diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/ComposerLockAnalyzer.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/ComposerLockAnalyzer.java index 6852413f5..5e8b4c3ec 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/ComposerLockAnalyzer.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/ComposerLockAnalyzer.java @@ -56,6 +56,11 @@ public class ComposerLockAnalyzer extends AbstractFileTypeAnalyzer { */ private static final String ANALYZER_NAME = "Composer.lock analyzer"; + /** + * The dependency Ecosystem + */ + static final String DEPENDENCY_ECOSYSTEM = "Composer"; + /** * composer.json. */ @@ -110,9 +115,12 @@ public class ComposerLockAnalyzer extends AbstractFileTypeAnalyzer { boolean processedAtLeastOneDep = false; for (ComposerDependency dep : clp.getDependencies()) { final Dependency d = new Dependency(dependency.getActualFile()); - d.setDisplayFileName(String.format("%s:%s/%s/%s", dependency.getDisplayFileName(), dep.getGroup(), dep.getProject(), dep.getVersion())); final String filePath = String.format("%s:%s/%s/%s", dependency.getFilePath(), dep.getGroup(), dep.getProject(), dep.getVersion()); - + d.setName(dep.getProject()); + d.setVersion(dep.getVersion()); + + d.setDependencyEcosystem(DEPENDENCY_ECOSYSTEM); + final MessageDigest sha1 = getSha1MessageDigest(); d.setFilePath(filePath); d.setSha1sum(Checksum.getHex(sha1.digest(filePath.getBytes(Charset.defaultCharset())))); diff --git a/dependency-check-core/src/test/java/org/owasp/dependencycheck/analyzer/ComposerLockAnalyzerTest.java b/dependency-check-core/src/test/java/org/owasp/dependencycheck/analyzer/ComposerLockAnalyzerTest.java index d94acfe37..95e7a1a18 100644 --- a/dependency-check-core/src/test/java/org/owasp/dependencycheck/analyzer/ComposerLockAnalyzerTest.java +++ b/dependency-check-core/src/test/java/org/owasp/dependencycheck/analyzer/ComposerLockAnalyzerTest.java @@ -126,7 +126,11 @@ public class ComposerLockAnalyzerTest extends BaseDBTestCase { //make sure the redundant composer.lock is removed assertFalse(engine.getDependencies().contains(result)); assertEquals(30,engine.getDependencies().size()); - assertThat(engine.getDependencies().get(0).getDisplayFileName(),equalTo("composer.lock:classpreloader/classpreloader/2.0.0")); + Dependency d = engine.getDependencies().get(0); + assertEquals("classpreloader",d.getName()); + assertEquals("2.0.0",d.getVersion()); + assertThat(d.getDisplayFileName(),equalTo("classpreloader:2.0.0")); + assertEquals(ComposerLockAnalyzer.DEPENDENCY_ECOSYSTEM,d.getDependencyEcosystem()); }