From 176d3ddefa4ab501c8abb30fa5016333f69df72b Mon Sep 17 00:00:00 2001 From: Jeremy Long Date: Sun, 4 Sep 2016 19:09:08 -0400 Subject: [PATCH] temporary fix for issue #534 --- .../analyzer/HintAnalyzer.java | 3 + .../xml/hints/HintHandler.java | 39 +++- .../dependencycheck/xml/hints/HintParser.java | 2 +- .../dependencycheck/xml/hints/HintRule.java | 35 +++- .../resources/dependencycheck-base-hint.xml | 191 +++++++++++------- .../resources/schema/dependency-hint.1.1.xsd | 82 ++++++++ .../xml/hints/HintHandlerTest.java | 2 +- .../src/test/resources/hints.xml | 2 +- pom.xml | 2 +- 9 files changed, 265 insertions(+), 93 deletions(-) create mode 100644 dependency-check-core/src/main/resources/schema/dependency-hint.1.1.xsd diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/HintAnalyzer.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/HintAnalyzer.java index 506896dfa..beddaf39f 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/HintAnalyzer.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/HintAnalyzer.java @@ -154,6 +154,9 @@ public class HintAnalyzer extends AbstractAnalyzer implements Analyzer { for (Evidence e : hint.getAddProduct()) { dependency.getProductEvidence().addEvidence(e); } + for (Evidence e : hint.getAddVersion()) { + dependency.getVersionEvidence().addEvidence(e); + } } } diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/xml/hints/HintHandler.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/xml/hints/HintHandler.java index 9634fb3d2..0608f5fa1 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/xml/hints/HintHandler.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/xml/hints/HintHandler.java @@ -62,9 +62,17 @@ public class HintHandler extends DefaultHandler { */ private static final String DUPLICATE = "duplicate"; /** - * Attribute name. + * Attribute value. */ private static final String VENDOR = "vendor"; + /** + * Attribute value. + */ + private static final String PRODUCT = "product"; + /** + * Attribute value. + */ + private static final String VERSION = "version"; /** * Attribute name. */ @@ -168,16 +176,25 @@ public class HintHandler extends DefaultHandler { attr.getValue(VALUE), Confidence.valueOf(attr.getValue(CONFIDENCE))); } - } else if (inAddNode) { - rule.addAddProduct(attr.getValue(SOURCE), - attr.getValue(NAME), - attr.getValue(VALUE), - Confidence.valueOf(attr.getValue(CONFIDENCE))); - } else { - rule.addGivenProduct(attr.getValue(SOURCE), - attr.getValue(NAME), - attr.getValue(VALUE), - Confidence.valueOf(attr.getValue(CONFIDENCE))); + } else if (PRODUCT.equals(hintType)) { + if (inAddNode) { + rule.addAddProduct(attr.getValue(SOURCE), + attr.getValue(NAME), + attr.getValue(VALUE), + Confidence.valueOf(attr.getValue(CONFIDENCE))); + } else { + rule.addGivenProduct(attr.getValue(SOURCE), + attr.getValue(NAME), + attr.getValue(VALUE), + Confidence.valueOf(attr.getValue(CONFIDENCE))); + } + } else if (VERSION.equals(hintType)) { + if (inAddNode) { + rule.addAddVersion(attr.getValue(SOURCE), + attr.getValue(NAME), + attr.getValue(VALUE), + Confidence.valueOf(attr.getValue(CONFIDENCE))); + } } } else if (FILE_NAME.equals(qName)) { final PropertyType pt = new PropertyType(); diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/xml/hints/HintParser.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/xml/hints/HintParser.java index 7f5c3ae0a..96a35bdc9 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/xml/hints/HintParser.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/xml/hints/HintParser.java @@ -64,7 +64,7 @@ public class HintParser { /** * The schema for the hint XML files. */ - private static final String HINT_SCHEMA = "schema/dependency-hint.1.0.xsd"; + private static final String HINT_SCHEMA = "schema/dependency-hint.1.1.xsd"; /** * Parses the given XML file and returns a list of the hints contained. diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/xml/hints/HintRule.