #foreach($dependency in $dependencies)
-## #set($lnkcnt=$lnkcnt+1)
-## -
-## $enc.html($dependency.DisplayFileName)
-## #if($dependency.getRelatedDependencies().size()>0)
-##
-## #foreach($related in $dependency.getRelatedDependencies())
-## - $enc.html($related.DisplayFileName)
-## #end
-##
-## #end
-##
-## #end
-##
Dependencies
#set($lnkcnt=0)
#set($cnt=0)
@@ -644,6 +628,19 @@ arising out of or in connection with the use of this tool, the analysis performe
File Path: $enc.html($dependency.FilePath)
MD5: $enc.html($dependency.Md5sum)
SHA1: $enc.html($dependency.Sha1sum)
+ #if ($dependency.projectReferences.size()==1)
+
Referenced In Project:
+ #foreach($ref in $dependency.projectReferences)
+ $enc.html($ref)
+ #end
+ #end
+ #if ($dependency.projectReferences.size()>1)
+
Referenced In Projects:
+ #foreach($ref in $dependency.projectReferences)
+ - $enc.html($ref)
+ #end
+
+ #end
#set($cnt=$cnt+1)
Evidence
@@ -906,6 +903,6 @@ arising out of or in connection with the use of this tool, the analysis performe
## END SUPPRESSED VULNERABILITIES
-
+