true if the analyzer supports parallel processing;
+ * otherwise false
* @see #analyzeDependency(Dependency, Engine)
* @see #findMoreDependencies(Engine, File)
*/
@@ -300,11 +303,11 @@ public class ArchiveAnalyzer extends AbstractFileTypeAnalyzer {
*/
private void addDisguisedJarsToDependencies(Dependency dependency, Engine engine) throws AnalysisException {
if (ZIP_FILTER.accept(dependency.getActualFile()) && isZipFileActuallyJarFile(dependency)) {
- final File tdir = getNextTempDirectory();
+ final File tempDir = getNextTempDirectory();
final String fileName = dependency.getFileName();
LOGGER.info("The zip file '{}' appears to be a JAR file, making a copy and analyzing it as a JAR.", fileName);
- final File tmpLoc = new File(tdir, fileName.substring(0, fileName.length() - 3) + "jar");
+ final File tmpLoc = new File(tempDir, fileName.substring(0, fileName.length() - 3) + "jar");
//store the archives sha1 and change it so that the engine doesn't think the zip and jar file are the same
// and add it is a related dependency.
final String archiveSha1 = dependency.getSha1sum();
@@ -344,8 +347,7 @@ public class ArchiveAnalyzer extends AbstractFileTypeAnalyzer {
* @return any dependencies that weren't known to the engine before
*/
private static Listtrue if the analyzer is open
+ */
public boolean isOpen() {
return cpe != null && cpe.isOpen();
}
@@ -203,7 +208,7 @@ public class CPEAnalyzer extends AbstractAnalyzer {
* @throws ParseException is thrown when the Lucene query cannot be parsed.
*/
protected void determineCPE(Dependency dependency) throws CorruptIndexException, IOException, ParseException {
- //TODO test dojo-war against this. we shold get dojo-toolkit:dojo-toolkit AND dojo-toolkit:toolkit
+ //TODO test dojo-war against this. we should get dojo-toolkit:dojo-toolkit AND dojo-toolkit:toolkit
String vendors = "";
String products = "";
for (Confidence confidence : Confidence.values()) {
@@ -291,7 +296,7 @@ public class CPEAnalyzer extends AbstractAnalyzer {
protected Listfalse
*/
private boolean checkEnabled() {
- boolean retval = false;
+ boolean retVal = false;
try {
if (Settings.getBoolean(Settings.KEYS.ANALYZER_CENTRAL_ENABLED)) {
if (!Settings.getBoolean(Settings.KEYS.ANALYZER_NEXUS_ENABLED)
|| NexusAnalyzer.DEFAULT_URL.equals(Settings.getString(Settings.KEYS.ANALYZER_NEXUS_URL))) {
LOGGER.debug("Enabling the Central analyzer");
- retval = true;
+ retVal = true;
} else {
LOGGER.info("Nexus analyzer is enabled, disabling the Central Analyzer");
}
@@ -120,7 +120,7 @@ public class CentralAnalyzer extends AbstractFileTypeAnalyzer {
} catch (InvalidSettingException ise) {
LOGGER.warn("Invalid setting. Disabling the Central analyzer");
}
- return retval;
+ return retVal;
}
/**
diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/ComposerLockAnalyzer.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/ComposerLockAnalyzer.java
index 57c8bf791..cccfeb010 100644
--- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/ComposerLockAnalyzer.java
+++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/ComposerLockAnalyzer.java
@@ -33,7 +33,7 @@ import org.slf4j.LoggerFactory;
import java.io.FileFilter;
import java.io.FileInputStream;
-import java.io.FileNotFoundException;
+import java.io.IOException;
import java.nio.charset.Charset;
import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;
@@ -101,9 +101,7 @@ public class ComposerLockAnalyzer extends AbstractFileTypeAnalyzer {
*/
@Override
protected void analyzeDependency(Dependency dependency, Engine engine) throws AnalysisException {
- FileInputStream fis = null;
- try {
- fis = new FileInputStream(dependency.getActualFile());
+ try (FileInputStream fis = new FileInputStream(dependency.getActualFile())) {
final ComposerLockParser clp = new ComposerLockParser(fis);
LOGGER.info("Checking composer.lock file {}", dependency.getActualFilePath());
clp.process();
@@ -120,18 +118,10 @@ public class ComposerLockAnalyzer extends AbstractFileTypeAnalyzer {
LOGGER.info("Adding dependency {}", d);
engine.getDependencies().add(d);
}
- } catch (FileNotFoundException fnfe) {
+ } catch (IOException ex) {
LOGGER.warn("Error opening dependency {}", dependency.getActualFilePath());
} catch (ComposerException ce) {
LOGGER.warn("Error parsing composer.json {}", dependency.getActualFilePath(), ce);
- } finally {
- if (fis != null) {
- try {
- fis.close();
- } catch (Exception e) {
- LOGGER.debug("Unable to close file", e);
- }
- }
}
}
diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/DependencyBundlingAnalyzer.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/DependencyBundlingAnalyzer.java
index 72c8e95ea..bf16a2e23 100644
--- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/DependencyBundlingAnalyzer.java
+++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/DependencyBundlingAnalyzer.java
@@ -145,7 +145,7 @@ public class DependencyBundlingAnalyzer extends AbstractAnalyzer {
protected synchronized void analyzeDependency(Dependency ignore, Engine engine) throws AnalysisException {
if (!analyzed) {
analyzed = true;
- final Set@@ -1133,7 +1073,7 @@ public class JarAnalyzer extends AbstractFileTypeAnalyzer { * package structure. Up to the first four levels of the package * structure are stored, excluding a leading "org" or "com". * Example:
- *ClassNameInformation obj = new ClassNameInformation("org.owasp.dependencycheck.analyzer.JarAnalyzer");
+ * ClassNameInformation obj = new ClassNameInformation("org/owasp/dependencycheck/analyzer/JarAnalyzer");
* System.out.println(obj.getName());
* for (String p : obj.getPackageStructure())
* System.out.println(p);
@@ -1161,9 +1101,7 @@ public class JarAnalyzer extends AbstractFileTypeAnalyzer {
if (tmp.length <= end) {
end = tmp.length - 1;
}
- for (int i = start; i <= end; i++) {
- packageStructure.add(tmp[i]);
- }
+ packageStructure.addAll(Arrays.asList(tmp).subList(start, end + 1));
} else {
packageStructure.add(name);
}
diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/NexusAnalyzer.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/NexusAnalyzer.java
index 8dff9242d..b6eae2a1d 100644
--- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/NexusAnalyzer.java
+++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/NexusAnalyzer.java
@@ -87,10 +87,6 @@ public class NexusAnalyzer extends AbstractFileTypeAnalyzer {
*/
private static final String SUPPORTED_EXTENSIONS = "jar";
- /**
- * Whether or not the Nexus analyzer should use a proxy if configured.
- */
- private boolean useProxy;
/**
* The Nexus Search to be set up for this analyzer.
*/
@@ -148,7 +144,7 @@ public class NexusAnalyzer extends AbstractFileTypeAnalyzer {
LOGGER.debug("Initializing Nexus Analyzer");
LOGGER.debug("Nexus Analyzer enabled: {}", isEnabled());
if (isEnabled()) {
- useProxy = useProxy();
+ final boolean useProxy = useProxy();
final String searchUrl = Settings.getString(Settings.KEYS.ANALYZER_NEXUS_URL);
LOGGER.debug("Nexus Analyzer URL: {}", searchUrl);
try {
diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/NodePackageAnalyzer.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/NodePackageAnalyzer.java
index 15f7e6d37..8f9685c41 100644
--- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/NodePackageAnalyzer.java
+++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/NodePackageAnalyzer.java
@@ -121,17 +121,9 @@ public class NodePackageAnalyzer extends AbstractFileTypeAnalyzer {
}
@Override
- protected void analyzeDependency(Dependency dependency, Engine engine)
- throws AnalysisException {
+ protected void analyzeDependency(Dependency dependency, Engine engine) throws AnalysisException {
final File file = dependency.getActualFile();
- JsonReader jsonReader;
- try {
- jsonReader = Json.createReader(FileUtils.openInputStream(file));
- } catch (IOException e) {
- throw new AnalysisException(
- "Problem occurred while reading dependency file.", e);
- }
- try {
+ try (JsonReader jsonReader = Json.createReader(FileUtils.openInputStream(file))) {
final JsonObject json = jsonReader.readObject();
final EvidenceCollection productEvidence = dependency.getProductEvidence();
final EvidenceCollection vendorEvidence = dependency.getVendorEvidence();
@@ -151,8 +143,8 @@ public class NodePackageAnalyzer extends AbstractFileTypeAnalyzer {
dependency.setDisplayFileName(String.format("%s/%s", file.getParentFile().getName(), file.getName()));
} catch (JsonException e) {
LOGGER.warn("Failed to parse package.json file.", e);
- } finally {
- jsonReader.close();
+ } catch (IOException e) {
+ throw new AnalysisException("Problem occurred while reading dependency file.", e);
}
}
diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/NuspecAnalyzer.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/NuspecAnalyzer.java
index 2d6fd1993..20e46663a 100644
--- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/NuspecAnalyzer.java
+++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/NuspecAnalyzer.java
@@ -33,7 +33,6 @@ import org.slf4j.LoggerFactory;
import java.io.FileFilter;
import java.io.FileInputStream;
import java.io.FileNotFoundException;
-import java.io.IOException;
import org.owasp.dependencycheck.exception.InitializationException;
/**
@@ -132,22 +131,10 @@ public class NuspecAnalyzer extends AbstractFileTypeAnalyzer {
try {
final NuspecParser parser = new XPathNuspecParser();
NugetPackage np = null;
- FileInputStream fis = null;
- try {
- fis = new FileInputStream(dependency.getActualFilePath());
+ try (FileInputStream fis = new FileInputStream(dependency.getActualFilePath())) {
np = parser.parse(fis);
- } catch (NuspecParseException ex) {
+ } catch (NuspecParseException | FileNotFoundException ex) {
throw new AnalysisException(ex);
- } catch (FileNotFoundException ex) {
- throw new AnalysisException(ex);
- } finally {
- if (fis != null) {
- try {
- fis.close();
- } catch (IOException e) {
- LOGGER.debug("Error closing input stream");
- }
- }
}
if (np.getOwners() != null) {
diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/PythonDistributionAnalyzer.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/PythonDistributionAnalyzer.java
index 578c8d8f4..551279eb7 100644
--- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/PythonDistributionAnalyzer.java
+++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/PythonDistributionAnalyzer.java
@@ -360,22 +360,12 @@ public class PythonDistributionAnalyzer extends AbstractFileTypeAnalyzer {
if (null == manifest) {
LOGGER.debug("Manifest file not found.");
} else {
- InputStream in = null;
- try {
- in = new BufferedInputStream(new FileInputStream(manifest));
+ try (InputStream in = new BufferedInputStream(new FileInputStream(manifest))) {
result.load(in);
- } catch (MessagingException e) {
+ } catch (MessagingException | FileNotFoundException e) {
LOGGER.warn(e.getMessage(), e);
- } catch (FileNotFoundException e) {
- LOGGER.warn(e.getMessage(), e);
- } finally {
- if (in != null) {
- try {
- in.close();
- } catch (IOException ex) {
- LOGGER.debug("failed to close input stream", ex);
- }
- }
+ } catch (IOException ex) {
+ LOGGER.warn(ex.getMessage(), ex);
}
}
return result;
diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/RubyBundleAuditAnalyzer.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/RubyBundleAuditAnalyzer.java
index e44aa6b45..f8239eadf 100644
--- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/RubyBundleAuditAnalyzer.java
+++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/RubyBundleAuditAnalyzer.java
@@ -113,7 +113,7 @@ public class RubyBundleAuditAnalyzer extends AbstractFileTypeAnalyzer {
if (!folder.isDirectory()) {
throw new AnalysisException(String.format("%s should have been a directory.", folder.getAbsolutePath()));
}
- final List args = new ArrayList();
+ final List args = new ArrayList<>();
final String bundleAuditPath = Settings.getString(Settings.KEYS.ANALYZER_BUNDLE_AUDIT_PATH);
File bundleAudit = null;
if (bundleAuditPath != null) {
@@ -172,7 +172,7 @@ public class RubyBundleAuditAnalyzer extends AbstractFileTypeAnalyzer {
exitValue = process.waitFor();
} catch (InterruptedException ex) {
setEnabled(false);
- final String msg = String.format("Bundle-audit process was interupted. Disabling %s", ANALYZER_NAME);
+ final String msg = String.format("Bundle-audit process was interrupted. Disabling %s", ANALYZER_NAME);
throw new InitializationException(msg);
}
if (0 == exitValue) {
@@ -180,9 +180,7 @@ public class RubyBundleAuditAnalyzer extends AbstractFileTypeAnalyzer {
final String msg = String.format("Unexpected exit code from bundle-audit process. Disabling %s: %s", ANALYZER_NAME, exitValue);
throw new InitializationException(msg);
} else {
- BufferedReader reader = null;
- try {
- reader = new BufferedReader(new InputStreamReader(process.getErrorStream(), "UTF-8"));
+ try (BufferedReader reader = new BufferedReader(new InputStreamReader(process.getErrorStream(), "UTF-8"))) {
if (!reader.ready()) {
LOGGER.warn("Bundle-audit error stream unexpectedly not ready. Disabling " + ANALYZER_NAME);
setEnabled(false);
@@ -201,14 +199,6 @@ public class RubyBundleAuditAnalyzer extends AbstractFileTypeAnalyzer {
} catch (IOException ex) {
setEnabled(false);
throw new InitializationException("Unable to read bundle-audit output.", ex);
- } finally {
- if (null != reader) {
- try {
- reader.close();
- } catch (IOException ex) {
- LOGGER.debug("Error closing reader", ex);
- }
- }
}
}
@@ -296,35 +286,19 @@ public class RubyBundleAuditAnalyzer extends AbstractFileTypeAnalyzer {
final String msg = String.format("Unexpected exit code from bundle-audit process; exit code: %s", exitValue);
throw new AnalysisException(msg);
}
- BufferedReader rdr = null;
- BufferedReader errReader = null;
try {
- errReader = new BufferedReader(new InputStreamReader(process.getErrorStream(), "UTF-8"));
- while (errReader.ready()) {
- final String error = errReader.readLine();
- LOGGER.warn(error);
+ try (BufferedReader errReader = new BufferedReader(new InputStreamReader(process.getErrorStream(), "UTF-8"))) {
+ while (errReader.ready()) {
+ final String error = errReader.readLine();
+ LOGGER.warn(error);
+ }
+ }
+ try (BufferedReader rdr = new BufferedReader(new InputStreamReader(process.getInputStream(), "UTF-8"))) {
+ processBundlerAuditOutput(dependency, engine, rdr);
}
- rdr = new BufferedReader(new InputStreamReader(process.getInputStream(), "UTF-8"));
- processBundlerAuditOutput(dependency, engine, rdr);
} catch (IOException ioe) {
LOGGER.warn("bundle-audit failure", ioe);
- } finally {
- if (errReader != null) {
- try {
- errReader.close();
- } catch (IOException ioe) {
- LOGGER.warn("bundle-audit close failure", ioe);
- }
- }
- if (null != rdr) {
- try {
- rdr.close();
- } catch (IOException ioe) {
- LOGGER.warn("bundle-audit close failure", ioe);
- }
- }
}
-
}
/**
@@ -342,7 +316,7 @@ public class RubyBundleAuditAnalyzer extends AbstractFileTypeAnalyzer {
Dependency dependency = null;
Vulnerability vulnerability = null;
String gem = null;
- final Map map = new HashMap();
+ final Map map = new HashMap<>();
boolean appendToDescription = false;
while (rdr.ready()) {
final String nextLine = rdr.readLine();
diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/VersionFilterAnalyzer.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/VersionFilterAnalyzer.java
index 7098149f1..3c1c1526b 100644
--- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/VersionFilterAnalyzer.java
+++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/VersionFilterAnalyzer.java
@@ -39,7 +39,7 @@ import org.slf4j.LoggerFactory;
*/
public class VersionFilterAnalyzer extends AbstractAnalyzer {
- //
+ //
/**
* Evidence source.
