github-mirrors/DependencyCheck
1
0
Fork 0
mirror of https://github.com/ysoftdevs/DependencyCheck.git synced 2026-03-24 10:01:35 +01:00
Code Issues Packages Projects Releases Wiki Activity

updated to prevent bundling of dependencies within WAR files

Browse Source
This commit is contained in:
Jeremy Long
2017-02-07 06:22:55 -05:00
parent 3a082ae00a
commit 3a11504153
1 changed files with 9 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/DependencyBundlingAnalyzer.java
View File

@@ -154,13 +154,15 @@ public class DependencyBundlingAnalyzer extends AbstractAnalyzer {
final ListIterator<Dependency> subIterator = engine.getDependencies().listIterator(mainIterator.nextIndex()); final ListIterator<Dependency> subIterator = engine.getDependencies().listIterator(mainIterator.nextIndex());
while (subIterator.hasNext()) { while (subIterator.hasNext()) {
final Dependency nextDependency = subIterator.next(); final Dependency nextDependency = subIterator.next();
if (hashesMatch(dependency, nextDependency) && !containedInWar(dependency.getFilePath()) if (hashesMatch(dependency, nextDependency)) {
&& !containedInWar(nextDependency.getFilePath())) { if (!containedInWar(dependency.getFilePath())
if (firstPathIsShortest(dependency.getFilePath(), nextDependency.getFilePath())) { && !containedInWar(nextDependency.getFilePath())) {
mergeDependencies(dependency, nextDependency, dependenciesToRemove); if (firstPathIsShortest(dependency.getFilePath(), nextDependency.getFilePath())) {
} else { mergeDependencies(dependency, nextDependency, dependenciesToRemove);
mergeDependencies(nextDependency, dependency, dependenciesToRemove); } else {
break; //since we merged into the next dependency - skip forward to the next in mainIterator mergeDependencies(nextDependency, dependency, dependenciesToRemove);
break; //since we merged into the next dependency - skip forward to the next in mainIterator
}
} }
} else if (isShadedJar(dependency, nextDependency)) { } else if (isShadedJar(dependency, nextDependency)) {
if (dependency.getFileName().toLowerCase().endsWith("pom.xml")) { if (dependency.getFileName().toLowerCase().endsWith("pom.xml")) {