diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nvdcve/CveDB.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nvdcve/CveDB.java index 30ab437d1..f00f4b8cd 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nvdcve/CveDB.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/nvdcve/CveDB.java @@ -68,9 +68,18 @@ public class CveDB { */ private ResourceBundle statementBundle = null; + /** + * <<<<<<< HEAD Creates a new CveDB object and opens the database + * connection. Note, the connection must be closed by the caller by calling + * the close method. ======= Does the underlying connection support batch + * operations? + */ + private boolean batchSupported; + /** * Creates a new CveDB object and opens the database connection. Note, the * connection must be closed by the caller by calling the close method. + * >>>>>>> e79da72711dc0f326fcdce52deab89e37c0d8230 * * @throws DatabaseException thrown if there is an exception opening the * database. @@ -81,6 +90,7 @@ public class CveDB { open(); try { final String databaseProductName = conn.getMetaData().getDatabaseProductName(); + batchSupported = conn.getMetaData().supportsBatchUpdates(); LOGGER.debug("Database dialect: {}", databaseProductName); final Locale dbDialect = new Locale(databaseProductName); statementBundle = ResourceBundle.getBundle("data/dbStatements", dbDialect); @@ -388,6 +398,7 @@ public class CveDB { ResultSet rsR = null; ResultSet rsS = null; Vulnerability vuln = null; + try { psV = getConnection().prepareStatement(statementBundle.getString("SELECT_VULNERABILITY")); psV.setString(1, cve); @@ -493,6 +504,7 @@ public class CveDB { } DBUtils.closeResultSet(rs); rs = null; + if (vulnerabilityId != 0) { if (vuln.getDescription().contains("** REJECT **")) { deleteVulnerability.setInt(1, vulnerabilityId); @@ -534,13 +546,24 @@ public class CveDB { rs = null; } } - insertReference.setInt(1, vulnerabilityId); + for (Reference r : vuln.getReferences()) { + insertReference.setInt(1, vulnerabilityId); insertReference.setString(2, r.getName()); insertReference.setString(3, r.getUrl()); insertReference.setString(4, r.getSource()); - insertReference.execute(); + + if (batchSupported) { + insertReference.addBatch(); + } else { + insertReference.execute(); + } } + + if (batchSupported) { + insertReference.executeBatch(); + } + for (VulnerableSoftware s : vuln.getVulnerableSoftware()) { int cpeProductId = 0; selectCpeId.setString(1, s.getName()); @@ -569,22 +592,30 @@ public class CveDB { insertSoftware.setInt(1, vulnerabilityId); insertSoftware.setInt(2, cpeProductId); + if (s.getPreviousVersion() == null) { insertSoftware.setNull(3, java.sql.Types.VARCHAR); } else { insertSoftware.setString(3, s.getPreviousVersion()); } - try { - insertSoftware.execute(); - } catch (SQLException ex) { - if (ex.getMessage().contains("Duplicate entry")) { - final String msg = String.format("Duplicate software key identified in '%s:%s'", vuln.getName(), s.getName()); - LOGGER.debug(msg, ex); - } else { - throw ex; + if (batchSupported) { + insertSoftware.addBatch(); + } else { + try { + insertSoftware.execute(); + } catch (SQLException ex) { + if (ex.getMessage().contains("Duplicate entry")) { + final String msg = String.format("Duplicate software key identified in '%s:%s'", vuln.getName(), s.getName()); + LOGGER.debug(msg, ex); + } else { + throw ex; + } } } } + if (batchSupported) { + insertSoftware.executeBatch(); + } } catch (SQLException ex) { final String msg = String.format("Error updating '%s'", vuln.getName()); LOGGER.debug(msg, ex); diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/update/nvd/NvdCve20Handler.