checkstyle/findbugs/pmd corrections

Former-commit-id: 7e1758362e3e3da13678e5e2a8bffa28b8ad5a87

dependency-check-cli/src/main/java/org/owasp/dependencycheck/App.java

@@ -351,22 +351,27 @@ public class App {
         }
     }
 
+    /**
+     * Creates a file appender and adds it to logback.
+     *
+     * @param verboseLog the path to the verbose log file
+     */
     private void prepareLogger(String verboseLog) {
-        StaticLoggerBinder loggerBinder = StaticLoggerBinder.getSingleton();
+        final StaticLoggerBinder loggerBinder = StaticLoggerBinder.getSingleton();
-        LoggerContext context = (LoggerContext) loggerBinder.getLoggerFactory();
+        final LoggerContext context = (LoggerContext) loggerBinder.getLoggerFactory();
 
         final PatternLayoutEncoder encoder = new PatternLayoutEncoder();
         encoder.setPattern("%d %C:%L%n%-5level - %msg%n");
         encoder.setContext(context);
         encoder.start();
-        FileAppender fa = new FileAppender();
+        final FileAppender fa = new FileAppender();
         fa.setAppend(true);
         fa.setEncoder(encoder);
         fa.setContext(context);
         fa.setFile(verboseLog);
         final File f = new File(verboseLog);
         String name = f.getName();
-        int i = name.lastIndexOf('.');
+        final int i = name.lastIndexOf('.');
         if (i > 1) {
             name = name.substring(0, i);
         }

dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/AssemblyAnalyzer.java

@@ -42,7 +42,6 @@ import org.owasp.dependencycheck.dependency.Dependency;
 import org.owasp.dependencycheck.dependency.Evidence;
 import org.owasp.dependencycheck.utils.DCResources;
 import org.owasp.dependencycheck.utils.Settings;
-import org.slf4j.Logger;
 import org.slf4j.cal10n.LocLogger;
 import org.slf4j.cal10n.LocLoggerFactory;
 import org.w3c.dom.Document;
@@ -79,15 +78,15 @@ public class AssemblyAnalyzer extends AbstractFileTypeAnalyzer {
     /**
      * Message Conveyer
      */
-    private IMessageConveyor messageConveyer = new MessageConveyor(Locale.getDefault());
+    private final IMessageConveyor MESSAGE_CONVERYOR = new MessageConveyor(Locale.getDefault());
     /**
      * LocLoggerFactory for localized logger
      */
-    private LocLoggerFactory llFactory = new LocLoggerFactory(messageConveyer);
+    private final LocLoggerFactory LLFACTORY = new LocLoggerFactory(MESSAGE_CONVERYOR);
     /**
      * Logger
      */
-    private LocLogger LOGGER = llFactory.getLocLogger(AssemblyAnalyzer.class);
+    private final LocLogger LOGGER = LLFACTORY.getLocLogger(AssemblyAnalyzer.class);
 
     /**
      * Builds the beginnings of a List for ProcessBuilder

dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/AutoconfAnalyzer.java

@@ -35,9 +35,8 @@ import org.owasp.dependencycheck.utils.Settings;
 import org.owasp.dependencycheck.utils.UrlStringUtils;
 
 /**
- * Used to analyze Autoconf input files named configure.ac or configure.in.
+ * Used to analyze Autoconf input files named configure.ac or configure.in. Files simply named "configure" are also analyzed,
- * Files simply named "configure" are also analyzed, assuming they are generated
+ * assuming they are generated by Autoconf, and contain certain special package descriptor variables.
- * by Autoconf, and contain certain special package descriptor variables.
  *
  * @author Dale Visser <dvisser@ida.org>
  * @see <a href="https://www.gnu.org/software/autoconf/">Autoconf - GNU Project - Free Software Foundation (FSF)</a>
@@ -85,10 +84,11 @@ public class AutoconfAnalyzer extends AbstractFileTypeAnalyzer {
      * Matches AC_INIT statement in configure.ac file.
      */
     private static final Pattern AC_INIT_PATTERN;
+
     static {
         // each instance of param or sep_param has a capture group
         final String param = "\\[{0,2}(.+?)\\]{0,2}";
-		final String sep_param = "\\s*,\\s*" + param;
+        final String sepParam = "\\s*,\\s*" + param;
         // Group 1: Package
         // Group 2: Version
         // Group 3: optional
@@ -98,8 +98,8 @@ public class AutoconfAnalyzer extends AbstractFileTypeAnalyzer {
         // Group 7: optional
         // Group 8: URL (if it exists)
         AC_INIT_PATTERN = Pattern.compile(String.format(
-				"AC_INIT\\(%s%s(%s)?(%s)?(%s)?\\s*\\)", param, sep_param,
+                "AC_INIT\\(%s%s(%s)?(%s)?(%s)?\\s*\\)", param, sepParam,
-				sep_param, sep_param, sep_param), Pattern.DOTALL
+                sepParam, sepParam, sepParam), Pattern.DOTALL
                 | Pattern.CASE_INSENSITIVE);
     }
 