*/
@@ -126,7 +126,7 @@ public class VersionFilterAnalyzer extends AbstractAnalyzer {
* the dependency.
*/
@Override
- protected void analyzeDependency(Dependency dependency, Engine engine) throws AnalysisException {
+ protected synchronized void analyzeDependency(Dependency dependency, Engine engine) throws AnalysisException {
String fileVersion = null;
String pomVersion = null;
String manifestVersion = null;
@@ -151,16 +151,14 @@ public class VersionFilterAnalyzer extends AbstractAnalyzer {
if (fileMatch || manifestMatch || pomMatch) {
LOGGER.debug("filtering evidence from {}", dependency.getFileName());
final EvidenceCollection versionEvidence = dependency.getVersionEvidence();
- synchronized (versionEvidence) {
- final Iterator itr = versionEvidence.iterator();
- while (itr.hasNext()) {
- final Evidence e = itr.next();
- if (!(pomMatch && VERSION.equals(e.getName())
- && (NEXUS.equals(e.getSource()) || CENTRAL.equals(e.getSource()) || POM.equals(e.getSource())))
- && !(fileMatch && VERSION.equals(e.getName()) && FILE.equals(e.getSource()))
- && !(manifestMatch && MANIFEST.equals(e.getSource()) && IMPLEMENTATION_VERSION.equals(e.getName()))) {
- itr.remove();
- }
+ final Iterator itr = versionEvidence.iterator();
+ while (itr.hasNext()) {
+ final Evidence e = itr.next();
+ if (!(pomMatch && VERSION.equals(e.getName())
+ && (NEXUS.equals(e.getSource()) || CENTRAL.equals(e.getSource()) || POM.equals(e.getSource())))
+ && !(fileMatch && VERSION.equals(e.getName()) && FILE.equals(e.getSource()))
+ && !(manifestMatch && MANIFEST.equals(e.getSource()) && IMPLEMENTATION_VERSION.equals(e.getName()))) {
+ itr.remove();
}
}
}
diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/central/CentralSearch.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/central/CentralSearch.java
index 5f3cfc420..314e321fb 100644
--- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/central/CentralSearch.java
+++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/central/CentralSearch.java
@@ -24,8 +24,10 @@ import java.net.URL;
import java.util.ArrayList;
import java.util.List;
import javax.xml.parsers.DocumentBuilder;
+import javax.xml.parsers.ParserConfigurationException;
import javax.xml.xpath.XPath;
import javax.xml.xpath.XPathConstants;
+import javax.xml.xpath.XPathExpressionException;
import javax.xml.xpath.XPathFactory;
import org.owasp.dependencycheck.data.nexus.MavenArtifact;
import org.owasp.dependencycheck.utils.Settings;
@@ -35,6 +37,7 @@ import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.w3c.dom.Document;
import org.w3c.dom.NodeList;
+import org.xml.sax.SAXException;
/**
* Class of methods to search Maven Central via Central.
@@ -117,7 +120,7 @@ public class CentralSearch {
if ("0".equals(numFound)) {
missing = true;
} else {
- result = new ArrayList();
+ result = new ArrayList<>();
final NodeList docs = (NodeList) xpath.evaluate("/response/result/doc", doc, XPathConstants.NODESET);
for (int i = 0; i < docs.getLength(); i++) {
final String g = xpath.evaluate("./str[@name='g']", docs.item(i));
@@ -125,11 +128,11 @@ public class CentralSearch {
final String a = xpath.evaluate("./str[@name='a']", docs.item(i));
LOGGER.trace("ArtifactId: {}", a);
final String v = xpath.evaluate("./str[@name='v']", docs.item(i));
- NodeList atts = (NodeList) xpath.evaluate("./arr[@name='ec']/str", docs.item(i), XPathConstants.NODESET);
+ NodeList attributes = (NodeList) xpath.evaluate("./arr[@name='ec']/str", docs.item(i), XPathConstants.NODESET);
boolean pomAvailable = false;
boolean jarAvailable = false;
- for (int x = 0; x < atts.getLength(); x++) {
- final String tmp = xpath.evaluate(".", atts.item(x));
+ for (int x = 0; x < attributes.getLength(); x++) {
+ final String tmp = xpath.evaluate(".", attributes.item(x));
if (".pom".equals(tmp)) {
pomAvailable = true;
} else if (".jar".equals(tmp)) {
@@ -137,10 +140,10 @@ public class CentralSearch {
}
}
- atts = (NodeList) xpath.evaluate("./arr[@name='tags']/str", docs.item(i), XPathConstants.NODESET);
+ attributes = (NodeList) xpath.evaluate("./arr[@name='tags']/str", docs.item(i), XPathConstants.NODESET);
boolean useHTTPS = false;
- for (int x = 0; x < atts.getLength(); x++) {
- final String tmp = xpath.evaluate(".", atts.item(x));
+ for (int x = 0; x < attributes.getLength(); x++) {
+ final String tmp = xpath.evaluate(".", attributes.item(x));
if ("https".equals(tmp)) {
useHTTPS = true;
}
@@ -149,7 +152,7 @@ public class CentralSearch {
result.add(new MavenArtifact(g, a, v, jarAvailable, pomAvailable, useHTTPS));
}
}
- } catch (Throwable e) {
+ } catch (ParserConfigurationException | IOException | SAXException | XPathExpressionException e) {
// Anything else is jacked up XML stuff that we really can't recover from well
throw new IOException(e.getMessage(), e);
}
diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/composer/ComposerDependency.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/composer/ComposerDependency.java
index 09dd97d9a..2ab329abe 100644
--- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/composer/ComposerDependency.java
+++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/composer/ComposerDependency.java
@@ -18,7 +18,7 @@
package org.owasp.dependencycheck.data.composer;
/**
- * Reperesents a dependency (GAV, right now) from a Composer dependency.
+ * Represents a dependency (GAV, right now) from a Composer dependency.
*
* @author colezlaw
*/
diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/composer/ComposerLockParser.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/composer/ComposerLockParser.java
index 289163763..0803276d1 100644
--- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/composer/ComposerLockParser.java
+++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/composer/ComposerLockParser.java
@@ -42,11 +42,6 @@ public class ComposerLockParser {
*/
private final JsonReader jsonReader;
- /**
- * The input stream we'll read
- */
- private final InputStream inputStream; // NOPMD - it gets set in the constructor, read later
-
/**
* The List of ComposerDependencies found
*/
@@ -58,15 +53,14 @@ public class ComposerLockParser {
private static final Logger LOGGER = LoggerFactory.getLogger(ComposerLockParser.class);
/**
- * Createas a ComposerLockParser from a JsonReader and an InputStream.
+ * Creates a ComposerLockParser from a JsonReader and an InputStream.
*
* @param inputStream the InputStream to parse
*/
public ComposerLockParser(InputStream inputStream) {
LOGGER.info("Creating a ComposerLockParser");
- this.inputStream = inputStream;
this.jsonReader = Json.createReader(inputStream);
- this.composerDependencies = new ArrayList();
+ this.composerDependencies = new ArrayList<>();
}
/**
@@ -87,7 +81,7 @@ public class ComposerLockParser {
final String group = groupName.substring(0, groupName.indexOf('/'));
final String project = groupName.substring(groupName.indexOf('/') + 1);
String version = pkg.getString("version");
- // Some version nubmers begin with v - which doesn't end up matching CPE's
+ // Some version numbers begin with v - which doesn't end up matching CPE's
if (version.startsWith("v")) {
version = version.substring(1);
}
diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/cpe/CpeMemoryIndex.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/cpe/CpeMemoryIndex.java
index 3100c5ebc..fd2437d2b 100644
--- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/cpe/CpeMemoryIndex.java
+++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/cpe/CpeMemoryIndex.java
@@ -149,7 +149,7 @@ public final class CpeMemoryIndex {
* @return the CPE Analyzer.
*/
private Analyzer createSearchingAnalyzer() {
- final Map fieldAnalyzers = new HashMap();
+ final Map fieldAnalyzers = new HashMap<>();
fieldAnalyzers.put(Fields.DOCUMENT_KEY, new KeywordAnalyzer());
productFieldAnalyzer = new SearchFieldAnalyzer(LuceneUtils.CURRENT_VERSION);
vendorFieldAnalyzer = new SearchFieldAnalyzer(LuceneUtils.CURRENT_VERSION);
@@ -191,57 +191,35 @@ public final class CpeMemoryIndex {
* @throws IndexException thrown if there is an issue creating the index
*/
private void buildIndex(CveDB cve) throws IndexException {
- Analyzer analyzer = null;
- IndexWriter indexWriter = null;
- try {
- analyzer = createSearchingAnalyzer();
- final IndexWriterConfig conf = new IndexWriterConfig(LuceneUtils.CURRENT_VERSION, analyzer);
- indexWriter = new IndexWriter(index, conf);
- try {
- // Tip: reuse the Document and Fields for performance...
- // See "Re-use Document and Field instances" from
- // http://wiki.apache.org/lucene-java/ImproveIndexingSpeed
- final Document doc = new Document();
- final Field v = new TextField(Fields.VENDOR, Fields.VENDOR, Field.Store.YES);
- final Field p = new TextField(Fields.PRODUCT, Fields.PRODUCT, Field.Store.YES);
- doc.add(v);
- doc.add(p);
+ try (Analyzer analyzer = createSearchingAnalyzer();
+ IndexWriter indexWriter = new IndexWriter(index, new IndexWriterConfig(LuceneUtils.CURRENT_VERSION, analyzer))) {
+ // Tip: reuse the Document and Fields for performance...
+ // See "Re-use Document and Field instances" from
+ // http://wiki.apache.org/lucene-java/ImproveIndexingSpeed
+ final Document doc = new Document();
+ final Field v = new TextField(Fields.VENDOR, Fields.VENDOR, Field.Store.YES);
+ final Field p = new TextField(Fields.PRODUCT, Fields.PRODUCT, Field.Store.YES);
+ doc.add(v);
+ doc.add(p);
- final Set> data = cve.getVendorProductList();
- for (Pair pair : data) {
- //todo figure out why there are null products
- if (pair.getLeft() != null && pair.getRight() != null) {
- v.setStringValue(pair.getLeft());
- p.setStringValue(pair.getRight());
- indexWriter.addDocument(doc);
- resetFieldAnalyzer();
- }
+ final Set> data = cve.getVendorProductList();
+ for (Pair pair : data) {
+ if (pair.getLeft() != null && pair.getRight() != null) {
+ v.setStringValue(pair.getLeft());
+ p.setStringValue(pair.getRight());
+ indexWriter.addDocument(doc);
+ resetFieldAnalyzer();
}
- } catch (DatabaseException ex) {
- LOGGER.debug("", ex);
- throw new IndexException("Error reading CPE data", ex);
}
+ indexWriter.commit();
+ indexWriter.close(true);
+ } catch (DatabaseException ex) {
+ LOGGER.debug("", ex);
+ throw new IndexException("Error reading CPE data", ex);
} catch (CorruptIndexException ex) {
throw new IndexException("Unable to close an in-memory index", ex);
} catch (IOException ex) {
throw new IndexException("Unable to close an in-memory index", ex);
- } finally {
- if (indexWriter != null) {
- try {
- try {
- indexWriter.commit();
- } finally {
- indexWriter.close(true);
- }
- } catch (CorruptIndexException ex) {
- throw new IndexException("Unable to close an in-memory index", ex);
- } catch (IOException ex) {
- throw new IndexException("Unable to close an in-memory index", ex);
- }
- if (analyzer != null) {
- analyzer.close();
- }
- }
}
}
diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/cwe/CweDB.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/cwe/CweDB.java
index 30c50ab78..38aefd09e 100644
--- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/cwe/CweDB.java
+++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/cwe/CweDB.java
@@ -54,12 +54,10 @@ public final class CweDB {
* @return a HashMap of CWE data
*/
private static Map loadData() {
- ObjectInputStream oin = null;
- try {
- final String filePath = "data/cwe.hashmap.serialized";
- final InputStream input = CweDB.class.getClassLoader().getResourceAsStream(filePath);
- oin = new ObjectInputStream(input);
- @SuppressWarnings("unchecked")
+ final String filePath = "data/cwe.hashmap.serialized";
+ try (InputStream input = CweDB.class.getClassLoader().getResourceAsStream(filePath);
+ ObjectInputStream oin = new ObjectInputStream(input)) {
+
final Map ret = (HashMap) oin.readObject();
return ret;
} catch (ClassNotFoundException ex) {
@@ -68,14 +66,6 @@ public final class CweDB {
} catch (IOException ex) {
LOGGER.warn("Unable to load CWE data due to an IO Error. This should not be an issue.");
LOGGER.debug("", ex);
- } finally {
- if (oin != null) {
- try {
- oin.close();
- } catch (IOException ex) {
- LOGGER.trace("", ex);
- }
- }
}
return null;
}
diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/cwe/CweHandler.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/cwe/CweHandler.java
index e0d948b57..894aed93a 100644
--- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/cwe/CweHandler.java
+++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/cwe/CweHandler.java
@@ -32,7 +32,7 @@ public class CweHandler extends DefaultHandler {
/**
* a HashMap containing the CWE data.
*/
- private final HashMap cwe = new HashMap();
+ private final HashMap cwe = new HashMap<>();
/**
* Returns the HashMap of CWE entries (CWE-ID, Full CWE Name).
diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/lucene/AbstractTokenizingFilter.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/lucene/AbstractTokenizingFilter.java
index 2a0b20d6a..25e943378 100644
--- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/lucene/AbstractTokenizingFilter.java
+++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/lucene/AbstractTokenizingFilter.java
@@ -63,7 +63,7 @@ public abstract class AbstractTokenizingFilter extends TokenFilter {
*/
public AbstractTokenizingFilter(TokenStream stream) {
super(stream);
- tokens = new LinkedList();
+ tokens = new LinkedList<>();
}
/**
diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/lucene/TokenPairConcatenatingFilter.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/lucene/TokenPairConcatenatingFilter.java
index 4b36d3e01..22f6f369a 100644
--- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/lucene/TokenPairConcatenatingFilter.java
+++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/lucene/TokenPairConcatenatingFilter.java
@@ -71,7 +71,7 @@ public final class TokenPairConcatenatingFilter extends TokenFilter {
*/
public TokenPairConcatenatingFilter(TokenStream stream) {
super(stream);
- words = new LinkedList();
+ words = new LinkedList<>();
}
/**
diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nexus/NexusSearch.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nexus/NexusSearch.java
index c7f6b790b..09567475f 100644
--- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nexus/NexusSearch.java
+++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nexus/NexusSearch.java
@@ -22,7 +22,9 @@ import java.io.IOException;
import java.net.HttpURLConnection;
import java.net.URL;
import javax.xml.parsers.DocumentBuilder;
+import javax.xml.parsers.ParserConfigurationException;
import javax.xml.xpath.XPath;
+import javax.xml.xpath.XPathExpressionException;
import javax.xml.xpath.XPathFactory;
import org.owasp.dependencycheck.utils.URLConnectionFactory;
@@ -30,6 +32,7 @@ import org.owasp.dependencycheck.utils.XmlUtils;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.w3c.dom.Document;
+import org.xml.sax.SAXException;
/**
* Class of methods to search Nexus repositories.
