-
-
-
- 
diff --git a/analyzers/assembly-analyzer.html b/analyzers/assembly-analyzer.html
index 7c932bc4e..71843a75e 100644
--- a/analyzers/assembly-analyzer.html
+++ b/analyzers/assembly-analyzer.html
@@ -1,13 +1,13 @@
-
+
-
-
-
diff --git a/analyzers/autoconf.html b/analyzers/autoconf.html
index 42beebf99..f5071deb2 100644
--- a/analyzers/autoconf.html
+++ b/analyzers/autoconf.html
@@ -1,13 +1,13 @@
-
+
-
-
-
@@ -236,6 +233,7 @@
Experimental: This analyzer is considered experimental. While this analyzer may be useful and provide valid results more testing must be completed to ensure that the false negative/false positive rates are acceptable.
OWASP dependency-check includes an analyzer that will scan Autoconf project configuration files. The analyzer will collect as much information it can about the project. The information collected is internally referred to as evidence and is grouped into vendor, product, and version buckets. Other analyzers later use this evidence to identify any Common Platform Enumeration (CPE) identifiers that apply.
File names scanned: configure, configure.in, configure.ac
-
-
-
diff --git a/analyzers/cmake.html b/analyzers/cmake.html
index 483fa395f..a62fcacd4 100644
--- a/analyzers/cmake.html
+++ b/analyzers/cmake.html
@@ -1,13 +1,13 @@
-
+
-
-
-
@@ -236,6 +233,7 @@
Experimental: This analyzer is considered experimental. While this analyzer may be useful and provide valid results more testing must be completed to ensure that the false negative/false positive rates are acceptable.
OWASP dependency-check includes an analyzer that will scan CMake project configuration files. The analyzer will collect as much information it can about the project. The information collected is internally referred to as evidence and is grouped into vendor, product, and version buckets. Other analyzers later use this evidence to identify any Common Platform Enumeration (CPE) identifiers that apply.
File names scanned: CMakeLists.txt, *.cmake
-
-
-
@@ -152,6 +149,7 @@
Experimental: This analyzer is considered experimental. While this analyzer may be useful and provide valid results more testing must be completed to ensure that the false negative/false positive rates are acceptable.
OWASP dependency-check includes an analyzer that scans composer.lock files to get exact dependency version information from PHP projects which are managed with Composer. If you’re using Composer to manage your project, this will only analyze the composer.lock file currently, so you’ll need to run composer install to have Composer generate this file.
-
-
-
@@ -272,24 +269,6 @@
The following analyzers can be enabled by enabling the experimental configuration option; see the documentation for the CLI, Ant, Maven, etc. for more information. These analyzers are considered experimental due to the higher false positive and false negative rates. Even though these are marked as experimental several teams have found them useful in their current state.
+ +| Analyzer | + +File Types Scanned | + +Analysis Method | +
|---|---|---|
| Autoconf | + +Autoconf project configuration files (configure, configure.in, configure.ac) | + +Regex scan for AC_INIT metadata, including in generated configuration script. | +
| CMake | + +CMake project files (CMakeLists.txt) and scripts (*.cmake) | + +Regex scan for project initialization and version setting commands. | +
| Composer Lock | + +PHP Composer Lock files (composer.lock) | + +Parses PHP Composer lock files for exact versions of dependencies. | +
| Node.js | + +NPM package specification files (package.json) | + +Parse JSON format for metadata. | +
| Python | Python source files (*.py); Package metadata files (PKG-INFO, METADATA); Package Distribution Files (*.whl, *.egg, *.zip) | @@ -360,7 +367,7 @@Regex scan of Python source files for setuptools metadata; Parse RFC822 header format for metadata in all other artifacts. |
| Ruby Gemspec | @@ -369,7 +376,7 @@Regex scan Gemspec initialization blocks for metadata. |
-
-
-
diff --git a/analyzers/nexus-analyzer.html b/analyzers/nexus-analyzer.html
index 03be2f67a..32c9d4f3a 100644
--- a/analyzers/nexus-analyzer.html
+++ b/analyzers/nexus-analyzer.html
@@ -1,13 +1,13 @@
-
+
-
-
-
diff --git a/analyzers/nodejs.html b/analyzers/nodejs.html
index e8edb969f..690dc0302 100644
--- a/analyzers/nodejs.html
+++ b/analyzers/nodejs.html
@@ -1,13 +1,13 @@
-
+
-
-
-
@@ -236,8 +233,9 @@
Experimental: This analyzer is considered experimental. While this analyzer may be useful and provide valid results more testing must be completed to ensure that the false negative/false positive rates are acceptable.
OWASP dependency-check includes an analyzer that will scan Node Package Manager package specification files. The analyzer will collect as much information as it can about the package. The information collected is internally referred to as evidence and is grouped into vendor, product, and version buckets. Other analyzers later use this evidence to identify any Common Platform Enumeration (CPE) identifiers that apply.
-Note:_Consider using Retire.js or the Node Security Project auditing tool, nsp instead of, or in addition to OWASP dependency-check to analyze Node.js packages.
+Note: Consider using Retire.js or the Node Security Project auditing tool, nsp instead of, or in addition to OWASP dependency-check to analyze Node.js packages.
Files Types Scanned: package.json
-
-
-
diff --git a/analyzers/openssl.html b/analyzers/openssl.html
index c8ed29d4f..11c188d3e 100644
--- a/analyzers/openssl.html
+++ b/analyzers/openssl.html
@@ -1,13 +1,13 @@
-
+
-
-
-
diff --git a/analyzers/python.html b/analyzers/python.html
index 404df18df..e8dee681f 100644
--- a/analyzers/python.html
+++ b/analyzers/python.html
@@ -1,13 +1,13 @@
-
+
-
-
-
@@ -236,6 +233,7 @@
Experimental: This analyzer is considered experimental. While this analyzer may be useful and provide valid results more testing must be completed to ensure that the false negative/false positive rates are acceptable.
OWASP dependency-check includes an analyzer that will scan Python artifacts. The analyzer(s) will collect as much information it can about the Python artifacts. The information collected is internally referred to as evidence and is grouped into vendor, product, and version buckets. Other analyzers later use this evidence to identify any Common Platform Enumeration (CPE) identifiers that apply.
Files Types Scanned: py, whl, egg, zip, PKG-INFO, and METADATA
-
-
-
@@ -236,8 +233,9 @@
Experimental: This analyzer is considered experimental. While this analyzer may be useful and provide valid results more testing must be completed to ensure that the false negative/false positive rates are acceptable.
OWASP dependency-check includes an analyzer that will scan Ruby Gem specifications. The analyzer will collect as much information as it can about the Gem. The information collected is internally referred to as evidence and is grouped into vendor, product, and version buckets. Other analyzers later use this evidence to identify any Common Platform Enumeration (CPE) identifiers that apply.
-Note: It is highly recommended that Ruby projects use bundler-audit.
+Note: It is highly recommended that Ruby projects use bundler-audit.
Files Types Scanned: Rakefile, *.gemspec
-
-
-
diff --git a/data/database.html b/data/database.html
index 79da60df3..000b742fa 100644
--- a/data/database.html
+++ b/data/database.html
@@ -1,13 +1,13 @@
-
+
-
-
-
diff --git a/data/index.html b/data/index.html
index a57833e7e..157484ce9 100644
--- a/data/index.html
+++ b/data/index.html
@@ -1,13 +1,13 @@
-
+
-
-
-
@@ -261,7 +258,7 @@
If the machine that is running dependency-check cannot reach the Central Repository the analysis may result in false negatives. This is because some POM files, that are not contained within the JAR file itself, contain evidence that is used to accurately identify a library. If Central cannot be reached, it is highly recommended to setup a Nexus server within your organization and to configure dependency-check to use the local Nexus server. Note, even with a Nexus server setup I have seen dependency-check be re-directed to other repositories on the Internet to download the actual POM file.
If the machine that is running dependency-check cannot reach the Central Repository the analysis may result in false negatives. This is because some POM files, that are not contained within the JAR file itself, contain evidence that is used to accurately identify a library. If Central cannot be reached, it is highly recommended to setup a Nexus server within your organization and to configure dependency-check to use the local Nexus server. Note, even with a Nexus server setup I have seen dependency-check be re-directed to other repositories on the Internet to download the actual POM file; this happened due to a rare circumstance where the Nexus instance used by dependency-check was not the instance of Nexus used to build the application (i.e. the dependencies were not actually present in the Nexus used by dependency-check).
diff --git a/data/mirrornvd.html b/data/mirrornvd.html index c596de8ed..bbe3f485e 100644 --- a/data/mirrornvd.html +++ b/data/mirrornvd.html @@ -1,13 +1,13 @@ - +
-
-
-
diff --git a/data/proxy.html b/data/proxy.html
index c56d41c50..88659f7c3 100644
--- a/data/proxy.html
+++ b/data/proxy.html
@@ -1,13 +1,13 @@
-
+
-
-
-
@@ -256,6 +253,13 @@
Note, it may also be possible to use the core Java proxy system properties instead of the configuration above.
+In some cases if you setup a proxy the connection may still fail due to certificate errors (see the log file from dependency-check). If you know which cert it’s failing on (either your proxy or NVD/CVE) you can either add the certificate itself or the signing chain to your trust store. If you don’t have access to modify the system trust store (in $JAVA_HOME/lib/security/cacerts) you can copy it elsewhere and import it using keytool, then specify that trust store on the command line (mvn -Djavax.net.ssl.trustStore=/path/to/cacerts) or if you need to always have that set, you can set the environment variable JAVA_TOOL_OPTIONS to have -Djavax.net.ssl.trustStore=/path/to/cacerts.
In some cases the proxy is configured to block HEAD requests. While an attempt is made by dependency-check to identify this situation it does not appear to be 100% successful. As such, the last thing to try is to add the property mvn -Ddownloader.quick.query.timestamp=false.
+If trying the above and it still fails please open a ticket in the github repo.
