From 8c53925bd7b061cb7c60d21a36f57ed7e0be377d Mon Sep 17 00:00:00 2001 From: Jeremy Long Date: Sun, 26 Jan 2014 11:51:55 -0500 Subject: [PATCH] version 1.1.0 --- SampleReport.html | 2 +- .../apidocs/allclasses-frame.html | 6 +- .../apidocs/allclasses-noframe.html | 6 +- .../apidocs/constant-values.html | 8 +- .../apidocs/deprecated-list.html | 8 +- dependency-check-ant/apidocs/help-doc.html | 8 +- dependency-check-ant/apidocs/index-all.html | 70 +- dependency-check-ant/apidocs/index.html | 4 +- .../DependencyCheckTask.ReportFormats.html | 11 +- .../taskdefs/DependencyCheckTask.html | 265 +- .../DependencyCheckTask.ReportFormats.html | 8 +- .../class-use/DependencyCheckTask.html | 8 +- .../taskdefs/package-frame.html | 6 +- .../taskdefs/package-summary.html | 11 +- .../taskdefs/package-tree.html | 8 +- .../dependencycheck/taskdefs/package-use.html | 11 +- .../apidocs/overview-tree.html | 8 +- dependency-check-ant/checkstyle.html | 32 +- dependency-check-ant/checkstyle.rss | 4 +- ...es-org.owasp.dependencycheck.taskdefs.html | 2 +- .../cobertura/frame-sourcefiles.html | 2 +- ...ry-org.owasp.dependencycheck.taskdefs.html | 8 +- .../cobertura/frame-summary.html | 6 +- ...ncycheck.taskdefs.DependencyCheckTask.html | 1726 +++++---- dependency-check-ant/configuration.html | 73 +- dependency-check-ant/cpd.html | 10 +- .../dependency-updates-report.html | 48 +- dependency-check-ant/findbugs.html | 12 +- dependency-check-ant/index.html | 10 +- dependency-check-ant/installation.html | 12 +- dependency-check-ant/license.html | 888 +---- .../plugin-updates-report.html | 10 +- dependency-check-ant/pmd.html | 10 +- dependency-check-ant/project-info.html | 10 +- dependency-check-ant/project-reports.html | 10 +- dependency-check-ant/project-summary.html | 12 +- dependency-check-ant/surefire-report.html | 24 +- dependency-check-ant/taglist.html | 10 +- dependency-check-ant/usage.html | 10 +- dependency-check-ant/xref-test/index.html | 2 +- .../taskdefs/DependencyCheckTaskTest.html | 229 +- .../taskdefs/package-frame.html | 2 +- .../taskdefs/package-summary.html | 2 +- .../xref-test/overview-frame.html | 2 +- .../xref-test/overview-summary.html | 4 +- dependency-check-ant/xref/index.html | 2 +- .../taskdefs/DependencyCheckTask.html | 1378 ++++--- .../taskdefs/package-frame.html | 2 +- .../taskdefs/package-summary.html | 2 +- dependency-check-ant/xref/overview-frame.html | 2 +- .../xref/overview-summary.html | 4 +- .../apidocs/allclasses-frame.html | 6 +- .../apidocs/allclasses-noframe.html | 6 +- .../apidocs/constant-values.html | 103 +- .../apidocs/deprecated-list.html | 8 +- dependency-check-cli/apidocs/help-doc.html | 8 +- dependency-check-cli/apidocs/index-all.html | 136 +- dependency-check-cli/apidocs/index.html | 4 +- .../org/owasp/dependencycheck/App.html | 8 +- .../owasp/dependencycheck/class-use/App.html | 8 +- .../cli/CliParser.ArgumentName.html | 278 +- .../owasp/dependencycheck/cli/CliParser.html | 170 +- .../cli/class-use/CliParser.ArgumentName.html | 8 +- .../cli/class-use/CliParser.html | 8 +- .../dependencycheck/cli/package-frame.html | 6 +- .../dependencycheck/cli/package-summary.html | 11 +- .../dependencycheck/cli/package-tree.html | 8 +- .../dependencycheck/cli/package-use.html | 8 +- .../owasp/dependencycheck/package-frame.html | 6 +- .../dependencycheck/package-summary.html | 8 +- .../owasp/dependencycheck/package-tree.html | 8 +- .../owasp/dependencycheck/package-use.html | 8 +- .../apidocs/overview-frame.html | 6 +- .../apidocs/overview-summary.html | 10 +- .../apidocs/overview-tree.html | 8 +- dependency-check-cli/arguments.html | 120 +- dependency-check-cli/checkstyle.html | 48 +- dependency-check-cli/checkstyle.rss | 6 +- ...cefiles-org.owasp.dependencycheck.cli.html | 2 +- .../cobertura/frame-sourcefiles.html | 2 +- ...summary-org.owasp.dependencycheck.cli.html | 8 +- ...ame-summary-org.owasp.dependencycheck.html | 8 +- .../cobertura/frame-summary.html | 8 +- .../org.owasp.dependencycheck.App.html | 500 +-- ...g.owasp.dependencycheck.cli.CliParser.html | 1615 ++++---- dependency-check-cli/cpd.html | 10 +- .../dependency-updates-report.html | 14 +- dependency-check-cli/findbugs.html | 10 +- dependency-check-cli/index.html | 10 +- dependency-check-cli/installation.html | 33 +- dependency-check-cli/license.html | 888 +---- .../plugin-updates-report.html | 10 +- dependency-check-cli/pmd.html | 21 +- dependency-check-cli/project-info.html | 10 +- dependency-check-cli/project-reports.html | 10 +- dependency-check-cli/project-summary.html | 12 +- dependency-check-cli/surefire-report.html | 26 +- dependency-check-cli/taglist.html | 10 +- dependency-check-cli/xref-test/index.html | 2 +- .../dependencycheck/cli/CliParserTest.html | 518 ++- .../dependencycheck/cli/package-frame.html | 2 +- .../dependencycheck/cli/package-summary.html | 2 +- .../xref-test/overview-frame.html | 2 +- .../xref-test/overview-summary.html | 4 +- dependency-check-cli/xref/index.html | 2 +- .../xref/org/owasp/dependencycheck/App.html | 419 +- .../owasp/dependencycheck/cli/CliParser.html | 1237 +++--- .../dependencycheck/cli/package-frame.html | 2 +- .../dependencycheck/cli/package-summary.html | 2 +- .../owasp/dependencycheck/package-frame.html | 2 +- .../dependencycheck/package-summary.html | 2 +- dependency-check-cli/xref/overview-frame.html | 2 +- .../xref/overview-summary.html | 4 +- .../apidocs/allclasses-frame.html | 11 +- .../apidocs/allclasses-noframe.html | 11 +- .../apidocs/constant-values.html | 44 +- .../apidocs/deprecated-list.html | 35 +- dependency-check-core/apidocs/help-doc.html | 8 +- dependency-check-core/apidocs/index-all.html | 530 ++- dependency-check-core/apidocs/index.html | 4 +- .../org/owasp/dependencycheck/Engine.html | 32 +- .../analyzer/AbstractAnalyzer.html | 13 +- .../analyzer/AbstractSuppressionAnalyzer.html | 14 +- .../analyzer/AnalysisException.html | 8 +- .../analyzer/AnalysisPhase.html | 8 +- .../dependencycheck/analyzer/Analyzer.html | 63 +- .../analyzer/AnalyzerService.html | 8 +- .../analyzer/ArchiveAnalyzer.html | 27 +- .../analyzer/ArchiveExtractionException.html | 8 +- .../dependencycheck/analyzer/CPEAnalyzer.html | 75 +- .../analyzer/CpeSuppressionAnalyzer.html | 27 +- .../analyzer/DependencyBundlingAnalyzer.html | 32 +- .../analyzer/FalsePositiveAnalyzer.html | 29 +- .../analyzer/FileNameAnalyzer.html | 14 +- .../analyzer/HintAnalyzer.html | 22 +- .../JarAnalyzer.ClassNameInformation.html | 8 +- .../dependencycheck/analyzer/JarAnalyzer.html | 106 +- .../analyzer/JavaScriptAnalyzer.html | 25 +- .../analyzer/NexusAnalyzer.html | 23 +- .../analyzer/NvdCveAnalyzer.html | 25 +- .../VulnerabilitySuppressionAnalyzer.html | 27 +- .../analyzer/class-use/AbstractAnalyzer.html | 39 +- .../AbstractSuppressionAnalyzer.html | 14 +- .../analyzer/class-use/AnalysisException.html | 34 +- .../analyzer/class-use/AnalysisPhase.html | 8 +- .../analyzer/class-use/Analyzer.html | 51 +- .../analyzer/class-use/AnalyzerService.html | 8 +- .../analyzer/class-use/ArchiveAnalyzer.html | 8 +- .../class-use/ArchiveExtractionException.html | 8 +- .../analyzer/class-use/CPEAnalyzer.html | 8 +- .../class-use/CpeSuppressionAnalyzer.html | 8 +- .../class-use/DependencyBundlingAnalyzer.html | 8 +- .../class-use/FalsePositiveAnalyzer.html | 8 +- .../analyzer/class-use/FileNameAnalyzer.html | 8 +- .../analyzer/class-use/HintAnalyzer.html | 8 +- .../JarAnalyzer.ClassNameInformation.html | 20 +- .../analyzer/class-use/JarAnalyzer.html | 8 +- .../class-use/JavaScriptAnalyzer.html | 8 +- .../analyzer/class-use/NexusAnalyzer.html | 8 +- .../analyzer/class-use/NvdCveAnalyzer.html | 8 +- .../VulnerabilitySuppressionAnalyzer.html | 8 +- .../analyzer/package-frame.html | 6 +- .../analyzer/package-summary.html | 50 +- .../analyzer/package-tree.html | 12 +- .../dependencycheck/analyzer/package-use.html | 11 +- .../dependencycheck/class-use/Engine.html | 37 +- .../data/cpe/CpeMemoryIndex.html | 15 +- .../dependencycheck/data/cpe/Fields.html | 11 +- .../dependencycheck/data/cpe/IndexEntry.html | 28 +- .../data/cpe/IndexException.html | 8 +- .../data/cpe/class-use/CpeMemoryIndex.html | 8 +- .../data/cpe/class-use/Fields.html | 8 +- .../data/cpe/class-use/IndexEntry.html | 13 +- .../data/cpe/class-use/IndexException.html | 8 +- .../data/cpe/package-frame.html | 6 +- .../data/cpe/package-summary.html | 19 +- .../data/cpe/package-tree.html | 12 +- .../dependencycheck/data/cpe/package-use.html | 12 +- .../owasp/dependencycheck/data/cwe/CweDB.html | 14 +- .../dependencycheck/data/cwe/CweHandler.html | 8 +- .../data/cwe/class-use/CweDB.html | 8 +- .../data/cwe/class-use/CweHandler.html | 8 +- .../data/cwe/package-frame.html | 6 +- .../data/cwe/package-summary.html | 8 +- .../data/cwe/package-tree.html | 8 +- .../dependencycheck/data/cwe/package-use.html | 8 +- .../data/lucene/AbstractTokenizingFilter.html | 11 +- .../data/lucene/AlphaNumericTokenizer.html | 11 +- .../data/lucene/DependencySimilarity.html | 20 +- .../data/lucene/FieldAnalyzer.html | 14 +- .../data/lucene/LuceneUtils.html | 28 +- .../data/lucene/SearchFieldAnalyzer.html | 22 +- .../data/lucene/SearchVersionAnalyzer.html | 11 +- .../lucene/TokenPairConcatenatingFilter.html | 40 +- .../data/lucene/UrlTokenizingFilter.html | 26 +- .../data/lucene/VersionAnalyzer.html | 8 +- .../data/lucene/VersionTokenizingFilter.html | 26 +- .../class-use/AbstractTokenizingFilter.html | 12 +- .../class-use/AlphaNumericTokenizer.html | 8 +- .../class-use/DependencySimilarity.html | 8 +- .../data/lucene/class-use/FieldAnalyzer.html | 8 +- .../data/lucene/class-use/LuceneUtils.html | 8 +- .../lucene/class-use/SearchFieldAnalyzer.html | 8 +- .../class-use/SearchVersionAnalyzer.html | 8 +- .../TokenPairConcatenatingFilter.html | 8 +- .../lucene/class-use/UrlTokenizingFilter.html | 8 +- .../lucene/class-use/VersionAnalyzer.html | 8 +- .../class-use/VersionTokenizingFilter.html | 8 +- .../data/lucene/package-frame.html | 6 +- .../data/lucene/package-summary.html | 30 +- .../data/lucene/package-tree.html | 8 +- .../data/lucene/package-use.html | 11 +- .../data/nexus/MavenArtifact.html | 8 +- .../data/nexus/NexusSearch.html | 24 +- .../data/nexus/class-use/MavenArtifact.html | 19 +- .../data/nexus/class-use/NexusSearch.html | 8 +- .../data/nexus/package-frame.html | 6 +- .../data/nexus/package-summary.html | 31 +- .../data/nexus/package-tree.html | 8 +- .../data/nexus/package-use.html | 16 +- .../data/nvdcve/ConnectionFactory.html | 8 +- .../dependencycheck/data/nvdcve/CveDB.html | 8 +- .../data/nvdcve/DatabaseException.html | 8 +- .../data/nvdcve/DatabaseProperties.html | 79 +- .../data/nvdcve/DriverLoadException.html | 8 +- .../data/nvdcve/DriverLoader.html | 8 +- .../nvdcve/class-use/ConnectionFactory.html | 8 +- .../data/nvdcve/class-use/CveDB.html | 8 +- .../nvdcve/class-use/DatabaseException.html | 8 +- .../nvdcve/class-use/DatabaseProperties.html | 40 +- .../nvdcve/class-use/DriverLoadException.html | 8 +- .../data/nvdcve/class-use/DriverLoader.html | 8 +- .../data/nvdcve/package-frame.html | 6 +- .../data/nvdcve/package-summary.html | 8 +- .../data/nvdcve/package-tree.html | 8 +- .../data/nvdcve/package-use.html | 36 +- .../data/update/CachedWebDataSource.html | 25 +- .../data/update/NvdCveInfo.html | 8 +- .../data/update/NvdCveUpdater.html | 19 +- .../data/update/StandardUpdate.html | 51 +- .../data/update/UpdateService.html | 14 +- .../data/update/UpdateableNvdCve.html | 62 +- .../update/class-use/CachedWebDataSource.html | 11 +- .../data/update/class-use/NvdCveInfo.html | 17 +- .../data/update/class-use/NvdCveUpdater.html | 8 +- .../data/update/class-use/StandardUpdate.html | 8 +- .../data/update/class-use/UpdateService.html | 8 +- .../update/class-use/UpdateableNvdCve.html | 8 +- .../exception/InvalidDataException.html | 11 +- .../update/exception/UpdateException.html | 8 +- .../class-use/InvalidDataException.html | 8 +- .../exception/class-use/UpdateException.html | 24 +- .../data/update/exception/package-frame.html | 6 +- .../update/exception/package-summary.html | 11 +- .../data/update/exception/package-tree.html | 8 +- .../data/update/exception/package-use.html | 8 +- .../data/update/package-frame.html | 6 +- .../data/update/package-summary.html | 8 +- .../data/update/package-tree.html | 8 +- .../data/update/package-use.html | 8 +- .../update/task/CallableDownloadTask.html | 8 +- .../data/update/task/ProcessTask.html | 24 +- .../task/class-use/CallableDownloadTask.html | 8 +- .../update/task/class-use/ProcessTask.html | 8 +- .../data/update/task/package-frame.html | 6 +- .../data/update/task/package-summary.html | 11 +- .../data/update/task/package-tree.html | 8 +- .../data/update/task/package-use.html | 11 +- .../update/xml/NvdCve12Handler.Element.html | 11 +- .../data/update/xml/NvdCve12Handler.html | 19 +- .../update/xml/NvdCve20Handler.Element.html | 11 +- .../data/update/xml/NvdCve20Handler.html | 14 +- .../class-use/NvdCve12Handler.Element.html | 8 +- .../update/xml/class-use/NvdCve12Handler.html | 8 +- .../class-use/NvdCve20Handler.Element.html | 8 +- .../update/xml/class-use/NvdCve20Handler.html | 8 +- .../data/update/xml/package-frame.html | 6 +- .../data/update/xml/package-summary.html | 14 +- .../data/update/xml/package-tree.html | 8 +- .../data/update/xml/package-use.html | 8 +- .../dependency/Confidence.html | 362 ++ .../dependency/Dependency.html | 140 +- .../dependencycheck/dependency/Evidence.html | 61 +- .../dependency/EvidenceCollection.html | 83 +- .../dependency/Identifier.html | 60 +- .../dependencycheck/dependency/Reference.html | 11 +- .../dependency/Vulnerability.html | 104 +- .../dependency/VulnerabilityComparator.html | 8 +- .../dependency/VulnerableSoftware.html | 39 +- .../dependency/class-use/Confidence.html | 252 ++ .../dependency/class-use/Dependency.html | 53 +- .../dependency/class-use/Evidence.html | 10 +- .../class-use/EvidenceCollection.html | 14 +- .../dependency/class-use/Identifier.html | 11 +- .../dependency/class-use/Reference.html | 8 +- .../dependency/class-use/Vulnerability.html | 8 +- .../class-use/VulnerabilityComparator.html | 8 +- .../class-use/VulnerableSoftware.html | 8 +- .../dependency/package-frame.html | 8 +- .../dependency/package-summary.html | 12 +- .../dependency/package-tree.html | 10 +- .../dependency/package-use.html | 20 +- .../exception/NoDataException.html | 8 +- .../exception/class-use/NoDataException.html | 8 +- .../exception/package-frame.html | 6 +- .../exception/package-summary.html | 8 +- .../exception/package-tree.html | 8 +- .../exception/package-use.html | 8 +- .../jaxb/pom/MavenNamespaceFilter.html | 14 +- .../pom/class-use/MavenNamespaceFilter.html | 8 +- .../jaxb/pom/generated/Activation.html | 8 +- .../jaxb/pom/generated/ActivationFile.html | 8 +- .../jaxb/pom/generated/ActivationOS.html | 8 +- .../pom/generated/ActivationProperty.html | 8 +- .../jaxb/pom/generated/Build.Extensions.html | 8 +- .../jaxb/pom/generated/Build.Filters.html | 8 +- .../jaxb/pom/generated/Build.Plugins.html | 8 +- .../jaxb/pom/generated/Build.Resources.html | 8 +- .../pom/generated/Build.TestResources.html | 8 +- .../jaxb/pom/generated/Build.html | 8 +- .../jaxb/pom/generated/BuildBase.Filters.html | 8 +- .../jaxb/pom/generated/BuildBase.Plugins.html | 8 +- .../pom/generated/BuildBase.Resources.html | 8 +- .../generated/BuildBase.TestResources.html | 8 +- .../jaxb/pom/generated/BuildBase.html | 8 +- .../pom/generated/CiManagement.Notifiers.html | 8 +- .../jaxb/pom/generated/CiManagement.html | 8 +- .../pom/generated/Contributor.Properties.html | 8 +- .../jaxb/pom/generated/Contributor.Roles.html | 8 +- .../jaxb/pom/generated/Contributor.html | 8 +- .../pom/generated/Dependency.Exclusions.html | 8 +- .../jaxb/pom/generated/Dependency.html | 8 +- .../DependencyManagement.Dependencies.html | 8 +- .../pom/generated/DependencyManagement.html | 8 +- .../pom/generated/DeploymentRepository.html | 8 +- .../pom/generated/Developer.Properties.html | 8 +- .../jaxb/pom/generated/Developer.Roles.html | 8 +- .../jaxb/pom/generated/Developer.html | 8 +- .../pom/generated/DistributionManagement.html | 8 +- .../jaxb/pom/generated/Exclusion.html | 8 +- .../jaxb/pom/generated/Extension.html | 8 +- .../jaxb/pom/generated/IssueManagement.html | 8 +- .../jaxb/pom/generated/License.html | 8 +- .../generated/MailingList.OtherArchives.html | 8 +- .../jaxb/pom/generated/MailingList.html | 8 +- .../pom/generated/Model.Contributors.html | 8 +- .../pom/generated/Model.Dependencies.html | 8 +- .../jaxb/pom/generated/Model.Developers.html | 8 +- .../jaxb/pom/generated/Model.Licenses.html | 8 +- .../pom/generated/Model.MailingLists.html | 8 +- .../jaxb/pom/generated/Model.Modules.html | 8 +- .../generated/Model.PluginRepositories.html | 8 +- .../jaxb/pom/generated/Model.Profiles.html | 8 +- .../jaxb/pom/generated/Model.Properties.html | 8 +- .../jaxb/pom/generated/Model.Reports.html | 8 +- .../pom/generated/Model.Repositories.html | 8 +- .../jaxb/pom/generated/Model.html | 8 +- .../pom/generated/Notifier.Configuration.html | 8 +- .../jaxb/pom/generated/Notifier.html | 8 +- .../jaxb/pom/generated/ObjectFactory.html | 8 +- .../jaxb/pom/generated/Organization.html | 8 +- .../jaxb/pom/generated/Parent.html | 8 +- .../pom/generated/Plugin.Configuration.html | 8 +- .../pom/generated/Plugin.Dependencies.html | 8 +- .../jaxb/pom/generated/Plugin.Executions.html | 8 +- .../jaxb/pom/generated/Plugin.Goals.html | 8 +- .../jaxb/pom/generated/Plugin.html | 8 +- .../PluginExecution.Configuration.html | 8 +- .../pom/generated/PluginExecution.Goals.html | 8 +- .../jaxb/pom/generated/PluginExecution.html | 8 +- .../generated/PluginManagement.Plugins.html | 8 +- .../jaxb/pom/generated/PluginManagement.html | 8 +- .../jaxb/pom/generated/Prerequisites.html | 8 +- .../pom/generated/Profile.Dependencies.html | 8 +- .../jaxb/pom/generated/Profile.Modules.html | 8 +- .../generated/Profile.PluginRepositories.html | 8 +- .../pom/generated/Profile.Properties.html | 8 +- .../jaxb/pom/generated/Profile.Reports.html | 8 +- .../pom/generated/Profile.Repositories.html | 8 +- .../jaxb/pom/generated/Profile.html | 8 +- .../jaxb/pom/generated/Relocation.html | 8 +- .../generated/ReportPlugin.Configuration.html | 8 +- .../generated/ReportPlugin.ReportSets.html | 8 +- .../jaxb/pom/generated/ReportPlugin.html | 8 +- .../generated/ReportSet.Configuration.html | 8 +- .../jaxb/pom/generated/ReportSet.Reports.html | 8 +- .../jaxb/pom/generated/ReportSet.html | 8 +- .../jaxb/pom/generated/Reporting.Plugins.html | 8 +- .../jaxb/pom/generated/Reporting.html | 8 +- .../jaxb/pom/generated/Repository.html | 8 +- .../jaxb/pom/generated/RepositoryPolicy.html | 8 +- .../jaxb/pom/generated/Resource.Excludes.html | 8 +- .../jaxb/pom/generated/Resource.Includes.html | 8 +- .../jaxb/pom/generated/Resource.html | 8 +- .../jaxb/pom/generated/Scm.html | 8 +- .../jaxb/pom/generated/Site.html | 8 +- .../pom/generated/class-use/Activation.html | 8 +- .../generated/class-use/ActivationFile.html | 8 +- .../pom/generated/class-use/ActivationOS.html | 8 +- .../class-use/ActivationProperty.html | 8 +- .../generated/class-use/Build.Extensions.html | 8 +- .../generated/class-use/Build.Filters.html | 8 +- .../generated/class-use/Build.Plugins.html | 8 +- .../generated/class-use/Build.Resources.html | 8 +- .../class-use/Build.TestResources.html | 8 +- .../jaxb/pom/generated/class-use/Build.html | 8 +- .../class-use/BuildBase.Filters.html | 8 +- .../class-use/BuildBase.Plugins.html | 8 +- .../class-use/BuildBase.Resources.html | 8 +- .../class-use/BuildBase.TestResources.html | 8 +- .../pom/generated/class-use/BuildBase.html | 8 +- .../class-use/CiManagement.Notifiers.html | 8 +- .../pom/generated/class-use/CiManagement.html | 8 +- .../class-use/Contributor.Properties.html | 8 +- .../class-use/Contributor.Roles.html | 8 +- .../pom/generated/class-use/Contributor.html | 8 +- .../class-use/Dependency.Exclusions.html | 8 +- .../pom/generated/class-use/Dependency.html | 8 +- .../DependencyManagement.Dependencies.html | 8 +- .../class-use/DependencyManagement.html | 8 +- .../class-use/DeploymentRepository.html | 8 +- .../class-use/Developer.Properties.html | 8 +- .../generated/class-use/Developer.Roles.html | 8 +- .../pom/generated/class-use/Developer.html | 8 +- .../class-use/DistributionManagement.html | 8 +- .../pom/generated/class-use/Exclusion.html | 8 +- .../pom/generated/class-use/Extension.html | 8 +- .../generated/class-use/IssueManagement.html | 8 +- .../jaxb/pom/generated/class-use/License.html | 8 +- .../class-use/MailingList.OtherArchives.html | 8 +- .../pom/generated/class-use/MailingList.html | 8 +- .../class-use/Model.Contributors.html | 8 +- .../class-use/Model.Dependencies.html | 8 +- .../generated/class-use/Model.Developers.html | 8 +- .../generated/class-use/Model.Licenses.html | 8 +- .../class-use/Model.MailingLists.html | 8 +- .../generated/class-use/Model.Modules.html | 8 +- .../class-use/Model.PluginRepositories.html | 8 +- .../generated/class-use/Model.Profiles.html | 8 +- .../generated/class-use/Model.Properties.html | 8 +- .../generated/class-use/Model.Reports.html | 8 +- .../class-use/Model.Repositories.html | 8 +- .../jaxb/pom/generated/class-use/Model.html | 8 +- .../class-use/Notifier.Configuration.html | 8 +- .../pom/generated/class-use/Notifier.html | 8 +- .../generated/class-use/ObjectFactory.html | 8 +- .../pom/generated/class-use/Organization.html | 8 +- .../jaxb/pom/generated/class-use/Parent.html | 8 +- .../class-use/Plugin.Configuration.html | 8 +- .../class-use/Plugin.Dependencies.html | 8 +- .../class-use/Plugin.Executions.html | 8 +- .../pom/generated/class-use/Plugin.Goals.html | 8 +- .../jaxb/pom/generated/class-use/Plugin.html | 8 +- .../PluginExecution.Configuration.html | 8 +- .../class-use/PluginExecution.Goals.html | 8 +- .../generated/class-use/PluginExecution.html | 8 +- .../class-use/PluginManagement.Plugins.html | 8 +- .../generated/class-use/PluginManagement.html | 8 +- .../generated/class-use/Prerequisites.html | 8 +- .../class-use/Profile.Dependencies.html | 8 +- .../generated/class-use/Profile.Modules.html | 8 +- .../class-use/Profile.PluginRepositories.html | 8 +- .../class-use/Profile.Properties.html | 8 +- .../generated/class-use/Profile.Reports.html | 8 +- .../class-use/Profile.Repositories.html | 8 +- .../jaxb/pom/generated/class-use/Profile.html | 8 +- .../pom/generated/class-use/Relocation.html | 8 +- .../class-use/ReportPlugin.Configuration.html | 8 +- .../class-use/ReportPlugin.ReportSets.html | 8 +- .../pom/generated/class-use/ReportPlugin.html | 8 +- .../class-use/ReportSet.Configuration.html | 8 +- .../class-use/ReportSet.Reports.html | 8 +- .../pom/generated/class-use/ReportSet.html | 8 +- .../class-use/Reporting.Plugins.html | 8 +- .../pom/generated/class-use/Reporting.html | 8 +- .../pom/generated/class-use/Repository.html | 8 +- .../generated/class-use/RepositoryPolicy.html | 8 +- .../class-use/Resource.Excludes.html | 8 +- .../class-use/Resource.Includes.html | 8 +- .../pom/generated/class-use/Resource.html | 8 +- .../jaxb/pom/generated/class-use/Scm.html | 8 +- .../jaxb/pom/generated/class-use/Site.html | 8 +- .../jaxb/pom/generated/package-frame.html | 6 +- .../jaxb/pom/generated/package-summary.html | 8 +- .../jaxb/pom/generated/package-tree.html | 8 +- .../jaxb/pom/generated/package-use.html | 8 +- .../jaxb/pom/package-frame.html | 6 +- .../jaxb/pom/package-summary.html | 8 +- .../jaxb/pom/package-tree.html | 8 +- .../dependencycheck/jaxb/pom/package-use.html | 8 +- .../owasp/dependencycheck/package-frame.html | 6 +- .../dependencycheck/package-summary.html | 8 +- .../owasp/dependencycheck/package-tree.html | 8 +- .../owasp/dependencycheck/package-use.html | 8 +- .../reporting/ReportGenerator.Format.html | 8 +- .../reporting/ReportGenerator.html | 34 +- .../reporting/VelocityLoggerRedirect.html | 42 +- .../class-use/ReportGenerator.Format.html | 8 +- .../reporting/class-use/ReportGenerator.html | 8 +- .../class-use/VelocityLoggerRedirect.html | 8 +- .../reporting/package-frame.html | 6 +- .../reporting/package-summary.html | 14 +- .../reporting/package-tree.html | 8 +- .../reporting/package-use.html | 8 +- .../suppression/PropertyType.html | 19 +- .../suppression/SuppressionErrorHandler.html | 8 +- .../suppression/SuppressionHandler.html | 8 +- .../SuppressionParseException.html | 8 +- .../suppression/SuppressionParser.html | 8 +- .../suppression/SuppressionRule.html | 16 +- .../suppression/class-use/PropertyType.html | 8 +- .../class-use/SuppressionErrorHandler.html | 8 +- .../class-use/SuppressionHandler.html | 8 +- .../class-use/SuppressionParseException.html | 8 +- .../class-use/SuppressionParser.html | 8 +- .../class-use/SuppressionRule.html | 8 +- .../suppression/package-frame.html | 6 +- .../suppression/package-summary.html | 12 +- .../suppression/package-tree.html | 8 +- .../suppression/package-use.html | 12 +- .../owasp/dependencycheck/utils/Checksum.html | 8 +- .../owasp/dependencycheck/utils/DBUtils.html | 17 +- .../utils/DependencyVersion.html | 38 +- .../utils/DependencyVersionUtil.html | 20 +- .../utils/DownloadFailedException.html | 8 +- .../dependencycheck/utils/Downloader.html | 22 +- .../utils/ExtractionException.html | 8 +- .../dependencycheck/utils/FileUtils.html | 48 +- .../owasp/dependencycheck/utils/Filter.html | 8 +- .../utils/InvalidSettingException.html | 8 +- .../dependencycheck/utils/LogFilter.html | 13 +- .../owasp/dependencycheck/utils/LogUtils.html | 8 +- .../utils/NonClosingStream.html | 13 +- .../dependencycheck/utils/Settings.KEYS.html | 62 +- .../owasp/dependencycheck/utils/Settings.html | 120 +- .../dependencycheck/utils/UrlStringUtils.html | 26 +- .../utils/class-use/Checksum.html | 8 +- .../utils/class-use/DBUtils.html | 8 +- .../utils/class-use/DependencyVersion.html | 15 +- .../class-use/DependencyVersionUtil.html | 8 +- .../class-use/DownloadFailedException.html | 11 +- .../utils/class-use/Downloader.html | 8 +- .../utils/class-use/ExtractionException.html | 8 +- .../utils/class-use/FileUtils.html | 8 +- .../utils/class-use/Filter.html | 8 +- .../class-use/InvalidSettingException.html | 8 +- .../utils/class-use/LogFilter.html | 8 +- .../utils/class-use/LogUtils.html | 8 +- .../utils/class-use/NonClosingStream.html | 8 +- .../utils/class-use/Settings.KEYS.html | 8 +- .../utils/class-use/Settings.html | 8 +- .../utils/class-use/UrlStringUtils.html | 8 +- .../dependencycheck/utils/package-frame.html | 6 +- .../utils/package-summary.html | 18 +- .../dependencycheck/utils/package-tree.html | 8 +- .../dependencycheck/utils/package-use.html | 14 +- .../apidocs/overview-frame.html | 7 +- .../apidocs/overview-summary.html | 61 +- .../apidocs/overview-tree.html | 14 +- dependency-check-core/apidocs/package-list | 1 - .../apidocs/serialized-form.html | 43 +- dependency-check-core/checkstyle.html | 75 +- dependency-check-core/checkstyle.rss | 358 +- .../cobertura/frame-packages.html | 3 - ...es-org.owasp.dependencycheck.analyzer.html | 10 +- ...-org.owasp.dependencycheck.data.nexus.html | 4 +- ...org.owasp.dependencycheck.data.nvdcve.html | 6 +- ...-org.owasp.dependencycheck.dependency.html | 11 +- ...sourcefiles-org.owasp.dependencycheck.html | 2 +- ...es-org.owasp.dependencycheck.jaxb.pom.html | 2 +- ...s-org.owasp.dependencycheck.reporting.html | 2 +- ...files-org.owasp.dependencycheck.utils.html | 2 +- .../cobertura/frame-sourcefiles.html | 48 +- ...ry-org.owasp.dependencycheck.analyzer.html | 26 +- ...ry-org.owasp.dependencycheck.data.cpe.html | 2 +- ...ry-org.owasp.dependencycheck.data.cwe.html | 2 +- ...org.owasp.dependencycheck.data.lucene.html | 2 +- ...-org.owasp.dependencycheck.data.nexus.html | 8 +- ...org.owasp.dependencycheck.data.nvdcve.html | 10 +- ...dependencycheck.data.update.exception.html | 2 +- ...org.owasp.dependencycheck.data.update.html | 2 +- ...wasp.dependencycheck.data.update.task.html | 2 +- ...owasp.dependencycheck.data.update.xml.html | 2 +- ...-org.owasp.dependencycheck.dependency.html | 13 +- ...y-org.owasp.dependencycheck.exception.html | 2 +- ...ame-summary-org.owasp.dependencycheck.html | 21 +- ...sp.dependencycheck.jaxb.pom.generated.html | 2 +- ...ry-org.owasp.dependencycheck.jaxb.pom.html | 6 +- ...y-org.owasp.dependencycheck.reporting.html | 8 +- ...org.owasp.dependencycheck.suppression.html | 2 +- ...mmary-org.owasp.dependencycheck.utils.html | 6 +- .../cobertura/frame-summary.html | 21 +- .../org.owasp.dependencycheck.Engine.html | 920 +++-- ...ndencycheck.analyzer.AbstractAnalyzer.html | 134 +- ....analyzer.AbstractSuppressionAnalyzer.html | 228 +- ...dencycheck.analyzer.AnalysisException.html | 128 +- ...ependencycheck.analyzer.AnalysisPhase.html | 122 +- ...asp.dependencycheck.analyzer.Analyzer.html | 226 +- ...endencycheck.analyzer.AnalyzerService.html | 126 +- ...endencycheck.analyzer.ArchiveAnalyzer.html | 809 ++-- ...k.analyzer.ArchiveExtractionException.html | 128 +- ....dependencycheck.analyzer.CPEAnalyzer.html | 1812 +++++---- ...check.analyzer.CpeSuppressionAnalyzer.html | 152 +- ...k.analyzer.DependencyBundlingAnalyzer.html | 900 +++-- ...ycheck.analyzer.FalsePositiveAnalyzer.html | 808 ++-- ...ndencycheck.analyzer.FileNameAnalyzer.html | 294 +- ...dependencycheck.analyzer.HintAnalyzer.html | 208 +- ....dependencycheck.analyzer.JarAnalyzer.html | 3353 +++++++++-------- ...encycheck.analyzer.JavaScriptAnalyzer.html | 272 +- ...ependencycheck.analyzer.NexusAnalyzer.html | 395 +- ...pendencycheck.analyzer.NvdCveAnalyzer.html | 342 +- ...yzer.VulnerabilitySuppressionAnalyzer.html | 152 +- ...pendencycheck.data.cpe.CpeMemoryIndex.html | 656 ++-- ...owasp.dependencycheck.data.cpe.Fields.html | 82 +- ...p.dependencycheck.data.cpe.IndexEntry.html | 416 +- ...pendencycheck.data.cpe.IndexException.html | 128 +- ....owasp.dependencycheck.data.cwe.CweDB.html | 152 +- ...p.dependencycheck.data.cwe.CweHandler.html | 106 +- ....data.lucene.AbstractTokenizingFilter.html | 174 +- ...eck.data.lucene.AlphaNumericTokenizer.html | 126 +- ...heck.data.lucene.DependencySimilarity.html | 94 +- ...ndencycheck.data.lucene.FieldAnalyzer.html | 156 +- ...pendencycheck.data.lucene.LuceneUtils.html | 218 +- ...check.data.lucene.SearchFieldAnalyzer.html | 184 +- ...eck.data.lucene.SearchVersionAnalyzer.html | 146 +- ...a.lucene.TokenPairConcatenatingFilter.html | 246 +- ...check.data.lucene.UrlTokenizingFilter.html | 164 +- ...encycheck.data.lucene.VersionAnalyzer.html | 138 +- ...k.data.lucene.VersionTokenizingFilter.html | 194 +- ...endencycheck.data.nexus.MavenArtifact.html | 361 +- ...ependencycheck.data.nexus.NexusSearch.html | 176 +- ...cycheck.data.nvdcve.ConnectionFactory.html | 598 +-- ....data.nvdcve.CorruptDatabaseException.html | 98 +- ...asp.dependencycheck.data.nvdcve.CveDB.html | 1666 ++++---- ...cycheck.data.nvdcve.DatabaseException.html | 114 +- ...ycheck.data.nvdcve.DatabaseProperties.html | 338 +- ...check.data.nvdcve.DriverLoadException.html | 114 +- ...endencycheck.data.nvdcve.DriverLoader.html | 250 +- ...ependencycheck.data.nvdcve.DriverShim.html | 354 +- ...check.data.update.CachedWebDataSource.html | 76 +- ...ependencycheck.data.update.NvdCveInfo.html | 270 +- ...ndencycheck.data.update.NvdCveUpdater.html | 112 +- ...dencycheck.data.update.StandardUpdate.html | 746 ++-- ...ndencycheck.data.update.UpdateService.html | 128 +- ...ncycheck.data.update.UpdateableNvdCve.html | 396 +- ...update.exception.InvalidDataException.html | 102 +- ...data.update.exception.UpdateException.html | 132 +- ...data.update.task.CallableDownloadTask.html | 456 ++- ...ncycheck.data.update.task.ProcessTask.html | 372 +- ...check.data.update.xml.NvdCve12Handler.html | 476 ++- ...check.data.update.xml.NvdCve20Handler.html | 1002 +++-- ...dependencycheck.dependency.Confidence.html | 105 + ...dependencycheck.dependency.Dependency.html | 1397 +++---- ...p.dependencycheck.dependency.Evidence.html | 576 ++- ...cycheck.dependency.EvidenceCollection.html | 856 ++--- ...dependencycheck.dependency.Identifier.html | 445 ++- ....dependencycheck.dependency.Reference.html | 318 +- ...endencycheck.dependency.Vulnerability.html | 922 +++-- ...ck.dependency.VulnerabilityComparator.html | 86 +- ...cycheck.dependency.VulnerableSoftware.html | 638 ++-- ...ndencycheck.exception.NoDataException.html | 132 +- ...cycheck.jaxb.pom.MavenNamespaceFilter.html | 188 +- ...cycheck.jaxb.pom.generated.Activation.html | 4 +- ...eck.jaxb.pom.generated.ActivationFile.html | 2 +- ...check.jaxb.pom.generated.ActivationOS.html | 2 +- ...jaxb.pom.generated.ActivationProperty.html | 4 +- ...endencycheck.jaxb.pom.generated.Build.html | 14 +- ...ncycheck.jaxb.pom.generated.BuildBase.html | 8 +- ...check.jaxb.pom.generated.CiManagement.html | 2 +- ...ycheck.jaxb.pom.generated.Contributor.html | 6 +- ...cycheck.jaxb.pom.generated.Dependency.html | 8 +- ...xb.pom.generated.DependencyManagement.html | 2 +- ...xb.pom.generated.DeploymentRepository.html | 4 +- ...ncycheck.jaxb.pom.generated.Developer.html | 6 +- ....pom.generated.DistributionManagement.html | 4 +- ...ncycheck.jaxb.pom.generated.Exclusion.html | 4 +- ...ncycheck.jaxb.pom.generated.Extension.html | 2 +- ...ck.jaxb.pom.generated.IssueManagement.html | 4 +- ...dencycheck.jaxb.pom.generated.License.html | 8 +- ...ycheck.jaxb.pom.generated.MailingList.html | 2 +- ...endencycheck.jaxb.pom.generated.Model.html | 40 +- ...encycheck.jaxb.pom.generated.Notifier.html | 2 +- ...heck.jaxb.pom.generated.ObjectFactory.html | 2 +- ...check.jaxb.pom.generated.Organization.html | 2 +- ...ndencycheck.jaxb.pom.generated.Parent.html | 4 +- ...ndencycheck.jaxb.pom.generated.Plugin.html | 10 +- ...ck.jaxb.pom.generated.PluginExecution.html | 10 +- ...k.jaxb.pom.generated.PluginManagement.html | 2 +- ...heck.jaxb.pom.generated.Prerequisites.html | 2 +- ...dencycheck.jaxb.pom.generated.Profile.html | 8 +- ...cycheck.jaxb.pom.generated.Relocation.html | 2 +- ...check.jaxb.pom.generated.ReportPlugin.html | 10 +- ...ncycheck.jaxb.pom.generated.ReportSet.html | 8 +- ...ncycheck.jaxb.pom.generated.Reporting.html | 8 +- ...cycheck.jaxb.pom.generated.Repository.html | 4 +- ...k.jaxb.pom.generated.RepositoryPolicy.html | 4 +- ...encycheck.jaxb.pom.generated.Resource.html | 10 +- ...ependencycheck.jaxb.pom.generated.Scm.html | 4 +- ...pendencycheck.jaxb.pom.generated.Site.html | 4 +- ...check.jaxb.pom.generated.package-info.html | 2 +- ...ndencycheck.reporting.ReportGenerator.html | 458 ++- ...heck.reporting.VelocityLoggerRedirect.html | 238 +- ...endencycheck.suppression.PropertyType.html | 360 +- ...k.suppression.SuppressionErrorHandler.html | 180 +- ...ycheck.suppression.SuppressionHandler.html | 342 +- ...suppression.SuppressionParseException.html | 132 +- ...cycheck.suppression.SuppressionParser.html | 198 +- ...encycheck.suppression.SuppressionRule.html | 736 ++-- ....owasp.dependencycheck.utils.Checksum.html | 44 +- ...g.owasp.dependencycheck.utils.DBUtils.html | 192 +- ...pendencycheck.utils.DependencyVersion.html | 526 ++- ...encycheck.utils.DependencyVersionUtil.html | 188 +- ...cycheck.utils.DownloadFailedException.html | 132 +- ...wasp.dependencycheck.utils.Downloader.html | 456 ++- ...ndencycheck.utils.ExtractionException.html | 132 +- ...owasp.dependencycheck.utils.FileUtils.html | 486 ++- ...rg.owasp.dependencycheck.utils.Filter.html | 46 +- ...cycheck.utils.InvalidSettingException.html | 132 +- ...owasp.dependencycheck.utils.LogFilter.html | 82 +- ....owasp.dependencycheck.utils.LogUtils.html | 172 +- ...ependencycheck.utils.NonClosingStream.html | 94 +- ....owasp.dependencycheck.utils.Settings.html | 1048 +++--- ....dependencycheck.utils.UrlStringUtils.html | 188 +- dependency-check-core/cpd.html | 106 +- .../dependency-updates-report.html | 25 +- dependency-check-core/failsafe-report.html | 51 +- dependency-check-core/findbugs.html | 99 +- dependency-check-core/index.html | 12 +- dependency-check-core/javancss.html | 1083 ++++++ dependency-check-core/license.html | 890 +---- .../plugin-updates-report.html | 19 +- dependency-check-core/pmd.html | 182 +- dependency-check-core/project-info.html | 14 +- dependency-check-core/project-reports.html | 24 +- dependency-check-core/project-summary.html | 16 +- dependency-check-core/surefire-report.html | 331 +- dependency-check-core/taglist.html | 112 +- .../xref-test/allclasses-frame.html | 12 +- dependency-check-core/xref-test/index.html | 2 +- .../EngineIntegrationTest.html | 64 +- .../analyzer/AbstractAnalyzerTest.html | 117 +- .../analyzer/AnalyzerServiceTest.html | 139 +- .../analyzer/ArchiveAnalyzerTest.html | 514 +-- .../analyzer/CPEAnalyzerTest.html | 465 ++- .../DependencyBundlingAnalyzerTest.html | 148 + .../analyzer/FalsePositiveAnalyzerTest.html | 129 + .../analyzer/FileNameAnalyzerTest.html | 270 +- .../analyzer/JarAnalyzerTest.html | 313 +- .../analyzer/package-frame.html | 8 +- .../analyzer/package-summary.html | 12 +- .../data/cpe/BaseIndexTestCase.html | 101 +- .../data/cpe/IndexEntryTest.html | 134 +- .../data/cpe/package-frame.html | 2 +- .../data/cpe/package-summary.html | 2 +- .../dependencycheck/data/cwe/CweDBTest.html | 160 +- .../data/cwe/package-frame.html | 2 +- .../data/cwe/package-summary.html | 2 +- .../data/lucene/FieldAnalyzerTest.html | 244 +- .../data/lucene/LuceneUtilsTest.html | 182 +- .../TokenPairConcatenatingFilterTest.html | 149 +- .../data/lucene/UrlTokenizingFilterTest.html | 191 +- .../data/lucene/package-frame.html | 2 +- .../data/lucene/package-summary.html | 2 +- .../data/nexus/NexusSearchTest.html | 123 +- .../data/nexus/package-frame.html | 2 +- .../data/nexus/package-summary.html | 2 +- .../data/nvdcve/BaseDBTestCase.html | 223 +- .../data/nvdcve/CveDBMySQLTest.html | 205 +- .../data/nvdcve/CveDBTest.html | 192 +- .../data/nvdcve/DatabasePropertiesTest.html | 237 +- .../data/nvdcve/DriverLoaderTest.html | 255 +- .../data/nvdcve/package-frame.html | 2 +- .../data/nvdcve/package-summary.html | 2 +- .../data/update/NvdCveInfoTest.html | 213 +- .../update/NvdCveUpdaterIntegrationTest.html | 113 +- .../update/StandardUpdateIntegrationTest.html | 219 +- .../data/update/UpdateableNvdCveTest.html | 315 +- .../data/update/package-frame.html | 2 +- .../data/update/package-summary.html | 2 +- .../update/xml/NvdCve_1_2_HandlerTest.html | 134 +- .../update/xml/NvdCve_2_0_HandlerTest.html | 144 +- .../data/update/xml/package-frame.html | 2 +- .../data/update/xml/package-summary.html | 2 +- .../dependency/DependencyTest.html | 574 ++- .../dependency/VulnerableSoftwareTest.html | 171 +- .../dependency/package-frame.html | 2 +- .../dependency/package-summary.html | 2 +- .../owasp/dependencycheck/package-frame.html | 2 +- .../dependencycheck/package-summary.html | 2 +- .../reporting/ReportGeneratorTest.html | 140 +- .../reporting/package-frame.html | 2 +- .../reporting/package-summary.html | 2 +- .../suppression/PropertyTypeTest.html | 211 +- .../suppression/SuppressionHandlerTest.html | 183 +- .../suppression/SuppressionParserTest.html | 119 +- .../suppression/SuppressionRuleTest.html | 937 ++--- .../suppression/package-frame.html | 2 +- .../suppression/package-summary.html | 2 +- .../dependencycheck/utils/ChecksumTest.html | 292 +- .../utils/DependencyVersionTest.html | 350 +- .../utils/DependencyVersionUtilTest.html | 46 +- .../utils/DownloaderIntegrationTest.html | 144 +- .../dependencycheck/utils/DownloaderTest.html | 112 +- .../dependencycheck/utils/FileUtilsTest.html | 157 +- .../dependencycheck/utils/FilterTest.html | 64 +- .../dependencycheck/utils/SettingsTest.html | 347 +- .../dependencycheck/utils/package-frame.html | 2 +- .../utils/package-summary.html | 2 +- .../xref-test/overview-frame.html | 5 +- .../xref-test/overview-summary.html | 9 +- .../xref/allclasses-frame.html | 11 +- dependency-check-core/xref/index.html | 2 +- .../org/owasp/dependencycheck/Engine.html | 872 +++-- .../analyzer/AbstractAnalyzer.html | 128 +- .../analyzer/AbstractSuppressionAnalyzer.html | 221 +- .../analyzer/AnalysisException.html | 127 +- .../analyzer/AnalysisPhase.html | 121 +- .../dependencycheck/analyzer/Analyzer.html | 191 +- .../analyzer/AnalyzerService.html | 125 +- .../analyzer/ArchiveAnalyzer.html | 758 ++-- .../analyzer/ArchiveExtractionException.html | 127 +- .../dependencycheck/analyzer/CPEAnalyzer.html | 1515 ++++---- .../analyzer/CpeSuppressionAnalyzer.html | 144 +- .../analyzer/DependencyBundlingAnalyzer.html | 722 ++-- .../analyzer/FalsePositiveAnalyzer.html | 725 ++-- .../analyzer/FileNameAnalyzer.html | 261 +- .../analyzer/HintAnalyzer.html | 184 +- .../dependencycheck/analyzer/JarAnalyzer.html | 2433 ++++++------ .../analyzer/JavaScriptAnalyzer.html | 234 +- .../analyzer/NexusAnalyzer.html | 339 +- .../analyzer/NvdCveAnalyzer.html | 311 +- .../VulnerabilitySuppressionAnalyzer.html | 144 +- .../analyzer/package-frame.html | 2 +- .../analyzer/package-summary.html | 2 +- .../data/cpe/CpeMemoryIndex.html | 646 ++-- .../dependencycheck/data/cpe/Fields.html | 80 +- .../dependencycheck/data/cpe/IndexEntry.html | 369 +- .../data/cpe/IndexException.html | 127 +- .../data/cpe/package-frame.html | 2 +- .../data/cpe/package-summary.html | 2 +- .../owasp/dependencycheck/data/cwe/CweDB.html | 146 +- .../dependencycheck/data/cwe/CweHandler.html | 105 +- .../data/cwe/package-frame.html | 2 +- .../data/cwe/package-summary.html | 2 +- .../data/lucene/AbstractTokenizingFilter.html | 162 +- .../data/lucene/AlphaNumericTokenizer.html | 120 +- .../data/lucene/DependencySimilarity.html | 91 +- .../data/lucene/FieldAnalyzer.html | 155 +- .../data/lucene/LuceneUtils.html | 213 +- .../data/lucene/SearchFieldAnalyzer.html | 176 +- .../data/lucene/SearchVersionAnalyzer.html | 140 +- .../lucene/TokenPairConcatenatingFilter.html | 243 +- .../data/lucene/UrlTokenizingFilter.html | 162 +- .../data/lucene/VersionAnalyzer.html | 137 +- .../data/lucene/VersionTokenizingFilter.html | 190 +- .../data/lucene/package-frame.html | 2 +- .../data/lucene/package-summary.html | 2 +- .../data/nexus/MavenArtifact.html | 266 +- .../data/nexus/NexusSearch.html | 165 +- .../data/nexus/package-frame.html | 2 +- .../data/nexus/package-summary.html | 2 +- .../data/nvdcve/ConnectionFactory.html | 475 +-- .../data/nvdcve/CorruptDatabaseException.html | 97 +- .../dependencycheck/data/nvdcve/CveDB.html | 1546 ++++---- .../data/nvdcve/DatabaseException.html | 113 +- .../data/nvdcve/DatabaseProperties.html | 276 +- .../data/nvdcve/DriverLoadException.html | 113 +- .../data/nvdcve/DriverLoader.html | 232 +- .../data/nvdcve/DriverShim.html | 353 +- .../data/nvdcve/package-frame.html | 2 +- .../data/nvdcve/package-summary.html | 2 +- .../data/update/CachedWebDataSource.html | 71 +- .../data/update/NvdCveInfo.html | 269 +- .../data/update/NvdCveUpdater.html | 108 +- .../data/update/StandardUpdate.html | 673 ++-- .../data/update/UpdateService.html | 126 +- .../data/update/UpdateableNvdCve.html | 339 +- .../exception/InvalidDataException.html | 96 +- .../update/exception/UpdateException.html | 131 +- .../data/update/exception/package-frame.html | 2 +- .../update/exception/package-summary.html | 2 +- .../data/update/package-frame.html | 2 +- .../data/update/package-summary.html | 2 +- .../update/task/CallableDownloadTask.html | 432 ++- .../data/update/task/ProcessTask.html | 338 +- .../data/update/task/package-frame.html | 2 +- .../data/update/task/package-summary.html | 2 +- .../data/update/xml/NvdCve12Handler.html | 454 ++- .../data/update/xml/NvdCve20Handler.html | 979 +++-- .../data/update/xml/package-frame.html | 2 +- .../data/update/xml/package-summary.html | 2 +- .../dependency/Confidence.html | 56 + .../dependency/Dependency.html | 1136 +++--- .../dependencycheck/dependency/Evidence.html | 493 ++- .../dependency/EvidenceCollection.html | 732 ++-- .../dependency/Identifier.html | 374 +- .../dependencycheck/dependency/Reference.html | 298 +- .../dependency/Vulnerability.html | 836 ++-- .../dependency/VulnerabilityComparator.html | 85 +- .../dependency/VulnerableSoftware.html | 591 ++- .../dependency/package-frame.html | 4 +- .../dependency/package-summary.html | 4 +- .../exception/NoDataException.html | 131 +- .../exception/package-frame.html | 2 +- .../exception/package-summary.html | 2 +- .../jaxb/pom/MavenNamespaceFilter.html | 185 +- .../jaxb/pom/generated/package-frame.html | 2 +- .../jaxb/pom/generated/package-summary.html | 2 +- .../jaxb/pom/package-frame.html | 2 +- .../jaxb/pom/package-summary.html | 2 +- .../owasp/dependencycheck/package-frame.html | 2 +- .../dependencycheck/package-summary.html | 2 +- .../reporting/ReportGenerator.html | 340 +- .../reporting/VelocityLoggerRedirect.html | 206 +- .../reporting/package-frame.html | 2 +- .../reporting/package-summary.html | 2 +- .../suppression/PropertyType.html | 341 +- .../suppression/SuppressionErrorHandler.html | 179 +- .../suppression/SuppressionHandler.html | 341 +- .../SuppressionParseException.html | 131 +- .../suppression/SuppressionParser.html | 197 +- .../suppression/SuppressionRule.html | 714 ++-- .../suppression/package-frame.html | 2 +- .../suppression/package-summary.html | 2 +- .../owasp/dependencycheck/utils/DBUtils.html | 185 +- .../utils/DependencyVersion.html | 490 ++- .../utils/DependencyVersionUtil.html | 182 +- .../utils/DownloadFailedException.html | 131 +- .../dependencycheck/utils/Downloader.html | 443 ++- .../utils/ExtractionException.html | 131 +- .../dependencycheck/utils/FileUtils.html | 446 ++- .../utils/InvalidSettingException.html | 131 +- .../dependencycheck/utils/LogFilter.html | 80 +- .../owasp/dependencycheck/utils/LogUtils.html | 171 +- .../utils/NonClosingStream.html | 90 +- .../owasp/dependencycheck/utils/Settings.html | 864 ++--- .../dependencycheck/utils/UrlStringUtils.html | 156 +- .../dependencycheck/utils/package-frame.html | 2 +- .../utils/package-summary.html | 2 +- .../xref/overview-frame.html | 8 +- .../xref/overview-summary.html | 14 +- dependency-check-jenkins/index.html | 15 +- dependency-check-jenkins/license.html | 842 ++--- dependency-check-jenkins/project-info.html | 10 +- dependency-check-jenkins/project-summary.html | 12 +- .../apidocs/allclasses-frame.html | 6 +- .../apidocs/allclasses-noframe.html | 6 +- .../apidocs/constant-values.html | 8 +- .../apidocs/deprecated-list.html | 8 +- dependency-check-maven/apidocs/help-doc.html | 8 +- dependency-check-maven/apidocs/index-all.html | 14 +- dependency-check-maven/apidocs/index.html | 4 +- .../maven/DependencyCheckMojo.html | 20 +- .../owasp/dependencycheck/maven/HelpMojo.html | 8 +- .../maven/class-use/DependencyCheckMojo.html | 8 +- .../maven/class-use/HelpMojo.html | 8 +- .../dependencycheck/maven/package-frame.html | 6 +- .../maven/package-summary.html | 11 +- .../dependencycheck/maven/package-tree.html | 8 +- .../dependencycheck/maven/package-use.html | 8 +- .../apidocs/overview-tree.html | 8 +- dependency-check-maven/check-mojo.html | 191 +- dependency-check-maven/checkstyle.html | 62 +- dependency-check-maven/checkstyle.rss | 4 +- ...mmary-org.owasp.dependencycheck.maven.html | 6 +- .../cobertura/frame-summary.html | 6 +- ...ndencycheck.maven.DependencyCheckMojo.html | 2233 +++++------ ....owasp.dependencycheck.maven.HelpMojo.html | 2 +- dependency-check-maven/configuration.html | 59 +- dependency-check-maven/cpd.html | 10 +- .../dependency-updates-report.html | 14 +- dependency-check-maven/findbugs.html | 10 +- dependency-check-maven/help-mojo.html | 12 +- dependency-check-maven/index.html | 15 +- dependency-check-maven/license.html | 842 ++--- dependency-check-maven/plugin-info.html | 16 +- .../plugin-updates-report.html | 10 +- dependency-check-maven/pmd.html | 10 +- dependency-check-maven/project-info.html | 10 +- dependency-check-maven/project-reports.html | 10 +- dependency-check-maven/project-summary.html | 12 +- dependency-check-maven/surefire-report.html | 18 +- dependency-check-maven/taglist.html | 34 +- dependency-check-maven/usage.html | 28 +- dependency-check-maven/xref-test/index.html | 2 +- .../maven/DependencyCheckMojoTest.html | 419 +- .../owasp/dependencycheck/maven/MySink.html | 1197 +++--- .../dependencycheck/maven/package-frame.html | 2 +- .../maven/package-summary.html | 2 +- .../xref-test/overview-frame.html | 2 +- .../xref-test/overview-summary.html | 4 +- dependency-check-maven/xref/index.html | 2 +- .../maven/DependencyCheckMojo.html | 1738 +++++---- .../dependencycheck/maven/package-frame.html | 2 +- .../maven/package-summary.html | 2 +- .../xref/overview-frame.html | 2 +- .../xref/overview-summary.html | 4 +- index.html | 29 +- issue-tracking.html | 29 +- license.html | 907 ++--- mail-lists.html | 29 +- modules.html | 31 +- project-info.html | 31 +- project-summary.html | 33 +- source-repository.html | 29 +- suppression.html | 29 +- team-list.html | 31 +- 1007 files changed, 55095 insertions(+), 53038 deletions(-) create mode 100644 dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/Confidence.html create mode 100644 dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/class-use/Confidence.html create mode 100644 dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.Confidence.html create mode 100644 dependency-check-core/javancss.html create mode 100644 dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/DependencyBundlingAnalyzerTest.html create mode 100644 dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/FalsePositiveAnalyzerTest.html create mode 100644 dependency-check-core/xref/org/owasp/dependencycheck/dependency/Confidence.html diff --git a/SampleReport.html b/SampleReport.html index 95d55ece2..75a2b1409 100644 --- a/SampleReport.html +++ b/SampleReport.html @@ -456,7 +456,7 @@
-