@@ -132,7 +135,7 @@ public class NexusSearch {
ma.setPomUrl(pomLink);
}
return ma;
- } catch (Throwable e) {
+ } catch (ParserConfigurationException | IOException | SAXException | XPathExpressionException e) {
// Anything else is jacked-up XML stuff that we really can't recover
// from well
throw new IOException(e.getMessage(), e);
@@ -170,7 +173,7 @@ public class NexusSearch {
LOGGER.warn("Expected root node name of status, got {}", doc.getDocumentElement().getNodeName());
return false;
}
- } catch (Throwable e) {
+ } catch (IOException | ParserConfigurationException | SAXException e) {
return false;
}
diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nuget/XPathNuspecParser.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nuget/XPathNuspecParser.java
index bbf2ecd1d..fa91cb73f 100644
--- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nuget/XPathNuspecParser.java
+++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nuget/XPathNuspecParser.java
@@ -17,14 +17,18 @@
*/
package org.owasp.dependencycheck.data.nuget;
+import java.io.IOException;
import java.io.InputStream;
import javax.xml.parsers.DocumentBuilder;
+import javax.xml.parsers.ParserConfigurationException;
import javax.xml.xpath.XPath;
import javax.xml.xpath.XPathConstants;
+import javax.xml.xpath.XPathExpressionException;
import javax.xml.xpath.XPathFactory;
import org.owasp.dependencycheck.utils.XmlUtils;
import org.w3c.dom.Document;
import org.w3c.dom.Node;
+import org.xml.sax.SAXException;
/**
* Parse a Nuspec file using XPath.
@@ -78,7 +82,7 @@ public class XPathNuspecParser implements NuspecParser {
nuspec.setLicenseUrl(getOrNull((Node) xpath.evaluate("/package/metadata/licenseUrl", d, XPathConstants.NODE)));
nuspec.setTitle(getOrNull((Node) xpath.evaluate("/package/metadata/title", d, XPathConstants.NODE)));
return nuspec;
- } catch (Throwable e) {
+ } catch (ParserConfigurationException | SAXException | IOException | XPathExpressionException | NuspecParseException e) {
throw new NuspecParseException("Unable to parse nuspec", e);
}
}
diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nvdcve/ConnectionFactory.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nvdcve/ConnectionFactory.java
index a5918ca47..b901231b4 100644
--- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nvdcve/ConnectionFactory.java
+++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nvdcve/ConnectionFactory.java
@@ -342,7 +342,7 @@ public final class ConnectionFactory {
LOGGER.warn("A new version of dependency-check is available; consider upgrading");
Settings.setBoolean(Settings.KEYS.AUTO_UPDATE, false);
} else if (e0 == c0 && e1 == c1) {
- //do nothing - not sure how we got here, but just incase...
+ //do nothing - not sure how we got here, but just in case...
} else {
LOGGER.error("The database schema must be upgraded to use this version of dependency-check. Please see {} for more information.",
UPGRADE_HELP_URL);
diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nvdcve/CveDB.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nvdcve/CveDB.java
index 650f84a34..0a966a24b 100644
--- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nvdcve/CveDB.java
+++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nvdcve/CveDB.java
@@ -63,7 +63,7 @@ public final class CveDB {
/**
* Singleton instance of the CveDB.
*/
- private static CveDB INSTANCE = null;
+ private static CveDB instance = null;
/**
* The logger.
*/
@@ -81,11 +81,6 @@ public final class CveDB {
* table.
*/
private DatabaseProperties databaseProperties;
- /**
- * Does the underlying connection support batch operations? Currently we do
- * not support batch execution.
- */
- private final boolean batchSupported = false;
/**
* The prepared statements.
*/
@@ -96,27 +91,93 @@ public final class CveDB {
* statement bundles "dbStatements*.properties".
*/
enum PreparedStatementCveDb {
+ /**
+ * Key for SQL Statement.
+ */
CLEANUP_ORPHANS,
+ /**
+ * Key for SQL Statement.
+ */
COUNT_CPE,
+ /**
+ * Key for SQL Statement.
+ */
DELETE_REFERENCE,
+ /**
+ * Key for SQL Statement.
+ */
DELETE_SOFTWARE,
+ /**
+ * Key for SQL Statement.
+ */
DELETE_VULNERABILITY,
+ /**
+ * Key for SQL Statement.
+ */
INSERT_CPE,
+ /**
+ * Key for SQL Statement.
+ */
INSERT_PROPERTY,
+ /**
+ * Key for SQL Statement.
+ */
INSERT_REFERENCE,
+ /**
+ * Key for SQL Statement.
+ */
INSERT_SOFTWARE,
+ /**
+ * Key for SQL Statement.
+ */
INSERT_VULNERABILITY,
+ /**
+ * Key for SQL Statement.
+ */
MERGE_PROPERTY,
+ /**
+ * Key for SQL Statement.
+ */
SELECT_CPE_ENTRIES,
+ /**
+ * Key for SQL Statement.
+ */
SELECT_CPE_ID,
+ /**
+ * Key for SQL Statement.
+ */
SELECT_CVE_FROM_SOFTWARE,
+ /**
+ * Key for SQL Statement.
+ */
SELECT_PROPERTIES,
+ /**
+ * Key for SQL Statement.
+ */
SELECT_REFERENCES,
+ /**
+ * Key for SQL Statement.
+ */
SELECT_SOFTWARE,
+ /**
+ * Key for SQL Statement.
+ */
SELECT_VENDOR_PRODUCT_LIST,
+ /**
+ * Key for SQL Statement.
+ */
SELECT_VULNERABILITY,
+ /**
+ * Key for SQL Statement.
+ */
SELECT_VULNERABILITY_ID,
+ /**
+ * Key for SQL Statement.
+ */
UPDATE_PROPERTY,
+ /**
+ * Key for SQL Statement.
+ */
UPDATE_VULNERABILITY
}
@@ -126,11 +187,11 @@ public final class CveDB {
* @return the CveDB singleton
* @throws DatabaseException thrown if there is a database error
*/
- public synchronized static CveDB getInstance() throws DatabaseException {
- if (INSTANCE == null) {
- INSTANCE = new CveDB();
+ public static synchronized CveDB getInstance() throws DatabaseException {
+ if (instance == null) {
+ instance = new CveDB();
}
- return INSTANCE;
+ return instance;
}
/**
@@ -155,9 +216,9 @@ public final class CveDB {
*
* @return the product name of the database if successful, {@code null} else
*/
- private String determineDatabaseProductName() {
+ private synchronized String determineDatabaseProductName() {
try {
- final String databaseProductName = getConnection().getMetaData().getDatabaseProductName();
+ final String databaseProductName = connection.getMetaData().getDatabaseProductName();
LOGGER.debug("Database product: {}", databaseProductName);
return databaseProductName;
} catch (SQLException se) {
@@ -166,15 +227,6 @@ public final class CveDB {
}
}
- /**
- * Returns the database connection.
- *
- * @return the database connection
- */
- private Connection getConnection() {
- return connection;
- }
-
/**
* Opens the database connection. If the database does not exist, it will
* create a new one.
@@ -196,7 +248,7 @@ public final class CveDB {
if (isOpen()) {
closeStatements();
try {
- getConnection().close();
+ connection.close();
} catch (SQLException ex) {
LOGGER.error("There was an error attempting to close the CveDB, see the log for more details.");
LOGGER.debug("", ex);
@@ -205,7 +257,7 @@ public final class CveDB {
LOGGER.debug("", ex);
}
connection = null;
- INSTANCE = null;
+ instance = null;
}
}
@@ -215,7 +267,7 @@ public final class CveDB {
* @return whether the database connection is open or closed
*/
private boolean isOpen() {
- return getConnection() != null;
+ return connection != null;
}
/**
@@ -228,15 +280,15 @@ public final class CveDB {
private EnumMap prepareStatements()
throws DatabaseException {
- final EnumMap result = new EnumMap(PreparedStatementCveDb.class);
+ final EnumMap result = new EnumMap<>(PreparedStatementCveDb.class);
for (PreparedStatementCveDb key : values()) {
final String statementString = statementBundle.getString(key.name());
final PreparedStatement preparedStatement;
try {
if (key == INSERT_VULNERABILITY || key == INSERT_CPE) {
- preparedStatement = getConnection().prepareStatement(statementString, new String[]{"id"});
+ preparedStatement = connection.prepareStatement(statementString, new String[]{"id"});
} else {
- preparedStatement = getConnection().prepareStatement(statementString);
+ preparedStatement = connection.prepareStatement(statementString);
}
} catch (SQLException exception) {
throw new DatabaseException(exception);
@@ -277,7 +329,7 @@ public final class CveDB {
public synchronized void commit() throws SQLException {
//temporary remove this as autocommit is on.
//if (isOpen()) {
- // getConnection().commit();
+ // connection.commit();
//}
}
@@ -623,30 +675,15 @@ public final class CveDB {
}
final PreparedStatement insertReference = getPreparedStatement(INSERT_REFERENCE);
- if (batchSupported) {
- insertReference.clearBatch();
- }
for (Reference r : vuln.getReferences()) {
insertReference.setInt(1, vulnerabilityId);
insertReference.setString(2, r.getName());
insertReference.setString(3, r.getUrl());
insertReference.setString(4, r.getSource());
-
- if (batchSupported) {
- insertReference.addBatch();
- } else {
- insertReference.execute();
- }
- }
-
- if (batchSupported) {
- insertReference.executeBatch();
+ insertReference.execute();
}
final PreparedStatement insertSoftware = getPreparedStatement(INSERT_SOFTWARE);
- if (batchSupported) {
- insertSoftware.clearBatch();
- }
for (VulnerableSoftware s : vuln.getVulnerableSoftware()) {
int cpeProductId = 0;
final PreparedStatement selectCpeId = getPreparedStatement(SELECT_CPE_ID);
@@ -682,23 +719,17 @@ public final class CveDB {
} else {
insertSoftware.setString(3, s.getPreviousVersion());
}
- if (batchSupported) {
- insertSoftware.addBatch();
- } else {
- try {
- insertSoftware.execute();
- } catch (SQLException ex) {
- if (ex.getMessage().contains("Duplicate entry")) {
- final String msg = String.format("Duplicate software key identified in '%s:%s'", vuln.getName(), s.getName());
- LOGGER.info(msg, ex);
- } else {
- throw ex;
- }
+ try {
+ insertSoftware.execute();
+ } catch (SQLException ex) {
+ if (ex.getMessage().contains("Duplicate entry")) {
+ final String msg = String.format("Duplicate software key identified in '%s:%s'", vuln.getName(), s.getName());
+ LOGGER.info(msg, ex);
+ } else {
+ throw ex;
}
}
- }
- if (batchSupported) {
- insertSoftware.executeBatch();
+
}
} catch (SQLException ex) {
final String msg = String.format("Error updating '%s'", vuln.getName());
@@ -777,7 +808,7 @@ public final class CveDB {
final boolean isVersionTwoADifferentProduct = "apache".equals(vendor) && "struts".equals(product);
- final Set majorVersionsAffectingAllPrevious = new HashSet();
+ final Set majorVersionsAffectingAllPrevious = new HashSet<>();
final boolean matchesAnyPrevious = identifiedVersion == null || "-".equals(identifiedVersion.toString());
String majorVersionMatch = null;
for (Entry entry : vulnerableSoftware.entrySet()) {
@@ -806,12 +837,12 @@ public final class CveDB {
if (!entry.getValue()) {
final DependencyVersion v = parseDependencyVersion(entry.getKey());
//this can't dereference a null 'majorVersionMatch' as canSkipVersions accounts for this.
- if (canSkipVersions && !majorVersionMatch.equals(v.getVersionParts().get(0))) {
+ if (canSkipVersions && majorVersionMatch != null && !majorVersionMatch.equals(v.getVersionParts().get(0))) {
continue;
}
//this can't dereference a null 'identifiedVersion' because if it was null we would have exited
//in the above loop or just after loop (if matchesAnyPrevious return null).
- if (identifiedVersion.equals(v)) {
+ if (identifiedVersion != null && identifiedVersion.equals(v)) {
return entry;
}
}
@@ -820,12 +851,12 @@ public final class CveDB {
if (entry.getValue()) {
final DependencyVersion v = parseDependencyVersion(entry.getKey());
//this can't dereference a null 'majorVersionMatch' as canSkipVersions accounts for this.
- if (canSkipVersions && !majorVersionMatch.equals(v.getVersionParts().get(0))) {
+ if (canSkipVersions && majorVersionMatch != null && !majorVersionMatch.equals(v.getVersionParts().get(0))) {
continue;
}
//this can't dereference a null 'identifiedVersion' because if it was null we would have exited
//in the above loop or just after loop (if matchesAnyPrevious return null).
- if (entry.getValue() && identifiedVersion.compareTo(v) <= 0) {
+ if (entry.getValue() && identifiedVersion != null && identifiedVersion.compareTo(v) <= 0) {
if (!(isVersionTwoADifferentProduct && !identifiedVersion.getVersionParts().get(0).equals(v.getVersionParts().get(0)))) {
return entry;
}
@@ -884,10 +915,11 @@ public final class CveDB {
public synchronized void deleteUnusedCpe() {
PreparedStatement ps = null;
try {
- ps = getConnection().prepareStatement(statementBundle.getString("DELETE_UNUSED_DICT_CPE"));
+ ps = connection.prepareStatement(statementBundle.getString("DELETE_UNUSED_DICT_CPE"));
ps.executeUpdate();
} catch (SQLException ex) {
LOGGER.error("Unable to delete CPE dictionary entries", ex);
+ } finally {
DBUtils.closeStatement(ps);
}
}
@@ -905,13 +937,14 @@ public final class CveDB {
public synchronized void addCpe(String cpe, String vendor, String product) {
PreparedStatement ps = null;
try {
- ps = getConnection().prepareStatement(statementBundle.getString("ADD_DICT_CPE"));
+ ps = connection.prepareStatement(statementBundle.getString("ADD_DICT_CPE"));
ps.setString(1, cpe);
ps.setString(2, vendor);
ps.setString(3, product);
ps.executeUpdate();
} catch (SQLException ex) {
LOGGER.error("Unable to add CPE dictionary entry", ex);
+ } finally {
DBUtils.closeStatement(ps);
}
}
diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nvdcve/DatabaseProperties.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nvdcve/DatabaseProperties.java
index a3b2aa86c..ea690ba75 100644
--- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nvdcve/DatabaseProperties.java
+++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nvdcve/DatabaseProperties.java
@@ -166,7 +166,7 @@ public class DatabaseProperties {
* @return a map of the database meta data
*/
public Map getMetaData() {
- final Map map = new TreeMap();
+ final Map map = new TreeMap<>();
for (Entry entry : properties.entrySet()) {
final String key = (String) entry.getKey();
if (!"version".equals(key)) {
diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nvdcve/DriverLoader.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nvdcve/DriverLoader.java
index c2f792bc7..1c61fcde9 100644
--- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nvdcve/DriverLoader.java
+++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nvdcve/DriverLoader.java
@@ -75,7 +75,7 @@ public final class DriverLoader {
*/
public static Driver load(String className, String pathToDriver) throws DriverLoadException {
final URLClassLoader parent = (URLClassLoader) ClassLoader.getSystemClassLoader();
- final List urls = new ArrayList();
+ final List urls = new ArrayList<>();
final String[] paths = pathToDriver.split(File.pathSeparator);
for (String path : paths) {
final File file = new File(path);
@@ -129,19 +129,7 @@ public final class DriverLoader {
//using the DriverShim to get around the fact that the DriverManager won't register a driver not in the base class path
DriverManager.registerDriver(shim);
return shim;
- } catch (ClassNotFoundException ex) {
- final String msg = String.format("Unable to load database driver '%s'", className);
- LOGGER.debug(msg, ex);
- throw new DriverLoadException(msg, ex);
- } catch (InstantiationException ex) {
- final String msg = String.format("Unable to load database driver '%s'", className);
- LOGGER.debug(msg, ex);
- throw new DriverLoadException(msg, ex);
- } catch (IllegalAccessException ex) {
- final String msg = String.format("Unable to load database driver '%s'", className);
- LOGGER.debug(msg, ex);
- throw new DriverLoadException(msg, ex);
- } catch (SQLException ex) {
+ } catch (ClassNotFoundException | InstantiationException | IllegalAccessException | SQLException ex) {
final String msg = String.format("Unable to load database driver '%s'", className);
LOGGER.debug(msg, ex);
throw new DriverLoadException(msg, ex);
diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nvdcve/DriverShim.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nvdcve/DriverShim.java
index acd289498..9d5f04ff0 100644
--- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nvdcve/DriverShim.java
+++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nvdcve/DriverShim.java
@@ -126,11 +126,7 @@ class DriverShim implements Driver {
if (m != null) {
try {
return (java.util.logging.Logger) m.invoke(m);
- } catch (IllegalAccessException ex) {
- LOGGER.trace("", ex);
- } catch (IllegalArgumentException ex) {
- LOGGER.trace("", ex);
- } catch (InvocationTargetException ex) {
+ } catch (IllegalAccessException | IllegalArgumentException | InvocationTargetException ex) {
LOGGER.trace("", ex);
}
}
diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/update/CpeUpdater.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/update/CpeUpdater.java
index fbca59444..0178e2ffb 100644
--- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/update/CpeUpdater.java
+++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/update/CpeUpdater.java
@@ -16,7 +16,7 @@
* Copyright (c) 2015 Jeremy Long. All Rights Reserved.