-
-
-
diff --git a/dependency-analysis.html b/dependency-analysis.html
index 5583fe7a6..579c2a355 100644
--- a/dependency-analysis.html
+++ b/dependency-analysis.html
@@ -1,13 +1,13 @@
-
+
-
-
-
diff --git a/dependency-check-ant/apidocs/allclasses-frame.html b/dependency-check-ant/apidocs/allclasses-frame.html
index 99504f9aa..2d007a06e 100644
--- a/dependency-check-ant/apidocs/allclasses-frame.html
+++ b/dependency-check-ant/apidocs/allclasses-frame.html
@@ -2,10 +2,10 @@
-
+
-| Package | # Classes | Line Coverage | Branch Coverage | Complexity | ||||
| org.owasp.dependencycheck.taskdefs | 4 |
|
| 1.5480769230769231;1.548 | ||||
| org.owasp.dependencycheck.taskdefs | 4 |
|
| 1.5377358490566038;1.538 |
| Package | # Classes | Line Coverage | Branch Coverage | Complexity | ||||
| All Packages | 7 |
|
| 1.5734265734265733;1.573 | ||||
| All Packages | 7 |
|
| 1.5655172413793104;1.566 | ||||
| org.owasp.dependencycheck.ant.logging | 2 |
|
| 1.7352941176470589;1.735 | ||||
| org.owasp.dependencycheck.taskdefs | 4 |
|
| 1.5480769230769231;1.548 | ||||
| org.owasp.dependencycheck.taskdefs | 4 |
|
| 1.5377358490566038;1.538 | ||||
| org.slf4j.impl | 1 |
|
| 1.0;1 |
*/ public AntLoggerAdapter(Task task) { super(); this.task = task;}
super(); this.task = task;}
@Override
public void trace(String msg) {
if (task != null) {
task.log(msg, Project.MSG_VERBOSE);
if (task != null) {
task.log(msg, Project.MSG_VERBOSE);
}
}
}
@Override
public void trace(String format, Object arg) {
if (task != null) {
final FormattingTuple tp = MessageFormatter.format(format, arg);task.log(tp.getMessage(), Project.MSG_VERBOSE);
if (task != null) {
final FormattingTuple tp = MessageFormatter.format(format, arg);task.log(tp.getMessage(), Project.MSG_VERBOSE);
}
}
}
@Override
public boolean isDebugEnabled() {
return true;
return true;
}
@Override
public void debug(String msg) {
if (task != null) {
task.log(msg, Project.MSG_DEBUG);
if (task != null) {
task.log(msg, Project.MSG_DEBUG);
}
}
}
@Override
public void debug(String format, Object arg) {
if (task != null) {
final FormattingTuple tp = MessageFormatter.format(format, arg);task.log(tp.getMessage(), Project.MSG_DEBUG);
if (task != null) {
final FormattingTuple tp = MessageFormatter.format(format, arg);task.log(tp.getMessage(), Project.MSG_DEBUG);
}
}
}
@Override
public void debug(String format, Object arg1, Object arg2) {
if (task != null) {
final FormattingTuple tp = MessageFormatter.format(format, arg1, arg2);task.log(tp.getMessage(), Project.MSG_DEBUG);
if (task != null) {
final FormattingTuple tp = MessageFormatter.format(format, arg1, arg2);task.log(tp.getMessage(), Project.MSG_DEBUG);
}
}
}
@Override
public void debug(String format, Object... arguments) {
if (task != null) { final FormattingTuple tp = MessageFormatter.format(format, arguments);task.log(tp.getMessage(), Project.MSG_DEBUG);
if (task != null) { final FormattingTuple tp = MessageFormatter.format(format, arguments);task.log(tp.getMessage(), Project.MSG_DEBUG);
}
}
}
@Override
public void info(String msg) {
if (task != null) {task.log(msg, Project.MSG_INFO);
if (task != null) {task.log(msg, Project.MSG_INFO);
}
}
}
@Override
public void info(String format, Object arg) {
if (task != null) { final FormattingTuple tp = MessageFormatter.format(format, arg);task.log(tp.getMessage(), Project.MSG_INFO);
if (task != null) { final FormattingTuple tp = MessageFormatter.format(format, arg);task.log(tp.getMessage(), Project.MSG_INFO);
}
}
}
}
*/ public AntLoggerFactory(Task task) { super();this.antLoggerAdapter = new AntLoggerAdapter(task);
}
super();this.antLoggerAdapter = new AntLoggerAdapter(task);
}
@Override
public Logger getLogger(String name) { return antLoggerAdapter; return antLoggerAdapter;}
}
| Classes in this File | Line Coverage | Branch Coverage | Complexity | ||||
| Check |
|
| 1.6666666666666667;1.667 | ||||
| Check$ReportFormats |
|
| 1.6666666666666667;1.667 | ||||
| Check |
|
| 1.6470588235294117;1.647 | ||||
| Check$ReportFormats |
|
| 1.6470588235294117;1.647 |
* System specific new line character. */private static final String NEW_LINE = System.getProperty("line.separator", "\n").intern();
private static final String NEW_LINE = System.getProperty("line.separator", "\n").intern();
*/ public Check() { super(); super(); // Call this before Dependency Check Core starts logging anything - this way, all SLF4J messages from // core end up coming through this tasks logger StaticLoggerBinder.getSingleton().setTask(this);}
StaticLoggerBinder.getSingleton().setTask(this);}
//The following code was copied Apache Ant PathConvert * Path to be converted */private Resources path = null;
private Resources path = null;
/** * Reference to path/fileset to convert */private Reference refid = null;
private Reference refid = null;
*/public void add(ResourceCollection rc) {
if (isReference()) { if (isReference()) { throw new BuildException("Nested elements are not allowed when using the refid attribute.");}
getPath().add(rc);
}
getPath().add(rc);
}
/** * Returns the path. If the path has not been initialized yet, this class is synchronized, and will instantiate the path * Returns the path. If the path has not been initialized yet, this class is * object. * synchronized, and will instantiate the path object. * */private synchronized Resources getPath() {
if (path == null) {
path = new Resources(getProject()); path.setCache(true);if (path == null) {
path = new Resources(getProject()); path.setCache(true);}
return path; return path;}
*/public boolean isReference() {
return refid != null; return refid != null;}
/** * Add a reference to a Path, FileSet, DirSet, or FileList defined elsewhere. * Add a reference to a Path, FileSet, DirSet, or FileList defined * * elsewhere. * @param r the reference to a path, fileset, dirset or filelist. * */ * @param r the reference to a path, fileset, dirset or filelist. */public void setRefid(Reference r) {
if (path != null) { throw new BuildException("Nested elements are not allowed when using the refid attribute."); if (path != null) { throw new BuildException("Nested elements are not allowed when using the refid attribute.");}
refid = r; } refid = r; } /** * If this is a reference, this method will add the referenced resource collection to the collection of paths. * * @throws BuildException if the reference is not to a resource collection */private void dealWithReferences() throws BuildException {
if (isReference()) { final Object o = refid.getReferencedObject(getProject()); if (!(o instanceof ResourceCollection)) { throw new BuildException("refid '" + refid.getRefId() + "' does not refer to a resource collection.");}
getPath().add((ResourceCollection) o);}
}
// END COPY from org.apache.tools.ant.taskdefs /** * The application name for the report. * * @deprecated use projectName instead. */@Deprecated
private String applicationName = null;
/** * Get the value of applicationName. * If this is a reference, this method will add the referenced resource * collection to the collection of paths. * * @throws BuildException if the reference is not to a resource collection */private void dealWithReferences() throws BuildException {
if (isReference()) { final Object o = refid.getReferencedObject(getProject()); if (!(o instanceof ResourceCollection)) { throw new BuildException("refid '" + refid.getRefId() + "' does not refer to a resource collection.");}
getPath().add((ResourceCollection) o);}
}
// END COPY from org.apache.tools.ant.taskdefs /** * The application name for the report. * * @deprecated use projectName instead. */@Deprecated
private String applicationName = null;
/** * @return the value of applicationName * Get the value of applicationName. * * @deprecated use projectName instead. * @return the value of applicationName */ *@Deprecated
public String getApplicationName() { return applicationName;}
/** * Set the value of applicationName. * * @param applicationName new value of applicationName * @deprecated use projectName instead. */@Deprecated
public String getApplicationName() { return applicationName;}
/** * Set the value of applicationName. * */ * @param applicationName new value of applicationName@Deprecated
* @deprecated use projectName instead. */@Deprecated
public void setApplicationName(String applicationName) {
this.applicationName = applicationName;}
/** * The name of the project being analyzed. this.applicationName = applicationName;}
*/private String projectName = "dependency-check";
/** * The name of the project being analyzed. /** */private String projectName = "dependency-check";
* Get the value of projectName. * /** * @return the value of projectName * Get the value of projectName. */ * * @return the value of projectName */ public String getProjectName() { if (applicationName != null) { log("Configuration 'applicationName' has been deprecated, please use 'projectName' instead", Project.MSG_WARN); if ("dependency-check".equals(projectName)) {projectName = applicationName;