@@ -133,8 +133,7 @@ public class AutoconfAnalyzer extends AbstractFileTypeAnalyzer {
     }
 
     /**
-	 * Returns the key used in the properties file to reference the analyzer's
+     * Returns the key used in the properties file to reference the analyzer's enabled property.
-	 * enabled property.
      *
      * @return the analyzer's enabled property setting key
      */
@@ -174,6 +173,13 @@ public class AutoconfAnalyzer extends AbstractFileTypeAnalyzer {
         }
     }
 
+    /**
+     * Extracts evidence from the configuration.
+     *
+     * @param dependency the dependency being analyzed
+     * @param name the name of the source of evidence
+     * @param contents the contents to analyze for evidence
+     */
     private void extractConfigureScriptEvidence(Dependency dependency,
             final String name, final String contents) {
         final Matcher matcher = PACKAGE_VAR.matcher(contents);
@@ -198,6 +204,13 @@ public class AutoconfAnalyzer extends AbstractFileTypeAnalyzer {
         }
     }
 
+    /**
+     * Retrieves the contents of a given file.
+     *
+     * @param actualFile the file to read
+     * @return the contents of the file
+     * @throws AnalysisException thrown if there is an IO Exception
+     */
     private String getFileContents(final File actualFile)
             throws AnalysisException {
         String contents = "";
@@ -210,6 +223,13 @@ public class AutoconfAnalyzer extends AbstractFileTypeAnalyzer {
         return contents;
     }
 
+    /**
+     * Gathers evidence from a given file
+     *
+     * @param dependency the dependency to add evidence to
+     * @param name the source of the evidence
+     * @param contents the evidence to analyze
+     */
     private void gatherEvidence(Dependency dependency, final String name,
             String contents) {
         final Matcher matcher = AC_INIT_PATTERN.matcher(contents);
@@ -243,8 +263,7 @@ public class AutoconfAnalyzer extends AbstractFileTypeAnalyzer {
     /**
      * Initializes the file type analyzer.
      *
-	 * @throws Exception
+     * @throws Exception thrown if there is an exception during initialization
-	 *             thrown if there is an exception during initialization
      */
     @Override
     protected void initializeFileTypeAnalyzer() throws Exception {

dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nexus/NexusSearch.java

@@ -48,14 +48,6 @@ public class NexusSearch {
      * Whether to use the Proxy when making requests.
      */
     private boolean useProxy;
-    /**
-     * The username to use if the Nexus requires authentication.
-     */
-    private String userName = null;
-    /**
-     * The password to use if the Nexus requires authentication.
-     */
-    private char[] password;
     /**
      * Used for logging.
      */

dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nvdcve/CveDB.java

@@ -73,7 +73,7 @@ public class CveDB {
      */
     public CveDB() throws DatabaseException {
         super();
-        statementBundle = java.util.ResourceBundle.getBundle("data/dbStatements");
+        statementBundle = ResourceBundle.getBundle("data/dbStatements");
         try {
             open();
             databaseProperties = new DatabaseProperties(this);

dependency-check-core/src/main/java/org/owasp/dependencycheck/data/update/StandardUpdate.java

@@ -189,9 +189,8 @@ public class StandardUpdate {
     }
 
     /**
-     * Determines if the index needs to be updated. This is done by fetching the NVD CVE meta data and checking the last
+     * Determines if the index needs to be updated. This is done by fetching the NVD CVE meta data and checking the last update
-     * update date. If the data needs to be refreshed this method will return the NvdCveUrl for the files that need to
+     * date. If the data needs to be refreshed this method will return the NvdCveUrl for the files that need to be updated.
-     * be updated.
      *
      * @return the collection of files that need to be updated
      * @throws MalformedURLException is thrown if the URL for the NVD CVE Meta data is incorrect

dependency-check-core/src/main/java/org/owasp/dependencycheck/dependency/Dependency.java

@@ -599,8 +599,8 @@ public class Dependency implements Serializable, Comparable<Dependency> {
     private Set<Dependency> relatedDependencies = new TreeSet<Dependency>();
 