*/
package org.owasp.dependencycheck.data.update;
-
+/*
import java.io.File;
import java.io.IOException;
import java.net.MalformedURLException;
@@ -37,7 +37,7 @@ import org.owasp.dependencycheck.utils.XmlUtils;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.xml.sax.SAXException;
-
+*/
/**
*
* This class is currently unused and if enabled will likely not work on MySQL
@@ -69,7 +69,7 @@ public class CpeUpdater { //extends BaseUpdater implements CachedWebDataSource {
// return;
// }
// } catch (InvalidSettingException ex) {
-// LOGGER.trace("inavlid setting UPDATE_NVDCVE_ENABLED", ex);
+// LOGGER.trace("invalid setting UPDATE_NVDCVE_ENABLED", ex);
// }
// */
//
diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/update/EngineVersionCheck.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/update/EngineVersionCheck.java
index 436e4b89e..ad25e6ae4 100644
--- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/update/EngineVersionCheck.java
+++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/update/EngineVersionCheck.java
@@ -98,7 +98,7 @@ public class EngineVersionCheck implements CachedWebDataSource {
final boolean enabled = Settings.getBoolean(Settings.KEYS.UPDATE_VERSION_CHECK_ENABLED, true);
final String original = Settings.getString(Settings.KEYS.CVE_ORIGINAL_MODIFIED_20_URL);
final String current = Settings.getString(Settings.KEYS.CVE_MODIFIED_20_URL);
- /**
+ /*
* Only update if auto-update is enabled, the engine check is
* enabled, and the NVD CVE URLs have not been modified (i.e. the
* user has not configured them to point to an internal source).
diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/update/NvdCveUpdater.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/update/NvdCveUpdater.java
index caebce05f..80ebb1bf6 100644
--- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/update/NvdCveUpdater.java
+++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/update/NvdCveUpdater.java
@@ -30,6 +30,7 @@ import java.util.concurrent.ExecutorService;
import java.util.concurrent.Executors;
import java.util.concurrent.Future;
import java.util.concurrent.TimeUnit;
+import java.util.concurrent.TimeoutException;
import org.owasp.dependencycheck.data.nvdcve.CveDB;
import org.owasp.dependencycheck.data.nvdcve.DatabaseException;
import org.owasp.dependencycheck.data.nvdcve.DatabaseProperties;
@@ -77,7 +78,13 @@ public class NvdCveUpdater implements CachedWebDataSource {
*/
private ExecutorService downloadExecutorService = null;
+ /**
+ * Reference to the DAO.
+ */
private CveDB cveDb = null;
+ /**
+ * The properties obtained from the database.
+ */
private DatabaseProperties dbProperties = null;
/**
@@ -135,6 +142,10 @@ public class NvdCveUpdater implements CachedWebDataSource {
}
}
+ /**
+ * Initialize the executor services for download and processing of the NVD
+ * CVE XML data.
+ */
protected void initializeExecutorServices() {
processingExecutorService = Executors.newFixedThreadPool(PROCESSING_THREAD_POOL_SIZE);
downloadExecutorService = Executors.newFixedThreadPool(DOWNLOAD_THREAD_POOL_SIZE);
@@ -142,6 +153,9 @@ public class NvdCveUpdater implements CachedWebDataSource {
LOGGER.debug("#processing threads: {}", PROCESSING_THREAD_POOL_SIZE);
}
+ /**
+ * Shutdown and cleanup of resources used by the executor services.
+ */
private void shutdownExecutorServices() {
if (processingExecutorService != null) {
processingExecutorService.shutdownNow();
@@ -426,7 +440,7 @@ public class NvdCveUpdater implements CachedWebDataSource {
final long timestamp;
try {
timestamp = timestampFuture.get(60, TimeUnit.SECONDS);
- } catch (Exception e) {
+ } catch (InterruptedException | ExecutionException | TimeoutException e) {
throw new DownloadFailedException(e);
}
lastModifiedDates.put(url, timestamp);
@@ -440,8 +454,16 @@ public class NvdCveUpdater implements CachedWebDataSource {
*/
private static class TimestampRetriever implements Callable {
- private String url;
+ /**
+ * The URL to obtain the timestamp from.
+ */
+ private final String url;
+ /**
+ * Instantiates a new timestamp retriever object.
+ *
+ * @param url the URL to hit
+ */
TimestampRetriever(String url) {
this.url = url;
}
diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/update/cpe/CPEHandler.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/update/cpe/CPEHandler.java
index 4c778e7b2..123d326cc 100644
--- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/update/cpe/CPEHandler.java
+++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/update/cpe/CPEHandler.java
@@ -30,7 +30,7 @@ import org.xml.sax.SAXException;
import org.xml.sax.helpers.DefaultHandler;
/**
- * A SAX Handler that will parse the CPE XML and load it into the databse.
+ * A SAX Handler that will parse the CPE XML and load it into the database.
*
* @author Jeremy Long
*/
@@ -60,7 +60,7 @@ public class CPEHandler extends DefaultHandler {
/**
* The list of CPE values.
*/
- private final List data = new ArrayList();
+ private final List data = new ArrayList<>();
/**
* Returns the list of CPE values.
@@ -154,35 +154,10 @@ public class CPEHandler extends DefaultHandler {
public void endElement(String uri, String localName, String qName) throws SAXException {
current.setNode(qName);
if (current.isSchemaVersionNode() && !CURRENT_SCHEMA_VERSION.equals(nodeText.toString())) {
- throw new SAXException("ERROR: Unexpecgted CPE Schema Version, expected: "
+ throw new SAXException("ERROR: Unexpected CPE Schema Version, expected: "
+ CURRENT_SCHEMA_VERSION + ", file is: " + nodeText);
}
-// } else if (current.isCpeItemNode()) {
-// //do nothing
-// } else if (current.isTitleNode()) {
-// //do nothing
-// } else if (current.isCpeListNode()) {
-// //do nothing
-// } else if (current.isMetaNode()) {
-// //do nothing
-// } else if (current.isNotesNode()) {
-// //do nothing
-// } else if (current.isNoteNode()) {
-// //do nothing
-// } else if (current.isCheckNode()) {
-// //do nothing
-// } else if (current.isGeneratorNode()) {
-// //do nothing
-// } else if (current.isProductNameNode()) {
-// //do nothing
-// } else if (current.isProductVersionNode()) {
-// //do nothing
-// else if (current.isTimestampNode()) {
-// //do nothing
-// } else {
-// throw new SAXException("ERROR STATE: Unexpected qName '" + qName + "'");
-// }
}
//
diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/update/nvd/DownloadTask.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/update/nvd/DownloadTask.java
index 59eb331a4..f291afcd6 100644
--- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/update/nvd/DownloadTask.java
+++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/update/nvd/DownloadTask.java
@@ -19,7 +19,6 @@ package org.owasp.dependencycheck.data.update.nvd;
import java.io.File;
import java.io.FileInputStream;
-import java.io.FileNotFoundException;
import java.io.IOException;
import java.io.InputStream;
import java.net.URL;
@@ -224,33 +223,19 @@ public class DownloadTask implements Callable> {
if (file == null || !file.isFile()) {
return false;
}
- InputStream is = null;
- try {
- is = new FileInputStream(file);
-
+ try (InputStream is = new FileInputStream(file)) {
final byte[] buf = new byte[5];
- int read = 0;
- try {
- read = is.read(buf);
- } catch (IOException ex) {
- return false;
- }
+ int read;
+ read = is.read(buf);
return read == 5
&& buf[0] == '<'
&& (buf[1] == '?')
&& (buf[2] == 'x' || buf[2] == 'X')
&& (buf[3] == 'm' || buf[3] == 'M')
&& (buf[4] == 'l' || buf[4] == 'L');
- } catch (FileNotFoundException ex) {
+ } catch (IOException ex) {
+ LOGGER.debug("Error checking if file is xml", ex);
return false;
- } finally {
- if (is != null) {
- try {
- is.close();
- } catch (IOException ex) {
- LOGGER.debug("Error closing stream", ex);
- }
- }
}
}
}
diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/update/nvd/NvdCve12Handler.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/update/nvd/NvdCve12Handler.java
index c47d5ddde..7adfbb18c 100644
--- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/update/nvd/NvdCve12Handler.java
+++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/update/nvd/NvdCve12Handler.java
@@ -93,7 +93,7 @@ public class NvdCve12Handler extends DefaultHandler {
skip = "1".equals(reject);
if (!skip) {
vulnerability = attributes.getValue("name");
- software = new ArrayList();
+ software = new ArrayList<>();
} else {
vulnerability = null;
software = null;
@@ -132,7 +132,7 @@ public class NvdCve12Handler extends DefaultHandler {
if (!CURRENT_SCHEMA_VERSION.equals(nvdVer)) {
throw new SAXNotSupportedException("Schema version " + nvdVer + " is not supported");
}
- vulnerabilities = new HashMap>();
+ vulnerabilities = new HashMap<>();
}
}
diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/update/nvd/NvdCve20Handler.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/update/nvd/NvdCve20Handler.java
index 96b64de9d..2a5b8bf80 100644
--- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/update/nvd/NvdCve20Handler.java
+++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/update/nvd/NvdCve20Handler.java
@@ -51,7 +51,8 @@ public class NvdCve20Handler extends DefaultHandler {
*/
private static final String CURRENT_SCHEMA_VERSION = "2.0";
/**
- * a possible attribute value of the {@link AttributeValues#XML_LANG} attribute
+ * a possible attribute value of the {@link AttributeValues#XML_LANG}
+ * attribute
*/
private static final String EN = "en";
/**
@@ -97,7 +98,8 @@ public class NvdCve20Handler extends DefaultHandler {
private CveDB cveDB;
/**
- * A list of CVE entries and associated VulnerableSoftware entries that contain previous entries.
+ * A list of CVE entries and associated VulnerableSoftware entries that
+ * contain previous entries.
*/
private Map> prevVersionVulnMap;
@@ -109,7 +111,7 @@ public class NvdCve20Handler extends DefaultHandler {
public int getTotalNumberOfEntries() {
return totalNumberOfEntries;
}
-
+
/**
* Get the value of totalNumberOfApplicationEntries.
*
@@ -182,9 +184,7 @@ public class NvdCve20Handler extends DefaultHandler {
totalNumberOfApplicationEntries += 1;
try {
saveEntry(vulnerability);
- } catch (DatabaseException ex) {
- throw new SAXException(ex);
- } catch (CorruptIndexException ex) {
+ } catch (DatabaseException | CorruptIndexException ex) {
throw new SAXException(ex);
} catch (IOException ex) {
throw new SAXException(ex);
@@ -251,10 +251,12 @@ public class NvdCve20Handler extends DefaultHandler {
public void setCveDB(CveDB db) {
cveDB = db;
}
+
/**
* Sets the prevVersionVulnMap.
*
- * @param map the map of vulnerable software with previous versions being vulnerable
+ * @param map the map of vulnerable software with previous versions being
+ * vulnerable
*/
public void setPrevVersionVulnMap(Map> map) {
prevVersionVulnMap = map;
@@ -264,7 +266,8 @@ public class NvdCve20Handler extends DefaultHandler {
* Saves a vulnerability to the CVE Database.
*
* @param vuln the vulnerability to store in the database
- * @throws DatabaseException thrown if there is an error writing to the database
+ * @throws DatabaseException thrown if there is an error writing to the
+ * database
* @throws CorruptIndexException is thrown if the CPE Index is corrupt
* @throws IOException thrown if there is an IOException with the CPE Index
*/
@@ -283,7 +286,8 @@ public class NvdCve20Handler extends DefaultHandler {
//
/**
- * A simple class to maintain information about the current element while parsing the NVD CVE XML.
+ * A simple class to maintain information about the current element while
+ * parsing the NVD CVE XML.
*/
protected static class Element {
@@ -508,7 +512,8 @@ public class NvdCve20Handler extends DefaultHandler {
//
/**
- * A simple class to maintain information about the attribute values encountered while parsing the NVD CVE XML.
+ * A simple class to maintain information about the attribute values
+ * encountered while parsing the NVD CVE XML.
*/
protected static class AttributeValues {
diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/update/nvd/ProcessTask.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/update/nvd/ProcessTask.java
index 20f64e804..d9c4f26f1 100644
--- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/update/nvd/ProcessTask.java
+++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/update/nvd/ProcessTask.java
@@ -18,7 +18,6 @@
package org.owasp.dependencycheck.data.update.nvd;
import java.io.File;
-import java.io.FileNotFoundException;
import java.io.IOException;
import java.sql.SQLException;
import java.util.List;
@@ -167,19 +166,7 @@ public class ProcessTask implements Callable {
importXML(filePair.getFirst(), filePair.getSecond());
cveDB.commit();
properties.save(filePair.getNvdCveInfo());
- } catch (FileNotFoundException ex) {
- throw new UpdateException(ex);
- } catch (ParserConfigurationException ex) {
- throw new UpdateException(ex);
- } catch (SAXException ex) {
- throw new UpdateException(ex);
- } catch (IOException ex) {
- throw new UpdateException(ex);
- } catch (SQLException ex) {
- throw new UpdateException(ex);
- } catch (DatabaseException ex) {
- throw new UpdateException(ex);
- } catch (ClassNotFoundException ex) {
+ } catch (ParserConfigurationException | SAXException | SQLException | DatabaseException | ClassNotFoundException | IOException ex) {
throw new UpdateException(ex);
} finally {
filePair.cleanup();
diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/update/nvd/UpdateableNvdCve.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/update/nvd/UpdateableNvdCve.java
index 4287bba4d..e086f2fae 100644
--- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/update/nvd/UpdateableNvdCve.java
+++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/update/nvd/UpdateableNvdCve.java
@@ -33,7 +33,7 @@ public class UpdateableNvdCve implements Iterable, Iterator collection = new TreeMap();
+ private final Map collection = new TreeMap<>();
/**
* Returns the collection of NvdCveInfo objects. This method is mainly used for testing.
diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/dependency/Dependency.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/dependency/Dependency.java
index fe442ee3a..9d7662ebb 100644
--- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/dependency/Dependency.java
+++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/dependency/Dependency.java
@@ -128,15 +128,15 @@ public class Dependency implements Serializable, Comparable {
/**
* A collection of related dependencies.
*/
- private Set relatedDependencies = new TreeSet();
+ private Set relatedDependencies = new TreeSet<>();
/**
* A list of projects that reference this dependency.
