github-mirrors/DependencyCheck
1
0
Fork 0
mirror of https://github.com/ysoftdevs/DependencyCheck.git synced 2026-03-17 23:04:07 +01:00
Code Issues Packages Projects Releases Wiki Activity

added notes for future enhancement

Browse Source 
Former-commit-id: 2886464dc1fd657b79f1763eec2862bbf2c11af7
This commit is contained in:
Jeremy Long
2015-05-23 06:39:23 -04:00
parent 928d8dbb15
commit 362c7e9c04
1 changed files with 2 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/CPEAnalyzer.java
View File

@@ -406,6 +406,8 @@ public class CPEAnalyzer implements Analyzer {
private boolean verifyEntry(final IndexEntry entry, final Dependency dependency) { private boolean verifyEntry(final IndexEntry entry, final Dependency dependency) {
boolean isValid = false; boolean isValid = false;
//TODO - does this nullify some of the fuzzy matching that happens in the lucene search?
// for instance CPE some-component and in the evidence we have SomeComponent.
if (collectionContainsString(dependency.getProductEvidence(), entry.getProduct()) if (collectionContainsString(dependency.getProductEvidence(), entry.getProduct())
&& collectionContainsString(dependency.getVendorEvidence(), entry.getVendor())) { && collectionContainsString(dependency.getVendorEvidence(), entry.getVendor())) {
//&& collectionContainsVersion(dependency.getVersionEvidence(), entry.getVersion()) //&& collectionContainsVersion(dependency.getVersionEvidence(), entry.getVersion())