     /**
-     * Get the value of {@link #relatedDependencies}. This field is used to collect other dependencies which really
+     * Get the value of {@link #relatedDependencies}. This field is used to collect other dependencies which really represent the
-     * represent the same dependency, and may be presented as one item in reports.
+     * same dependency, and may be presented as one item in reports.
      *
      * @return the value of relatedDependencies
      */
@@ -660,8 +660,8 @@ public class Dependency implements Serializable, Comparable<Dependency> {
 
     /**
      * Adds a related dependency. The internal collection is normally a {@link java.util.TreeSet}, which relies on
-     * {@link #compareTo(Dependency)}. A consequence of this is that if you attempt to add a dependency with the
+     * {@link #compareTo(Dependency)}. A consequence of this is that if you attempt to add a dependency with the same file path
-     * same file path (modulo character case) as one that is already in the collection, it won't get added.
+     * (modulo character case) as one that is already in the collection, it won't get added.
      *
      * @param dependency a reference to the related dependency
      */
@@ -735,22 +735,22 @@ public class Dependency implements Serializable, Comparable<Dependency> {
             return false;
         }
         final Dependency other = (Dependency) obj;
-        return ObjectUtils.equals(this.actualFilePath, other.actualFilePath) &&
+        return ObjectUtils.equals(this.actualFilePath, other.actualFilePath)
-                ObjectUtils.equals(this.filePath, other.filePath) &&
+                && ObjectUtils.equals(this.filePath, other.filePath)
-                ObjectUtils.equals(this.fileName, other.fileName) &&
+                && ObjectUtils.equals(this.fileName, other.fileName)
-                ObjectUtils.equals(this.fileExtension, other.fileExtension) &&
+                && ObjectUtils.equals(this.fileExtension, other.fileExtension)
-                ObjectUtils.equals(this.md5sum, other.md5sum) &&
+                && ObjectUtils.equals(this.md5sum, other.md5sum)
-                ObjectUtils.equals(this.sha1sum, other.sha1sum) &&
+                && ObjectUtils.equals(this.sha1sum, other.sha1sum)
-                ObjectUtils.equals(this.identifiers, other.identifiers) &&
+                && ObjectUtils.equals(this.identifiers, other.identifiers)
-                ObjectUtils.equals(this.vendorEvidence, other.vendorEvidence) &&
+                && ObjectUtils.equals(this.vendorEvidence, other.vendorEvidence)
-                ObjectUtils.equals(this.productEvidence, other.productEvidence) &&
+                && ObjectUtils.equals(this.productEvidence, other.productEvidence)
-                ObjectUtils.equals(this.versionEvidence, other.versionEvidence) &&
+                && ObjectUtils.equals(this.versionEvidence, other.versionEvidence)
-                ObjectUtils.equals(this.description, other.description) &&
+                && ObjectUtils.equals(this.description, other.description)
-                ObjectUtils.equals(this.license, other.license) &&
+                && ObjectUtils.equals(this.license, other.license)
-                ObjectUtils.equals(this.vulnerabilities, other.vulnerabilities) &&
+                && ObjectUtils.equals(this.vulnerabilities, other.vulnerabilities)
-                ObjectUtils.equals(this.relatedDependencies, other.relatedDependencies) &&
+                && ObjectUtils.equals(this.relatedDependencies, other.relatedDependencies)
-                ObjectUtils.equals(this.projectReferences, other.projectReferences) &&
+                && ObjectUtils.equals(this.projectReferences, other.projectReferences)
-                ObjectUtils.equals(this.availableVersions, other.availableVersions);
+                && ObjectUtils.equals(this.availableVersions, other.availableVersions);
     }
 
     /**

dependency-check-core/src/main/java/org/owasp/dependencycheck/utils/DCResources.java

@@ -32,13 +32,40 @@ import ch.qos.cal10n.LocaleData;
 )
 public enum DCResources {
 
+    /**
+     * Not deployed.
+     */
     NOTDEPLOYED,
+    /**
+     * grok error.
+     */
     GROKERROR,
+    /**
+     * The dependency is not an assembly.
+     */
     NOTASSEMBLY,
+    /**
+     * GROK Return Code.
+     */
     GROKRC,
+    /**
+     * Grok assembly was extracted.
+     */
     GROKDEPLOYED,
+    /**
+     * Grok assembly was not extracted.
+     */
     GROKNOTDEPLOYED,
+    /**
+     * Grok failed to initialize.
+     */
     GROKINITFAIL,
+    /**
+     * Grok initialized.
+     */
     GROKINITMSG,
+    /**
+     * Grok assembly was not deleted.
+     */
     GROKNOTDELETED
 }

dependency-check-maven/src/main/java/org/owasp/dependencycheck/maven/AggregateMojo.java