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/update/nvd/NvdCve20Handler.java index e2b60db7a..25fc95f9b 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/update/nvd/NvdCve20Handler.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/data/update/nvd/NvdCve20Handler.java @@ -254,17 +254,16 @@ public class NvdCve20Handler extends DefaultHandler { * @throws IOException thrown if there is an IOException with the CPE Index */ private void saveEntry(Vulnerability vuln) throws DatabaseException, CorruptIndexException, IOException { - if (cveDB == null) { - return; - } final String cveName = vuln.getName(); - if (prevVersionVulnMap.containsKey(cveName)) { + if (prevVersionVulnMap != null && prevVersionVulnMap.containsKey(cveName)) { final List vulnSoftware = prevVersionVulnMap.get(cveName); for (VulnerableSoftware vs : vulnSoftware) { vuln.updateVulnerableSoftware(vs); } } - cveDB.updateVulnerability(vuln); + if (cveDB != null) { + cveDB.updateVulnerability(vuln); + } } // diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/dependency/VulnerableSoftware.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/dependency/VulnerableSoftware.java index 3e46581e6..05dde8126 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/dependency/VulnerableSoftware.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/dependency/VulnerableSoftware.java @@ -180,23 +180,14 @@ public class VulnerableSoftware extends IndexEntry implements Serializable, Comp final int max = (left.length <= right.length) ? left.length : right.length; if (max > 0) { for (int i = 0; result == 0 && i < max; i++) { - final String[] subLeft = left[i].split("\\."); - final String[] subRight = right[i].split("\\."); + final String[] subLeft = left[i].split("(\\.|-)"); + final String[] subRight = right[i].split("(\\.|-)"); final int subMax = (subLeft.length <= subRight.length) ? subLeft.length : subRight.length; if (subMax > 0) { for (int x = 0; result == 0 && x < subMax; x++) { if (isPositiveInteger(subLeft[x]) && isPositiveInteger(subRight[x])) { try { result = Long.valueOf(subLeft[x]).compareTo(Long.valueOf(subRight[x])); -// final long iLeft = Long.parseLong(subLeft[x]); -// final long iRight = Long.parseLong(subRight[x]); -// if (iLeft != iRight) { -// if (iLeft > iRight) { -// result = 2; -// } else { -// result = -2; -// } -// } } catch (NumberFormatException ex) { //ignore the exception - they obviously aren't numbers if (!subLeft[x].equalsIgnoreCase(subRight[x])) { diff --git a/dependency-check-core/src/test/java/org/owasp/dependencycheck/data/update/nvd/NvdCve_2_0_HandlerTest.java b/dependency-check-core/src/test/java/org/owasp/dependencycheck/data/update/nvd/NvdCve_2_0_HandlerTest.java index 70257e6ed..975750d5d 100644 --- a/dependency-check-core/src/test/java/org/owasp/dependencycheck/data/update/nvd/NvdCve_2_0_HandlerTest.java +++ b/dependency-check-core/src/test/java/org/owasp/dependencycheck/data/update/nvd/NvdCve_2_0_HandlerTest.java @@ -19,6 +19,8 @@ package org.owasp.dependencycheck.data.update.nvd; import org.owasp.dependencycheck.data.update.nvd.NvdCve20Handler; import java.io.File; +import java.util.List; +import java.util.Map; import javax.xml.parsers.SAXParser; import javax.xml.parsers.SAXParserFactory; import org.junit.After; @@ -28,6 +30,7 @@ import org.junit.Before; import org.junit.BeforeClass; import org.junit.Test; import org.owasp.dependencycheck.BaseTest; +import org.owasp.dependencycheck.dependency.VulnerableSoftware; /** * @@ -49,12 +52,42 @@ public class NvdCve_2_0_HandlerTest extends BaseTest { saxParser.parse(file, instance); } catch (Throwable