if (applicationName != null) { log("Configuration 'applicationName' has been deprecated, please use 'projectName' instead", Project.MSG_WARN); if ("dependency-check".equals(projectName)) {projectName = applicationName;
}
}
return projectName;}
}
return projectName; /**}
* Set the value of projectName. * /** * @param projectName new value of projectName * Set the value of projectName. */ * * @param projectName new value of projectName */public void setProjectName(String projectName) {
this.projectName = projectName; } /** this.projectName = projectName; } * Specifies the destination directory for the generated Dependency-Check report. */private String reportOutputDirectory = ".";
/** * Specifies the destination directory for the generated Dependency-Check * report. /** * Get the value of reportOutputDirectory. */private String reportOutputDirectory = ".";
* * @return the value of reportOutputDirectory /** */ * Get the value of reportOutputDirectory. public String getReportOutputDirectory() { return reportOutputDirectory; * * @return the value of reportOutputDirectory}
*/ /** public String getReportOutputDirectory() { return reportOutputDirectory; * Set the value of reportOutputDirectory.}
* * @param reportOutputDirectory new value of reportOutputDirectory /** */ * Set the value of reportOutputDirectory.public void setReportOutputDirectory(String reportOutputDirectory) {
this.reportOutputDirectory = reportOutputDirectory;}
* * @param reportOutputDirectory new value of reportOutputDirectory */ /** * Specifies if the build should be failed if a CVSS score above a specified level is identified. The default is 11 which * means since the CVSS scores are 0-10, by default the build will never fail and the CVSS score is set to 11. The valid rangepublic void setReportOutputDirectory(String reportOutputDirectory) {
this.reportOutputDirectory = reportOutputDirectory;}
* for the fail build on CVSS is 0 to 11, where anything above 10 will not cause the build to fail. /** */private float failBuildOnCVSS = 11;
* Specifies if the build should be failed if a CVSS score above a specified * level is identified. The default is 11 which means since the CVSS scores * are 0-10, by default the build will never fail and the CVSS score is set /** * to 11. The valid range for the fail build on CVSS is 0 to 11, where * Get the value of failBuildOnCVSS. * anything above 10 will not cause the build to fail. * * @return the value of failBuildOnCVSS */private float failBuildOnCVSS = 11;
*/public float getFailBuildOnCVSS() {
return failBuildOnCVSS; /** * Get the value of failBuildOnCVSS.}
* * @return the value of failBuildOnCVSS /** */ * Set the value of failBuildOnCVSS. *public float getFailBuildOnCVSS() {
return failBuildOnCVSS; * @param failBuildOnCVSS new value of failBuildOnCVSS}
*/public void setFailBuildOnCVSS(float failBuildOnCVSS) {
this.failBuildOnCVSS = failBuildOnCVSS;}
/** * Set the value of failBuildOnCVSS. * /** * @param failBuildOnCVSS new value of failBuildOnCVSS * Sets whether auto-updating of the NVD CVE/CPE data is enabled. It is not recommended that this be turned to false. Default */ * is true. */ private Boolean autoUpdate;public void setFailBuildOnCVSS(float failBuildOnCVSS) {
this.failBuildOnCVSS = failBuildOnCVSS;}
/** /** * Sets whether auto-updating of the NVD CVE/CPE data is enabled. It is not * Get the value of autoUpdate. * recommended that this be turned to false. Default is true. * */ * @return the value of autoUpdate private Boolean autoUpdate; */ public Boolean isAutoUpdate() { return autoUpdate; /** * Get the value of autoUpdate.}
* * @return the value of autoUpdate /** */ * Set the value of autoUpdate. * public Boolean isAutoUpdate() { return autoUpdate; * @param autoUpdate new value of autoUpdate */public void setAutoUpdate(Boolean autoUpdate) {
this.autoUpdate = autoUpdate;}
/** * Whether only the update phase should be executed. * * @deprecated Use the update task instead */@Deprecated
private boolean updateOnly = false;
/** * Get the value of updateOnly. * * @return the value of updateOnly * @deprecated Use the update task instead */@Deprecated
public boolean isUpdateOnly() {
return updateOnly;}
/** * Set the value of updateOnly. * Set the value of autoUpdate. * * @param updateOnly new value of updateOnly * @deprecated Use the update task instead * @param autoUpdate new value of autoUpdate */@Deprecated
public void setUpdateOnly(boolean updateOnly) {
this.updateOnly = updateOnly; }public void setAutoUpdate(Boolean autoUpdate) {
this.autoUpdate = autoUpdate;}
/** * The report format to be generated (HTML, XML, VULN, ALL). Default is HTML. * Whether only the update phase should be executed. * * @deprecated Use the update task instead */private String reportFormat = "HTML";
@Deprecated
private boolean updateOnly = false;
/** * Get the value of updateOnly. * * @return the value of updateOnly * @deprecated Use the update task instead */@Deprecated
public boolean isUpdateOnly() {
return updateOnly;}
/** * Set the value of updateOnly. * * @param updateOnly new value of updateOnly * @deprecated Use the update task instead */@Deprecated
public void setUpdateOnly(boolean updateOnly) {
this.updateOnly = updateOnly; } /** * Get the value of reportFormat. * The report format to be generated (HTML, XML, VULN, ALL). Default is * * HTML. * @return the value of reportFormat */private String reportFormat = "HTML";
public String getReportFormat() { return reportFormat;}
/** * Set the value of reportFormat. * Get the value of reportFormat. * * @param reportFormat new value of reportFormat * @return the value of reportFormat */ public String getReportFormat() { return reportFormat;}
public void setReportFormat(ReportFormats reportFormat) {
this.reportFormat = reportFormat.getValue();}
/** * Set the value of reportFormat. * * The path to the suppression file. * @param reportFormat new value of reportFormat */ private String suppressionFile; /**public void setReportFormat(ReportFormats reportFormat) {
this.reportFormat = reportFormat.getValue();}
* Get the value of suppressionFile. /** * * The path to the suppression file. * @return the value of suppressionFile */ */ private String suppressionFile; public String getSuppressionFile() { return suppressionFile;}
/** * Set the value of suppressionFile. * Get the value of suppressionFile. * * @param suppressionFile new value of suppressionFile * @return the value of suppressionFile */ public String getSuppressionFile() { return suppressionFile;}
public void setSuppressionFile(String suppressionFile) {
this.suppressionFile = suppressionFile; } /** * Set the value of suppressionFile. * * flag indicating whether or not to show a summary of findings. * @param suppressionFile new value of suppressionFile */private boolean showSummary = true;
/**public void setSuppressionFile(String suppressionFile) {
this.suppressionFile = suppressionFile; } * Get the value of showSummary. /** * * flag indicating whether or not to show a summary of findings. * @return the value of showSummary */private boolean showSummary = true;
public boolean isShowSummary() {
return showSummary; /**}
* Get the value of showSummary. * /** * @return the value of showSummary * Set the value of showSummary. */ * * @param showSummary new value of showSummarypublic boolean isShowSummary() {
return showSummary; */public void setShowSummary(boolean showSummary) {
this.showSummary = showSummary; } /** * Whether or not the Jar Analyzer is enabled. */ private Boolean jarAnalyzerEnabled; /** * Returns whether or not the analyzer is enabled. * * @return true if the analyzer is enabled */ public Boolean isJarAnalyzerEnabled() { return jarAnalyzerEnabled;}
/** * Sets whether or not the analyzer is enabled. * Set the value of showSummary. * * @param jarAnalyzerEnabled the value of the new setting * @param showSummary new value of showSummary */public void setJarAnalyzerEnabled(Boolean jarAnalyzerEnabled) {
this.jarAnalyzerEnabled = jarAnalyzerEnabled; }public void setShowSummary(boolean showSummary) {
this.showSummary = showSummary; } /** * Whether experimental analyzers are enabled. */ private Boolean enableExperimental; /** * Get the value of enableExperimental. * * @return the value of enableExperimental */ public Boolean isEnableExperimental() { return enableExperimental;}
/** * Set the value of enableExperimental. * * Whether or not the Archive Analyzer is enabled. * @param enableExperimental new value of enableExperimental */ private Boolean archiveAnalyzerEnabled; /**public void setEnableExperimental(Boolean enableExperimental) {
this.enableExperimental = enableExperimental; } * Returns whether or not the analyzer is enabled. * /** * @return true if the analyzer is enabled * Whether or not the Jar Analyzer is enabled. */ public Boolean isArchiveAnalyzerEnabled() { return archiveAnalyzerEnabled; private Boolean jarAnalyzerEnabled;}
/** /** * Whether or not the .NET Assembly Analyzer is enabled. */ private Boolean assemblyAnalyzerEnabled; /** * Sets whether or not the analyzer is enabled. * * @param archiveAnalyzerEnabled the value of the new setting */public void setArchiveAnalyzerEnabled(Boolean archiveAnalyzerEnabled) {