Dependency Report

+

Dependency-Check Report

Project: Sample Application

diff --git a/dependency-check-ant/apidocs/allclasses-frame.html b/dependency-check-ant/apidocs/allclasses-frame.html index c28f91d39..158b60d52 100644 --- a/dependency-check-ant/apidocs/allclasses-frame.html +++ b/dependency-check-ant/apidocs/allclasses-frame.html @@ -2,10 +2,10 @@ - + -All Classes (Dependency-Check Ant Task 1.0.8 API) - +All Classes (Dependency-Check Ant Task 1.1.0 API) + diff --git a/dependency-check-ant/apidocs/allclasses-noframe.html b/dependency-check-ant/apidocs/allclasses-noframe.html index e7959fdeb..9399cb65b 100644 --- a/dependency-check-ant/apidocs/allclasses-noframe.html +++ b/dependency-check-ant/apidocs/allclasses-noframe.html @@ -2,10 +2,10 @@ - + -All Classes (Dependency-Check Ant Task 1.0.8 API) - +All Classes (Dependency-Check Ant Task 1.1.0 API) + diff --git a/dependency-check-ant/apidocs/constant-values.html b/dependency-check-ant/apidocs/constant-values.html index 1676c5b00..ea6813b6f 100644 --- a/dependency-check-ant/apidocs/constant-values.html +++ b/dependency-check-ant/apidocs/constant-values.html @@ -2,16 +2,16 @@ - + -Constant Field Values (Dependency-Check Ant Task 1.0.8 API) - +Constant Field Values (Dependency-Check Ant Task 1.1.0 API) + diff --git a/dependency-check-ant/apidocs/deprecated-list.html b/dependency-check-ant/apidocs/deprecated-list.html index 986ae7a8a..97c824f66 100644 --- a/dependency-check-ant/apidocs/deprecated-list.html +++ b/dependency-check-ant/apidocs/deprecated-list.html @@ -2,16 +2,16 @@ - + -Deprecated List (Dependency-Check Ant Task 1.0.8 API) - +Deprecated List (Dependency-Check Ant Task 1.1.0 API) + diff --git a/dependency-check-ant/apidocs/help-doc.html b/dependency-check-ant/apidocs/help-doc.html index dcb32ebcb..4db40cb9c 100644 --- a/dependency-check-ant/apidocs/help-doc.html +++ b/dependency-check-ant/apidocs/help-doc.html @@ -2,16 +2,16 @@ - + -API Help (Dependency-Check Ant Task 1.0.8 API) - +API Help (Dependency-Check Ant Task 1.1.0 API) + diff --git a/dependency-check-ant/apidocs/index-all.html b/dependency-check-ant/apidocs/index-all.html index c47f858d7..54a16da00 100644 --- a/dependency-check-ant/apidocs/index-all.html +++ b/dependency-check-ant/apidocs/index-all.html @@ -2,16 +2,16 @@ - + -Index (Dependency-Check Ant Task 1.0.8 API) - +Index (Dependency-Check Ant Task 1.1.0 API) + @@ -87,8 +87,7 @@
DependencyCheckTask.ReportFormats - Class in org.owasp.dependencycheck.taskdefs
-
An enumeration of supported report formats: "ALL", "HTML", "XML", "VULN", - etc..
+
An enumeration of supported report formats: "ALL", "HTML", "XML", "VULN", etc..
DependencyCheckTask.ReportFormats() - Constructor for class org.owasp.dependencycheck.taskdefs.DependencyCheckTask.ReportFormats
 
@@ -110,10 +109,30 @@
Get the value of applicationName.
+
getConnectionString() - Method in class org.owasp.dependencycheck.taskdefs.DependencyCheckTask
+
+
Get the value of connectionString.
+
getConnectionTimeout() - Method in class org.owasp.dependencycheck.taskdefs.DependencyCheckTask
Get the value of connectionTimeout.
+
getDatabaseDriverName() - Method in class org.owasp.dependencycheck.taskdefs.DependencyCheckTask
+
+
Get the value of databaseDriverName.
+
+
getDatabaseDriverPath() - Method in class org.owasp.dependencycheck.taskdefs.DependencyCheckTask
+
+
Get the value of databaseDriverPath.
+
+
getDatabasePassword() - Method in class org.owasp.dependencycheck.taskdefs.DependencyCheckTask
+
+
Get the value of databasePassword.
+
+
getDatabaseUser() - Method in class org.owasp.dependencycheck.taskdefs.DependencyCheckTask
+
+
Get the value of databaseUser.
+
getDataDirectory() - Method in class org.owasp.dependencycheck.taskdefs.DependencyCheckTask
Get the value of dataDirectory.
@@ -126,6 +145,10 @@
Get the value of logFile.
+
getNexusUrl() - Method in class org.owasp.dependencycheck.taskdefs.DependencyCheckTask
+
+
Get the value of nexusUrl.
+
getProxyPassword() - Method in class org.owasp.dependencycheck.taskdefs.DependencyCheckTask
Get the value of proxyPassword.
@@ -168,6 +191,10 @@
Get the value of autoUpdate.
+
isNexusAnalyzerEnabled() - Method in class org.owasp.dependencycheck.taskdefs.DependencyCheckTask
+
+
Get the value of nexusAnalyzerEnabled.
+
isReference() - Method in class org.owasp.dependencycheck.taskdefs.DependencyCheckTask
Learn whether the refid attribute of this element been set.
@@ -205,10 +232,30 @@
Set the value of autoUpdate.
+
setConnectionString(String) - Method in class org.owasp.dependencycheck.taskdefs.DependencyCheckTask
+
+
Set the value of connectionString.
+
setConnectionTimeout(String) - Method in class org.owasp.dependencycheck.taskdefs.DependencyCheckTask
Set the value of connectionTimeout.
+
setDatabaseDriverName(String) - Method in class org.owasp.dependencycheck.taskdefs.DependencyCheckTask
+
+
Set the value of databaseDriverName.
+
+
setDatabaseDriverPath(String) - Method in class org.owasp.dependencycheck.taskdefs.DependencyCheckTask
+
+
Set the value of databaseDriverPath.
+
+
setDatabasePassword(String) - Method in class org.owasp.dependencycheck.taskdefs.DependencyCheckTask
+
+
Set the value of databasePassword.
+
+
setDatabaseUser(String) - Method in class org.owasp.dependencycheck.taskdefs.DependencyCheckTask
+
+
Set the value of databaseUser.
+
setDataDirectory(String) - Method in class org.owasp.dependencycheck.taskdefs.DependencyCheckTask
Set the value of dataDirectory.
@@ -221,6 +268,14 @@
Set the value of logFile.
+
setNexusAnalyzerEnabled(boolean) - Method in class org.owasp.dependencycheck.taskdefs.DependencyCheckTask
+
+
Set the value of nexusAnalyzerEnabled.
+
+
setNexusUrl(String) - Method in class org.owasp.dependencycheck.taskdefs.DependencyCheckTask
+
+
Set the value of nexusUrl.
+
setProxyPassword(String) - Method in class org.owasp.dependencycheck.taskdefs.DependencyCheckTask
Set the value of proxyPassword.
@@ -239,8 +294,7 @@
setRefid(Reference) - Method in class org.owasp.dependencycheck.taskdefs.DependencyCheckTask
-
Add a reference to a Path, FileSet, DirSet, or FileList defined - elsewhere.
+
Add a reference to a Path, FileSet, DirSet, or FileList defined elsewhere.
setReportFormat(DependencyCheckTask.ReportFormats) - Method in class org.owasp.dependencycheck.taskdefs.DependencyCheckTask
diff --git a/dependency-check-ant/apidocs/index.html b/dependency-check-ant/apidocs/index.html index f84e90e98..471a8724c 100644 --- a/dependency-check-ant/apidocs/index.html +++ b/dependency-check-ant/apidocs/index.html @@ -2,9 +2,9 @@ - + -Dependency-Check Ant Task 1.0.8 API +Dependency-Check Ant Task 1.1.0 API @@ -107,8 +107,7 @@ 
public static class DependencyCheckTask.ReportFormats
 extends org.apache.tools.ant.types.EnumeratedAttribute
-
An enumeration of supported report formats: "ALL", "HTML", "XML", "VULN", - etc..
+
An enumeration of supported report formats: "ALL", "HTML", "XML", "VULN", etc..
diff --git a/dependency-check-ant/apidocs/org/owasp/dependencycheck/taskdefs/DependencyCheckTask.html b/dependency-check-ant/apidocs/org/owasp/dependencycheck/taskdefs/DependencyCheckTask.html index a6ff60f54..3465687dc 100644 --- a/dependency-check-ant/apidocs/org/owasp/dependencycheck/taskdefs/DependencyCheckTask.html +++ b/dependency-check-ant/apidocs/org/owasp/dependencycheck/taskdefs/DependencyCheckTask.html @@ -2,16 +2,16 @@ - + -DependencyCheckTask (Dependency-Check Ant Task 1.0.8 API) - +DependencyCheckTask (Dependency-Check Ant Task 1.1.0 API) + @@ -136,8 +136,7 @@ extends org.apache.tools.ant.Task static class  DependencyCheckTask.ReportFormats -
An enumeration of supported report formats: "ALL", "HTML", "XML", "VULN", - etc..
+
An enumeration of supported report formats: "ALL", "HTML", "XML", "VULN", etc..
@@ -214,28 +213,64 @@ extends org.apache.tools.ant.Task String +getConnectionString() +
Get the value of connectionString.
+ + + +String getConnectionTimeout()
Get the value of connectionTimeout.
+ +String +getDatabaseDriverName() +
Get the value of databaseDriverName.
+ + String +getDatabaseDriverPath() +
Get the value of databaseDriverPath.
+ + + +String +getDatabasePassword() +
Get the value of databasePassword.
+ + + +String +getDatabaseUser() +
Get the value of databaseUser.
+ + + +String getDataDirectory()
Get the value of dataDirectory.
- + float getFailBuildOnCVSS()
Get the value of failBuildOnCVSS.
- + String getLogFile()
Get the value of logFile.
+ +String +getNexusUrl() +
Get the value of nexusUrl.
+ + String getProxyPassword() @@ -286,28 +321,40 @@ extends org.apache.tools.ant.Task boolean +isNexusAnalyzerEnabled() +
Get the value of nexusAnalyzerEnabled.
+ + + +boolean isReference()
Learn whether the refid attribute of this element been set.
- + boolean isShowSummary()
Get the value of showSummary.
- + void setApplicationName(String applicationName)
Set the value of applicationName.
- + void setAutoUpdate(boolean autoUpdate)
Set the value of autoUpdate.
+ +void +setConnectionString(String connectionString) +
Set the value of connectionString.
+ + void setConnectionTimeout(String connectionTimeout) @@ -316,6 +363,30 @@ extends org.apache.tools.ant.Task void +setDatabaseDriverName(String databaseDriverName) +
Set the value of databaseDriverName.
+ + + +void +setDatabaseDriverPath(String databaseDriverPath) +
Set the value of databaseDriverPath.
+ + + +void +setDatabasePassword(String databasePassword) +
Set the value of databasePassword.
+ + + +void +setDatabaseUser(String databaseUser) +
Set the value of databaseUser.
+ + + +void setDataDirectory(String dataDirectory)
Set the value of dataDirectory.
@@ -334,6 +405,18 @@ extends org.apache.tools.ant.Task void +setNexusAnalyzerEnabled(boolean nexusAnalyzerEnabled) +
Set the value of nexusAnalyzerEnabled.
+ + + +void +setNexusUrl(String nexusUrl) +
Set the value of nexusUrl.
+ + + +void setProxyPassword(String proxyPassword)
Set the value of proxyPassword.
@@ -359,8 +442,7 @@ extends org.apache.tools.ant.Task void setRefid(org.apache.tools.ant.types.Reference r) -
Add a reference to a Path, FileSet, DirSet, or FileList defined - elsewhere.
+
Add a reference to a Path, FileSet, DirSet, or FileList defined elsewhere.
@@ -471,8 +553,7 @@ extends org.apache.tools.ant.Task

  • setRefid

    public void setRefid(org.apache.tools.ant.types.Reference r)
    -
    Add a reference to a Path, FileSet, DirSet, or FileList defined - elsewhere.
    +
    Add a reference to a Path, FileSet, DirSet, or FileList defined elsewhere.
    Parameters:
    r - the reference to a path, fileset, dirset or filelist.
    • @@ -784,6 +865,160 @@ extends org.apache.tools.ant.Task
    Parameters:
    showSummary - new value of showSummary
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/dependency-check-ant/apidocs/org/owasp/dependencycheck/taskdefs/class-use/DependencyCheckTask.ReportFormats.html b/dependency-check-ant/apidocs/org/owasp/dependencycheck/taskdefs/class-use/DependencyCheckTask.ReportFormats.html index 45fd136f2..e628fd144 100644 --- a/dependency-check-ant/apidocs/org/owasp/dependencycheck/taskdefs/class-use/DependencyCheckTask.ReportFormats.html +++ b/dependency-check-ant/apidocs/org/owasp/dependencycheck/taskdefs/class-use/DependencyCheckTask.ReportFormats.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.taskdefs.DependencyCheckTask.ReportFormats (Dependency-Check Ant Task 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.taskdefs.DependencyCheckTask.ReportFormats (Dependency-Check Ant Task 1.1.0 API) + diff --git a/dependency-check-ant/apidocs/org/owasp/dependencycheck/taskdefs/class-use/DependencyCheckTask.html b/dependency-check-ant/apidocs/org/owasp/dependencycheck/taskdefs/class-use/DependencyCheckTask.html index dff0b0567..27ee67263 100644 --- a/dependency-check-ant/apidocs/org/owasp/dependencycheck/taskdefs/class-use/DependencyCheckTask.html +++ b/dependency-check-ant/apidocs/org/owasp/dependencycheck/taskdefs/class-use/DependencyCheckTask.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.taskdefs.DependencyCheckTask (Dependency-Check Ant Task 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.taskdefs.DependencyCheckTask (Dependency-Check Ant Task 1.1.0 API) + diff --git a/dependency-check-ant/apidocs/org/owasp/dependencycheck/taskdefs/package-frame.html b/dependency-check-ant/apidocs/org/owasp/dependencycheck/taskdefs/package-frame.html index 4c2334635..8d7679fd7 100644 --- a/dependency-check-ant/apidocs/org/owasp/dependencycheck/taskdefs/package-frame.html +++ b/dependency-check-ant/apidocs/org/owasp/dependencycheck/taskdefs/package-frame.html @@ -2,10 +2,10 @@ - + -org.owasp.dependencycheck.taskdefs (Dependency-Check Ant Task 1.0.8 API) - +org.owasp.dependencycheck.taskdefs (Dependency-Check Ant Task 1.1.0 API) + diff --git a/dependency-check-ant/apidocs/org/owasp/dependencycheck/taskdefs/package-summary.html b/dependency-check-ant/apidocs/org/owasp/dependencycheck/taskdefs/package-summary.html index 8f837c8f2..888ecac2a 100644 --- a/dependency-check-ant/apidocs/org/owasp/dependencycheck/taskdefs/package-summary.html +++ b/dependency-check-ant/apidocs/org/owasp/dependencycheck/taskdefs/package-summary.html @@ -2,16 +2,16 @@ - + -org.owasp.dependencycheck.taskdefs (Dependency-Check Ant Task 1.0.8 API) - +org.owasp.dependencycheck.taskdefs (Dependency-Check Ant Task 1.1.0 API) + @@ -93,8 +93,7 @@ DependencyCheckTask.ReportFormats -
    An enumeration of supported report formats: "ALL", "HTML", "XML", "VULN", - etc..
    +
    An enumeration of supported report formats: "ALL", "HTML", "XML", "VULN", etc..
    diff --git a/dependency-check-ant/apidocs/org/owasp/dependencycheck/taskdefs/package-tree.html b/dependency-check-ant/apidocs/org/owasp/dependencycheck/taskdefs/package-tree.html index 3160d3f5c..8fafb188a 100644 --- a/dependency-check-ant/apidocs/org/owasp/dependencycheck/taskdefs/package-tree.html +++ b/dependency-check-ant/apidocs/org/owasp/dependencycheck/taskdefs/package-tree.html @@ -2,16 +2,16 @@ - + -org.owasp.dependencycheck.taskdefs Class Hierarchy (Dependency-Check Ant Task 1.0.8 API) - +org.owasp.dependencycheck.taskdefs Class Hierarchy (Dependency-Check Ant Task 1.1.0 API) + diff --git a/dependency-check-ant/apidocs/org/owasp/dependencycheck/taskdefs/package-use.html b/dependency-check-ant/apidocs/org/owasp/dependencycheck/taskdefs/package-use.html index dc4dc58e4..62973d934 100644 --- a/dependency-check-ant/apidocs/org/owasp/dependencycheck/taskdefs/package-use.html +++ b/dependency-check-ant/apidocs/org/owasp/dependencycheck/taskdefs/package-use.html @@ -2,16 +2,16 @@ - + -Uses of Package org.owasp.dependencycheck.taskdefs (Dependency-Check Ant Task 1.0.8 API) - +Uses of Package org.owasp.dependencycheck.taskdefs (Dependency-Check Ant Task 1.1.0 API) + @@ -78,8 +78,7 @@ DependencyCheckTask.ReportFormats -
    An enumeration of supported report formats: "ALL", "HTML", "XML", "VULN", - etc..
    +
    An enumeration of supported report formats: "ALL", "HTML", "XML", "VULN", etc..
    diff --git a/dependency-check-ant/apidocs/overview-tree.html b/dependency-check-ant/apidocs/overview-tree.html index 107496f17..9cfd1564e 100644 --- a/dependency-check-ant/apidocs/overview-tree.html +++ b/dependency-check-ant/apidocs/overview-tree.html @@ -2,16 +2,16 @@ - + -Class Hierarchy (Dependency-Check Ant Task 1.0.8 API) - +Class Hierarchy (Dependency-Check Ant Task 1.1.0 API) + diff --git a/dependency-check-ant/checkstyle.html b/dependency-check-ant/checkstyle.html index cbaf031f6..16195c05b 100644 --- a/dependency-check-ant/checkstyle.html +++ b/dependency-check-ant/checkstyle.html @@ -1,13 +1,13 @@ - + dependency-check-ant - Checkstyle Results @@ -54,7 +54,7 @@
  • - +
  • /
    • @@ -67,8 +67,8 @@ -
  • Last Published: 2014-01-16
  • |
    • -
  • Version: 1.0.8
    • +
  • Last Published: 2014-01-26
  • |
    • +
  • Version: 1.1.0
    • @@ -245,7 +245,7 @@ 18 0 0 -0 +1

    Files

    @@ -253,9 +253,25 @@ -
    Files I Infos W WarningsE Errors
    +E Errors + +src/main/java/org/owasp/dependencycheck/taskdefs/DependencyCheckTask.java +0 +0 +1
    -

    Details

    +

    Details

    +
    +

    src/main/java/org/owasp/dependencycheck/taskdefs/DependencyCheckTask.java

    + + + + + + + + +
    ViolationMessageLine
    ErrorsTotal number of methods is 52 (max allowed is 40).51
    diff --git a/dependency-check-ant/checkstyle.rss b/dependency-check-ant/checkstyle.rss index a83e0ff65..bca6d73f2 100644 --- a/dependency-check-ant/checkstyle.rss +++ b/dependency-check-ant/checkstyle.rss @@ -26,7 +26,7 @@ under the License. ©2012 - 2014 OWASP File: 18, - Errors: 0, + Errors: 1, Warnings: 0, Infos: 0 @@ -181,7 +181,7 @@ under the License. 0 - 0 + 1 diff --git a/dependency-check-ant/cobertura/frame-sourcefiles-org.owasp.dependencycheck.taskdefs.html b/dependency-check-ant/cobertura/frame-sourcefiles-org.owasp.dependencycheck.taskdefs.html index 8de243d6e..1fa3510f1 100644 --- a/dependency-check-ant/cobertura/frame-sourcefiles-org.owasp.dependencycheck.taskdefs.html +++ b/dependency-check-ant/cobertura/frame-sourcefiles-org.owasp.dependencycheck.taskdefs.html @@ -15,7 +15,7 @@ org.owasp.dependencycheck.taskdefs - +
    DependencyCheckTask (59%)DependencyCheckTask (54%)
    diff --git a/dependency-check-ant/cobertura/frame-sourcefiles.html b/dependency-check-ant/cobertura/frame-sourcefiles.html index 20f136f5f..18211c2dd 100644 --- a/dependency-check-ant/cobertura/frame-sourcefiles.html +++ b/dependency-check-ant/cobertura/frame-sourcefiles.html @@ -15,7 +15,7 @@ All Packages - +
    DependencyCheckTask (59%)DependencyCheckTask (54%)
    diff --git a/dependency-check-ant/cobertura/frame-summary-org.owasp.dependencycheck.taskdefs.html b/dependency-check-ant/cobertura/frame-summary-org.owasp.dependencycheck.taskdefs.html index f7e816698..1676554f6 100644 --- a/dependency-check-ant/cobertura/frame-summary-org.owasp.dependencycheck.taskdefs.html +++ b/dependency-check-ant/cobertura/frame-summary-org.owasp.dependencycheck.taskdefs.html @@ -16,7 +16,7 @@ - +
    Package # Classes Line Coverage Branch Coverage Complexity
    org.owasp.dependencycheck.taskdefs2
    59%
    110/184
    47%
    40/84
    		2.325
    org.owasp.dependencycheck.taskdefs2
    54%
    125/228
    42%
    47/110
    		2.241
    -
    Report generated by Cobertura 1.9.4.1 on 1/16/14 7:31 AM.
    +
    Report generated by Cobertura 1.9.4.1 on 1/26/14 11:15 AM.
    diff --git a/dependency-check-ant/cobertura/frame-summary.html b/dependency-check-ant/cobertura/frame-summary.html index 8f397b079..ea4ed8284 100644 --- a/dependency-check-ant/cobertura/frame-summary.html +++ b/dependency-check-ant/cobertura/frame-summary.html @@ -16,8 +16,8 @@ - - + +
    Package # Classes Line Coverage Branch Coverage Complexity
    All Packages2
    59%
    110/184
    47%
    40/84
    		2.325
    org.owasp.dependencycheck.taskdefs2
    59%
    110/184
    47%
    40/84
    		2.325
    All Packages2
    54%
    125/228
    42%
    47/110
    		2.241
    org.owasp.dependencycheck.taskdefs2
    54%
    125/228
    42%
    47/110
    		2.241
    -
    Report generated by Cobertura 1.9.4.1 on 1/16/14 7:31 AM.
    +
    Report generated by Cobertura 1.9.4.1 on 1/26/14 11:15 AM.
    diff --git a/dependency-check-ant/cobertura/org.owasp.dependencycheck.taskdefs.DependencyCheckTask.html b/dependency-check-ant/cobertura/org.owasp.dependencycheck.taskdefs.DependencyCheckTask.html index 05873626c..73dfd1eaa 100644 --- a/dependency-check-ant/cobertura/org.owasp.dependencycheck.taskdefs.DependencyCheckTask.html +++ b/dependency-check-ant/cobertura/org.owasp.dependencycheck.taskdefs.DependencyCheckTask.html @@ -12,8 +12,8 @@
     
    - - + +
    Classes in this File Line Coverage Branch Coverage Complexity
    DependencyCheckTask
    58%
    103/177
    46%
    38/82
    		2.325
    DependencyCheckTask$ReportFormats
    100%
    7/7
    100%
    2/2
    		2.325
    DependencyCheckTask
    53%
    118/221
    41%
    45/108
    		2.241
    DependencyCheckTask$ReportFormats
    100%
    7/7
    100%
    2/2
    		2.241
     
    @@ -25,245 +25,245 @@  3   
      *
     4   - 
      * Dependency-check-ant is free software: you can redistribute it and/or modify it
    + 
      * Licensed under the Apache License, Version 2.0 (the "License");
     5   - 
      * under the terms of the GNU General Public License as published by the Free
    + 
      * you may not use this file except in compliance with the License.
     6   - 
      * Software Foundation, either version 3 of the License, or (at your option) any
    + 
      * You may obtain a copy of the License at
     7   - 
      * later version.
    + 
      *
     8   - 
      *
    + 
      *     http://www.apache.org/licenses/LICENSE-2.0
     9   - 
      * Dependency-check-ant is distributed in the hope that it will be useful, but
    + 
      *
     10   - 
      * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
    + 
      * Unless required by applicable law or agreed to in writing, software
     11   - 
      * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
    + 
      * distributed under the License is distributed on an "AS IS" BASIS,
     12   - 
      * details.
    + 
      * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13   - 
      *
    + 
      * See the License for the specific language governing permissions and
     14   - 
      * You should have received a copy of the GNU General Public License along with
    + 
      * limitations under the License.
     15   - 
      * dependency-check-ant. If not, see http://www.gnu.org/licenses/.
    + 
      *
     16   - 
      *
    -  17   
      * Copyright (c) 2013 Jeremy Long. All Rights Reserved.
    +  17   + 
      */
     18   - 
      */
    -  19   
     package org.owasp.dependencycheck.taskdefs;
    +  19   + 
     
     20   - 
     
    -  21   
     import java.io.File;
    -  22   +  21   
     import java.io.IOException;
    -  23   +  22   
     import java.io.InputStream;
    -  24   +  23   
     import java.util.List;
    -  25   +  24   
     import java.util.logging.Level;
    -  26   +  25   
     import java.util.logging.Logger;
    -  27   +  26   
     import org.apache.tools.ant.BuildException;
    -  28   +  27   
     import org.apache.tools.ant.Task;
    -  29   +  28   
     import org.apache.tools.ant.types.EnumeratedAttribute;
    -  30   +  29   
     import org.apache.tools.ant.types.Reference;
    -  31   +  30   
     import org.apache.tools.ant.types.Resource;
    -  32   +  31   
     import org.apache.tools.ant.types.ResourceCollection;
    -  33   +  32   
     import org.apache.tools.ant.types.resources.FileProvider;
    -  34   +  33   
     import org.apache.tools.ant.types.resources.Resources;
    -  35   +  34   
     import org.owasp.dependencycheck.Engine;
    +  35   + 
     import org.owasp.dependencycheck.data.nvdcve.CveDB;
     36   - 
     import org.owasp.dependencycheck.dependency.Dependency;
    + 
     import org.owasp.dependencycheck.data.nvdcve.DatabaseException;
     37   - 
     import org.owasp.dependencycheck.dependency.Identifier;
    + 
     import org.owasp.dependencycheck.data.nvdcve.DatabaseProperties;
     38   - 
     import org.owasp.dependencycheck.dependency.Vulnerability;
    + 
     import org.owasp.dependencycheck.dependency.Dependency;
     39   - 
     import org.owasp.dependencycheck.reporting.ReportGenerator;
    + 
     import org.owasp.dependencycheck.dependency.Identifier;
     40   - 
     import org.owasp.dependencycheck.reporting.ReportGenerator.Format;
    + 
     import org.owasp.dependencycheck.dependency.Vulnerability;
     41   - 
     import org.owasp.dependencycheck.utils.LogUtils;
    + 
     import org.owasp.dependencycheck.reporting.ReportGenerator;
     42   - 
     import org.owasp.dependencycheck.utils.Settings;
    + 
     import org.owasp.dependencycheck.reporting.ReportGenerator.Format;
     43   - 
     
    + 
     import org.owasp.dependencycheck.utils.LogUtils;
     44   - 
     /**
    + 
     import org.owasp.dependencycheck.utils.Settings;
     45   - 
      * An Ant task definition to execute dependency-check during an Ant build.
    + 
     
     46   - 
      *
    + 
     /**
     47   - 
      * @author Jeremy Long <jeremy.long@owasp.org>
    + 
      * An Ant task definition to execute dependency-check during an Ant build.
     48   - 
      */
    + 
      *
     49   - 
     public class DependencyCheckTask extends Task {
    + 
      * @author Jeremy Long <jeremy.long@owasp.org>
     50   - 
     
    + 
      */
     51   - 
         /**
    + 
     public class DependencyCheckTask extends Task {
     52   - 
          * The properties file location.
    + 
     
     53   - 
          */
    + 
         /**
     54   - 
         private static final String PROPERTIES_FILE = "task.properties";
    + 
          * The properties file location.
     55   - 
         /**
    + 
          */
     56   - 
          * Name of the logging properties file.
    + 
         private static final String PROPERTIES_FILE = "task.properties";
     57   - 
          */
    + 
         /**
     58   - 
         private static final String LOG_PROPERTIES_FILE = "log.properties";
    + 
          * Name of the logging properties file.
     59   - 
         /**
    + 
          */
     60   - 
          * System specific new line character.
    + 
         private static final String LOG_PROPERTIES_FILE = "log.properties";
     61   - 
          */
    -  62  1 
         private static final String NEW_LINE = System.getProperty("line.separator", "\n").intern();
    + 
         /**
    +  62   + 
          * System specific new line character.
     63   - 
     
    -  64   - 
         /**
    + 
          */
    +  64  2 
         private static final String NEW_LINE = System.getProperty("line.separator", "\n").intern();
     65   - 
          * Construct a new DependencyCheckTask.
    + 
     
     66   - 
          */
    + 
         /**
     67   + 
          * Construct a new DependencyCheckTask.
    +  68   + 
          */
    +  69   
         public DependencyCheckTask() {
    -  68  4 
             super();
    -  69  4 
         }
    -  70   - 
         //The following code was copied Apache Ant PathConvert
    -  71   - 
         //BEGIN COPY from org.apache.tools.ant.taskdefs.PathConvert
    +  70  8 
             super();
    +  71  8 
         }
     72   - 
         /**
    + 
         //The following code was copied Apache Ant PathConvert
     73   - 
          * Path to be converted
    + 
         //BEGIN COPY from org.apache.tools.ant.taskdefs.PathConvert
     74   - 
          */
    -  75  4 
         private Resources path = null;
    + 
         /**
    +  75   + 
          * Path to be converted
     76   - 
         /**
    -  77   - 
          * Reference to path/fileset to convert
    + 
          */
    +  77  8 
         private Resources path = null;
     78   - 
          */
    -  79  4 
         private Reference refid = null;
    + 
         /**
    +  79   + 
          * Reference to path/fileset to convert
     80   - 
     
    -  81   - 
         /**
    + 
          */
    +  81  8 
         private Reference refid = null;
     82   - 
          * Add an arbitrary ResourceCollection.
    + 
     
     83   - 
          *
    + 
         /**
     84   - 
          * @param rc the ResourceCollection to add.
    + 
          * Add an arbitrary ResourceCollection.
     85   - 
          * @since Ant 1.7
    + 
          *
     86   - 
          */
    + 
          * @param rc the ResourceCollection to add.
     87   + 
          * @since Ant 1.7
    +  88   + 
          */
    +  89   
         public void add(ResourceCollection rc) {
    -  88  4 
             if (isReference()) {
    -  89  0 
                 throw new BuildException("Nested elements are not allowed when using the refid attribute.");
    -  90   +  90  8 
             if (isReference()) {
    +  91  0 
                 throw new BuildException("Nested elements are not allowed when using the refid attribute.");
    +  92   
             }
    -  91  4 
             getPath().add(rc);
    -  92  4 
         }
    -  93   - 
     
    -  94   - 
         /**
    +  93  8 
             getPath().add(rc);
    +  94  8 
         }
     95   - 
          * Returns the path. If the path has not been initialized yet, this class is
    + 
     
     96   - 
          * synchronized, and will instantiate the path object.
    + 
         /**
     97   - 
          *
    + 
          * Returns the path. If the path has not been initialized yet, this class is synchronized, and will instantiate the
     98   - 
          * @return the path
    + 
          * path object.
     99   - 
          */
    + 
          *
     100   + 
          * @return the path
    +  101   + 
          */
    +  102   
         private synchronized Resources getPath() {
    -  101  4 
             if (path == null) {
    -  102  3 
                 path = new Resources(getProject());
    -  103  3 
                 path.setCache(true);
    -  104   - 
             }
    -  105  4 
             return path;
    +  103  8 
             if (path == null) {
    +  104  6 
                 path = new Resources(getProject());
    +  105  6 
                 path.setCache(true);
     106   - 
         }
    -  107   - 
     
    -  108   - 
         /**
    -  109   - 
          * Learn whether the refid attribute of this element been set.
    -  110   - 
          *
    -  111   - 
          * @return true if refid is valid.
    -  112   - 
          */
    -  113   - 
         public boolean isReference() {
    -  114  8 
             return refid != null;
    -  115   - 
         }
    -  116   - 
     
    -  117   - 
         /**
    -  118   - 
          * Add a reference to a Path, FileSet, DirSet, or FileList defined
    -  119   - 
          * elsewhere.
    -  120   - 
          *
    -  121   - 
          * @param r the reference to a path, fileset, dirset or filelist.
    -  122   - 
          */
    -  123   - 
         public void setRefid(Reference r) {
    -  124  0 
             if (path != null) {
    -  125  0 
                 throw new BuildException("Nested elements are not allowed when using the refid attribute.");
    -  126   
             }
    -  127  0 
             refid = r;
    -  128  0 
         }
    -  129   +  107  8 
             return path;
    +  108   + 
         }
    +  109   
     
    -  130   +  110   
         /**
    +  111   + 
          * Learn whether the refid attribute of this element been set.
    +  112   + 
          *
    +  113   + 
          * @return true if refid is valid.
    +  114   + 
          */
    +  115   + 
         public boolean isReference() {
    +  116  16 
             return refid != null;
    +  117   + 
         }
    +  118   + 
     
    +  119   + 
         /**
    +  120   + 
          * Add a reference to a Path, FileSet, DirSet, or FileList defined elsewhere.
    +  121   + 
          *
    +  122   + 
          * @param r the reference to a path, fileset, dirset or filelist.
    +  123   + 
          */
    +  124   + 
         public void setRefid(Reference r) {
    +  125  0 
             if (path != null) {
    +  126  0 
                 throw new BuildException("Nested elements are not allowed when using the refid attribute.");
    +  127   + 
             }
    +  128  0 
             refid = r;
    +  129  0 
         }
    +  130   + 
     
     131   - 
          * If this is a reference, this method will add the referenced resource
    + 
         /**
     132   - 
          * collection to the collection of paths.
    + 
          * If this is a reference, this method will add the referenced resource collection to the collection of paths.
     133   
          *
     134   @@ -272,7 +272,7 @@ 
          */
     136   
         private void dealWithReferences() throws BuildException {
    -  137  4 
             if (isReference()) {
    +  137  8 
             if (isReference()) {
     138  0 
                 final Object o = refid.getReferencedObject(getProject());
     139  0 
                 if (!(o instanceof ResourceCollection)) {
     140  0 
                     throw new BuildException("refid '" + refid.getRefId()
    @@ -283,7 +283,7 @@  143  0 
                 getPath().add((ResourceCollection) o);
     144   
             }
    -  145  4 
         }
    +  145  8 
         }
     146   
         // END COPY from org.apache.tools.ant.taskdefs
     147   @@ -292,7 +292,7 @@ 
          * The application name for the report.
     149   
          */
    -  150  4 
         private String applicationName = "Dependency-Check";
    +  150  8 
         private String applicationName = "Dependency-Check";
     151   
     
     152   @@ -324,15 +324,15 @@ 
          */
     166   
         public void setApplicationName(String applicationName) {
    -  167  4 
             this.applicationName = applicationName;
    -  168  4 
         }
    +  167  8 
             this.applicationName = applicationName;
    +  168  8 
         }
     169   
         /**
     170   
          * The location of the data directory that contains
     171   
          */
    -  172  4 
         private String dataDirectory = null;
    +  172  8 
         private String dataDirectory = null;
     173   
     
     174   @@ -369,801 +369,1121 @@  191   
         /**
     192   - 
          * Specifies the destination directory for the generated Dependency-Check
    + 
          * Specifies the destination directory for the generated Dependency-Check report.
     193   - 
          * report.
    -  194   
          */
    -  195  4 
         private String reportOutputDirectory = ".";
    +  194  8 
         private String reportOutputDirectory = ".";
    +  195   + 
     
     196   - 
     
    + 
         /**
     197   - 
         /**
    -  198   
          * Get the value of reportOutputDirectory.
    +  198   + 
          *
     199   - 
          *
    -  200   
          * @return the value of reportOutputDirectory
    +  200   + 
          */
     201   - 
          */
    -  202   
         public String getReportOutputDirectory() {
    -  203  0 
             return reportOutputDirectory;
    +  202  0 
             return reportOutputDirectory;
    +  203   + 
         }
     204   - 
         }
    + 
     
     205   - 
     
    + 
         /**
     206   - 
         /**
    -  207   
          * Set the value of reportOutputDirectory.
    +  207   + 
          *
     208   - 
          *
    -  209   
          * @param reportOutputDirectory new value of reportOutputDirectory
    +  209   + 
          */
     210   - 
          */
    -  211   
         public void setReportOutputDirectory(String reportOutputDirectory) {
    -  212  4 
             this.reportOutputDirectory = reportOutputDirectory;
    -  213  4 
         }
    +  211  8 
             this.reportOutputDirectory = reportOutputDirectory;
    +  212  8 
         }
    +  213   + 
         /**
     214   - 
         /**
    + 
          * Specifies if the build should be failed if a CVSS score above a specified level is identified. The default is 11
     215   - 
          * Specifies if the build should be failed if a CVSS score above a specified
    + 
          * which means since the CVSS scores are 0-10, by default the build will never fail and the CVSS score is set to 11.
     216   - 
          * level is identified. The default is 11 which means since the CVSS scores
    + 
          * The valid range for the fail build on CVSS is 0 to 11, where anything above 10 will not cause the build to fail.
     217   - 
          * are 0-10, by default the build will never fail and the CVSS score is set
    -  218   - 
          * to 11. The valid range for the fail build on CVSS is 0 to 11, where
    + 
          */
    +  218  8 
         private float failBuildOnCVSS = 11;
     219   - 
          * anything above 10 will not cause the build to fail.
    + 
     
     220   - 
          */
    -  221  4 
         private float failBuildOnCVSS = 11;
    -  222   - 
     
