github-mirrors/DependencyCheck
1
0
Fork 0
mirror of https://github.com/ysoftdevs/DependencyCheck.git synced 2026-01-15 08:13:43 +01:00
Code Issues Packages Projects Releases Wiki Activity

fix for issue #937

Browse Source
This commit is contained in:
Jeremy Long
2017-10-22 14:41:06 -04:00
parent 714b3d29b9
commit 5b7314e6d3
10 changed files with 72 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
src/site/markdown/analyzers/index.md
View File

@@ -32,3 +32,14 @@ several teams have found them useful in their current state.
| [Python](./python.html) | Python source files (\*.py); Package metadata files (PKG-INFO, METADATA); Package Distribution Files (\*.whl, \*.egg, \*.zip) | Regex scan of Python source files for setuptools metadata; Parse RFC822 header format for metadata in all other artifacts. |
| [Ruby Gemspec](./ruby-gemspec.html) | Ruby makefiles (Rakefile); Ruby Gemspec files (\*.gemspec) | Regex scan Gemspec initialization blocks for metadata. |
| [SWIFT](./swift.html) | SWIFT Package Manager's `Package.swift` | Extracts dependency information from swift package file. |
Retired Analyzers
----------------------
The following analyzers can be enabled by enabling the _retired_ configuration
option; see the documentation for the CLI, Ant, Maven, etc. for more information.
These analyzers have been retired due to the higher false positive and
false negative rates.
| Analyzer | File Types Scanned | Analysis Method |
| -------- | ------------------ | --------------- |
| [Node.js](./nodejs.html) | NPM package specification files (package.json) | Parse JSON format for metadata. |

9
src/site/markdown/analyzers/nodejs.md
View File

@@ -1,9 +1,8 @@
Node.js Analyzer
================
*Experimental*: This analyzer is considered experimental. While this analyzer may
be useful and provide valid results more testing must be completed to ensure that
the false negative/false positive rates are acceptable.
*Retired*: This analyzer has been retired due to an extremely high false positive
rate.
OWASP dependency-check includes an analyzer that will scan [Node Package Manager](https://www.npmjs.com/)
package specification files. The analyzer will collect as much information as
@@ -12,8 +11,4 @@ as evidence and is grouped into vendor, product, and version buckets. Other
analyzers later use this evidence to identify any Common Platform Enumeration
(CPE) identifiers that apply.
*Note*: Consider using [Retire.js](http://retirejs.github.io/retire.js/) or the
Node Security Project auditing tool, [nsp](https://nodesecurity.io/tools) instead
of, or in addition to OWASP dependency-check to analyze Node.js packages.
Files Types Scanned: [package.json](https://docs.npmjs.com/files/package.json)

3
src/site/markdown/dependency-check-gradle/configuration.md
View File

@@ -121,12 +121,13 @@ analyzers | pathToMono | The path to Mono for .NET assembly analys
analyzers | cmakeEnabled | Sets whether or not the [experimental](../analyzers/index.html) CMake Analyzer should be used. | true
analyzers | autoconfEnabled | Sets whether or not the [experimental](../analyzers/index.html) autoconf Analyzer should be used. | true
analyzers | composerEnabled | Sets whether or not the [experimental](../analyzers/index.html) PHP Composer Lock File Analyzer should be used. | true
analyzers | nodeEnabled | Sets whether or not the [experimental](../analyzers/index.html) Node.js Analyzer should be used. | true
analyzers | nodeEnabled | Sets whether or not the [retired](../analyzers/index.html) Node.js Analyzer should be used. | true
analyzers | nspEnabled | Sets whether the NSP Analyzer should be used. | true
analyzers | cocoapodsEnabled | Sets whether or not the [experimental](../analyzers/index.html) Cocoapods Analyzer should be used. | true
analyzers | swiftEnabled | Sets whether or not the [experimental](../analyzers/index.html) Swift Package Manager Analyzer should be used. | true
analyzers | bundleAuditEnabled | Sets whether or not the [experimental](../analyzers/index.html) Ruby Bundle Audit Analyzer should be used. | true
analyzers | pathToBundleAudit | The path to bundle audit. |  
analyzers | retiredEnabled | Sets whether the [retired analyzers](../analyzers/index.html) will be used. If not set to true the analyzers marked as experimental (see below) will not be used | false
#### Example
```groovy