this.archiveAnalyzerEnabled = archiveAnalyzerEnabled; } /** * Returns whether or not the analyzer is enabled. * * @return true if the analyzer is enabled */ public Boolean isJarAnalyzerEnabled() { return jarAnalyzerEnabled;}
/** * Sets whether or not the analyzer is enabled. * * @param jarAnalyzerEnabled the value of the new setting */public void setJarAnalyzerEnabled(Boolean jarAnalyzerEnabled) {
this.jarAnalyzerEnabled = jarAnalyzerEnabled; } /** * Whether or not the Archive Analyzer is enabled. */ public Boolean isAssemblyAnalyzerEnabled() { return assemblyAnalyzerEnabled; private Boolean archiveAnalyzerEnabled;}
/** /** * Sets whether or not the analyzer is enabled. * * @param assemblyAnalyzerEnabled the value of the new setting */public void setAssemblyAnalyzerEnabled(Boolean assemblyAnalyzerEnabled) {
this.assemblyAnalyzerEnabled = assemblyAnalyzerEnabled; } /** * Whether or not the .NET Nuspec Analyzer is enabled. */ private Boolean nuspecAnalyzerEnabled; /** * Returns whether or not the analyzer is enabled. * * @return true if the analyzer is enabled */ public Boolean isNuspecAnalyzerEnabled() { return nuspecAnalyzerEnabled; public Boolean isArchiveAnalyzerEnabled() { return archiveAnalyzerEnabled;}
/** * Whether or not the .NET Assembly Analyzer is enabled. */ private Boolean assemblyAnalyzerEnabled; /** * Sets whether or not the analyzer is enabled. * * @param nuspecAnalyzerEnabled the value of the new setting * @param archiveAnalyzerEnabled the value of the new setting */public void setNuspecAnalyzerEnabled(Boolean nuspecAnalyzerEnabled) {
this.nuspecAnalyzerEnabled = nuspecAnalyzerEnabled; } /** * Whether or not the PHP Composer Analyzer is enabled. */ private Boolean composerAnalyzerEnabled;public void setArchiveAnalyzerEnabled(Boolean archiveAnalyzerEnabled) {
this.archiveAnalyzerEnabled = archiveAnalyzerEnabled; } /** * Get the value of composerAnalyzerEnabled. * Returns whether or not the analyzer is enabled. * * @return true if the analyzer is enabled */ public Boolean isAssemblyAnalyzerEnabled() { return assemblyAnalyzerEnabled;}
/** * Sets whether or not the analyzer is enabled. * * @param assemblyAnalyzerEnabled the value of the new setting */public void setAssemblyAnalyzerEnabled(Boolean assemblyAnalyzerEnabled) {
this.assemblyAnalyzerEnabled = assemblyAnalyzerEnabled; } /** * @return the value of composerAnalyzerEnabled * Whether or not the .NET Nuspec Analyzer is enabled. */ public Boolean isComposerAnalyzerEnabled() { return composerAnalyzerEnabled; private Boolean nuspecAnalyzerEnabled;}
/** * Returns whether or not the analyzer is enabled. /** * * Set the value of composerAnalyzerEnabled. * @return true if the analyzer is enabled * */ * @param composerAnalyzerEnabled new value of composerAnalyzerEnabled */ public Boolean isNuspecAnalyzerEnabled() { return nuspecAnalyzerEnabled;public void setComposerAnalyzerEnabled(Boolean composerAnalyzerEnabled) {
this.composerAnalyzerEnabled = composerAnalyzerEnabled; } /** * Whether the autoconf analyzer should be enabled. */ private Boolean autoconfAnalyzerEnabled;}
/** * Get the value of autoconfAnalyzerEnabled. * Sets whether or not the analyzer is enabled. * * @param nuspecAnalyzerEnabled the value of the new setting */public void setNuspecAnalyzerEnabled(Boolean nuspecAnalyzerEnabled) {
this.nuspecAnalyzerEnabled = nuspecAnalyzerEnabled; } /** * @return the value of autoconfAnalyzerEnabled * Whether or not the PHP Composer Analyzer is enabled. */ public Boolean isAutoconfAnalyzerEnabled() { return autoconfAnalyzerEnabled; private Boolean composerAnalyzerEnabled;}
/** * Get the value of composerAnalyzerEnabled. /** * * Set the value of autoconfAnalyzerEnabled. * @return the value of composerAnalyzerEnabled * */ * @param autoconfAnalyzerEnabled new value of autoconfAnalyzerEnabled */ public Boolean isComposerAnalyzerEnabled() { return composerAnalyzerEnabled;public void setAutoconfAnalyzerEnabled(Boolean autoconfAnalyzerEnabled) {
this.autoconfAnalyzerEnabled = autoconfAnalyzerEnabled; } /** * Whether the CMake analyzer should be enabled. */ private Boolean cmakeAnalyzerEnabled;}
/** * Get the value of cmakeAnalyzerEnabled. * Set the value of composerAnalyzerEnabled. * * @param composerAnalyzerEnabled new value of composerAnalyzerEnabled */public void setComposerAnalyzerEnabled(Boolean composerAnalyzerEnabled) {
this.composerAnalyzerEnabled = composerAnalyzerEnabled; } /** * @return the value of cmakeAnalyzerEnabled * Whether the autoconf analyzer should be enabled. */ public Boolean isCMakeAnalyzerEnabled() { return cmakeAnalyzerEnabled; private Boolean autoconfAnalyzerEnabled;}
/** * Get the value of autoconfAnalyzerEnabled. /** * * Set the value of cmakeAnalyzerEnabled. * @return the value of autoconfAnalyzerEnabled * */ * @param cmakeAnalyzerEnabled new value of cmakeAnalyzerEnabled */ public Boolean isAutoconfAnalyzerEnabled() { return autoconfAnalyzerEnabled;public void setCMakeAnalyzerEnabled(Boolean cmakeAnalyzerEnabled) {
this.cmakeAnalyzerEnabled = cmakeAnalyzerEnabled; } /** * Whether or not the openssl analyzer is enabled. */ private Boolean opensslAnalyzerEnabled;}
/** * Get the value of opensslAnalyzerEnabled. * Set the value of autoconfAnalyzerEnabled. * * @param autoconfAnalyzerEnabled new value of autoconfAnalyzerEnabled */public void setAutoconfAnalyzerEnabled(Boolean autoconfAnalyzerEnabled) {
this.autoconfAnalyzerEnabled = autoconfAnalyzerEnabled; } /** * @return the value of opensslAnalyzerEnabled * Whether the CMake analyzer should be enabled. */ public Boolean isOpensslAnalyzerEnabled() { return opensslAnalyzerEnabled; private Boolean cmakeAnalyzerEnabled;}
/** * Get the value of cmakeAnalyzerEnabled. /** * * Set the value of opensslAnalyzerEnabled. * @return the value of cmakeAnalyzerEnabled * */ * @param opensslAnalyzerEnabled new value of opensslAnalyzerEnabled */ public Boolean isCMakeAnalyzerEnabled() { return cmakeAnalyzerEnabled;public void setOpensslAnalyzerEnabled(Boolean opensslAnalyzerEnabled) {
this.opensslAnalyzerEnabled = opensslAnalyzerEnabled; } /** * Whether or not the Node.js Analyzer is enabled. */ private Boolean nodeAnalyzerEnabled;}
/** * Get the value of nodeAnalyzerEnabled. * Set the value of cmakeAnalyzerEnabled. * * @param cmakeAnalyzerEnabled new value of cmakeAnalyzerEnabled */public void setCMakeAnalyzerEnabled(Boolean cmakeAnalyzerEnabled) {
this.cmakeAnalyzerEnabled = cmakeAnalyzerEnabled; } /** * @return the value of nodeAnalyzerEnabled * Whether or not the openssl analyzer is enabled. */ public Boolean isNodeAnalyzerEnabled() { return nodeAnalyzerEnabled; private Boolean opensslAnalyzerEnabled;}
/** * Get the value of opensslAnalyzerEnabled. /** * * Set the value of nodeAnalyzerEnabled. * @return the value of opensslAnalyzerEnabled * */ * @param nodeAnalyzerEnabled new value of nodeAnalyzerEnabled */ public Boolean isOpensslAnalyzerEnabled() { return opensslAnalyzerEnabled;public void setNodeAnalyzerEnabled(Boolean nodeAnalyzerEnabled) {
this.nodeAnalyzerEnabled = nodeAnalyzerEnabled; } /** * Whether the ruby gemspec analyzer should be enabled. */ private Boolean rubygemsAnalyzerEnabled;}
/** * Get the value of rubygemsAnalyzerEnabled. * Set the value of opensslAnalyzerEnabled. * * @param opensslAnalyzerEnabled new value of opensslAnalyzerEnabled */public void setOpensslAnalyzerEnabled(Boolean opensslAnalyzerEnabled) {
this.opensslAnalyzerEnabled = opensslAnalyzerEnabled; } /** * @return the value of rubygemsAnalyzerEnabled * Whether or not the Node.js Analyzer is enabled. */ public Boolean isRubygemsAnalyzerEnabled() { return rubygemsAnalyzerEnabled; private Boolean nodeAnalyzerEnabled;}
/** * Get the value of nodeAnalyzerEnabled. /** * * Set the value of rubygemsAnalyzerEnabled. * @return the value of nodeAnalyzerEnabled * */ * @param rubygemsAnalyzerEnabled new value of rubygemsAnalyzerEnabled */ public Boolean isNodeAnalyzerEnabled() { return nodeAnalyzerEnabled;public void setRubygemsAnalyzerEnabled(Boolean rubygemsAnalyzerEnabled) {
this.rubygemsAnalyzerEnabled = rubygemsAnalyzerEnabled; } /** * Whether the python package analyzer should be enabled. */ private Boolean pyPackageAnalyzerEnabled;}
/** * Get the value of pyPackageAnalyzerEnabled. * Set the value of nodeAnalyzerEnabled. * * @param nodeAnalyzerEnabled new value of nodeAnalyzerEnabled */public void setNodeAnalyzerEnabled(Boolean nodeAnalyzerEnabled) {
this.nodeAnalyzerEnabled = nodeAnalyzerEnabled; } /** * @return the value of pyPackageAnalyzerEnabled * Whether the ruby gemspec analyzer should be enabled. */ public Boolean isPyPackageAnalyzerEnabled() { return pyPackageAnalyzerEnabled; private Boolean rubygemsAnalyzerEnabled;}
/** * Get the value of rubygemsAnalyzerEnabled. /** * Set the value of pyPackageAnalyzerEnabled. * * @param pyPackageAnalyzerEnabled new value of pyPackageAnalyzerEnabled * @return the value of rubygemsAnalyzerEnabled */ public Boolean isRubygemsAnalyzerEnabled() { return rubygemsAnalyzerEnabled;public void setPyPackageAnalyzerEnabled(Boolean pyPackageAnalyzerEnabled) {