    -  223   
         /**
    -  224   +  221   
          * Get the value of failBuildOnCVSS.
    -  225   +  222   
          *
    -  226   +  223   
          * @return the value of failBuildOnCVSS
    -  227   +  224   
          */
    -  228   +  225   
         public float getFailBuildOnCVSS() {
    -  229  0 
             return failBuildOnCVSS;
    +  226  0 
             return failBuildOnCVSS;
    +  227   + 
         }
    +  228   + 
     
    +  229   + 
         /**
     230   - 
         }
    -  231   - 
     
    -  232   - 
         /**
    -  233   
          * Set the value of failBuildOnCVSS.
    -  234   +  231   
          *
    -  235   +  232   
          * @param failBuildOnCVSS new value of failBuildOnCVSS
    -  236   +  233   
          */
    -  237   +  234   
         public void setFailBuildOnCVSS(float failBuildOnCVSS) {
    -  238  1 
             this.failBuildOnCVSS = failBuildOnCVSS;
    -  239  1 
         }
    +  235  2 
             this.failBuildOnCVSS = failBuildOnCVSS;
    +  236  2 
         }
    +  237   + 
         /**
    +  238   + 
          * Sets whether auto-updating of the NVD CVE/CPE data is enabled. It is not recommended that this be turned to
    +  239   + 
          * false. Default is true.
     240   - 
         /**
    -  241   - 
          * Sets whether auto-updating of the NVD CVE/CPE data is enabled. It is not
    + 
          */
    +  241  8 
         private boolean autoUpdate = true;
     242   - 
          * recommended that this be turned to false. Default is true.
    + 
     
     243   - 
          */
    -  244  4 
         private boolean autoUpdate = true;
    -  245   - 
     
    -  246   
         /**
    -  247   +  244   
          * Get the value of autoUpdate.
    -  248   +  245   
          *
    -  249   +  246   
          * @return the value of autoUpdate
    -  250   +  247   
          */
    -  251   +  248   
         public boolean isAutoUpdate() {
    -  252  0 
             return autoUpdate;
    +  249  0 
             return autoUpdate;
    +  250   + 
         }
    +  251   + 
     
    +  252   + 
         /**
     253   - 
         }
    -  254   - 
     
    -  255   - 
         /**
    -  256   
          * Set the value of autoUpdate.
    -  257   +  254   
          *
    -  258   +  255   
          * @param autoUpdate new value of autoUpdate
    -  259   +  256   
          */
    -  260   +  257   
         public void setAutoUpdate(boolean autoUpdate) {
    -  261  4 
             this.autoUpdate = autoUpdate;
    -  262  4 
         }
    +  258  8 
             this.autoUpdate = autoUpdate;
    +  259  8 
         }
    +  260   + 
         /**
    +  261   + 
          * The report format to be generated (HTML, XML, VULN, ALL). This configuration option has no affect if using this
    +  262   + 
          * within the Site plugin unless the externalReport is set to true. Default is HTML.
     263   - 
         /**
    -  264   - 
          * The report format to be generated (HTML, XML, VULN, ALL). This
    + 
          */
    +  264  8 
         private String reportFormat = "HTML";
     265   - 
          * configuration option has no affect if using this within the Site plugin
    + 
     
     266   - 
          * unless the externalReport is set to true. Default is HTML.
    + 
         /**
     267   - 
          */
    -  268  4 
         private String reportFormat = "HTML";
    -  269   - 
     
    -  270   - 
         /**
    -  271   
          * Get the value of reportFormat.
    -  272   +  268   
          *
    -  273   +  269   
          * @return the value of reportFormat
    -  274   +  270   
          */
    -  275   +  271   
         public String getReportFormat() {
    -  276  0 
             return reportFormat;
    -  277   +  272  0 
             return reportFormat;
    +  273   
         }
    -  278   +  274   
     
    -  279   +  275   
         /**
    -  280   +  276   
          * Set the value of reportFormat.
    -  281   +  277   
          *
    -  282   +  278   
          * @param reportFormat new value of reportFormat
    -  283   +  279   
          */
    -  284   +  280   
         public void setReportFormat(ReportFormats reportFormat) {
    -  285  4 
             this.reportFormat = reportFormat.getValue();
    -  286  4 
         }
    -  287   +  281  8 
             this.reportFormat = reportFormat.getValue();
    +  282  8 
         }
    +  283   
         /**
    -  288   +  284   
          * The Proxy URL.
    -  289   +  285   
          */
    -  290   +  286   
         private String proxyUrl;
    -  291   +  287   
     
    -  292   +  288   
         /**
    -  293   +  289   
          * Get the value of proxyUrl.
    -  294   +  290   
          *
    -  295   +  291   
          * @return the value of proxyUrl
    -  296   +  292   
          */
    -  297   +  293   
         public String getProxyUrl() {
    -  298  0 
             return proxyUrl;
    -  299   +  294  0 
             return proxyUrl;
    +  295   
         }
    -  300   +  296   
     
    -  301   +  297   
         /**
    -  302   +  298   
          * Set the value of proxyUrl.
    -  303   +  299   
          *
    -  304   +  300   
          * @param proxyUrl new value of proxyUrl
    -  305   +  301   
          */
    -  306   +  302   
         public void setProxyUrl(String proxyUrl) {
    -  307  0 
             this.proxyUrl = proxyUrl;
    -  308  0 
         }
    -  309   +  303  0 
             this.proxyUrl = proxyUrl;
    +  304  0 
         }
    +  305   
         /**
    -  310   +  306   
          * The Proxy Port.
    -  311   +  307   
          */
    -  312   +  308   
         private String proxyPort;
    -  313   +  309   
     
    -  314   +  310   
         /**
    -  315   +  311   
          * Get the value of proxyPort.
    -  316   +  312   
          *
    -  317   +  313   
          * @return the value of proxyPort
    -  318   +  314   
          */
    -  319   +  315   
         public String getProxyPort() {
    -  320  0 
             return proxyPort;
    -  321   +  316  0 
             return proxyPort;
    +  317   
         }
    -  322   +  318   
     
    -  323   +  319   
         /**
    -  324   +  320   
          * Set the value of proxyPort.
    -  325   +  321   
          *
    -  326   +  322   
          * @param proxyPort new value of proxyPort
    -  327   +  323   
          */
    -  328   +  324   
         public void setProxyPort(String proxyPort) {
    -  329  0 
             this.proxyPort = proxyPort;
    -  330  0 
         }
    -  331   +  325  0 
             this.proxyPort = proxyPort;
    +  326  0 
         }
    +  327   
         /**
    -  332   +  328   
          * The Proxy username.
    -  333   +  329   
          */
    -  334   +  330   
         private String proxyUsername;
    -  335   +  331   
     
    -  336   +  332   
         /**
    -  337   +  333   
          * Get the value of proxyUsername.
    -  338   +  334   
          *
    -  339   +  335   
          * @return the value of proxyUsername
    -  340   +  336   
          */
    -  341   +  337   
         public String getProxyUsername() {
    -  342  0 
             return proxyUsername;
    -  343   +  338  0 
             return proxyUsername;
    +  339   
         }
    -  344   +  340   
     
    -  345   +  341   
         /**
    -  346   +  342   
          * Set the value of proxyUsername.
    -  347   +  343   
          *
    -  348   +  344   
          * @param proxyUsername new value of proxyUsername
    -  349   +  345   
          */
    -  350   +  346   
         public void setProxyUsername(String proxyUsername) {
    -  351  0 
             this.proxyUsername = proxyUsername;
    -  352  0 
         }
    -  353   +  347  0 
             this.proxyUsername = proxyUsername;
    +  348  0 
         }
    +  349   
         /**
    -  354   +  350   
          * The Proxy password.
    -  355   +  351   
          */
    -  356   +  352   
         private String proxyPassword;
    -  357   +  353   
     
    -  358   +  354   
         /**
    -  359   +  355   
          * Get the value of proxyPassword.
    -  360   +  356   
          *
    -  361   +  357   
          * @return the value of proxyPassword
    -  362   +  358   
          */
    -  363   +  359   
         public String getProxyPassword() {
    -  364  0 
             return proxyPassword;
    -  365   +  360  0 
             return proxyPassword;
    +  361   
         }
    -  366   +  362   
     
    -  367   +  363   
         /**
    -  368   +  364   
          * Set the value of proxyPassword.
    -  369   +  365   
          *
    -  370   +  366   
          * @param proxyPassword new value of proxyPassword
    -  371   +  367   
          */
    -  372   +  368   
         public void setProxyPassword(String proxyPassword) {
    -  373  0 
             this.proxyPassword = proxyPassword;
    -  374  0 
         }
    -  375   +  369  0 
             this.proxyPassword = proxyPassword;
    +  370  0 
         }
    +  371   
         /**
    -  376   +  372   
          * The Connection Timeout.
    -  377   +  373   
          */
    -  378   +  374   
         private String connectionTimeout;
    -  379   +  375   
     
    -  380   +  376   
         /**
    -  381   +  377   
          * Get the value of connectionTimeout.
    -  382   +  378   
          *
    -  383   +  379   
          * @return the value of connectionTimeout
    -  384   +  380   
          */
    -  385   +  381   
         public String getConnectionTimeout() {
    -  386  0 
             return connectionTimeout;
    -  387   +  382  0 
             return connectionTimeout;
    +  383   
         }
    -  388   +  384   
     
    -  389   +  385   
         /**
    -  390   +  386   
          * Set the value of connectionTimeout.
    -  391   +  387   
          *
    -  392   +  388   
          * @param connectionTimeout new value of connectionTimeout
    -  393   +  389   
          */
    -  394   +  390   
         public void setConnectionTimeout(String connectionTimeout) {
    -  395  0 
             this.connectionTimeout = connectionTimeout;
    -  396  0 
         }
    -  397   +  391  0 
             this.connectionTimeout = connectionTimeout;
    +  392  0 
         }
    +  393   
         /**
    -  398   +  394   
          * The file path used for verbose logging.
    +  395   + 
          */
    +  396  8 
         private String logFile = null;
    +  397   + 
     
    +  398   + 
         /**
     399   - 
          */
    -  400  4 
         private String logFile = null;
    -  401   - 
     
    -  402   - 
         /**
    -  403   
          * Get the value of logFile.
    -  404   +  400   
          *
    -  405   +  401   
          * @return the value of logFile
    -  406   +  402   
          */
    -  407   +  403   
         public String getLogFile() {
    -  408  0 
             return logFile;
    -  409   +  404  0 
             return logFile;
    +  405   
         }
    -  410   +  406   
     
    -  411   +  407   
         /**
    -  412   +  408   
          * Set the value of logFile.
    -  413   +  409   
          *
    -  414   +  410   
          * @param logFile new value of logFile
    -  415   +  411   
          */
    -  416   +  412   
         public void setLogFile(String logFile) {
    -  417  0 
             this.logFile = logFile;
    -  418  0 
         }
    -  419   +  413  0 
             this.logFile = logFile;
    +  414  0 
         }
    +  415   
         /**
    -  420   +  416   
          * The path to the suppression file.
    -  421   +  417   
          */
    -  422   +  418   
         private String suppressionFile;
    -  423   +  419   
     
    -  424   +  420   
         /**
    -  425   +  421   
          * Get the value of suppressionFile.
    -  426   +  422   
          *
    -  427   +  423   
          * @return the value of suppressionFile
    -  428   +  424   
          */
    -  429   +  425   
         public String getSuppressionFile() {
    -  430  0 
             return suppressionFile;
    -  431   +  426  0 
             return suppressionFile;
    +  427   
         }
    -  432   +  428   
     
    -  433   +  429   
         /**
    -  434   +  430   
          * Set the value of suppressionFile.
    -  435   +  431   
          *
    -  436   +  432   
          * @param suppressionFile new value of suppressionFile
    -  437   +  433   
          */
    -  438   +  434   
         public void setSuppressionFile(String suppressionFile) {
    -  439  0 
             this.suppressionFile = suppressionFile;
    -  440  0 
         }
    -  441   +  435  0 
             this.suppressionFile = suppressionFile;
    +  436  0 
         }
    +  437   
         /**
    -  442   +  438   
          * flag indicating whether or not to show a summary of findings.
    +  439   + 
          */
    +  440  8 
         private boolean showSummary = true;
    +  441   + 
     
    +  442   + 
         /**
     443   - 
          */
    -  444  4 
         private boolean showSummary = true;
    -  445   - 
     
    -  446   - 
         /**
    -  447   
          * Get the value of showSummary.
    -  448   +  444   
          *
    -  449   +  445   
          * @return the value of showSummary
    -  450   +  446   
          */
    -  451   +  447   
         public boolean isShowSummary() {
    -  452  0 
             return showSummary;
    -  453   +  448  0 
             return showSummary;
    +  449   
         }
    -  454   +  450   
     
    -  455   +  451   
         /**
    -  456   +  452   
          * Set the value of showSummary.
    -  457   +  453   
          *
    -  458   +  454   
          * @param showSummary new value of showSummary
    -  459   +  455   
          */
    -  460   +  456   
         public void setShowSummary(boolean showSummary) {
    -  461  0 
             this.showSummary = showSummary;
    -  462  0 
         }
    -  463   +  457  0 
             this.showSummary = showSummary;
    +  458  0 
         }
    +  459   
     
    +  460   + 
         /**
    +  461   + 
          * Whether or not the nexus analyzer is enabled.
    +  462   + 
          */
    +  463  8 
         private boolean nexusAnalyzerEnabled = true;
     464   - 
         @Override
    + 
     
     465   - 
         public void execute() throws BuildException {
    -  466  4 
             final InputStream in = DependencyCheckTask.class.getClassLoader().getResourceAsStream(LOG_PROPERTIES_FILE);
    -  467  4 
             LogUtils.prepareLogger(in, logFile);
    + 
         /**
    +  466   + 
          * Get the value of nexusAnalyzerEnabled.
    +  467   + 
          *
     468   - 
     
    -  469  4 
             dealWithReferences();
    -  470  4 
             validateConfiguration();
    -  471  3 
             populateSettings();
    + 
          * @return the value of nexusAnalyzerEnabled
    +  469   + 
          */
    +  470   + 
         public boolean isNexusAnalyzerEnabled() {
    +  471  0 
             return nexusAnalyzerEnabled;
     472   + 
         }
    +  473   + 
     
    +  474   + 
         /**
    +  475   + 
          * Set the value of nexusAnalyzerEnabled.
    +  476   + 
          *
    +  477   + 
          * @param nexusAnalyzerEnabled new value of nexusAnalyzerEnabled
    +  478   + 
          */
    +  479   + 
         public void setNexusAnalyzerEnabled(boolean nexusAnalyzerEnabled) {
    +  480  0 
             this.nexusAnalyzerEnabled = nexusAnalyzerEnabled;
    +  481  0 
         }
    +  482   
     
    -  473  3 
             final Engine engine = new Engine();
    -  474  3 
             for (Resource resource : path) {
    -  475  5 
                 final FileProvider provider = resource.as(FileProvider.class);
    -  476  5 
                 if (provider != null) {
    -  477  5 
                     final File file = provider.getFile();
    -  478  5 
                     if (file != null && file.exists()) {
    -  479  4 
                         engine.scan(file);
    -  480   - 
                     }
    -  481   - 
                 }
    -  482  5 
             }
     483   - 
             try {
    -  484  3 
                 engine.analyzeDependencies();
    -  485  3 
                 final ReportGenerator reporter = new ReportGenerator(applicationName, engine.getDependencies(), engine.getAnalyzers());
    -  486  3 
                 reporter.generateReports(reportOutputDirectory, reportFormat);
    + 
         /**
    +  484   + 
          * The URL of the Nexus server.
    +  485   + 
          */
    +  486   + 
         private String nexusUrl;
     487   
     
    -  488  3 
                 if (this.failBuildOnCVSS <= 10) {
    -  489  0 
                     checkForFailure(engine.getDependencies());
    -  490   - 
                 }
    -  491  3 
                 if (this.showSummary) {
    -  492  3 
                     showSummary(engine.getDependencies());
    -  493   - 
                 }
    -  494  0 
             } catch (IOException ex) {
    -  495  0 
                 Logger.getLogger(DependencyCheckTask.class.getName()).log(Level.FINE, "Unable to generate dependency-check report", ex);
    -  496  0 
                 throw new BuildException("Unable to generate dependency-check report", ex);
    -  497  0 
             } catch (Exception ex) {
    -  498  0 
                 Logger.getLogger(DependencyCheckTask.class.getName()).log(Level.FINE, "An exception occurred; unable to continue task", ex);
    -  499  0 
                 throw new BuildException("An exception occurred; unable to continue task", ex);
    -  500  3 
             }
    -  501  3 
         }
    -  502   - 
     
    -  503   +  488   
         /**
    -  504   - 
          * Validate the configuration to ensure the parameters have been properly
    -  505   - 
          * configured/initialized.
    -  506   +  489   + 
          * Get the value of nexusUrl.
    +  490   
          *
    +  491   + 
          * @return the value of nexusUrl
    +  492   + 
          */
    +  493   + 
         public String getNexusUrl() {
    +  494  0 
             return nexusUrl;
    +  495   + 
         }
    +  496   + 
     
    +  497   + 
         /**
    +  498   + 
          * Set the value of nexusUrl.
    +  499   + 
          *
    +  500   + 
          * @param nexusUrl new value of nexusUrl
    +  501   + 
          */
    +  502   + 
         public void setNexusUrl(String nexusUrl) {
    +  503  0 
             this.nexusUrl = nexusUrl;
    +  504  0 
         }
    +  505   + 
     
    +  506   + 
         /**
     507   - 
          * @throws BuildException if the task was not configured correctly.
    + 
          * The database driver name; such as org.h2.Driver.
     508   
          */
     509   - 
         private void validateConfiguration() throws BuildException {
    -  510  4 
             if (path == null) {
    -  511  1 
                 throw new BuildException("No project dependencies have been defined to analyze.");
    + 
         private String databaseDriverName;
    +  510   + 
     
    +  511   + 
         /**
     512   - 
             }
    -  513  3 
             if (failBuildOnCVSS < 0 || failBuildOnCVSS > 11) {
    -  514  0 
                 throw new BuildException("Invalid configuration, failBuildOnCVSS must be between 0 and 11.");
    -  515   - 
             }
    -  516  3 
         }
    -  517   - 
     
    -  518   - 
         /**
    -  519   - 
          * Takes the properties supplied and updates the dependency-check settings.
    -  520   - 
          * Additionally, this sets the system properties required to change the
    -  521   - 
          * proxy url, port, and connection timeout.
    -  522   - 
          */
    -  523   - 
         private void populateSettings() {
    -  524  3 
             InputStream taskProperties = null;
    -  525   - 
             try {
    -  526  3 
                 taskProperties = this.getClass().getClassLoader().getResourceAsStream(PROPERTIES_FILE);
    -  527  3 
                 Settings.mergeProperties(taskProperties);
    -  528  0 
             } catch (IOException ex) {
    -  529  0 
                 Logger.getLogger(DependencyCheckTask.class.getName()).log(Level.WARNING, "Unable to load the dependency-check ant task.properties file.");
    -  530  0 
                 Logger.getLogger(DependencyCheckTask.class.getName()).log(Level.FINE, null, ex);
    -  531   - 
             } finally {
    -  532  3 
                 if (taskProperties != null) {
    -  533   - 
                     try {
    -  534  3 
                         taskProperties.close();
    -  535  0 
                     } catch (IOException ex) {
    -  536  0 
                         Logger.getLogger(DependencyCheckTask.class.getName()).log(Level.FINEST, null, ex);
    -  537  3 
                     }
    -  538   - 
                 }
    -  539   - 
             }
    -  540  3 
             if (dataDirectory != null) {
    -  541  0 
                 Settings.setString(Settings.KEYS.DATA_DIRECTORY, dataDirectory);
    -  542   - 
             } else {
    -  543  3 
                 final File jarPath = new File(DependencyCheckTask.class.getProtectionDomain().getCodeSource().getLocation().getPath());
    -  544  3 
                 final File base = jarPath.getParentFile();
    -  545  3 
                 final String sub = Settings.getString(Settings.KEYS.DATA_DIRECTORY);
    -  546  3 
                 final File dataDir = new File(base, sub);
    -  547  3 
                 Settings.setString(Settings.KEYS.DATA_DIRECTORY, dataDir.getAbsolutePath());
    -  548   - 
             }
    -  549   - 
     
    -  550  3 
             Settings.setBoolean(Settings.KEYS.AUTO_UPDATE, autoUpdate);
    -  551   - 
     
    -  552  3 
             if (proxyUrl != null && !proxyUrl.isEmpty()) {
    -  553  0 
                 Settings.setString(Settings.KEYS.PROXY_URL, proxyUrl);
    -  554   - 
             }
    -  555  3 
             if (proxyPort != null && !proxyPort.isEmpty()) {
    -  556  0 
                 Settings.setString(Settings.KEYS.PROXY_PORT, proxyPort);
    -  557   - 
             }
    -  558  3 
             if (proxyUsername != null && !proxyUsername.isEmpty()) {
    -  559  0 
                 Settings.setString(Settings.KEYS.PROXY_USERNAME, proxyUsername);
    -  560   - 
             }
    -  561  3 
             if (proxyPassword != null && !proxyPassword.isEmpty()) {
    -  562  0 
                 Settings.setString(Settings.KEYS.PROXY_PASSWORD, proxyPassword);
    -  563   - 
             }
    -  564  3 
             if (connectionTimeout != null && !connectionTimeout.isEmpty()) {
    -  565  0 
                 Settings.setString(Settings.KEYS.CONNECTION_TIMEOUT, connectionTimeout);
    -  566   - 
             }
    -  567  3 
             if (suppressionFile != null && !suppressionFile.isEmpty()) {
    -  568  0 
                 Settings.setString(Settings.KEYS.SUPPRESSION_FILE, suppressionFile);
    -  569   - 
             }
    -  570  3 
         }
    -  571   - 
     
    -  572   - 
         /**
    -  573   - 
          * Checks to see if a vulnerability has been identified with a CVSS score
    -  574   - 
          * that is above the threshold set in the configuration.
    -  575   + 
          * Get the value of databaseDriverName.
    +  513   
          *
    -  576   - 
          * @param dependencies the list of dependency objects
    -  577   - 
          * @throws BuildException thrown if a CVSS score is found that is higher
    -  578   - 
          * then the threshold set
    -  579   +  514   + 
          * @return the value of databaseDriverName
    +  515   
          */
    +  516   + 
         public String getDatabaseDriverName() {
    +  517  0 
             return databaseDriverName;
    +  518   + 
         }
    +  519   + 
     
    +  520   + 
         /**
    +  521   + 
          * Set the value of databaseDriverName.
    +  522   + 
          *
    +  523   + 
          * @param databaseDriverName new value of databaseDriverName
    +  524   + 
          */
    +  525   + 
         public void setDatabaseDriverName(String databaseDriverName) {
    +  526  0 
             this.databaseDriverName = databaseDriverName;
    +  527  0 
         }
    +  528   + 
     
    +  529   + 
         /**
    +  530   + 
          * The path to the database driver JAR file if it is not on the class path.
    +  531   + 
          */
    +  532   + 
         private String databaseDriverPath;
    +  533   + 
     
    +  534   + 
         /**
    +  535   + 
          * Get the value of databaseDriverPath.
    +  536   + 
          *
    +  537   + 
          * @return the value of databaseDriverPath
    +  538   + 
          */
    +  539   + 
         public String getDatabaseDriverPath() {
    +  540  0 
             return databaseDriverPath;
    +  541   + 
         }
    +  542   + 
     
    +  543   + 
         /**
    +  544   + 
          * Set the value of databaseDriverPath.
    +  545   + 
          *
    +  546   + 
          * @param databaseDriverPath new value of databaseDriverPath
    +  547   + 
          */
    +  548   + 
         public void setDatabaseDriverPath(String databaseDriverPath) {
    +  549  0 
             this.databaseDriverPath = databaseDriverPath;
    +  550  0 
         }
    +  551   + 
         /**
    +  552   + 
          * The database connection string.
    +  553   + 
          */
    +  554   + 
         private String connectionString;
    +  555   + 
     
    +  556   + 
         /**
    +  557   + 
          * Get the value of connectionString.
    +  558   + 
          *
    +  559   + 
          * @return the value of connectionString
    +  560   + 
          */
    +  561   + 
         public String getConnectionString() {
    +  562  0 
             return connectionString;
    +  563   + 
         }
    +  564   + 
     
    +  565   + 
         /**
    +  566   + 
          * Set the value of connectionString.
    +  567   + 
          *
    +  568   + 
          * @param connectionString new value of connectionString
    +  569   + 
          */
    +  570   + 
         public void setConnectionString(String connectionString) {
    +  571  0 
             this.connectionString = connectionString;
    +  572  0 
         }
    +  573   + 
         /**
    +  574   + 
          * The user name for connecting to the database.
    +  575   + 
          */
    +  576   + 
         private String databaseUser;
    +  577   + 
     
    +  578   + 
         /**
    +  579   + 
          * Get the value of databaseUser.
     580   - 
         private void checkForFailure(List<Dependency> dependencies) throws BuildException {
    -  581  0 
             final StringBuilder ids = new StringBuilder();
    -  582  0 
             for (Dependency d : dependencies) {
    -  583  0 
                 for (Vulnerability v : d.getVulnerabilities()) {
    -  584  0 
                     if (v.getCvssScore() >= failBuildOnCVSS) {
    -  585  0 
                         if (ids.length() == 0) {
    -  586  0 
                             ids.append(v.getName());
    + 
          *
    +  581   + 
          * @return the value of databaseUser
    +  582   + 
          */
    +  583   + 
         public String getDatabaseUser() {
    +  584  0 
             return databaseUser;
    +  585   + 
         }
    +  586   + 
     
     587   - 
                         } else {
    -  588  0 
                             ids.append(", ").append(v.getName());
    + 
         /**
    +  588   + 
          * Set the value of databaseUser.
     589   - 
                         }
    + 
          *
     590   - 
                     }
    -  591  0 
                 }
    -  592  0 
             }
    -  593  0 
             if (ids.length() > 0) {
    -  594  0 
                 final String msg = String.format("%n%nDependency-Check Failure:%n"
    + 
          * @param databaseUser new value of databaseUser
    +  591   + 
          */
    +  592   + 
         public void setDatabaseUser(String databaseUser) {
    +  593  0 
             this.databaseUser = databaseUser;
    +  594  0 
         }
     595   - 
                         + "One or more dependencies were identified with vulnerabilities that have a CVSS score greater then '%.1f': %s%n"
    + 
     
     596   - 
                         + "See the dependency-check report for more details.%n%n", failBuildOnCVSS, ids.toString());
    -  597  0 
                 throw new BuildException(msg);
    + 
         /**
    +  597   + 
          * The password to use when connecting to the database.
     598   - 
             }
    -  599  0 
         }
    + 
          */
    +  599   + 
         private String databasePassword;
     600   
     
     601   
         /**
     602   - 
          * Generates a warning message listing a summary of dependencies and their
    + 
          * Get the value of databasePassword.
     603   - 
          * associated CPE and CVE entries.
    -  604   
          *
    +  604   + 
          * @return the value of databasePassword
     605   - 
          * @param dependencies a list of dependency objects
    + 
          */
     606   - 
          */
    -  607   - 
         private void showSummary(List<Dependency> dependencies) {
    -  608  3 
             final StringBuilder summary = new StringBuilder();
    -  609  3 
             for (Dependency d : dependencies) {
    -  610  5 
                 boolean firstEntry = true;
    -  611  5 
                 final StringBuilder ids = new StringBuilder();
    -  612  5 
                 for (Vulnerability v : d.getVulnerabilities()) {
    -  613  20 
                     if (firstEntry) {
    -  614  4 
                         firstEntry = false;
    -  615   - 
                     } else {
    -  616  16 
                         ids.append(", ");
    -  617   - 
                     }
    -  618  20 
                     ids.append(v.getName());
    -  619  20 
                 }
    -  620  5 
                 if (ids.length() > 0) {
    -  621  4 
                     summary.append(d.getFileName()).append(" (");
    -  622  4 
                     firstEntry = true;
    -  623  4 
                     for (Identifier id : d.getIdentifiers()) {
    -  624  12 
                         if (firstEntry) {
    -  625  4 
                             firstEntry = false;
    -  626   - 
                         } else {
    -  627  8 
                             summary.append(", ");
    -  628   - 
                         }
    -  629  12 
                         summary.append(id.getValue());
    -  630  12 
                     }
    -  631  4 
                     summary.append(") : ").append(ids).append(NEW_LINE);
    -  632   - 
                 }
    -  633  5 
             }
    -  634  3 
             if (summary.length() > 0) {
    -  635  3 
                 final String msg = String.format("%n%n"
    -  636   - 
                         + "One or more dependencies were identified with known vulnerabilities:%n%n%s"
    -  637   - 
                         + "%n%nSee the dependency-check report for more details.%n%n", summary.toString());
    -  638  3 
                 Logger.getLogger(DependencyCheckTask.class.getName()).log(Level.WARNING, msg);
    -  639   - 
             }
    -  640  3 
         }
    -  641   - 
     
    -  642   - 
         /**
    -  643   - 
          * An enumeration of supported report formats: "ALL", "HTML", "XML", "VULN",
    -  644   - 
          * etc..
    -  645   - 
          */
    -  646  4 
         public static class ReportFormats extends EnumeratedAttribute {
    -  647   - 
     
    -  648   - 
             /**
    -  649   - 
              * Returns the list of values for the report format.
    -  650   - 
              *
    -  651   - 
              * @return the list of values for the report format
    -  652   - 
              */
    -  653   - 
             @Override
    -  654   - 
             public String[] getValues() {
    -  655  4 
                 int i = 0;
    -  656  4 
                 final Format[] formats = Format.values();
    -  657  4 
                 final String[] values = new String[formats.length];
    -  658  20 
                 for (Format format : formats) {
    -  659  16 
                     values[i++] = format.name();
    -  660   - 
                 }
    -  661  4 
                 return values;
    -  662   - 
             }
    -  663   + 
         public String getDatabasePassword() {
    +  607  0 
             return databasePassword;
    +  608   
         }
    -  664   +  609   + 
     
    +  610   + 
         /**
    +  611   + 
          * Set the value of databasePassword.
    +  612   + 
          *
    +  613   + 
          * @param databasePassword new value of databasePassword
    +  614   + 
          */
    +  615   + 
         public void setDatabasePassword(String databasePassword) {
    +  616  0 
             this.databasePassword = databasePassword;
    +  617  0 
         }
    +  618   + 
     
    +  619   + 
         @Override
    +  620   + 
         public void execute() throws BuildException {
    +  621  8 
             final InputStream in = DependencyCheckTask.class.getClassLoader().getResourceAsStream(LOG_PROPERTIES_FILE);
    +  622  8 
             LogUtils.prepareLogger(in, logFile);
    +  623   + 
     
    +  624  8 
             dealWithReferences();
    +  625  8 
             validateConfiguration();
    +  626  6 
             populateSettings();
    +  627   + 
     
    +  628  6 
             final Engine engine = new Engine();
    +  629  6 
             for (Resource resource : path) {
    +  630  10 
                 final FileProvider provider = resource.as(FileProvider.class);
    +  631  10 
                 if (provider != null) {
    +  632  10 
                     final File file = provider.getFile();
    +  633  10 
                     if (file != null && file.exists()) {
    +  634  8 
                         engine.scan(file);
    +  635   + 
                     }
    +  636   + 
                 }
    +  637  10 
             }
    +  638   + 
             try {
    +  639  6 
                 engine.analyzeDependencies();
    +  640  6 
                 DatabaseProperties prop = null;
    +  641  6 
                 CveDB cve = null;
    +  642   + 
                 try {
    +  643  6 
                     cve = new CveDB();
    +  644  6 
                     cve.open();
    +  645  6 
                     prop = cve.getDatabaseProperties();
    +  646  0 
                 } catch (DatabaseException ex) {
    +  647  0 
                     Logger.getLogger(DependencyCheckTask.class.getName()).log(Level.FINE, "Unable to retrieve DB Properties", ex);
    +  648   + 
                 } finally {
    +  649  6 
                     if (cve != null) {
    +  650  6 
                         cve.close();
    +  651   + 
                     }
    +  652   + 
                 }
    +  653  6 
                 final ReportGenerator reporter = new ReportGenerator(applicationName, engine.getDependencies(), engine.getAnalyzers(), prop);
    +  654  6 
                 reporter.generateReports(reportOutputDirectory, reportFormat);
    +  655   + 
     
    +  656  6 
                 if (this.failBuildOnCVSS <= 10) {
    +  657  0 
                     checkForFailure(engine.getDependencies());
    +  658   + 
                 }
    +  659  6 
                 if (this.showSummary) {
    +  660  6 
                     showSummary(engine.getDependencies());
    +  661   + 
                 }
    +  662  0 
             } catch (IOException ex) {
    +  663  0 
                 Logger.getLogger(DependencyCheckTask.class.getName()).log(Level.FINE, "Unable to generate dependency-check report", ex);
    +  664  0 
                 throw new BuildException("Unable to generate dependency-check report", ex);
    +  665  0 
             } catch (Exception ex) {
    +  666  0 
                 Logger.getLogger(DependencyCheckTask.class.getName()).log(Level.FINE, "An exception occurred; unable to continue task", ex);
    +  667  0 
                 throw new BuildException("An exception occurred; unable to continue task", ex);
    +  668  6 
             }
    +  669  6 
         }
    +  670   + 
     
    +  671   + 
         /**
    +  672   + 
          * Validate the configuration to ensure the parameters have been properly configured/initialized.
    +  673   + 
          *
    +  674   + 
          * @throws BuildException if the task was not configured correctly.
    +  675   + 
          */
    +  676   + 
         private void validateConfiguration() throws BuildException {
    +  677  8 
             if (path == null) {
    +  678  2 
                 throw new BuildException("No project dependencies have been defined to analyze.");
    +  679   + 
             }
    +  680  6 
             if (failBuildOnCVSS < 0 || failBuildOnCVSS > 11) {
    +  681  0 
                 throw new BuildException("Invalid configuration, failBuildOnCVSS must be between 0 and 11.");
    +  682   + 
             }
    +  683  6 
         }
    +  684   + 
     
    +  685   + 
         /**
    +  686   + 
          * Takes the properties supplied and updates the dependency-check settings. Additionally, this sets the system
    +  687   + 
          * properties required to change the proxy url, port, and connection timeout.
    +  688   + 
          */
    +  689   + 
         private void populateSettings() {
    +  690  6 
             InputStream taskProperties = null;
    +  691   + 
             try {
    +  692  6 
                 taskProperties = this.getClass().getClassLoader().getResourceAsStream(PROPERTIES_FILE);
    +  693  6 
                 Settings.mergeProperties(taskProperties);
    +  694  0 
             } catch (IOException ex) {
    +  695  0 
                 Logger.getLogger(DependencyCheckTask.class.getName()).log(Level.WARNING, "Unable to load the dependency-check ant task.properties file.");
    +  696  0 
                 Logger.getLogger(DependencyCheckTask.class.getName()).log(Level.FINE, null, ex);
    +  697   + 
             } finally {
    +  698  6 
                 if (taskProperties != null) {
    +  699   + 
                     try {
    +  700  6 
                         taskProperties.close();
    +  701  0 
                     } catch (IOException ex) {
    +  702  0 
                         Logger.getLogger(DependencyCheckTask.class.getName()).log(Level.FINEST, null, ex);
    +  703  6 
                     }
    +  704   + 
                 }
    +  705   + 
             }
    +  706  6 
             if (dataDirectory != null) {
    +  707  0 
                 Settings.setString(Settings.KEYS.DATA_DIRECTORY, dataDirectory);
    +  708   + 
             } else {
    +  709  6 
                 final File jarPath = new File(DependencyCheckTask.class.getProtectionDomain().getCodeSource().getLocation().getPath());
    +  710  6 
                 final File base = jarPath.getParentFile();
    +  711  6 
                 final String sub = Settings.getString(Settings.KEYS.DATA_DIRECTORY);
    +  712  6 
                 final File dataDir = new File(base, sub);
    +  713  6 
                 Settings.setString(Settings.KEYS.DATA_DIRECTORY, dataDir.getAbsolutePath());
    +  714   + 
             }
    +  715   + 
     
    +  716  6 
             Settings.setBoolean(Settings.KEYS.AUTO_UPDATE, autoUpdate);
    +  717   + 
     
    +  718  6 
             if (proxyUrl != null && !proxyUrl.isEmpty()) {
    +  719  0 
                 Settings.setString(Settings.KEYS.PROXY_URL, proxyUrl);
    +  720   + 
             }
    +  721  6 
             if (proxyPort != null && !proxyPort.isEmpty()) {
    +  722  0 
                 Settings.setString(Settings.KEYS.PROXY_PORT, proxyPort);
    +  723   + 
             }
    +  724  6 
             if (proxyUsername != null && !proxyUsername.isEmpty()) {
    +  725  0 
                 Settings.setString(Settings.KEYS.PROXY_USERNAME, proxyUsername);
    +  726   + 
             }
    +  727  6 
             if (proxyPassword != null && !proxyPassword.isEmpty()) {
    +  728  0 
                 Settings.setString(Settings.KEYS.PROXY_PASSWORD, proxyPassword);
    +  729   + 
             }
    +  730  6 
             if (connectionTimeout != null && !connectionTimeout.isEmpty()) {
    +  731  0 
                 Settings.setString(Settings.KEYS.CONNECTION_TIMEOUT, connectionTimeout);
    +  732   + 
             }
    +  733  6 
             if (suppressionFile != null && !suppressionFile.isEmpty()) {
    +  734  0 
                 Settings.setString(Settings.KEYS.SUPPRESSION_FILE, suppressionFile);
    +  735   + 
             }
    +  736  6 
             Settings.setBoolean(Settings.KEYS.ANALYZER_NEXUS_ENABLED, nexusAnalyzerEnabled);
    +  737  6 
             if (nexusUrl != null && !nexusUrl.isEmpty()) {
    +  738  0 
                 Settings.setString(Settings.KEYS.ANALYZER_NEXUS_URL, nexusUrl);
    +  739   + 
             }
    +  740  6 
             if (databaseDriverName != null && !databaseDriverName.isEmpty()) {
    +  741  0 
                 Settings.setString(Settings.KEYS.DB_DRIVER_NAME, databaseDriverName);
    +  742   + 
             }
    +  743  6 
             if (databaseDriverPath != null && !databaseDriverPath.isEmpty()) {
    +  744  0 
                 Settings.setString(Settings.KEYS.DB_DRIVER_PATH, databaseDriverPath);
    +  745   + 
             }
    +  746  6 
             if (connectionString != null && !connectionString.isEmpty()) {
    +  747  0 
                 Settings.setString(Settings.KEYS.DB_CONNECTION_STRING, connectionString);
    +  748   + 
             }
    +  749  6 
             if (databaseUser != null && !databaseUser.isEmpty()) {
    +  750  0 
                 Settings.setString(Settings.KEYS.DB_USER, databaseUser);
    +  751   + 
             }
    +  752  6 
             if (databasePassword != null && !databasePassword.isEmpty()) {
    +  753  0 
                 Settings.setString(Settings.KEYS.DB_PASSWORD, databasePassword);
    +  754   + 
             }
    +  755  6 
         }
    +  756   + 
     
    +  757   + 
         /**
    +  758   + 
          * Checks to see if a vulnerability has been identified with a CVSS score that is above the threshold set in the
    +  759   + 
          * configuration.
    +  760   + 
          *
    +  761   + 
          * @param dependencies the list of dependency objects
    +  762   + 
          * @throws BuildException thrown if a CVSS score is found that is higher then the threshold set
    +  763   + 
          */
    +  764   + 
         private void checkForFailure(List<Dependency> dependencies) throws BuildException {
    +  765  0 
             final StringBuilder ids = new StringBuilder();
    +  766  0 
             for (Dependency d : dependencies) {
    +  767  0 
                 for (Vulnerability v : d.getVulnerabilities()) {
    +  768  0 
                     if (v.getCvssScore() >= failBuildOnCVSS) {
    +  769  0 
                         if (ids.length() == 0) {
    +  770  0 
                             ids.append(v.getName());
    +  771   + 
                         } else {
    +  772  0 
                             ids.append(", ").append(v.getName());
    +  773   + 
                         }
    +  774   + 
                     }
    +  775  0 
                 }
    +  776  0 
             }
    +  777  0 
             if (ids.length() > 0) {
    +  778  0 
                 final String msg = String.format("%n%nDependency-Check Failure:%n"
    +  779   + 
                         + "One or more dependencies were identified with vulnerabilities that have a CVSS score greater then '%.1f': %s%n"
    +  780   + 
                         + "See the dependency-check report for more details.%n%n", failBuildOnCVSS, ids.toString());
    +  781  0 
                 throw new BuildException(msg);
    +  782   + 
             }
    +  783  0 
         }
    +  784   + 
     
    +  785   + 
         /**
    +  786   + 
          * Generates a warning message listing a summary of dependencies and their associated CPE and CVE entries.
    +  787   + 
          *
    +  788   + 
          * @param dependencies a list of dependency objects
    +  789   + 
          */
    +  790   + 
         private void showSummary(List<Dependency> dependencies) {
    +  791  6 
             final StringBuilder summary = new StringBuilder();
    +  792  6 
             for (Dependency d : dependencies) {
    +  793  10 
                 boolean firstEntry = true;
    +  794  10 
                 final StringBuilder ids = new StringBuilder();
    +  795  10 
                 for (Vulnerability v : d.getVulnerabilities()) {
    +  796  40 
                     if (firstEntry) {
    +  797  8 
                         firstEntry = false;
    +  798   + 
                     } else {
    +  799  32 
                         ids.append(", ");
    +  800   + 
                     }
    +  801  40 
                     ids.append(v.getName());
    +  802  40 
                 }
    +  803  10 
                 if (ids.length() > 0) {
    +  804  8 
                     summary.append(d.getFileName()).append(" (");
    +  805  8 
                     firstEntry = true;
    +  806  8 
                     for (Identifier id : d.getIdentifiers()) {
    +  807  24 
                         if (firstEntry) {
    +  808  8 
                             firstEntry = false;
    +  809   + 
                         } else {
    +  810  16 
                             summary.append(", ");
    +  811   + 
                         }
    +  812  24 
                         summary.append(id.getValue());
    +  813  24 
                     }
    +  814  8 
                     summary.append(") : ").append(ids).append(NEW_LINE);
    +  815   + 
                 }
    +  816  10 
             }
    +  817  6 
             if (summary.length() > 0) {
    +  818  6 
                 final String msg = String.format("%n%n"
    +  819   + 
                         + "One or more dependencies were identified with known vulnerabilities:%n%n%s"
    +  820   + 
                         + "%n%nSee the dependency-check report for more details.%n%n", summary.toString());
    +  821  6 
                 Logger.getLogger(DependencyCheckTask.class.getName()).log(Level.WARNING, msg);
    +  822   + 
             }
    +  823  6 
         }
    +  824   + 
     
    +  825   + 
         /**
    +  826   + 
          * An enumeration of supported report formats: "ALL", "HTML", "XML", "VULN", etc..
    +  827   + 
          */
    +  828  8 
         public static class ReportFormats extends EnumeratedAttribute {
    +  829   + 
     
    +  830   + 
             /**
    +  831   + 
              * Returns the list of values for the report format.
    +  832   + 
              *
    +  833   + 
              * @return the list of values for the report format
    +  834   + 
              */
    +  835   + 
             @Override
    +  836   + 
             public String[] getValues() {
    +  837  8 
                 int i = 0;
    +  838  8 
                 final Format[] formats = Format.values();
    +  839  8 
                 final String[] values = new String[formats.length];
    +  840  40 
                 for (Format format : formats) {
    +  841  32 
                     values[i++] = format.name();
    +  842   + 
                 }
    +  843  8 
                 return values;
    +  844   + 
             }
    +  845   + 
         }
    +  846   
     }
    -
    Report generated by Cobertura 1.9.4.1 on 1/16/14 7:31 AM.
    +
    Report generated by Cobertura 1.9.4.1 on 1/26/14 11:15 AM.
    diff --git a/dependency-check-ant/configuration.html b/dependency-check-ant/configuration.html index fbe94300f..4bb1ad701 100644 --- a/dependency-check-ant/configuration.html +++ b/dependency-check-ant/configuration.html @@ -1,13 +1,13 @@ - + dependency-check-ant - Configuration @@ -54,7 +54,7 @@
  • - +
  • /
    • @@ -67,8 +67,8 @@ -
  • Last Published: 2014-01-16
  • |
    • -
  • Version: 1.0.8
    • +
  • Last Published: 2014-01-26
  • |
    • +
  • Version: 1.1.0
    • @@ -289,6 +289,69 @@ The connection timeout used when downloading data files from the Internet. +Optional + + + + +nexusAnalyzerEnabled + +The connection timeout used when downloading data files from the Internet. + +Optional + + + + +nexusUrl + +The connection timeout used when downloading data files from the Internet. + +Optional + + + + +databaseDriverName + +The name of the database driver. Example: org.h2.Driver. + +Optional + + + + +databaseDriverPath + +The path to the database driver JAR file; only used if the driver is not in the class path. + +Optional + + + + +connectionString + +The connection string used to connect to the database. + +Optional + + + + +databaseUser + +The username used when connecting to the database. + +Optional + + + + +databasePassword + +The password used when connecting to the database. + Optional diff --git a/dependency-check-ant/cpd.html b/dependency-check-ant/cpd.html index ae8728b23..b680b12ed 100644 --- a/dependency-check-ant/cpd.html +++ b/dependency-check-ant/cpd.html @@ -1,13 +1,13 @@ - + dependency-check-ant - CPD Results @@ -54,7 +54,7 @@
  • - +
  • /
    • @@ -67,8 +67,8 @@ -
  • Last Published: 2014-01-16
  • |
    • -
  • Version: 1.0.8
    • +
  • Last Published: 2014-01-26
  • |
    • +
  • Version: 1.1.0
    • diff --git a/dependency-check-ant/dependency-updates-report.html b/dependency-check-ant/dependency-updates-report.html index ec41fce72..45b2d95fa 100644 --- a/dependency-check-ant/dependency-updates-report.html +++ b/dependency-check-ant/dependency-updates-report.html @@ -1,13 +1,13 @@ - + dependency-check-ant - Dependency Updates Report @@ -54,7 +54,7 @@
  • - +
  • /
    • @@ -67,8 +67,8 @@ -
  • Last Published: 2014-01-16
  • |
    • -
  • Version: 1.0.8
    • +
  • Last Published: 2014-01-26
  • |
    • +
  • Version: 1.1.0
    • @@ -237,7 +237,7 @@ # of dependencies using the latest version available -2 +4 # of dependencies where the next version available is smaller than an incremental version update @@ -245,7 +245,7 @@ # of dependencies where the next version available is an incremental version update -2 +0 # of dependencies where the next version available is a minor version update @@ -285,34 +285,34 @@ - + org.apache.ant ant -1.9.1 +1.9.3 compile jar -1.9.2 + - + org.apache.ant ant-testutil -1.9.1 +1.9.3 test jar -1.9.2 + org.owasp dependency-check-core -1.0.8 +1.1.0 compile jar @@ -364,7 +364,7 @@ - + @@ -373,7 +373,7 @@ - + @@ -382,16 +382,13 @@ - - - -
    Status There is at least one newer incremental version available. Incremental updates are typically passive.
     No newer versions available.
    Group Id org.apache.ant
    ant
    Current Version1.9.1
    1.9.3
    Scope compile
    Typejar
    Newer versions1.9.2 Next Incremental
    1.9.3 Latest Incremental
    +jar

    org.apache.ant:ant-testutil

    - + @@ -400,7 +397,7 @@ - + @@ -409,10 +406,7 @@ - - - -
    Status There is at least one newer incremental version available. Incremental updates are typically passive.
     No newer versions available.
    Group Id org.apache.ant
    ant-testutil
    Current Version1.9.1
    1.9.3
    Scope test
    Typejar
    Newer versions1.9.2 Next Incremental
    1.9.3 Latest Incremental
    +jar

    org.owasp:dependency-check-core

    @@ -427,7 +421,7 @@ - + diff --git a/dependency-check-ant/findbugs.html b/dependency-check-ant/findbugs.html index 1ccc92104..3941159c3 100644 --- a/dependency-check-ant/findbugs.html +++ b/dependency-check-ant/findbugs.html @@ -1,13 +1,13 @@ - + dependency-check-ant - FindBugs Bug Detector Report @@ -54,7 +54,7 @@
  • - +
  • /
    • @@ -67,8 +67,8 @@ -
  • Last Published: 2014-01-16
  • |
    • -
  • Version: 1.0.8
    • +
  • Last Published: 2014-01-26
  • |
    • +
  • Version: 1.1.0
    • @@ -271,7 +271,7 @@ - +
    dependency-check-core
    Current Version1.0.8
    1.1.0
    Scope compile
    Inconsistent synchronization of org.owasp.dependencycheck.taskdefs.DependencyCheckTask.path; locked 44% of time MT_CORRECTNESS IS2_INCONSISTENT_SYNC474125 Medium
    diff --git a/dependency-check-ant/index.html b/dependency-check-ant/index.html index aaebf1afe..2366c7c7c 100644 --- a/dependency-check-ant/index.html +++ b/dependency-check-ant/index.html @@ -1,13 +1,13 @@ - + dependency-check-ant - About @@ -54,7 +54,7 @@
  • - +
  • /
    • @@ -67,8 +67,8 @@ -
  • Last Published: 2014-01-16
  • |
    • -
  • Version: 1.0.8
    • +
  • Last Published: 2014-01-26
  • |
    • +
  • Version: 1.1.0
    • diff --git a/dependency-check-ant/installation.html b/dependency-check-ant/installation.html index 0d27af0fc..48c9acf21 100644 --- a/dependency-check-ant/installation.html +++ b/dependency-check-ant/installation.html @@ -1,13 +1,13 @@ - + dependency-check-ant - Installation @@ -54,7 +54,7 @@
  • - +
  • /
    • @@ -67,8 +67,8 @@ -
  • Last Published: 2014-01-16
  • |
    • -
  • Version: 1.0.8
    • +
  • Last Published: 2014-01-26
  • |
    • +
  • Version: 1.1.0
    • @@ -145,7 +145,7 @@

    Installation

    -

    Download dependency-check-ant from bintray here. To install dependency-check-ant place the dependency-check-ant-1.0.8.jar into the lib directory of your Ant instalation directory. Once installed you can add the taskdef to you build.xml and add the task to a new or existing target.

