diff --git a/dependency-check-cli/src/main/java/org/owasp/dependencycheck/App.java b/dependency-check-cli/src/main/java/org/owasp/dependencycheck/App.java index b7d07c7cc..f34108383 100644 --- a/dependency-check-cli/src/main/java/org/owasp/dependencycheck/App.java +++ b/dependency-check-cli/src/main/java/org/owasp/dependencycheck/App.java @@ -27,7 +27,6 @@ import java.util.HashSet; import java.util.List; import java.util.Set; import org.apache.commons.cli.ParseException; -import org.apache.commons.lang.StringUtils; import org.owasp.dependencycheck.data.nvdcve.CveDB; import org.owasp.dependencycheck.data.nvdcve.DatabaseException; import org.owasp.dependencycheck.data.nvdcve.DatabaseProperties; diff --git a/dependency-check-cli/src/main/java/org/owasp/dependencycheck/CliParser.java b/dependency-check-cli/src/main/java/org/owasp/dependencycheck/CliParser.java index d6b2dd65d..33ffc841b 100644 --- a/dependency-check-cli/src/main/java/org/owasp/dependencycheck/CliParser.java +++ b/dependency-check-cli/src/main/java/org/owasp/dependencycheck/CliParser.java @@ -344,7 +344,7 @@ public final class CliParser { final Option pathToMono = Option.builder().argName("path").hasArg().longOpt(ARGUMENT.PATH_TO_MONO) .desc("The path to Mono for .NET Assembly analysis on non-windows systems.") .build(); - + final Option pathToBundleAudit = Option.builder().argName("path").hasArg() .longOpt(ARGUMENT.PATH_TO_BUNDLE_AUDIT) .desc("The path to bundle-audit for Gem bundle analysis.").build(); @@ -576,7 +576,6 @@ public final class CliParser { return (line != null) && line.hasOption(ARGUMENT.DISABLE_BUNDLE_AUDIT); } - /** * Returns true if the disablePyDist command line argument was specified. * diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/AnalysisPhase.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/AnalysisPhase.java index 61d128a18..1716388b1 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/AnalysisPhase.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/AnalysisPhase.java @@ -29,7 +29,7 @@ public enum AnalysisPhase { */ INITIAL, /** - * Pre information collection phase + * Pre information collection phase. */ PRE_INFORMATION_COLLECTION, /** diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/CMakeAnalyzer.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/CMakeAnalyzer.java index 0435fa7a7..4d957be82 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/CMakeAnalyzer.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/CMakeAnalyzer.java @@ -32,8 +32,10 @@ import org.slf4j.LoggerFactory; import java.io.File; import java.io.FileFilter; import java.io.IOException; +import java.io.UnsupportedEncodingException; import java.security.MessageDigest; import java.security.NoSuchAlgorithmException; +import java.util.logging.Level; import java.util.regex.Matcher; import java.util.regex.Pattern; @@ -212,8 +214,13 @@ public class CMakeAnalyzer extends AbstractFileTypeAnalyzer { final String filePath = String.format("%s:%s", dependency.getFilePath(), product); currentDep.setFilePath(filePath); - // prevents coalescing into the dependency provided by engine - currentDep.setSha1sum(Checksum.getHex(sha1.digest(filePath.getBytes()))); + byte[] path; + try { + path = filePath.getBytes("UTF-8"); + } catch (UnsupportedEncodingException ex) { + path = filePath.getBytes(); + } + currentDep.setSha1sum(Checksum.getHex(sha1.digest(path))); engine.getDependencies().add(currentDep); } final String source = currentDep.getDisplayFileName(); diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/RubyBundleAuditAnalyzer.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/RubyBundleAuditAnalyzer.java index ffb988e03..c0451c860 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/RubyBundleAuditAnalyzer.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/RubyBundleAuditAnalyzer.java @@ -51,8 +51,8 @@ public class RubyBundleAuditAnalyzer extends AbstractFileTypeAnalyzer { */ private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.PRE_INFORMATION_COLLECTION; - private static final FileFilter FILTER = - FileFilterBuilder.newInstance().addFilenames("Gemfile.lock").build(); + private static final FileFilter FILTER + = FileFilterBuilder.newInstance().addFilenames("Gemfile.lock").build(); public static final String NAME = "Name: "; public static final String VERSION = "Version: "; public static final String ADVISORY = "Advisory: "; @@ -113,7 +113,7 @@ public class RubyBundleAuditAnalyzer extends AbstractFileTypeAnalyzer { throw new AnalysisException("Bundle-audit error stream unexpectedly not ready."); } else { final String line = reader.readLine(); - if (!line.contains("Errno::ENOENT")) { + if (line == null || !line.contains("Errno::ENOENT")) { LOGGER.warn("Unexpected bundle-audit output. Disabling {}: {}", ANALYZER_NAME, line); setEnabled(false); throw new AnalysisException("Unexpected bundle-audit output."); @@ -126,8 +126,8 @@ public class RubyBundleAuditAnalyzer extends AbstractFileTypeAnalyzer { } } if (isEnabled()) { - LOGGER.info(ANALYZER_NAME + " is enabled. It is necessary to manually run \"bundle-audit update\" " + - "occasionally to keep its database up to date."); + LOGGER.info(ANALYZER_NAME + " is enabled. It is necessary to manually run \"bundle-audit update\" " + + "occasionally to keep its database up to date."); } } @@ -162,8 +162,8 @@ public class RubyBundleAuditAnalyzer extends AbstractFileTypeAnalyzer { } /** - * If {@link #analyzeFileType(Dependency, Engine)} is called, then we have successfully initialized, and it will - * be necessary to disable {@link RubyGemspecAnalyzer}. + * If {@link #analyzeFileType(Dependency, Engine)} is called, then we have successfully initialized, and it will be necessary + * to disable {@link RubyGemspecAnalyzer}. */ private boolean needToDisableGemspecAnalyzer = true; diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/update/EngineVersionCheck.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/update/EngineVersionCheck.java index c141c17a7..d642b1aac 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/update/EngineVersionCheck.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/update/EngineVersionCheck.java @@ -21,7 +21,6 @@ import java.io.IOException; import java.net.HttpURLConnection; import java.net.MalformedURLException; import java.net.URL; -import java.util.logging.Level; import org.apache.commons.io.IOUtils; import org.owasp.dependencycheck.data.nvdcve.CveDB; import org.owasp.dependencycheck.data.nvdcve.DatabaseException; @@ -128,7 +127,7 @@ public class EngineVersionCheck implements CachedWebDataSource { protected boolean shouldUpdate(final long lastChecked, final long now, final DatabaseProperties properties, String currentVersion) throws UpdateException { //check every 30 days if we know there is an update, otherwise check every 7 days - int checkRange = 30; + final int checkRange = 30; if (!DateUtil.withinDateRange(lastChecked, now, checkRange)) { LOGGER.debug("Checking web for new version."); final String currentRelease = getCurrentReleaseVersion(); diff --git a/dependency-check-maven/src/main/java/org/owasp/dependencycheck/maven/BaseDependencyCheckMojo.java b/dependency-check-maven/src/main/java/org/owasp/dependencycheck/maven/BaseDependencyCheckMojo.java index f0a21b596..b2c005199 100644 --- a/dependency-check-maven/src/main/java/org/owasp/dependencycheck/maven/BaseDependencyCheckMojo.java +++ b/dependency-check-maven/src/main/java/org/owasp/dependencycheck/maven/BaseDependencyCheckMojo.java @@ -28,8 +28,6 @@ import java.io.ObjectInputStream; import java.io.ObjectOutputStream; import java.util.List; import java.util.Locale; -import java.util.logging.Level; -import java.util.logging.Logger; import org.apache.maven.artifact.Artifact; import org.apache.maven.doxia.sink.Sink; import org.apache.maven.plugin.AbstractMojo; @@ -282,7 +280,7 @@ public abstract class BaseDependencyCheckMojo extends AbstractMojo implements Ma /** * The security dispatcher that can decrypt passwords in the settings.xml. */ - @Component(role = org.sonatype.plexus.components.sec.dispatcher.SecDispatcher.class, hint = "default") + @Component(role = SecDispatcher.class, hint = "default") private SecDispatcher securityDispatcher; /** * The database user name. @@ -701,7 +699,7 @@ public abstract class BaseDependencyCheckMojo extends AbstractMojo implements Ma Settings.setStringIfNotEmpty(Settings.KEYS.DB_CONNECTION_STRING, connectionString); if (databaseUser == null && databasePassword == null && serverId != null) { - Server server = settingsXml.getServer(serverId); + final Server server = settingsXml.getServer(serverId); if (server != null) { databaseUser = server.getUsername(); try { @@ -718,17 +716,21 @@ public abstract class BaseDependencyCheckMojo extends AbstractMojo implements Ma databasePassword = securityDispatcher.decrypt(server.getPassword()); } catch (SecDispatcherException ex) { - if (ex.getCause() instanceof java.io.FileNotFoundException - || (ex.getCause() != null && ex.getCause().getCause() instanceof java.io.FileNotFoundException)) { + if (ex.getCause() instanceof FileNotFoundException + || (ex.getCause() != null && ex.getCause().getCause() instanceof FileNotFoundException)) { //maybe its not encrypted? final String tmp = server.getPassword(); if (tmp.startsWith("{") && tmp.endsWith("}")) { - getLog().error(String.format("Unable to decrypt the server password for server id '%s' in settings.xml%n\tCause: %s", serverId, ex.getMessage())); + getLog().error(String.format( + "Unable to decrypt the server password for server id '%s' in settings.xml%n\tCause: %s", + serverId, ex.getMessage())); } else { databasePassword = tmp; } } else { - getLog().error(String.format("Unable to decrypt the server password for server id '%s' in settings.xml%n\tCause: %s", serverId, ex.getMessage())); + getLog().error(String.format( + "Unable to decrypt the server password for server id '%s' in settings.xml%n\tCause: %s", + serverId, ex.getMessage())); } } } else {