this.pyPackageAnalyzerEnabled = pyPackageAnalyzerEnabled; }}
/** * Set the value of rubygemsAnalyzerEnabled. * * Whether the python distribution analyzer should be enabled. * @param rubygemsAnalyzerEnabled new value of rubygemsAnalyzerEnabled */ private Boolean pyDistributionAnalyzerEnabled; /**public void setRubygemsAnalyzerEnabled(Boolean rubygemsAnalyzerEnabled) {
this.rubygemsAnalyzerEnabled = rubygemsAnalyzerEnabled; } * Get the value of pyDistributionAnalyzerEnabled. /** * * Whether the python package analyzer should be enabled. * @return the value of pyDistributionAnalyzerEnabled */ */ private Boolean pyPackageAnalyzerEnabled; public Boolean isPyDistributionAnalyzerEnabled() { return pyDistributionAnalyzerEnabled; /**}
* Get the value of pyPackageAnalyzerEnabled. * /** * @return the value of pyPackageAnalyzerEnabled * Set the value of pyDistributionAnalyzerEnabled. */ * * @param pyDistributionAnalyzerEnabled new value of pyDistributionAnalyzerEnabled public Boolean isPyPackageAnalyzerEnabled() { return pyPackageAnalyzerEnabled; */public void setPyDistributionAnalyzerEnabled(Boolean pyDistributionAnalyzerEnabled) {
this.pyDistributionAnalyzerEnabled = pyDistributionAnalyzerEnabled; } /** * Whether or not the central analyzer is enabled. */ private Boolean centralAnalyzerEnabled; /** * Get the value of centralAnalyzerEnabled. * * @return the value of centralAnalyzerEnabled */ public Boolean isCentralAnalyzerEnabled() { return centralAnalyzerEnabled;}
/** * Set the value of centralAnalyzerEnabled. * Set the value of pyPackageAnalyzerEnabled. * * @param centralAnalyzerEnabled new value of centralAnalyzerEnabled * @param pyPackageAnalyzerEnabled new value of pyPackageAnalyzerEnabled */public void setCentralAnalyzerEnabled(Boolean centralAnalyzerEnabled) {
this.centralAnalyzerEnabled = centralAnalyzerEnabled; }public void setPyPackageAnalyzerEnabled(Boolean pyPackageAnalyzerEnabled) {
this.pyPackageAnalyzerEnabled = pyPackageAnalyzerEnabled; } /** * Whether the python distribution analyzer should be enabled. */ private Boolean pyDistributionAnalyzerEnabled; /** * Get the value of pyDistributionAnalyzerEnabled. * * @return the value of pyDistributionAnalyzerEnabled */ public Boolean isPyDistributionAnalyzerEnabled() { return pyDistributionAnalyzerEnabled;}
/** * Set the value of pyDistributionAnalyzerEnabled. * * @param pyDistributionAnalyzerEnabled new value of * Whether or not the nexus analyzer is enabled. * pyDistributionAnalyzerEnabled */ private Boolean nexusAnalyzerEnabled; /**public void setPyDistributionAnalyzerEnabled(Boolean pyDistributionAnalyzerEnabled) {
this.pyDistributionAnalyzerEnabled = pyDistributionAnalyzerEnabled; } * Get the value of nexusAnalyzerEnabled. * /** * @return the value of nexusAnalyzerEnabled * Whether or not the central analyzer is enabled. */ public Boolean isNexusAnalyzerEnabled() { return nexusAnalyzerEnabled; private Boolean centralAnalyzerEnabled;}
/** * Get the value of centralAnalyzerEnabled. /** * Set the value of nexusAnalyzerEnabled. * * @param nexusAnalyzerEnabled new value of nexusAnalyzerEnabled * @return the value of centralAnalyzerEnabled */ public Boolean isCentralAnalyzerEnabled() { return centralAnalyzerEnabled;public void setNexusAnalyzerEnabled(Boolean nexusAnalyzerEnabled) {
this.nexusAnalyzerEnabled = nexusAnalyzerEnabled; }}
/** * Set the value of centralAnalyzerEnabled. * * The URL of a Nexus server's REST API end point (http://domain/nexus/service/local). * @param centralAnalyzerEnabled new value of centralAnalyzerEnabled */ private String nexusUrl; /**public void setCentralAnalyzerEnabled(Boolean centralAnalyzerEnabled) {
this.centralAnalyzerEnabled = centralAnalyzerEnabled; } * Get the value of nexusUrl. * /** * @return the value of nexusUrl * Whether or not the nexus analyzer is enabled. */ public String getNexusUrl() { return nexusUrl; private Boolean nexusAnalyzerEnabled;}
/** * Get the value of nexusAnalyzerEnabled. /** * * Set the value of nexusUrl. * @return the value of nexusAnalyzerEnabled * */ * @param nexusUrl new value of nexusUrl */ public Boolean isNexusAnalyzerEnabled() { return nexusAnalyzerEnabled;public void setNexusUrl(String nexusUrl) {
this.nexusUrl = nexusUrl; } /** * Whether or not the defined proxy should be used when connecting to Nexus. */ private Boolean nexusUsesProxy; /** * Get the value of nexusUsesProxy. * * @return the value of nexusUsesProxy */ public Boolean isNexusUsesProxy() { return nexusUsesProxy;}
/** * Set the value of nexusAnalyzerEnabled. * * @param nexusAnalyzerEnabled new value of nexusAnalyzerEnabled */public void setNexusAnalyzerEnabled(Boolean nexusAnalyzerEnabled) {
this.nexusAnalyzerEnabled = nexusAnalyzerEnabled; } /** * The URL of a Nexus server's REST API end point * (http://domain/nexus/service/local). */ private String nexusUrl; /** * Set the value of nexusUsesProxy. * Get the value of nexusUrl. * * @param nexusUsesProxy new value of nexusUsesProxy * @return the value of nexusUrl */public void setNexusUsesProxy(Boolean nexusUsesProxy) {
this.nexusUsesProxy = nexusUsesProxy; } public String getNexusUrl() { return nexusUrl;}
/** * Additional ZIP File extensions to add analyze. This should be a comma-separated list of file extensions to treat like ZIP * Set the value of nexusUrl. * files. */ private String zipExtensions; /** * Get the value of zipExtensions. * * @param nexusUrl new value of nexusUrl */public void setNexusUrl(String nexusUrl) {
this.nexusUrl = nexusUrl; } /** * @return the value of zipExtensions * Whether or not the defined proxy should be used when connecting to Nexus. */ public String getZipExtensions() { return zipExtensions; private Boolean nexusUsesProxy;}
/** * Get the value of nexusUsesProxy. /** * Set the value of zipExtensions. * * @param zipExtensions new value of zipExtensions * @return the value of nexusUsesProxy */ public Boolean isNexusUsesProxy() { return nexusUsesProxy;public void setZipExtensions(String zipExtensions) {
this.zipExtensions = zipExtensions; }}
/** * Set the value of nexusUsesProxy. * * The path to Mono for .NET assembly analysis on non-windows systems. * @param nexusUsesProxy new value of nexusUsesProxy */ private String pathToMono; /**public void setNexusUsesProxy(Boolean nexusUsesProxy) {
this.nexusUsesProxy = nexusUsesProxy; } * Get the value of pathToMono. * /** * @return the value of pathToMono * Additional ZIP File extensions to add analyze. This should be a */ * comma-separated list of file extensions to treat like ZIP files. public String getPathToMono() { return pathToMono; */ private String zipExtensions;}
/** /** * Get the value of zipExtensions. * Set the value of pathToMono. * * * @return the value of zipExtensions * @param pathToMono new value of pathToMono */ */public void setPathToMono(String pathToMono) {
this.pathToMono = pathToMono; }@Override
public void execute() throws BuildException {
dealWithReferences();
validateConfiguration();
populateSettings();
Engine engine = null; try {engine = new Engine(Check.class.getClassLoader());
if (isUpdateOnly()) { log("Deprecated 'UpdateOnly' property set; please use the UpdateTask instead", Project.MSG_WARN); engine.doUpdates(); } else { try {for (Resource resource : path) {
final FileProvider provider = resource.as(FileProvider.class);
if (provider != null) { final File file = provider.getFile(); if (file != null && file.exists()) {engine.scan(file);
}
}
}
engine.analyzeDependencies();
DatabaseProperties prop = null; CveDB cve = null; try { cve = new CveDB();cve.open();
prop = cve.getDatabaseProperties();
} catch (DatabaseException ex) { log("Unable to retrieve DB Properties", ex, Project.MSG_DEBUG); } finally { if (cve != null) {cve.close();
}
}
final ReportGenerator reporter = new ReportGenerator(getProjectName(), engine.getDependencies(), engine.getAnalyzers(), prop);
reporter.generateReports(reportOutputDirectory, reportFormat);
if (this.failBuildOnCVSS <= 10) { checkForFailure(engine.getDependencies());}
if (this.showSummary) {showSummary(engine.getDependencies());
}
} catch (IOException ex) { log("Unable to generate dependency-check report", ex, Project.MSG_DEBUG); throw new BuildException("Unable to generate dependency-check report", ex); } catch (Exception ex) { log("An exception occurred; unable to continue task", ex, Project.MSG_DEBUG); throw new BuildException("An exception occurred; unable to continue task", ex);}
}
} catch (DatabaseException ex) { log("Unable to connect to the dependency-check database; analysis has stopped", ex, Project.MSG_ERR); } finally { Settings.cleanup(true); if (engine != null) {engine.cleanup();
}
}
}
/** * Validate the configuration to ensure the parameters have been properly configured/initialized. * * @throws BuildException if the task was not configured correctly. */private void validateConfiguration() throws BuildException {
if (path == null) {
throw new BuildException("No project dependencies have been defined to analyze.");
}