*/
- private Set projectReferences = new HashSet();
+ private Set projectReferences = new HashSet<>();
/**
* A list of available versions.
*/
- private List availableVersions = new ArrayList();
+ private List availableVersions = new ArrayList<>();
/**
* Returns the package path.
@@ -598,7 +598,7 @@ public class Dependency implements Serializable, Comparable {
LOGGER.warn("Unable to read '{}' to determine hashes.", file.getName());
LOGGER.debug("", ex);
} catch (NoSuchAlgorithmException ex) {
- LOGGER.warn("Unable to use MD5 of SHA1 checksums.");
+ LOGGER.warn("Unable to use MD5 or SHA1 checksums.");
LOGGER.debug("", ex);
}
this.setMd5sum(md5);
diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/dependency/EvidenceCollection.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/dependency/EvidenceCollection.java
index 2590f0cbb..fb45480b0 100644
--- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/dependency/EvidenceCollection.java
+++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/dependency/EvidenceCollection.java
@@ -114,23 +114,27 @@ public class EvidenceCollection implements Serializable, Iterable {
* @return Iterable<Evidence> an iterable collection of evidence
*/
public final Iterable iterator(Confidence confidence) {
- if (confidence == Confidence.HIGHEST) {
- return EvidenceCollection.HIGHEST_CONFIDENCE.filter(this.list);
- } else if (confidence == Confidence.HIGH) {
- return EvidenceCollection.HIGH_CONFIDENCE.filter(this.list);
- } else if (confidence == Confidence.MEDIUM) {
- return EvidenceCollection.MEDIUM_CONFIDENCE.filter(this.list);
- } else {
- return EvidenceCollection.LOW_CONFIDENCE.filter(this.list);
+ if (null != confidence) {
+ switch (confidence) {
+ case HIGHEST:
+ return EvidenceCollection.HIGHEST_CONFIDENCE.filter(this.list);
+ case HIGH:
+ return EvidenceCollection.HIGH_CONFIDENCE.filter(this.list);
+ case MEDIUM:
+ return EvidenceCollection.MEDIUM_CONFIDENCE.filter(this.list);
+ default:
+ return EvidenceCollection.LOW_CONFIDENCE.filter(this.list);
+ }
}
+ return null;
}
/**
* Creates a new EvidenceCollection.
*/
public EvidenceCollection() {
- list = new TreeSet();
- weightedStrings = new HashSet();
+ list = new TreeSet<>();
+ weightedStrings = new HashSet<>();
}
/**
@@ -204,7 +208,7 @@ public class EvidenceCollection implements Serializable, Iterable {
if (source == null) {
return null;
}
- final Set ret = new HashSet();
+ final Set ret = new HashSet<>();
for (Evidence e : list) {
if (source.equals(e.getSource())) {
ret.add(e);
@@ -224,7 +228,7 @@ public class EvidenceCollection implements Serializable, Iterable {
if (source == null || name == null) {
return null;
}
- final Set ret = new HashSet();
+ final Set ret = new HashSet<>();
for (Evidence e : list) {
if (source.equals(e.getSource()) && name.equals(e.getName())) {
ret.add(e);
@@ -345,7 +349,7 @@ public class EvidenceCollection implements Serializable, Iterable {
* collections
*/
public static Set mergeForDisplay(EvidenceCollection... ec) {
- final Set ret = new TreeSet();
+ final Set ret = new TreeSet<>();
for (EvidenceCollection col : ec) {
for (Evidence e : col) {
//if (e.isUsed()) {
@@ -393,10 +397,10 @@ public class EvidenceCollection implements Serializable, Iterable {
*
*
* Example, given the following input:
- * 'Please visit https://www.somedomain.com/path1/path2/file.php?id=439'
+ * 'Please visit https://www.owasp.com/path1/path2/file.php?id=439'
*
* The function would return:
- * 'Please visit somedomain path1 path2 file'
+ * 'Please visit owasp path1 path2 file'
*
* @param value the value that may contain a url
* @return the modified string
diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/dependency/Vulnerability.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/dependency/Vulnerability.java
index b03001a53..8d14cd9b8 100644
--- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/dependency/Vulnerability.java
+++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/dependency/Vulnerability.java
@@ -47,11 +47,11 @@ public class Vulnerability implements Serializable, Comparable {
/**
* References for this vulnerability.
*/
- private Set references = new HashSet();
+ private Set references = new HashSet<>();
/**
* A set of vulnerable software.
*/
- private Set vulnerableSoftware = new HashSet();
+ private Set vulnerableSoftware = new HashSet<>();
/**
* The CWE for the vulnerability.
*/
@@ -153,7 +153,7 @@ public class Vulnerability implements Serializable, Comparable {
* @return the list of references
*/
public List getReferences(boolean sorted) {
- List sortedRefs = new ArrayList<>(this.references);
+ final List sortedRefs = new ArrayList<>(this.references);
if (sorted) {
Collections.sort(sortedRefs);
}
@@ -210,7 +210,7 @@ public class Vulnerability implements Serializable, Comparable {
* @return the list of vulnerable software
*/
public List getVulnerableSoftware(boolean sorted) {
- List sortedVulnerableSoftware = new ArrayList<>(this.vulnerableSoftware);
+ final List sortedVulnerableSoftware = new ArrayList<>(this.vulnerableSoftware);
if (sorted) {
Collections.sort(sortedVulnerableSoftware);
}
@@ -516,4 +516,4 @@ public class Vulnerability implements Serializable, Comparable {
public boolean hasMatchedAllPreviousCPE() {
return matchedAllPreviousCPE != null;
}
-}
\ No newline at end of file
+}
diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/exception/ExceptionCollection.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/exception/ExceptionCollection.java
index de8dfbcd8..e7bf7e9dd 100644
--- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/exception/ExceptionCollection.java
+++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/exception/ExceptionCollection.java
@@ -35,7 +35,7 @@ public class ExceptionCollection extends Exception {
/**
* A collection of exceptions.
*/
- private List exceptions;
+ private final List exceptions;
/**
* Flag indicating if a fatal exception occurred that would prevent the
* attempt at completing the analysis even if exceptions occurred.
@@ -99,7 +99,7 @@ public class ExceptionCollection extends Exception {
*/
public ExceptionCollection(Throwable exceptions, boolean fatal) {
super();
- this.exceptions = new ArrayList();
+ this.exceptions = new ArrayList<>();
this.exceptions.add(exceptions);
this.fatal = fatal;
}
diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/reporting/ReportGenerator.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/reporting/ReportGenerator.java
index e56f4fc75..a97aef3fa 100644
--- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/reporting/ReportGenerator.java
+++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/reporting/ReportGenerator.java
@@ -240,55 +240,39 @@ public class ReportGenerator {
InputStream input = null;
String templatePath = null;
final File f = new File(templateName);
- if (f.exists() && f.isFile()) {
- try {
- templatePath = templateName;
- input = new FileInputStream(f);
- } catch (FileNotFoundException ex) {
- throw new ReportException("Unable to locate template file: " + templateName, ex);
- }
- } else {
- templatePath = "templates/" + templateName + ".vsl";
- input = this.getClass().getClassLoader().getResourceAsStream(templatePath);
- }
- if (input == null) {
- throw new ReportException("Template file doesn't exist: " + templatePath);
- }
-
- InputStreamReader reader = null;
- OutputStreamWriter writer = null;
-
try {
- reader = new InputStreamReader(input, "UTF-8");
- writer = new OutputStreamWriter(outputStream, "UTF-8");
- if (!velocityEngine.evaluate(context, writer, templatePath, reader)) {
- throw new ReportException("Failed to convert the template into html.");
+ if (f.exists() && f.isFile()) {
+ try {
+ templatePath = templateName;
+ input = new FileInputStream(f);
+ } catch (FileNotFoundException ex) {
+ throw new ReportException("Unable to locate template file: " + templateName, ex);
+ }
+ } else {
+ templatePath = "templates/" + templateName + ".vsl";
+ input = this.getClass().getClassLoader().getResourceAsStream(templatePath);
+ }
+ if (input == null) {
+ throw new ReportException("Template file doesn't exist: " + templatePath);
+ }
+
+ try (InputStreamReader reader = new InputStreamReader(input, "UTF-8");
+ OutputStreamWriter writer = new OutputStreamWriter(outputStream, "UTF-8")) {
+ if (!velocityEngine.evaluate(context, writer, templatePath, reader)) {
+ throw new ReportException("Failed to convert the template into html.");
+ }
+ writer.flush();
+ } catch (UnsupportedEncodingException ex) {
+ throw new ReportException("Unable to generate the report using UTF-8", ex);
+ } catch (IOException ex) {
+ throw new ReportException("Unable to write the report", ex);
}
- writer.flush();
- } catch (UnsupportedEncodingException ex) {
- throw new ReportException("Unable to generate the report using UTF-8", ex);
- } catch (IOException ex) {
- throw new ReportException("Unable to write the report", ex);
} finally {
- if (writer != null) {
+ if (input != null) {
try {
- writer.close();
+ input.close();
} catch (IOException ex) {
- LOGGER.trace("", ex);
- }
- }
- if (outputStream != null) {
- try {
- outputStream.close();
- } catch (IOException ex) {
- LOGGER.trace("", ex);
- }
- }
- if (reader != null) {
- try {
- reader.close();
- } catch (IOException ex) {
- LOGGER.trace("", ex);
+ LOGGER.trace("Error closing input", ex);
}
}
}
@@ -315,21 +299,10 @@ public class ReportGenerator {
throw new ReportException("Unable to create directory '" + outFile.getParentFile().getAbsolutePath() + "'.");
}
}
-
- OutputStream outputSteam = null;
- try {
- outputSteam = new FileOutputStream(outFile);
+ try (OutputStream outputSteam = new FileOutputStream(outFile)) {
generateReport(templateName, outputSteam);
- } catch (FileNotFoundException ex) {
+ } catch (IOException ex) {
throw new ReportException("Unable to write to file: " + outFile, ex);
- } finally {
- if (outputSteam != null) {
- try {
- outputSteam.close();
- } catch (IOException ex) {
- LOGGER.trace("ignore", ex);
- }
- }
}
}
-}
\ No newline at end of file
+}
diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/utils/DBUtils.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/utils/DBUtils.java
index c27c4b7d4..3dd1042fc 100644
--- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/utils/DBUtils.java
+++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/utils/DBUtils.java
@@ -47,7 +47,8 @@ public final class DBUtils {
*
* @param statement a prepared statement that just executed an insert
* @return a primary key
- * @throws DatabaseException thrown if there is an exception obtaining the key
+ * @throws DatabaseException thrown if there is an exception obtaining the
+ * key
*/
public static int getGeneratedKey(PreparedStatement statement) throws DatabaseException {
ResultSet rs = null;
@@ -72,27 +73,29 @@ public final class DBUtils {
* @param statement a Statement object
*/
public static void closeStatement(Statement statement) {
- if (statement != null) {
- try {
+ try {
+ if (statement != null && !statement.isClosed()) {
+
statement.close();
- } catch (SQLException ex) {
- LOGGER.trace(statement.toString(), ex);
}
+ } catch (SQLException ex) {
+ LOGGER.trace(statement.toString(), ex);
}
}
/**
- * Closes the result set capturing and ignoring any SQLExceptions that occur.
+ * Closes the result set capturing and ignoring any SQLExceptions that
+ * occur.
*
* @param rs a ResultSet to close
*/
public static void closeResultSet(ResultSet rs) {
- if (rs != null) {
- try {
+ try {
+ if (rs != null && !rs.isClosed()) {
rs.close();
- } catch (SQLException ex) {
- LOGGER.trace(rs.toString(), ex);
}
+ } catch (SQLException ex) {
+ LOGGER.trace(rs.toString(), ex);
}
}
}
diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/utils/DependencyVersion.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/utils/DependencyVersion.java
index f25c76a24..ff8bf15c8 100644
--- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/utils/DependencyVersion.java
+++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/utils/DependencyVersion.java
@@ -66,7 +66,7 @@ public class DependencyVersion implements Iterable, Comparable();
+ versionParts = new ArrayList<>();
if (version != null) {
final Pattern rx = Pattern.compile("(\\d+[a-z]{1,3}$|[a-z]+\\d+|\\d+|(release|beta|alpha)$)");
final Matcher matcher = rx.matcher(version.toLowerCase());
diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/utils/DependencyVersionUtil.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/utils/DependencyVersionUtil.java
index 61e88a820..b4ac9cbd6 100644
--- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/utils/DependencyVersionUtil.java
+++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/utils/DependencyVersionUtil.java
@@ -74,7 +74,7 @@ public final class DependencyVersionUtil {
//'-' is a special case used within the CVE entries, just include it as the version.
