true if an identifier was added to the dependency; otherwise false
* @throws UnsupportedEncodingException is thrown if UTF-8 is not supported
*/
- private boolean determineIdentifiers(Dependency dependency, String vendor, String product, Confidence currentConfidence) throws UnsupportedEncodingException {
+ protected boolean determineIdentifiers(Dependency dependency, String vendor, String product,
+ Confidence currentConfidence) throws UnsupportedEncodingException {
final Settrue if the leftPath is the shortest; otherwise false
+ */
+ protected boolean firstPathIsShortest(String left, String right) {
+ final String leftPath = left.replace('\\', '/');
+ final String rightPath = right.replace('\\', '/');
+
+ final int leftCount = countChar(leftPath, '/');
+ final int rightCount = countChar(rightPath, '/');
+ if (leftCount == rightCount) {
+ return leftPath.compareTo(rightPath) <= 0;
+ } else {
+ return leftCount < rightCount;
+ }
+ }
+
+ /**
+ * Counts the number of times the character is present in the string.
+ *
+ * @param string the string to count the characters in
+ * @param c the character to count
+ * @return the number of times the character is present in the string
+ */
+ private int countChar(String string, char c) {
+ int count = 0;
+ final int max = string.length();
+ for (int i = 0; i < max; i++) {
+ if (c == string.charAt(i)) {
+ count++;
+ }
+ }
+ return count;
+ }
}
diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/FalsePositiveAnalyzer.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/FalsePositiveAnalyzer.java
index 3eb5d46c3..725e32ede 100644
--- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/FalsePositiveAnalyzer.java
+++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/FalsePositiveAnalyzer.java
@@ -93,12 +93,17 @@ public class FalsePositiveAnalyzer extends AbstractAnalyzer {
addFalseNegativeCPEs(dependency);
}
+ /**
+ * Removes inaccurate matches on springframework CPEs.
+ *
+ * @param dependency the dependency to test for and remove known inaccurate CPE matches
+ */
private void removeBadSpringMatches(Dependency dependency) {
String mustContain = null;
for (Identifier i : dependency.getIdentifiers()) {
if ("maven".contains(i.getType())) {
if (i.getValue() != null && i.getValue().startsWith("org.springframework.")) {
- int endPoint = i.getValue().indexOf(":", 19);
+ final int endPoint = i.getValue().indexOf(":", 19);
if (endPoint >= 0) {
mustContain = i.getValue().substring(19, endPoint).toLowerCase();
break;
@@ -107,9 +112,9 @@ public class FalsePositiveAnalyzer extends AbstractAnalyzer {
}
}
if (mustContain != null) {
- IteratorMavenArtifact is populated with the GAV.
+ *
+ * @param sha1 the SHA-1 hash string for which to search
+ * @return the populated Maven GAV.
+ * @throws IOException if it's unable to connect to the specified repository or if
+ * the specified artifact is not found.
+ */
+ public List