iterator = service.getAnalyzers();
- while(iterator.hasNext()) {
+ while (iterator.hasNext()) {
Analyzer a = iterator.next();
analyzers.add(a);
}
diff --git a/src/main/java/org/codesecure/dependencycheck/utils/CliParser.java b/src/main/java/org/codesecure/dependencycheck/utils/CliParser.java
index ae2738c75..55300e2c4 100644
--- a/src/main/java/org/codesecure/dependencycheck/utils/CliParser.java
+++ b/src/main/java/org/codesecure/dependencycheck/utils/CliParser.java
@@ -135,6 +135,7 @@ public final class CliParser {
throw new FileNotFoundException("Invalid file argument: " + path);
}
}
+
/**
* Generates an Options collection that is used to parse the command line
* and to display the help message.
@@ -156,7 +157,8 @@ public final class CliParser {
.withDescription("the name of the application being scanned").create(ArgumentName.APPNAME_SHORT);
Option path = OptionBuilder.withArgName("path").hasArg().withLongOpt(ArgumentName.SCAN)
- .withDescription("the path to scan - this option can be specified multiple times.").create(ArgumentName.SCAN_SHORT);
+ .withDescription("the path to scan - this option can be specified multiple times.")
+ .create(ArgumentName.SCAN_SHORT);
Option load = OptionBuilder.withArgName("file").hasArg().withLongOpt(ArgumentName.CPE)
.withDescription("load the CPE xml file").create(ArgumentName.CPE_SHORT);
@@ -225,11 +227,11 @@ public final class CliParser {
formatter.printHelp(Settings.getString("application.name", "DependencyCheck"),
"\n" + Settings.getString("application.name", "DependencyCheck")
+ " can be used to identify if there are any known CVE vulnerabilities in libraries utillized by an application. "
- + Settings.getString("application.name", "DependencyCheck") + " will automatically update required data from the Internet, such as the CVE and CPE data files from nvd.nist.gov.\n",
+ + Settings.getString("application.name", "DependencyCheck")
+ + " will automatically update required data from the Internet, such as the CVE and CPE data files from nvd.nist.gov.\n",
options, "", true);
}
-
/**
* Retrieves the file command line parameter(s) specified for the 'cpe' argument.
*
@@ -264,6 +266,7 @@ public final class CliParser {
public String getApplicationName() {
return line.getOptionValue(ArgumentName.APPNAME);
}
+
/**
* Prints the manifest information to standard output:
* - Implementation-Title: ${pom.name}
@@ -291,6 +294,7 @@ public final class CliParser {
* line arguments.
*/
public static class ArgumentName {
+
/**
* The long CLI argument name specifing the directory/file to scan
*/
@@ -347,6 +351,5 @@ public final class CliParser {
* The short CLI argument name asking for the version.
*/
public static final String VERSION = "version";
-
}
}
diff --git a/src/main/java/org/codesecure/dependencycheck/utils/DownloadFailedException.java b/src/main/java/org/codesecure/dependencycheck/utils/DownloadFailedException.java
index f88fa8dac..49414b57e 100644
--- a/src/main/java/org/codesecure/dependencycheck/utils/DownloadFailedException.java
+++ b/src/main/java/org/codesecure/dependencycheck/utils/DownloadFailedException.java
@@ -1,30 +1,63 @@
-/*
- * To change this template, choose Tools | Templates
- * and open the template in the editor.
- */
package org.codesecure.dependencycheck.utils;
+/*
+ * This file is part of DependencyCheck.
+ *
+ * DependencyCheck is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * DependencyCheck is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with DependencyCheck. If not, see http://www.gnu.org/licenses/.
+ *
+ * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
+ */
import java.io.IOException;
/**
- *
+ * An exception used when a download fails.
+ *
* @author Jeremy Long (jeremy.long@gmail.com)
*/
public class DownloadFailedException extends IOException {
-
+
private static final long serialVersionUID = 1L;
-
+
+ /**
+ * Creates a new DownloadFailedException.
+ */
public DownloadFailedException() {
super();
}
-
+
+ /**
+ * Creates a new DownloadFailedException.
+ * @param msg a message for the exception.
+ */
public DownloadFailedException(String msg) {
super(msg);
}
+
+ /**
+ * Creates a new DownloadFailedException.
+ * @param ex the cause of te download failure.
+ */
public DownloadFailedException(Throwable ex) {
super(ex);
}
+
+ /**
+ * Creates a new DownloadFailedException.
+ * @param msg a message for the exception.
+ * @param ex the cause of te download failure.
+ */
public DownloadFailedException(String msg, Throwable ex) {
- super(msg,ex);
+ super(msg, ex);
}
}
diff --git a/src/main/java/org/codesecure/dependencycheck/utils/Downloader.java b/src/main/java/org/codesecure/dependencycheck/utils/Downloader.java
index d27571e45..229197cec 100644
--- a/src/main/java/org/codesecure/dependencycheck/utils/Downloader.java
+++ b/src/main/java/org/codesecure/dependencycheck/utils/Downloader.java
@@ -42,7 +42,6 @@ public class Downloader {
* Private constructor for utility class.