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/xml/hints/HintRule.java index 1d9df8d4d..7290ba26e 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/xml/hints/HintRule.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/xml/hints/HintRule.java @@ -85,6 +85,15 @@ public class HintRule { */ private final List givenVendor = new ArrayList(); + /** + * The list of product evidence to add. + */ + private final List addProduct = new ArrayList(); + /** + * The list of version evidence to add. + */ + private final List addVersion = new ArrayList(); + /** * Adds a given vendors to the list of evidence to matched. * @@ -106,11 +115,6 @@ public class HintRule { return givenVendor; } - /** - * The list of product evidence to add. - */ - private final List addProduct = new ArrayList(); - /** * Adds a given product to the list of evidence to add when matched. * @@ -132,6 +136,27 @@ public class HintRule { return addProduct; } + /** + * Adds a given version to the list of evidence to add when matched. + * + * @param source the source of the evidence + * @param name the name of the evidence + * @param value the value of the evidence + * @param confidence the confidence of the evidence + */ + public void addAddVersion(String source, String name, String value, Confidence confidence) { + addVersion.add(new Evidence(source, name, value, confidence)); + } + + /** + * Get the value of addVersion. + * + * @return the value of addVersion + */ + public List getAddVersion() { + return addVersion; + } + /** * The list of vendor hints to add. */ diff --git a/dependency-check-core/src/main/resources/dependencycheck-base-hint.xml b/dependency-check-core/src/main/resources/dependencycheck-base-hint.xml index 4e1d870a6..5d3dacdaa 100644 --- a/dependency-check-core/src/main/resources/dependencycheck-base-hint.xml +++ b/dependency-check-core/src/main/resources/dependencycheck-base-hint.xml @@ -1,75 +1,120 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/dependency-check-core/src/main/resources/schema/dependency-hint.1.1.xsd b/dependency-check-core/src/main/resources/schema/dependency-hint.1.1.xsd new file mode 100644 index 000000000..63390044a --- /dev/null +++ b/dependency-check-core/src/main/resources/schema/dependency-hint.1.1.xsd @@ -0,0 +1,82 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/dependency-check-core/src/test/java/org/owasp/dependencycheck/xml/hints/HintHandlerTest.java b/dependency-check-core/src/test/java/org/owasp/dependencycheck/xml/hints/HintHandlerTest.java index 0b055fb1d..2d06c3a69 100644 --- a/dependency-check-core/src/test/java/org/owasp/dependencycheck/xml/hints/HintHandlerTest.java +++ b/dependency-check-core/src/test/java/org/owasp/dependencycheck/xml/hints/HintHandlerTest.java @@ -52,7 +52,7 @@ public class HintHandlerTest extends BaseTest { @Test public void testHandler() throws ParserConfigurationException, SAXNotRecognizedException, SAXNotSupportedException, SAXException, FileNotFoundException, UnsupportedEncodingException, IOException { File file = BaseTest.getResourceAsFile(this, "hints.xml"); - File schema = BaseTest.getResourceAsFile(this, "schema/dependency-hint.1.0.xsd"); + File schema = BaseTest.getResourceAsFile(this, "schema/dependency-hint.1.1.xsd"); HintHandler handler = new HintHandler(); SAXParserFactory factory = SAXParserFactory.newInstance(); diff --git a/dependency-check-core/src/test/resources/hints.xml b/dependency-check-core/src/test/resources/hints.xml index 000028414..bf739a083 100644 --- a/dependency-check-core/src/test/resources/hints.xml +++ b/dependency-check-core/src/test/resources/hints.xml @@ -1,5 +1,5 @@ - + diff --git a/pom.xml b/pom.xml index dc275a75d..9a774c09f 100644 --- a/pom.xml +++ b/pom.xml @@ -360,7 +360,7 @@ Copyright (c) 2012 - Jeremy Long - +