if ("-".equals(text)) {
final DependencyVersion dv = new DependencyVersion();
- final List list = new ArrayList();
+ final List list = new ArrayList<>();
list.add(text);
dv.setVersionParts(list);
return dv;
diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/utils/ExtractionUtil.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/utils/ExtractionUtil.java
index 9b137b5f6..fe4b07666 100644
--- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/utils/ExtractionUtil.java
+++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/utils/ExtractionUtil.java
@@ -85,18 +85,10 @@ public final class ExtractionUtil {
return;
}
- FileInputStream fis = null;
- ZipInputStream zis = null;
-
- try {
- fis = new FileInputStream(archive);
- } catch (FileNotFoundException ex) {
- LOGGER.debug("", ex);
- throw new ExtractionException("Archive file was not found.", ex);
- }
- zis = new ZipInputStream(new BufferedInputStream(fis));
ZipEntry entry;
- try {
+ try (FileInputStream fis = new FileInputStream(archive);
+ BufferedInputStream bis = new BufferedInputStream(fis);
+ ZipInputStream zis = new ZipInputStream(bis)) {
while ((entry = zis.getNextEntry()) != null) {
if (entry.isDirectory()) {
final File d = new File(extractTo, entry.getName());
@@ -107,9 +99,7 @@ public final class ExtractionUtil {
} else {
final File file = new File(extractTo, entry.getName());
if (engine == null || engine.accept(file)) {
- FileOutputStream fos = null;
- try {
- fos = new FileOutputStream(file);
+ try (FileOutputStream fos = new FileOutputStream(file)) {
IOUtils.copy(zis, fos);
} catch (FileNotFoundException ex) {
LOGGER.debug("", ex);
@@ -119,8 +109,6 @@ public final class ExtractionUtil {
LOGGER.debug("", ex);
final String msg = String.format("IO Exception while parsing file '%s'.", file.getName());
throw new ExtractionException(msg, ex);
- } finally {
- FileUtils.close(fos);
}
}
}
@@ -129,8 +117,6 @@ public final class ExtractionUtil {
final String msg = String.format("Exception reading archive '%s'.", archive.getName());
LOGGER.debug("", ex);
throw new ExtractionException(msg, ex);
- } finally {
- FileUtils.close(zis);
}
}
@@ -142,31 +128,21 @@ public final class ExtractionUtil {
* @param filter determines which files get extracted
* @throws ExtractionException thrown if the archive is not found
*/
- public static void extractFilesUsingFilter(File archive, File destination,
- FilenameFilter filter) throws ExtractionException {
+ public static void extractFilesUsingFilter(File archive, File destination, FilenameFilter filter) throws ExtractionException {
if (archive == null || destination == null) {
return;
}
- FileInputStream fis = null;
- try {
- fis = new FileInputStream(archive);
+ try (FileInputStream fis = new FileInputStream(archive)) {
+ extractArchive(new ZipArchiveInputStream(new BufferedInputStream(
+ fis)), destination, filter);
} catch (FileNotFoundException ex) {
LOGGER.debug("", ex);
throw new ExtractionException("Archive file was not found.", ex);
- }
- try {
- extractArchive(new ZipArchiveInputStream(new BufferedInputStream(
- fis)), destination, filter);
- } catch (ArchiveExtractionException ex) {
+ } catch (IOException | ArchiveExtractionException ex) {
LOGGER.warn("Exception extracting archive '{}'.", archive.getName());
LOGGER.debug("", ex);
- } finally {
- try {
- fis.close();
- } catch (IOException ex) {
- LOGGER.debug("", ex);
- }
+ throw new ExtractionException("Unable to extract from archive", ex);
}
}
@@ -197,9 +173,7 @@ public final class ExtractionUtil {
extractFile(input, destination, filter, entry);
}
}
- } catch (IOException ex) {
- throw new ArchiveExtractionException(ex);
- } catch (Throwable ex) {
+ } catch (IOException | AnalysisException ex) {
throw new ArchiveExtractionException(ex);
} finally {
FileUtils.close(input);
@@ -221,26 +195,19 @@ public final class ExtractionUtil {
FilenameFilter filter, ArchiveEntry entry) throws ExtractionException {
final File file = new File(destination, entry.getName());
if (filter.accept(file.getParentFile(), file.getName())) {
- LOGGER.debug("Extracting '{}'",
- file.getPath());
- FileOutputStream fos = null;
- try {
- createParentFile(file);
- fos = new FileOutputStream(file);
+ LOGGER.debug("Extracting '{}'", file.getPath());
+ createParentFile(file);
+
+ try (FileOutputStream fos = new FileOutputStream(file)) {
IOUtils.copy(input, fos);
} catch (FileNotFoundException ex) {
LOGGER.debug("", ex);
- final String msg = String.format("Unable to find file '%s'.",
- file.getName());
+ final String msg = String.format("Unable to find file '%s'.", file.getName());
throw new ExtractionException(msg, ex);
} catch (IOException ex) {
LOGGER.debug("", ex);
- final String msg = String
- .format("IO Exception while parsing file '%s'.",
- file.getName());
+ final String msg = String.format("IO Exception while parsing file '%s'.", file.getName());
throw new ExtractionException(msg, ex);
- } finally {
- FileUtils.close(fos);
}
}
}
@@ -253,8 +220,7 @@ public final class ExtractionUtil {
* @throws ExtractionException thrown if the parent paths could not be
* created
*/
- private static void createParentFile(final File file)
- throws ExtractionException {
+ private static void createParentFile(final File file) throws ExtractionException {
final File parent = file.getParentFile();
if (!parent.isDirectory() && !parent.mkdirs()) {
final String msg = String.format(
@@ -282,35 +248,11 @@ public final class ExtractionUtil {
if (!file.renameTo(gzip)) {
throw new IOException("Unable to rename '" + file.getPath() + "'");
}
- final File newfile = new File(originalPath);
-
- final byte[] buffer = new byte[4096];
-
- GZIPInputStream cin = null;
- FileOutputStream out = null;
- try {
- cin = new GZIPInputStream(new FileInputStream(gzip));
- out = new FileOutputStream(newfile);
-
- int len;
- while ((len = cin.read(buffer)) > 0) {
- out.write(buffer, 0, len);
- }
+ final File newFile = new File(originalPath);
+ try (GZIPInputStream cin = new GZIPInputStream(new FileInputStream(gzip));
+ FileOutputStream out = new FileOutputStream(newFile)) {
+ IOUtils.copy(cin, out);
} finally {
- if (cin != null) {
- try {
- cin.close();
- } catch (IOException ex) {
- LOGGER.trace("ignore", ex);
- }
- }
- if (out != null) {
- try {
- out.close();
- } catch (IOException ex) {
- LOGGER.trace("ignore", ex);
- }
- }
if (gzip.isFile() && !org.apache.commons.io.FileUtils.deleteQuietly(gzip)) {
LOGGER.debug("Failed to delete temporary file when extracting 'gz' {}", gzip.toString());
gzip.deleteOnExit();
diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/utils/FileFilterBuilder.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/utils/FileFilterBuilder.java
index bf3dbb5ae..f320e0604 100644
--- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/utils/FileFilterBuilder.java
+++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/utils/FileFilterBuilder.java
@@ -48,15 +48,15 @@ public class FileFilterBuilder {
/**
* A set of filenames to filter.
*/
- private final Set filenames = new HashSet();
+ private final Set filenames = new HashSet<>();
/**
* A set of extensions to filter.
*/
- private final Set extensions = new HashSet();
+ private final Set extensions = new HashSet<>();
/**
* An array list of file filters.
*/
- private final List fileFilters = new ArrayList();
+ private final List fileFilters = new ArrayList<>();
/**
* Create a new instance and return it. This method is for convenience in using the builder pattern within a single statement.
@@ -125,10 +125,10 @@ public class FileFilterBuilder {
}
final OrFileFilter filter = new OrFileFilter();
if (!filenames.isEmpty()) {
- filter.addFileFilter(new NameFileFilter(new ArrayList(filenames)));
+ filter.addFileFilter(new NameFileFilter(new ArrayList<>(filenames)));
}
if (!extensions.isEmpty()) {
- filter.addFileFilter(new SuffixFileFilter(new ArrayList(extensions), IOCase.INSENSITIVE));
+ filter.addFileFilter(new SuffixFileFilter(new ArrayList<>(extensions), IOCase.INSENSITIVE));
}
for (IOFileFilter iof : fileFilters) {
filter.addFileFilter(iof);
diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/utils/Filter.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/utils/Filter.java
index 65c24616e..554a70dc1 100644
--- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/utils/Filter.java
+++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/utils/Filter.java
@@ -3,7 +3,7 @@ package org.owasp.dependencycheck.utils;
import java.util.Iterator;
import java.util.NoSuchElementException;
-/*
+/**
* This is an abstract filter that can be used to filter iterable list.
*
* This Filter class was copied from:
@@ -11,15 +11,35 @@ import java.util.NoSuchElementException;
*
* Erik Rasmussen - © 2006 - 2012 All Rights Reserved. @author Erik Rasmussen
* https://plus.google.com/115403795880834599019/?rel=author
+ *
+ * @param the type to filter
*/
public abstract class Filter {
+ /**
+ * Determines whether the object passes the filter.
+ *
+ * @param object the object to test
+ * @return whether or not the object passes the filter
+ */
public abstract boolean passes(T object);
+ /**
+ * Filters a given iterator.
+ *
+ * @param iterator the iterator to filter
+ * @return the filtered iterator
+ */
public Iterator filter(Iterator iterator) {
return new FilterIterator(iterator);
}
+ /**
+ * Filters a given iterable.
+ *
+ * @param iterable the iterable to filter
+ * @return the filtered iterable
+ */
public Iterable filter(final Iterable iterable) {
return new Iterable() {
@@ -71,4 +91,4 @@ public abstract class Filter {
}
}
}
-}
\ No newline at end of file
+}
diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/utils/UrlStringUtils.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/utils/UrlStringUtils.java
index 7b0da6864..45308b9e6 100644
--- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/utils/UrlStringUtils.java
+++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/utils/UrlStringUtils.java
@@ -47,8 +47,8 @@ public final class UrlStringUtils {
private static final Pattern IS_URL_TEST = Pattern.compile("^(ht|f)tps?://.*", Pattern.CASE_INSENSITIVE);
/**
- * Tests if the text provided contains a URL. This is somewhat limited search in that it only looks for
- * (ftp|http|https)://
+ * Tests if the text provided contains a URL. This is somewhat limited
+ * search in that it only looks for (ftp|http|https)://
*
* @param text the text to search
* @return true if the text contains a url, otherwise false
@@ -67,14 +67,16 @@ public final class UrlStringUtils {
return IS_URL_TEST.matcher(text).matches();
}
/**
- * A listing of domain parts that should not be used as evidence. Yes, this is an incomplete list.
+ * A listing of domain parts that should not be used as evidence. Yes, this
+ * is an incomplete list.
*/
- private static final Set IGNORE_LIST = new HashSet(
+ private static final Set IGNORE_LIST = new HashSet<>(
Arrays.asList("www", "com", "org", "gov", "info", "name", "net", "pro", "tel", "mobi", "xxx"));
/**
*
- * Takes a URL, in String format, and adds the important parts of the URL to a list of strings.
+ * Takes a URL, in String format, and adds the important parts of the URL to
+ * a list of strings.
*
* Example, given the following input:
* "https://www.somedomain.com/path1/path2/file.php?id=439"
@@ -87,7 +89,7 @@ public final class UrlStringUtils {
* @throws MalformedURLException thrown if the URL is malformed
*/
public static List extractImportantUrlData(String text) throws MalformedURLException {
- final List importantParts = new ArrayList();
+ final List importantParts = new ArrayList<>();
final URL url = new URL(text);
final String[] domain = url.getHost().split("\\.");
//add the domain except www and the tld.
@@ -99,14 +101,21 @@ public final class UrlStringUtils {
}
final String document = url.getPath();
final String[] pathParts = document.split("[\\//]");
- for (int i = 0; i < pathParts.length - 2; i++) {
+ for (int i = 0; i < pathParts.length - 1; i++) {
if (!pathParts[i].isEmpty()) {
importantParts.add(pathParts[i]);
}
}
if (pathParts.length > 0 && !pathParts[pathParts.length - 1].isEmpty()) {
- final String fileNameNoExt = pathParts[pathParts.length - 1].replaceAll("\\..*{0,5}$", "");
- importantParts.add(fileNameNoExt);
+ final String tmp = pathParts[pathParts.length - 1];
+ final int pos = tmp.lastIndexOf('.');
+ if (pos > 1) {
+ importantParts.add(tmp.substring(0, pos));
+ } else if (pos == 0 && tmp.length() > 1) {
+ importantParts.add(tmp.substring(1));
+ } else {
+ importantParts.add(tmp);
+ }
}
return importantParts;
}
diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/xml/hints/HintHandler.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/xml/hints/HintHandler.java
index c834abf60..676067c5e 100644
--- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/xml/hints/HintHandler.java
+++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/xml/hints/HintHandler.java
@@ -149,8 +149,17 @@ public class HintHandler extends DefaultHandler {
* Internal type to track the parent node state.
*/
enum ParentType {
+ /**
+ * Marks the add node.
+ */
ADD,
+ /**
+ * Marks the given node.
+ */
GIVEN,
+ /**
+ * Marks the remove node.
+ */
REMOVE
}
/**
diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/xml/hints/HintParser.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/xml/hints/HintParser.java
index ce881759c..58966d0f8 100644
--- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/xml/hints/HintParser.java
+++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/xml/hints/HintParser.java
@@ -79,38 +79,19 @@ public class HintParser {
* @throws HintParseException thrown if the XML file cannot be parsed
*/
public Hints parseHints(File file) throws HintParseException {
- FileInputStream fis = null;
+ //TODO there must be a better way to determine which schema to use for validation.
try {
- fis = new FileInputStream(file);
- return parseHints(fis);
- } catch (IOException ex) {
- LOGGER.debug("", ex);
- throw new HintParseException(ex);
- } catch (SAXException ex) {
- try {
- if (fis != null) {
- try {
- fis.close();
- } catch (IOException ex1) {
- LOGGER.debug("Unable to close stream", ex1);
- }
- }
- fis = new FileInputStream(file);
- } catch (FileNotFoundException ex1) {
- throw new HintParseException(ex1);
- }
- try {
- return parseHints(fis, HINT_SCHEMA_OLD);
- } catch (SAXException ex1) {
+ try (FileInputStream fis = new FileInputStream(file)) {
+ return parseHints(fis);
+ } catch (IOException ex) {
+ LOGGER.debug("", ex);
throw new HintParseException(ex);
}
- } finally {
- if (fis != null) {
- try {
- fis.close();
- } catch (IOException ex) {
- LOGGER.debug("Unable to close stream", ex);
- }
+ } catch (SAXException ex) {
+ try (FileInputStream fis = new FileInputStream(file)) {
+ return parseHints(fis, HINT_SCHEMA_OLD);
+ } catch (SAXException | IOException ex1) {
+ throw new HintParseException(ex);
}
}
}
@@ -139,24 +120,21 @@ public class HintParser {
* @throws SAXException thrown if the XML cannot be parsed
*/
private Hints parseHints(InputStream inputStream, String schema) throws HintParseException, SAXException {
- InputStream schemaStream = null;
- try {
- schemaStream = this.getClass().getClassLoader().getResourceAsStream(schema);
+ try (InputStream schemaStream = this.getClass().getClassLoader().getResourceAsStream(schema)) {
final HintHandler handler = new HintHandler();
final SAXParser saxParser = XmlUtils.buildSecureSaxParser(schemaStream);
final XMLReader xmlReader = saxParser.getXMLReader();
xmlReader.setErrorHandler(new HintErrorHandler());
xmlReader.setContentHandler(handler);
-
- final Reader reader = new InputStreamReader(inputStream, "UTF-8");
- final InputSource in = new InputSource(reader);
-
- xmlReader.parse(in);
- final Hints hints = new Hints();
- hints.setHintRules(handler.getHintRules());
- hints.setVendorDuplicatingHintRules(handler.getVendorDuplicatingHintRules());
- return hints;
- } catch (ParserConfigurationException ex) {
+ try (Reader reader = new InputStreamReader(inputStream, "UTF-8")) {
+ final InputSource in = new InputSource(reader);
+ xmlReader.parse(in);
+ final Hints hints = new Hints();
+ hints.setHintRules(handler.getHintRules());
+ hints.setVendorDuplicatingHintRules(handler.getVendorDuplicatingHintRules());
+ return hints;
+ }
+ } catch (ParserConfigurationException | FileNotFoundException ex) {
LOGGER.debug("", ex);
throw new HintParseException(ex);
} catch (SAXException ex) {
@@ -166,20 +144,9 @@ public class HintParser {
LOGGER.debug("", ex);
throw new HintParseException(ex);
}
- } catch (FileNotFoundException ex) {
- LOGGER.debug("", ex);
- throw new HintParseException(ex);
} catch (IOException ex) {
LOGGER.debug("", ex);
throw new HintParseException(ex);
- } finally {
- if (schemaStream != null) {
- try {
- schemaStream.close();
- } catch (IOException ex) {
- LOGGER.debug("Error closing hint file stream", ex);
- }
- }
}
}
}
diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/xml/hints/HintRule.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/xml/hints/HintRule.java
index ab59344f4..e92cbdda9 100644
--- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/xml/hints/HintRule.java
+++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/xml/hints/HintRule.java
@@ -255,7 +255,7 @@ public class HintRule {
return removeVersion;
}
/**
- * Adds a given version to the list of evidence to matche.
+ * Adds a given version to the list of evidence to match.
*
* @param source the source of the evidence
* @param name the name of the evidence
diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/xml/pom/Model.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/xml/pom/Model.java
index 132f10daf..2168ec950 100644
--- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/xml/pom/Model.java
+++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/xml/pom/Model.java
@@ -74,7 +74,7 @@ public class Model {
/**
* The list of licenses.
*/
- private final List licenses = new ArrayList();
+ private final List licenses = new ArrayList<>();
/**
* The project URL.
*/
diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/xml/pom/PomHandler.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/xml/pom/PomHandler.java
index 198ce2e12..014d8043e 100644
--- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/xml/pom/PomHandler.java
+++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/xml/pom/PomHandler.java
@@ -91,7 +91,7 @@ public class PomHandler extends DefaultHandler {
/**
* The stack of elements processed; used to determine the parent node.
*/
- private final Deque stack = new ArrayDeque();
+ private final Deque stack = new ArrayDeque<>();
/**
* The license object.
*/
@@ -101,7 +101,7 @@ public class PomHandler extends DefaultHandler {
* The current node text being extracted from the element.
*/
private StringBuilder currentText;
-
+
/**
* Handles the start element event.