ex) { + ex.printStackTrace(); results = ex; } assertTrue("Exception thrown during parse of 2012 CVE version 2.0?", results == null); if (results != null) { System.err.println(results); } + } + @Test + public void testParserWithPreviousVersion() { + Throwable results = null; + try { + SAXParserFactory factory = SAXParserFactory.newInstance(); + SAXParser saxParser = factory.newSAXParser(); + + File file12 = BaseTest.getResourceAsFile(this, "cve-1.2-2008_4411.xml"); + + final NvdCve12Handler cve12Handler = new NvdCve12Handler(); + saxParser.parse(file12, cve12Handler); + final Map> prevVersionVulnMap = cve12Handler.getVulnerabilities(); + + //File file = new File(this.getClass().getClassLoader().getResource("nvdcve-2.0-2012.xml").getPath()); + File file20 = BaseTest.getResourceAsFile(this, "cve-2.0-2008_4411.xml"); + + NvdCve20Handler instance = new NvdCve20Handler(); + instance.setPrevVersionVulnMap(prevVersionVulnMap); + saxParser.parse(file20, instance); + + assertTrue(instance.getTotalNumberOfEntries()==1); + } catch (Throwable ex) { + results = ex; + } + assertTrue("Exception thrown during parse of 2012 CVE version 2.0?", results == null); + if (results != null) { + System.err.println(results); + } } } diff --git a/dependency-check-core/src/test/java/org/owasp/dependencycheck/dependency/VulnerabilityTest.java b/dependency-check-core/src/test/java/org/owasp/dependencycheck/dependency/VulnerabilityTest.java index 550540b67..e4849f1bb 100644 --- a/dependency-check-core/src/test/java/org/owasp/dependencycheck/dependency/VulnerabilityTest.java +++ b/dependency-check-core/src/test/java/org/owasp/dependencycheck/dependency/VulnerabilityTest.java @@ -17,6 +17,7 @@ */ package org.owasp.dependencycheck.dependency; +import java.util.Set; import org.junit.After; import org.junit.AfterClass; import static org.junit.Assert.assertEquals; @@ -31,7 +32,7 @@ import org.owasp.dependencycheck.BaseTest; * * @author Jens Hausherr */ -public class VulnerabilityTest extends BaseTest { +public class VulnerabilityTest extends BaseTest { /** * Test of equals method, of class VulnerableSoftware. @@ -49,90 +50,112 @@ public class VulnerabilityTest extends BaseTest { @Test public void testDpulicateVersionsWithPreviousVersion() { - Vulnerability obj = new Vulnerability(); - obj.addVulnerableSoftware("cpe:/a:mysql:mysql:4.1.0",null); - obj.addVulnerableSoftware("cpe:/a:mysql:mysql:4.1.1",null); - obj.addVulnerableSoftware("cpe:/a:mysql:mysql:4.1.2",null); - obj.addVulnerableSoftware("cpe:/a:mysql:mysql:4.1.10",null); - obj.addVulnerableSoftware("cpe:/a:mysql:mysql:4.1.11",null); - obj.addVulnerableSoftware("cpe:/a:mysql:mysql:4.1.12",null); - obj.addVulnerableSoftware("cpe:/a:mysql:mysql:4.1.13",null); - obj.addVulnerableSoftware("cpe:/a:mysql:mysql:4.1.14",null); - obj.addVulnerableSoftware("cpe:/a:mysql:mysql:4.1.15",null); - obj.addVulnerableSoftware("cpe:/a:mysql:mysql:4.1.16",null); - obj.addVulnerableSoftware("cpe:/a:mysql:mysql:4.1.17",null); - obj.addVulnerableSoftware("cpe:/a:mysql:mysql:4.1.18",null); - obj.addVulnerableSoftware("cpe:/a:mysql:mysql:4.1.19",null); - obj.addVulnerableSoftware("cpe:/a:mysql:mysql:4.1.20",null); - obj.addVulnerableSoftware("cpe:/a:mysql:mysql:4.1.21",null); - obj.addVulnerableSoftware("cpe:/a:mysql:mysql:4.1.22",null); - obj.addVulnerableSoftware("cpe:/a:mysql:mysql:4.1.23",null); - obj.addVulnerableSoftware("cpe:/a:mysql:mysql:5.0.0",null); - obj.addVulnerableSoftware("cpe:/a:mysql:mysql:5.0.0:alpha",null); - obj.addVulnerableSoftware("cpe:/a:mysql:mysql:5.0.1",null); - obj.addVulnerableSoftware("cpe:/a:mysql:mysql:5.0.10",null); - obj.addVulnerableSoftware("cpe:/a:mysql:mysql:5.0.10a",null); - obj.addVulnerableSoftware("cpe:/a:mysql:mysql:5.0.11",null); - obj.addVulnerableSoftware("cpe:/a:mysql:mysql:5.0.12",null); - obj.addVulnerableSoftware("cpe:/a:mysql:mysql:5.0.13",null); - obj.addVulnerableSoftware("cpe:/a:mysql:mysql:5.0.15",null); - obj.addVulnerableSoftware("cpe:/a:mysql:mysql:5.0.19",null); - obj.addVulnerableSoftware("cpe:/a:mysql:mysql:5.0.1a",null); - obj.addVulnerableSoftware("cpe:/a:mysql:mysql:5.0.2",null); - obj.addVulnerableSoftware("cpe:/a:mysql:mysql:5.0.3",null); - obj.addVulnerableSoftware("cpe:/a:mysql:mysql:5.0.4",null); - obj.addVulnerableSoftware("cpe:/a:mysql:mysql:5.0.5.0.21",null); - obj.addVulnerableSoftware("cpe:/a:mysql:mysql:5.0.6",null); - obj.addVulnerableSoftware("cpe:/a:mysql:mysql:5.0.9",null); - obj.addVulnerableSoftware("cpe:/a:mysql:mysql:5.0.21",null); - obj.addVulnerableSoftware("cpe:/a:mysql:mysql:5.0.22",null); - obj.addVulnerableSoftware("cpe:/a:mysql:mysql:5.0.23",null); - obj.addVulnerableSoftware("cpe:/a:mysql:mysql:5.0.24",null); - obj.addVulnerableSoftware("cpe:/a:mysql:mysql:5.0.24a",null); - obj.addVulnerableSoftware("cpe:/a:mysql:mysql:5.0.25",null); - obj.addVulnerableSoftware("cpe:/a:mysql:mysql:5.0.30",null); - obj.addVulnerableSoftware("cpe:/a:mysql:mysql:5.0.32",null); - obj.addVulnerableSoftware("cpe:/a:mysql:mysql:5.0.33",null); - obj.addVulnerableSoftware("cpe:/a:mysql:mysql:5.0.36",null); - obj.addVulnerableSoftware("cpe:/a:mysql:mysql:5.0.37",null); - obj.addVulnerableSoftware("cpe:/a:mysql:mysql:5.0.38",null); - obj.addVulnerableSoftware("cpe:/a:mysql:mysql:5.0.3a",null); - obj.addVulnerableSoftware("cpe:/a:mysql:mysql:5.0.41",null); - obj.addVulnerableSoftware("cpe:/a:mysql:mysql:5.0.42",null); - obj.addVulnerableSoftware("cpe:/a:mysql:mysql:5.0.44",null); - obj.addVulnerableSoftware("cpe:/a:mysql:mysql:5.0.45",null); - obj.addVulnerableSoftware("cpe:/a:mysql:mysql:5.0.4a",null); - obj.addVulnerableSoftware("cpe:/a:mysql:mysql:5.0.50",null); - obj.addVulnerableSoftware("cpe:/a:mysql:mysql:5.0.51",null); - obj.addVulnerableSoftware("cpe:/a:mysql:mysql:5.0.52",null); - obj.addVulnerableSoftware("cpe:/a:mysql:mysql:5.0.54",null); - obj.addVulnerableSoftware("cpe:/a:mysql:mysql:5.0.56",null); - obj.addVulnerableSoftware("cpe:/a:mysql:mysql:5.1.23a","1"); - obj.addVulnerableSoftware("cpe:/a:mysql:mysql:5.1.3",null); - obj.addVulnerableSoftware("cpe:/a:mysql:mysql:5.1.4",null); - obj.addVulnerableSoftware("cpe:/a:mysql:mysql:5.1.5",null); - obj.addVulnerableSoftware("cpe:/a:mysql:mysql:5.1.5a",null); - obj.addVulnerableSoftware("cpe:/a:mysql:mysql:5.1.6",null); - obj.addVulnerableSoftware("cpe:/a:mysql:mysql:5.1.7",null); - obj.addVulnerableSoftware("cpe:/a:mysql:mysql:5.1.9",null); - obj.addVulnerableSoftware("cpe:/a:mysql:mysql:5.1.11",null); - obj.addVulnerableSoftware("cpe:/a:mysql:mysql:5.1.12",null); - obj.addVulnerableSoftware("cpe:/a:mysql:mysql:5.1.14",null); - obj.addVulnerableSoftware("cpe:/a:mysql:mysql:5.1.15",null); - obj.addVulnerableSoftware("cpe:/a:mysql:mysql:5.1.16",null); - obj.addVulnerableSoftware("cpe:/a:mysql:mysql:5.1.17",null); - obj.addVulnerableSoftware("cpe:/a:mysql:mysql:5.1.18",null); - obj.addVulnerableSoftware("cpe:/a:mysql:mysql:5.1.19",null); - obj.addVulnerableSoftware("cpe:/a:mysql:mysql:5.1.20",null); - obj.addVulnerableSoftware("cpe:/a:mysql:mysql:5.1.21",null); - obj.addVulnerableSoftware("cpe:/a:mysql:mysql:5.1.22",null); - obj.addVulnerableSoftware("cpe:/a:mysql:mysql:5.1.23",null); - obj.addVulnerableSoftware("cpe:/a:mysql:mysql:5.1.23a",null); - obj.addVulnerableSoftware("cpe:/a:mysql:mysql:6.0.0",null); - obj.addVulnerableSoftware("cpe:/a:mysql:mysql:6.0.1",null); - obj.addVulnerableSoftware("cpe:/a:mysql:mysql:6.0.2",null); - obj.addVulnerableSoftware("cpe:/a:mysql:mysql:6.0.3",null); - obj.addVulnerableSoftware("cpe:/a:mysql:mysql:6.0.4",null); - assertEquals(82, obj.getVulnerableSoftware().size()); + Vulnerability