    +

    Download dependency-check-ant from bintray here. To install dependency-check-ant place the dependency-check-ant-1.1.0.jar into the lib directory of your Ant instalation directory. Once installed you can add the taskdef to you build.xml and add the task to a new or existing target.

    It is important to understand that the first time this task is executed it may take 20 minutes or more as it downloads and processes the data from the National Vulnerability Database (NVD) hosted by NIST: https://nvd.nist.gov

    After the first batch download, as long as the task is executed at least once every seven days the update will only take a few seconds.

    diff --git a/dependency-check-ant/license.html b/dependency-check-ant/license.html index dcfd0c0c6..b2f734030 100644 --- a/dependency-check-ant/license.html +++ b/dependency-check-ant/license.html @@ -1,13 +1,13 @@ - + dependency-check-ant - Project License @@ -54,7 +54,7 @@
  • - +
  • /
    • @@ -67,8 +67,8 @@ -
  • Last Published: 2014-01-16
  • |
    • -
  • Version: 1.0.8
    • +
  • Last Published: 2014-01-26
  • |
    • +
  • Version: 1.1.0
    • @@ -172,682 +172,210 @@

    Project License

    -

    GNU General Public License version 3

    +

    The Apache Software License, Version 2.0

    -
                        GNU GENERAL PUBLIC LICENSE 
-                       Version 3, 29 June 2007
-
- Copyright (C) 2007 Free Software Foundation, Inc. <http://fsf.org/>
- Everyone is permitted to copy and distribute verbatim copies
- of this license document, but changing it is not allowed.
-
-                            Preamble
-
-  The GNU General Public License is a free, copyleft license for
-software and other kinds of works.
-
-  The licenses for most software and other practical works are designed
-to take away your freedom to share and change the works.  By contrast,
-the GNU General Public License is intended to guarantee your freedom to
-share and change all versions of a program--to make sure it remains free
-software for all its users.  We, the Free Software Foundation, use the
-GNU General Public License for most of our software; it applies also to
-any other work released this way by its authors.  You can apply it to
-your programs, too.
-
-  When we speak of free software, we are referring to freedom, not
-price.  Our General Public Licenses are designed to make sure that you
-have the freedom to distribute copies of free software (and charge for
-them if you wish), that you receive source code or can get it if you
-want it, that you can change the software or use pieces of it in new
-free programs, and that you know you can do these things.
-
-  To protect your rights, we need to prevent others from denying you
-these rights or asking you to surrender the rights.  Therefore, you have
-certain responsibilities if you distribute copies of the software, or if
-you modify it: responsibilities to respect the freedom of others.
-
-  For example, if you distribute copies of such a program, whether
-gratis or for a fee, you must pass on to the recipients the same
-freedoms that you received.  You must make sure that they, too, receive
-or can get the source code.  And you must show them these terms so they
-know their rights.
-
-  Developers that use the GNU GPL protect your rights with two steps:
-(1) assert copyright on the software, and (2) offer you this License
-giving you legal permission to copy, distribute and/or modify it.
-
-  For the developers' and authors' protection, the GPL clearly explains
-that there is no warranty for this free software.  For both users' and
-authors' sake, the GPL requires that modified versions be marked as
-changed, so that their problems will not be attributed erroneously to
-authors of previous versions.
-
-  Some devices are designed to deny users access to install or run
-modified versions of the software inside them, although the manufacturer
-can do so.  This is fundamentally incompatible with the aim of
-protecting users' freedom to change the software.  The systematic
-pattern of such abuse occurs in the area of products for individuals to
-use, which is precisely where it is most unacceptable.  Therefore, we
-have designed this version of the GPL to prohibit the practice for those
-products.  If such problems arise substantially in other domains, we
-stand ready to extend this provision to those domains in future versions
-of the GPL, as needed to protect the freedom of users.
-
-  Finally, every program is threatened constantly by software patents.
-States should not allow patents to restrict development and use of
-software on general-purpose computers, but in those that do, we wish to
-avoid the special danger that patents applied to a free program could
-make it effectively proprietary.  To prevent this, the GPL assures that
-patents cannot be used to render the program non-free.
-
-  The precise terms and conditions for copying, distribution and
-modification follow.
-
-                       TERMS AND CONDITIONS
-
-  0. Definitions.
-
-  "This License" refers to version 3 of the GNU General Public License.
-
-  "Copyright" also means copyright-like laws that apply to other kinds of
-works, such as semiconductor masks.
-
-  "The Program" refers to any copyrightable work licensed under this
-License.  Each licensee is addressed as "you".  "Licensees" and
-"recipients" may be individuals or organizations.
-
-  To "modify" a work means to copy from or adapt all or part of the work
-in a fashion requiring copyright permission, other than the making of an
-exact copy.  The resulting work is called a "modified version" of the
-earlier work or a work "based on" the earlier work.
-
-  A "covered work" means either the unmodified Program or a work based
-on the Program.
-
-  To "propagate" a work means to do anything with it that, without
-permission, would make you directly or secondarily liable for
-infringement under applicable copyright law, except executing it on a
-computer or modifying a private copy.  Propagation includes copying,
-distribution (with or without modification), making available to the
-public, and in some countries other activities as well.
-
-  To "convey" a work means any kind of propagation that enables other
-parties to make or receive copies.  Mere interaction with a user through
-a computer network, with no transfer of a copy, is not conveying.
-
-  An interactive user interface displays "Appropriate Legal Notices"
-to the extent that it includes a convenient and prominently visible
-feature that (1) displays an appropriate copyright notice, and (2)
-tells the user that there is no warranty for the work (except to the
-extent that warranties are provided), that licensees may convey the
-work under this License, and how to view a copy of this License.  If
-the interface presents a list of user commands or options, such as a
-menu, a prominent item in the list meets this criterion.
-
-  1. Source Code.
-
-  The "source code" for a work means the preferred form of the work
-for making modifications to it.  "Object code" means any non-source
-form of a work.
-
-  A "Standard Interface" means an interface that either is an official
-standard defined by a recognized standards body, or, in the case of
-interfaces specified for a particular programming language, one that
-is widely used among developers working in that language.
-
-  The "System Libraries" of an executable work include anything, other
-than the work as a whole, that (a) is included in the normal form of
-packaging a Major Component, but which is not part of that Major
-Component, and (b) serves only to enable use of the work with that
-Major Component, or to implement a Standard Interface for which an
-implementation is available to the public in source code form.  A
-"Major Component", in this context, means a major essential component
-(kernel, window system, and so on) of the specific operating system
-(if any) on which the executable work runs, or a compiler used to
-produce the work, or an object code interpreter used to run it.
-
-  The "Corresponding Source" for a work in object code form means all
-the source code needed to generate, install, and (for an executable
-work) run the object code and to modify the work, including scripts to
-control those activities.  However, it does not include the work's
-System Libraries, or general-purpose tools or generally available free
-programs which are used unmodified in performing those activities but
-which are not part of the work.  For example, Corresponding Source
-includes interface definition files associated with source files for
-the work, and the source code for shared libraries and dynamically
-linked subprograms that the work is specifically designed to require,
-such as by intimate data communication or control flow between those
-subprograms and other parts of the work.
-
-  The Corresponding Source need not include anything that users
-can regenerate automatically from other parts of the Corresponding
-Source.
-
-  The Corresponding Source for a work in source code form is that
-same work.
-
-  2. Basic Permissions.
-
-  All rights granted under this License are granted for the term of
-copyright on the Program, and are irrevocable provided the stated
-conditions are met.  This License explicitly affirms your unlimited
-permission to run the unmodified Program.  The output from running a
-covered work is covered by this License only if the output, given its
-content, constitutes a covered work.  This License acknowledges your
-rights of fair use or other equivalent, as provided by copyright law.
-
-  You may make, run and propagate covered works that you do not
-convey, without conditions so long as your license otherwise remains
-in force.  You may convey covered works to others for the sole purpose
-of having them make modifications exclusively for you, or provide you
-with facilities for running those works, provided that you comply with
-the terms of this License in conveying all material for which you do
-not control copyright.  Those thus making or running the covered works
-for you must do so exclusively on your behalf, under your direction
-and control, on terms that prohibit them from making any copies of
-your copyrighted material outside their relationship with you.
-
-  Conveying under any other circumstances is permitted solely under
-the conditions stated below.  Sublicensing is not allowed; section 10
-makes it unnecessary.
-
-  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
-
-  No covered work shall be deemed part of an effective technological
-measure under any applicable law fulfilling obligations under article
-11 of the WIPO copyright treaty adopted on 20 December 1996, or
-similar laws prohibiting or restricting circumvention of such
-measures.
-
-  When you convey a covered work, you waive any legal power to forbid
-circumvention of technological measures to the extent such circumvention
-is effected by exercising rights under this License with respect to
-the covered work, and you disclaim any intention to limit operation or
-modification of the work as a means of enforcing, against the work's
-users, your or third parties' legal rights to forbid circumvention of
-technological measures.
-
-  4. Conveying Verbatim Copies.
-
-  You may convey verbatim copies of the Program's source code as you
-receive it, in any medium, provided that you conspicuously and
-appropriately publish on each copy an appropriate copyright notice;
-keep intact all notices stating that this License and any
-non-permissive terms added in accord with section 7 apply to the code;
-keep intact all notices of the absence of any warranty; and give all
-recipients a copy of this License along with the Program.
-
-  You may charge any price or no price for each copy that you convey,
-and you may offer support or warranty protection for a fee.
-
-  5. Conveying Modified Source Versions.
-
-  You may convey a work based on the Program, or the modifications to
-produce it from the Program, in the form of source code under the
-terms of section 4, provided that you also meet all of these conditions:
-
-    a) The work must carry prominent notices stating that you modified
-    it, and giving a relevant date.
-
-    b) The work must carry prominent notices stating that it is
-    released under this License and any conditions added under section
-    7.  This requirement modifies the requirement in section 4 to
-    "keep intact all notices".
-
-    c) You must license the entire work, as a whole, under this
-    License to anyone who comes into possession of a copy.  This
-    License will therefore apply, along with any applicable section 7
-    additional terms, to the whole of the work, and all its parts,
-    regardless of how they are packaged.  This License gives no
-    permission to license the work in any other way, but it does not
-    invalidate such permission if you have separately received it.
-
-    d) If the work has interactive user interfaces, each must display
-    Appropriate Legal Notices; however, if the Program has interactive
-    interfaces that do not display Appropriate Legal Notices, your
-    work need not make them do so.
-
-  A compilation of a covered work with other separate and independent
-works, which are not by their nature extensions of the covered work,
-and which are not combined with it such as to form a larger program,
-in or on a volume of a storage or distribution medium, is called an
-"aggregate" if the compilation and its resulting copyright are not
-used to limit the access or legal rights of the compilation's users
-beyond what the individual works permit.  Inclusion of a covered work
-in an aggregate does not cause this License to apply to the other
-parts of the aggregate.
-
-  6. Conveying Non-Source Forms.
-
-  You may convey a covered work in object code form under the terms
-of sections 4 and 5, provided that you also convey the
-machine-readable Corresponding Source under the terms of this License,
-in one of these ways:
-
-    a) Convey the object code in, or embodied in, a physical product
-    (including a physical distribution medium), accompanied by the
-    Corresponding Source fixed on a durable physical medium
-    customarily used for software interchange.
-
-    b) Convey the object code in, or embodied in, a physical product
-    (including a physical distribution medium), accompanied by a
-    written offer, valid for at least three years and valid for as
-    long as you offer spare parts or customer support for that product
-    model, to give anyone who possesses the object code either (1) a
-    copy of the Corresponding Source for all the software in the
-    product that is covered by this License, on a durable physical
-    medium customarily used for software interchange, for a price no
-    more than your reasonable cost of physically performing this
-    conveying of source, or (2) access to copy the
-    Corresponding Source from a network server at no charge.
-
-    c) Convey individual copies of the object code with a copy of the
-    written offer to provide the Corresponding Source.  This
-    alternative is allowed only occasionally and noncommercially, and
-    only if you received the object code with such an offer, in accord
-    with subsection 6b.
-
-    d) Convey the object code by offering access from a designated
-    place (gratis or for a charge), and offer equivalent access to the
-    Corresponding Source in the same way through the same place at no
-    further charge.  You need not require recipients to copy the
-    Corresponding Source along with the object code.  If the place to
-    copy the object code is a network server, the Corresponding Source
-    may be on a different server (operated by you or a third party)
-    that supports equivalent copying facilities, provided you maintain
-    clear directions next to the object code saying where to find the
-    Corresponding Source.  Regardless of what server hosts the
-    Corresponding Source, you remain obligated to ensure that it is
-    available for as long as needed to satisfy these requirements.
-
-    e) Convey the object code using peer-to-peer transmission, provided
-    you inform other peers where the object code and Corresponding
-    Source of the work are being offered to the general public at no
-    charge under subsection 6d.
-
-  A separable portion of the object code, whose source code is excluded
-from the Corresponding Source as a System Library, need not be
-included in conveying the object code work.
-
-  A "User Product" is either (1) a "consumer product", which means any
-tangible personal property which is normally used for personal, family,
-or household purposes, or (2) anything designed or sold for incorporation
-into a dwelling.  In determining whether a product is a consumer product,
-doubtful cases shall be resolved in favor of coverage.  For a particular
-product received by a particular user, "normally used" refers to a
-typical or common use of that class of product, regardless of the status
-of the particular user or of the way in which the particular user
-actually uses, or expects or is expected to use, the product.  A product
-is a consumer product regardless of whether the product has substantial
-commercial, industrial or non-consumer uses, unless such uses represent
-the only significant mode of use of the product.
-
-  "Installation Information" for a User Product means any methods,
-procedures, authorization keys, or other information required to install
-and execute modified versions of a covered work in that User Product from
-a modified version of its Corresponding Source.  The information must
-suffice to ensure that the continued functioning of the modified object
-code is in no case prevented or interfered with solely because
-modification has been made.
-
-  If you convey an object code work under this section in, or with, or
-specifically for use in, a User Product, and the conveying occurs as
-part of a transaction in which the right of possession and use of the
-User Product is transferred to the recipient in perpetuity or for a
-fixed term (regardless of how the transaction is characterized), the
-Corresponding Source conveyed under this section must be accompanied
-by the Installation Information.  But this requirement does not apply
-if neither you nor any third party retains the ability to install
-modified object code on the User Product (for example, the work has
-been installed in ROM).
-
-  The requirement to provide Installation Information does not include a
-requirement to continue to provide support service, warranty, or updates
-for a work that has been modified or installed by the recipient, or for
-the User Product in which it has been modified or installed.  Access to a
-network may be denied when the modification itself materially and
-adversely affects the operation of the network or violates the rules and
-protocols for communication across the network.
-
-  Corresponding Source conveyed, and Installation Information provided,
-in accord with this section must be in a format that is publicly
-documented (and with an implementation available to the public in
-source code form), and must require no special password or key for
-unpacking, reading or copying.
-
-  7. Additional Terms.
-
-  "Additional permissions" are terms that supplement the terms of this
-License by making exceptions from one or more of its conditions.
-Additional permissions that are applicable to the entire Program shall
-be treated as though they were included in this License, to the extent
-that they are valid under applicable law.  If additional permissions
-apply only to part of the Program, that part may be used separately
-under those permissions, but the entire Program remains governed by
-this License without regard to the additional permissions.
-
-  When you convey a copy of a covered work, you may at your option
-remove any additional permissions from that copy, or from any part of
-it.  (Additional permissions may be written to require their own
-removal in certain cases when you modify the work.)  You may place
-additional permissions on material, added by you to a covered work,
-for which you have or can give appropriate copyright permission.
-
-  Notwithstanding any other provision of this License, for material you
-add to a covered work, you may (if authorized by the copyright holders of
-that material) supplement the terms of this License with terms:
-
-    a) Disclaiming warranty or limiting liability differently from the
-    terms of sections 15 and 16 of this License; or
-
-    b) Requiring preservation of specified reasonable legal notices or
-    author attributions in that material or in the Appropriate Legal
-    Notices displayed by works containing it; or
-
-    c) Prohibiting misrepresentation of the origin of that material, or
-    requiring that modified versions of such material be marked in
-    reasonable ways as different from the original version; or
-
-    d) Limiting the use for publicity purposes of names of licensors or
-    authors of the material; or
-
-    e) Declining to grant rights under trademark law for use of some
-    trade names, trademarks, or service marks; or
-
-    f) Requiring indemnification of licensors and authors of that
-    material by anyone who conveys the material (or modified versions of
-    it) with contractual assumptions of liability to the recipient, for
-    any liability that these contractual assumptions directly impose on
-    those licensors and authors.
-
-  All other non-permissive additional terms are considered "further
-restrictions" within the meaning of section 10.  If the Program as you
-received it, or any part of it, contains a notice stating that it is
-governed by this License along with a term that is a further
-restriction, you may remove that term.  If a license document contains
-a further restriction but permits relicensing or conveying under this
-License, you may add to a covered work material governed by the terms
-of that license document, provided that the further restriction does
-not survive such relicensing or conveying.
-
-  If you add terms to a covered work in accord with this section, you
-must place, in the relevant source files, a statement of the
-additional terms that apply to those files, or a notice indicating
-where to find the applicable terms.
-
-  Additional terms, permissive or non-permissive, may be stated in the
-form of a separately written license, or stated as exceptions;
-the above requirements apply either way.
-
-  8. Termination.
-
-  You may not propagate or modify a covered work except as expressly
-provided under this License.  Any attempt otherwise to propagate or
-modify it is void, and will automatically terminate your rights under
-this License (including any patent licenses granted under the third
-paragraph of section 11).
-
-  However, if you cease all violation of this License, then your
-license from a particular copyright holder is reinstated (a)
-provisionally, unless and until the copyright holder explicitly and
-finally terminates your license, and (b) permanently, if the copyright
-holder fails to notify you of the violation by some reasonable means
-prior to 60 days after the cessation.
-
-  Moreover, your license from a particular copyright holder is
-reinstated permanently if the copyright holder notifies you of the
-violation by some reasonable means, this is the first time you have
-received notice of violation of this License (for any work) from that
-copyright holder, and you cure the violation prior to 30 days after
-your receipt of the notice.
-
-  Termination of your rights under this section does not terminate the
-licenses of parties who have received copies or rights from you under
-this License.  If your rights have been terminated and not permanently
-reinstated, you do not qualify to receive new licenses for the same
-material under section 10.
-
-  9. Acceptance Not Required for Having Copies.
-
-  You are not required to accept this License in order to receive or
-run a copy of the Program.  Ancillary propagation of a covered work
-occurring solely as a consequence of using peer-to-peer transmission
-to receive a copy likewise does not require acceptance.  However,
-nothing other than this License grants you permission to propagate or
-modify any covered work.  These actions infringe copyright if you do
-not accept this License.  Therefore, by modifying or propagating a
-covered work, you indicate your acceptance of this License to do so.
-
-  10. Automatic Licensing of Downstream Recipients.
-
-  Each time you convey a covered work, the recipient automatically
-receives a license from the original licensors, to run, modify and
-propagate that work, subject to this License.  You are not responsible
-for enforcing compliance by third parties with this License.
-
-  An "entity transaction" is a transaction transferring control of an
-organization, or substantially all assets of one, or subdividing an
-organization, or merging organizations.  If propagation of a covered
-work results from an entity transaction, each party to that
-transaction who receives a copy of the work also receives whatever
-licenses to the work the party's predecessor in interest had or could
-give under the previous paragraph, plus a right to possession of the
-Corresponding Source of the work from the predecessor in interest, if
-the predecessor has it or can get it with reasonable efforts.
-
-  You may not impose any further restrictions on the exercise of the
-rights granted or affirmed under this License.  For example, you may
-not impose a license fee, royalty, or other charge for exercise of
-rights granted under this License, and you may not initiate litigation
-(including a cross-claim or counterclaim in a lawsuit) alleging that
-any patent claim is infringed by making, using, selling, offering for
-sale, or importing the Program or any portion of it.
-
-  11. Patents.
-
-  A "contributor" is a copyright holder who authorizes use under this
-License of the Program or a work on which the Program is based.  The
-work thus licensed is called the contributor's "contributor version".
-
-  A contributor's "essential patent claims" are all patent claims
-owned or controlled by the contributor, whether already acquired or
-hereafter acquired, that would be infringed by some manner, permitted
-by this License, of making, using, or selling its contributor version,
-but do not include claims that would be infringed only as a
-consequence of further modification of the contributor version.  For
-purposes of this definition, "control" includes the right to grant
-patent sublicenses in a manner consistent with the requirements of
-this License.
-
-  Each contributor grants you a non-exclusive, worldwide, royalty-free
-patent license under the contributor's essential patent claims, to
-make, use, sell, offer for sale, import and otherwise run, modify and
-propagate the contents of its contributor version.
-
-  In the following three paragraphs, a "patent license" is any express
-agreement or commitment, however denominated, not to enforce a patent
-(such as an express permission to practice a patent or covenant not to
-sue for patent infringement).  To "grant" such a patent license to a
-party means to make such an agreement or commitment not to enforce a
-patent against the party.
-
-  If you convey a covered work, knowingly relying on a patent license,
-and the Corresponding Source of the work is not available for anyone
-to copy, free of charge and under the terms of this License, through a
-publicly available network server or other readily accessible means,
-then you must either (1) cause the Corresponding Source to be so
-available, or (2) arrange to deprive yourself of the benefit of the
-patent license for this particular work, or (3) arrange, in a manner
-consistent with the requirements of this License, to extend the patent
-license to downstream recipients.  "Knowingly relying" means you have
-actual knowledge that, but for the patent license, your conveying the
-covered work in a country, or your recipient's use of the covered work
-in a country, would infringe one or more identifiable patents in that
-country that you have reason to believe are valid.
-
-  If, pursuant to or in connection with a single transaction or
-arrangement, you convey, or propagate by procuring conveyance of, a
-covered work, and grant a patent license to some of the parties
-receiving the covered work authorizing them to use, propagate, modify
-or convey a specific copy of the covered work, then the patent license
-you grant is automatically extended to all recipients of the covered
-work and works based on it.
-
-  A patent license is "discriminatory" if it does not include within
-the scope of its coverage, prohibits the exercise of, or is
-conditioned on the non-exercise of one or more of the rights that are
-specifically granted under this License.  You may not convey a covered
-work if you are a party to an arrangement with a third party that is
-in the business of distributing software, under which you make payment
-to the third party based on the extent of your activity of conveying
-the work, and under which the third party grants, to any of the
-parties who would receive the covered work from you, a discriminatory
-patent license (a) in connection with copies of the covered work
-conveyed by you (or copies made from those copies), or (b) primarily
-for and in connection with specific products or compilations that
-contain the covered work, unless you entered into that arrangement,
-or that patent license was granted, prior to 28 March 2007.
-
-  Nothing in this License shall be construed as excluding or limiting
-any implied license or other defenses to infringement that may
-otherwise be available to you under applicable patent law.
-
-  12. No Surrender of Others' Freedom.
-
-  If conditions are imposed on you (whether by court order, agreement or
-otherwise) that contradict the conditions of this License, they do not
-excuse you from the conditions of this License.  If you cannot convey a
-covered work so as to satisfy simultaneously your obligations under this
-License and any other pertinent obligations, then as a consequence you may
-not convey it at all.  For example, if you agree to terms that obligate you
-to collect a royalty for further conveying from those to whom you convey
-the Program, the only way you could satisfy both those terms and this
-License would be to refrain entirely from conveying the Program.
-
-  13. Use with the GNU Affero General Public License.
-
-  Notwithstanding any other provision of this License, you have
-permission to link or combine any covered work with a work licensed
-under version 3 of the GNU Affero General Public License into a single
-combined work, and to convey the resulting work.  The terms of this
-License will continue to apply to the part which is the covered work,
-but the special requirements of the GNU Affero General Public License,
-section 13, concerning interaction through a network will apply to the
-combination as such.
-
-  14. Revised Versions of this License.
-
-  The Free Software Foundation may publish revised and/or new versions of
-the GNU General Public License from time to time.  Such new versions will
-be similar in spirit to the present version, but may differ in detail to
-address new problems or concerns.
-
-  Each version is given a distinguishing version number.  If the
-Program specifies that a certain numbered version of the GNU General
-Public License "or any later version" applies to it, you have the
-option of following the terms and conditions either of that numbered
-version or of any later version published by the Free Software
-Foundation.  If the Program does not specify a version number of the
-GNU General Public License, you may choose any version ever published
-by the Free Software Foundation.
-
-  If the Program specifies that a proxy can decide which future
-versions of the GNU General Public License can be used, that proxy's
-public statement of acceptance of a version permanently authorizes you
-to choose that version for the Program.
-
-  Later license versions may give you additional or different
-permissions.  However, no additional obligations are imposed on any
-author or copyright holder as a result of your choosing to follow a
-later version.
-
-  15. Disclaimer of Warranty.
-
-  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
-APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
-HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
-OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
-THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
-PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
-IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
-ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
-
-  16. Limitation of Liability.
-
-  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
-WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
-THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
-GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
-USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
-DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
-PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
-EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
-SUCH DAMAGES.
-
-  17. Interpretation of Sections 15 and 16.
-
-  If the disclaimer of warranty and limitation of liability provided
-above cannot be given local legal effect according to their terms,
-reviewing courts shall apply local law that most closely approximates
-an absolute waiver of all civil liability in connection with the
-Program, unless a warranty or assumption of liability accompanies a
-copy of the Program in return for a fee.
-
-                     END OF TERMS AND CONDITIONS
-
-            How to Apply These Terms to Your New Programs
-
-  If you develop a new program, and you want it to be of the greatest
-possible use to the public, the best way to achieve this is to make it
-free software which everyone can redistribute and change under these terms.
-
-  To do so, attach the following notices to the program.  It is safest
-to attach them to the start of each source file to most effectively
-state the exclusion of warranty; and each file should have at least
-the "copyright" line and a pointer to where the full notice is found.
-
-    <one line to give the program's name and a brief idea of what it does.>
-    Copyright (C) <year>  <name of author>
-
-    This program is free software: you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-    the Free Software Foundation, either version 3 of the License, or
-    (at your option) any later version.
-
-    This program is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-    GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-Also add information on how to contact you by electronic and paper mail.
-
-  If the program does terminal interaction, make it output a short
-notice like this when it starts in an interactive mode:
-
-    <program>  Copyright (C) <year>  <name of author>
-    This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
-    This is free software, and you are welcome to redistribute it
-    under certain conditions; type `show c' for details.
-
-The hypothetical commands `show w' and `show c' should show the appropriate
-parts of the General Public License.  Of course, your program's commands
-might be different; for a GUI interface, you would use an "about box".
-
-  You should also get your employer (if you work as a programmer) or school,
-if any, to sign a "copyright disclaimer" for the program, if necessary.
-For more information on this, and how to apply and follow the GNU GPL, see
-<http://www.gnu.org/licenses/>.
-
-  The GNU General Public License does not permit incorporating your program
-into proprietary programs.  If your program is a subroutine library, you
-may consider it more useful to permit linking proprietary applications with
-the library.  If this is what you want to do, use the GNU Lesser General
-Public License instead of this License.  But first, please read
-<http://www.gnu.org/philosophy/why-not-lgpl.html>.
+
    +                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
    diff --git a/dependency-check-ant/plugin-updates-report.html b/dependency-check-ant/plugin-updates-report.html index a0b8b88f5..c29a363c5 100644 --- a/dependency-check-ant/plugin-updates-report.html +++ b/dependency-check-ant/plugin-updates-report.html @@ -1,13 +1,13 @@ - + dependency-check-ant - Plugin Updates Report @@ -54,7 +54,7 @@
  • - +
  • /
    • @@ -67,8 +67,8 @@ -
  • Last Published: 2014-01-16
  • |
    • -
  • Version: 1.0.8
    • +
  • Last Published: 2014-01-26
  • |
    • +
  • Version: 1.1.0
    • diff --git a/dependency-check-ant/pmd.html b/dependency-check-ant/pmd.html index 7c69ffaa7..e79f77d53 100644 --- a/dependency-check-ant/pmd.html +++ b/dependency-check-ant/pmd.html @@ -1,13 +1,13 @@ - + dependency-check-ant - PMD Results @@ -54,7 +54,7 @@
  • - +
  • /
    • @@ -67,8 +67,8 @@ -
  • Last Published: 2014-01-16
  • |
    • -
  • Version: 1.0.8
    • +
  • Last Published: 2014-01-26
  • |
    • +
  • Version: 1.1.0
    • diff --git a/dependency-check-ant/project-info.html b/dependency-check-ant/project-info.html index 333d8172e..eba0860c0 100644 --- a/dependency-check-ant/project-info.html +++ b/dependency-check-ant/project-info.html @@ -1,13 +1,13 @@ - + dependency-check-ant - Project Information @@ -54,7 +54,7 @@
  • - +
  • /
    • @@ -67,8 +67,8 @@ -
  • Last Published: 2014-01-16
  • |
    • -
  • Version: 1.0.8
    • +
  • Last Published: 2014-01-26
  • |
    • +
  • Version: 1.1.0
    • diff --git a/dependency-check-ant/project-reports.html b/dependency-check-ant/project-reports.html index f46dde1c5..ff9f557b4 100644 --- a/dependency-check-ant/project-reports.html +++ b/dependency-check-ant/project-reports.html @@ -1,13 +1,13 @@ - + dependency-check-ant - Generated Reports @@ -54,7 +54,7 @@
  • - +
  • /
    • @@ -67,8 +67,8 @@ -
  • Last Published: 2014-01-16
  • |
    • -
  • Version: 1.0.8
    • +
  • Last Published: 2014-01-26
  • |
    • +
  • Version: 1.1.0
    • diff --git a/dependency-check-ant/project-summary.html b/dependency-check-ant/project-summary.html index 180c3bfaa..843a6620a 100644 --- a/dependency-check-ant/project-summary.html +++ b/dependency-check-ant/project-summary.html @@ -1,13 +1,13 @@ - + dependency-check-ant - Project Summary @@ -54,7 +54,7 @@
  • - +
  • /
    • @@ -67,8 +67,8 @@ -
  • Last Published: 2014-01-16
  • |
    • -
  • Version: 1.0.8
    • +
  • Last Published: 2014-01-26
  • |
    • +
  • Version: 1.1.0
    • @@ -210,7 +210,7 @@ dependency-check-ant Version -1.0.8 +1.1.0 Type jar diff --git a/dependency-check-ant/surefire-report.html b/dependency-check-ant/surefire-report.html index e424c040c..c1b53fb64 100644 --- a/dependency-check-ant/surefire-report.html +++ b/dependency-check-ant/surefire-report.html @@ -1,13 +1,13 @@ - + dependency-check-ant - Surefire Report @@ -54,7 +54,7 @@
  • - +
  • /
    • @@ -67,8 +67,8 @@ -
  • Last Published: 2014-01-16
  • |
    • -
  • Version: 1.0.8
    • +
  • Last Published: 2014-01-26
  • |
    • +
  • Version: 1.1.0
    • @@ -266,7 +266,7 @@ function toggleDisplay(elementId) { 0 0 100% -24.481
    +29.668

    Note: failures are anticipated and checked for with assertions while errors are unanticipated.


    Package List

    @@ -287,7 +287,7 @@ function toggleDisplay(elementId) { 0 0 100% -24.481
    +29.668

    Note: package statistics are not computed recursively, they only sum up all of its testsuites numbers.

    org.owasp.dependencycheck.taskdefs

    @@ -309,7 +309,7 @@ function toggleDisplay(elementId) { 0 0 100% -24.481

    +29.668

    Test Cases

    [Summary] [Package List] [Test Cases]

    @@ -319,19 +319,19 @@ function toggleDisplay(elementId) { testGetFailBuildOnCVSS -3.5 +3.492 testAddDirSet -17.961 +22.951 testAddFileSet -1.769 +1.787 testAddFileList -1.251

    +1.438
    diff --git a/dependency-check-ant/taglist.html b/dependency-check-ant/taglist.html index 852e71569..337dd020d 100644 --- a/dependency-check-ant/taglist.html +++ b/dependency-check-ant/taglist.html @@ -1,13 +1,13 @@ - + dependency-check-ant - Tag List report @@ -54,7 +54,7 @@
  • - +
  • /
    • @@ -67,8 +67,8 @@ -
  • Last Published: 2014-01-16
  • |
    • -
  • Version: 1.0.8
    • +
  • Last Published: 2014-01-26
  • |
    • +
  • Version: 1.1.0
    • diff --git a/dependency-check-ant/usage.html b/dependency-check-ant/usage.html index 56a13b407..0c9fc4da3 100644 --- a/dependency-check-ant/usage.html +++ b/dependency-check-ant/usage.html @@ -1,13 +1,13 @@ - + dependency-check-ant - Usage @@ -54,7 +54,7 @@
  • - +
  • /
    • @@ -67,8 +67,8 @@ -
  • Last Published: 2014-01-16
  • |
    • -
  • Version: 1.0.8
    • +
  • Last Published: 2014-01-26
  • |
    • +
  • Version: 1.1.0
    • diff --git a/dependency-check-ant/xref-test/index.html b/dependency-check-ant/xref-test/index.html index 297d8d108..4ffbc3ed4 100644 --- a/dependency-check-ant/xref-test/index.html +++ b/dependency-check-ant/xref-test/index.html @@ -4,7 +4,7 @@ - Dependency-Check Ant Task 1.0.8 Reference + Dependency-Check Ant Task 1.1.0 Reference diff --git a/dependency-check-ant/xref-test/org/owasp/dependencycheck/taskdefs/DependencyCheckTaskTest.html b/dependency-check-ant/xref-test/org/owasp/dependencycheck/taskdefs/DependencyCheckTaskTest.html index 1d26f05ff..4ad9bae9a 100644 --- a/dependency-check-ant/xref-test/org/owasp/dependencycheck/taskdefs/DependencyCheckTaskTest.html +++ b/dependency-check-ant/xref-test/org/owasp/dependencycheck/taskdefs/DependencyCheckTaskTest.html @@ -9,126 +9,125 @@ 1 /* 2 * This file is part of dependency-check-ant. 3 * -4 * Dependency-check-ant is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-ant is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-ant. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2013 Jeremy Long. All Rights Reserved. -18 */ -19 package org.owasp.dependencycheck.taskdefs; -20 -21 import java.io.File; -22 import static junit.framework.TestCase.assertTrue; +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2013 Jeremy Long. All Rights Reserved. +17 */ +18 package org.owasp.dependencycheck.taskdefs; +19 +20 import java.io.File; +21 import static junit.framework.TestCase.assertTrue; +22 import org.apache.tools.ant.BuildFileTest; 23 import org.junit.After; 24 import org.junit.AfterClass; 25 import org.junit.Before; 26 import org.junit.BeforeClass; 27 import org.junit.Test; -28 import org.apache.tools.ant.BuildFileTest; -29 import org.owasp.dependencycheck.data.nvdcve.BaseDBTestCase; -30 -31 /** -32 * -33 * @author Jeremy Long <jeremy.long@owasp.org> -34 */ -35 public class DependencyCheckTaskTest extends BuildFileTest { -36 -37 public DependencyCheckTaskTest() { -38 } -39 -40 @BeforeClass -41 public static void setUpClass() { -42 } -43 -44 @AfterClass -45 public static void tearDownClass() { -46 } -47 -48 @Before -49 @Override -50 public void setUp() throws Exception { -51 BaseDBTestCase.ensureDBExists(); -52 final String buildFile = this.getClass().getClassLoader().getResource("build.xml").getPath(); -53 configureProject(buildFile); -54 } -55 -56 @After -57 @Override -58 public void tearDown() { -59 //no cleanup... -60 //executeTarget("cleanup"); -61 } -62 -63 /** -64 * Test of addFileSet method, of class DependencyCheckTask. -65 */ -66 @Test -67 public void testAddFileSet() throws Exception { -68 File report = new File("target/DependencyCheck-Report.html"); -69 if (report.exists()) { -70 if (!report.delete()) { -71 throw new Exception("Unable to delete 'target/DependencyCheck-Report.html' prior to test."); -72 } -73 } -74 executeTarget("test.fileset"); -75 -76 assertTrue("DependencyCheck report was not generated", report.exists()); -77 -78 } -79 -80 /** -81 * Test of addFileList method, of class DependencyCheckTask. -82 * -83 * @throws Exception -84 */ -85 @Test -86 public void testAddFileList() throws Exception { -87 File report = new File("target/DependencyCheck-Report.xml"); -88 if (report.exists()) { -89 if (!report.delete()) { -90 throw new Exception("Unable to delete 'target/DependencyCheck-Report.xml' prior to test."); -91 } -92 } -93 executeTarget("test.filelist"); -94 -95 assertTrue("DependencyCheck report was not generated", report.exists()); -96 } -97 -98 /** -99 * Test of addDirSet method, of class DependencyCheckTask. -100 * -101 * @throws Exception -102 */ -103 @Test -104 public void testAddDirSet() throws Exception { -105 File report = new File("target/DependencyCheck-Vulnerability.html"); -106 if (report.exists()) { -107 if (!report.delete()) { -108 throw new Exception("Unable to delete 'target/DependencyCheck-Vulnerability.html' prior to test."); -109 } -110 } -111 executeTarget("test.dirset"); -112 assertTrue("DependencyCheck report was not generated", report.exists()); -113 } -114 -115 /** -116 * Test of getFailBuildOnCVSS method, of class DependencyCheckTask. -117 */ -118 @Test -119 public void testGetFailBuildOnCVSS() { -120 expectBuildException("failCVSS", "asdfasdfscore"); -121 System.out.println(this.getOutput()); -122 } -123 } +28 import org.owasp.dependencycheck.data.nvdcve.BaseDBTestCase; +29 +30 /** +31 * +32 * @author Jeremy Long <jeremy.long@owasp.org> +33 */ +34 public class DependencyCheckTaskTest extends BuildFileTest { +35 +36 public DependencyCheckTaskTest() { +37 } +38 +39 @BeforeClass +40 public static void setUpClass() { +41 } +42 +43 @AfterClass +44 public static void tearDownClass() { +45 } +46 +47 @Before +48 @Override +49 public void setUp() throws Exception { +50 BaseDBTestCase.ensureDBExists(); +51 final String buildFile = this.getClass().getClassLoader().getResource("build.xml").getPath(); +52 configureProject(buildFile); +53 } +54 +55 @After +56 @Override +57 public void tearDown() { +58 //no cleanup... +59 //executeTarget("cleanup"); +60 } +61 +62 /** +63 * Test of addFileSet method, of class DependencyCheckTask. +64 */ +65 @Test +66 public void testAddFileSet() throws Exception { +67 File report = new File("target/DependencyCheck-Report.html"); +68 if (report.exists()) { +69 if (!report.delete()) { +70 throw new Exception("Unable to delete 'target/DependencyCheck-Report.html' prior to test."); +71 } +72 } +73 executeTarget("test.fileset"); +74 +75 assertTrue("DependencyCheck report was not generated", report.exists()); +76 +77 } +78 +79 /** +80 * Test of addFileList method, of class DependencyCheckTask. +81 * +82 * @throws Exception +83 */ +84 @Test +85 public void testAddFileList() throws Exception { +86 File report = new File("target/DependencyCheck-Report.xml"); +87 if (report.exists()) { +88 if (!report.delete()) { +89 throw new Exception("Unable to delete 'target/DependencyCheck-Report.xml' prior to test."); +90 } +91 } +92 executeTarget("test.filelist"); +93 +94 assertTrue("DependencyCheck report was not generated", report.exists()); +95 } +96 +97 /** +98 * Test of addDirSet method, of class DependencyCheckTask. +99 * +100 * @throws Exception +101 */ +102 @Test +103 public void testAddDirSet() throws Exception { +104 File report = new File("target/DependencyCheck-Vulnerability.html"); +105 if (report.exists()) { +106 if (!report.delete()) { +107 throw new Exception("Unable to delete 'target/DependencyCheck-Vulnerability.html' prior to test."); +108 } +109 } +110 executeTarget("test.dirset"); +111 assertTrue("DependencyCheck report was not generated", report.exists()); +112 } +113 +114 /** +115 * Test of getFailBuildOnCVSS method, of class DependencyCheckTask. +116 */ +117 @Test +118 public void testGetFailBuildOnCVSS() { +119 expectBuildException("failCVSS", "asdfasdfscore"); +120 System.out.println(this.getOutput()); +121 } +122 }
    diff --git a/dependency-check-ant/xref-test/org/owasp/dependencycheck/taskdefs/package-frame.html b/dependency-check-ant/xref-test/org/owasp/dependencycheck/taskdefs/package-frame.html index 8fef8eeed..2cb9d92c3 100644 --- a/dependency-check-ant/xref-test/org/owasp/dependencycheck/taskdefs/package-frame.html +++ b/dependency-check-ant/xref-test/org/owasp/dependencycheck/taskdefs/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Ant Task 1.0.8 Reference Package org.owasp.dependencycheck.taskdefs + Dependency-Check Ant Task 1.1.0 Reference Package org.owasp.dependencycheck.taskdefs diff --git a/dependency-check-ant/xref-test/org/owasp/dependencycheck/taskdefs/package-summary.html b/dependency-check-ant/xref-test/org/owasp/dependencycheck/taskdefs/package-summary.html index a6270c007..45558c86d 100644 --- a/dependency-check-ant/xref-test/org/owasp/dependencycheck/taskdefs/package-summary.html +++ b/dependency-check-ant/xref-test/org/owasp/dependencycheck/taskdefs/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Ant Task 1.0.8 Reference Package org.owasp.dependencycheck.taskdefs + Dependency-Check Ant Task 1.1.0 Reference Package org.owasp.dependencycheck.taskdefs diff --git a/dependency-check-ant/xref-test/overview-frame.html b/dependency-check-ant/xref-test/overview-frame.html index a8134eea5..f9de60f72 100644 --- a/dependency-check-ant/xref-test/overview-frame.html +++ b/dependency-check-ant/xref-test/overview-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Ant Task 1.0.8 Reference + Dependency-Check Ant Task 1.1.0 Reference diff --git a/dependency-check-ant/xref-test/overview-summary.html b/dependency-check-ant/xref-test/overview-summary.html index 84cbe6fc7..a8fe89bf9 100644 --- a/dependency-check-ant/xref-test/overview-summary.html +++ b/dependency-check-ant/xref-test/overview-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Ant Task 1.0.8 Reference + Dependency-Check Ant Task 1.1.0 Reference @@ -24,7 +24,7 @@ -