*/
private Downloader() {
-
}
/**
@@ -66,7 +65,7 @@ public class Downloader {
HttpURLConnection conn = null;
Proxy proxy = null;
String proxyUrl = Settings.getString(Settings.KEYS.PROXY_URL);
-
+
try {
if (proxyUrl != null) {
int proxyPort = Settings.getInt(Settings.KEYS.PROXY_PORT);
@@ -80,11 +79,11 @@ public class Downloader {
int timeout = Settings.getInt(Settings.KEYS.CONNECTION_TIMEOUT);
conn.setConnectTimeout(timeout);
}
-
+
conn.connect();
} catch (IOException ex) {
try {
- if (conn!=null) {
+ if (conn != null) {
conn.disconnect();
}
} finally {
@@ -92,13 +91,13 @@ public class Downloader {
}
throw new DownloadFailedException("Error downloading file.", ex);
}
-
+
BufferedOutputStream writer = null;
try {
//the following times out on some systems because the CPE is big.
//InputStream reader = url.openStream();
InputStream reader = conn.getInputStream();
-
+
writer = new BufferedOutputStream(new FileOutputStream(outputPath));
byte[] buffer = new byte[4096];
int bytesRead = 0;
diff --git a/src/main/java/org/codesecure/dependencycheck/utils/Settings.java b/src/main/java/org/codesecure/dependencycheck/utils/Settings.java
index 4fa896eef..a8194547a 100644
--- a/src/main/java/org/codesecure/dependencycheck/utils/Settings.java
+++ b/src/main/java/org/codesecure/dependencycheck/utils/Settings.java
@@ -20,9 +20,6 @@ package org.codesecure.dependencycheck.utils;
import java.io.IOException;
import java.io.InputStream;
-import java.util.Enumeration;
-import java.util.HashMap;
-import java.util.Map;
import java.util.Properties;
import java.util.logging.Level;
import java.util.logging.Logger;
@@ -34,7 +31,6 @@ import java.util.logging.Logger;
*/
public class Settings {
-
/**
* The collection of keys used within the properties file.
*/
@@ -60,10 +56,6 @@ public class Settings {
* The properties key for the path where the OSVDB Lucene Index will be stored.
*/
public static final String OSVDB_INDEX = "osvdb";
- /**
- * The properties key prefix for the analyzer assocations.
- */
- public static final String FILE_EXTENSION_ANALYZER_ASSOCIATION_PREFIX = "file.extension.analyzer.association.";
/**
* The properties key for the proxy url.
*/
@@ -120,7 +112,7 @@ public class Settings {
public static void setString(String key, String value) {
instance.props.setProperty(key, value);
}
-
+
/**
* Returns a value from the properties file. If the value was specified as a
* system property or passed in via the -Dprop=value argument - this method
@@ -133,7 +125,7 @@ public class Settings {
public static String getString(String key) {
return System.getProperty(key, instance.props.getProperty(key));
}
-
+
/**
* Returns a integer value from the properties file. If the value was specified as a
* system property or passed in via the -Dprop=value argument - this method
@@ -146,6 +138,7 @@ public class Settings {
public static int getInt(String key) {
return Integer.parseInt(Settings.getString(key));
}
+
/**
* Returns a boolean value from the properties file. If the value was specified as a
* system property or passed in via the -Dprop=value argument - this method
diff --git a/src/test/java/org/codesecure/dependencycheck/scanner/JarAnalyzerTest.java b/src/test/java/org/codesecure/dependencycheck/scanner/JarAnalyzerTest.java
index 0d8b4de47..a0f8864dc 100644
--- a/src/test/java/org/codesecure/dependencycheck/scanner/JarAnalyzerTest.java
+++ b/src/test/java/org/codesecure/dependencycheck/scanner/JarAnalyzerTest.java
@@ -53,6 +53,41 @@ public class JarAnalyzerTest {
assertEquals("89CE9E36AA9A9E03F1450936D2F4F8DD0F961F8B", result.getSha1sum());
assertTrue(result.getVendorEvidence().toString().toLowerCase().contains("apache"));
assertTrue(result.getVendorEvidence().getWeighting().contains("apache"));
+
+
+ file = new File(this.getClass().getClassLoader().getResource("org.mortbay.jetty.jar").getPath());
+
+ result = instance.insepct(file);
+ boolean found = false;
+ for (Evidence e : result.getTitleEvidence()) {
+ if (e.getName().equals("package-title") && e.getValue().equals("org.mortbay.http")) {
+ found = true;
+ break;
+ }
+ }
+ assertTrue("package-title of org.mortbay.http not found in org.mortbay.jetty.jar", found);
+
+ found = false;
+ for (Evidence e : result.getVendorEvidence()) {
+ if (e.getName().equals("implementation-url") && e.getValue().equals("http://jetty.mortbay.org")) {
+ found = true;
+ break;
+ }
+ }
+ assertTrue("implementation-url of http://jetty.mortbay.org not found in org.mortbay.jetty.jar", found);
+
+ found = false;
+ for (Evidence e : result.getVersionEvidence()) {
+ if (e.getName().equals("Implementation-Version") && e.getValue().equals("4.2.27")) {
+ found = true;
+ break;
+ }
+ }
+ assertTrue("implementation-version of 4.2.27 not found in org.mortbay.jetty.jar", found);
+
+ file = new File(this.getClass().getClassLoader().getResource("org.mortbay.jmx.jar").getPath());
+ result = instance.insepct(file);
+ assertEquals("org.mortbar,jmx.jar has version evidence?",result.getVersionEvidence().size(),0);
}
/**