obj = new Vulnerability(); + obj.addVulnerableSoftware("cpe:/a:hp:system_management_homepage:2.1.0-103%28a%29", null); + obj.addVulnerableSoftware("cpe:/a:hp:system_management_homepage:2.1.0-118", null); + obj.addVulnerableSoftware("cpe:/a:hp:system_management_homepage:2.1.3.132", null); + obj.addVulnerableSoftware("cpe:/a:hp:system_management_homepage:2.1.12-200", null); + obj.addVulnerableSoftware("cpe:/a:hp:system_management_homepage:2.1.2-127", null); + obj.addVulnerableSoftware("cpe:/a:hp:system_management_homepage:2.1.9", null); + obj.addVulnerableSoftware("cpe:/a:hp:system_management_homepage:2.1.10", null); + obj.addVulnerableSoftware("cpe:/a:hp:system_management_homepage:2.1.11", null); + obj.addVulnerableSoftware("cpe:/a:hp:system_management_homepage:2.1.12-118", null); + obj.addVulnerableSoftware("cpe:/a:hp:system_management_homepage:2.1.4-143", null); + obj.addVulnerableSoftware("cpe:/a:hp:system_management_homepage:2.1.0-109", null); + obj.addVulnerableSoftware("cpe:/a:hp:system_management_homepage:2.1.6-156", null); + obj.addVulnerableSoftware("cpe:/a:hp:system_management_homepage:2.1.4", null); + obj.addVulnerableSoftware("cpe:/a:hp:system_management_homepage:2.1.3", null); + obj.addVulnerableSoftware("cpe:/a:hp:system_management_homepage:2.1", null); + obj.addVulnerableSoftware("cpe:/a:hp:system_management_homepage:2.1.10-186", null); + obj.addVulnerableSoftware("cpe:/a:hp:system_management_homepage:2.1.6", null); + obj.addVulnerableSoftware("cpe:/a:hp:system_management_homepage:2.1.5", null); + obj.addVulnerableSoftware("cpe:/a:hp:system_management_homepage:2.1.5-146", null); + obj.addVulnerableSoftware("cpe:/a:hp:system_management_homepage:2.1.8", null); + obj.addVulnerableSoftware("cpe:/a:hp:system_management_homepage:2.1.7", null); + obj.addVulnerableSoftware("cpe:/a:hp:system_management_homepage:2.1.2", null); + obj.addVulnerableSoftware("cpe:/a:hp:system_management_homepage:2.0.2", null); + obj.addVulnerableSoftware("cpe:/a:hp:system_management_homepage:2.1.1", null); + obj.addVulnerableSoftware("cpe:/a:hp:system_management_homepage:2.1.8-177", null); + obj.addVulnerableSoftware("cpe:/a:hp:system_management_homepage:2.0.1", null); + obj.addVulnerableSoftware("cpe:/a:hp:system_management_homepage:2.0.0", null); + obj.addVulnerableSoftware("cpe:/a:hp:system_management_homepage:2.1.7-168", null); + obj.addVulnerableSoftware("cpe:/a:hp:system_management_homepage:2.1.0-103", null); + obj.addVulnerableSoftware("cpe:/a:hp:system_management_homepage:2.1.11-197", null); + obj.addVulnerableSoftware("cpe:/a:hp:system_management_homepage:2.1.9-178", null); + obj.addVulnerableSoftware("cpe:/a:hp:system_management_homepage:2.1.12-200", "1"); + assertEquals(31, obj.getVulnerableSoftware().size()); } + + @Test + public void testSoftwareSorting() { + Vulnerability obj = new