    Dependency-Check Ant Task 1.0.8 Reference

    +

    Dependency-Check Ant Task 1.1.0 Reference

    diff --git a/dependency-check-ant/xref/index.html b/dependency-check-ant/xref/index.html index 297d8d108..4ffbc3ed4 100644 --- a/dependency-check-ant/xref/index.html +++ b/dependency-check-ant/xref/index.html @@ -4,7 +4,7 @@ - Dependency-Check Ant Task 1.0.8 Reference + Dependency-Check Ant Task 1.1.0 Reference diff --git a/dependency-check-ant/xref/org/owasp/dependencycheck/taskdefs/DependencyCheckTask.html b/dependency-check-ant/xref/org/owasp/dependencycheck/taskdefs/DependencyCheckTask.html index 9386c73c3..7021bc43e 100644 --- a/dependency-check-ant/xref/org/owasp/dependencycheck/taskdefs/DependencyCheckTask.html +++ b/dependency-check-ant/xref/org/owasp/dependencycheck/taskdefs/DependencyCheckTask.html @@ -9,135 +9,135 @@ 1/*2 * This file is part of dependency-check-ant.3 * -4 * Dependency-check-ant is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-ant is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-ant. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2013 Jeremy Long. All Rights Reserved. -18 */ -19package org.owasp.dependencycheck.taskdefs; -20 -21import java.io.File; -22import java.io.IOException; -23import java.io.InputStream; -24import java.util.List; -25import java.util.logging.Level; -26import java.util.logging.Logger; -27import org.apache.tools.ant.BuildException; -28import org.apache.tools.ant.Task; -29import org.apache.tools.ant.types.EnumeratedAttribute; -30import org.apache.tools.ant.types.Reference; -31import org.apache.tools.ant.types.Resource; -32import org.apache.tools.ant.types.ResourceCollection; -33import org.apache.tools.ant.types.resources.FileProvider; -34import org.apache.tools.ant.types.resources.Resources; -35import org.owasp.dependencycheck.Engine; -36import org.owasp.dependencycheck.dependency.Dependency; -37import org.owasp.dependencycheck.dependency.Identifier; -38import org.owasp.dependencycheck.dependency.Vulnerability; -39import org.owasp.dependencycheck.reporting.ReportGenerator; -40import org.owasp.dependencycheck.reporting.ReportGenerator.Format; -41import org.owasp.dependencycheck.utils.LogUtils; -42import org.owasp.dependencycheck.utils.Settings; -43 -44/** -45 * An Ant task definition to execute dependency-check during an Ant build. -46 * -47 * @author Jeremy Long <jeremy.long@owasp.org> -48 */ -49publicclassDependencyCheckTaskextends Task { -50 -51/** -52 * The properties file location. -53 */ -54privatestaticfinal String PROPERTIES_FILE = "task.properties"; -55/** -56 * Name of the logging properties file. -57 */ -58privatestaticfinal String LOG_PROPERTIES_FILE = "log.properties"; -59/** -60 * System specific new line character. -61 */ -62privatestaticfinal String NEW_LINE = System.getProperty("line.separator", "\n").intern(); -63 -64/** -65 * Construct a new DependencyCheckTask. -66 */ -67publicDependencyCheckTask() { -68super(); -69 } -70//The following code was copied Apache Ant PathConvert -71//BEGIN COPY from org.apache.tools.ant.taskdefs.PathConvert -72/** -73 * Path to be converted -74 */ -75private Resources path = null; -76/** -77 * Reference to path/fileset to convert -78 */ -79private Reference refid = null; -80 -81/** -82 * Add an arbitrary ResourceCollection. -83 * -84 * @param rc the ResourceCollection to add. -85 * @since Ant 1.7 -86 */ -87publicvoid add(ResourceCollection rc) { -88if (isReference()) { -89thrownew BuildException("Nested elements are not allowed when using the refid attribute."); -90 } -91 getPath().add(rc); -92 } -93 -94/** -95 * Returns the path. If the path has not been initialized yet, this class is -96 * synchronized, and will instantiate the path object. -97 * -98 * @return the path -99 */ -100privatesynchronized Resources getPath() { -101if (path == null) { -102 path = new Resources(getProject()); -103 path.setCache(true); -104 } -105return path; -106 } -107 -108/** -109 * Learn whether the refid attribute of this element been set. -110 * -111 * @return true if refid is valid. -112 */ -113publicboolean isReference() { -114return refid != null; -115 } -116 -117/** -118 * Add a reference to a Path, FileSet, DirSet, or FileList defined -119 * elsewhere. -120 * -121 * @param r the reference to a path, fileset, dirset or filelist. -122 */ -123publicvoid setRefid(Reference r) { -124if (path != null) { -125thrownew BuildException("Nested elements are not allowed when using the refid attribute."); -126 } -127 refid = r; -128 } -129 -130/** -131 * If this is a reference, this method will add the referenced resource -132 * collection to the collection of paths. +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2013 Jeremy Long. All Rights Reserved. +17 */ +18package org.owasp.dependencycheck.taskdefs; +19 +20import java.io.File; +21import java.io.IOException; +22import java.io.InputStream; +23import java.util.List; +24import java.util.logging.Level; +25import java.util.logging.Logger; +26import org.apache.tools.ant.BuildException; +27import org.apache.tools.ant.Task; +28import org.apache.tools.ant.types.EnumeratedAttribute; +29import org.apache.tools.ant.types.Reference; +30import org.apache.tools.ant.types.Resource; +31import org.apache.tools.ant.types.ResourceCollection; +32import org.apache.tools.ant.types.resources.FileProvider; +33import org.apache.tools.ant.types.resources.Resources; +34import org.owasp.dependencycheck.Engine; +35import org.owasp.dependencycheck.data.nvdcve.CveDB; +36import org.owasp.dependencycheck.data.nvdcve.DatabaseException; +37import org.owasp.dependencycheck.data.nvdcve.DatabaseProperties; +38import org.owasp.dependencycheck.dependency.Dependency; +39import org.owasp.dependencycheck.dependency.Identifier; +40import org.owasp.dependencycheck.dependency.Vulnerability; +41import org.owasp.dependencycheck.reporting.ReportGenerator; +42import org.owasp.dependencycheck.reporting.ReportGenerator.Format; +43import org.owasp.dependencycheck.utils.LogUtils; +44import org.owasp.dependencycheck.utils.Settings; +45 +46/** +47 * An Ant task definition to execute dependency-check during an Ant build. +48 * +49 * @author Jeremy Long <jeremy.long@owasp.org> +50 */ +51publicclassDependencyCheckTaskextends Task { +52 +53/** +54 * The properties file location. +55 */ +56privatestaticfinal String PROPERTIES_FILE = "task.properties"; +57/** +58 * Name of the logging properties file. +59 */ +60privatestaticfinal String LOG_PROPERTIES_FILE = "log.properties"; +61/** +62 * System specific new line character. +63 */ +64privatestaticfinal String NEW_LINE = System.getProperty("line.separator", "\n").intern(); +65 +66/** +67 * Construct a new DependencyCheckTask. +68 */ +69publicDependencyCheckTask() { +70super(); +71 } +72//The following code was copied Apache Ant PathConvert +73//BEGIN COPY from org.apache.tools.ant.taskdefs.PathConvert +74/** +75 * Path to be converted +76 */ +77private Resources path = null; +78/** +79 * Reference to path/fileset to convert +80 */ +81private Reference refid = null; +82 +83/** +84 * Add an arbitrary ResourceCollection. +85 * +86 * @param rc the ResourceCollection to add. +87 * @since Ant 1.7 +88 */ +89publicvoid add(ResourceCollection rc) { +90if (isReference()) { +91thrownew BuildException("Nested elements are not allowed when using the refid attribute."); +92 } +93 getPath().add(rc); +94 } +95 +96/** +97 * Returns the path. If the path has not been initialized yet, this class is synchronized, and will instantiate the +98 * path object. +99 * +100 * @return the path +101 */ +102privatesynchronized Resources getPath() { +103if (path == null) { +104 path = new Resources(getProject()); +105 path.setCache(true); +106 } +107return path; +108 } +109 +110/** +111 * Learn whether the refid attribute of this element been set. +112 * +113 * @return true if refid is valid. +114 */ +115publicboolean isReference() { +116return refid != null; +117 } +118 +119/** +120 * Add a reference to a Path, FileSet, DirSet, or FileList defined elsewhere. +121 * +122 * @param r the reference to a path, fileset, dirset or filelist. +123 */ +124publicvoid setRefid(Reference r) { +125if (path != null) { +126thrownew BuildException("Nested elements are not allowed when using the refid attribute."); +127 } +128 refid = r; +129 } +130 +131/** +132 * If this is a reference, this method will add the referenced resource collection to the collection of paths.133 *134 * @throws BuildException if the reference is not to a resource collection135 */ @@ -197,479 +197,661 @@ 189this.dataDirectory = dataDirectory; 190 } 191/** -192 * Specifies the destination directory for the generated Dependency-Check -193 * report. -194 */ -195private String reportOutputDirectory = "."; -196 -197/** -198 * Get the value of reportOutputDirectory. -199 * -200 * @return the value of reportOutputDirectory -201 */ -202public String getReportOutputDirectory() { -203return reportOutputDirectory; -204 } -205 -206/** -207 * Set the value of reportOutputDirectory. -208 * -209 * @param reportOutputDirectory new value of reportOutputDirectory -210 */ -211publicvoid setReportOutputDirectory(String reportOutputDirectory) { -212this.reportOutputDirectory = reportOutputDirectory; -213 } -214/** -215 * Specifies if the build should be failed if a CVSS score above a specified -216 * level is identified. The default is 11 which means since the CVSS scores -217 * are 0-10, by default the build will never fail and the CVSS score is set -218 * to 11. The valid range for the fail build on CVSS is 0 to 11, where -219 * anything above 10 will not cause the build to fail. -220 */ -221privatefloat failBuildOnCVSS = 11; -222 -223/** -224 * Get the value of failBuildOnCVSS. -225 * -226 * @return the value of failBuildOnCVSS -227 */ -228publicfloat getFailBuildOnCVSS() { -229return failBuildOnCVSS; -230 } -231 -232/** -233 * Set the value of failBuildOnCVSS. -234 * -235 * @param failBuildOnCVSS new value of failBuildOnCVSS -236 */ -237publicvoid setFailBuildOnCVSS(float failBuildOnCVSS) { -238this.failBuildOnCVSS = failBuildOnCVSS; -239 } -240/** -241 * Sets whether auto-updating of the NVD CVE/CPE data is enabled. It is not -242 * recommended that this be turned to false. Default is true. -243 */ -244privateboolean autoUpdate = true; -245 -246/** -247 * Get the value of autoUpdate. -248 * -249 * @return the value of autoUpdate -250 */ -251publicboolean isAutoUpdate() { -252return autoUpdate; -253 } -254 -255/** -256 * Set the value of autoUpdate. -257 * -258 * @param autoUpdate new value of autoUpdate -259 */ -260publicvoid setAutoUpdate(boolean autoUpdate) { -261this.autoUpdate = autoUpdate; -262 } -263/** -264 * The report format to be generated (HTML, XML, VULN, ALL). This -265 * configuration option has no affect if using this within the Site plugin -266 * unless the externalReport is set to true. Default is HTML. -267 */ -268private String reportFormat = "HTML"; -269 -270/** -271 * Get the value of reportFormat. -272 * -273 * @return the value of reportFormat -274 */ -275public String getReportFormat() { -276return reportFormat; -277 } -278 -279/** -280 * Set the value of reportFormat. -281 * -282 * @param reportFormat new value of reportFormat -283 */ -284publicvoid setReportFormat(ReportFormats reportFormat) { -285this.reportFormat = reportFormat.getValue(); -286 } -287/** -288 * The Proxy URL. -289 */ -290private String proxyUrl; -291 -292/** -293 * Get the value of proxyUrl. -294 * -295 * @return the value of proxyUrl -296 */ -297public String getProxyUrl() { -298return proxyUrl; -299 } -300 -301/** -302 * Set the value of proxyUrl. -303 * -304 * @param proxyUrl new value of proxyUrl -305 */ -306publicvoid setProxyUrl(String proxyUrl) { -307this.proxyUrl = proxyUrl; -308 } -309/** -310 * The Proxy Port. -311 */ -312private String proxyPort; -313 -314/** -315 * Get the value of proxyPort. -316 * -317 * @return the value of proxyPort -318 */ -319public String getProxyPort() { -320return proxyPort; -321 } -322 -323/** -324 * Set the value of proxyPort. -325 * -326 * @param proxyPort new value of proxyPort -327 */ -328publicvoid setProxyPort(String proxyPort) { -329this.proxyPort = proxyPort; -330 } -331/** -332 * The Proxy username. -333 */ -334private String proxyUsername; -335 -336/** -337 * Get the value of proxyUsername. -338 * -339 * @return the value of proxyUsername -340 */ -341public String getProxyUsername() { -342return proxyUsername; -343 } -344 -345/** -346 * Set the value of proxyUsername. -347 * -348 * @param proxyUsername new value of proxyUsername -349 */ -350publicvoid setProxyUsername(String proxyUsername) { -351this.proxyUsername = proxyUsername; -352 } -353/** -354 * The Proxy password. -355 */ -356private String proxyPassword; -357 -358/** -359 * Get the value of proxyPassword. -360 * -361 * @return the value of proxyPassword -362 */ -363public String getProxyPassword() { -364return proxyPassword; -365 } -366 -367/** -368 * Set the value of proxyPassword. -369 * -370 * @param proxyPassword new value of proxyPassword -371 */ -372publicvoid setProxyPassword(String proxyPassword) { -373this.proxyPassword = proxyPassword; -374 } -375/** -376 * The Connection Timeout. -377 */ -378private String connectionTimeout; -379 -380/** -381 * Get the value of connectionTimeout. -382 * -383 * @return the value of connectionTimeout -384 */ -385public String getConnectionTimeout() { -386return connectionTimeout; -387 } -388 -389/** -390 * Set the value of connectionTimeout. -391 * -392 * @param connectionTimeout new value of connectionTimeout -393 */ -394publicvoid setConnectionTimeout(String connectionTimeout) { -395this.connectionTimeout = connectionTimeout; -396 } -397/** -398 * The file path used for verbose logging. -399 */ -400private String logFile = null; -401 -402/** -403 * Get the value of logFile. -404 * -405 * @return the value of logFile -406 */ -407public String getLogFile() { -408return logFile; -409 } -410 -411/** -412 * Set the value of logFile. -413 * -414 * @param logFile new value of logFile -415 */ -416publicvoid setLogFile(String logFile) { -417this.logFile = logFile; -418 } -419/** -420 * The path to the suppression file. -421 */ -422private String suppressionFile; -423 -424/** -425 * Get the value of suppressionFile. -426 * -427 * @return the value of suppressionFile -428 */ -429public String getSuppressionFile() { -430return suppressionFile; -431 } -432 -433/** -434 * Set the value of suppressionFile. -435 * -436 * @param suppressionFile new value of suppressionFile -437 */ -438publicvoid setSuppressionFile(String suppressionFile) { -439this.suppressionFile = suppressionFile; -440 } -441/** -442 * flag indicating whether or not to show a summary of findings. -443 */ -444privateboolean showSummary = true; -445 -446/** -447 * Get the value of showSummary. -448 * -449 * @return the value of showSummary -450 */ -451publicboolean isShowSummary() { -452return showSummary; -453 } -454 -455/** -456 * Set the value of showSummary. -457 * -458 * @param showSummary new value of showSummary -459 */ -460publicvoid setShowSummary(boolean showSummary) { -461this.showSummary = showSummary; -462 } -463 -464 @Override -465publicvoid execute() throws BuildException { -466final InputStream in = DependencyCheckTask.class.getClassLoader().getResourceAsStream(LOG_PROPERTIES_FILE); -467 LogUtils.prepareLogger(in, logFile); -468 -469 dealWithReferences(); -470 validateConfiguration(); -471 populateSettings(); -472 -473final Engine engine = new Engine(); -474for (Resource resource : path) { -475final FileProvider provider = resource.as(FileProvider.class); -476if (provider != null) { -477final File file = provider.getFile(); -478if (file != null && file.exists()) { -479 engine.scan(file); -480 } -481 } -482 } -483try { -484 engine.analyzeDependencies(); -485final ReportGenerator reporter = new ReportGenerator(applicationName, engine.getDependencies(), engine.getAnalyzers()); -486 reporter.generateReports(reportOutputDirectory, reportFormat); +192 * Specifies the destination directory for the generated Dependency-Check report. +193 */ +194private String reportOutputDirectory = "."; +195 +196/** +197 * Get the value of reportOutputDirectory. +198 * +199 * @return the value of reportOutputDirectory +200 */ +201public String getReportOutputDirectory() { +202return reportOutputDirectory; +203 } +204 +205/** +206 * Set the value of reportOutputDirectory. +207 * +208 * @param reportOutputDirectory new value of reportOutputDirectory +209 */ +210publicvoid setReportOutputDirectory(String reportOutputDirectory) { +211this.reportOutputDirectory = reportOutputDirectory; +212 } +213/** +214 * Specifies if the build should be failed if a CVSS score above a specified level is identified. The default is 11 +215 * which means since the CVSS scores are 0-10, by default the build will never fail and the CVSS score is set to 11. +216 * The valid range for the fail build on CVSS is 0 to 11, where anything above 10 will not cause the build to fail. +217 */ +218privatefloat failBuildOnCVSS = 11; +219 +220/** +221 * Get the value of failBuildOnCVSS. +222 * +223 * @return the value of failBuildOnCVSS +224 */ +225publicfloat getFailBuildOnCVSS() { +226return failBuildOnCVSS; +227 } +228 +229/** +230 * Set the value of failBuildOnCVSS. +231 * +232 * @param failBuildOnCVSS new value of failBuildOnCVSS +233 */ +234publicvoid setFailBuildOnCVSS(float failBuildOnCVSS) { +235this.failBuildOnCVSS = failBuildOnCVSS; +236 } +237/** +238 * Sets whether auto-updating of the NVD CVE/CPE data is enabled. It is not recommended that this be turned to +239 * false. Default is true. +240 */ +241privateboolean autoUpdate = true; +242 +243/** +244 * Get the value of autoUpdate. +245 * +246 * @return the value of autoUpdate +247 */ +248publicboolean isAutoUpdate() { +249return autoUpdate; +250 } +251 +252/** +253 * Set the value of autoUpdate. +254 * +255 * @param autoUpdate new value of autoUpdate +256 */ +257publicvoid setAutoUpdate(boolean autoUpdate) { +258this.autoUpdate = autoUpdate; +259 } +260/** +261 * The report format to be generated (HTML, XML, VULN, ALL). This configuration option has no affect if using this +262 * within the Site plugin unless the externalReport is set to true. Default is HTML. +263 */ +264private String reportFormat = "HTML"; +265 +266/** +267 * Get the value of reportFormat. +268 * +269 * @return the value of reportFormat +270 */ +271public String getReportFormat() { +272return reportFormat; +273 } +274 +275/** +276 * Set the value of reportFormat. +277 * +278 * @param reportFormat new value of reportFormat +279 */ +280publicvoid setReportFormat(ReportFormats reportFormat) { +281this.reportFormat = reportFormat.getValue(); +282 } +283/** +284 * The Proxy URL. +285 */ +286private String proxyUrl; +287 +288/** +289 * Get the value of proxyUrl. +290 * +291 * @return the value of proxyUrl +292 */ +293public String getProxyUrl() { +294return proxyUrl; +295 } +296 +297/** +298 * Set the value of proxyUrl. +299 * +300 * @param proxyUrl new value of proxyUrl +301 */ +302publicvoid setProxyUrl(String proxyUrl) { +303this.proxyUrl = proxyUrl; +304 } +305/** +306 * The Proxy Port. +307 */ +308private String proxyPort; +309 +310/** +311 * Get the value of proxyPort. +312 * +313 * @return the value of proxyPort +314 */ +315public String getProxyPort() { +316return proxyPort; +317 } +318 +319/** +320 * Set the value of proxyPort. +321 * +322 * @param proxyPort new value of proxyPort +323 */ +324publicvoid setProxyPort(String proxyPort) { +325this.proxyPort = proxyPort; +326 } +327/** +328 * The Proxy username. +329 */ +330private String proxyUsername; +331 +332/** +333 * Get the value of proxyUsername. +334 * +335 * @return the value of proxyUsername +336 */ +337public String getProxyUsername() { +338return proxyUsername; +339 } +340 +341/** +342 * Set the value of proxyUsername. +343 * +344 * @param proxyUsername new value of proxyUsername +345 */ +346publicvoid setProxyUsername(String proxyUsername) { +347this.proxyUsername = proxyUsername; +348 } +349/** +350 * The Proxy password. +351 */ +352private String proxyPassword; +353 +354/** +355 * Get the value of proxyPassword. +356 * +357 * @return the value of proxyPassword +358 */ +359public String getProxyPassword() { +360return proxyPassword; +361 } +362 +363/** +364 * Set the value of proxyPassword. +365 * +366 * @param proxyPassword new value of proxyPassword +367 */ +368publicvoid setProxyPassword(String proxyPassword) { +369this.proxyPassword = proxyPassword; +370 } +371/** +372 * The Connection Timeout. +373 */ +374private String connectionTimeout; +375 +376/** +377 * Get the value of connectionTimeout. +378 * +379 * @return the value of connectionTimeout +380 */ +381public String getConnectionTimeout() { +382return connectionTimeout; +383 } +384 +385/** +386 * Set the value of connectionTimeout. +387 * +388 * @param connectionTimeout new value of connectionTimeout +389 */ +390publicvoid setConnectionTimeout(String connectionTimeout) { +391this.connectionTimeout = connectionTimeout; +392 } +393/** +394 * The file path used for verbose logging. +395 */ +396private String logFile = null; +397 +398/** +399 * Get the value of logFile. +400 * +401 * @return the value of logFile +402 */ +403public String getLogFile() { +404return logFile; +405 } +406 +407/** +408 * Set the value of logFile. +409 * +410 * @param logFile new value of logFile +411 */ +412publicvoid setLogFile(String logFile) { +413this.logFile = logFile; +414 } +415/** +416 * The path to the suppression file. +417 */ +418private String suppressionFile; +419 +420/** +421 * Get the value of suppressionFile. +422 * +423 * @return the value of suppressionFile +424 */ +425public String getSuppressionFile() { +426return suppressionFile; +427 } +428 +429/** +430 * Set the value of suppressionFile. +431 * +432 * @param suppressionFile new value of suppressionFile +433 */ +434publicvoid setSuppressionFile(String suppressionFile) { +435this.suppressionFile = suppressionFile; +436 } +437/** +438 * flag indicating whether or not to show a summary of findings. +439 */ +440privateboolean showSummary = true; +441 +442/** +443 * Get the value of showSummary. +444 * +445 * @return the value of showSummary +446 */ +447publicboolean isShowSummary() { +448return showSummary; +449 } +450 +451/** +452 * Set the value of showSummary. +453 * +454 * @param showSummary new value of showSummary +455 */ +456publicvoid setShowSummary(boolean showSummary) { +457this.showSummary = showSummary; +458 } +459 +460/** +461 * Whether or not the nexus analyzer is enabled. +462 */ +463privateboolean nexusAnalyzerEnabled = true; +464 +465/** +466 * Get the value of nexusAnalyzerEnabled. +467 * +468 * @return the value of nexusAnalyzerEnabled +469 */ +470publicboolean isNexusAnalyzerEnabled() { +471return nexusAnalyzerEnabled; +472 } +473 +474/** +475 * Set the value of nexusAnalyzerEnabled. +476 * +477 * @param nexusAnalyzerEnabled new value of nexusAnalyzerEnabled +478 */ +479publicvoid setNexusAnalyzerEnabled(boolean nexusAnalyzerEnabled) { +480this.nexusAnalyzerEnabled = nexusAnalyzerEnabled; +481 } +482 +483/** +484 * The URL of the Nexus server. +485 */ +486private String nexusUrl; 487 -488if (this.failBuildOnCVSS <= 10) { -489 checkForFailure(engine.getDependencies()); -490 } -491if (this.showSummary) { -492 showSummary(engine.getDependencies()); -493 } -494 } catch (IOException ex) { -495 Logger.getLogger(DependencyCheckTask.class.getName()).log(Level.FINE, "Unable to generate dependency-check report", ex); -496thrownew BuildException("Unable to generate dependency-check report", ex); -497 } catch (Exception ex) { -498 Logger.getLogger(DependencyCheckTask.class.getName()).log(Level.FINE, "An exception occurred; unable to continue task", ex); -499thrownew BuildException("An exception occurred; unable to continue task", ex); -500 } -501 } -502 -503/** -504 * Validate the configuration to ensure the parameters have been properly -505 * configured/initialized. -506 * -507 * @throws BuildException if the task was not configured correctly. +488/** +489 * Get the value of nexusUrl. +490 * +491 * @return the value of nexusUrl +492 */ +493public String getNexusUrl() { +494return nexusUrl; +495 } +496 +497/** +498 * Set the value of nexusUrl. +499 * +500 * @param nexusUrl new value of nexusUrl +501 */ +502publicvoid setNexusUrl(String nexusUrl) { +503this.nexusUrl = nexusUrl; +504 } +505 +506/** +507 * The database driver name; such as org.h2.Driver.508 */ -509privatevoid validateConfiguration() throws BuildException { -510if (path == null) { -511thrownew BuildException("No project dependencies have been defined to analyze."); -512 } -513if (failBuildOnCVSS < 0 || failBuildOnCVSS > 11) { -514thrownew BuildException("Invalid configuration, failBuildOnCVSS must be between 0 and 11."); -515 } -516 } -517 -518/** -519 * Takes the properties supplied and updates the dependency-check settings. -520 * Additionally, this sets the system properties required to change the -521 * proxy url, port, and connection timeout. -522 */ -523privatevoid populateSettings() { -524 InputStream taskProperties = null; -525try { -526 taskProperties = this.getClass().getClassLoader().getResourceAsStream(PROPERTIES_FILE); -527 Settings.mergeProperties(taskProperties); -528 } catch (IOException ex) { -529 Logger.getLogger(DependencyCheckTask.class.getName()).log(Level.WARNING, "Unable to load the dependency-check ant task.properties file."); -530 Logger.getLogger(DependencyCheckTask.class.getName()).log(Level.FINE, null, ex); -531 } finally { -532if (taskProperties != null) { -533try { -534 taskProperties.close(); -535 } catch (IOException ex) { -536 Logger.getLogger(DependencyCheckTask.class.getName()).log(Level.FINEST, null, ex); -537 } -538 } -539 } -540if (dataDirectory != null) { -541 Settings.setString(Settings.KEYS.DATA_DIRECTORY, dataDirectory); -542 } else { -543final File jarPath = new File(DependencyCheckTask.class.getProtectionDomain().getCodeSource().getLocation().getPath()); -544final File base = jarPath.getParentFile(); -545final String sub = Settings.getString(Settings.KEYS.DATA_DIRECTORY); -546final File dataDir = new File(base, sub); -547 Settings.setString(Settings.KEYS.DATA_DIRECTORY, dataDir.getAbsolutePath()); -548 } -549 -550 Settings.setBoolean(Settings.KEYS.AUTO_UPDATE, autoUpdate); -551 -552if (proxyUrl != null && !proxyUrl.isEmpty()) { -553 Settings.setString(Settings.KEYS.PROXY_URL, proxyUrl); -554 } -555if (proxyPort != null && !proxyPort.isEmpty()) { -556 Settings.setString(Settings.KEYS.PROXY_PORT, proxyPort); -557 } -558if (proxyUsername != null && !proxyUsername.isEmpty()) { -559 Settings.setString(Settings.KEYS.PROXY_USERNAME, proxyUsername); -560 } -561if (proxyPassword != null && !proxyPassword.isEmpty()) { -562 Settings.setString(Settings.KEYS.PROXY_PASSWORD, proxyPassword); -563 } -564if (connectionTimeout != null && !connectionTimeout.isEmpty()) { -565 Settings.setString(Settings.KEYS.CONNECTION_TIMEOUT, connectionTimeout); -566 } -567if (suppressionFile != null && !suppressionFile.isEmpty()) { -568 Settings.setString(Settings.KEYS.SUPPRESSION_FILE, suppressionFile); -569 } -570 } -571 -572/** -573 * Checks to see if a vulnerability has been identified with a CVSS score -574 * that is above the threshold set in the configuration. -575 * -576 * @param dependencies the list of dependency objects -577 * @throws BuildException thrown if a CVSS score is found that is higher -578 * then the threshold set -579 */ -580privatevoid checkForFailure(List<Dependency> dependencies) throws BuildException { -581final StringBuilder ids = new StringBuilder(); -582for (Dependency d : dependencies) { -583for (Vulnerability v : d.getVulnerabilities()) { -584if (v.getCvssScore() >= failBuildOnCVSS) { -585if (ids.length() == 0) { -586 ids.append(v.getName()); -587 } else { -588 ids.append(", ").append(v.getName()); -589 } -590 } -591 } -592 } -593if (ids.length() > 0) { -594final String msg = String.format("%n%nDependency-Check Failure:%n" -595 + "One or more dependencies were identified with vulnerabilities that have a CVSS score greater then '%.1f': %s%n" -596 + "See the dependency-check report for more details.%n%n", failBuildOnCVSS, ids.toString()); -597thrownew BuildException(msg); -598 } -599 } +509private String databaseDriverName; +510 +511/** +512 * Get the value of databaseDriverName. +513 * +514 * @return the value of databaseDriverName +515 */ +516public String getDatabaseDriverName() { +517return databaseDriverName; +518 } +519 +520/** +521 * Set the value of databaseDriverName. +522 * +523 * @param databaseDriverName new value of databaseDriverName +524 */ +525publicvoid setDatabaseDriverName(String databaseDriverName) { +526this.databaseDriverName = databaseDriverName; +527 } +528 +529/** +530 * The path to the database driver JAR file if it is not on the class path. +531 */ +532private String databaseDriverPath; +533 +534/** +535 * Get the value of databaseDriverPath. +536 * +537 * @return the value of databaseDriverPath +538 */ +539public String getDatabaseDriverPath() { +540return databaseDriverPath; +541 } +542 +543/** +544 * Set the value of databaseDriverPath. +545 * +546 * @param databaseDriverPath new value of databaseDriverPath +547 */ +548publicvoid setDatabaseDriverPath(String databaseDriverPath) { +549this.databaseDriverPath = databaseDriverPath; +550 } +551/** +552 * The database connection string. +553 */ +554private String connectionString; +555 +556/** +557 * Get the value of connectionString. +558 * +559 * @return the value of connectionString +560 */ +561public String getConnectionString() { +562return connectionString; +563 } +564 +565/** +566 * Set the value of connectionString. +567 * +568 * @param connectionString new value of connectionString +569 */ +570publicvoid setConnectionString(String connectionString) { +571this.connectionString = connectionString; +572 } +573/** +574 * The user name for connecting to the database. +575 */ +576private String databaseUser; +577 +578/** +579 * Get the value of databaseUser. +580 * +581 * @return the value of databaseUser +582 */ +583public String getDatabaseUser() { +584return databaseUser; +585 } +586 +587/** +588 * Set the value of databaseUser. +589 * +590 * @param databaseUser new value of databaseUser +591 */ +592publicvoid setDatabaseUser(String databaseUser) { +593this.databaseUser = databaseUser; +594 } +595 +596/** +597 * The password to use when connecting to the database. +598 */ +599private String databasePassword; 600601/** -602 * Generates a warning message listing a summary of dependencies and their -603 * associated CPE and CVE entries. -604 * -605 * @param dependencies a list of dependency objects -606 */ -607privatevoid showSummary(List<Dependency> dependencies) { -608final StringBuilder summary = new StringBuilder(); -609for (Dependency d : dependencies) { -610boolean firstEntry = true; -611final StringBuilder ids = new StringBuilder(); -612for (Vulnerability v : d.getVulnerabilities()) { -613if (firstEntry) { -614 firstEntry = false; -615 } else { -616 ids.append(", "); -617 } -618 ids.append(v.getName()); -619 } -620if (ids.length() > 0) { -621 summary.append(d.getFileName()).append(" ("); -622 firstEntry = true; -623for (Identifier id : d.getIdentifiers()) { -624if (firstEntry) { -625 firstEntry = false; -626 } else { -627 summary.append(", "); -628 } -629 summary.append(id.getValue()); -630 } -631 summary.append(") : ").append(ids).append(NEW_LINE); -632 } -633 } -634if (summary.length() > 0) { -635final String msg = String.format("%n%n" -636 + "One or more dependencies were identified with known vulnerabilities:%n%n%s" -637 + "%n%nSee the dependency-check report for more details.%n%n", summary.toString()); -638 Logger.getLogger(DependencyCheckTask.class.getName()).log(Level.WARNING, msg); -639 } -640 } -641 -642/** -643 * An enumeration of supported report formats: "ALL", "HTML", "XML", "VULN", -644 * etc.. -645 */ -646publicstaticclassReportFormatsextends EnumeratedAttribute { -647 -648/** -649 * Returns the list of values for the report format. -650 * -651 * @return the list of values for the report format -652 */ -653 @Override -654public String[] getValues() { -655int i = 0; -656final Format[] formats = Format.values(); -657final String[] values = new String[formats.length]; -658for (Format format : formats) { -659 values[i++] = format.name(); -660 } -661return values; -662 } -663 } -664 } +602 * Get the value of databasePassword. +603 * +604 * @return the value of databasePassword +605 */ +606public String getDatabasePassword() { +607return databasePassword; +608 } +609 +610/** +611 * Set the value of databasePassword. +612 * +613 * @param databasePassword new value of databasePassword +614 */ +615publicvoid setDatabasePassword(String databasePassword) { +616this.databasePassword = databasePassword; +617 } +618 +619 @Override +620publicvoid execute() throws BuildException { +621final InputStream in = DependencyCheckTask.class.getClassLoader().getResourceAsStream(LOG_PROPERTIES_FILE); +622 LogUtils.prepareLogger(in, logFile); +623 +624 dealWithReferences(); +625 validateConfiguration(); +626 populateSettings(); +627 +628final Engine engine = new Engine(); +629for (Resource resource : path) { +630final FileProvider provider = resource.as(FileProvider.class); +631if (provider != null) { +632final File file = provider.getFile(); +633if (file != null && file.exists()) { +634 engine.scan(file); +635 } +636 } +637 } +638try { +639 engine.analyzeDependencies(); +640 DatabaseProperties prop = null; +641 CveDB cve = null; +642try { +643 cve = new CveDB(); +644 cve.open(); +645 prop = cve.getDatabaseProperties(); +646 } catch (DatabaseException ex) { +647 Logger.getLogger(DependencyCheckTask.class.getName()).log(Level.FINE, "Unable to retrieve DB Properties", ex); +648 } finally { +649if (cve != null) { +650 cve.close(); +651 } +652 } +653final ReportGenerator reporter = new ReportGenerator(applicationName, engine.getDependencies(), engine.getAnalyzers(), prop); +654 reporter.generateReports(reportOutputDirectory, reportFormat); +655 +656if (this.failBuildOnCVSS <= 10) { +657 checkForFailure(engine.getDependencies()); +658 } +659if (this.showSummary) { +660 showSummary(engine.getDependencies()); +661 } +662 } catch (IOException ex) { +663 Logger.getLogger(DependencyCheckTask.class.getName()).log(Level.FINE, "Unable to generate dependency-check report", ex); +664thrownew BuildException("Unable to generate dependency-check report", ex); +665 } catch (Exception ex) { +666 Logger.getLogger(DependencyCheckTask.class.getName()).log(Level.FINE, "An exception occurred; unable to continue task", ex); +667thrownew BuildException("An exception occurred; unable to continue task", ex); +668 } +669 } +670 +671/** +672 * Validate the configuration to ensure the parameters have been properly configured/initialized. +673 * +674 * @throws BuildException if the task was not configured correctly. +675 */ +676privatevoid validateConfiguration() throws BuildException { +677if (path == null) { +678thrownew BuildException("No project dependencies have been defined to analyze."); +679 } +680if (failBuildOnCVSS < 0 || failBuildOnCVSS > 11) { +681thrownew BuildException("Invalid configuration, failBuildOnCVSS must be between 0 and 11."); +682 } +683 } +684 +685/** +686 * Takes the properties supplied and updates the dependency-check settings. Additionally, this sets the system +687 * properties required to change the proxy url, port, and connection timeout. +688 */ +689privatevoid populateSettings() { +690 InputStream taskProperties = null; +691try { +692 taskProperties = this.getClass().getClassLoader().getResourceAsStream(PROPERTIES_FILE); +693 Settings.mergeProperties(taskProperties); +694 } catch (IOException ex) { +695 Logger.getLogger(DependencyCheckTask.class.getName()).log(Level.WARNING, "Unable to load the dependency-check ant task.properties file."); +696 Logger.getLogger(DependencyCheckTask.class.getName()).log(Level.FINE, null, ex); +697 } finally { +698if (taskProperties != null) { +699try { +700 taskProperties.close(); +701 } catch (IOException ex) { +702 Logger.getLogger(DependencyCheckTask.class.getName()).log(Level.FINEST, null, ex); +703 } +704 } +705 } +706if (dataDirectory != null) { +707 Settings.setString(Settings.KEYS.DATA_DIRECTORY, dataDirectory); +708 } else { +709final File jarPath = new File(DependencyCheckTask.class.getProtectionDomain().getCodeSource().getLocation().getPath()); +710final File base = jarPath.getParentFile(); +711final String sub = Settings.getString(Settings.KEYS.DATA_DIRECTORY); +712final File dataDir = new File(base, sub); +713 Settings.setString(Settings.KEYS.DATA_DIRECTORY, dataDir.getAbsolutePath()); +714 } +715 +716 Settings.setBoolean(Settings.KEYS.AUTO_UPDATE, autoUpdate); +717 +718if (proxyUrl != null && !proxyUrl.isEmpty()) { +719 Settings.setString(Settings.KEYS.PROXY_URL, proxyUrl); +720 } +721if (proxyPort != null && !proxyPort.isEmpty()) { +722 Settings.setString(Settings.KEYS.PROXY_PORT, proxyPort); +723 } +724if (proxyUsername != null && !proxyUsername.isEmpty()) { +725 Settings.setString(Settings.KEYS.PROXY_USERNAME, proxyUsername); +726 } +727if (proxyPassword != null && !proxyPassword.isEmpty()) { +728 Settings.setString(Settings.KEYS.PROXY_PASSWORD, proxyPassword); +729 } +730if (connectionTimeout != null && !connectionTimeout.isEmpty()) { +731 Settings.setString(Settings.KEYS.CONNECTION_TIMEOUT, connectionTimeout); +732 } +733if (suppressionFile != null && !suppressionFile.isEmpty()) { +734 Settings.setString(Settings.KEYS.SUPPRESSION_FILE, suppressionFile); +735 } +736 Settings.setBoolean(Settings.KEYS.ANALYZER_NEXUS_ENABLED, nexusAnalyzerEnabled); +737if (nexusUrl != null && !nexusUrl.isEmpty()) { +738 Settings.setString(Settings.KEYS.ANALYZER_NEXUS_URL, nexusUrl); +739 } +740if (databaseDriverName != null && !databaseDriverName.isEmpty()) { +741 Settings.setString(Settings.KEYS.DB_DRIVER_NAME, databaseDriverName); +742 } +743if (databaseDriverPath != null && !databaseDriverPath.isEmpty()) { +744 Settings.setString(Settings.KEYS.DB_DRIVER_PATH, databaseDriverPath); +745 } +746if (connectionString != null && !connectionString.isEmpty()) { +747 Settings.setString(Settings.KEYS.DB_CONNECTION_STRING, connectionString); +748 } +749if (databaseUser != null && !databaseUser.isEmpty()) { +750 Settings.setString(Settings.KEYS.DB_USER, databaseUser); +751 } +752if (databasePassword != null && !databasePassword.isEmpty()) { +753 Settings.setString(Settings.KEYS.DB_PASSWORD, databasePassword); +754 } +755 } +756 +757/** +758 * Checks to see if a vulnerability has been identified with a CVSS score that is above the threshold set in the +759 * configuration. +760 * +761 * @param dependencies the list of dependency objects +762 * @throws BuildException thrown if a CVSS score is found that is higher then the threshold set +763 */ +764privatevoid checkForFailure(List<Dependency> dependencies) throws BuildException { +765final StringBuilder ids = new StringBuilder(); +766for (Dependency d : dependencies) { +767for (Vulnerability v : d.getVulnerabilities()) { +768if (v.getCvssScore() >= failBuildOnCVSS) { +769if (ids.length() == 0) { +770 ids.append(v.getName()); +771 } else { +772 ids.append(", ").append(v.getName()); +773 } +774 } +775 } +776 } +777if (ids.length() > 0) { +778final String msg = String.format("%n%nDependency-Check Failure:%n" +779 + "One or more dependencies were identified with vulnerabilities that have a CVSS score greater then '%.1f': %s%n" +780 + "See the dependency-check report for more details.%n%n", failBuildOnCVSS, ids.toString()); +781thrownew BuildException(msg); +782 } +783 } +784 +785/** +786 * Generates a warning message listing a summary of dependencies and their associated CPE and CVE entries. +787 * +788 * @param dependencies a list of dependency objects +789 */ +790privatevoid showSummary(List<Dependency> dependencies) { +791final StringBuilder summary = new StringBuilder(); +792for (Dependency d : dependencies) { +793boolean firstEntry = true; +794final StringBuilder ids = new StringBuilder(); +795for (Vulnerability v : d.getVulnerabilities()) { +796if (firstEntry) { +797 firstEntry = false; +798 } else { +799 ids.append(", "); +800 } +801 ids.append(v.getName()); +802 } +803if (ids.length() > 0) { +804 summary.append(d.getFileName()).append(" ("); +805 firstEntry = true; +806for (Identifier id : d.getIdentifiers()) { +807if (firstEntry) { +808 firstEntry = false; +809 } else { +810 summary.append(", "); +811 } +812 summary.append(id.getValue()); +813 } +814 summary.append(") : ").append(ids).append(NEW_LINE); +815 } +816 } +817if (summary.length() > 0) { +818final String msg = String.format("%n%n" +819 + "One or more dependencies were identified with known vulnerabilities:%n%n%s" +820 + "%n%nSee the dependency-check report for more details.%n%n", summary.toString()); +821 Logger.getLogger(DependencyCheckTask.class.getName()).log(Level.WARNING, msg); +822 } +823 } +824 +825/** +826 * An enumeration of supported report formats: "ALL", "HTML", "XML", "VULN", etc.. +827 */ +828publicstaticclassReportFormatsextends EnumeratedAttribute { +829 +830/** +831 * Returns the list of values for the report format. +832 * +833 * @return the list of values for the report format +834 */ +835 @Override +836public String[] getValues() { +837int i = 0; +838final Format[] formats = Format.values(); +839final String[] values = new String[formats.length]; +840for (Format format : formats) { +841 values[i++] = format.name(); +842 } +843return values; +844 } +845 } +846 }
    diff --git a/dependency-check-ant/xref/org/owasp/dependencycheck/taskdefs/package-frame.html b/dependency-check-ant/xref/org/owasp/dependencycheck/taskdefs/package-frame.html index 25460261c..adf4c9647 100644 --- a/dependency-check-ant/xref/org/owasp/dependencycheck/taskdefs/package-frame.html +++ b/dependency-check-ant/xref/org/owasp/dependencycheck/taskdefs/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Ant Task 1.0.8 Reference Package org.owasp.dependencycheck.taskdefs + Dependency-Check Ant Task 1.1.0 Reference Package org.owasp.dependencycheck.taskdefs diff --git a/dependency-check-ant/xref/org/owasp/dependencycheck/taskdefs/package-summary.html b/dependency-check-ant/xref/org/owasp/dependencycheck/taskdefs/package-summary.html index a221b982a..6d8fc1e34 100644 --- a/dependency-check-ant/xref/org/owasp/dependencycheck/taskdefs/package-summary.html +++ b/dependency-check-ant/xref/org/owasp/dependencycheck/taskdefs/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Ant Task 1.0.8 Reference Package org.owasp.dependencycheck.taskdefs + Dependency-Check Ant Task 1.1.0 Reference Package org.owasp.dependencycheck.taskdefs diff --git a/dependency-check-ant/xref/overview-frame.html b/dependency-check-ant/xref/overview-frame.html index a8134eea5..f9de60f72 100644 --- a/dependency-check-ant/xref/overview-frame.html +++ b/dependency-check-ant/xref/overview-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Ant Task 1.0.8 Reference + Dependency-Check Ant Task 1.1.0 Reference diff --git a/dependency-check-ant/xref/overview-summary.html b/dependency-check-ant/xref/overview-summary.html index 84cbe6fc7..a8fe89bf9 100644 --- a/dependency-check-ant/xref/overview-summary.html +++ b/dependency-check-ant/xref/overview-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Ant Task 1.0.8 Reference + Dependency-Check Ant Task 1.1.0 Reference @@ -24,7 +24,7 @@ -

    Dependency-Check Ant Task 1.0.8 Reference

    +

    Dependency-Check Ant Task 1.1.0 Reference

    diff --git a/dependency-check-cli/apidocs/allclasses-frame.html b/dependency-check-cli/apidocs/allclasses-frame.html index d436d8a02..47223b3d5 100644 --- a/dependency-check-cli/apidocs/allclasses-frame.html +++ b/dependency-check-cli/apidocs/allclasses-frame.html @@ -2,10 +2,10 @@ - + -All Classes (Dependency-Check Command Line 1.0.8 API) - +All Classes (Dependency-Check Command Line 1.1.0 API) + diff --git a/dependency-check-cli/apidocs/allclasses-noframe.html b/dependency-check-cli/apidocs/allclasses-noframe.html index 18443f848..bb826397f 100644 --- a/dependency-check-cli/apidocs/allclasses-noframe.html +++ b/dependency-check-cli/apidocs/allclasses-noframe.html @@ -2,10 +2,10 @@ - + -All Classes (Dependency-Check Command Line 1.0.8 API) - +All Classes (Dependency-Check Command Line 1.1.0 API) + diff --git a/dependency-check-cli/apidocs/constant-values.html b/dependency-check-cli/apidocs/constant-values.html index 1191ed02e..16dce3aa5 100644 --- a/dependency-check-cli/apidocs/constant-values.html +++ b/dependency-check-cli/apidocs/constant-values.html @@ -2,16 +2,16 @@ - + -Constant Field Values (Dependency-Check Command Line 1.0.8 API) - +Constant Field Values (Dependency-Check Command Line 1.1.0 API) + @@ -85,19 +85,33 @@ + + + + + - + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -141,19 +183,33 @@ + + + + + - + + + + + + - - - - - - + - + - + - + - - - - - - - - - - - + - + - + diff --git a/dependency-check-cli/apidocs/deprecated-list.html b/dependency-check-cli/apidocs/deprecated-list.html index 0c2b1d5d4..bae094a42 100644 --- a/dependency-check-cli/apidocs/deprecated-list.html +++ b/dependency-check-cli/apidocs/deprecated-list.html @@ -2,16 +2,16 @@ - + -Deprecated List (Dependency-Check Command Line 1.0.8 API) - +Deprecated List (Dependency-Check Command Line 1.1.0 API) + diff --git a/dependency-check-cli/apidocs/help-doc.html b/dependency-check-cli/apidocs/help-doc.html index 69186cee7..4a5051a2f 100644 --- a/dependency-check-cli/apidocs/help-doc.html +++ b/dependency-check-cli/apidocs/help-doc.html @@ -2,16 +2,16 @@ - + -API Help (Dependency-Check Command Line 1.0.8 API) - +API Help (Dependency-Check Command Line 1.1.0 API) + diff --git a/dependency-check-cli/apidocs/index-all.html b/dependency-check-cli/apidocs/index-all.html index 34fb590a4..6adaf8443 100644 --- a/dependency-check-cli/apidocs/index-all.html +++ b/dependency-check-cli/apidocs/index-all.html @@ -2,16 +2,16 @@ - + -Index (Dependency-Check Command Line 1.0.8 API) - +Index (Dependency-Check Command Line 1.1.0 API) + @@ -63,11 +63,15 @@ -
    A C D G H I M O P R S V  +
    A C D G H I M N O P R S V 

    A

    +
    ADVANCED_HELP - Static variable in class org.owasp.dependencycheck.cli.CliParser.ArgumentName
    +
    +
    The long CLI argument name asking for advanced help.
    +
    App - Class in org.owasp.dependencycheck
    The command line interface for the DependencyCheck application.
    @@ -76,13 +80,11 @@
     
    APP_NAME - Static variable in class org.owasp.dependencycheck.cli.CliParser.ArgumentName
    -
    The long CLI argument name specifying the name of the application to - be scanned.
    +
    The long CLI argument name specifying the name of the application to be scanned.
    APP_NAME_SHORT - Static variable in class org.owasp.dependencycheck.cli.CliParser.ArgumentName
    -
    The short CLI argument name specifying the name of the application to - be scanned.
    +
    The short CLI argument name specifying the name of the application to be scanned.
    @@ -98,11 +100,14 @@
     
    CliParser.ArgumentName - Class in org.owasp.dependencycheck.cli
    -
    A collection of static final strings that represent the possible command - line arguments.
    +
    A collection of static final strings that represent the possible command line arguments.
    CliParser.ArgumentName() - Constructor for class org.owasp.dependencycheck.cli.CliParser.ArgumentName
     
    +
    CONNECTION_STRING - Static variable in class org.owasp.dependencycheck.cli.CliParser.ArgumentName
    +
    +
    The CLI argument name for setting the connection string.
    +
    CONNECTION_TIMEOUT - Static variable in class org.owasp.dependencycheck.cli.CliParser.ArgumentName
    The CLI argument name indicating the connection timeout.
    @@ -123,8 +128,23 @@
    DATA_DIRECTORY_SHORT - Static variable in class org.owasp.dependencycheck.cli.CliParser.ArgumentName
    -
    The short CLI argument name for setting the location of the data - directory.
    +
    The short CLI argument name for setting the location of the data directory.
    +
    +
    DB_DRIVER - Static variable in class org.owasp.dependencycheck.cli.CliParser.ArgumentName
    +
    +
    The CLI argument name for setting the database driver name.
    +
    +
    DB_DRIVER_PATH - Static variable in class org.owasp.dependencycheck.cli.CliParser.ArgumentName
    +
    +
    The CLI argument name for setting the path to the database driver; in case it is not on the class path.
    +
    +
    DB_NAME - Static variable in class org.owasp.dependencycheck.cli.CliParser.ArgumentName
    +
    +
    The CLI argument name for setting the database user name.
    +
    +
    DB_PASSWORD - Static variable in class org.owasp.dependencycheck.cli.CliParser.ArgumentName
    +
    +
    The CLI argument name for setting the database password.
    DISABLE_AUTO_UPDATE - Static variable in class org.owasp.dependencycheck.cli.CliParser.ArgumentName
    @@ -134,6 +154,10 @@
    The short CLI argument name specifying that the CPE/CVE/etc.
    +
    DISABLE_NEXUS - Static variable in class org.owasp.dependencycheck.cli.CliParser.ArgumentName
    +
    +
    Disables the Nexus Analyzer.
    +
    @@ -144,14 +168,38 @@
    Returns the application name specified on the command line.
    +
    getConnectionString() - Method in class org.owasp.dependencycheck.cli.CliParser
    +
    +
    Returns the database connection string if specified; otherwise null is returned.
    +
    getConnectionTimeout() - Method in class org.owasp.dependencycheck.cli.CliParser
    Returns the connection timeout.
    +
    getDatabaseDriverName() - Method in class org.owasp.dependencycheck.cli.CliParser
    +
    +
    Returns the database driver name if specified; otherwise null is returned.
    +
    +
    getDatabaseDriverPath() - Method in class org.owasp.dependencycheck.cli.CliParser
    +
    +
    Returns the database driver path if specified; otherwise null is returned.
    +
    +
    getDatabasePassword() - Method in class org.owasp.dependencycheck.cli.CliParser
    +
    +
    Returns the database database password if specified; otherwise null is returned.
    +
    +
    getDatabaseUser() - Method in class org.owasp.dependencycheck.cli.CliParser
    +
    +
    Returns the database database user name if specified; otherwise null is returned.
    +
    getDataDirectory() - Method in class org.owasp.dependencycheck.cli.CliParser
    Get the value of dataDirectory.
    +
    getNexusUrl() - Method in class org.owasp.dependencycheck.cli.CliParser
    +
    +
    Returns the url to the nexus server if one was specified.
    +
    getPropertiesFile() - Method in class org.owasp.dependencycheck.cli.CliParser
    Returns the properties file specified on the command line.
    @@ -174,8 +222,7 @@
    getReportDirectory() - Method in class org.owasp.dependencycheck.cli.CliParser
    -
    Returns the directory to write the reports to specified on the command - line.
    +
    Returns the directory to write the reports to specified on the command line.
    getReportFormat() - Method in class org.owasp.dependencycheck.cli.CliParser
    @@ -183,8 +230,7 @@
    getScanFiles() - Method in class org.owasp.dependencycheck.cli.CliParser
    -
    Retrieves the file command line parameter(s) specified for the 'scan' - argument.
    +
    Retrieves the file command line parameter(s) specified for the 'scan' argument.
    getSuppressionFile() - Method in class org.owasp.dependencycheck.cli.CliParser
    @@ -226,6 +272,10 @@
    Determines if the 'version' command line argument was passed in.
    +
    isNexusDisabled() - Method in class org.owasp.dependencycheck.cli.CliParser
    +
    +
    Returns true if the disableNexus command line argument was specified.
    +
    isRunScan() - Method in class org.owasp.dependencycheck.cli.CliParser
    Determines if the 'scan' command line argument was passed in.
    @@ -241,6 +291,16 @@
    The main method for the application.
    + + + +