*
@@ -132,66 +132,77 @@ public class PomHandler extends DefaultHandler {
public void endElement(String uri, String localName, String qName) throws SAXException {
stack.pop();
final String parentNode = stack.peek();
- if (null != parentNode) switch (parentNode) {
- case PROJECT:
- if (null != qName) switch (qName) {
- case GROUPID:
- model.setGroupId(currentText.toString());
- break;
- case ARTIFACTID:
- model.setArtifactId(currentText.toString());
- break;
- case VERSION:
- model.setVersion(currentText.toString());
- break;
- case NAME:
- model.setName(currentText.toString());
- break;
- case DESCRIPTION:
- model.setDescription(currentText.toString());
- break;
- case URL:
- model.setProjectURL(currentText.toString());
- break;
- default:
- break;
- } break;
- case ORGANIZATION:
- if (NAME.equals(qName)) {
- model.setOrganization(currentText.toString());
- } else if (URL.equals(qName)) {
- model.setOrganizationUrl(currentText.toString());
- } break;
- case PARENT:
- if (null != qName) switch (qName) {
- case GROUPID:
- model.setParentGroupId(currentText.toString());
- break;
- case ARTIFACTID:
- model.setParentArtifactId(currentText.toString());
- break;
- case VERSION:
- model.setParentVersion(currentText.toString());
- break;
- default:
- break;
- } break;
- case LICENSE:
- if (license != null) {
+ if (null != parentNode) {
+ switch (parentNode) {
+ case PROJECT:
+ if (null != qName) {
+ switch (qName) {
+ case GROUPID:
+ model.setGroupId(currentText.toString());
+ break;
+ case ARTIFACTID:
+ model.setArtifactId(currentText.toString());
+ break;
+ case VERSION:
+ model.setVersion(currentText.toString());
+ break;
+ case NAME:
+ model.setName(currentText.toString());
+ break;
+ case DESCRIPTION:
+ model.setDescription(currentText.toString());
+ break;
+ case URL:
+ model.setProjectURL(currentText.toString());
+ break;
+ default:
+ break;
+ }
+ }
+ break;
+ case ORGANIZATION:
if (NAME.equals(qName)) {
- license.setName(currentText.toString());
+ model.setOrganization(currentText.toString());
} else if (URL.equals(qName)) {
- license.setUrl(currentText.toString());
+ model.setOrganizationUrl(currentText.toString());
}
- } break;
- case LICENSES:
- if (LICENSE.equals(qName)) {
+ break;
+ case PARENT:
+ if (null != qName) {
+ switch (qName) {
+ case GROUPID:
+ model.setParentGroupId(currentText.toString());
+ break;
+ case ARTIFACTID:
+ model.setParentArtifactId(currentText.toString());
+ break;
+ case VERSION:
+ model.setParentVersion(currentText.toString());
+ break;
+ default:
+ break;
+ }
+ }
+ break;
+ case LICENSE:
if (license != null) {
- model.addLicense(license);
+ if (NAME.equals(qName)) {
+ license.setName(currentText.toString());
+ } else if (URL.equals(qName)) {
+ license.setUrl(currentText.toString());
+ }
}
- } break;
- default:
- break;
+ break;
+ case LICENSES:
+ if (LICENSE.equals(qName)) {
+ if (license != null) {
+ model.addLicense(license);
+ }
+ }
+ break;
+ default:
+ break;
+ }
}
}
diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/xml/pom/PomParser.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/xml/pom/PomParser.java
index 5218e3d7a..3b81e1591 100644
--- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/xml/pom/PomParser.java
+++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/xml/pom/PomParser.java
@@ -58,21 +58,11 @@ public class PomParser {
* @throws PomParseException thrown if the xml file cannot be parsed
*/
public Model parse(File file) throws PomParseException {
- FileInputStream fis = null;
- try {
- fis = new FileInputStream(file);
+ try (FileInputStream fis = new FileInputStream(file)) {
return parse(fis);
} catch (IOException ex) {
LOGGER.debug("", ex);
throw new PomParseException(ex);
- } finally {
- if (fis != null) {
- try {
- fis.close();
- } catch (IOException ex) {
- LOGGER.debug("Unable to close stream", ex);
- }
- }
}
}
@@ -90,18 +80,15 @@ public class PomParser {
final SAXParser saxParser = XmlUtils.buildSecureSaxParser();
final XMLReader xmlReader = saxParser.getXMLReader();
xmlReader.setContentHandler(handler);
- BOMInputStream bomStream = new BOMInputStream(inputStream);
- ByteOrderMark bom = bomStream.getBOM();
- String defaultEncoding = "UTF-8";
- String charsetName = bom == null ? defaultEncoding : bom.getCharsetName();
+ final BOMInputStream bomStream = new BOMInputStream(inputStream);
+ final ByteOrderMark bom = bomStream.getBOM();
+ final String defaultEncoding = "UTF-8";
+ final String charsetName = bom == null ? defaultEncoding : bom.getCharsetName();
final Reader reader = new InputStreamReader(bomStream, charsetName);
final InputSource in = new InputSource(reader);
xmlReader.parse(in);
return handler.getModel();
- } catch (ParserConfigurationException | SAXException ex) {
- LOGGER.debug("", ex);
- throw new PomParseException(ex);
- } catch (FileNotFoundException ex) {
+ } catch (ParserConfigurationException | SAXException | FileNotFoundException ex) {
LOGGER.debug("", ex);
throw new PomParseException(ex);
} catch (IOException ex) {
diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/xml/suppression/SuppressionErrorHandler.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/xml/suppression/SuppressionErrorHandler.java
index b4801b380..d476f1aaa 100644
--- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/xml/suppression/SuppressionErrorHandler.java
+++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/xml/suppression/SuppressionErrorHandler.java
@@ -18,6 +18,8 @@
package org.owasp.dependencycheck.xml.suppression;
import org.owasp.dependencycheck.utils.XmlUtils;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
import org.xml.sax.ErrorHandler;
import org.xml.sax.SAXException;
import org.xml.sax.SAXParseException;
@@ -32,7 +34,7 @@ public class SuppressionErrorHandler implements ErrorHandler {
/**
* The logger.
*/
- //private static final Logger LOGGER = LoggerFactory.getLogger(SuppressionErrorHandler.class);
+ private static final Logger LOGGER = LoggerFactory.getLogger(SuppressionErrorHandler.class);
/**
* Logs warnings.
@@ -42,7 +44,7 @@ public class SuppressionErrorHandler implements ErrorHandler {
*/
@Override
public void warning(SAXParseException ex) throws SAXException {
- //LOGGER.debug("", ex);
+ LOGGER.trace("", ex);
}
/**
@@ -60,7 +62,7 @@ public class SuppressionErrorHandler implements ErrorHandler {
* Handles fatal exceptions.
*
* @param ex a fatal exception
- * @throws SAXException is always
+ * @throws SAXException is always thrown
*/
@Override
public void fatalError(SAXParseException ex) throws SAXException {
diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/xml/suppression/SuppressionHandler.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/xml/suppression/SuppressionHandler.java
index 62c11ffc3..ec1b7b1c2 100644
--- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/xml/suppression/SuppressionHandler.java
+++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/xml/suppression/SuppressionHandler.java
@@ -71,7 +71,7 @@ public class SuppressionHandler extends DefaultHandler {
/**
* A list of suppression rules.
*/
- private final List suppressionRules = new ArrayList();
+ private final List suppressionRules = new ArrayList<>();
/**
* Get the value of suppressionRules.
@@ -199,4 +199,4 @@ public class SuppressionHandler extends DefaultHandler {
}
return pt;
}
-}
\ No newline at end of file
+}
diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/xml/suppression/SuppressionParser.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/xml/suppression/SuppressionParser.java
index 88a37dbe8..4ee98c82a 100644
--- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/xml/suppression/SuppressionParser.java
+++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/xml/suppression/SuppressionParser.java
@@ -64,39 +64,19 @@ public class SuppressionParser {
* @throws SuppressionParseException thrown if the XML file cannot be parsed
*/
public List parseSuppressionRules(File file) throws SuppressionParseException {
- FileInputStream fis = null;
try {
- fis = new FileInputStream(file);
- return parseSuppressionRules(fis);
- } catch (IOException ex) {
- LOGGER.debug("", ex);
- throw new SuppressionParseException(ex);
+ try (FileInputStream fis = new FileInputStream(file)) {
+ return parseSuppressionRules(fis);
+ } catch (IOException ex) {
+ LOGGER.debug("", ex);
+ throw new SuppressionParseException(ex);
+ }
} catch (SAXException ex) {
- try {
- if (fis != null) {
- try {
- fis.close();
- } catch (IOException ex1) {
- LOGGER.debug("Unable to close stream", ex1);
- }
- }
- fis = new FileInputStream(file);
- } catch (FileNotFoundException ex1) {
- throw new SuppressionParseException(ex);
- }
- try {
+ try (FileInputStream fis = new FileInputStream(file)) {
return parseSuppressionRules(fis, OLD_SUPPRESSION_SCHEMA);
- } catch (SAXException ex1) {
+ } catch (SAXException | IOException ex1) {
throw new SuppressionParseException(ex);
}
- } finally {
- if (fis != null) {
- try {
- fis.close();
- } catch (IOException ex) {
- LOGGER.debug("Unable to close stream", ex);
- }
- }
}
}
@@ -124,19 +104,18 @@ public class SuppressionParser {
* @throws SAXException thrown if the XML cannot be parsed
*/
private List parseSuppressionRules(InputStream inputStream, String schema) throws SuppressionParseException, SAXException {
- InputStream schemaStream = null;
- try {
- schemaStream = this.getClass().getClassLoader().getResourceAsStream(schema);
+ try (InputStream schemaStream = this.getClass().getClassLoader().getResourceAsStream(schema)) {
final SuppressionHandler handler = new SuppressionHandler();
final SAXParser saxParser = XmlUtils.buildSecureSaxParser(schemaStream);
final XMLReader xmlReader = saxParser.getXMLReader();
xmlReader.setErrorHandler(new SuppressionErrorHandler());
xmlReader.setContentHandler(handler);
- final Reader reader = new InputStreamReader(inputStream, "UTF-8");
- final InputSource in = new InputSource(reader);
- xmlReader.parse(in);
- return handler.getSuppressionRules();
- } catch (ParserConfigurationException ex) {
+ try (Reader reader = new InputStreamReader(inputStream, "UTF-8")) {
+ final InputSource in = new InputSource(reader);
+ xmlReader.parse(in);
+ return handler.getSuppressionRules();
+ }
+ } catch (ParserConfigurationException | FileNotFoundException ex) {
LOGGER.debug("", ex);
throw new SuppressionParseException(ex);
} catch (SAXException ex) {
@@ -146,20 +125,9 @@ public class SuppressionParser {
LOGGER.debug("", ex);
throw new SuppressionParseException(ex);
}
- } catch (FileNotFoundException ex) {
- LOGGER.debug("", ex);
- throw new SuppressionParseException(ex);
} catch (IOException ex) {
LOGGER.debug("", ex);
throw new SuppressionParseException(ex);
- } finally {
- if (schemaStream != null) {
- try {
- schemaStream.close();
- } catch (IOException ex) {
- LOGGER.debug("Error closing suppression file stream", ex);
- }
- }
}
}
}
diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/xml/suppression/SuppressionRule.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/xml/suppression/SuppressionRule.java
index 30313be71..ca6c7ab05 100644
--- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/xml/suppression/SuppressionRule.java
+++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/xml/suppression/SuppressionRule.java
@@ -529,4 +529,4 @@ public class SuppressionRule {
sb.append('}');
return sb.toString();
}
-}
\ No newline at end of file
+}
diff --git a/dependency-check-core/src/main/resources/data/dbStatements.properties b/dependency-check-core/src/main/resources/data/dbStatements.properties
index d7c4eb276..87098536e 100644
--- a/dependency-check-core/src/main/resources/data/dbStatements.properties
+++ b/dependency-check-core/src/main/resources/data/dbStatements.properties
@@ -13,7 +13,7 @@
# See the License for the specific language governing permissions and
# limitations under the License.
#
-# Copyright (c) 2015 The OWASP Foundatio. All Rights Reserved.
+# Copyright (c) 2015 The OWASP Foundation. All Rights Reserved.
DELETE_REFERENCE=DELETE FROM reference WHERE cveid = ?
DELETE_SOFTWARE=DELETE FROM software WHERE cveid = ?
diff --git a/dependency-check-core/src/main/resources/schema/nvdcve/2_0/scap-core_0.1.xsd b/dependency-check-core/src/main/resources/schema/nvdcve/2_0/scap-core_0.1.xsd
index 41d1ce5f6..c9a09f82f 100644
--- a/dependency-check-core/src/main/resources/schema/nvdcve/2_0/scap-core_0.1.xsd
+++ b/dependency-check-core/src/main/resources/schema/nvdcve/2_0/scap-core_0.1.xsd
@@ -133,7 +133,7 @@
-
diff --git a/dependency-check-core/src/test/java/org/owasp/dependencycheck/BaseDBTestCase.java b/dependency-check-core/src/test/java/org/owasp/dependencycheck/BaseDBTestCase.java
index 1bb992197..6264b6ebf 100644
--- a/dependency-check-core/src/test/java/org/owasp/dependencycheck/BaseDBTestCase.java
+++ b/dependency-check-core/src/test/java/org/owasp/dependencycheck/BaseDBTestCase.java
@@ -24,6 +24,7 @@ import java.io.FileInputStream;
import java.io.FileOutputStream;
import java.util.zip.ZipEntry;
import java.util.zip.ZipInputStream;
+import org.apache.commons.compress.utils.IOUtils;
import org.junit.AfterClass;
import org.junit.Before;
import org.owasp.dependencycheck.data.nvdcve.CveDB;
@@ -45,7 +46,7 @@ public abstract class BaseDBTestCase extends BaseTest {
@Before
public void setUpDb() throws Exception {
- ensureDBExists();
+ ensureDBExists();
}
@AfterClass
@@ -54,12 +55,10 @@ public abstract class BaseDBTestCase extends BaseTest {
}
public static void ensureDBExists() throws Exception {
-
File f = new File("./target/data/dc.h2.db");
if (f.exists() && f.isFile() && f.length() < 71680) {
f.delete();
}
-
File dataPath = Settings.getDataDirectory();
String fileName = Settings.getString(Settings.KEYS.DB_FILE_NAME);
LOGGER.trace("DB file name {}", fileName);
@@ -68,12 +67,9 @@ public abstract class BaseDBTestCase extends BaseTest {
if (!dataPath.exists() || !dataFile.exists()) {
LOGGER.trace("Extracting database to {}", dataPath.toString());
dataPath.mkdirs();
- FileInputStream fis = null;
- ZipInputStream zin = null;
- try {
- File path = new File(BaseDBTestCase.class.getClassLoader().getResource("data.zip").toURI().getPath());
- fis = new FileInputStream(path);
- zin = new ZipInputStream(new BufferedInputStream(fis));
+ File path = new File(BaseDBTestCase.class.getClassLoader().getResource("data.zip").toURI().getPath());
+ try (FileInputStream fis = new FileInputStream(path);
+ ZipInputStream zin = new ZipInputStream(new BufferedInputStream(fis))) {
ZipEntry entry;
while ((entry = zin.getNextEntry()) != null) {
if (entry.isDirectory()) {
@@ -81,53 +77,15 @@ public abstract class BaseDBTestCase extends BaseTest {
d.mkdir();
continue;
}
- FileOutputStream fos = null;
- BufferedOutputStream dest = null;
- try {
- File o = new File(dataPath, entry.getName());
- o.createNewFile();
- fos = new FileOutputStream(o, false);
- dest = new BufferedOutputStream(fos, BUFFER_SIZE);
- byte data[] = new byte[BUFFER_SIZE];
- int count;
- while ((count = zin.read(data, 0, BUFFER_SIZE)) != -1) {
- dest.write(data, 0, count);
- }
+ File o = new File(dataPath, entry.getName());
+ o.createNewFile();
+ try (FileOutputStream fos = new FileOutputStream(o, false);
+ BufferedOutputStream dest = new BufferedOutputStream(fos, BUFFER_SIZE)) {
+ IOUtils.copy(zin, dest);
} catch (Throwable ex) {
LOGGER.error("", ex);
- } finally {
- try {
- if (dest != null) {
- dest.flush();
- dest.close();
- }
- } catch (Throwable ex) {
- LOGGER.trace("", ex);
- }
- try {
- if (fos != null) {
- fos.close();
- }
- } catch (Throwable ex) {
- LOGGER.trace("", ex);
- }
}
}
- } finally {
- try {
- if (zin != null) {
- zin.close();
- }
- } catch (Throwable ex) {
- LOGGER.trace("", ex);
- }
- try {
- if (fis != null) {
- fis.close();
- }
- } catch (Throwable ex) {
- LOGGER.trace("", ex);
- }
}
}
}
diff --git a/dependency-check-core/src/test/java/org/owasp/dependencycheck/analyzer/JarAnalyzerTest.java b/dependency-check-core/src/test/java/org/owasp/dependencycheck/analyzer/JarAnalyzerTest.java
index 97d11546a..df9931548 100644
--- a/dependency-check-core/src/test/java/org/owasp/dependencycheck/analyzer/JarAnalyzerTest.java
+++ b/dependency-check-core/src/test/java/org/owasp/dependencycheck/analyzer/JarAnalyzerTest.java
@@ -22,20 +22,24 @@ import static org.junit.Assert.assertTrue;
import java.io.File;
import java.util.ArrayList;
+import java.util.Arrays;
import java.util.List;
+import org.junit.After;
+import org.junit.AfterClass;
+import org.junit.Before;
+import org.junit.BeforeClass;
import org.junit.Test;
import org.owasp.dependencycheck.BaseTest;
import org.owasp.dependencycheck.dependency.Dependency;
import org.owasp.dependencycheck.dependency.Evidence;
+import org.owasp.dependencycheck.utils.Settings;
/**
* @author Jeremy Long
*/
public class JarAnalyzerTest extends BaseTest {
-// private static final Logger LOGGER = LoggerFactory.getLogger(JarAnalyzerTest.class);
-
/**
* Test of inspect method, of class JarAnalyzer.
