version 1.1.1

Former-commit-id: bde142783532d8d46b468e644f3af8ecc42c40d3

dependency-check-ant/pom.xml

@@ -21,7 +21,7 @@ Copyright (c) 2013 - Jeremy Long. All Rights Reserved.
     <parent>
         <groupId>org.owasp</groupId>
         <artifactId>dependency-check-parent</artifactId>
-        <version>1.1.1-SNAPSHOT</version>
+        <version>1.1.1</version>
     </parent>
 
     <artifactId>dependency-check-ant</artifactId>

dependency-check-cli/pom.xml

@@ -21,7 +21,7 @@ Copyright (c) 2012 - Jeremy Long. All Rights Reserved.
     <parent>
         <groupId>org.owasp</groupId>
         <artifactId>dependency-check-parent</artifactId>
-        <version>1.1.1-SNAPSHOT</version>
+        <version>1.1.1</version>
     </parent>
 
     <artifactId>dependency-check-cli</artifactId>

dependency-check-core/pom.xml

@@ -21,7 +21,7 @@ Copyright (c) 2012 Jeremy Long. All Rights Reserved.
     <parent>
         <groupId>org.owasp</groupId>
         <artifactId>dependency-check-parent</artifactId>
-        <version>1.1.1-SNAPSHOT</version>
+        <version>1.1.1</version>
     </parent>
 
     <artifactId>dependency-check-core</artifactId>

dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/JavaScriptAnalyzer.java

@@ -13,20 +13,27 @@
  * See the License for the specific language governing permissions and
  * limitations under the License.
  *
- * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
+ * Copyright (c) 2014 Jeremy Long. All Rights Reserved.
  */
 package org.owasp.dependencycheck.analyzer;
 
+import java.io.BufferedReader;
+import java.io.File;
+import java.io.FileNotFoundException;
+import java.io.FileReader;
+import java.io.IOException;
 import java.util.Set;
+import java.util.logging.Level;
+import java.util.logging.Logger;
 import java.util.regex.Pattern;
 import org.owasp.dependencycheck.Engine;
 import org.owasp.dependencycheck.dependency.Dependency;
 
 /**
  *
- * Used to load a JAR file and collect information that can be used to determine the associated CPE.
+ * Used to analyze a JavaScript file to gather information to aid in identification of a CPE identifier.
  *
- * @author Jeremy Long <jeremy.long@owasp.org>
+ * @author Jeremy Long (jeremy.long@owasp.org)
  */
 public class JavaScriptAnalyzer extends AbstractAnalyzer implements Analyzer {
 
@@ -49,6 +56,7 @@ public class JavaScriptAnalyzer extends AbstractAnalyzer implements Analyzer {
      *
      * @return a list of file EXTENSIONS supported by this analyzer.
      */
+    @Override
     public Set<String> getSupportedExtensions() {
         return EXTENSIONS;
     }
@@ -58,6 +66,7 @@ public class JavaScriptAnalyzer extends AbstractAnalyzer implements Analyzer {
      *
      * @return the name of the analyzer.
      */
+    @Override
     public String getName() {
         return ANALYZER_NAME;
     }
@@ -68,6 +77,7 @@ public class JavaScriptAnalyzer extends AbstractAnalyzer implements Analyzer {
      * @param extension the file extension to test for support.
      * @return whether or not the specified file extension is supported by this analyzer.
      */
+    @Override
     public boolean supportsExtension(String extension) {
         return EXTENSIONS.contains(extension);
     }
@@ -77,42 +87,45 @@ public class JavaScriptAnalyzer extends AbstractAnalyzer implements Analyzer {
      *
      * @return the phase that the analyzer is intended to run in.
      */
+    @Override
     public AnalysisPhase getAnalysisPhase() {
         return ANALYSIS_PHASE;
     }
     //</editor-fold>
 