    N

    +
    +
    NEXUS_URL - Static variable in class org.owasp.dependencycheck.cli.CliParser.ArgumentName
    +
    +
    The URL of the nexus server.
    +
    +
    @@ -268,23 +328,19 @@
    OUT - Static variable in class org.owasp.dependencycheck.cli.CliParser.ArgumentName
    -
    The long CLI argument name specifying the directory to write the - reports to.
    +
    The long CLI argument name specifying the directory to write the reports to.
    OUT_SHORT - Static variable in class org.owasp.dependencycheck.cli.CliParser.ArgumentName
    -
    The short CLI argument name specifying the directory to write the - reports to.
    +
    The short CLI argument name specifying the directory to write the reports to.
    OUTPUT_FORMAT - Static variable in class org.owasp.dependencycheck.cli.CliParser.ArgumentName
    -
    The long CLI argument name specifying the output format to write the - reports to.
    +
    The long CLI argument name specifying the output format to write the reports to.
    OUTPUT_FORMAT_SHORT - Static variable in class org.owasp.dependencycheck.cli.CliParser.ArgumentName
    -
    The short CLI argument name specifying the output format to write the - reports to.
    +
    The short CLI argument name specifying the output format to write the reports to.
    @@ -302,26 +358,21 @@
    printVersionInfo() - Method in class org.owasp.dependencycheck.cli.CliParser
    -
    Prints the manifest information to standard output.
    +
    + Prints the manifest information to standard output.
    PROP - Static variable in class org.owasp.dependencycheck.cli.CliParser.ArgumentName
    -
    The CLI argument name for setting the location of an additional - properties file.
    +
    The CLI argument name for setting the location of an additional properties file.
    PROP_SHORT - Static variable in class org.owasp.dependencycheck.cli.CliParser.ArgumentName
    -
    The short CLI argument name for setting the location of an additional - properties file.
    +
    The short CLI argument name for setting the location of an additional properties file.
    PROXY_PASSWORD - Static variable in class org.owasp.dependencycheck.cli.CliParser.ArgumentName
    The CLI argument name indicating the proxy password.
    -
    PROXY_PASSWORD_SHORT - Static variable in class org.owasp.dependencycheck.cli.CliParser.ArgumentName
    -
    -
    The short CLI argument name indicating the proxy password.
    -
    PROXY_PORT - Static variable in class org.owasp.dependencycheck.cli.CliParser.ArgumentName
    The CLI argument name indicating the proxy port.
    @@ -342,10 +393,6 @@
    The CLI argument name indicating the proxy username.
    -
    PROXY_USERNAME_SHORT - Static variable in class org.owasp.dependencycheck.cli.CliParser.ArgumentName
    -
    -
    The short CLI argument name indicating the proxy username.
    -
    @@ -372,13 +419,7 @@
    SUPPRESION_FILE - Static variable in class org.owasp.dependencycheck.cli.CliParser.ArgumentName
    -
    The CLI argument name for setting the location of the suppression - file.
    -
    -
    SUPPRESION_FILE_SHORT - Static variable in class org.owasp.dependencycheck.cli.CliParser.ArgumentName
    -
    -
    The short CLI argument name for setting the location of the - suppression file.
    +
    The CLI argument name for setting the location of the suppression file.
    @@ -392,8 +433,7 @@
    VERBOSE_LOG_SHORT - Static variable in class org.owasp.dependencycheck.cli.CliParser.ArgumentName
    -
    The short CLI argument name for setting the location of the data - directory.
    +
    The short CLI argument name for setting the location of the data directory.
    VERSION - Static variable in class org.owasp.dependencycheck.cli.CliParser.ArgumentName
    @@ -404,7 +444,7 @@
    The long CLI argument name asking for the version.
    -A C D G H I M O P R S V 
    +A C D G H I M N O P R S V 
    diff --git a/dependency-check-cli/apidocs/index.html b/dependency-check-cli/apidocs/index.html index 55cd7305f..836b8f797 100644 --- a/dependency-check-cli/apidocs/index.html +++ b/dependency-check-cli/apidocs/index.html @@ -2,9 +2,9 @@ - + -Dependency-Check Command Line 1.0.8 API +Dependency-Check Command Line 1.1.0 API diff --git a/dependency-check-cli/apidocs/org/owasp/dependencycheck/class-use/App.html b/dependency-check-cli/apidocs/org/owasp/dependencycheck/class-use/App.html index 71a338595..0be2bbabb 100644 --- a/dependency-check-cli/apidocs/org/owasp/dependencycheck/class-use/App.html +++ b/dependency-check-cli/apidocs/org/owasp/dependencycheck/class-use/App.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.App (Dependency-Check Command Line 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.App (Dependency-Check Command Line 1.1.0 API) + diff --git a/dependency-check-cli/apidocs/org/owasp/dependencycheck/cli/CliParser.ArgumentName.html b/dependency-check-cli/apidocs/org/owasp/dependencycheck/cli/CliParser.ArgumentName.html index f7abb9277..2ca888f11 100644 --- a/dependency-check-cli/apidocs/org/owasp/dependencycheck/cli/CliParser.ArgumentName.html +++ b/dependency-check-cli/apidocs/org/owasp/dependencycheck/cli/CliParser.ArgumentName.html @@ -2,16 +2,16 @@ - + -CliParser.ArgumentName (Dependency-Check Command Line 1.0.8 API) - +CliParser.ArgumentName (Dependency-Check Command Line 1.1.0 API) + @@ -103,8 +103,7 @@ 
    public static class CliParser.ArgumentName
 extends Object
    -
    A collection of static final strings that represent the possible command - line arguments.
    +
    A collection of static final strings that represent the possible command line arguments.
    @@ -125,16 +124,26 @@ extends - + + + + + + + + @@ -158,8 +167,31 @@ extends + + + + + + + + + + + + + + + + @@ -176,56 +208,62 @@ extends + + + + - + + + + + @@ -236,46 +274,34 @@ extends - - - - - + - + - + - + - - - - - - - - - + - + - +
    + +public static final StringADVANCED_HELP"advancedHelp"
    public static final String APP_NAME "app"
    public static final String APP_NAME_SHORT "a"
    + +public static final StringCONNECTION_STRING"connectionString"
    @@ -127,6 +141,34 @@ "d"
    + +public static final StringDB_DRIVER"dbDriverName"
    + +public static final StringDB_DRIVER_PATH"dbDriverPath"
    + +public static final StringDB_NAME"dbUser"
    + +public static final StringDB_PASSWORD"dbPassword"
    public static final String"n"
    + +public static final StringDISABLE_NEXUS"disableNexus"
    public static final String HELP "help"
    public static final String HELP_SHORT "h"
    + +public static final StringNEXUS_URL"nexus"
    @@ -204,54 +260,40 @@ "proxypass"
    - -public static final StringPROXY_PASSWORD_SHORT"pp"
    public static final String PROXY_PORT "proxyport"
    public static final String PROXY_PORT_SHORT "p"
    public static final String PROXY_URL "proxyurl"
    public static final String PROXY_URL_SHORT "u"
    public static final String PROXY_USERNAME "proxyuser"
    - -public static final StringPROXY_USERNAME_SHORT"pu"
    @@ -274,34 +316,27 @@ "suppression"
    - -public static final StringSUPPRESION_FILE_SHORT"sf"
    public static final String VERBOSE_LOG "log"
    public static final String VERBOSE_LOG_SHORT "l"
    public static final String VERSION "version"
    public static final String static StringAPP_NAME -
    The long CLI argument name specifying the name of the application to - be scanned.
    +    		ADVANCED_HELP +
    The long CLI argument name asking for advanced help.
    static StringAPP_NAME +
    The long CLI argument name specifying the name of the application to be scanned.
    +
    static String APP_NAME_SHORT -
    The short CLI argument name specifying the name of the application to - be scanned.
    +
    The short CLI argument name specifying the name of the application to be scanned.
    +
    static StringCONNECTION_STRING +
    The CLI argument name for setting the connection string.
    static String DATA_DIRECTORY_SHORT -
    The short CLI argument name for setting the location of the data - directory.
    +
    The short CLI argument name for setting the location of the data directory.
    +
    static StringDB_DRIVER +
    The CLI argument name for setting the database driver name.
    +
    static StringDB_DRIVER_PATH +
    The CLI argument name for setting the path to the database driver; in case it is not on the class path.
    +
    static StringDB_NAME +
    The CLI argument name for setting the database user name.
    +
    static StringDB_PASSWORD +
    The CLI argument name for setting the database password.
    static StringDISABLE_NEXUS +
    Disables the Nexus Analyzer.
    +
    static String HELP
    The long CLI argument name asking for help.
    static String HELP_SHORT
    The short CLI argument name asking for help.
    static StringNEXUS_URL +
    The URL of the nexus server.
    +
    static String OUT -
    The long CLI argument name specifying the directory to write the - reports to.
    +
    The long CLI argument name specifying the directory to write the reports to.
    static String OUT_SHORT -
    The short CLI argument name specifying the directory to write the - reports to.
    +
    The short CLI argument name specifying the directory to write the reports to.
    static String OUTPUT_FORMAT -
    The long CLI argument name specifying the output format to write the - reports to.
    +
    The long CLI argument name specifying the output format to write the reports to.
    static String OUTPUT_FORMAT_SHORT -
    The short CLI argument name specifying the output format to write the - reports to.
    +
    The short CLI argument name specifying the output format to write the reports to.
    static String PROP -
    The CLI argument name for setting the location of an additional - properties file.
    +
    The CLI argument name for setting the location of an additional properties file.
    static String PROP_SHORT -
    The short CLI argument name for setting the location of an additional - properties file.
    +
    The short CLI argument name for setting the location of an additional properties file.
    static StringPROXY_PASSWORD_SHORT -
    The short CLI argument name indicating the proxy password.
    -
    static String PROXY_PORT
    The CLI argument name indicating the proxy port.
    static String PROXY_PORT_SHORT
    The short CLI argument name indicating the proxy port.
    static String PROXY_URL
    The CLI argument name indicating the proxy url.
    static String PROXY_URL_SHORT
    The short CLI argument name indicating the proxy url.
    static String PROXY_USERNAME
    The CLI argument name indicating the proxy username.
    static StringPROXY_USERNAME_SHORT -
    The short CLI argument name indicating the proxy username.
    -
    static String SCAN @@ -291,37 +317,28 @@ extends static String SUPPRESION_FILE -
    The CLI argument name for setting the location of the suppression - file.
    +
    The CLI argument name for setting the location of the suppression file.
    static StringSUPPRESION_FILE_SHORT -
    The short CLI argument name for setting the location of the - suppression file.
    -
    static String VERBOSE_LOG
    The CLI argument name for setting the location of the data directory.
    static String VERBOSE_LOG_SHORT -
    The short CLI argument name for setting the location of the data - directory.
    +
    The short CLI argument name for setting the location of the data directory.
    static String VERSION
    The short CLI argument name asking for the version.
    static String VERSION_SHORT
    The long CLI argument name asking for the version.
    @@ -403,8 +420,7 @@ extends

    DISABLE_AUTO_UPDATE

    public static final String DISABLE_AUTO_UPDATE
    -
    The long CLI argument name specifying that the CPE/CVE/etc. data - should not be automatically updated.
    +
    The long CLI argument name specifying that the CPE/CVE/etc. data should not be automatically updated.
    See Also:
    Constant Field Values
    @@ -415,8 +431,7 @@ extends

    DISABLE_AUTO_UPDATE_SHORT

    public static final String DISABLE_AUTO_UPDATE_SHORT
    -
    The short CLI argument name specifying that the CPE/CVE/etc. data - should not be automatically updated.
    +
    The short CLI argument name specifying that the CPE/CVE/etc. data should not be automatically updated.
    See Also:
    Constant Field Values
    @@ -427,8 +442,7 @@ extends

    OUT

    public static final String OUT
    -
    The long CLI argument name specifying the directory to write the - reports to.
    +
    The long CLI argument name specifying the directory to write the reports to.
    See Also:
    Constant Field Values
    @@ -439,8 +453,7 @@ extends

    OUT_SHORT

    public static final String OUT_SHORT
    -
    The short CLI argument name specifying the directory to write the - reports to.
    +
    The short CLI argument name specifying the directory to write the reports to.
    See Also:
    Constant Field Values
    @@ -451,8 +464,7 @@ extends

    OUTPUT_FORMAT

    public static final String OUTPUT_FORMAT
    -
    The long CLI argument name specifying the output format to write the - reports to.
    +
    The long CLI argument name specifying the output format to write the reports to.
    See Also:
    Constant Field Values
    @@ -463,8 +475,7 @@ extends

    OUTPUT_FORMAT_SHORT

    public static final String OUTPUT_FORMAT_SHORT
    -
    The short CLI argument name specifying the output format to write the - reports to.
    +
    The short CLI argument name specifying the output format to write the reports to.
    See Also:
    Constant Field Values
    @@ -475,8 +486,7 @@ extends

    APP_NAME

    public static final String APP_NAME
    -
    The long CLI argument name specifying the name of the application to - be scanned.
    +
    The long CLI argument name specifying the name of the application to be scanned.
    See Also:
    Constant Field Values
    @@ -487,8 +497,7 @@ extends

    APP_NAME_SHORT

    public static final String APP_NAME_SHORT
    -
    The short CLI argument name specifying the name of the application to - be scanned.
    +
    The short CLI argument name specifying the name of the application to be scanned.
    See Also:
    Constant Field Values
    @@ -503,6 +512,17 @@ extends See Also:
    Constant Field Values
    + + + +
      +
    • +

      ADVANCED_HELP

      +
      public static final String ADVANCED_HELP
      +
      The long CLI argument name asking for advanced help.
      +
      See Also:
      Constant Field Values
      +
      • +
    @@ -580,17 +600,6 @@ extends See Also:
    Constant Field Values
    - - - -
      -
    • -

      PROXY_USERNAME_SHORT

      -
      public static final String PROXY_USERNAME_SHORT
      -
      The short CLI argument name indicating the proxy username.
      -
      See Also:
      Constant Field Values
      -
      • -
    @@ -602,17 +611,6 @@ extends See Also:
    Constant Field Values
    - - - -
      -
    • -

      PROXY_PASSWORD_SHORT

      -
      public static final String PROXY_PASSWORD_SHORT
      -
      The short CLI argument name indicating the proxy password.
      -
      See Also:
      Constant Field Values
      -
      • -
    @@ -653,8 +651,7 @@ extends

    PROP_SHORT

    public static final String PROP_SHORT
    -
    The short CLI argument name for setting the location of an additional - properties file.
    +
    The short CLI argument name for setting the location of an additional properties file.
    See Also:
    Constant Field Values
    @@ -665,8 +662,7 @@ extends

    PROP

    public static final String PROP
    -
    The CLI argument name for setting the location of an additional - properties file.
    +
    The CLI argument name for setting the location of an additional properties file.
    See Also:
    Constant Field Values
    @@ -688,8 +684,7 @@ extends

    DATA_DIRECTORY_SHORT

    public static final String DATA_DIRECTORY_SHORT
    -
    The short CLI argument name for setting the location of the data - directory.
    +
    The short CLI argument name for setting the location of the data directory.
    See Also:
    Constant Field Values
    @@ -711,8 +706,7 @@ extends

    VERBOSE_LOG_SHORT

    public static final String VERBOSE_LOG_SHORT
    -
    The short CLI argument name for setting the location of the data - directory.
    +
    The short CLI argument name for setting the location of the data directory.
    See Also:
    Constant Field Values
    @@ -723,21 +717,85 @@ extends

    SUPPRESION_FILE

    public static final String SUPPRESION_FILE
    -
    The CLI argument name for setting the location of the suppression - file.
    +
    The CLI argument name for setting the location of the suppression file.
    See Also:
    Constant Field Values
    - + + + + + + + + + + + +
      +
    • +

      CONNECTION_STRING

      +
      public static final String CONNECTION_STRING
      +
      The CLI argument name for setting the connection string.
      +
      See Also:
      Constant Field Values
      +
      • +
    + + + +
      +
    • +

      DB_NAME

      +
      public static final String DB_NAME
      +
      The CLI argument name for setting the database user name.
      +
      See Also:
      Constant Field Values
      +
      • +
    + + + +
      +
    • +

      DB_PASSWORD

      +
      public static final String DB_PASSWORD
      +
      The CLI argument name for setting the database password.
      +
      See Also:
      Constant Field Values
      +
      • +
    + + + +
      +
    • +

      DB_DRIVER

      +
      public static final String DB_DRIVER
      +
      The CLI argument name for setting the database driver name.
      +
      See Also:
      Constant Field Values
      +
      • +
    +
    • -

      SUPPRESION_FILE_SHORT

      -
      public static final String SUPPRESION_FILE_SHORT
      -
      The short CLI argument name for setting the location of the - suppression file.
      -
      See Also:
      Constant Field Values
      +

      DB_DRIVER_PATH

      +
      public static final String DB_DRIVER_PATH
      +
      The CLI argument name for setting the path to the database driver; in case it is not on the class path.
      +
      See Also:
      Constant Field Values
    diff --git a/dependency-check-cli/apidocs/org/owasp/dependencycheck/cli/CliParser.html b/dependency-check-cli/apidocs/org/owasp/dependencycheck/cli/CliParser.html index 2b6b47878..35784a433 100644 --- a/dependency-check-cli/apidocs/org/owasp/dependencycheck/cli/CliParser.html +++ b/dependency-check-cli/apidocs/org/owasp/dependencycheck/cli/CliParser.html @@ -2,16 +2,16 @@ - + -CliParser (Dependency-Check Command Line 1.0.8 API) - +CliParser (Dependency-Check Command Line 1.1.0 API) + @@ -123,8 +123,7 @@ extends     		static class  CliParser.ArgumentName -
    A collection of static final strings that represent the possible command - line arguments.
    +
    A collection of static final strings that represent the possible command line arguments.
    @@ -167,16 +166,52 @@ extends String -getConnectionTimeout() -
    Returns the connection timeout.
    +getConnectionString() +
    Returns the database connection string if specified; otherwise null is returned.
    String +getConnectionTimeout() +
    Returns the connection timeout.
    + + + +String +getDatabaseDriverName() +
    Returns the database driver name if specified; otherwise null is returned.
    + + + +String +getDatabaseDriverPath() +
    Returns the database driver path if specified; otherwise null is returned.
    + + + +String +getDatabasePassword() +
    Returns the database database password if specified; otherwise null is returned.
    + + + +String +getDatabaseUser() +
    Returns the database database user name if specified; otherwise null is returned.
    + + + +String getDataDirectory()
    Get the value of dataDirectory.
    + +String +getNexusUrl() +
    Returns the url to the nexus server if one was specified.
    + + File getPropertiesFile() @@ -210,8 +245,7 @@ extends String getReportDirectory() -
    Returns the directory to write the reports to specified on the command - line.
    +
    Returns the directory to write the reports to specified on the command line.
    @@ -223,8 +257,7 @@ extends String[] getScanFiles() -
    Retrieves the file command line parameter(s) specified for the 'scan' - argument.
    +
    Retrieves the file command line parameter(s) specified for the 'scan' argument.
    @@ -259,26 +292,33 @@ extends boolean +isNexusDisabled() +
    Returns true if the disableNexus command line argument was specified.
    + + + +boolean isRunScan()
    Determines if the 'scan' command line argument was passed in.
    - + void parse(String[] args)
    Parses the arguments passed in and captures the results for later use.
    - + void printHelp()
    Displays the command line help message to the standard output.
    - + void printVersionInfo() -
    Prints the manifest information to standard output.
    +
    + Prints the manifest information to standard output.
    @@ -332,8 +372,7 @@ extends Parses the arguments passed in and captures the results for later use.
    Parameters:
    args - the command line arguments
    Throws:
    -
    FileNotFoundException - is thrown when a 'file' argument does not - point to a file that exists.
    +
    FileNotFoundException - is thrown when a 'file' argument does not point to a file that exists.
    org.apache.commons.cli.ParseException - is thrown when a Parse Exception occurs.
    @@ -370,6 +409,28 @@ extends Returns:
    whether or not the 'scan' command line argument was passed in
    +     + + + + + + + @@ -387,8 +448,7 @@ extends

    getScanFiles

    public String[] getScanFiles()
    -
    Retrieves the file command line parameter(s) specified for the 'scan' - argument.
    +
    Retrieves the file command line parameter(s) specified for the 'scan' argument.
    Returns:
    the file paths specified on the command line for scan
    @@ -399,8 +459,7 @@ extends

    getReportDirectory

    public String getReportDirectory()
    -
    Returns the directory to write the reports to specified on the command - line.
    +
    Returns the directory to write the reports to specified on the command line.
    Returns:
    the path to the reports directory.
    @@ -411,8 +470,7 @@ extends

    getReportFormat

    public String getReportFormat()
    -
    Returns the output format specified on the command line. Defaults to HTML - if no format was specified.
    +
    Returns the output format specified on the command line. Defaults to HTML if no format was specified.
    Returns:
    the output format name.
    @@ -533,7 +591,8 @@ extends

    printVersionInfo

    public void printVersionInfo()
    -

    Prints the manifest information to standard output.

    +

    + Prints the manifest information to standard output.

    • Implementation-Title: ${pom.name}
    • Implementation-Version: ${pom.version}
    @@ -541,15 +600,70 @@ extends     -
      +

      • isAutoUpdate

        public boolean isAutoUpdate()
        -
        Checks if the auto update feature has been disabled. If it has been - disabled via the command line this will return false.
        +
        Checks if the auto update feature has been disabled. If it has been disabled via the command line this will + return false.
        Returns:
        if auto-update is allowed.
      + + + +
        +
      • +

        getDatabaseDriverName

        +
        public String getDatabaseDriverName()
        +
        Returns the database driver name if specified; otherwise null is returned.
        +
        Returns:
        the database driver name if specified; otherwise null is returned
        +
        • +
      + + + +
        +
      • +

        getDatabaseDriverPath

        +
        public String getDatabaseDriverPath()
        +
        Returns the database driver path if specified; otherwise null is returned.
        +
        Returns:
        the database driver name if specified; otherwise null is returned
        +
        • +
      + + + +
        +
      • +

        getConnectionString

        +
        public String getConnectionString()
        +
        Returns the database connection string if specified; otherwise null is returned.
        +
        Returns:
        the database connection string if specified; otherwise null is returned
        +
        • +
      + + + +
        +
      • +

        getDatabaseUser

        +
        public String getDatabaseUser()
        +
        Returns the database database user name if specified; otherwise null is returned.
        +
        Returns:
        the database database user name if specified; otherwise null is returned
        +
        • +
      + + + +
        +
      • +

        getDatabasePassword

        +
        public String getDatabasePassword()
        +
        Returns the database database password if specified; otherwise null is returned.
        +
        Returns:
        the database database password if specified; otherwise null is returned
        +
        • +
    diff --git a/dependency-check-cli/apidocs/org/owasp/dependencycheck/cli/class-use/CliParser.ArgumentName.html b/dependency-check-cli/apidocs/org/owasp/dependencycheck/cli/class-use/CliParser.ArgumentName.html index da08b15bc..7fdf1a74a 100644 --- a/dependency-check-cli/apidocs/org/owasp/dependencycheck/cli/class-use/CliParser.ArgumentName.html +++ b/dependency-check-cli/apidocs/org/owasp/dependencycheck/cli/class-use/CliParser.ArgumentName.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.cli.CliParser.ArgumentName (Dependency-Check Command Line 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.cli.CliParser.ArgumentName (Dependency-Check Command Line 1.1.0 API) + diff --git a/dependency-check-cli/apidocs/org/owasp/dependencycheck/cli/class-use/CliParser.html b/dependency-check-cli/apidocs/org/owasp/dependencycheck/cli/class-use/CliParser.html index 06cc48df0..a2e6260fb 100644 --- a/dependency-check-cli/apidocs/org/owasp/dependencycheck/cli/class-use/CliParser.html +++ b/dependency-check-cli/apidocs/org/owasp/dependencycheck/cli/class-use/CliParser.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.cli.CliParser (Dependency-Check Command Line 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.cli.CliParser (Dependency-Check Command Line 1.1.0 API) + diff --git a/dependency-check-cli/apidocs/org/owasp/dependencycheck/cli/package-frame.html b/dependency-check-cli/apidocs/org/owasp/dependencycheck/cli/package-frame.html index 2daf6d59f..9e37a4c16 100644 --- a/dependency-check-cli/apidocs/org/owasp/dependencycheck/cli/package-frame.html +++ b/dependency-check-cli/apidocs/org/owasp/dependencycheck/cli/package-frame.html @@ -2,10 +2,10 @@ - + -org.owasp.dependencycheck.cli (Dependency-Check Command Line 1.0.8 API) - +org.owasp.dependencycheck.cli (Dependency-Check Command Line 1.1.0 API) + diff --git a/dependency-check-cli/apidocs/org/owasp/dependencycheck/cli/package-summary.html b/dependency-check-cli/apidocs/org/owasp/dependencycheck/cli/package-summary.html index 173550e5a..990d98860 100644 --- a/dependency-check-cli/apidocs/org/owasp/dependencycheck/cli/package-summary.html +++ b/dependency-check-cli/apidocs/org/owasp/dependencycheck/cli/package-summary.html @@ -2,16 +2,16 @@ - + -org.owasp.dependencycheck.cli (Dependency-Check Command Line 1.0.8 API) - +org.owasp.dependencycheck.cli (Dependency-Check Command Line 1.1.0 API) + @@ -96,8 +96,7 @@ CliParser.ArgumentName -
    A collection of static final strings that represent the possible command - line arguments.
    +
    A collection of static final strings that represent the possible command line arguments.
    diff --git a/dependency-check-cli/apidocs/org/owasp/dependencycheck/cli/package-tree.html b/dependency-check-cli/apidocs/org/owasp/dependencycheck/cli/package-tree.html index 86c466267..90dda33ed 100644 --- a/dependency-check-cli/apidocs/org/owasp/dependencycheck/cli/package-tree.html +++ b/dependency-check-cli/apidocs/org/owasp/dependencycheck/cli/package-tree.html @@ -2,16 +2,16 @@ - + -org.owasp.dependencycheck.cli Class Hierarchy (Dependency-Check Command Line 1.0.8 API) - +org.owasp.dependencycheck.cli Class Hierarchy (Dependency-Check Command Line 1.1.0 API) + diff --git a/dependency-check-cli/apidocs/org/owasp/dependencycheck/cli/package-use.html b/dependency-check-cli/apidocs/org/owasp/dependencycheck/cli/package-use.html index e4b82160d..14684b3b1 100644 --- a/dependency-check-cli/apidocs/org/owasp/dependencycheck/cli/package-use.html +++ b/dependency-check-cli/apidocs/org/owasp/dependencycheck/cli/package-use.html @@ -2,16 +2,16 @@ - + -Uses of Package org.owasp.dependencycheck.cli (Dependency-Check Command Line 1.0.8 API) - +Uses of Package org.owasp.dependencycheck.cli (Dependency-Check Command Line 1.1.0 API) + diff --git a/dependency-check-cli/apidocs/org/owasp/dependencycheck/package-frame.html b/dependency-check-cli/apidocs/org/owasp/dependencycheck/package-frame.html index 1a89b5610..9eced8d0b 100644 --- a/dependency-check-cli/apidocs/org/owasp/dependencycheck/package-frame.html +++ b/dependency-check-cli/apidocs/org/owasp/dependencycheck/package-frame.html @@ -2,10 +2,10 @@ - + -org.owasp.dependencycheck (Dependency-Check Command Line 1.0.8 API) - +org.owasp.dependencycheck (Dependency-Check Command Line 1.1.0 API) + diff --git a/dependency-check-cli/apidocs/org/owasp/dependencycheck/package-summary.html b/dependency-check-cli/apidocs/org/owasp/dependencycheck/package-summary.html index 1fdfae0a8..c0d9c64bc 100644 --- a/dependency-check-cli/apidocs/org/owasp/dependencycheck/package-summary.html +++ b/dependency-check-cli/apidocs/org/owasp/dependencycheck/package-summary.html @@ -2,16 +2,16 @@ - + -org.owasp.dependencycheck (Dependency-Check Command Line 1.0.8 API) - +org.owasp.dependencycheck (Dependency-Check Command Line 1.1.0 API) + diff --git a/dependency-check-cli/apidocs/org/owasp/dependencycheck/package-tree.html b/dependency-check-cli/apidocs/org/owasp/dependencycheck/package-tree.html index 6d4d8d972..2cb4c23ce 100644 --- a/dependency-check-cli/apidocs/org/owasp/dependencycheck/package-tree.html +++ b/dependency-check-cli/apidocs/org/owasp/dependencycheck/package-tree.html @@ -2,16 +2,16 @@ - + -org.owasp.dependencycheck Class Hierarchy (Dependency-Check Command Line 1.0.8 API) - +org.owasp.dependencycheck Class Hierarchy (Dependency-Check Command Line 1.1.0 API) + diff --git a/dependency-check-cli/apidocs/org/owasp/dependencycheck/package-use.html b/dependency-check-cli/apidocs/org/owasp/dependencycheck/package-use.html index 4c4487504..a1f49d813 100644 --- a/dependency-check-cli/apidocs/org/owasp/dependencycheck/package-use.html +++ b/dependency-check-cli/apidocs/org/owasp/dependencycheck/package-use.html @@ -2,16 +2,16 @@ - + -Uses of Package org.owasp.dependencycheck (Dependency-Check Command Line 1.0.8 API) - +Uses of Package org.owasp.dependencycheck (Dependency-Check Command Line 1.1.0 API) + diff --git a/dependency-check-cli/apidocs/overview-frame.html b/dependency-check-cli/apidocs/overview-frame.html index 3a5e6cc2f..0aa404541 100644 --- a/dependency-check-cli/apidocs/overview-frame.html +++ b/dependency-check-cli/apidocs/overview-frame.html @@ -2,10 +2,10 @@ - + -Overview List (Dependency-Check Command Line 1.0.8 API) - +Overview List (Dependency-Check Command Line 1.1.0 API) + diff --git a/dependency-check-cli/apidocs/overview-summary.html b/dependency-check-cli/apidocs/overview-summary.html index 5beb7a264..f6a3e7e32 100644 --- a/dependency-check-cli/apidocs/overview-summary.html +++ b/dependency-check-cli/apidocs/overview-summary.html @@ -2,16 +2,16 @@ - + -Overview (Dependency-Check Command Line 1.0.8 API) - +Overview (Dependency-Check Command Line 1.1.0 API) + @@ -64,7 +64,7 @@
    -

    Dependency-Check Command Line 1.0.8 API

    +

    Dependency-Check Command Line 1.1.0 API

    diff --git a/dependency-check-cli/apidocs/overview-tree.html b/dependency-check-cli/apidocs/overview-tree.html index a338cb811..c3181487e 100644 --- a/dependency-check-cli/apidocs/overview-tree.html +++ b/dependency-check-cli/apidocs/overview-tree.html @@ -2,16 +2,16 @@ - + -Class Hierarchy (Dependency-Check Command Line 1.0.8 API) - +Class Hierarchy (Dependency-Check Command Line 1.1.0 API) + diff --git a/dependency-check-cli/arguments.html b/dependency-check-cli/arguments.html index cc044ee82..8ca21809c 100644 --- a/dependency-check-cli/arguments.html +++ b/dependency-check-cli/arguments.html @@ -1,13 +1,13 @@ - + dependency-check-cli - Command Line Arguments @@ -54,7 +54,7 @@
  • - +
  • /
    • @@ -67,8 +67,8 @@ -
  • Last Published: 2014-01-16
  • |
    • -
  • Version: 1.0.8
    • +
  • Last Published: 2014-01-26
  • |
    • +
  • Version: 1.1.0
    • @@ -273,7 +273,7 @@ - + @@ -286,7 +286,7 @@ - + @@ -310,7 +310,7 @@ - + @@ -344,6 +344,110 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/dependency-check-cli/checkstyle.html b/dependency-check-cli/checkstyle.html index f15283476..0f7a35e19 100644 --- a/dependency-check-cli/checkstyle.html +++ b/dependency-check-cli/checkstyle.html @@ -1,13 +1,13 @@ - + dependency-check-cli - Checkstyle Results @@ -54,7 +54,7 @@
  • - +
  • /
    • @@ -67,8 +67,8 @@ -
  • Last Published: 2014-01-16
  • |
    • -
  • Version: 1.0.8
    • +
  • Last Published: 2014-01-26
  • |
    • +
  • Version: 1.1.0
    • @@ -238,7 +238,7 @@ -
    -pp --proxypass
    -pu --proxyuser
    -sf --suppression Print the version information. Optional
    --advancedHelp Print the advanced help message. Optional
    --connectionString <connStr> The connection string to the database. Optional
    --dbDriverName <driver> The database driver name. Optional
    --dbDriverPath <path> The path to the database driver; note, this does not need to be set unless the JAR is outside of the class path. Optional
    --dbPassword <password>The password for connecting to the database. Optional
    --dbUser <user> The username used to connect to the database. Optional
    --disableNexus Disable the Nexus Analyzer. Optional
    --nexus <url> The url to the Nexus Server. Optional
    14 0 02
    +0

    Files

    @@ -246,41 +246,9 @@ - - - - - - - - - - -
    Files I Infos W WarningsE Errors
    src/main/java/org/owasp/dependencycheck/App.java001
    src/main/java/org/owasp/dependencycheck/cli/CliParser.java001
    +E Errors
    -

    Details

    -
    -

    src/main/java/org/owasp/dependencycheck/App.java

    - - - - - - - - -
    ViolationMessageLine
    ErrorsMore than 7 parameters (found 9).156
    -
    -

    src/main/java/org/owasp/dependencycheck/cli/CliParser.java

    - - - - - - - - -
    ViolationMessageLine
    ErrorsLine is longer than 150 characters (found 160).103
    +

    Details

    diff --git a/dependency-check-cli/checkstyle.rss b/dependency-check-cli/checkstyle.rss index eb888f6ab..3d51719f0 100644 --- a/dependency-check-cli/checkstyle.rss +++ b/dependency-check-cli/checkstyle.rss @@ -26,7 +26,7 @@ under the License. ©2012 - 2014 OWASP File: 14, - Errors: 2, + Errors: 0, Warnings: 0, Infos: 0 @@ -83,7 +83,7 @@ under the License. 0 - 1 + 0 @@ -139,7 +139,7 @@ under the License. 0 - 1 + 0 diff --git a/dependency-check-cli/cobertura/frame-sourcefiles-org.owasp.dependencycheck.cli.html b/dependency-check-cli/cobertura/frame-sourcefiles-org.owasp.dependencycheck.cli.html index d8822950c..51bc327d8 100644 --- a/dependency-check-cli/cobertura/frame-sourcefiles-org.owasp.dependencycheck.cli.html +++ b/dependency-check-cli/cobertura/frame-sourcefiles-org.owasp.dependencycheck.cli.html @@ -15,7 +15,7 @@ org.owasp.dependencycheck.cli - +
    CliParser (76%)CliParser (69%)
    diff --git a/dependency-check-cli/cobertura/frame-sourcefiles.html b/dependency-check-cli/cobertura/frame-sourcefiles.html index 7b4e2c99b..ebe0e47b3 100644 --- a/dependency-check-cli/cobertura/frame-sourcefiles.html +++ b/dependency-check-cli/cobertura/frame-sourcefiles.html @@ -18,7 +18,7 @@ All Packages App (0%) -CliParser (76%) +CliParser (69%) diff --git a/dependency-check-cli/cobertura/frame-summary-org.owasp.dependencycheck.cli.html b/dependency-check-cli/cobertura/frame-summary-org.owasp.dependencycheck.cli.html index c096a49b1..0855e92f3 100644 --- a/dependency-check-cli/cobertura/frame-summary-org.owasp.dependencycheck.cli.html +++ b/dependency-check-cli/cobertura/frame-summary-org.owasp.dependencycheck.cli.html @@ -16,7 +16,7 @@ - +
    Package # Classes Line Coverage Branch Coverage Complexity
    org.owasp.dependencycheck.cli2
    76%
    73/96
    71%
    23/32
    		1.68
    org.owasp.dependencycheck.cli2
    69%
    74/107
    56%
    25/44
    		1.676
    -
    Report generated by Cobertura 1.9.4.1 on 1/16/14 7:29 AM.
    +
    Report generated by Cobertura 1.9.4.1 on 1/26/14 11:13 AM.
    diff --git a/dependency-check-cli/cobertura/frame-summary-org.owasp.dependencycheck.html b/dependency-check-cli/cobertura/frame-summary-org.owasp.dependencycheck.html index 85ef036ab..9c845488a 100644 --- a/dependency-check-cli/cobertura/frame-summary-org.owasp.dependencycheck.html +++ b/dependency-check-cli/cobertura/frame-summary-org.owasp.dependencycheck.html @@ -16,8 +16,8 @@ - - + +
    Package # Classes Line Coverage Branch Coverage Complexity
    org.owasp.dependencycheck1
    0%
    0/75
    0%
    0/36
    		7.5
    org.owasp.dependencycheck.cli2
    76%
    73/96
    71%
    23/32
    		1.68
    org.owasp.dependencycheck1
    0%
    0/113
    0%
    0/64
    		11
    org.owasp.dependencycheck.cli2
    69%
    74/107
    56%
    25/44
    		1.676
    -
    Report generated by Cobertura 1.9.4.1 on 1/16/14 7:29 AM.
    +
    Report generated by Cobertura 1.9.4.1 on 1/26/14 11:13 AM.
    diff --git a/dependency-check-cli/cobertura/frame-summary.html b/dependency-check-cli/cobertura/frame-summary.html index 7ebd43e08..8d899be24 100644 --- a/dependency-check-cli/cobertura/frame-summary.html +++ b/dependency-check-cli/cobertura/frame-summary.html @@ -16,9 +16,9 @@ - - - + + +
    Package # Classes Line Coverage Branch Coverage Complexity
    All Packages3
    42%
    73/171
    33%
    23/68
    		2.483
    org.owasp.dependencycheck1
    0%
    0/75
    0%
    0/36
    		7.5
    org.owasp.dependencycheck.cli2
    76%
    73/96
    71%
    23/32
    		1.68
    All Packages3
    33%
    74/220
    23%
    25/108
    		2.658
    org.owasp.dependencycheck1
    0%
    0/113
    0%
    0/64
    		11
    org.owasp.dependencycheck.cli2
    69%
    74/107
    56%
    25/44
    		1.676
    -
    Report generated by Cobertura 1.9.4.1 on 1/16/14 7:29 AM.
    +
    Report generated by Cobertura 1.9.4.1 on 1/26/14 11:13 AM.
    diff --git a/dependency-check-cli/cobertura/org.owasp.dependencycheck.App.html b/dependency-check-cli/cobertura/org.owasp.dependencycheck.App.html index d085732c6..2fd250728 100644 --- a/dependency-check-cli/cobertura/org.owasp.dependencycheck.App.html +++ b/dependency-check-cli/cobertura/org.owasp.dependencycheck.App.html @@ -12,7 +12,7 @@
     
    - +
    Classes in this File Line Coverage Branch Coverage Complexity
    App
    0%
    0/75
    0%
    0/36
    		7.5
    App
    0%
    0/113
    0%
    0/64
    		11
     
    @@ -24,336 +24,336 @@  3   
      *
     4   - 
      * Dependency-check-cli is free software: you can redistribute it and/or modify it
    + 
      * Licensed under the Apache License, Version 2.0 (the "License");
     5   - 
      * under the terms of the GNU General Public License as published by the Free
    + 
      * you may not use this file except in compliance with the License.
     6   - 
      * Software Foundation, either version 3 of the License, or (at your option) any
    + 
      * You may obtain a copy of the License at
     7   - 
      * later version.
    + 
      *
     8   - 
      *
    + 
      *     http://www.apache.org/licenses/LICENSE-2.0
     9   - 
      * Dependency-check-cli is distributed in the hope that it will be useful, but
    + 
      *
     10   - 
      * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
    + 
      * Unless required by applicable law or agreed to in writing, software
     11   - 
      * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
    + 
      * distributed under the License is distributed on an "AS IS" BASIS,
     12   - 
      * details.
    + 
      * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13   - 
      *
    + 
      * See the License for the specific language governing permissions and
     14   - 
      * You should have received a copy of the GNU General Public License along with
    + 
      * limitations under the License.
     15   - 
      * dependency-check-cli. If not, see http://www.gnu.org/licenses/.
    + 
      *
     16   - 
      *
    + 
      * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
     17   - 
      * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
    + 
      */
     18   - 
      */
    -  19   
     package org.owasp.dependencycheck;
    +  19   + 
     
     20   - 
     
    -  21   
     import java.io.File;
    -  22   +  21   
     import java.io.FileNotFoundException;
    -  23   +  22   
     import java.io.IOException;
    -  24   +  23   
     import java.io.InputStream;
    -  25   +  24   
     import java.util.List;
    -  26   +  25   
     import java.util.logging.Level;
    -  27   +  26   
     import java.util.logging.Logger;
    -  28   +  27   
     import org.apache.commons.cli.ParseException;
    -  29   - 
     import org.owasp.dependencycheck.reporting.ReportGenerator;
    -  30   - 
     import org.owasp.dependencycheck.dependency.Dependency;
    -  31   +  28   
     import org.owasp.dependencycheck.cli.CliParser;
    +  29   + 
     import org.owasp.dependencycheck.data.nvdcve.CveDB;
    +  30   + 
     import org.owasp.dependencycheck.data.nvdcve.DatabaseException;
    +  31   + 
     import org.owasp.dependencycheck.data.nvdcve.DatabaseProperties;
     32   - 
     import org.owasp.dependencycheck.utils.LogUtils;
    + 
     import org.owasp.dependencycheck.dependency.Dependency;
     33   - 
     import org.owasp.dependencycheck.utils.Settings;
    + 
     import org.owasp.dependencycheck.reporting.ReportGenerator;
     34   - 
     
    + 
     import org.owasp.dependencycheck.utils.LogUtils;
     35   - 
     /*
    + 
     import org.owasp.dependencycheck.utils.Settings;
     36   - 
      * This file is part of App.
    + 
     
     37   - 
      *
    -  38   - 
      * App is free software: you can redistribute it and/or modify it under the
    -  39   - 
      * terms of the GNU General Public License as published by the Free Software
    -  40   - 
      * Foundation, either version 3 of the License, or (at your option) any later
    -  41   - 
      * version.
    -  42   - 
      *
    -  43   - 
      * App is distributed in the hope that it will be useful, but WITHOUT ANY
    -  44   - 
      * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR
    -  45   - 
      * A PARTICULAR PURPOSE. See the GNU General Public License for more details.
    -  46   - 
      *
    -  47   - 
      * You should have received a copy of the GNU General Public License along with
    -  48   - 
      * App. If not, see http://www.gnu.org/licenses/.
    -  49   - 
      *
    -  50   - 
      * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
    -  51   - 
      */
    -  52   
     /**
    -  53   +  38   
      * The command line interface for the DependencyCheck application.
    -  54   +  39   
      *
    -  55   +  40   
      * @author Jeremy Long <jeremy.long@owasp.org>
    -  56   +  41   
      */
    -  57  0 
     public class App {
    +  42  0 
     public class App {
    +  43   + 
     
    +  44   + 
         /**
    +  45   + 
          * The location of the log properties configuration file.
    +  46   + 
          */
    +  47   + 
         private static final String LOG_PROPERTIES_FILE = "log.properties";
    +  48   + 
     
    +  49   + 
         /**
    +  50   + 
          * The main method for the application.
    +  51   + 
          *
    +  52   + 
          * @param args the command line arguments
    +  53   + 
          */
    +  54   + 
         public static void main(String[] args) {
    +  55  0 
             final App app = new App();
    +  56  0 
             app.run(args);
    +  57  0 
         }
     58   
     
     59   
         /**
     60   - 
          * The location of the log properties configuration file.
    -  61   - 
          */
    -  62   - 
         private static final String LOG_PROPERTIES_FILE = "log.properties";
    -  63   - 
     
    -  64   - 
         /**
    -  65   - 
          * The main method for the application.
    -  66   - 
          *
    -  67   - 
          * @param args the command line arguments
    -  68   - 
          */
    -  69   - 
         public static void main(String[] args) {
    -  70  0 
             final App app = new App();
    -  71  0 
             app.run(args);
    -  72  0 
         }
    -  73   - 
     
    -  74   - 
         /**
    -  75   
          * Main CLI entry-point into the application.
    -  76   +  61   
          *
    -  77   +  62   
          * @param args the command line arguments
    -  78   +  63   
          */
    -  79   +  64   
         public void run(String[] args) {
    -  80   +  65   
     
    -  81  0 
             final CliParser cli = new CliParser();
    -  82   +  66  0 
             final CliParser cli = new CliParser();
    +  67   
             try {
    -  83  0 
                 cli.parse(args);
    -  84  0 
             } catch (FileNotFoundException ex) {
    -  85  0 
                 System.err.println(ex.getMessage());
    -  86  0 
                 cli.printHelp();
    -  87  0 
                 return;
    -  88  0 
             } catch (ParseException ex) {
    -  89  0 
                 System.err.println(ex.getMessage());
    -  90  0 
                 cli.printHelp();
    -  91  0 
                 return;
    -  92  0 
             }
    -  93   +  68  0 
                 cli.parse(args);
    +  69  0 
             } catch (FileNotFoundException ex) {
    +  70  0 
                 System.err.println(ex.getMessage());
    +  71  0 
                 cli.printHelp();
    +  72  0 
                 return;
    +  73  0 
             } catch (ParseException ex) {
    +  74  0 
                 System.err.println(ex.getMessage());
    +  75  0 
                 cli.printHelp();
    +  76  0 
                 return;
    +  77  0 
             }
    +  78   
     
    -  94  0 
             final InputStream in = App.class.getClassLoader().getResourceAsStream(LOG_PROPERTIES_FILE);
    -  95  0 
             LogUtils.prepareLogger(in, cli.getVerboseLog());
    -  96   +  79  0 
             final InputStream in = App.class.getClassLoader().getResourceAsStream(LOG_PROPERTIES_FILE);
    +  80  0 
             LogUtils.prepareLogger(in, cli.getVerboseLog());
    +  81   
     
    -  97  0 
             if (cli.isGetVersion()) {
    -  98  0 
                 cli.printVersionInfo();
    -  99  0 
             } else if (cli.isRunScan()) {
    -  100  0 
                 updateSettings(cli.isAutoUpdate(), cli.getConnectionTimeout(), cli.getProxyUrl(),
    -  101   - 
                         cli.getProxyPort(), cli.getProxyUsername(), cli.getProxyPassword(),
    -  102   - 
                         cli.getDataDirectory(), cli.getPropertiesFile(), cli.getSuppressionFile());
    -  103  0 
                 runScan(cli.getReportDirectory(), cli.getReportFormat(), cli.getApplicationName(), cli.getScanFiles());
    -  104   +  82  0 
             if (cli.isGetVersion()) {
    +  83  0 
                 cli.printVersionInfo();
    +  84  0 
             } else if (cli.isRunScan()) {
    +  85  0 
                 updateSettings(cli);
    +  86  0 
                 runScan(cli.getReportDirectory(), cli.getReportFormat(), cli.getApplicationName(), cli.getScanFiles());
    +  87   
             } else {
    -  105  0 
                 cli.printHelp();
    -  106   +  88  0 
                 cli.printHelp();
    +  89   
             }
    -  107  0 
         }
    -  108   +  90  0 
         }
    +  91   
     
    -  109   +  92   
         /**
    -  110   - 
          * Scans the specified directories and writes the dependency reports to the
    -  111   - 
          * reportDirectory.
    -  112   +  93   + 
          * Scans the specified directories and writes the dependency reports to the reportDirectory.
    +  94   
          *
    -  113   - 
          * @param reportDirectory the path to the directory where the reports will
    -  114   - 
          * be written
    -  115   +  95   + 
          * @param reportDirectory the path to the directory where the reports will be written
    +  96   
          * @param outputFormat the output format of the report
    -  116   +  97   
          * @param applicationName the application name for the report
    -  117   +  98   
          * @param files the files/directories to scan
    -  118   +  99   
          */
    -  119   +  100   
         private void runScan(String reportDirectory, String outputFormat, String applicationName, String[] files) {
    -  120  0 
             final Engine scanner = new Engine();
    -  121   +  101  0 
             final Engine scanner = new Engine();
    +  102   
     
    -  122  0 
             for (String file : files) {
    -  123  0 
                 scanner.scan(file);
    -  124   +  103  0 
             for (String file : files) {
    +  104  0 
                 scanner.scan(file);
    +  105   
             }
    -  125   +  106   
     
    -  126  0 
             scanner.analyzeDependencies();
    -  127  0 
             final List<Dependency> dependencies = scanner.getDependencies();
    -  128   - 
     