@@ -149,7 +149,7 @@ public class AggregateMojo extends BaseDependencyCheckMojo {
                     if (mpp.compareTo(mod.getBasedir()) == 0 && descendants.add(mod)) {
                         if (getLog().isDebugEnabled()) {
                             getLog().debug(String.format("Decendent module %s added", mod.getName()));
-                        };
+                        }
                     }
                 } catch (IOException ex) {
                     if (getLog().isDebugEnabled()) {

dependency-check-maven/src/main/java/org/owasp/dependencycheck/maven/BaseDependencyCheckMojo.java

@@ -67,10 +67,6 @@ public abstract class BaseDependencyCheckMojo extends AbstractMojo implements Ma
      * The properties file location.
      */
     private static final String PROPERTIES_FILE = "mojo.properties";
-    /**
-     * Name of the logging properties file.
-     */
-    private static final String LOG_PROPERTIES_FILE = "log.properties";
     /**
      * System specific new line character.
      */
@@ -949,10 +945,11 @@ public abstract class BaseDependencyCheckMojo extends AbstractMojo implements Ma
             } else {
                 file = new File(writeTo, dataFileName);
             }
-            File parent = file.getParentFile();
+            final File parent = file.getParentFile();
             if (!parent.isDirectory()) {
                 if (parent.mkdirs()) {
-                    getLog().error(String.format("Directory '%s' does not exist and cannot be created; unable to write data file.", parent.getAbsolutePath()));
+                    getLog().error(String.format("Directory '%s' does not exist and cannot be created; unable to write data file.",
+                            parent.getAbsolutePath()));
                 }
             }
 

dependency-check-maven/src/main/java/org/owasp/dependencycheck/maven/slf4j/MavenLoggerAdapter.java

@@ -18,22 +18,32 @@
 package org.owasp.dependencycheck.maven.slf4j;
 
 import org.apache.maven.plugin.logging.Log;
-import org.slf4j.helpers.FormattingTuple;
 import org.slf4j.helpers.MarkerIgnoringBase;
 import org.slf4j.helpers.MessageFormatter;
 
 /**
- * Created by colezlaw on 6/14/15.
+ * Created on 6/14/15.
+ *
+ * @author colezlaw
  */
 public class MavenLoggerAdapter extends MarkerIgnoringBase {
 
     private Log log;
 
+    /**
+     * Creates a new Maven Logger Adapter.
+     *
+     * @param log the maven log
+     */
     public MavenLoggerAdapter(Log log) {
         super();
         this.log = log;
     }
 
+    /**
+     *
+     * @return
+     */
     @Override
     public boolean isTraceEnabled() {
         if (log != null) {

dependency-check-maven/src/main/java/org/owasp/dependencycheck/maven/slf4j/MavenLoggerFactory.java

@@ -22,7 +22,9 @@ import org.slf4j.ILoggerFactory;
 import org.slf4j.Logger;
 
 /**
- * Created by colezlaw on 6/14/15.
+ * Created on 6/14/15.
+ *
+ * @author colezlaw
  */
 public class MavenLoggerFactory implements ILoggerFactory {
 

dependency-check-maven/src/main/java/org/slf4j/impl/StaticLoggerBinder.java

@@ -48,7 +48,7 @@ public class StaticLoggerBinder implements LoggerFactoryBinder {
     /**
      * Maven mojos have their own logger, so we'll use one of those
      */
-    private Log log;
+    private Log log = null;
 
     /**
      * Set the Task which will this is to log through.
@@ -70,7 +70,7 @@ public class StaticLoggerBinder implements LoggerFactoryBinder {
     private static final String loggerFactoryClassStr = MavenLoggerFactory.class.getName();
 
     /**
-     * The ILoggerFactory instance returned by the {@link #getLoggerFactory} method should always be the smae object
+     * The ILoggerFactory instance returned by the {@link #getLoggerFactory} method should always be the same object
      */
     private ILoggerFactory loggerFactory;
 
@@ -83,6 +83,7 @@ public class StaticLoggerBinder implements LoggerFactoryBinder {
      *
      * @return the logger factory
      */
+    @Override
     public ILoggerFactory getLoggerFactory() {
         return loggerFactory;
     }
@@ -92,6 +93,7 @@ public class StaticLoggerBinder implements LoggerFactoryBinder {
      *
      * @return the logger factory class string
      */
+    @Override
     public String getLoggerFactoryClassStr() {
         return loggerFactoryClassStr;
     }