if (failBuildOnCVSS < 0 || failBuildOnCVSS > 11) { throw new BuildException("Invalid configuration, failBuildOnCVSS must be between 0 and 11.");}
}
/** * Takes the properties supplied and updates the dependency-check settings. Additionally, this sets the system properties * required to change the proxy server, port, and connection timeout. * * @throws BuildException thrown when an invalid setting is configured. */@Override
protected void populateSettings() throws BuildException {
super.populateSettings();Settings.setBooleanIfNotNull(Settings.KEYS.AUTO_UPDATE, autoUpdate);
Settings.setStringIfNotEmpty(Settings.KEYS.SUPPRESSION_FILE, suppressionFile);
Settings.setBooleanIfNotNull(Settings.KEYS.ANALYZER_JAR_ENABLED, jarAnalyzerEnabled);
Settings.setBooleanIfNotNull(Settings.KEYS.ANALYZER_PYTHON_DISTRIBUTION_ENABLED, pyDistributionAnalyzerEnabled);
Settings.setBooleanIfNotNull(Settings.KEYS.ANALYZER_PYTHON_PACKAGE_ENABLED, pyPackageAnalyzerEnabled);
Settings.setBooleanIfNotNull(Settings.KEYS.ANALYZER_RUBY_GEMSPEC_ENABLED, rubygemsAnalyzerEnabled);
Settings.setBooleanIfNotNull(Settings.KEYS.ANALYZER_OPENSSL_ENABLED, opensslAnalyzerEnabled);
Settings.setBooleanIfNotNull(Settings.KEYS.ANALYZER_CMAKE_ENABLED, cmakeAnalyzerEnabled);
Settings.setBooleanIfNotNull(Settings.KEYS.ANALYZER_AUTOCONF_ENABLED, autoconfAnalyzerEnabled);
Settings.setBooleanIfNotNull(Settings.KEYS.ANALYZER_COMPOSER_LOCK_ENABLED, composerAnalyzerEnabled);
Settings.setBooleanIfNotNull(Settings.KEYS.ANALYZER_NODE_PACKAGE_ENABLED, nodeAnalyzerEnabled);
Settings.setBooleanIfNotNull(Settings.KEYS.ANALYZER_NUSPEC_ENABLED, nuspecAnalyzerEnabled);
Settings.setBooleanIfNotNull(Settings.KEYS.ANALYZER_CENTRAL_ENABLED, centralAnalyzerEnabled);
Settings.setBooleanIfNotNull(Settings.KEYS.ANALYZER_NEXUS_ENABLED, nexusAnalyzerEnabled);
Settings.setBooleanIfNotNull(Settings.KEYS.ANALYZER_ARCHIVE_ENABLED, archiveAnalyzerEnabled);
Settings.setBooleanIfNotNull(Settings.KEYS.ANALYZER_ASSEMBLY_ENABLED, assemblyAnalyzerEnabled);
Settings.setStringIfNotEmpty(Settings.KEYS.ANALYZER_NEXUS_URL, nexusUrl);
Settings.setBooleanIfNotNull(Settings.KEYS.ANALYZER_NEXUS_USES_PROXY, nexusUsesProxy);
Settings.setStringIfNotEmpty(Settings.KEYS.ADDITIONAL_ZIP_EXTENSIONS, zipExtensions);
Settings.setStringIfNotEmpty(Settings.KEYS.ANALYZER_ASSEMBLY_MONO_PATH, pathToMono);
}
/** * Checks to see if a vulnerability has been identified with a CVSS score that is above the threshold set in the * configuration. * * @param dependencies the list of dependency objects * @throws BuildException thrown if a CVSS score is found that is higher then the threshold set */private void checkForFailure(List<Dependency> dependencies) throws BuildException {
final StringBuilder ids = new StringBuilder(); for (Dependency d : dependencies) { for (Vulnerability v : d.getVulnerabilities()) { if (v.getCvssScore() >= failBuildOnCVSS) { if (ids.length() == 0) { ids.append(v.getName()); } else { ids.append(", ").append(v.getName());}
}
} } if (ids.length() > 0) { final String msg = String.format("%n%nDependency-Check Failure:%n" + "One or more dependencies were identified with vulnerabilities that have a CVSS score greater then '%.1f': %s%n" + "See the dependency-check report for more details.%n%n", failBuildOnCVSS, ids.toString()); throw new BuildException(msg);}
} /** * Generates a warning message listing a summary of dependencies and their associated CPE and CVE entries. * * @param dependencies a list of dependency objects */private void showSummary(List<Dependency> dependencies) {
final StringBuilder summary = new StringBuilder();
for (Dependency d : dependencies) {
boolean firstEntry = true;
final StringBuilder ids = new StringBuilder();
for (Vulnerability v : d.getVulnerabilities()) {
if (firstEntry) {
firstEntry = false; } else { ids.append(", ");}
ids.append(v.getName());
}
if (ids.length() > 0) {
summary.append(d.getFileName()).append(" ("); firstEntry = true;for (Identifier id : d.getIdentifiers()) {
if (firstEntry) {
firstEntry = false; } else { summary.append(", ");}
summary.append(id.getValue());
}
summary.append(") : ").append(ids).append(NEW_LINE);}
}
if (summary.length() > 0) {
final String msg = String.format("%n%n"
+ "One or more dependencies were identified with known vulnerabilities:%n%n%s" + "%n%nSee the dependency-check report for more details.%n%n", summary.toString());log(msg, Project.MSG_WARN);
}
}
/** * An enumeration of supported report formats: "ALL", "HTML", "XML", "VULN", etc.. */public static class ReportFormats extends EnumeratedAttribute {
/** * Returns the list of values for the report format. * * @return the list of values for the report format */@Override
public String[] getValues() { int i = 0; final Format[] formats = Format.values();final String[] values = new String[formats.length];
for (Format format : formats) {
values[i++] = format.name();
}
return values;}
public String getZipExtensions() { return zipExtensions;}
/** * Set the value of zipExtensions. * * @param zipExtensions new value of zipExtensions */public void setZipExtensions(String zipExtensions) {
this.zipExtensions = zipExtensions; } /** * The path to Mono for .NET assembly analysis on non-windows systems. */ private String pathToMono; /** * Get the value of pathToMono. * * @return the value of pathToMono */ public String getPathToMono() { return pathToMono;}
/** * Set the value of pathToMono. * * @param pathToMono new value of pathToMono */public void setPathToMono(String pathToMono) {
this.pathToMono = pathToMono; }@Override
public void execute() throws BuildException {
dealWithReferences();
validateConfiguration();
populateSettings();
Engine engine = null; try {engine = new Engine(Check.class.getClassLoader());
if (isUpdateOnly()) { log("Deprecated 'UpdateOnly' property set; please use the UpdateTask instead", Project.MSG_WARN); engine.doUpdates(); } else { try {for (Resource resource : path) {
final FileProvider provider = resource.as(FileProvider.class);
if (provider != null) { final File file = provider.getFile(); if (file != null && file.exists()) {engine.scan(file);
}
}
}
engine.analyzeDependencies();
DatabaseProperties prop = null; CveDB cve = null; try { cve = new CveDB();cve.open();
prop = cve.getDatabaseProperties();
} catch (DatabaseException ex) { log("Unable to retrieve DB Properties", ex, Project.MSG_DEBUG); } finally { if (cve != null) {cve.close();
}
}
final ReportGenerator reporter = new ReportGenerator(getProjectName(), engine.getDependencies(), engine.getAnalyzers(), prop);
reporter.generateReports(reportOutputDirectory, reportFormat);
if (this.failBuildOnCVSS <= 10) { checkForFailure(engine.getDependencies());}
if (this.showSummary) {showSummary(engine.getDependencies());
}
} catch (IOException ex) { log("Unable to generate dependency-check report", ex, Project.MSG_DEBUG); throw new BuildException("Unable to generate dependency-check report", ex); } catch (Exception ex) { log("An exception occurred; unable to continue task", ex, Project.MSG_DEBUG); throw new BuildException("An exception occurred; unable to continue task", ex);}
}
} catch (DatabaseException ex) { log("Unable to connect to the dependency-check database; analysis has stopped", ex, Project.MSG_ERR); } finally { Settings.cleanup(true); if (engine != null) {engine.cleanup();
}
}
}
/** * Validate the configuration to ensure the parameters have been properly * configured/initialized. * * @throws BuildException if the task was not configured correctly. */private void validateConfiguration() throws BuildException {
if (path == null) {
throw new BuildException("No project dependencies have been defined to analyze.");
}
if (failBuildOnCVSS < 0 || failBuildOnCVSS > 11) { throw new BuildException("Invalid configuration, failBuildOnCVSS must be between 0 and 11.");}
}
/** * Takes the properties supplied and updates the dependency-check settings. * Additionally, this sets the system properties required to change the * proxy server, port, and connection timeout. * * @throws BuildException thrown when an invalid setting is configured. */@Override
protected void populateSettings() throws BuildException {
super.populateSettings();Settings.setBooleanIfNotNull(Settings.KEYS.AUTO_UPDATE, autoUpdate);
Settings.setStringIfNotEmpty(Settings.KEYS.SUPPRESSION_FILE, suppressionFile);
Settings.setBooleanIfNotNull(Settings.KEYS.ANALYZER_EXPERIMENTAL_ENABLED, enableExperimental);
Settings.setBooleanIfNotNull(Settings.KEYS.ANALYZER_JAR_ENABLED, jarAnalyzerEnabled);
Settings.setBooleanIfNotNull(Settings.KEYS.ANALYZER_PYTHON_DISTRIBUTION_ENABLED, pyDistributionAnalyzerEnabled);
Settings.setBooleanIfNotNull(Settings.KEYS.ANALYZER_PYTHON_PACKAGE_ENABLED, pyPackageAnalyzerEnabled);
Settings.setBooleanIfNotNull(Settings.KEYS.ANALYZER_RUBY_GEMSPEC_ENABLED, rubygemsAnalyzerEnabled);
Settings.setBooleanIfNotNull(Settings.KEYS.ANALYZER_OPENSSL_ENABLED, opensslAnalyzerEnabled);
Settings.setBooleanIfNotNull(Settings.KEYS.ANALYZER_CMAKE_ENABLED, cmakeAnalyzerEnabled);
Settings.setBooleanIfNotNull(Settings.KEYS.ANALYZER_AUTOCONF_ENABLED, autoconfAnalyzerEnabled);