     /**
-     * Loads a specified JAR file and collects information from the manifest and checksums to identify the correct CPE
+     * Loads a specified JavaScript file and collects information from the copyright information contained within.
-     * information.
      *
      * @param dependency the dependency to analyze.
      * @param engine the engine that is scanning the dependencies
-     * @throws AnalysisException is thrown if there is an error reading the JAR file.
+     * @throws AnalysisException is thrown if there is an error reading the JavaScript file.
      */
     @Override
     public void analyze(Dependency dependency, Engine engine) throws AnalysisException {
-        final Pattern extractComments = Pattern.compile("(/\\*([^*]|[\\r\\n]|(\\*+([^*/]|[\\r\\n])))*\\*+/)|(//.*)");
+        BufferedReader fin = null;;
-
+        try {
-    }
+            //  /\*([^\*][^/]|[\r\n\f])+?\*/
-
+            final Pattern extractComments = Pattern.compile("(/\\*([^*]|[\\r\\n]|(\\*+([^*/]|[\\r\\n])))*\\*+/)|(//.*)", Pattern.MULTILINE);
-    /**
+            File file = dependency.getActualFile();
-     * The initialize method does nothing for this Analyzer.
+            fin = new BufferedReader(new FileReader(file));
-     *
+            StringBuilder sb = new StringBuilder(2000);
-     * @throws Exception thrown if there is an exception
+            String text;
-     */
+            while ((text = fin.readLine()) != null) {
-    @Override
+                sb.append(text);
-    public void initialize() throws Exception {
+            }
-        //do nothing
+        } catch (FileNotFoundException ex) {
-    }
+            final String msg = String.format("Dependency file not found: '%s'", dependency.getActualFilePath());
-
+            throw new AnalysisException(msg, ex);
-    /**
+        } catch (IOException ex) {
-     * The close method does nothing for this Analyzer.
+            Logger.getLogger(JavaScriptAnalyzer.class.getName()).log(Level.SEVERE, null, ex);
-     *
+        } finally {
-     * @throws Exception thrown if there is an exception
+            if (fin != null) {
-     */
+                try {
-    @Override
+                    fin.close();
-    public void close() throws Exception {
+                } catch (IOException ex) {
-        //do nothing
+                    Logger.getLogger(JavaScriptAnalyzer.class.getName()).log(Level.FINEST, null, ex);
+                }
+            }
+        }
     }
 }

dependency-check-core/src/test/java/org/owasp/dependencycheck/analyzer/JavaScriptAnalyzerTest.java