Vulnerability(); + obj.addVulnerableSoftware("cpe:/a:hp:system_management_homepage:2.1.0-103%28a%29", null); + obj.addVulnerableSoftware("cpe:/a:hp:system_management_homepage:2.1.0-118", null); + obj.addVulnerableSoftware("cpe:/a:hp:system_management_homepage:2.1.3.132", null); + obj.addVulnerableSoftware("cpe:/a:hp:system_management_homepage:2.1.12-200", null); + obj.addVulnerableSoftware("cpe:/a:hp:system_management_homepage:2.1.2-127", null); + obj.addVulnerableSoftware("cpe:/a:hp:system_management_homepage:2.1.9", null); + obj.addVulnerableSoftware("cpe:/a:hp:system_management_homepage:2.1.10", null); + obj.addVulnerableSoftware("cpe:/a:hp:system_management_homepage:2.1.11", null); + obj.addVulnerableSoftware("cpe:/a:hp:system_management_homepage:2.1.12-118", null); + obj.addVulnerableSoftware("cpe:/a:hp:system_management_homepage:2.1.4-143", null); + obj.addVulnerableSoftware("cpe:/a:hp:system_management_homepage:2.1.0-109", null); + obj.addVulnerableSoftware("cpe:/a:hp:system_management_homepage:2.1.6-156", null); + obj.addVulnerableSoftware("cpe:/a:hp:system_management_homepage:2.1.4", null); + obj.addVulnerableSoftware("cpe:/a:hp:system_management_homepage:2.1.3", null); + obj.addVulnerableSoftware("cpe:/a:hp:system_management_homepage:2.1", null); + obj.addVulnerableSoftware("cpe:/a:hp:system_management_homepage:2.1.10-186", null); + obj.addVulnerableSoftware("cpe:/a:hp:system_management_homepage:2.1.6", null); + obj.addVulnerableSoftware("cpe:/a:hp:system_management_homepage:2.1.5", null); + obj.addVulnerableSoftware("cpe:/a:hp:system_management_homepage:2.1.5-146", null); + obj.addVulnerableSoftware("cpe:/a:hp:system_management_homepage:2.1.8", null); + obj.addVulnerableSoftware("cpe:/a:hp:system_management_homepage:2.1.7", null); + obj.addVulnerableSoftware("cpe:/a:hp:system_management_homepage:2.1.2", null); + obj.addVulnerableSoftware("cpe:/a:hp:system_management_homepage:2.0.2", null); + obj.addVulnerableSoftware("cpe:/a:hp:system_management_homepage:2.1.1", null); + obj.addVulnerableSoftware("cpe:/a:hp:system_management_homepage:2.1.8-177", null); + obj.addVulnerableSoftware("cpe:/a:hp:system_management_homepage:2.0.1", null); + obj.addVulnerableSoftware("cpe:/a:hp:system_management_homepage:2.0.0", null); + obj.addVulnerableSoftware("cpe:/a:hp:system_management_homepage:2.1.7-168", null); + obj.addVulnerableSoftware("cpe:/a:hp:system_management_homepage:2.1.0-103", null); + obj.addVulnerableSoftware("cpe:/a:hp:system_management_homepage:2.1.11-197", null); + obj.addVulnerableSoftware("cpe:/a:hp:system_management_homepage:2.1.9-178", null); + + Set software = obj.getVulnerableSoftware(); + VulnerableSoftware vs[] = software.toArray(new VulnerableSoftware[software.size()]); + + assertTrue("cpe:/a:hp:system_management_homepage:2.0.0".equals(vs[0].getName())); + assertTrue("cpe:/a:hp:system_management_homepage:2.0.1".equals(vs[1].getName())); + assertTrue("cpe:/a:hp:system_management_homepage:2.0.2".equals(vs[2].getName())); + assertTrue("cpe:/a:hp:system_management_homepage:2.1".equals(vs[3].getName())); + assertTrue("cpe:/a:hp:system_management_homepage:2.1.0-103".equals(vs[4].getName())); + assertTrue("cpe:/a:hp:system_management_homepage:2.1.0-103%28a%29".equals(vs[5].getName())); + assertTrue("cpe:/a:hp:system_management_homepage:2.1.0-109".equals(vs[6].getName())); + assertTrue("cpe:/a:hp:system_management_homepage:2.1.0-118".equals(vs[7].getName())); + assertTrue("cpe:/a:hp:system_management_homepage:2.1.1".equals(vs[8].getName())); + assertTrue("cpe:/a:hp:system_management_homepage:2.1.2".equals(vs[9].getName())); + assertTrue("cpe:/a:hp:system_management_homepage:2.1.2-127".equals(vs[10].getName())); + assertTrue("cpe:/a:hp:system_management_homepage:2.1.3".equals(vs[11].getName())); + assertTrue("cpe:/a:hp:system_management_homepage:2.1.3.132".equals(vs[12].getName())); + assertTrue("cpe:/a:hp:system_management_homepage:2.1.4".equals(vs[13].getName())); + assertTrue("cpe:/a:hp:system_management_homepage:2.1.4-143".equals(vs[14].getName())); + assertTrue("cpe:/a:hp:system_management_homepage:2.1.5".equals(vs[15].getName())); + assertTrue("cpe:/a:hp:system_management_homepage:2.1.5-146".equals(vs[16].getName())); + assertTrue("cpe:/a:hp:system_management_homepage:2.1.6".equals(vs[17].getName())); + assertTrue("cpe:/a:hp:system_management_homepage:2.1.6-156".equals(vs[18].getName())); + assertTrue("cpe:/a:hp:system_management_homepage:2.1.7".equals(vs[19].getName())); + assertTrue("cpe:/a:hp:system_management_homepage:2.1.7-168".equals(vs[20].getName())); + assertTrue("cpe:/a:hp:system_management_homepage:2.1.8".equals(vs[21].getName())); + assertTrue("cpe:/a:hp:system_management_homepage:2.1.8-177".equals(vs[22].getName())); + assertTrue("cpe:/a:hp:system_management_homepage:2.1.9".equals(vs[23].getName())); + assertTrue("cpe:/a:hp:system_management_homepage:2.1.9-178".equals(vs[24].getName())); + assertTrue("cpe:/a:hp:system_management_homepage:2.1.10".equals(vs[25].getName())); + assertTrue("cpe:/a:hp:system_management_homepage:2.1.10-186".equals(vs[26].getName())); + assertTrue("cpe:/a:hp:system_management_homepage:2.1.11".equals(vs[27].getName())); + assertTrue("cpe:/a:hp:system_management_homepage:2.1.11-197".equals(vs[28].getName())); + assertTrue("cpe:/a:hp:system_management_homepage:2.1.12-118".equals(vs[29].getName())); + assertTrue("cpe:/a:hp:system_management_homepage:2.1.12-200".equals(vs[30].getName())); + + } + } diff --git a/dependency-check-core/src/test/java/org/owasp/dependencycheck/dependency/VulnerableSoftwareTest.java b/dependency-check-core/src/test/java/org/owasp/dependencycheck/dependency/VulnerableSoftwareTest.java index 8789d25d1..91ed83373 100644 --- a/dependency-check-core/src/test/java/org/owasp/dependencycheck/dependency/VulnerableSoftwareTest.java +++ b/dependency-check-core/src/test/java/org/owasp/dependencycheck/dependency/VulnerableSoftwareTest.java @@ -31,7 +31,7 @@ import org.owasp.dependencycheck.BaseTest; * * @author Jeremy Long */ -public class VulnerableSoftwareTest extends BaseTest { +public class VulnerableSoftwareTest extends BaseTest { /** * Test of equals method, of class VulnerableSoftware. @@ -93,25 +93,52 @@ public class VulnerableSoftwareTest extends BaseTest { } @Test - public void testCompareToNonNumerical(){ - VulnerableSoftware vs = new VulnerableSoftware(); - vs.setCpe("cpe:/a:mysql:mysql:5.1.23a"); - VulnerableSoftware vs1 = new VulnerableSoftware(); - vs1.setCpe("cpe:/a:mysql:mysql:5.1.23a"); - vs1.setPreviousVersion("1"); - assertEquals(0, vs.compareTo(vs1)); - assertEquals(0, vs1.compareTo(vs)); + public void testCompareToNonNumerical() { + VulnerableSoftware vs = new VulnerableSoftware(); + vs.setCpe("cpe:/a:mysql:mysql:5.1.23a"); + VulnerableSoftware vs1 = new VulnerableSoftware(); + vs1.setCpe("cpe:/a:mysql:mysql:5.1.23a"); + vs1.setPreviousVersion("1"); + assertEquals(0, vs.compareTo(vs1)); + assertEquals(0, vs1.compareTo(vs)); + } + + @Test + public void testCompareToComplex() { + VulnerableSoftware vs = new VulnerableSoftware(); + VulnerableSoftware vs1 = new VulnerableSoftware(); + + vs.setCpe("2.1"); + vs1.setCpe("2.1.10"); + assertTrue(vs.compareTo(vs1) < 0); + + vs.setCpe("cpe:/a:hp:system_management_homepage:2.1.1"); + vs1.setCpe("cpe:/a:hp:system_management_homepage:2.1.10"); + assertTrue(vs.compareTo(vs1) < 0); + + vs.setCpe("10"); + vs1.setCpe("10-186"); + assertTrue(vs.compareTo(vs1) < 0); + + vs.setCpe("2.1.10"); + vs1.setCpe("2.1.10-186"); + assertTrue(vs.compareTo(vs1) < 0); + + vs.setCpe("cpe:/a:hp:system_management_homepage:2.1.10"); + vs1.setCpe("cpe:/a:hp:system_management_homepage:2.1.10-186"); + assertTrue(vs.compareTo(vs1) < 0); + //assertTrue(vs1.compareTo(vs)>0); } @Test public