    -  129  0 
             final ReportGenerator report = new ReportGenerator(applicationName, dependencies, scanner.getAnalyzers());
    -  130   +  107  0 
             scanner.analyzeDependencies();
    +  108  0 
             final List<Dependency> dependencies = scanner.getDependencies();
    +  109  0 
             DatabaseProperties prop = null;
    +  110  0 
             CveDB cve = null;
    +  111   
             try {
    -  131  0 
                 report.generateReports(reportDirectory, outputFormat);
    -  132  0 
             } catch (IOException ex) {
    -  133  0 
                 Logger.getLogger(App.class.getName()).log(Level.SEVERE, "There was an IO error while attempting to generate the report.");
    -  134  0 
                 Logger.getLogger(App.class.getName()).log(Level.INFO, null, ex);
    -  135  0 
             } catch (Exception ex) {
    -  136  0 
                 Logger.getLogger(App.class.getName()).log(Level.SEVERE, "There was an error while attempting to generate the report.");
    -  137  0 
                 Logger.getLogger(App.class.getName()).log(Level.INFO, null, ex);
    -  138  0 
             }
    -  139  0 
         }
    -  140   +  112  0 
                 cve = new CveDB();
    +  113  0 
                 cve.open();
    +  114  0 
                 prop = cve.getDatabaseProperties();
    +  115  0 
             } catch (DatabaseException ex) {
    +  116  0 
                 Logger.getLogger(App.class.getName()).log(Level.FINE, "Unable to retrieve DB Properties", ex);
    +  117   + 
             } finally {
    +  118  0 
                 if (cve != null) {
    +  119  0 
                     cve.close();
    +  120   + 
                 }
    +  121   + 
             }
    +  122  0 
             final ReportGenerator report = new ReportGenerator(applicationName, dependencies, scanner.getAnalyzers(), prop);
    +  123   + 
             try {
    +  124  0 
                 report.generateReports(reportDirectory, outputFormat);
    +  125  0 
             } catch (IOException ex) {
    +  126  0 
                 Logger.getLogger(App.class.getName()).log(Level.SEVERE, "There was an IO error while attempting to generate the report.");
    +  127  0 
                 Logger.getLogger(App.class.getName()).log(Level.INFO, null, ex);
    +  128  0 
             } catch (Exception ex) {
    +  129  0 
                 Logger.getLogger(App.class.getName()).log(Level.SEVERE, "There was an error while attempting to generate the report.");
    +  130  0 
                 Logger.getLogger(App.class.getName()).log(Level.INFO, null, ex);
    +  131  0 
             }
    +  132  0 
         }
    +  133   
     
    -  141   +  134   
         /**
    -  142   +  135   
          * Updates the global Settings.
    -  143   +  136   
          *
    -  144   - 
          * @param autoUpdate whether or not to update cached web data sources
    -  145   - 
          * @param connectionTimeout the timeout to use when downloading resources
    -  146   - 
          * (null or blank will use default)
    -  147   - 
          * @param proxyUrl the proxy url (null or blank means no proxy will be used)
    -  148   - 
          * @param proxyPort the proxy port (null or blank means no port will be
    -  149   - 
          * used)
    -  150   - 
          * @param proxyUser the proxy user name
    -  151   - 
          * @param proxyPass the password for the proxy
    -  152   - 
          * @param dataDirectory the directory to store/retrieve persistent data from
    -  153   - 
          * @param propertiesFile the properties file to utilize
    -  154   - 
          * @param suppressionFile the path to the suppression file
    -  155   +  137   + 
          * @param cli a reference to the CLI Parser that contains the command line arguments used to set the corresponding
    +  138   + 
          * settings in the core engine.
    +  139   
          */
    -  156   - 
         private void updateSettings(boolean autoUpdate, String connectionTimeout, String proxyUrl, String proxyPort,
    -  157   - 
                 String proxyUser, String proxyPass, String dataDirectory, File propertiesFile,
    -  158   - 
                 String suppressionFile) {
    -  159   +  140   + 
         private void updateSettings(CliParser cli) {
    +  141   
     
    -  160  0 
             if (propertiesFile != null) {
    -  161   +  142  0 
             final boolean autoUpdate = cli.isAutoUpdate();
    +  143  0 
             final String connectionTimeout = cli.getConnectionTimeout();
    +  144  0 
             final String proxyUrl = cli.getProxyUrl();
    +  145  0 
             final String proxyPort = cli.getProxyPort();
    +  146  0 
             final String proxyUser = cli.getProxyUsername();
    +  147  0 
             final String proxyPass = cli.getProxyPassword();
    +  148  0 
             final String dataDirectory = cli.getDataDirectory();
    +  149  0 
             final File propertiesFile = cli.getPropertiesFile();
    +  150  0 
             final String suppressionFile = cli.getSuppressionFile();
    +  151  0 
             final boolean nexusDisabled = cli.isNexusDisabled();
    +  152  0 
             final String nexusUrl = cli.getNexusUrl();
    +  153  0 
             final String databaseDriverName = cli.getDatabaseDriverName();
    +  154  0 
             final String databaseDriverPath = cli.getDatabaseDriverPath();
    +  155  0 
             final String connectionString = cli.getConnectionString();
    +  156  0 
             final String databaseUser = cli.getDatabaseUser();
    +  157  0 
             final String databasePassword = cli.getDatabasePassword();
    +  158   + 
     
    +  159  0 
             if (propertiesFile != null) {
    +  160   
                 try {
    -  162  0 
                     Settings.mergeProperties(propertiesFile);
    -  163  0 
                 } catch (FileNotFoundException ex) {
    -  164  0 
                     final String msg = String.format("Unable to load properties file '%s'", propertiesFile.getPath());
    -  165  0 
                     Logger.getLogger(App.class.getName()).log(Level.SEVERE, msg);
    -  166  0 
                     Logger.getLogger(App.class.getName()).log(Level.FINE, null, ex);
    -  167  0 
                 } catch (IOException ex) {
    -  168  0 
                     final String msg = String.format("Unable to find properties file '%s'", propertiesFile.getPath());
    -  169  0 
                     Logger.getLogger(App.class.getName()).log(Level.SEVERE, msg);
    -  170  0 
                     Logger.getLogger(App.class.getName()).log(Level.FINE, null, ex);
    -  171  0 
                 }
    -  172   +  161  0 
                     Settings.mergeProperties(propertiesFile);
    +  162  0 
                 } catch (FileNotFoundException ex) {
    +  163  0 
                     final String msg = String.format("Unable to load properties file '%s'", propertiesFile.getPath());
    +  164  0 
                     Logger.getLogger(App.class.getName()).log(Level.SEVERE, msg);
    +  165  0 
                     Logger.getLogger(App.class.getName()).log(Level.FINE, null, ex);
    +  166  0 
                 } catch (IOException ex) {
    +  167  0 
                     final String msg = String.format("Unable to find properties file '%s'", propertiesFile.getPath());
    +  168  0 
                     Logger.getLogger(App.class.getName()).log(Level.SEVERE, msg);
    +  169  0 
                     Logger.getLogger(App.class.getName()).log(Level.FINE, null, ex);
    +  170  0 
                 }
    +  171   
             }
    -  173  0 
             if (dataDirectory != null) {
    -  174  0 
                 Settings.setString(Settings.KEYS.DATA_DIRECTORY, dataDirectory);
    -  175  0 
             } else if (System.getProperty("basedir") != null) {
    -  176  0 
                 final File dataDir = new File(System.getProperty("basedir"), "data");
    -  177  0 
                 Settings.setString(Settings.KEYS.DATA_DIRECTORY, dataDir.getAbsolutePath());
    -  178  0 
             } else {
    -  179  0 
                 final File jarPath = new File(App.class.getProtectionDomain().getCodeSource().getLocation().getPath());
    -  180  0 
                 final File base = jarPath.getParentFile();
    -  181  0 
                 final String sub = Settings.getString(Settings.KEYS.DATA_DIRECTORY);
    -  182  0 
                 final File dataDir = new File(base, sub);
    -  183  0 
                 Settings.setString(Settings.KEYS.DATA_DIRECTORY, dataDir.getAbsolutePath());
    -  184   +  172  0 
             if (dataDirectory != null) {
    +  173  0 
                 Settings.setString(Settings.KEYS.DATA_DIRECTORY, dataDirectory);
    +  174  0 
             } else if (System.getProperty("basedir") != null) {
    +  175  0 
                 final File dataDir = new File(System.getProperty("basedir"), "data");
    +  176  0 
                 Settings.setString(Settings.KEYS.DATA_DIRECTORY, dataDir.getAbsolutePath());
    +  177  0 
             } else {
    +  178  0 
                 final File jarPath = new File(App.class.getProtectionDomain().getCodeSource().getLocation().getPath());
    +  179  0 
                 final File base = jarPath.getParentFile();
    +  180  0 
                 final String sub = Settings.getString(Settings.KEYS.DATA_DIRECTORY);
    +  181  0 
                 final File dataDir = new File(base, sub);
    +  182  0 
                 Settings.setString(Settings.KEYS.DATA_DIRECTORY, dataDir.getAbsolutePath());
    +  183   
             }
    -  185  0 
             Settings.setBoolean(Settings.KEYS.AUTO_UPDATE, autoUpdate);
    -  186  0 
             if (proxyUrl != null && !proxyUrl.isEmpty()) {
    -  187  0 
                 Settings.setString(Settings.KEYS.PROXY_URL, proxyUrl);
    -  188   +  184  0 
             Settings.setBoolean(Settings.KEYS.AUTO_UPDATE, autoUpdate);
    +  185  0 
             if (proxyUrl != null && !proxyUrl.isEmpty()) {
    +  186  0 
                 Settings.setString(Settings.KEYS.PROXY_URL, proxyUrl);
    +  187   
             }
    -  189  0 
             if (proxyPort != null && !proxyPort.isEmpty()) {
    -  190  0 
                 Settings.setString(Settings.KEYS.PROXY_PORT, proxyPort);
    -  191   +  188  0 
             if (proxyPort != null && !proxyPort.isEmpty()) {
    +  189  0 
                 Settings.setString(Settings.KEYS.PROXY_PORT, proxyPort);
    +  190   
             }
    -  192  0 
             if (proxyUser != null && !proxyUser.isEmpty()) {
    -  193  0 
                 Settings.setString(Settings.KEYS.PROXY_USERNAME, proxyUser);
    -  194   +  191  0 
             if (proxyUser != null && !proxyUser.isEmpty()) {
    +  192  0 
                 Settings.setString(Settings.KEYS.PROXY_USERNAME, proxyUser);
    +  193   
             }
    -  195  0 
             if (proxyPass != null && !proxyPass.isEmpty()) {
    -  196  0 
                 Settings.setString(Settings.KEYS.PROXY_PASSWORD, proxyPass);
    -  197   +  194  0 
             if (proxyPass != null && !proxyPass.isEmpty()) {
    +  195  0 
                 Settings.setString(Settings.KEYS.PROXY_PASSWORD, proxyPass);
    +  196   
             }
    -  198  0 
             if (connectionTimeout != null && !connectionTimeout.isEmpty()) {
    -  199  0 
                 Settings.setString(Settings.KEYS.CONNECTION_TIMEOUT, connectionTimeout);
    -  200   +  197  0 
             if (connectionTimeout != null && !connectionTimeout.isEmpty()) {
    +  198  0 
                 Settings.setString(Settings.KEYS.CONNECTION_TIMEOUT, connectionTimeout);
    +  199   
             }
    -  201  0 
             if (suppressionFile != null && !suppressionFile.isEmpty()) {
    -  202  0 
                 Settings.setString(Settings.KEYS.SUPPRESSION_FILE, suppressionFile);
    -  203   +  200  0 
             if (suppressionFile != null && !suppressionFile.isEmpty()) {
    +  201  0 
                 Settings.setString(Settings.KEYS.SUPPRESSION_FILE, suppressionFile);
    +  202   
             }
    -  204  0 
         }
    -  205   +  203  0 
             Settings.setBoolean(Settings.KEYS.ANALYZER_NEXUS_ENABLED, !nexusDisabled);
    +  204  0 
             if (nexusUrl != null && !nexusUrl.isEmpty()) {
    +  205  0 
                 Settings.setString(Settings.KEYS.ANALYZER_NEXUS_URL, nexusUrl);
    +  206   + 
             }
    +  207   + 
     
    +  208  0 
             if (databaseDriverName != null && !databaseDriverName.isEmpty()) {
    +  209  0 
                 Settings.setString(Settings.KEYS.DB_DRIVER_NAME, databaseDriverName);
    +  210   + 
             }
    +  211  0 
             if (databaseDriverPath != null && !databaseDriverPath.isEmpty()) {
    +  212  0 
                 Settings.setString(Settings.KEYS.DB_DRIVER_PATH, databaseDriverPath);
    +  213   + 
             }
    +  214  0 
             if (connectionString != null && !connectionString.isEmpty()) {
    +  215  0 
                 Settings.setString(Settings.KEYS.DB_CONNECTION_STRING, connectionString);
    +  216   + 
             }
    +  217  0 
             if (databaseUser != null && !databaseUser.isEmpty()) {
    +  218  0 
                 Settings.setString(Settings.KEYS.DB_USER, databaseUser);
    +  219   + 
             }
    +  220  0 
             if (databasePassword != null && !databasePassword.isEmpty()) {
    +  221  0 
                 Settings.setString(Settings.KEYS.DB_PASSWORD, databasePassword);
    +  222   + 
             }
    +  223  0 
         }
    +  224   
     }
    -
    Report generated by Cobertura 1.9.4.1 on 1/16/14 7:29 AM.
    +
    Report generated by Cobertura 1.9.4.1 on 1/26/14 11:13 AM.
    diff --git a/dependency-check-cli/cobertura/org.owasp.dependencycheck.cli.CliParser.html b/dependency-check-cli/cobertura/org.owasp.dependencycheck.cli.CliParser.html index 9ffebdf03..9fa184565 100644 --- a/dependency-check-cli/cobertura/org.owasp.dependencycheck.cli.CliParser.html +++ b/dependency-check-cli/cobertura/org.owasp.dependencycheck.cli.CliParser.html @@ -12,8 +12,8 @@
     
    - - + +
    Classes in this File Line Coverage Branch Coverage Complexity
    CliParser
    76%
    73/95
    71%
    23/32
    		1.68
    CliParser$ArgumentName
    0%
    0/1
    N/A
    N/A
    		1.68
    CliParser
    69%
    74/106
    56%
    25/44
    		1.676
    CliParser$ArgumentName
    0%
    0/1
    N/A
    N/A
    		1.676
     
    @@ -25,683 +25,688 @@  3   
      *
     4   - 
      * Dependency-check-cli is free software: you can redistribute it and/or modify it
    + 
      * Licensed under the Apache License, Version 2.0 (the "License");
     5   - 
      * under the terms of the GNU General Public License as published by the Free
    + 
      * you may not use this file except in compliance with the License.
     6   - 
      * Software Foundation, either version 3 of the License, or (at your option) any
    + 
      * You may obtain a copy of the License at
     7   - 
      * later version.
    + 
      *
     8   - 
      *
    + 
      *     http://www.apache.org/licenses/LICENSE-2.0
     9   - 
      * Dependency-check-cli is distributed in the hope that it will be useful, but
    + 
      *
     10   - 
      * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
    + 
      * Unless required by applicable law or agreed to in writing, software
     11   - 
      * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
    + 
      * distributed under the License is distributed on an "AS IS" BASIS,
     12   - 
      * details.
    + 
      * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13   - 
      *
    + 
      * See the License for the specific language governing permissions and
     14   - 
      * You should have received a copy of the GNU General Public License along with
    + 
      * limitations under the License.
     15   - 
      * dependency-check-cli. If not, see http://www.gnu.org/licenses/.
    + 
      *
     16   - 
      *
    -  17   
      * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
    +  17   + 
      */
     18   - 
      */
    -  19   
     package org.owasp.dependencycheck.cli;
    +  19   + 
     
     20   - 
     
    -  21   
     import java.io.File;
    -  22   +  21   
     import java.io.FileNotFoundException;
    -  23   +  22   
     import org.apache.commons.cli.CommandLine;
    -  24   +  23   
     import org.apache.commons.cli.CommandLineParser;
    -  25   +  24   
     import org.apache.commons.cli.HelpFormatter;
    -  26   +  25   
     import org.apache.commons.cli.Option;
    -  27   +  26   
     import org.apache.commons.cli.OptionBuilder;
    -  28   +  27   
     import org.apache.commons.cli.OptionGroup;
    -  29   +  28   
     import org.apache.commons.cli.Options;
    -  30   +  29   
     import org.apache.commons.cli.ParseException;
    -  31   +  30   
     import org.apache.commons.cli.PosixParser;
    -  32   +  31   
     import org.owasp.dependencycheck.reporting.ReportGenerator.Format;
    -  33   +  32   
     import org.owasp.dependencycheck.utils.Settings;
    +  33   + 
     
     34   - 
     
    -  35   
     /**
    -  36   +  35   
      * A utility to parse command line arguments for the DependencyCheck.
    -  37   +  36   
      *
    -  38   +  37   
      * @author Jeremy Long <jeremy.long@owasp.org>
    -  39   +  38   
      */
    -  40  9 
     public final class CliParser {
    -  41   +  39  18 
     public final class CliParser {
    +  40   
     
    +  41   + 
         /**
     42   - 
         /**
    -  43   
          * The command line.
    +  43   + 
          */
     44   - 
          */
    -  45   
         private CommandLine line;
    -  46   +  45   
         /**
    +  46   + 
          * Indicates whether the arguments are valid.
     47   - 
          * The options for the command line parser.
    -  48   
          */
    -  49  9 
         private final Options options = createCommandLineOptions();
    +  48  18 
         private boolean isValid = true;
    +  49   + 
     
     50   
         /**
     51   - 
          * Indicates whether the arguments are valid.
    -  52   - 
          */
    -  53  9 
         private boolean isValid = true;
    -  54   - 
     
    -  55   - 
         /**
    -  56   
          * Parses the arguments passed in and captures the results for later use.
    -  57   +  52   
          *
    -  58   +  53   
          * @param args the command line arguments
    -  59   - 
          * @throws FileNotFoundException is thrown when a 'file' argument does not
    -  60   - 
          * point to a file that exists.
    -  61   +  54   + 
          * @throws FileNotFoundException is thrown when a 'file' argument does not point to a file that exists.
    +  55   
          * @throws ParseException is thrown when a Parse Exception occurs.
    -  62   +  56   
          */
    -  63   +  57   
         public void parse(String[] args) throws FileNotFoundException, ParseException {
    -  64  9 
             line = parseArgs(args);
    +  58  18 
             line = parseArgs(args);
    +  59   + 
     
    +  60  16 
             if (line != null) {
    +  61  16 
                 validateArgs();
    +  62   + 
             }
    +  63  14 
         }
    +  64   + 
     
     65   - 
     
    -  66  8 
             if (line != null) {
    -  67  8 
                 validateArgs();
    -  68   - 
             }
    -  69  7 
         }
    -  70   - 
     
    -  71   
         /**
    -  72   +  66   
          * Parses the command line arguments.
    -  73   +  67   
          *
    -  74   +  68   
          * @param args the command line arguments
    -  75   +  69   
          * @return the results of parsing the command line arguments
    -  76   +  70   
          * @throws ParseException if the arguments are invalid
    -  77   +  71   
          */
    -  78   +  72   
         private CommandLine parseArgs(String[] args) throws ParseException {
    -  79  9 
             final CommandLineParser parser = new PosixParser();
    -  80  9 
             return parser.parse(options, args);
    -  81   +  73  18 
             final CommandLineParser parser = new PosixParser();
    +  74  18 
             final Options options = createCommandLineOptions();
    +  75  18 
             return parser.parse(options, args);
    +  76   
         }
    -  82   +  77   
     
    -  83   +  78   
         /**
    -  84   +  79   
          * Validates that the command line arguments are valid.
    +  80   + 
          *
    +  81   + 
          * @throws FileNotFoundException if there is a file specified by either the SCAN or CPE command line arguments that
    +  82   + 
          * does not exist.
    +  83   + 
          * @throws ParseException is thrown if there is an exception parsing the command line.
    +  84   + 
          */
     85   - 
          *
    -  86   - 
          * @throws FileNotFoundException if there is a file specified by either the
    -  87   - 
          * SCAN or CPE command line arguments that does not exist.
    -  88   - 
          * @throws ParseException is thrown if there is an exception parsing the
    -  89   - 
          * command line.
    -  90   - 
          */
    -  91   
         private void validateArgs() throws FileNotFoundException, ParseException {
    -  92  8 
             if (isRunScan()) {
    -  93  2 
                 validatePathExists(getScanFiles(), "scan");
    -  94  1 
                 validatePathExists(getReportDirectory(), "out");
    -  95  1 
                 if (!line.hasOption(ArgumentName.APP_NAME)) {
    -  96  0 
                     throw new ParseException("Missing 'app' argument; the scan cannot be run without the an application name.");
    -  97   +  86  16 
             if (isRunScan()) {
    +  87  4 
                 validatePathExists(getScanFiles(), "scan");
    +  88  2 
                 validatePathExists(getReportDirectory(), "out");
    +  89  2 
                 if (!line.hasOption(ArgumentName.APP_NAME)) {
    +  90  0 
                     throw new ParseException("Missing 'app' argument; the scan cannot be run without the an application name.");
    +  91   
                 }
    -  98  1 
                 if (line.hasOption(ArgumentName.OUTPUT_FORMAT)) {
    -  99  0 
                     final String format = line.getOptionValue(ArgumentName.OUTPUT_FORMAT);
    -  100   +  92  2 
                 if (line.hasOption(ArgumentName.OUTPUT_FORMAT)) {
    +  93  0 
                     final String format = line.getOptionValue(ArgumentName.OUTPUT_FORMAT);
    +  94   
                     try {
    -  101  0 
                         Format.valueOf(format);
    -  102  0 
                     } catch (IllegalArgumentException ex) {
    -  103  0 
                         final String msg = String.format("An invalid 'format' of '%s' was specified. Supported output formats are XML, HTML, VULN, or ALL", format);
    -  104  0 
                         throw new ParseException(msg);
    -  105  0 
                     }
    -  106   +  95  0 
                         Format.valueOf(format);
    +  96  0 
                     } catch (IllegalArgumentException ex) {
    +  97  0 
                         final String msg = String.format("An invalid 'format' of '%s' was specified. "
    +  98   + 
                                 + "Supported output formats are XML, HTML, VULN, or ALL", format);
    +  99  0 
                         throw new ParseException(msg);
    +  100  0 
                     }
    +  101   
                 }
    +  102   + 
             }
    +  103  14 
         }
    +  104   + 
     
    +  105   + 
         /**
    +  106   + 
          * Validates whether or not the path(s) points at a file that exists; if the path(s) does not point to an existing
     107   - 
             }
    -  108  7 
         }
    + 
          * file a FileNotFoundException is thrown.
    +  108   + 
          *
     109   - 
     
    -  110   - 
         /**
    -  111   - 
          * Validates whether or not the path(s) points at a file that exists; if the
    -  112   - 
          * path(s) does not point to an existing file a FileNotFoundException is
    -  113   - 
          * thrown.
    -  114   - 
          *
    -  115   
          * @param paths the paths to validate if they exists
    -  116   +  110   
          * @param optType the option being validated (e.g. scan, out, etc.)
    -  117   - 
          * @throws FileNotFoundException is thrown if one of the paths being
    -  118   - 
          * validated does not exist.
    -  119   +  111   + 
          * @throws FileNotFoundException is thrown if one of the paths being validated does not exist.
    +  112   
          */
    -  120   +  113   
         private void validatePathExists(String[] paths, String optType) throws FileNotFoundException {
    -  121  3 
             for (String path : paths) {
    -  122  2 
                 validatePathExists(path, optType);
    +  114  6 
             for (String path : paths) {
    +  115  4 
                 validatePathExists(path, optType);
    +  116   + 
             }
    +  117  2 
         }
    +  118   + 
     
    +  119   + 
         /**
    +  120   + 
          * Validates whether or not the path points at a file that exists; if the path does not point to an existing file a
    +  121   + 
          * FileNotFoundException is thrown.
    +  122   + 
          *
     123   - 
             }
    -  124  1 
         }
    -  125   - 
     
    -  126   - 
         /**
    -  127   - 
          * Validates whether or not the path points at a file that exists; if the
    -  128   - 
          * path does not point to an existing file a FileNotFoundException is
    -  129   - 
          * thrown.
    -  130   - 
          *
    -  131   
          * @param path the paths to validate if they exists
    -  132   +  124   
          * @param optType the option being validated (e.g. scan, out, etc.)
    -  133   - 
          * @throws FileNotFoundException is thrown if the path being validated does
    -  134   - 
          * not exist.
    -  135   +  125   + 
          * @throws FileNotFoundException is thrown if the path being validated does not exist.
    +  126   
          */
    -  136   +  127   
         private void validatePathExists(String path, String optType) throws FileNotFoundException {
    -  137  3 
             final File f = new File(path);
    -  138  3 
             if (!f.exists()) {
    -  139  1 
                 isValid = false;
    -  140  1 
                 final String msg = String.format("Invalid '%s' argument: '%s'", optType, path);
    -  141  1 
                 throw new FileNotFoundException(msg);
    -  142   +  128  6 
             final File f = new File(path);
    +  129  6 
             if (!f.exists()) {
    +  130  2 
                 isValid = false;
    +  131  2 
                 final String msg = String.format("Invalid '%s' argument: '%s'", optType, path);
    +  132  2 
                 throw new FileNotFoundException(msg);
    +  133   
             }
    -  143  2 
         }
    -  144   +  134  4 
         }
    +  135   
     
    -  145   +  136   
         /**
    -  146   - 
          * Generates an Options collection that is used to parse the command line
    -  147   - 
          * and to display the help message.
    -  148   +  137   + 
          * Generates an Options collection that is used to parse the command line and to display the help message.
    +  138   
          *
    -  149   +  139   
          * @return the command line options used for parsing the command line
    -  150   +  140   
          */
    -  151   +  141   
         @SuppressWarnings("static-access")
    -  152   +  142   
         private Options createCommandLineOptions() {
    -  153  9 
             final Option help = new Option(ArgumentName.HELP_SHORT, ArgumentName.HELP, false,
    +  143   + 
     
    +  144  18 
             final Options options = new Options();
    +  145  18 
             addStandardOptions(options);
    +  146  18 
             addAdvancedOptions(options);
    +  147   + 
     
    +  148  18 
             return options;
    +  149   + 
         }
    +  150   + 
     
    +  151   + 
         /**
    +  152   + 
          * Adds the standard command line options to the given options collection.
    +  153   + 
          *
     154   - 
                     "Print this message.");
    + 
          * @param options a collection of command line arguments
     155   - 
     
    -  156  9 
             final Option version = new Option(ArgumentName.VERSION_SHORT, ArgumentName.VERSION,
    + 
          * @throws IllegalArgumentException thrown if there is an exception
    +  156   + 
          */
     157   - 
                     false, "Print the version information.");
    + 
         @SuppressWarnings("static-access")
     158   - 
     
    -  159  9 
             final Option noUpdate = new Option(ArgumentName.DISABLE_AUTO_UPDATE_SHORT, ArgumentName.DISABLE_AUTO_UPDATE,
    + 
         private void addStandardOptions(final Options options) throws IllegalArgumentException {
    +  159  22 
             final Option help = new Option(ArgumentName.HELP_SHORT, ArgumentName.HELP, false,
     160   - 
                     false, "Disables the automatic updating of the CPE data.");
    + 
                     "Print this message.");
     161   
     
    -  162  9 
             final Option appName = OptionBuilder.withArgName("name").hasArg().withLongOpt(ArgumentName.APP_NAME)
    +  162  22 
             final Option advancedHelp = OptionBuilder.withLongOpt(ArgumentName.ADVANCED_HELP)
     163   - 
                     .withDescription("The name of the application being scanned. This is a required argument.")
    + 
                     .withDescription("Print the advanced help message.").create();
     164   - 
                     .create(ArgumentName.APP_NAME_SHORT);
    -  165   
     
    -  166  9 
             final Option connectionTimeout = OptionBuilder.withArgName("timeout").hasArg().withLongOpt(ArgumentName.CONNECTION_TIMEOUT)
    +  165  22 
             final Option version = new Option(ArgumentName.VERSION_SHORT, ArgumentName.VERSION,
    +  166   + 
                     false, "Print the version information.");
     167   - 
                     .withDescription("The connection timeout (in milliseconds) to use when downloading resources.")
    -  168   - 
                     .create(ArgumentName.CONNECTION_TIMEOUT_SHORT);
    + 
     
    +  168  22 
             final Option noUpdate = new Option(ArgumentName.DISABLE_AUTO_UPDATE_SHORT, ArgumentName.DISABLE_AUTO_UPDATE,
     169   + 
                     false, "Disables the automatic updating of the CPE data.");
    +  170   
     
    -  170  9 
             final Option proxyUrl = OptionBuilder.withArgName("url").hasArg().withLongOpt(ArgumentName.PROXY_URL)
    -  171   - 
                     .withDescription("The proxy url to use when downloading resources.")
    +  171  22 
             final Option appName = OptionBuilder.withArgName("name").hasArg().withLongOpt(ArgumentName.APP_NAME)
     172   - 
                     .create(ArgumentName.PROXY_URL_SHORT);
    + 
                     .withDescription("The name of the application being scanned. This is a required argument.")
     173   + 
                     .create(ArgumentName.APP_NAME_SHORT);
    +  174   
     
    -  174  9 
             final Option proxyPort = OptionBuilder.withArgName("port").hasArg().withLongOpt(ArgumentName.PROXY_PORT)
    -  175   - 
                     .withDescription("The proxy port to use when downloading resources.")
    +  175  22 
             final Option path = OptionBuilder.withArgName("path").hasArg().withLongOpt(ArgumentName.SCAN)
     176   - 
                     .create(ArgumentName.PROXY_PORT_SHORT);
    -  177   - 
     
    -  178  9 
             final Option proxyUsername = OptionBuilder.withArgName("user").hasArg().withLongOpt(ArgumentName.PROXY_USERNAME)
    -  179   - 
                     .withDescription("The proxy username to use when downloading resources.")
    -  180   - 
                     .create(ArgumentName.PROXY_USERNAME_SHORT);
    -  181   - 
     
    -  182  9 
             final Option proxyPassword = OptionBuilder.withArgName("pass").hasArg().withLongOpt(ArgumentName.PROXY_PASSWORD)
    -  183   - 
                     .withDescription("The proxy password to use when downloading resources.")
    -  184   - 
                     .create(ArgumentName.PROXY_PASSWORD_SHORT);
    -  185   - 
     
    -  186  9 
             final Option path = OptionBuilder.withArgName("path").hasArg().withLongOpt(ArgumentName.SCAN)
    -  187   
                     .withDescription("The path to scan - this option can be specified multiple times.")
    -  188   +  177   
                     .create(ArgumentName.SCAN_SHORT);
    -  189   +  178   
     
    -  190  9 
             final Option props = OptionBuilder.withArgName("file").hasArg().withLongOpt(ArgumentName.PROP)
    -  191   +  179  22 
             final Option props = OptionBuilder.withArgName("file").hasArg().withLongOpt(ArgumentName.PROP)
    +  180   
                     .withDescription("A property file to load.")
    -  192   +  181   
                     .create(ArgumentName.PROP_SHORT);
    -  193   +  182   
     
    -  194  9 
             final Option data = OptionBuilder.withArgName("path").hasArg().withLongOpt(ArgumentName.DATA_DIRECTORY)
    -  195   - 
                     .withDescription("The location of the data directory used to store persistent data. This option should generally not be set.")
    -  196   - 
                     .create(ArgumentName.DATA_DIRECTORY_SHORT);
    -  197   - 
     
    -  198  9 
             final Option out = OptionBuilder.withArgName("folder").hasArg().withLongOpt(ArgumentName.OUT)
    -  199   +  183  22 
             final Option out = OptionBuilder.withArgName("folder").hasArg().withLongOpt(ArgumentName.OUT)
    +  184   
                     .withDescription("The folder to write reports to. This defaults to the current directory.")
    -  200   +  185   
                     .create(ArgumentName.OUT_SHORT);
    -  201   +  186   
     
    -  202  9 
             final Option outputFormat = OptionBuilder.withArgName("format").hasArg().withLongOpt(ArgumentName.OUTPUT_FORMAT)
    -  203   +  187  22 
             final Option outputFormat = OptionBuilder.withArgName("format").hasArg().withLongOpt(ArgumentName.OUTPUT_FORMAT)
    +  188   
                     .withDescription("The output format to write to (XML, HTML, VULN, ALL). The default is HTML.")
    -  204   +  189   
                     .create(ArgumentName.OUTPUT_FORMAT_SHORT);
    -  205   +  190   
     
    -  206  9 
             final Option verboseLog = OptionBuilder.withArgName("file").hasArg().withLongOpt(ArgumentName.VERBOSE_LOG)
    -  207   +  191  22 
             final Option verboseLog = OptionBuilder.withArgName("file").hasArg().withLongOpt(ArgumentName.VERBOSE_LOG)
    +  192   
                     .withDescription("The file path to write verbose logging information.")
    -  208   +  193   
                     .create(ArgumentName.VERBOSE_LOG_SHORT);
    -  209   +  194   
     
    -  210  9 
             final Option suppressionFile = OptionBuilder.withArgName("file").hasArg().withLongOpt(ArgumentName.SUPPRESION_FILE)
    -  211   +  195  22 
             final Option suppressionFile = OptionBuilder.withArgName("file").hasArg().withLongOpt(ArgumentName.SUPPRESION_FILE)
    +  196   
                     .withDescription("The file path to the suppression XML file.")
    +  197   + 
                     .create();
    +  198   + 
     
    +  199  22 
             final Option disableNexusAnalyzer = OptionBuilder.withLongOpt(ArgumentName.DISABLE_NEXUS)
    +  200   + 
                     .withDescription("Disable the Nexus Analyzer.")
    +  201   + 
                     .create();
    +  202   + 
     
    +  203  22 
             final Option nexusUrl = OptionBuilder.withArgName("url").hasArg().withLongOpt(ArgumentName.NEXUS_URL)
    +  204   + 
                     .withDescription("The url to the Nexus Server.")
    +  205   + 
                     .create();
    +  206   + 
     
    +  207   + 
             //This is an option group because it can be specified more then once.
    +  208  22 
             final OptionGroup og = new OptionGroup();
    +  209  22 
             og.addOption(path);
    +  210   + 
     
    +  211  22 
             options.addOptionGroup(og)
     212   - 
                     .create(ArgumentName.SUPPRESION_FILE_SHORT);
    + 
                     .addOption(out)
     213   - 
     
    + 
                     .addOption(outputFormat)
     214   - 
     
    -  215  9 
             final OptionGroup og = new OptionGroup();
    -  216  9 
             og.addOption(path);
    + 
                     .addOption(appName)
    +  215   + 
                     .addOption(version)
    +  216   + 
                     .addOption(help)
     217   + 
                     .addOption(advancedHelp)
    +  218   + 
                     .addOption(noUpdate)
    +  219   + 
                     .addOption(props)
    +  220   + 
                     .addOption(verboseLog)
    +  221   + 
                     .addOption(suppressionFile)
    +  222   + 
                     .addOption(disableNexusAnalyzer)
    +  223   + 
                     .addOption(nexusUrl);
    +  224  22 
         }
    +  225   
     
    -  218  9 
             final Options opts = new Options();
    -  219  9 
             opts.addOptionGroup(og);
    -  220  9 
             opts.addOption(out);
    -  221  9 
             opts.addOption(outputFormat);
    -  222  9 
             opts.addOption(appName);
    -  223  9 
             opts.addOption(version);
    -  224  9 
             opts.addOption(help);
    -  225  9 
             opts.addOption(noUpdate);
    -  226  9 
             opts.addOption(props);
    -  227  9 
             opts.addOption(data);
    -  228  9 
             opts.addOption(verboseLog);
    -  229  9 
             opts.addOption(suppressionFile);
    -  230  9 
             opts.addOption(proxyPort);
    -  231  9 
             opts.addOption(proxyUrl);
    -  232  9 
             opts.addOption(proxyUsername);
    -  233  9 
             opts.addOption(proxyPassword);
    -  234  9 
             opts.addOption(connectionTimeout);
    +  226   + 
         /**
    +  227   + 
          * Adds the advanced command line options to the given options collection. These are split out for purposes of being
    +  228   + 
          * able to display two different help messages.
    +  229   + 
          *
    +  230   + 
          * @param options a collection of command line arguments
    +  231   + 
          * @throws IllegalArgumentException thrown if there is an exception
    +  232   + 
          */
    +  233   + 
         @SuppressWarnings("static-access")
    +  234   + 
         private void addAdvancedOptions(final Options options) throws IllegalArgumentException {
     235   
     
    -  236  9 
             return opts;
    +  236  18 
             final Option data = OptionBuilder.withArgName("path").hasArg().withLongOpt(ArgumentName.DATA_DIRECTORY)
     237   - 
         }
    + 
                     .withDescription("The location of the H2 Database file. This option should generally not be set.")
     238   - 
     
    + 
                     .create(ArgumentName.DATA_DIRECTORY_SHORT);
     239   - 
         /**
    -  240   - 
          * Determines if the 'version' command line argument was passed in.
    + 
     
    +  240  18 
             final Option connectionTimeout = OptionBuilder.withArgName("timeout").hasArg().withLongOpt(ArgumentName.CONNECTION_TIMEOUT)
     241   - 
          *
    + 
                     .withDescription("The connection timeout (in milliseconds) to use when downloading resources.")
     242   - 
          * @return whether or not the 'version' command line argument was passed in
    + 
                     .create(ArgumentName.CONNECTION_TIMEOUT_SHORT);
     243   - 
          */
    -  244   - 
         public boolean isGetVersion() {
    -  245  7 
             return (line != null) && line.hasOption(ArgumentName.VERSION);
    + 
     
    +  244  18 
             final Option proxyUrl = OptionBuilder.withArgName("url").hasArg().withLongOpt(ArgumentName.PROXY_URL)
    +  245   + 
                     .withDescription("The proxy url to use when downloading resources.")
     246   - 
         }
    + 
                     .create(ArgumentName.PROXY_URL_SHORT);
     247   
     
    -  248   - 
         /**
    +  248  18 
             final Option proxyPort = OptionBuilder.withArgName("port").hasArg().withLongOpt(ArgumentName.PROXY_PORT)
     249   - 
          * Determines if the 'help' command line argument was passed in.
    + 
                     .withDescription("The proxy port to use when downloading resources.")
     250   - 
          *
    + 
                     .create(ArgumentName.PROXY_PORT_SHORT);
     251   - 
          * @return whether or not the 'help' command line argument was passed in
    -  252   - 
          */
    + 
     
    +  252  18 
             final Option proxyUsername = OptionBuilder.withArgName("user").hasArg().withLongOpt(ArgumentName.PROXY_USERNAME)
     253   - 
         public boolean isGetHelp() {
    -  254  7 
             return (line != null) && line.hasOption(ArgumentName.HELP);
    + 
                     .withDescription("The proxy username to use when downloading resources.")
    +  254   + 
                     .create();
     255   - 
         }
    -  256   
     
    +  256  18 
             final Option proxyPassword = OptionBuilder.withArgName("pass").hasArg().withLongOpt(ArgumentName.PROXY_PASSWORD)
     257   - 
         /**
    + 
                     .withDescription("The proxy password to use when downloading resources.")
     258   - 
          * Determines if the 'scan' command line argument was passed in.
    + 
                     .create();
     259   - 
          *
    -  260   - 
          * @return whether or not the 'scan' command line argument was passed in
    + 
     
    +  260  18 
             final Option connectionString = OptionBuilder.withArgName("connStr").hasArg().withLongOpt(ArgumentName.CONNECTION_STRING)
     261   - 
          */
    + 
                     .withDescription("The connection string to the database.")
     262   - 
         public boolean isRunScan() {
    -  263  15 
             return (line != null) && isValid && line.hasOption(ArgumentName.SCAN);
    + 
                     .create();
    +  263  18 
             final Option dbUser = OptionBuilder.withArgName("user").hasArg().withLongOpt(ArgumentName.DB_NAME)
     264   - 
         }
    + 
                     .withDescription("The username used to connect to the database.")
     265   - 
     
    -  266   - 
         /**
    + 
                     .create();
    +  266  18 
             final Option dbPassword = OptionBuilder.withArgName("password").hasArg().withLongOpt(ArgumentName.DB_PASSWORD)
     267   - 
          * Displays the command line help message to the standard output.
    + 
                     .withDescription("The password for connecting to the database.")
     268   - 
          */
    -  269   - 
         public void printHelp() {
    -  270  2 
             final HelpFormatter formatter = new HelpFormatter();
    -  271  2 
             final String nl = System.getProperty("line.separator");
    -  272   - 
     
    -  273  2 
             formatter.printHelp(Settings.getString("application.name", "DependencyCheck"),
    + 
                     .create();
    +  269  18 
             final Option dbDriver = OptionBuilder.withArgName("driver").hasArg().withLongOpt(ArgumentName.DB_DRIVER)
    +  270   + 
                     .withDescription("The database driver name.")
    +  271   + 
                     .create();
    +  272  18 
             final Option dbDriverPath = OptionBuilder.withArgName("path").hasArg().withLongOpt(ArgumentName.DB_DRIVER_PATH)
    +  273   + 
                     .withDescription("The path to the database driver; note, this does not need to be set unless the JAR is outside of the classpath.")
     274   - 
                     nl + Settings.getString("application.name", "DependencyCheck")
    + 
                     .create();
     275   - 
                     + " can be used to identify if there are any known CVE vulnerabilities in libraries utilized by an application. "
    -  276   - 
                     + Settings.getString("application.name", "DependencyCheck")
    + 
     
    +  276  18 
             options.addOption(proxyPort)
     277   - 
                     + " will automatically update required data from the Internet, such as the CVE and CPE data files from nvd.nist.gov." + nl + nl,
    + 
                     .addOption(proxyUrl)
     278   - 
                     options,
    + 
                     .addOption(proxyUsername)
     279   - 
                     "",
    + 
                     .addOption(proxyPassword)
     280   - 
                     true);
    -  281  2 
         }
    + 
                     .addOption(connectionTimeout)
    +  281   + 
                     .addOption(connectionString)
     282   - 
     
    + 
                     .addOption(dbUser)
     283   - 
         /**
    + 
                     .addOption(data)
     284   - 
          * Retrieves the file command line parameter(s) specified for the 'scan'
    + 
                     .addOption(dbPassword)
     285   - 
          * argument.
    + 
                     .addOption(dbDriver)
     286   - 
          *
    -  287   - 
          * @return the file paths specified on the command line for scan
    + 
                     .addOption(dbDriverPath);
    +  287  18 
         }
     288   - 
          */
    + 
     
     289   - 
         public String[] getScanFiles() {
    -  290  3 
             return line.getOptionValues(ArgumentName.SCAN);
    + 
         /**
    +  290   + 
          * Determines if the 'version' command line argument was passed in.
     291   - 
         }
    + 
          *
     292   - 
     
    + 
          * @return whether or not the 'version' command line argument was passed in
     293   - 
         /**
    + 
          */
     294   - 
          * Returns the directory to write the reports to specified on the command
    -  295   - 
          * line.
    + 
         public boolean isGetVersion() {
    +  295  14 
             return (line != null) && line.hasOption(ArgumentName.VERSION);
     296   - 
          *
    + 
         }
     297   - 
          * @return the path to the reports directory.
    + 
     
     298   - 
          */
    + 
         /**
     299   - 
         public String getReportDirectory() {
    -  300  1 
             return line.getOptionValue(ArgumentName.OUT, ".");
    + 
          * Determines if the 'help' command line argument was passed in.
    +  300   + 
          *
     301   - 
         }
    + 
          * @return whether or not the 'help' command line argument was passed in
     302   - 
     
    + 
          */
     303   - 
         /**
    -  304   - 
          * Returns the output format specified on the command line. Defaults to HTML
    + 
         public boolean isGetHelp() {
    +  304  14 
             return (line != null) && line.hasOption(ArgumentName.HELP);
     305   - 
          * if no format was specified.
    + 
         }
     306   - 
          *
    + 
     
     307   - 
          * @return the output format name.
    + 
         /**
     308   - 
          */
    + 
          * Determines if the 'scan' command line argument was passed in.
     309   - 
         public String getReportFormat() {
    -  310  0 
             return line.getOptionValue(ArgumentName.OUTPUT_FORMAT, "HTML");
    + 
          *
    +  310   + 
          * @return whether or not the 'scan' command line argument was passed in
     311   - 
         }
    + 
          */
     312   - 
     
    -  313   - 
         /**
    + 
         public boolean isRunScan() {
    +  313  30 
             return (line != null) && isValid && line.hasOption(ArgumentName.SCAN);
     314   - 
          * Returns the application name specified on the command line.
    + 
         }
     315   - 
          *
    + 
     
     316   - 
          * @return the application name.
    + 
         /**
     317   - 
          */
    + 
          * Returns true if the disableNexus command line argument was specified.
     318   - 
         public String getApplicationName() {
    -  319  0 
             return line.getOptionValue(ArgumentName.APP_NAME);
    + 
          *
    +  319   + 
          * @return true if the disableNexus command line argument was specified; otherwise false
     320   - 
         }
    + 
          */
     321   - 
     
    -  322   - 
         /**
    + 
         public boolean isNexusDisabled() {
    +  322  0 
             return (line != null) && line.hasOption(ArgumentName.DISABLE_NEXUS);
     323   - 
          * Returns the connection timeout.
    + 
         }
     324   - 
          *
    + 
     
     325   - 
          * @return the connection timeout
    + 
         /**
     326   - 
          */
    + 
          * Returns the url to the nexus server if one was specified.
     327   - 
         public String getConnectionTimeout() {
    -  328  0 
             return line.getOptionValue(ArgumentName.CONNECTION_TIMEOUT);
    + 
          *
    +  328   + 
          * @return the url to the nexus server; if none was specified this will return null;
     329   - 
         }
    + 
          */
     330   - 
     
    -  331   - 
         /**
    -  332   - 
          * Returns the proxy url.
    + 
         public String getNexusUrl() {
    +  331  0 
             if (line == null || !line.hasOption(ArgumentName.NEXUS_URL)) {
    +  332  0 
                 return null;
     333   - 
          *
    -  334   - 
          * @return the proxy url
    + 
             } else {
    +  334  0 
                 return line.getOptionValue(ArgumentName.NEXUS_URL);
     335   - 
          */
    -  336   - 
         public String getProxyUrl() {
    -  337  0 
             return line.getOptionValue(ArgumentName.PROXY_URL);
    -  338   - 
         }
    -  339   - 
     
    -  340   - 
         /**
    -  341   - 
          * Returns the proxy port.
    -  342   - 
          *
    -  343   - 
          * @return the proxy port
    -  344   - 
          */
    -  345   - 
         public String getProxyPort() {
    -  346  0 
             return line.getOptionValue(ArgumentName.PROXY_PORT);
    -  347   - 
         }
    -  348   - 
     
    -  349   - 
         /**
    -  350   - 
          * Returns the proxy username.
    -  351   - 
          *
    -  352   - 
          * @return the proxy username
    -  353   - 
          */
    -  354   - 
         public String getProxyUsername() {
    -  355  0 
             return line.getOptionValue(ArgumentName.PROXY_USERNAME);
    -  356   - 
         }
    -  357   - 
     
    -  358   - 
         /**
    -  359   - 
          * Returns the proxy password.
    -  360   - 
          *
    -  361   - 
          * @return the proxy password
    -  362   - 
          */
    -  363   - 
         public String getProxyPassword() {
    -  364  0 
             return line.getOptionValue(ArgumentName.PROXY_PASSWORD);
    -  365   - 
         }
    -  366   - 
     
    -  367   - 
         /**
    -  368   - 
          * Get the value of dataDirectory.
    -  369   - 
          *
    -  370   - 
          * @return the value of dataDirectory
    -  371   - 
          */
    -  372   - 
         public String getDataDirectory() {
    -  373  0 
             return line.getOptionValue(ArgumentName.DATA_DIRECTORY);
    -  374   - 
         }
    -  375   - 
     
    -  376   - 
         /**
    -  377   - 
          * Returns the properties file specified on the command line.
    -  378   - 
          *
    -  379   - 
          * @return the properties file specified on the command line
    -  380   - 
          */
    -  381   - 
         public File getPropertiesFile() {
    -  382  0 
             final String path = line.getOptionValue(ArgumentName.PROP);
    -  383  0 
             if (path != null) {
    -  384  0 
                 return new File(path);
    -  385   
             }
    -  386  0 
             return null;
    +  336   + 
         }
    +  337   + 
     
