diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/ArchiveAnalyzer.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/ArchiveAnalyzer.java index c9d14b33d..f6b0a10d4 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/ArchiveAnalyzer.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/ArchiveAnalyzer.java @@ -81,10 +81,17 @@ public class ArchiveAnalyzer extends AbstractAnalyzer implements Analyzer { * The phase that this analyzer is intended to run in. */ private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.INITIAL; + /** + * The set of things we can handle with Zip methods + */ + private static final Set ZIPPABLES = newHashSet("zip", "ear", "war", "nupkg"); /** * The set of file extensions supported by this analyzer. */ - private static final Set EXTENSIONS = newHashSet("zip", "ear", "war", "tar", "gz", "tgz"); + private static final Set EXTENSIONS = newHashSet("tar", "gz", "tgz"); + static { + EXTENSIONS.addAll(ZIPPABLES); + } /** * Returns a list of file EXTENSIONS supported by this analyzer. @@ -251,7 +258,7 @@ public class ArchiveAnalyzer extends AbstractAnalyzer implements Analyzer { } final String archiveExt = org.owasp.dependencycheck.utils.FileUtils.getFileExtension(archive.getName()).toLowerCase(); try { - if ("zip".equals(archiveExt) || "war".equals(archiveExt) || "ear".equals(archiveExt)) { + if (ZIPPABLES.contains(archiveExt)) { extractArchive(new ZipArchiveInputStream(new BufferedInputStream(fis)), destination, engine); } else if ("tar".equals(archiveExt)) { extractArchive(new TarArchiveInputStream(new BufferedInputStream(fis)), destination, engine); diff --git a/dependency-check-core/src/test/java/org/owasp/dependencycheck/analyzer/ArchiveAnalyzerTest.java b/dependency-check-core/src/test/java/org/owasp/dependencycheck/analyzer/ArchiveAnalyzerTest.java index 3d8ea28ce..08d519d2b 100644 --- a/dependency-check-core/src/test/java/org/owasp/dependencycheck/analyzer/ArchiveAnalyzerTest.java +++ b/dependency-check-core/src/test/java/org/owasp/dependencycheck/analyzer/ArchiveAnalyzerTest.java @@ -69,6 +69,7 @@ public class ArchiveAnalyzerTest extends BaseIndexTestCase { expResult.add("zip"); expResult.add("war"); expResult.add("ear"); + expResult.add("nupkg"); expResult.add("tar"); expResult.add("gz"); expResult.add("tgz"); @@ -110,6 +111,10 @@ public class ArchiveAnalyzerTest extends BaseIndexTestCase { extension = "zip"; //supported result = instance.supportsExtension(extension); assertEquals(expResult, result); + + extension = "nupkg"; //supported + result = instance.supportsExtension(extension); + assertEquals(expResult, result); } /**