- * Simple object to track the parts of a version number. The parts are contained in a List such that version 1.2.3 will
- * be stored as: versionParts[0] = 1;
+ * Simple object to track the parts of a version number. The parts are contained
+ * in a List such that version 1.2.3 will be stored as: versionParts[0] = 1;
* versionParts[1] = 2;
* versionParts[2] = 3;
*
*
- * Note, the parser contained in this class expects the version numbers to be separated by periods. If a different
- * separator is used the parser will likely fail.
+ * Note, the parser contained in this class expects the version numbers to be
+ * separated by periods. If a different separator is used the parser will likely
+ * fail.
*
* @author Jeremy Long
*/
@@ -47,8 +48,9 @@ public class DependencyVersion implements Iterable, ComparableNote, this should only be used when the version passed in is already known to be a well formatted version
- * number. Otherwise, DependencyVersionUtil.parseVersion() should be used instead.
+ * Note, this should only be used when the version passed in is
+ * already known to be a well formatted version number. Otherwise,
+ * DependencyVersionUtil.parseVersion() should be used instead.
*
* @param version the well formatted version number to parse
*/
@@ -57,8 +59,9 @@ public class DependencyVersion implements Iterable, ComparableNote, this should only be
- * used to parse something that is already known to be a version number.
+ * Parses a version string into its sub parts: major, minor, revision,
+ * build, etc. Note, this should only be used to parse something that
+ * is already known to be a version number.
*
* @param version the version string to parse
*/
@@ -133,26 +136,33 @@ public class DependencyVersion implements Iterable, Comparable other.versionParts.size())
+ ? this.versionParts.size() : other.versionParts.size();
+
+ if (minVersionMatchLength==1 && maxVersionMatchLength>=3) {
+ return false;
+ }
+
//TODO steal better version of code from compareTo
- for (int i = 0; i < max; i++) {
+ for (int i = 0; i < minVersionMatchLength; i++) {
final String thisPart = this.versionParts.get(i);
final String otherPart = other.versionParts.get(i);
if (!thisPart.equals(otherPart)) {
return false;
}
}
- if (this.versionParts.size() > max) {
- for (int i = max; i < this.versionParts.size(); i++) {
+ if (this.versionParts.size() > minVersionMatchLength) {
+ for (int i = minVersionMatchLength; i < this.versionParts.size(); i++) {
if (!"0".equals(this.versionParts.get(i))) {
return false;
}
}
}
- if (other.versionParts.size() > max) {
- for (int i = max; i < other.versionParts.size(); i++) {
+ if (other.versionParts.size() > minVersionMatchLength) {
+ for (int i = minVersionMatchLength; i < other.versionParts.size(); i++) {
if (!"0".equals(other.versionParts.get(i))) {
return false;
}
@@ -180,8 +190,9 @@ public class DependencyVersion implements Iterable, Comparablecom\.offbytwo\.jenkins:jenkins-client:.*
cpe:/a:jenkins:jenkins
+
+
+ ^(?!com.thoughtworks).*xstream.*$
+ cpe:/a:x-stream:xstream
+
diff --git a/dependency-check-core/src/main/resources/templates/HtmlReport.vsl b/dependency-check-core/src/main/resources/templates/HtmlReport.vsl
index 332377d10..4bdc1ffba 100644
--- a/dependency-check-core/src/main/resources/templates/HtmlReport.vsl
+++ b/dependency-check-core/src/main/resources/templates/HtmlReport.vsl
@@ -83,16 +83,50 @@ Copyright (c) 2012 Jeremy Long. All Rights Reserved.
xml += $("#modal-text").text().replace(/\n/g,'\n ');
xml += '\n';
$('#modal-text').text(xml).focus().select();
+ $('#modal-add-header').toggleClass('active');
});
});
- function copyText(name, sha1, type, val) {
+ function suppressSwitchTo(switchTo) {
+ $('#modal-suppress-change-to-sha1').toggleClass('active');
+ $('#modal-suppress-change-to-gav').toggleClass('active');
+ setCopyText($('#suppress-name').val(),
+ switchTo,
+ $('#suppress-'+switchTo).val(),
+ $('#suppress-type').val(),
+ $('#suppress-val').val());
+ }
+ function copyText(name, sha1, gav, type, val) {
+ $('#suppress-name').val(name);
+ $('#suppress-type').val(type);
+ $('#suppress-val').val(val);
+ $('#suppress-sha1').val(sha1);
+ $('#suppress-gav').val(gav);
+ if (gav=='') {
+ if ($('#modal-suppress-change-to-gav').hasClass('active')) {
+ $('#modal-suppress-change-to-gav').toggleClass('active');
+ }
+ if ($('#modal-suppress-change-to-sha1').hasClass('active')) {
+ $('#modal-suppress-change-to-sha1').toggleClass('active');
+ }
+ setCopyText(name, 'sha1', sha1, type, val);
+ } else {
+ if ($('#modal-suppress-change-to-gav').hasClass('active')) {
+ $('#modal-suppress-change-to-gav').toggleClass('active');
+ }
+ if (!$('#modal-suppress-change-to-sha1').hasClass('active')) {
+ $('#modal-suppress-change-to-sha1').toggleClass('active');
+ }
+ setCopyText(name, 'gav', gav, type, val);
+ }
+ }
+ function setCopyText(name, matchType, matchValue, suppressType, suppressVal) {
xml = '\n';
xml += ' \n';
- xml += ' ' + sha1 + '\n';
- xml += ' <'+type+'>' + val + '\n';
+ xml += ' <'+matchType+'>' + matchValue + '\n';
+ xml += ' <'+suppressType+'>' + suppressVal + '\n';
xml += '';
$('#modal-text').text(xml);
- $('#modal-content,#modal-background').toggleClass('active');
+ $('#modal-content,#modal-background').addClass('active');
$('#modal-text').focus();
$('#modal-text').select();
}
@@ -150,6 +184,12 @@ Copyright (c) 2012 Jeremy Long. All Rights Reserved.
#modal-text:focus {
outline: none;
}
+ .suppresstype {
+ display: none;
+ }
+ .suppresstype.active {
+ display: block;
+ }
.suppressedLabel {
cursor: default;
padding:1px;
@@ -504,6 +544,11 @@ Copyright (c) 2012 Jeremy Long. All Rights Reserved.
@@ -515,6 +560,10 @@ the reporting provided constitutes acceptance for use in an AS IS condition, and
implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided
is at the user’s risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever
arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.
+
@@ -725,6 +774,12 @@ arising out of or in connection with the use of this tool, the analysis performe
None
#else ## ($dependency.getIdentifiers().size()>0)
+ #set($suppressGav='')
+ #foreach($id in $dependency.getIdentifiers())
+ #if ($id.type=="maven")
+ #set($suppressGav=$id.value)
+ #end
+ #end
#foreach($id in $dependency.getIdentifiers())
#if( $id.url )
##yes, we are HTML Encoding the href. this is okay. We can't URL encode as we have to trust the analyzer here...
@@ -737,7 +792,7 @@ arising out of or in connection with the use of this tool, the analysis performe
#end
#if ($id.type=="cpe")
##yes, we are HTML Encoding into JavaScript... the escape utils don't have a JS Encode and I haven't written one yet
-
+
#end
#if ($id.description)
$enc.html($id.description)
@@ -753,7 +808,7 @@ arising out of or in connection with the use of this tool, the analysis performe
#foreach($vuln in $dependency.getVulnerabilities())
#set($vsctr=$vsctr+1)
-