Settings.setBooleanIfNotNull(Settings.KEYS.ANALYZER_COMPOSER_LOCK_ENABLED, composerAnalyzerEnabled);
Settings.setBooleanIfNotNull(Settings.KEYS.ANALYZER_NODE_PACKAGE_ENABLED, nodeAnalyzerEnabled);
Settings.setBooleanIfNotNull(Settings.KEYS.ANALYZER_NUSPEC_ENABLED, nuspecAnalyzerEnabled);
Settings.setBooleanIfNotNull(Settings.KEYS.ANALYZER_CENTRAL_ENABLED, centralAnalyzerEnabled);
Settings.setBooleanIfNotNull(Settings.KEYS.ANALYZER_NEXUS_ENABLED, nexusAnalyzerEnabled);
Settings.setBooleanIfNotNull(Settings.KEYS.ANALYZER_ARCHIVE_ENABLED, archiveAnalyzerEnabled);
Settings.setBooleanIfNotNull(Settings.KEYS.ANALYZER_ASSEMBLY_ENABLED, assemblyAnalyzerEnabled);
Settings.setStringIfNotEmpty(Settings.KEYS.ANALYZER_NEXUS_URL, nexusUrl);
Settings.setBooleanIfNotNull(Settings.KEYS.ANALYZER_NEXUS_USES_PROXY, nexusUsesProxy);
Settings.setStringIfNotEmpty(Settings.KEYS.ADDITIONAL_ZIP_EXTENSIONS, zipExtensions);
Settings.setStringIfNotEmpty(Settings.KEYS.ANALYZER_ASSEMBLY_MONO_PATH, pathToMono);
}
/** * Checks to see if a vulnerability has been identified with a CVSS score * that is above the threshold set in the configuration. * * @param dependencies the list of dependency objects * @throws BuildException thrown if a CVSS score is found that is higher * then the threshold set */private void checkForFailure(List<Dependency> dependencies) throws BuildException {
final StringBuilder ids = new StringBuilder(); for (Dependency d : dependencies) { for (Vulnerability v : d.getVulnerabilities()) { if (v.getCvssScore() >= failBuildOnCVSS) { if (ids.length() == 0) { ids.append(v.getName()); } else { ids.append(", ").append(v.getName());}
}
} } if (ids.length() > 0) { final String msg = String.format("%n%nDependency-Check Failure:%n" + "One or more dependencies were identified with vulnerabilities that have a CVSS score greater then '%.1f': %s%n" + "See the dependency-check report for more details.%n%n", failBuildOnCVSS, ids.toString()); throw new BuildException(msg);}
} /** * Generates a warning message listing a summary of dependencies and their * associated CPE and CVE entries. * * @param dependencies a list of dependency objects */private void showSummary(List<Dependency> dependencies) {
final StringBuilder summary = new StringBuilder();
for (Dependency d : dependencies) {
boolean firstEntry = true;
final StringBuilder ids = new StringBuilder();
for (Vulnerability v : d.getVulnerabilities()) {
if (firstEntry) {
firstEntry = false; } else { ids.append(", ");}
ids.append(v.getName());
}
if (ids.length() > 0) {
summary.append(d.getFileName()).append(" ("); firstEntry = true;for (Identifier id : d.getIdentifiers()) {
if (firstEntry) {
firstEntry = false; } else { summary.append(", ");}
summary.append(id.getValue());
}
summary.append(") : ").append(ids).append(NEW_LINE);}
}
if (summary.length() > 0) {final String msg = String.format("%n%n"
+ "One or more dependencies were identified with known vulnerabilities:%n%n%s" + "%n%nSee the dependency-check report for more details.%n%n", summary.toString());log(msg, Project.MSG_WARN);
}
}
/** * An enumeration of supported report formats: "ALL", "HTML", "XML", "VULN", * etc.. */public static class ReportFormats extends EnumeratedAttribute {
/** * Returns the list of values for the report format. * * @return the list of values for the report format */@Override
public String[] getValues() { int i = 0; final Format[] formats = Format.values();final String[] values = new String[formats.length];
for (Format format : formats) {
values[i++] = format.name();
}
return values;}
}
}
*/ public Purge() { super(); super(); // Call this before Dependency Check Core starts logging anything - this way, all SLF4J messages from // core end up coming through this tasks logger StaticLoggerBinder.getSingleton().setTask(this);}
StaticLoggerBinder.getSingleton().setTask(this);}
* The location of the data directory that contains */private String dataDirectory = null;
private String dataDirectory = null;
*/protected void populateSettings() {
Settings.initialize();
InputStream taskProperties = null;Settings.initialize();
InputStream taskProperties = null; try { taskProperties = this.getClass().getClassLoader().getResourceAsStream(PROPERTIES_FILE);Settings.mergeProperties(taskProperties);
taskProperties = this.getClass().getClassLoader().getResourceAsStream(PROPERTIES_FILE);Settings.mergeProperties(taskProperties);
} catch (IOException ex) { log("Unable to load the dependency-check ant task.properties file.", ex, Project.MSG_WARN); } finally { if (taskProperties != null) { if (taskProperties != null) { try {taskProperties.close();
taskProperties.close();
} catch (IOException ex) { log("", ex, Project.MSG_DEBUG);}
}
}
}
if (dataDirectory != null) { if (dataDirectory != null) { Settings.setString(Settings.KEYS.DATA_DIRECTORY, dataDirectory); } else {final File jarPath = new File(Purge.class.getProtectionDomain().getCodeSource().getLocation().getPath());
final File base = jarPath.getParentFile(); final String sub = Settings.getString(Settings.KEYS.DATA_DIRECTORY);final File dataDir = new File(base, sub);
Settings.setString(Settings.KEYS.DATA_DIRECTORY, dataDir.getAbsolutePath());
final File jarPath = new File(Purge.class.getProtectionDomain().getCodeSource().getLocation().getPath());
final File base = jarPath.getParentFile(); final String sub = Settings.getString(Settings.KEYS.DATA_DIRECTORY);final File dataDir = new File(base, sub);
Settings.setString(Settings.KEYS.DATA_DIRECTORY, dataDir.getAbsolutePath());
}
}
}
}
*/ public Update() { super(); super(); // Call this before Dependency Check Core starts logging anything - this way, all SLF4J messages from // core end up coming through this tasks logger StaticLoggerBinder.getSingleton().setTask(this);}
StaticLoggerBinder.getSingleton().setTask(this);}
@Override
protected void populateSettings() throws BuildException {
super.populateSettings();Settings.setStringIfNotEmpty(Settings.KEYS.PROXY_SERVER, proxyServer);
Settings.setStringIfNotEmpty(Settings.KEYS.PROXY_PORT, proxyPort);
Settings.setStringIfNotEmpty(Settings.KEYS.PROXY_USERNAME, proxyUsername);
Settings.setStringIfNotEmpty(Settings.KEYS.PROXY_PASSWORD, proxyPassword);
Settings.setStringIfNotEmpty(Settings.KEYS.CONNECTION_TIMEOUT, connectionTimeout);
Settings.setStringIfNotEmpty(Settings.KEYS.DB_DRIVER_NAME, databaseDriverName);
Settings.setStringIfNotEmpty(Settings.KEYS.DB_DRIVER_PATH, databaseDriverPath);
Settings.setStringIfNotEmpty(Settings.KEYS.DB_CONNECTION_STRING, connectionString);
Settings.setStringIfNotEmpty(Settings.KEYS.DB_USER, databaseUser);
Settings.setStringIfNotEmpty(Settings.KEYS.DB_PASSWORD, databasePassword);
Settings.setStringIfNotEmpty(Settings.KEYS.CVE_MODIFIED_12_URL, cveUrl12Modified);
Settings.setStringIfNotEmpty(Settings.KEYS.CVE_MODIFIED_20_URL, cveUrl20Modified);
Settings.setStringIfNotEmpty(Settings.KEYS.CVE_SCHEMA_1_2, cveUrl12Base);
Settings.setStringIfNotEmpty(Settings.KEYS.CVE_SCHEMA_2_0, cveUrl20Base);
if (cveValidForHours != null) { super.populateSettings();Settings.setStringIfNotEmpty(Settings.KEYS.PROXY_SERVER, proxyServer);
Settings.setStringIfNotEmpty(Settings.KEYS.PROXY_PORT, proxyPort);
Settings.setStringIfNotEmpty(Settings.KEYS.PROXY_USERNAME, proxyUsername);
Settings.setStringIfNotEmpty(Settings.KEYS.PROXY_PASSWORD, proxyPassword);
Settings.setStringIfNotEmpty(Settings.KEYS.CONNECTION_TIMEOUT, connectionTimeout);
Settings.setStringIfNotEmpty(Settings.KEYS.DB_DRIVER_NAME, databaseDriverName);
Settings.setStringIfNotEmpty(Settings.KEYS.DB_DRIVER_PATH, databaseDriverPath);
Settings.setStringIfNotEmpty(Settings.KEYS.DB_CONNECTION_STRING, connectionString);
Settings.setStringIfNotEmpty(Settings.KEYS.DB_USER, databaseUser);
Settings.setStringIfNotEmpty(Settings.KEYS.DB_PASSWORD, databasePassword);
Settings.setStringIfNotEmpty(Settings.KEYS.CVE_MODIFIED_12_URL, cveUrl12Modified);
Settings.setStringIfNotEmpty(Settings.KEYS.CVE_MODIFIED_20_URL, cveUrl20Modified);
Settings.setStringIfNotEmpty(Settings.KEYS.CVE_SCHEMA_1_2, cveUrl12Base);
Settings.setStringIfNotEmpty(Settings.KEYS.CVE_SCHEMA_2_0, cveUrl20Base);
if (cveValidForHours != null) { if (cveValidForHours >= 0) { Settings.setInt(Settings.KEYS.CVE_CHECK_VALID_FOR_HOURS, cveValidForHours);}
}
}
}
}
/** * The binding of org.slf4j.LoggerFactory class with an actual instance of org.slf4j.ILoggerFactory is performed using information * The binding of org.slf4j.LoggerFactory class with an actual instance of * returned by this class. * org.slf4j.ILoggerFactory is performed using information returned by this * * class. * @author colezlaw * */ * @author colezlawpublic class StaticLoggerBinder implements LoggerFactoryBinder {
*/ //CSOFF: FinalClass /**public class StaticLoggerBinder implements LoggerFactoryBinder {
* The unique instance of this class //CSON: FinalClass * */private static final StaticLoggerBinder SINGLETON = new StaticLoggerBinder();
/** * The unique instance of this class /** */private static final StaticLoggerBinder SINGLETON = new StaticLoggerBinder();