@@ -0,0 +1,145 @@
+/*
+ * This file is part of dependency-check-core.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * Copyright (c) 2014 Jeremy Long. All Rights Reserved.
+ */
+package org.owasp.dependencycheck.analyzer;
+
+import java.io.File;
+import java.util.HashSet;
+import java.util.Set;
+import org.junit.After;
+import org.junit.AfterClass;
+import static org.junit.Assert.assertEquals;
+import org.junit.Before;
+import org.junit.BeforeClass;
+import org.junit.Test;
+import org.owasp.dependencycheck.Engine;
+import org.owasp.dependencycheck.dependency.Dependency;
+
+/**
+ *
+ * @author Jeremy Long (jeremy.long@owasp.org)
+ */
+public class JavaScriptAnalyzerTest {
+
+    public JavaScriptAnalyzerTest() {
+    }
+
+    @BeforeClass
+    public static void setUpClass() {
+    }
+
+    @AfterClass
+    public static void tearDownClass() {
+    }
+
+    @Before
+    public void setUp() {
+    }
+
+    @After
+    public void tearDown() {
+    }
+
+    /**
+     * Test of getSupportedExtensions method, of class JavaScriptAnalyzer.
+     */
+    @Test
+    public void testGetSupportedExtensions() {
+        JavaScriptAnalyzer instance = new JavaScriptAnalyzer();
+        Set expResult = new HashSet<String>();
+        expResult.add("js");
+        Set result = instance.getSupportedExtensions();
+        assertEquals(expResult, result);
+    }
+
+    /**
+     * Test of getName method, of class JavaScriptAnalyzer.
+     */
+    @Test
+    public void testGetName() {
+        System.out.println("getName");
+        JavaScriptAnalyzer instance = new JavaScriptAnalyzer();
+        String expResult = "JavaScript Analyzer";
+        String result = instance.getName();
+        assertEquals(expResult, result);
+    }
+
+    /**
+     * Test of supportsExtension method, of class JavaScriptAnalyzer.
+     */
+    @Test
+    public void testSupportsExtension() {
+        String extension = "js";
+        JavaScriptAnalyzer instance = new JavaScriptAnalyzer();
+        boolean expResult = true;
+        boolean result = instance.supportsExtension(extension);
+        assertEquals(expResult, result);
+    }
+
+    /**
+     * Test of getAnalysisPhase method, of class JavaScriptAnalyzer.
+     */
+    @Test
+    public void testGetAnalysisPhase() {
+        JavaScriptAnalyzer instance = new JavaScriptAnalyzer();
+        AnalysisPhase expResult = AnalysisPhase.INFORMATION_COLLECTION;
+        AnalysisPhase result = instance.getAnalysisPhase();
+        assertEquals(expResult, result);
+    }
+
+    /**
+     * Test of analyze method, of class JavaScriptAnalyzer.
+     */
+    @Test
+    public void testAnalyze() throws Exception {
+        File jq6 = new File(this.getClass().getClassLoader().getResource("jquery-1.6.2.min.js").getPath());
+        File jq10 = new File(this.getClass().getClassLoader().getResource("jquery-1.10.2.js").getPath());
+        File jq10min = new File(this.getClass().getClassLoader().getResource("jquery-1.10.2.min.js").getPath());
+        Dependency depJQ6 = new Dependency(jq6);
+        Dependency depJQ10 = new Dependency(jq10);
+        Dependency depJQ10min = new Dependency(jq10min);
+        Engine engine = null;
+        JavaScriptAnalyzer instance = new JavaScriptAnalyzer();
+
+//        assertTrue(depJQ6.getEvidence().size() == 0);
+//        assertTrue(depJQ10.getEvidence().size() == 0);
+//        assertTrue(depJQ10min.getEvidence().size() == 0);
+//
+//        instance.analyze(depJQ6, engine);
+//        instance.analyze(depJQ10, engine);
+//        instance.analyze(depJQ10min, engine);
+//        //TODO improve the assertions
+//        assertTrue(depJQ6.getEvidence().size() > 0);
+//        assertTrue(depJQ10.getEvidence().size() > 0);
+//        assertTrue(depJQ10min.getEvidence().size() > 0);
+    }
+
+    /**
+     * Test of initialize method, of class JavaScriptAnalyzer.
+     */
+    @Test
+    public void testInitialize() throws Exception {
+    }
+
+    /**
+     * Test of close method, of class JavaScriptAnalyzer.
+     */
+    @Test
+    public void testClose() throws Exception {
+
+    }
+}

dependency-check-jenkins/pom.xml

@@ -6,7 +6,7 @@
     <parent>
         <groupId>org.owasp</groupId>
         <artifactId>dependency-check-parent</artifactId>
-        <version>1.1.1-SNAPSHOT</version>
+        <version>1.1.1</version>
     </parent>
 
     <groupId>org.owasp</groupId>

dependency-check-maven/pom.xml

@@ -23,7 +23,7 @@ Copyright (c) 2013 Jeremy Long. All Rights Reserved.
     <parent>
         <groupId>org.owasp</groupId>
         <artifactId>dependency-check-parent</artifactId>
-        <version>1.1.1-SNAPSHOT</version>
+        <version>1.1.1</version>
     </parent>
 
     <artifactId>dependency-check-maven</artifactId>

pom.xml

@@ -20,7 +20,7 @@ Copyright (c) 2012 - Jeremy Long
 
     <groupId>org.owasp</groupId>
     <artifactId>dependency-check-parent</artifactId>
-    <version>1.1.1-SNAPSHOT</version>
+    <version>1.1.1</version>
     <packaging>pom</packaging>
 
     <modules>