void testEqualsPreviousVersion() { - VulnerableSoftware vs = new VulnerableSoftware(); - vs.setCpe("cpe:/a:mysql:mysql:5.1.23a"); - VulnerableSoftware vs1 = new VulnerableSoftware(); - vs1.setCpe("cpe:/a:mysql:mysql:5.1.23a"); - vs1.setPreviousVersion("1"); - assertEquals(vs,vs1); - assertEquals(vs1,vs); + VulnerableSoftware vs = new VulnerableSoftware(); + vs.setCpe("cpe:/a:mysql:mysql:5.1.23a"); + VulnerableSoftware vs1 = new VulnerableSoftware(); + vs1.setCpe("cpe:/a:mysql:mysql:5.1.23a"); + vs1.setPreviousVersion("1"); + assertEquals(vs, vs1); + assertEquals(vs1, vs); } diff --git a/dependency-check-core/src/test/resources/cve-1.2-2008_4411.xml b/dependency-check-core/src/test/resources/cve-1.2-2008_4411.xml new file mode 100644 index 000000000..0fad0302c --- /dev/null +++ b/dependency-check-core/src/test/resources/cve-1.2-2008_4411.xml @@ -0,0 +1,57 @@ + + + + + Cross-site scripting (XSS) vulnerability in HP System Management Homepage (SMH) before 2.1.15.210 on Linux and Windows allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2008-1663. + + + + + + + + + 31663 + smh-unspecified-xss(45754) + ADV-2008-2778 + 1021015 + 4398 + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/dependency-check-core/src/test/resources/cve-2.0-2008_4411.xml b/dependency-check-core/src/test/resources/cve-2.0-2008_4411.xml new file mode 100644 index 000000000..0413733de --- /dev/null +++ b/dependency-check-core/src/test/resources/cve-2.0-2008_4411.xml @@ -0,0 +1,115 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + cpe:/a:hp:system_management_homepage:2.1.0-103%28a%29 + cpe:/a:hp:system_management_homepage:2.1.0-118 + cpe:/a:hp:system_management_homepage:2.1.3.132 + cpe:/a:hp:system_management_homepage:2.1.12-200 + cpe:/a:hp:system_management_homepage:2.1.2-127 + cpe:/a:hp:system_management_homepage:2.1.9 + cpe:/a:hp:system_management_homepage:2.1.10 + cpe:/a:hp:system_management_homepage:2.1.11 + cpe:/a:hp:system_management_homepage:2.1.12-118 + cpe:/a:hp:system_management_homepage:2.1.4-143 + cpe:/a:hp:system_management_homepage:2.1.0-109 + cpe:/a:hp:system_management_homepage:2.1.6-156 + cpe:/a:hp:system_management_homepage:2.1.4 + cpe:/a:hp:system_management_homepage:2.1.3 + cpe:/a:hp:system_management_homepage:2.1 + cpe:/a:hp:system_management_homepage:2.1.10-186 + cpe:/a:hp:system_management_homepage:2.1.6 + cpe:/a:hp:system_management_homepage:2.1.5 + cpe:/a:hp:system_management_homepage:2.1.5-146 + cpe:/a:hp:system_management_homepage:2.1.8 + cpe:/a:hp:system_management_homepage:2.1.7 + cpe:/a:hp:system_management_homepage:2.1.2 + cpe:/a:hp:system_management_homepage:2.0.2 + cpe:/a:hp:system_management_homepage:2.1.1 + cpe:/a:hp:system_management_homepage:2.1.8-177 + cpe:/a:hp:system_management_homepage:2.0.1 + cpe:/a:hp:system_management_homepage:2.0.0 + cpe:/a:hp:system_management_homepage:2.1.7-168 + cpe:/a:hp:system_management_homepage:2.1.0-103 + cpe:/a:hp:system_management_homepage:2.1.11-197 + cpe:/a:hp:system_management_homepage:2.1.9-178 + + CVE-2008-4411 + 2008-10-13T16:00:02.277-04:00 + 2011-03-07T22:12:25.097-05:00 + + + 4.3 + NETWORK + MEDIUM + NONE + NONE + PARTIAL + NONE + http://nvd.nist.gov + 2008-10-14T10:57:00.000-04:00 + + + + + BID + 31663 + + + XF + smh-unspecified-xss(45754) + + + VUPEN + ADV-2008-2778 + + + SECTRACK + 1021015 + + + SREASON + 4398 + + Cross-site scripting (XSS) vulnerability in HP System Management Homepage (SMH) before 2.1.15.210 on Linux and Windows allows remote attackers to inject arbitrary web script or HTML via unspecified vectors, a different vulnerability than CVE-2008-1663. + + + \ No newline at end of file