* Return the singleton of this class. * /** * @return the StaticLoggerBinder singleton * Return the singleton of this class. */public static final StaticLoggerBinder getSingleton() {
return SINGLETON;}
/** * Ant tasks have the log method we actually want to call. So we hang onto the task as a delegate */private Task task = null;
/** * Set the Task which will this is to log through. * * @return the StaticLoggerBinder singleton */public static final StaticLoggerBinder getSingleton() {
return SINGLETON;}
/** * Ant tasks have the log method we actually want to call. So we hang onto * the task as a delegate */private Task task = null;
* @param task the task through which to log /** */ * Set the Task which will this is to log through. * * @param task the task through which to log */public void setTask(Task task) {
this.task = task; loggerFactory = new AntLoggerFactory(task);}
/** * Declare the version of the SLF4J API this implementation is compiled against. The value of this filed is usually modified this.task = task; loggerFactory = new AntLoggerFactory(task);}
* with each release. */ // to avoid constant folding by the compiler, this field must *not* be finalpublic static String REQUESTED_API_VERSION = "1.7.12"; // final
private static final String LOGGER_FACTORY_CLASS = AntLoggerFactory.class.getName();
/** * The ILoggerFactory instance returned by the {@link #getLoggerFactory} method should always be the smae object * Declare the version of the SLF4J API this implementation is compiled * against. The value of this filed is usually modified with each release. */ // to avoid constant folding by the compiler, this field must *not* be final //CSOFF: StaticVariableName //CSOFF: VisibilityModifierpublic static String REQUESTED_API_VERSION = "1.7.12"; // final
//CSON: VisibilityModifier private ILoggerFactory loggerFactory; //CSON: StaticVariableName /** * Constructs a new static logger binder. * The logger factory class string. */ private StaticLoggerBinder() { loggerFactory = new AntLoggerFactory(task);}
private static final String LOGGER_FACTORY_CLASS = AntLoggerFactory.class.getName();
/** * The ILoggerFactory instance returned by the {@link #getLoggerFactory} /** * method should always be the smae object * Returns the logger factory. */ * private ILoggerFactory loggerFactory; * @return the logger factory */@Override
public ILoggerFactory getLoggerFactory() { return loggerFactory;}
/** * Returns the logger factory class string. * * @return the logger factory class string * Constructs a new static logger binder. */ private StaticLoggerBinder() { loggerFactory = new AntLoggerFactory(task);}
/** * Returns the logger factory. * * @return the logger factory@Override
*/ public String getLoggerFactoryClassStr() { return LOGGER_FACTORY_CLASS;}
@Override
public ILoggerFactory getLoggerFactory() { return loggerFactory;}
/** * Returns the logger factory class string. * * @return the logger factory class string */@Override
public String getLoggerFactoryClassStr() { return LOGGER_FACTORY_CLASS;}
}
-
-
-
diff --git a/dependency-check-ant/config-update.html b/dependency-check-ant/config-update.html
index 4135946a2..d65e31734 100644
--- a/dependency-check-ant/config-update.html
+++ b/dependency-check-ant/config-update.html
@@ -1,13 +1,13 @@
-
+
-
-
-
diff --git a/dependency-check-ant/configuration.html b/dependency-check-ant/configuration.html
index 0ea4d3453..27ea1ccc3 100644
--- a/dependency-check-ant/configuration.html
+++ b/dependency-check-ant/configuration.html
@@ -1,13 +1,13 @@
-
+
-
-
-
@@ -174,7 +171,7 @@
The following properties can be set on the dependency-check-update task.
+The following properties can be set on the dependency-check task.
| proxyServer | -The Proxy Server. | +The Proxy Server; see the proxy configuration page for more information. | @@ -297,6 +294,15 @@ | + + |
| enableExperimental | + +Enable the experimental analyzers. If not enabled the experimental analyzers (see below) will not be loaded or used. | + +false | +
-
-
-
-
-
-
@@ -233,7 +230,7 @@
| commons-io | |
| Current Version | -2.4 | 2.5 |
|---|---|
| Scope | ant |
| Current Version | -1.9.6 | 1.9.7 |
| Scope | ant-testutil |
| Current Version | -1.9.6 | 1.9.7 |
| Scope | jar |
| Newer versions | -4.8.0 Next Minor 4.8.1 4.9.0 4.9.1 4.10.0 4.10.1 4.10.2 4.10.3 4.10.4 Latest Minor 5.0.0 Next Major 5.1.0 5.2.0 5.2.1 5.3.0 5.3.1 5.3.2 5.4.0 5.4.1 5.5.0 6.0.0 Latest Major |
| jar | |
| Newer versions | -4.8.0 Next Minor 4.8.1 4.9.0 4.9.1 4.10.0 4.10.1 4.10.2 4.10.3 4.10.4 Latest Minor 5.0.0 Next Major 5.1.0 5.2.0 5.2.1 5.3.0 5.3.1 5.3.2 5.4.0 5.4.1 5.5.0 6.0.0 Latest Major |
|---|
| jar | |
| Newer versions | -4.8.0 Next Minor 4.8.1 4.9.0 4.9.1 4.10.0 4.10.1 4.10.2 4.10.3 4.10.4 Latest Minor 5.0.0 Next Major 5.1.0 5.2.0 5.2.1 5.3.0 5.3.1 5.3.2 5.4.0 5.4.1 5.5.0 6.0.0 Latest Major |
|---|
| jar | |
| Newer versions | -4.8.0 Next Minor 4.8.1 4.9.0 4.9.1 4.10.0 4.10.1 4.10.2 4.10.3 4.10.4 Latest Minor 5.0.0 Next Major 5.1.0 5.2.0 5.2.1 5.3.0 5.3.1 5.3.2 5.4.0 5.4.1 5.5.0 6.0.0 Latest Major |
|---|
| Status | - There is at least one newer incremental version available. Incremental updates are typically passive. | No newer versions available. |
|---|---|
| Group Id | org.apache.maven | maven-core |
| Current Version | -3.3.3 | 3.3.9 |
| Scope | |
| Type | -jar |
| Newer versions | -3.3.9 Next Incremental |
| Status | - There is at least one newer incremental version available. Incremental updates are typically passive. | No newer versions available. |
|---|---|
| Group Id | org.apache.maven | maven-plugin-api |
| Current Version | -3.3.3 | 3.3.9 |
| Scope | |
| Type | -jar |
| Newer versions | -3.3.9 Next Incremental |
| Status | - There is at least one newer incremental version available. Incremental updates are typically passive. | No newer versions available. |
|---|---|
| Group Id | org.apache.maven | maven-settings |
| Current Version | -3.3.3 | 3.3.9 |
| Scope | |
| Type | -jar |
| Newer versions | -3.3.9 Next Incremental |
| Status | - No newer versions available. | There is at least one newer minor version available. Minor updates are sometimes passive. |
|---|---|
| Group Id | org.jmockit |
| Type | -jar |
| Status | - No newer versions available. | There is at least one newer incremental version available. Incremental updates are typically passive. |
|---|---|
| Group Id | org.jsoup | jsoup |
| Current Version | -1.8.3 | 1.9.1 |
| Scope | |
| Type | -jar |
| dependency-check-core | |
| Current Version | -1.3.6 | 1.4.0 |
|---|---|
| Scope | compile | dependency-check-utils |
| Current Version | -1.3.6 | 1.4.0 |
| Scope | compile | Inconsistent synchronization of org.owasp.dependencycheck.taskdefs.Check.path; locked 44% of time | MT_CORRECTNESS | IS2_INCONSISTENT_SYNC | -838 | +870 | Medium |
-
-
-
@@ -153,7 +150,7 @@
-
-
-
@@ -200,11 +197,11 @@
+This project uses Travis CI.
+ diff --git a/dependency-check-ant/issue-tracking.html b/dependency-check-ant/issue-tracking.html index bd01a77bf..378db0cc3 100644 --- a/dependency-check-ant/issue-tracking.html +++ b/dependency-check-ant/issue-tracking.html @@ -1,13 +1,13 @@ - +
-
-
-
diff --git a/dependency-check-ant/license.html b/dependency-check-ant/license.html
index eb42d8fa3..4c298a65d 100644
--- a/dependency-check-ant/license.html
+++ b/dependency-check-ant/license.html
@@ -1,13 +1,13 @@
-
+
-
-
-
diff --git a/dependency-check-ant/mail-lists.html b/dependency-check-ant/mail-lists.html
index 9667f4f5f..ce7c4c66f 100644
--- a/dependency-check-ant/mail-lists.html
+++ b/dependency-check-ant/mail-lists.html
@@ -1,13 +1,13 @@
-
+
-
-
-
diff --git a/dependency-check-ant/plugin-updates-report.html b/dependency-check-ant/plugin-updates-report.html
index 21a1d389d..c41d3ed4c 100644
--- a/dependency-check-ant/plugin-updates-report.html
+++ b/dependency-check-ant/plugin-updates-report.html
@@ -1,13 +1,13 @@
-
+
-
-
-
@@ -233,7 +230,7 @@
| maven-resources-plugin | |
| Current Version | -2.7 |
|---|
| maven-site-plugin | |
| Current Version | -3.5 |
|---|
| Status | - No newer versions available. | There is at least one newer major version available. Major updates are rarely passive. |
|---|---|
| Group Id | org.apache.maven.plugins | maven-source-plugin |
| Current Version | -2.4 |
| dependency-check-ant | |
| Version | -1.3.6 | 1.4.0 |
| Type | jar | 0 | 0 | 100% | -18.409 |
Note: failures are anticipated and checked for with assertions while errors are unanticipated.
Note: package statistics are not computed recursively, they only sum up all of its testsuites numbers.
[Summary] [Package List] [Test Cases]
@@ -315,19 +312,19 @@ function toggleDisplay(elementId) {
-
-
-
diff --git a/dependency-check-ant/team-list.html b/dependency-check-ant/team-list.html
index 283691c53..38b0559b4 100644
--- a/dependency-check-ant/team-list.html
+++ b/dependency-check-ant/team-list.html
@@ -1,13 +1,13 @@
-
+
-
-
-
diff --git a/dependency-check-ant/xref-test/index.html b/dependency-check-ant/xref-test/index.html
index 22912bedb..87b737854 100644
--- a/dependency-check-ant/xref-test/index.html
+++ b/dependency-check-ant/xref-test/index.html
@@ -4,7 +4,7 @@
-