From 0edf017ddcc0c40977c4076a168049d1548f8d75 Mon Sep 17 00:00:00 2001 From: Jeremy Long Date: Sat, 3 May 2014 08:52:45 -0400 Subject: [PATCH] patched for issue #120 - duplicate evidence listed in reports Former-commit-id: 3cdc1854af586029911b70fb4b8ff54669bac022 --- .../dependency/Dependency.java | 9 ++ .../dependencycheck/dependency/Evidence.java | 89 +++++++++++++++++-- .../dependency/EvidenceCollection.java | 20 +++++ .../main/resources/templates/HtmlReport.vsl | 4 +- .../main/resources/templates/XmlReport.vsl | 2 +- .../maven/DependencyCheckMojo.java | 5 +- 6 files changed, 116 insertions(+), 13 deletions(-) diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/dependency/Dependency.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/dependency/Dependency.java index 48ddf25fe..18965edc5 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/dependency/Dependency.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/dependency/Dependency.java @@ -369,6 +369,15 @@ public class Dependency implements Comparable { return EvidenceCollection.merge(this.productEvidence, this.vendorEvidence, this.versionEvidence); } + /** + * Returns the evidence used to identify this dependency. + * + * @return an EvidenceCollection. + */ + public Set getEvidenceForDisplay() { + return EvidenceCollection.mergeForDisplay(this.productEvidence, this.vendorEvidence, this.versionEvidence); + } + /** * Returns the evidence used to identify this dependency. * diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/dependency/Evidence.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/dependency/Evidence.java index 88fc18e72..6b8ad8bd6 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/dependency/Evidence.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/dependency/Evidence.java @@ -220,22 +220,95 @@ public class Evidence implements Comparable { * @return an integer indicating the ordering of the two objects */ public int compareTo(Evidence o) { - if (source.equals(o.source)) { - if (name.equals(o.name)) { - if (value.equals(o.value)) { - if (confidence.equals(o.confidence)) { + if (o == null) { + return 1; + } + if (equalsWithNullCheck(source, o.source)) { + if (equalsWithNullCheck(name, o.name)) { + if (equalsWithNullCheck(value, o.value)) { + if (equalsWithNullCheck(confidence, o.confidence)) { return 0; //they are equal } else { - return confidence.compareTo(o.confidence); + return compareToWithNullCheck(confidence, o.confidence); } } else { - return value.compareToIgnoreCase(o.value); + return compareToIgnoreCaseWithNullCheck(value, o.value); } } else { - return name.compareToIgnoreCase(o.name); + return compareToIgnoreCaseWithNullCheck(name, o.name); } } else { - return source.compareToIgnoreCase(o.source); + return compareToIgnoreCaseWithNullCheck(source, o.source); } } + + /** + * Equality check with an exhaustive, possibly duplicative, check against nulls. + * + * @param me the value to be compared + * @param other the other value to be compared + * @return true if the values are equal; otherwise false + */ + private boolean equalsWithNullCheck(String me, String other) { + if (me == null && other == null) { + return true; + } else if (me == null || other == null) { + return false; + } + return me.equals(other); + } + + /** + * Equality check with an exhaustive, possibly duplicative, check against nulls. + * + * @param me the value to be compared + * @param other the other value to be compared + * @return true if the values are equal; otherwise false + */ + private boolean equalsWithNullCheck(Confidence me, Confidence other) { + if (me == null && other == null) { + return true; + } else if (me == null || other == null) { + return false; + } + return me.equals(other); + } + + /** + * Wrapper around {@link java.lang.String#compareToIgnoreCase(java.lang.String) String.compareToIgnoreCase} with an + * exhaustive, possibly duplicative, check against nulls. + * + * @param me the value to be compared + * @param other the other value to be compared + * @return true if the values are equal; otherwise false + */ + private int compareToIgnoreCaseWithNullCheck(String me, String other) { + if (me == null && other == null) { + return 0; + } else if (me == null) { + return -1; //the other string is greater then me + } else if (other == null) { + return 1; //me is greater then the other string + } + return me.compareToIgnoreCase(other); + } + + /** + * Wrapper around {@link java.lang.Enum#compareTo(java.lang.Enum) Enum.compareTo} with an exhaustive, possibly + * duplicative, check against nulls. + * + * @param me the value to be compared + * @param other the other value to be compared + * @return true if the values are equal; otherwise false + */ + private int compareToWithNullCheck(Confidence me, Confidence other) { + if (me == null && other == null) { + return 0; + } else if (me == null) { + return -1; //the other string is greater then me + } else if (other == null) { + return 1; //me is greater then the other string + } + return me.compareTo(other); + } } diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/dependency/EvidenceCollection.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/dependency/EvidenceCollection.java index 3908665e5..141370ab1 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/dependency/EvidenceCollection.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/dependency/EvidenceCollection.java @@ -311,6 +311,26 @@ public class EvidenceCollection implements Iterable { return ret; } + /** + * Merges multiple EvidenceCollections together; flattening all of the evidence items by removing the confidence. + * + * @param ec One or more EvidenceCollections + * @return new set of evidence resulting from merging the evidence in the collections + */ + public static Set mergeForDisplay(EvidenceCollection... ec) { + final Set ret = new TreeSet(); + for (EvidenceCollection col : ec) { + for (Evidence e : col) { + if (e.isUsed()) { + final Evidence newEvidence = new Evidence(e.getSource(), e.getName(), e.getValue(), null); + newEvidence.setUsed(true); + ret.add(newEvidence); + } + } + } + return ret; + } + /** * Returns a string of evidence 'values'. * diff --git a/dependency-check-core/src/main/resources/templates/HtmlReport.vsl b/dependency-check-core/src/main/resources/templates/HtmlReport.vsl index a4cbc305b..9a47dd6ac 100644 --- a/dependency-check-core/src/main/resources/templates/HtmlReport.vsl +++ b/dependency-check-core/src/main/resources/templates/HtmlReport.vsl @@ -571,7 +571,7 @@ arising out of or in connection with the use of this tool, the analysis performe