*
@@ -51,14 +55,14 @@ public class JarAnalyzerTest extends BaseTest {
instance.analyze(result, null);
assertTrue(result.getVendorEvidence().toString().toLowerCase().contains("apache"));
assertTrue(result.getVendorEvidence().getWeighting().contains("apache"));
-
+
file = BaseTest.getResourceAsFile(this, "dwr.jar");
result = new Dependency(file);
instance.analyze(result, null);
boolean found = false;
for (Evidence e : result.getVendorEvidence()) {
if (e.getName().equals("url")) {
- assertEquals("Project url was not as expected in dwr.jar", e.getValue(), "http://getahead.ltd.uk/dwr");
+ assertEquals("Project url was not as expected in dwr.jar", e.getValue(), "http://getahead.ltd.uk/dwr");
found = true;
break;
}
@@ -136,9 +140,40 @@ public class JarAnalyzerTest extends BaseTest {
File file = BaseTest.getResourceAsFile(this, "xalan-2.7.0.jar");
Dependency result = new Dependency(file);
JarAnalyzer instance = new JarAnalyzer();
- List cni = new ArrayList();
+ List cni = new ArrayList<>();
instance.parseManifest(result, cni);
assertTrue(result.getVersionEvidence().getEvidence("manifest: org/apache/xalan/").size() > 0);
}
+
+ /**
+ * Test of getAnalysisPhase method, of class JarAnalyzer.
+ */
+ @Test
+ public void testGetAnalysisPhase() {
+ JarAnalyzer instance = new JarAnalyzer();
+ AnalysisPhase expResult = AnalysisPhase.INFORMATION_COLLECTION;
+ AnalysisPhase result = instance.getAnalysisPhase();
+ assertEquals(expResult, result);
+ }
+
+ /**
+ * Test of getAnalyzerEnabledSettingKey method, of class JarAnalyzer.
+ */
+ @Test
+ public void testGetAnalyzerEnabledSettingKey() {
+ JarAnalyzer instance = new JarAnalyzer();
+ String expResult = Settings.KEYS.ANALYZER_JAR_ENABLED;
+ String result = instance.getAnalyzerEnabledSettingKey();
+ assertEquals(expResult, result);
+ }
+
+ @Test
+ public void testClassInformation() {
+ JarAnalyzer.ClassNameInformation instance = new JarAnalyzer.ClassNameInformation("org/owasp/dependencycheck/analyzer/JarAnalyzer");
+ assertEquals("org/owasp/dependencycheck/analyzer/JarAnalyzer", instance.getName());
+ List expected = Arrays.asList("owasp", "dependencycheck", "analyzer", "jaranalyzer");
+ List results = instance.getPackageStructure();
+ assertEquals(expected, results);
+ }
}
diff --git a/dependency-check-core/src/test/java/org/owasp/dependencycheck/analyzer/RubyBundleAuditAnalyzerTest.java b/dependency-check-core/src/test/java/org/owasp/dependencycheck/analyzer/RubyBundleAuditAnalyzerTest.java
index 91f72a3ba..ff5a4a9e1 100644
--- a/dependency-check-core/src/test/java/org/owasp/dependencycheck/analyzer/RubyBundleAuditAnalyzerTest.java
+++ b/dependency-check-core/src/test/java/org/owasp/dependencycheck/analyzer/RubyBundleAuditAnalyzerTest.java
@@ -45,6 +45,7 @@ import org.owasp.dependencycheck.utils.Settings;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import static org.junit.Assert.fail;
+import org.owasp.dependencycheck.exception.InitializationException;
/**
* Unit tests for {@link RubyBundleAuditAnalyzer}.
@@ -122,7 +123,7 @@ public class RubyBundleAuditAnalyzerTest extends BaseDBTestCase {
assertTrue(dependency.getVersionEvidence().toString().toLowerCase().contains("2.2.2"));
assertTrue(dependency.getFilePath().endsWith(resource));
assertTrue(dependency.getFileName().equals("Gemfile.lock"));
- } catch (Exception e) {
+ } catch (InitializationException | DatabaseException | AnalysisException e) {
LOGGER.warn("Exception setting up RubyBundleAuditAnalyzer. Make sure Ruby gem bundle-audit is installed. You may also need to set property \"analyzer.bundle.audit.path\".");
Assume.assumeNoException("Exception setting up RubyBundleAuditAnalyzer; bundle audit may not be installed, or property \"analyzer.bundle.audit.path\" may not be set.", e);
}
@@ -145,7 +146,7 @@ public class RubyBundleAuditAnalyzerTest extends BaseDBTestCase {
Vulnerability vulnerability = dependency.getVulnerabilities().first();
assertEquals(vulnerability.getCvssScore(), 5.0f, 0.0);
- } catch (Exception e) {
+ } catch (InitializationException | DatabaseException | AnalysisException e) {
LOGGER.warn("Exception setting up RubyBundleAuditAnalyzer. Make sure Ruby gem bundle-audit is installed. You may also need to set property \"analyzer.bundle.audit.path\".");
Assume.assumeNoException("Exception setting up RubyBundleAuditAnalyzer; bundle audit may not be installed, or property \"analyzer.bundle.audit.path\" may not be set.", e);
}
diff --git a/dependency-check-core/src/test/java/org/owasp/dependencycheck/data/lucene/FieldAnalyzerTest.java b/dependency-check-core/src/test/java/org/owasp/dependencycheck/data/lucene/FieldAnalyzerTest.java
index 77c70cb17..f98107ba2 100644
--- a/dependency-check-core/src/test/java/org/owasp/dependencycheck/data/lucene/FieldAnalyzerTest.java
+++ b/dependency-check-core/src/test/java/org/owasp/dependencycheck/data/lucene/FieldAnalyzerTest.java
@@ -61,19 +61,19 @@ public class FieldAnalyzerTest extends BaseTest {
String field2 = "vendor";
String text2 = "springsource";
- IndexWriter w = createIndex(analyzer, index);
- addDoc(w, field1, text1, field2, text2);
- text1 = "x-stream";
- text2 = "xstream";
- addDoc(w, field1, text1, field2, text2);
- w.close();
+ try (IndexWriter w = createIndex(analyzer, index)) {
+ addDoc(w, field1, text1, field2, text2);
+ text1 = "x-stream";
+ text2 = "xstream";
+ addDoc(w, field1, text1, field2, text2);
+ }
//Analyzer searchingAnalyzer = new SearchFieldAnalyzer(LuceneUtils.CURRENT_VERSION);
String querystr = "product:\"(Spring Framework Core)\" vendor:(SpringSource)";
SearchFieldAnalyzer searchAnalyzerProduct = new SearchFieldAnalyzer(LuceneUtils.CURRENT_VERSION);
SearchFieldAnalyzer searchAnalyzerVendor = new SearchFieldAnalyzer(LuceneUtils.CURRENT_VERSION);
- HashMap map = new HashMap();
+ HashMap map = new HashMap<>();
map.put(field1, searchAnalyzerProduct);
map.put(field2, searchAnalyzerVendor);
PerFieldAnalyzerWrapper wrapper = new PerFieldAnalyzerWrapper(new StandardAnalyzer(LuceneUtils.CURRENT_VERSION), map);
diff --git a/dependency-check-core/src/test/java/org/owasp/dependencycheck/data/lucene/UrlTokenizingFilterTest.java b/dependency-check-core/src/test/java/org/owasp/dependencycheck/data/lucene/UrlTokenizingFilterTest.java
index 8b902f417..adb7b94ce 100644
--- a/dependency-check-core/src/test/java/org/owasp/dependencycheck/data/lucene/UrlTokenizingFilterTest.java
+++ b/dependency-check-core/src/test/java/org/owasp/dependencycheck/data/lucene/UrlTokenizingFilterTest.java
@@ -31,7 +31,7 @@ import org.apache.lucene.analysis.core.KeywordTokenizer;
*/
public class UrlTokenizingFilterTest extends BaseTokenStreamTestCase {
- private Analyzer analyzer;
+ private final Analyzer analyzer;
public UrlTokenizingFilterTest() {
analyzer = new Analyzer() {
diff --git a/dependency-check-core/src/test/java/org/owasp/dependencycheck/data/nvdcve/ConnectionFactoryTest.java b/dependency-check-core/src/test/java/org/owasp/dependencycheck/data/nvdcve/ConnectionFactoryTest.java
index 7768acbdb..4316c7311 100644
--- a/dependency-check-core/src/test/java/org/owasp/dependencycheck/data/nvdcve/ConnectionFactoryTest.java
+++ b/dependency-check-core/src/test/java/org/owasp/dependencycheck/data/nvdcve/ConnectionFactoryTest.java
@@ -36,9 +36,9 @@ public class ConnectionFactoryTest extends BaseDBTestCase {
@Test
public void testInitialize() throws DatabaseException, SQLException {
ConnectionFactory.initialize();
- Connection result = ConnectionFactory.getConnection();
- assertNotNull(result);
- result.close();
+ try (Connection result = ConnectionFactory.getConnection()) {
+ assertNotNull(result);
+ }
ConnectionFactory.cleanup();
}
}
diff --git a/dependency-check-core/src/test/java/org/owasp/dependencycheck/data/update/nvd/NvdCveInfoTest.java b/dependency-check-core/src/test/java/org/owasp/dependencycheck/data/update/nvd/NvdCveInfoTest.java
index 81250cd52..2b31123e0 100644
--- a/dependency-check-core/src/test/java/org/owasp/dependencycheck/data/update/nvd/NvdCveInfoTest.java
+++ b/dependency-check-core/src/test/java/org/owasp/dependencycheck/data/update/nvd/NvdCveInfoTest.java
@@ -17,7 +17,6 @@
*/
package org.owasp.dependencycheck.data.update.nvd;
-import org.owasp.dependencycheck.data.update.nvd.NvdCveInfo;
import static org.junit.Assert.assertEquals;
import org.junit.Test;
import org.owasp.dependencycheck.BaseTest;
diff --git a/dependency-check-core/src/test/java/org/owasp/dependencycheck/data/update/nvd/NvdCve_1_2_HandlerTest.java b/dependency-check-core/src/test/java/org/owasp/dependencycheck/data/update/nvd/NvdCve_1_2_HandlerTest.java
index 4a6684712..01b9662fb 100644
--- a/dependency-check-core/src/test/java/org/owasp/dependencycheck/data/update/nvd/NvdCve_1_2_HandlerTest.java
+++ b/dependency-check-core/src/test/java/org/owasp/dependencycheck/data/update/nvd/NvdCve_1_2_HandlerTest.java
@@ -17,7 +17,6 @@
*/
package org.owasp.dependencycheck.data.update.nvd;
-import org.owasp.dependencycheck.data.update.nvd.NvdCve12Handler;
import java.io.File;
import java.util.List;
import java.util.Map;
diff --git a/dependency-check-core/src/test/java/org/owasp/dependencycheck/data/update/nvd/NvdCve_2_0_HandlerTest.java b/dependency-check-core/src/test/java/org/owasp/dependencycheck/data/update/nvd/NvdCve_2_0_HandlerTest.java
index e438239eb..95dcb5255 100644
--- a/dependency-check-core/src/test/java/org/owasp/dependencycheck/data/update/nvd/NvdCve_2_0_HandlerTest.java
+++ b/dependency-check-core/src/test/java/org/owasp/dependencycheck/data/update/nvd/NvdCve_2_0_HandlerTest.java
@@ -17,10 +17,11 @@
*/
package org.owasp.dependencycheck.data.update.nvd;
-import org.owasp.dependencycheck.data.update.nvd.NvdCve20Handler;
import java.io.File;
+import java.io.IOException;
import java.util.List;
import java.util.Map;
+import javax.xml.parsers.ParserConfigurationException;
import javax.xml.parsers.SAXParser;
import javax.xml.parsers.SAXParserFactory;
@@ -29,6 +30,7 @@ import static org.junit.Assert.assertTrue;
import org.junit.Test;
import org.owasp.dependencycheck.BaseTest;
import org.owasp.dependencycheck.dependency.VulnerableSoftware;
+import org.xml.sax.SAXException;
/**
*
@@ -49,7 +51,7 @@ public class NvdCve_2_0_HandlerTest extends BaseTest {
NvdCve20Handler instance = new NvdCve20Handler();
saxParser.parse(file, instance);
- } catch (Throwable ex) {
+ } catch (ParserConfigurationException | SAXException | IOException ex) {
ex.printStackTrace();
results = ex;
}
@@ -80,7 +82,7 @@ public class NvdCve_2_0_HandlerTest extends BaseTest {
saxParser.parse(file20, instance);
assertTrue(instance.getTotalNumberOfEntries()==1);
- } catch (Throwable ex) {
+ } catch (ParserConfigurationException | SAXException | IOException ex) {
results = ex;
}
assertTrue("Exception thrown during parse of 2012 CVE version 2.0?", results == null);
diff --git a/dependency-check-core/src/test/java/org/owasp/dependencycheck/utils/FilterTest.java b/dependency-check-core/src/test/java/org/owasp/dependencycheck/utils/FilterTest.java
index dc0290d85..fcdefcd00 100644
--- a/dependency-check-core/src/test/java/org/owasp/dependencycheck/utils/FilterTest.java
+++ b/dependency-check-core/src/test/java/org/owasp/dependencycheck/utils/FilterTest.java
@@ -48,12 +48,12 @@ public class FilterTest extends BaseTest {
*/
@Test
public void testFilter_Iterable() {
- List testData = new ArrayList