    +  338   + 
         /**
    +  339   + 
          * Displays the command line help message to the standard output.
    +  340   + 
          */
    +  341   + 
         public void printHelp() {
    +  342  4 
             final HelpFormatter formatter = new HelpFormatter();
    +  343  4 
             final Options options = new Options();
    +  344  4 
             addStandardOptions(options);
    +  345  4 
             if (line != null && line.hasOption(ArgumentName.ADVANCED_HELP)) {
    +  346  0 
                 addAdvancedOptions(options);
    +  347   + 
             }
    +  348  4 
             final String helpMsg = String.format("%n%s"
    +  349   + 
                     + " can be used to identify if there are any known CVE vulnerabilities in libraries utilized by an application. "
    +  350   + 
                     + "%s will automatically update required data from the Internet, such as the CVE and CPE data files from nvd.nist.gov.%n%n",
    +  351   + 
                     Settings.getString("application.name", "DependencyCheck"),
    +  352   + 
                     Settings.getString("application.name", "DependencyCheck"));
    +  353   + 
     
    +  354  4 
             formatter.printHelp(Settings.getString("application.name", "DependencyCheck"),
    +  355   + 
                     helpMsg,
    +  356   + 
                     options,
    +  357   + 
                     "",
    +  358   + 
                     true);
    +  359   + 
     
    +  360  4 
         }
    +  361   + 
     
    +  362   + 
         /**
    +  363   + 
          * Retrieves the file command line parameter(s) specified for the 'scan' argument.
    +  364   + 
          *
    +  365   + 
          * @return the file paths specified on the command line for scan
    +  366   + 
          */
    +  367   + 
         public String[] getScanFiles() {
    +  368  6 
             return line.getOptionValues(ArgumentName.SCAN);
    +  369   + 
         }
    +  370   + 
     
    +  371   + 
         /**
    +  372   + 
          * Returns the directory to write the reports to specified on the command line.
    +  373   + 
          *
    +  374   + 
          * @return the path to the reports directory.
    +  375   + 
          */
    +  376   + 
         public String getReportDirectory() {
    +  377  2 
             return line.getOptionValue(ArgumentName.OUT, ".");
    +  378   + 
         }
    +  379   + 
     
    +  380   + 
         /**
    +  381   + 
          * Returns the output format specified on the command line. Defaults to HTML if no format was specified.
    +  382   + 
          *
    +  383   + 
          * @return the output format name.
    +  384   + 
          */
    +  385   + 
         public String getReportFormat() {
    +  386  0 
             return line.getOptionValue(ArgumentName.OUTPUT_FORMAT, "HTML");
     387   
         }
     388   @@ -709,16 +714,16 @@  389   
         /**
     390   - 
          * Returns the path to the verbose log file.
    + 
          * Returns the application name specified on the command line.
     391   
          *
     392   - 
          * @return the path to the verbose log file
    + 
          * @return the application name.
     393   
          */
     394   - 
         public String getVerboseLog() {
    -  395  0 
             return line.getOptionValue(ArgumentName.VERBOSE_LOG);
    + 
         public String getApplicationName() {
    +  395  0 
             return line.getOptionValue(ArgumentName.APP_NAME);
     396   
         }
     397   @@ -726,16 +731,16 @@  398   
         /**
     399   - 
          * Returns the path to the suppression file.
    + 
          * Returns the connection timeout.
     400   
          *
     401   - 
          * @return the path to the suppression file
    + 
          * @return the connection timeout
     402   
          */
     403   - 
         public String getSuppressionFile() {
    -  404  0 
             return line.getOptionValue(ArgumentName.SUPPRESION_FILE);
    + 
         public String getConnectionTimeout() {
    +  404  0 
             return line.getOptionValue(ArgumentName.CONNECTION_TIMEOUT);
     405   
         }
     406   @@ -743,344 +748,582 @@  407   
         /**
     408   - 
          * <p>Prints the manifest information to standard output.</p>
    + 
          * Returns the proxy url.
     409   - 
          * <ul><li>Implementation-Title: ${pom.name}</li>
    + 
          *
     410   - 
          * <li>Implementation-Version: ${pom.version}</li></ul>
    + 
          * @return the proxy url
     411   
          */
     412   - 
         public void printVersionInfo() {
    -  413  1 
             final String version = String.format("%s version %s",
    + 
         public String getProxyUrl() {
    +  413  0 
             return line.getOptionValue(ArgumentName.PROXY_URL);
     414   - 
                     Settings.getString("application.name", "DependencyCheck"),
    -  415   - 
                     Settings.getString("application.version", "Unknown"));
    -  416  1 
             System.out.println(version);
    -  417  1 
         }
    -  418   - 
     
    -  419   - 
         /**
    -  420   - 
          * Checks if the auto update feature has been disabled. If it has been
    -  421   - 
          * disabled via the command line this will return false.
    -  422   - 
          *
    -  423   - 
          * @return if auto-update is allowed.
    -  424   - 
          */
    -  425   - 
         public boolean isAutoUpdate() {
    -  426  0 
             return (line == null) || !line.hasOption(ArgumentName.DISABLE_AUTO_UPDATE);
    -  427   
         }
    -  428   +  415   
     
    -  429   +  416   
         /**
    -  430   - 
          * A collection of static final strings that represent the possible command
    -  431   - 
          * line arguments.
    -  432   +  417   + 
          * Returns the proxy port.
    +  418   + 
          *
    +  419   + 
          * @return the proxy port
    +  420   
          */
    -  433  9 
         public static class ArgumentName {
    -  434   +  421   + 
         public String getProxyPort() {
    +  422  0 
             return line.getOptionValue(ArgumentName.PROXY_PORT);
    +  423   + 
         }
    +  424   
     
    +  425   + 
         /**
    +  426   + 
          * Returns the proxy username.
    +  427   + 
          *
    +  428   + 
          * @return the proxy username
    +  429   + 
          */
    +  430   + 
         public String getProxyUsername() {
    +  431  0 
             return line.getOptionValue(ArgumentName.PROXY_USERNAME);
    +  432   + 
         }
    +  433   + 
     
    +  434   + 
         /**
     435   - 
             /**
    + 
          * Returns the proxy password.
     436   - 
              * The long CLI argument name specifying the directory/file to scan.
    + 
          *
     437   - 
              */
    + 
          * @return the proxy password
     438   - 
             public static final String SCAN = "scan";
    + 
          */
     439   - 
             /**
    -  440   - 
              * The short CLI argument name specifying the directory/file to scan.
    + 
         public String getProxyPassword() {
    +  440  0 
             return line.getOptionValue(ArgumentName.PROXY_PASSWORD);
     441   - 
              */
    + 
         }
     442   - 
             public static final String SCAN_SHORT = "s";
    + 
     
     443   - 
             /**
    + 
         /**
     444   - 
              * The long CLI argument name specifying that the CPE/CVE/etc. data
    + 
          * Get the value of dataDirectory.
     445   - 
              * should not be automatically updated.
    + 
          *
     446   - 
              */
    + 
          * @return the value of dataDirectory
     447   - 
             public static final String DISABLE_AUTO_UPDATE = "noupdate";
    + 
          */
     448   - 
             /**
    -  449   - 
              * The short CLI argument name specifying that the CPE/CVE/etc. data
    + 
         public String getDataDirectory() {
    +  449  0 
             return line.getOptionValue(ArgumentName.DATA_DIRECTORY);
     450   - 
              * should not be automatically updated.
    + 
         }
     451   - 
              */
    + 
     
     452   - 
             public static final String DISABLE_AUTO_UPDATE_SHORT = "n";
    + 
         /**
     453   - 
             /**
    + 
          * Returns the properties file specified on the command line.
     454   - 
              * The long CLI argument name specifying the directory to write the
    + 
          *
     455   - 
              * reports to.
    + 
          * @return the properties file specified on the command line
     456   - 
              */
    + 
          */
     457   - 
             public static final String OUT = "out";
    -  458   - 
             /**
    -  459   - 
              * The short CLI argument name specifying the directory to write the
    -  460   - 
              * reports to.
    + 
         public File getPropertiesFile() {
    +  458  0 
             final String path = line.getOptionValue(ArgumentName.PROP);
    +  459  0 
             if (path != null) {
    +  460  0 
                 return new File(path);
     461   - 
              */
    -  462   - 
             public static final String OUT_SHORT = "o";
    + 
             }
    +  462  0 
             return null;
     463   - 
             /**
    + 
         }
     464   - 
              * The long CLI argument name specifying the output format to write the
    + 
     
     465   - 
              * reports to.
    + 
         /**
     466   - 
              */
    + 
          * Returns the path to the verbose log file.
     467   - 
             public static final String OUTPUT_FORMAT = "format";
    + 
          *
     468   - 
             /**
    + 
          * @return the path to the verbose log file
     469   - 
              * The short CLI argument name specifying the output format to write the
    + 
          */
     470   - 
              * reports to.
    -  471   - 
              */
    + 
         public String getVerboseLog() {
    +  471  0 
             return line.getOptionValue(ArgumentName.VERBOSE_LOG);
     472   - 
             public static final String OUTPUT_FORMAT_SHORT = "f";
    + 
         }
     473   - 
             /**
    + 
     
     474   - 
              * The long CLI argument name specifying the name of the application to
    + 
         /**
     475   - 
              * be scanned.
    + 
          * Returns the path to the suppression file.
     476   - 
              */
    + 
          *
     477   - 
             public static final String APP_NAME = "app";
    + 
          * @return the path to the suppression file
     478   - 
             /**
    + 
          */
     479   - 
              * The short CLI argument name specifying the name of the application to
    -  480   - 
              * be scanned.
    + 
         public String getSuppressionFile() {
    +  480  0 
             return line.getOptionValue(ArgumentName.SUPPRESION_FILE);
     481   - 
              */
    + 
         }
     482   - 
             public static final String APP_NAME_SHORT = "a";
    + 
     
     483   - 
             /**
    + 
         /**
     484   - 
              * The long CLI argument name asking for help.
    + 
          * <p>
     485   - 
              */
    + 
          * Prints the manifest information to standard output.</p>
     486   - 
             public static final String HELP = "help";
    + 
          * <ul><li>Implementation-Title: ${pom.name}</li>
     487   - 
             /**
    + 
          * <li>Implementation-Version: ${pom.version}</li></ul>
     488   - 
              * The short CLI argument name asking for help.
    + 
          */
     489   - 
              */
    -  490   - 
             public static final String HELP_SHORT = "h";
    + 
         public void printVersionInfo() {
    +  490  2 
             final String version = String.format("%s version %s",
     491   - 
             /**
    + 
                     Settings.getString("application.name", "DependencyCheck"),
     492   - 
              * The long CLI argument name asking for the version.
    -  493   - 
              */
    -  494   - 
             public static final String VERSION_SHORT = "v";
    + 
                     Settings.getString("application.version", "Unknown"));
    +  493  2 
             System.out.println(version);
    +  494  2 
         }
     495   - 
             /**
    + 
     
     496   - 
              * The short CLI argument name asking for the version.
    + 
         /**
     497   - 
              */
    + 
          * Checks if the auto update feature has been disabled. If it has been disabled via the command line this will
     498   - 
             public static final String VERSION = "version";
    + 
          * return false.
     499   - 
             /**
    + 
          *
     500   - 
              * The short CLI argument name indicating the proxy port.
    + 
          * @return if auto-update is allowed.
     501   - 
              */
    + 
          */
     502   - 
             public static final String PROXY_PORT_SHORT = "p";
    -  503   - 
             /**
    + 
         public boolean isAutoUpdate() {
    +  503  0 
             return (line == null) || !line.hasOption(ArgumentName.DISABLE_AUTO_UPDATE);
     504   - 
              * The CLI argument name indicating the proxy port.
    + 
         }
     505   - 
              */
    + 
     
     506   - 
             public static final String PROXY_PORT = "proxyport";
    + 
         /**
     507   - 
             /**
    + 
          * Returns the database driver name if specified; otherwise null is returned.
     508   - 
              * The short CLI argument name indicating the proxy url.
    + 
          *
     509   - 
              */
    + 
          * @return the database driver name if specified; otherwise null is returned
     510   - 
             public static final String PROXY_URL_SHORT = "u";
    + 
          */
     511   - 
             /**
    -  512   - 
              * The CLI argument name indicating the proxy url.
    + 
         public String getDatabaseDriverName() {
    +  512  0 
             return line.getOptionValue(ArgumentName.DB_DRIVER);
     513   - 
              */
    + 
         }
     514   - 
             public static final String PROXY_URL = "proxyurl";
    + 
     
     515   - 
             /**
    + 
         /**
     516   - 
              * The short CLI argument name indicating the proxy username.
    + 
          * Returns the database driver path if specified; otherwise null is returned.
     517   - 
              */
    + 
          *
     518   - 
             public static final String PROXY_USERNAME_SHORT = "pu";
    + 
          * @return the database driver name if specified; otherwise null is returned
     519   - 
             /**
    + 
          */
     520   - 
              * The CLI argument name indicating the proxy username.
    -  521   - 
              */
    + 
         public String getDatabaseDriverPath() {
    +  521  0 
             return line.getOptionValue(ArgumentName.DB_DRIVER_PATH);
     522   - 
             public static final String PROXY_USERNAME = "proxyuser";
    + 
         }
     523   - 
             /**
    + 
     
     524   - 
              * The short CLI argument name indicating the proxy password.
    + 
         /**
     525   - 
              */
    + 
          * Returns the database connection string if specified; otherwise null is returned.
     526   - 
             public static final String PROXY_PASSWORD_SHORT = "pp";
    + 
          *
     527   - 
             /**
    + 
          * @return the database connection string if specified; otherwise null is returned
     528   - 
              * The CLI argument name indicating the proxy password.
    + 
          */
     529   - 
              */
    -  530   - 
             public static final String PROXY_PASSWORD = "proxypass";
    + 
         public String getConnectionString() {
    +  530  0 
             return line.getOptionValue(ArgumentName.CONNECTION_STRING);
     531   - 
             /**
    + 
         }
     532   - 
              * The short CLI argument name indicating the connection timeout.
    + 
     
     533   - 
              */
    + 
         /**
     534   - 
             public static final String CONNECTION_TIMEOUT_SHORT = "c";
    + 
          * Returns the database database user name if specified; otherwise null is returned.
     535   - 
             /**
    + 
          *
     536   - 
              * The CLI argument name indicating the connection timeout.
    + 
          * @return the database database user name if specified; otherwise null is returned
     537   - 
              */
    + 
          */
     538   - 
             public static final String CONNECTION_TIMEOUT = "connectiontimeout";
    -  539   - 
             /**
    + 
         public String getDatabaseUser() {
    +  539  0 
             return line.getOptionValue(ArgumentName.DB_NAME);
     540   - 
              * The short CLI argument name for setting the location of an additional
    + 
         }
     541   - 
              * properties file.
    + 
     
     542   - 
              */
    + 
         /**
     543   - 
             public static final String PROP_SHORT = "p";
    + 
          * Returns the database database password if specified; otherwise null is returned.
     544   - 
             /**
    + 
          *
     545   - 
              * The CLI argument name for setting the location of an additional
    + 
          * @return the database database password if specified; otherwise null is returned
     546   - 
              * properties file.
    + 
          */
     547   - 
              */
    -  548   - 
             public static final String PROP = "propertyfile";
    + 
         public String getDatabasePassword() {
    +  548  0 
             return line.getOptionValue(ArgumentName.DB_PASSWORD);
     549   - 
             /**
    + 
         }
     550   - 
              * The CLI argument name for setting the location of the data directory.
    + 
     
     551   - 
              */
    + 
         /**
     552   - 
             public static final String DATA_DIRECTORY = "data";
    + 
          * A collection of static final strings that represent the possible command line arguments.
     553   - 
             /**
    -  554   - 
              * The short CLI argument name for setting the location of the data
    + 
          */
    +  554  18 
         public static class ArgumentName {
     555   - 
              * directory.
    + 
     
     556   - 
              */
    + 
             /**
     557   - 
             public static final String DATA_DIRECTORY_SHORT = "d";
    + 
              * The long CLI argument name specifying the directory/file to scan.
     558   - 
             /**
    + 
              */
     559   - 
              * The CLI argument name for setting the location of the data directory.
    + 
             public static final String SCAN = "scan";
     560   - 
              */
    + 
             /**
     561   - 
             public static final String VERBOSE_LOG = "log";
    + 
              * The short CLI argument name specifying the directory/file to scan.
     562   - 
             /**
    -  563   - 
              * The short CLI argument name for setting the location of the data
    -  564   - 
              * directory.
    -  565   
              */
    -  566   - 
             public static final String VERBOSE_LOG_SHORT = "l";
    -  567   +  563   + 
             public static final String SCAN_SHORT = "s";
    +  564   
             /**
    +  565   + 
              * The long CLI argument name specifying that the CPE/CVE/etc. data should not be automatically updated.
    +  566   + 
              */
    +  567   + 
             public static final String DISABLE_AUTO_UPDATE = "noupdate";
     568   - 
              * The CLI argument name for setting the location of the suppression
    + 
             /**
     569   - 
              * file.
    + 
              * The short CLI argument name specifying that the CPE/CVE/etc. data should not be automatically updated.
     570   
              */
     571   - 
             public static final String SUPPRESION_FILE = "suppression";
    + 
             public static final String DISABLE_AUTO_UPDATE_SHORT = "n";
     572   
             /**
     573   - 
              * The short CLI argument name for setting the location of the
    + 
              * The long CLI argument name specifying the directory to write the reports to.
     574   - 
              * suppression file.
    -  575   
              */
    +  575   + 
             public static final String OUT = "out";
     576   - 
             public static final String SUPPRESION_FILE_SHORT = "sf";
    + 
             /**
     577   - 
         }
    + 
              * The short CLI argument name specifying the directory to write the reports to.
     578   + 
              */
    +  579   + 
             public static final String OUT_SHORT = "o";
    +  580   + 
             /**
    +  581   + 
              * The long CLI argument name specifying the output format to write the reports to.
    +  582   + 
              */
    +  583   + 
             public static final String OUTPUT_FORMAT = "format";
    +  584   + 
             /**
    +  585   + 
              * The short CLI argument name specifying the output format to write the reports to.
    +  586   + 
              */
    +  587   + 
             public static final String OUTPUT_FORMAT_SHORT = "f";
    +  588   + 
             /**
    +  589   + 
              * The long CLI argument name specifying the name of the application to be scanned.
    +  590   + 
              */
    +  591   + 
             public static final String APP_NAME = "app";
    +  592   + 
             /**
    +  593   + 
              * The short CLI argument name specifying the name of the application to be scanned.
    +  594   + 
              */
    +  595   + 
             public static final String APP_NAME_SHORT = "a";
    +  596   + 
             /**
    +  597   + 
              * The long CLI argument name asking for help.
    +  598   + 
              */
    +  599   + 
             public static final String HELP = "help";
    +  600   + 
             /**
    +  601   + 
              * The long CLI argument name asking for advanced help.
    +  602   + 
              */
    +  603   + 
             public static final String ADVANCED_HELP = "advancedHelp";
    +  604   + 
             /**
    +  605   + 
              * The short CLI argument name asking for help.
    +  606   + 
              */
    +  607   + 
             public static final String HELP_SHORT = "h";
    +  608   + 
             /**
    +  609   + 
              * The long CLI argument name asking for the version.
    +  610   + 
              */
    +  611   + 
             public static final String VERSION_SHORT = "v";
    +  612   + 
             /**
    +  613   + 
              * The short CLI argument name asking for the version.
    +  614   + 
              */
    +  615   + 
             public static final String VERSION = "version";
    +  616   + 
             /**
    +  617   + 
              * The short CLI argument name indicating the proxy port.
    +  618   + 
              */
    +  619   + 
             public static final String PROXY_PORT_SHORT = "p";
    +  620   + 
             /**
    +  621   + 
              * The CLI argument name indicating the proxy port.
    +  622   + 
              */
    +  623   + 
             public static final String PROXY_PORT = "proxyport";
    +  624   + 
             /**
    +  625   + 
              * The short CLI argument name indicating the proxy url.
    +  626   + 
              */
    +  627   + 
             public static final String PROXY_URL_SHORT = "u";
    +  628   + 
             /**
    +  629   + 
              * The CLI argument name indicating the proxy url.
    +  630   + 
              */
    +  631   + 
             public static final String PROXY_URL = "proxyurl";
    +  632   + 
             /**
    +  633   + 
              * The CLI argument name indicating the proxy username.
    +  634   + 
              */
    +  635   + 
             public static final String PROXY_USERNAME = "proxyuser";
    +  636   + 
             /**
    +  637   + 
              * The CLI argument name indicating the proxy password.
    +  638   + 
              */
    +  639   + 
             public static final String PROXY_PASSWORD = "proxypass";
    +  640   + 
             /**
    +  641   + 
              * The short CLI argument name indicating the connection timeout.
    +  642   + 
              */
    +  643   + 
             public static final String CONNECTION_TIMEOUT_SHORT = "c";
    +  644   + 
             /**
    +  645   + 
              * The CLI argument name indicating the connection timeout.
    +  646   + 
              */
    +  647   + 
             public static final String CONNECTION_TIMEOUT = "connectiontimeout";
    +  648   + 
             /**
    +  649   + 
              * The short CLI argument name for setting the location of an additional properties file.
    +  650   + 
              */
    +  651   + 
             public static final String PROP_SHORT = "p";
    +  652   + 
             /**
    +  653   + 
              * The CLI argument name for setting the location of an additional properties file.
    +  654   + 
              */
    +  655   + 
             public static final String PROP = "propertyfile";
    +  656   + 
             /**
    +  657   + 
              * The CLI argument name for setting the location of the data directory.
    +  658   + 
              */
    +  659   + 
             public static final String DATA_DIRECTORY = "data";
    +  660   + 
             /**
    +  661   + 
              * The short CLI argument name for setting the location of the data directory.
    +  662   + 
              */
    +  663   + 
             public static final String DATA_DIRECTORY_SHORT = "d";
    +  664   + 
             /**
    +  665   + 
              * The CLI argument name for setting the location of the data directory.
    +  666   + 
              */
    +  667   + 
             public static final String VERBOSE_LOG = "log";
    +  668   + 
             /**
    +  669   + 
              * The short CLI argument name for setting the location of the data directory.
    +  670   + 
              */
    +  671   + 
             public static final String VERBOSE_LOG_SHORT = "l";
    +  672   + 
             /**
    +  673   + 
              * The CLI argument name for setting the location of the suppression file.
    +  674   + 
              */
    +  675   + 
             public static final String SUPPRESION_FILE = "suppression";
    +  676   + 
             /**
    +  677   + 
              * Disables the Nexus Analyzer.
    +  678   + 
              */
    +  679   + 
             public static final String DISABLE_NEXUS = "disableNexus";
    +  680   + 
             /**
    +  681   + 
              * The URL of the nexus server.
    +  682   + 
              */
    +  683   + 
             public static final String NEXUS_URL = "nexus";
    +  684   + 
             /**
    +  685   + 
              * The CLI argument name for setting the connection string.
    +  686   + 
              */
    +  687   + 
             public static final String CONNECTION_STRING = "connectionString";
    +  688   + 
             /**
    +  689   + 
              * The CLI argument name for setting the database user name.
    +  690   + 
              */
    +  691   + 
             public static final String DB_NAME = "dbUser";
    +  692   + 
             /**
    +  693   + 
              * The CLI argument name for setting the database password.
    +  694   + 
              */
    +  695   + 
             public static final String DB_PASSWORD = "dbPassword";
    +  696   + 
             /**
    +  697   + 
              * The CLI argument name for setting the database driver name.
    +  698   + 
              */
    +  699   + 
             public static final String DB_DRIVER = "dbDriverName";
    +  700   + 
             /**
    +  701   + 
              * The CLI argument name for setting the path to the database driver; in case it is not on the class path.
    +  702   + 
              */
    +  703   + 
             public static final String DB_DRIVER_PATH = "dbDriverPath";
    +  704   + 
         }
    +  705   
     }
    -
    Report generated by Cobertura 1.9.4.1 on 1/16/14 7:29 AM.
    +
    Report generated by Cobertura 1.9.4.1 on 1/26/14 11:13 AM.
    diff --git a/dependency-check-cli/cpd.html b/dependency-check-cli/cpd.html index a85e0011b..d8d58712e 100644 --- a/dependency-check-cli/cpd.html +++ b/dependency-check-cli/cpd.html @@ -1,13 +1,13 @@ - + dependency-check-cli - CPD Results @@ -54,7 +54,7 @@
  • - +
  • /
    • @@ -67,8 +67,8 @@ -
  • Last Published: 2014-01-16
  • |
    • -
  • Version: 1.0.8
    • +
  • Last Published: 2014-01-26
  • |
    • +
  • Version: 1.1.0
    • diff --git a/dependency-check-cli/dependency-updates-report.html b/dependency-check-cli/dependency-updates-report.html index 8cf427ea1..3c5f8f367 100644 --- a/dependency-check-cli/dependency-updates-report.html +++ b/dependency-check-cli/dependency-updates-report.html @@ -1,13 +1,13 @@ - + dependency-check-cli - Dependency Updates Report @@ -54,7 +54,7 @@
  • - +
  • /
    • @@ -67,8 +67,8 @@ -
  • Last Published: 2014-01-16
  • |
    • -
  • Version: 1.0.8
    • +
  • Last Published: 2014-01-26
  • |
    • +
  • Version: 1.1.0
    • @@ -293,7 +293,7 @@ org.owasp dependency-check-core -1.0.8 +1.1.0 compile jar @@ -378,7 +378,7 @@ dependency-check-core Current Version -1.0.8 +1.1.0 Scope compile diff --git a/dependency-check-cli/findbugs.html b/dependency-check-cli/findbugs.html index 416293d75..c32c41cd0 100644 --- a/dependency-check-cli/findbugs.html +++ b/dependency-check-cli/findbugs.html @@ -1,13 +1,13 @@ - + dependency-check-cli - FindBugs Bug Detector Report @@ -54,7 +54,7 @@
  • - +
  • /
    • @@ -67,8 +67,8 @@ -
  • Last Published: 2014-01-16
  • |
    • -
  • Version: 1.0.8
    • +
  • Last Published: 2014-01-26
  • |
    • +
  • Version: 1.1.0
    • diff --git a/dependency-check-cli/index.html b/dependency-check-cli/index.html index 8111543f4..4dd0841d0 100644 --- a/dependency-check-cli/index.html +++ b/dependency-check-cli/index.html @@ -1,13 +1,13 @@ - + dependency-check-cli - About @@ -54,7 +54,7 @@
  • - +
  • /
    • @@ -67,8 +67,8 @@ -
  • Last Published: 2014-01-16
  • |
    • -
  • Version: 1.0.8
    • +
  • Last Published: 2014-01-26
  • |
    • +
  • Version: 1.1.0
    • diff --git a/dependency-check-cli/installation.html b/dependency-check-cli/installation.html index a571f8e9a..c995c0acf 100644 --- a/dependency-check-cli/installation.html +++ b/dependency-check-cli/installation.html @@ -1,13 +1,13 @@ - + dependency-check-cli - Installation & Usage @@ -54,7 +54,7 @@
  • - +
  • /
    • @@ -67,8 +67,8 @@ -
  • Last Published: 2014-01-16
  • |
    • -
  • Version: 1.0.8
    • +
  • Last Published: 2014-01-26
  • |
    • +
  • Version: 1.1.0
    • @@ -139,23 +139,36 @@

    Installation & Usage

    -

    Downlod the dependency-check command line tool here. Extract the zip file to a location on your computer and put the ‘bin’ directory into the path environment variable. On *nix systems you will likely need to make the shell script executable:

    +

    Download the dependency-check command line tool here. Extract the zip file to a location on your computer and put the ‘bin’ directory into the path environment variable. On *nix systems you will likely need to make the shell script executable:

    $ chmod +777 dependency-check.sh

    To scan a folder on the system you can run:

    +
    +

    Windows

    + 
    dependency-check.bat --app "My App Name" --scan "c:\java\application\lib"
-
-dependency-check.sh --app "My App Name" --scan "/java/application/lib"
    -

    To view the command line arguments, see the arguments page, or you can run: dependency-check.bat –help

    +
    +
    +

    \*nix

    + +
    +
    dependency-check.sh --app "My App Name" --scan "/java/application/lib"
+
    +

    To view the command line arguments, see the arguments page, or you can run:

    +
    +

    Windows

    dependency-check.bat –help

    +
    +
    +

    \*nix

    dependency-check.sh --help
-
    +
    diff --git a/dependency-check-cli/license.html b/dependency-check-cli/license.html index b1471f6c6..d8a3eba1f 100644 --- a/dependency-check-cli/license.html +++ b/dependency-check-cli/license.html @@ -1,13 +1,13 @@ - + dependency-check-cli - Project License @@ -54,7 +54,7 @@
  • - +
  • /
    • @@ -67,8 +67,8 @@ -
  • Last Published: 2014-01-16
  • |
    • -
  • Version: 1.0.8
    • +
  • Last Published: 2014-01-26
  • |
    • +
  • Version: 1.1.0
    • @@ -165,682 +165,210 @@

    Project License

    -

    GNU General Public License version 3

    +

    The Apache Software License, Version 2.0

    -
                        GNU GENERAL PUBLIC LICENSE 
-                       Version 3, 29 June 2007
-
- Copyright (C) 2007 Free Software Foundation, Inc. <http://fsf.org/>
- Everyone is permitted to copy and distribute verbatim copies
- of this license document, but changing it is not allowed.
-
-                            Preamble
-
-  The GNU General Public License is a free, copyleft license for
-software and other kinds of works.
-
-  The licenses for most software and other practical works are designed
-to take away your freedom to share and change the works.  By contrast,
-the GNU General Public License is intended to guarantee your freedom to
-share and change all versions of a program--to make sure it remains free
-software for all its users.  We, the Free Software Foundation, use the
-GNU General Public License for most of our software; it applies also to
-any other work released this way by its authors.  You can apply it to
-your programs, too.
-
-  When we speak of free software, we are referring to freedom, not
-price.  Our General Public Licenses are designed to make sure that you
-have the freedom to distribute copies of free software (and charge for
-them if you wish), that you receive source code or can get it if you
-want it, that you can change the software or use pieces of it in new
-free programs, and that you know you can do these things.
-
-  To protect your rights, we need to prevent others from denying you
-these rights or asking you to surrender the rights.  Therefore, you have
-certain responsibilities if you distribute copies of the software, or if
-you modify it: responsibilities to respect the freedom of others.
-
-  For example, if you distribute copies of such a program, whether
-gratis or for a fee, you must pass on to the recipients the same
-freedoms that you received.  You must make sure that they, too, receive
-or can get the source code.  And you must show them these terms so they
-know their rights.
-
-  Developers that use the GNU GPL protect your rights with two steps:
-(1) assert copyright on the software, and (2) offer you this License
-giving you legal permission to copy, distribute and/or modify it.
-
-  For the developers' and authors' protection, the GPL clearly explains
-that there is no warranty for this free software.  For both users' and
-authors' sake, the GPL requires that modified versions be marked as
-changed, so that their problems will not be attributed erroneously to
-authors of previous versions.
-
-  Some devices are designed to deny users access to install or run
-modified versions of the software inside them, although the manufacturer
-can do so.  This is fundamentally incompatible with the aim of
-protecting users' freedom to change the software.  The systematic
-pattern of such abuse occurs in the area of products for individuals to
-use, which is precisely where it is most unacceptable.  Therefore, we
-have designed this version of the GPL to prohibit the practice for those
-products.  If such problems arise substantially in other domains, we
-stand ready to extend this provision to those domains in future versions
-of the GPL, as needed to protect the freedom of users.
-
-  Finally, every program is threatened constantly by software patents.
-States should not allow patents to restrict development and use of
-software on general-purpose computers, but in those that do, we wish to
-avoid the special danger that patents applied to a free program could
-make it effectively proprietary.  To prevent this, the GPL assures that
-patents cannot be used to render the program non-free.
-
-  The precise terms and conditions for copying, distribution and
-modification follow.
-
-                       TERMS AND CONDITIONS
-
-  0. Definitions.
-
-  "This License" refers to version 3 of the GNU General Public License.
-
-  "Copyright" also means copyright-like laws that apply to other kinds of
-works, such as semiconductor masks.
-
-  "The Program" refers to any copyrightable work licensed under this
-License.  Each licensee is addressed as "you".  "Licensees" and
-"recipients" may be individuals or organizations.
-
-  To "modify" a work means to copy from or adapt all or part of the work
-in a fashion requiring copyright permission, other than the making of an
-exact copy.  The resulting work is called a "modified version" of the
-earlier work or a work "based on" the earlier work.
-
-  A "covered work" means either the unmodified Program or a work based
-on the Program.
-
-  To "propagate" a work means to do anything with it that, without
-permission, would make you directly or secondarily liable for
-infringement under applicable copyright law, except executing it on a
-computer or modifying a private copy.  Propagation includes copying,
-distribution (with or without modification), making available to the
-public, and in some countries other activities as well.
-
-  To "convey" a work means any kind of propagation that enables other
-parties to make or receive copies.  Mere interaction with a user through
-a computer network, with no transfer of a copy, is not conveying.
-
-  An interactive user interface displays "Appropriate Legal Notices"
-to the extent that it includes a convenient and prominently visible
-feature that (1) displays an appropriate copyright notice, and (2)
-tells the user that there is no warranty for the work (except to the
-extent that warranties are provided), that licensees may convey the
-work under this License, and how to view a copy of this License.  If
-the interface presents a list of user commands or options, such as a
-menu, a prominent item in the list meets this criterion.
-
-  1. Source Code.
-
-  The "source code" for a work means the preferred form of the work
-for making modifications to it.  "Object code" means any non-source
-form of a work.
-
-  A "Standard Interface" means an interface that either is an official
-standard defined by a recognized standards body, or, in the case of
-interfaces specified for a particular programming language, one that
-is widely used among developers working in that language.
-
-  The "System Libraries" of an executable work include anything, other
-than the work as a whole, that (a) is included in the normal form of
-packaging a Major Component, but which is not part of that Major
-Component, and (b) serves only to enable use of the work with that
-Major Component, or to implement a Standard Interface for which an
-implementation is available to the public in source code form.  A
-"Major Component", in this context, means a major essential component
-(kernel, window system, and so on) of the specific operating system
-(if any) on which the executable work runs, or a compiler used to
-produce the work, or an object code interpreter used to run it.
-
-  The "Corresponding Source" for a work in object code form means all
-the source code needed to generate, install, and (for an executable
-work) run the object code and to modify the work, including scripts to
-control those activities.  However, it does not include the work's
-System Libraries, or general-purpose tools or generally available free
-programs which are used unmodified in performing those activities but
-which are not part of the work.  For example, Corresponding Source
-includes interface definition files associated with source files for
-the work, and the source code for shared libraries and dynamically
-linked subprograms that the work is specifically designed to require,
-such as by intimate data communication or control flow between those
-subprograms and other parts of the work.
-
-  The Corresponding Source need not include anything that users
-can regenerate automatically from other parts of the Corresponding
-Source.
-
-  The Corresponding Source for a work in source code form is that
-same work.
-
-  2. Basic Permissions.
-
-  All rights granted under this License are granted for the term of
-copyright on the Program, and are irrevocable provided the stated
-conditions are met.  This License explicitly affirms your unlimited
-permission to run the unmodified Program.  The output from running a
-covered work is covered by this License only if the output, given its
-content, constitutes a covered work.  This License acknowledges your
-rights of fair use or other equivalent, as provided by copyright law.
-
-  You may make, run and propagate covered works that you do not
-convey, without conditions so long as your license otherwise remains
-in force.  You may convey covered works to others for the sole purpose
-of having them make modifications exclusively for you, or provide you
-with facilities for running those works, provided that you comply with
-the terms of this License in conveying all material for which you do
-not control copyright.  Those thus making or running the covered works
-for you must do so exclusively on your behalf, under your direction
-and control, on terms that prohibit them from making any copies of
-your copyrighted material outside their relationship with you.
-
-  Conveying under any other circumstances is permitted solely under
-the conditions stated below.  Sublicensing is not allowed; section 10
-makes it unnecessary.
-
-  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
-
-  No covered work shall be deemed part of an effective technological
-measure under any applicable law fulfilling obligations under article
-11 of the WIPO copyright treaty adopted on 20 December 1996, or
-similar laws prohibiting or restricting circumvention of such
-measures.
-
-  When you convey a covered work, you waive any legal power to forbid
-circumvention of technological measures to the extent such circumvention
-is effected by exercising rights under this License with respect to
-the covered work, and you disclaim any intention to limit operation or
-modification of the work as a means of enforcing, against the work's
-users, your or third parties' legal rights to forbid circumvention of
-technological measures.
-
-  4. Conveying Verbatim Copies.
-
-  You may convey verbatim copies of the Program's source code as you
-receive it, in any medium, provided that you conspicuously and
-appropriately publish on each copy an appropriate copyright notice;
-keep intact all notices stating that this License and any
-non-permissive terms added in accord with section 7 apply to the code;
-keep intact all notices of the absence of any warranty; and give all
-recipients a copy of this License along with the Program.
-
-  You may charge any price or no price for each copy that you convey,
-and you may offer support or warranty protection for a fee.
-
-  5. Conveying Modified Source Versions.
-
-  You may convey a work based on the Program, or the modifications to
-produce it from the Program, in the form of source code under the
-terms of section 4, provided that you also meet all of these conditions:
-
-    a) The work must carry prominent notices stating that you modified
-    it, and giving a relevant date.
-
-    b) The work must carry prominent notices stating that it is
-    released under this License and any conditions added under section
-    7.  This requirement modifies the requirement in section 4 to
-    "keep intact all notices".
-
-    c) You must license the entire work, as a whole, under this
-    License to anyone who comes into possession of a copy.  This
-    License will therefore apply, along with any applicable section 7
-    additional terms, to the whole of the work, and all its parts,
-    regardless of how they are packaged.  This License gives no
-    permission to license the work in any other way, but it does not
-    invalidate such permission if you have separately received it.
-
-    d) If the work has interactive user interfaces, each must display
-    Appropriate Legal Notices; however, if the Program has interactive
-    interfaces that do not display Appropriate Legal Notices, your
-    work need not make them do so.
-
-  A compilation of a covered work with other separate and independent
-works, which are not by their nature extensions of the covered work,
-and which are not combined with it such as to form a larger program,
-in or on a volume of a storage or distribution medium, is called an
-"aggregate" if the compilation and its resulting copyright are not
-used to limit the access or legal rights of the compilation's users
-beyond what the individual works permit.  Inclusion of a covered work
-in an aggregate does not cause this License to apply to the other
-parts of the aggregate.
-
-  6. Conveying Non-Source Forms.
-
-  You may convey a covered work in object code form under the terms
-of sections 4 and 5, provided that you also convey the
-machine-readable Corresponding Source under the terms of this License,
-in one of these ways:
-
-    a) Convey the object code in, or embodied in, a physical product
-    (including a physical distribution medium), accompanied by the
-    Corresponding Source fixed on a durable physical medium
-    customarily used for software interchange.
-
-    b) Convey the object code in, or embodied in, a physical product
-    (including a physical distribution medium), accompanied by a
-    written offer, valid for at least three years and valid for as
-    long as you offer spare parts or customer support for that product
-    model, to give anyone who possesses the object code either (1) a
-    copy of the Corresponding Source for all the software in the
-    product that is covered by this License, on a durable physical
-    medium customarily used for software interchange, for a price no
-    more than your reasonable cost of physically performing this
-    conveying of source, or (2) access to copy the
-    Corresponding Source from a network server at no charge.
-
-    c) Convey individual copies of the object code with a copy of the
-    written offer to provide the Corresponding Source.  This
-    alternative is allowed only occasionally and noncommercially, and
-    only if you received the object code with such an offer, in accord
-    with subsection 6b.
-
-    d) Convey the object code by offering access from a designated
-    place (gratis or for a charge), and offer equivalent access to the
-    Corresponding Source in the same way through the same place at no
-    further charge.  You need not require recipients to copy the
-    Corresponding Source along with the object code.  If the place to
-    copy the object code is a network server, the Corresponding Source
-    may be on a different server (operated by you or a third party)
-    that supports equivalent copying facilities, provided you maintain
-    clear directions next to the object code saying where to find the
-    Corresponding Source.  Regardless of what server hosts the
-    Corresponding Source, you remain obligated to ensure that it is
-    available for as long as needed to satisfy these requirements.
-
-    e) Convey the object code using peer-to-peer transmission, provided
-    you inform other peers where the object code and Corresponding
-    Source of the work are being offered to the general public at no
-    charge under subsection 6d.
-
-  A separable portion of the object code, whose source code is excluded
-from the Corresponding Source as a System Library, need not be
-included in conveying the object code work.
-
-  A "User Product" is either (1) a "consumer product", which means any
-tangible personal property which is normally used for personal, family,
-or household purposes, or (2) anything designed or sold for incorporation
-into a dwelling.  In determining whether a product is a consumer product,
-doubtful cases shall be resolved in favor of coverage.  For a particular
-product received by a particular user, "normally used" refers to a
-typical or common use of that class of product, regardless of the status
-of the particular user or of the way in which the particular user
-actually uses, or expects or is expected to use, the product.  A product
-is a consumer product regardless of whether the product has substantial
-commercial, industrial or non-consumer uses, unless such uses represent
-the only significant mode of use of the product.
-
-  "Installation Information" for a User Product means any methods,
-procedures, authorization keys, or other information required to install
-and execute modified versions of a covered work in that User Product from
-a modified version of its Corresponding Source.  The information must
-suffice to ensure that the continued functioning of the modified object
-code is in no case prevented or interfered with solely because
-modification has been made.
-
-  If you convey an object code work under this section in, or with, or
-specifically for use in, a User Product, and the conveying occurs as
-part of a transaction in which the right of possession and use of the
-User Product is transferred to the recipient in perpetuity or for a
-fixed term (regardless of how the transaction is characterized), the
-Corresponding Source conveyed under this section must be accompanied
-by the Installation Information.  But this requirement does not apply
-if neither you nor any third party retains the ability to install
-modified object code on the User Product (for example, the work has
-been installed in ROM).
-
-  The requirement to provide Installation Information does not include a
-requirement to continue to provide support service, warranty, or updates
-for a work that has been modified or installed by the recipient, or for
-the User Product in which it has been modified or installed.  Access to a
-network may be denied when the modification itself materially and
-adversely affects the operation of the network or violates the rules and
-protocols for communication across the network.
-
-  Corresponding Source conveyed, and Installation Information provided,
-in accord with this section must be in a format that is publicly
-documented (and with an implementation available to the public in
-source code form), and must require no special password or key for
-unpacking, reading or copying.
-
-  7. Additional Terms.
-
-  "Additional permissions" are terms that supplement the terms of this
-License by making exceptions from one or more of its conditions.
-Additional permissions that are applicable to the entire Program shall
-be treated as though they were included in this License, to the extent
-that they are valid under applicable law.  If additional permissions
-apply only to part of the Program, that part may be used separately
-under those permissions, but the entire Program remains governed by
-this License without regard to the additional permissions.
-
-  When you convey a copy of a covered work, you may at your option
-remove any additional permissions from that copy, or from any part of
-it.  (Additional permissions may be written to require their own
-removal in certain cases when you modify the work.)  You may place
-additional permissions on material, added by you to a covered work,
-for which you have or can give appropriate copyright permission.
-
-  Notwithstanding any other provision of this License, for material you
-add to a covered work, you may (if authorized by the copyright holders of
-that material) supplement the terms of this License with terms:
-
-    a) Disclaiming warranty or limiting liability differently from the
-    terms of sections 15 and 16 of this License; or
-
-    b) Requiring preservation of specified reasonable legal notices or
-    author attributions in that material or in the Appropriate Legal
-    Notices displayed by works containing it; or
-
-    c) Prohibiting misrepresentation of the origin of that material, or
-    requiring that modified versions of such material be marked in
-    reasonable ways as different from the original version; or
-
-    d) Limiting the use for publicity purposes of names of licensors or
-    authors of the material; or
-
-    e) Declining to grant rights under trademark law for use of some
-    trade names, trademarks, or service marks; or
-
-    f) Requiring indemnification of licensors and authors of that
-    material by anyone who conveys the material (or modified versions of
-    it) with contractual assumptions of liability to the recipient, for
-    any liability that these contractual assumptions directly impose on
-    those licensors and authors.
-
-  All other non-permissive additional terms are considered "further
-restrictions" within the meaning of section 10.  If the Program as you
-received it, or any part of it, contains a notice stating that it is
-governed by this License along with a term that is a further
-restriction, you may remove that term.  If a license document contains
-a further restriction but permits relicensing or conveying under this
-License, you may add to a covered work material governed by the terms
-of that license document, provided that the further restriction does
-not survive such relicensing or conveying.
-
-  If you add terms to a covered work in accord with this section, you
-must place, in the relevant source files, a statement of the
-additional terms that apply to those files, or a notice indicating
-where to find the applicable terms.
-
-  Additional terms, permissive or non-permissive, may be stated in the
-form of a separately written license, or stated as exceptions;
-the above requirements apply either way.
-
-  8. Termination.
-
-  You may not propagate or modify a covered work except as expressly
-provided under this License.  Any attempt otherwise to propagate or
-modify it is void, and will automatically terminate your rights under
-this License (including any patent licenses granted under the third
-paragraph of section 11).
-
-  However, if you cease all violation of this License, then your
-license from a particular copyright holder is reinstated (a)
-provisionally, unless and until the copyright holder explicitly and
-finally terminates your license, and (b) permanently, if the copyright
-holder fails to notify you of the violation by some reasonable means
-prior to 60 days after the cessation.
-
-  Moreover, your license from a particular copyright holder is
-reinstated permanently if the copyright holder notifies you of the
-violation by some reasonable means, this is the first time you have
-received notice of violation of this License (for any work) from that
-copyright holder, and you cure the violation prior to 30 days after
-your receipt of the notice.
-
-  Termination of your rights under this section does not terminate the
-licenses of parties who have received copies or rights from you under
-this License.  If your rights have been terminated and not permanently
-reinstated, you do not qualify to receive new licenses for the same
-material under section 10.
-
-  9. Acceptance Not Required for Having Copies.
-
-  You are not required to accept this License in order to receive or
-run a copy of the Program.  Ancillary propagation of a covered work
-occurring solely as a consequence of using peer-to-peer transmission
-to receive a copy likewise does not require acceptance.  However,
-nothing other than this License grants you permission to propagate or
-modify any covered work.  These actions infringe copyright if you do
-not accept this License.  Therefore, by modifying or propagating a
-covered work, you indicate your acceptance of this License to do so.
-
-  10. Automatic Licensing of Downstream Recipients.
-
-  Each time you convey a covered work, the recipient automatically
-receives a license from the original licensors, to run, modify and
-propagate that work, subject to this License.  You are not responsible
-for enforcing compliance by third parties with this License.
-
-  An "entity transaction" is a transaction transferring control of an
-organization, or substantially all assets of one, or subdividing an
-organization, or merging organizations.  If propagation of a covered
-work results from an entity transaction, each party to that
-transaction who receives a copy of the work also receives whatever
-licenses to the work the party's predecessor in interest had or could
-give under the previous paragraph, plus a right to possession of the
-Corresponding Source of the work from the predecessor in interest, if
-the predecessor has it or can get it with reasonable efforts.
-
-  You may not impose any further restrictions on the exercise of the
-rights granted or affirmed under this License.  For example, you may
-not impose a license fee, royalty, or other charge for exercise of
-rights granted under this License, and you may not initiate litigation
-(including a cross-claim or counterclaim in a lawsuit) alleging that
-any patent claim is infringed by making, using, selling, offering for
-sale, or importing the Program or any portion of it.
-
-  11. Patents.
-
-  A "contributor" is a copyright holder who authorizes use under this
-License of the Program or a work on which the Program is based.  The
-work thus licensed is called the contributor's "contributor version".
-
-  A contributor's "essential patent claims" are all patent claims
-owned or controlled by the contributor, whether already acquired or
-hereafter acquired, that would be infringed by some manner, permitted
-by this License, of making, using, or selling its contributor version,
-but do not include claims that would be infringed only as a
-consequence of further modification of the contributor version.  For
-purposes of this definition, "control" includes the right to grant
-patent sublicenses in a manner consistent with the requirements of
-this License.
-
-  Each contributor grants you a non-exclusive, worldwide, royalty-free
-patent license under the contributor's essential patent claims, to
-make, use, sell, offer for sale, import and otherwise run, modify and
-propagate the contents of its contributor version.
-
-  In the following three paragraphs, a "patent license" is any express
-agreement or commitment, however denominated, not to enforce a patent
-(such as an express permission to practice a patent or covenant not to
-sue for patent infringement).  To "grant" such a patent license to a
-party means to make such an agreement or commitment not to enforce a
-patent against the party.
-
-  If you convey a covered work, knowingly relying on a patent license,
-and the Corresponding Source of the work is not available for anyone
-to copy, free of charge and under the terms of this License, through a
-publicly available network server or other readily accessible means,
-then you must either (1) cause the Corresponding Source to be so
-available, or (2) arrange to deprive yourself of the benefit of the
-patent license for this particular work, or (3) arrange, in a manner
-consistent with the requirements of this License, to extend the patent
-license to downstream recipients.  "Knowingly relying" means you have
-actual knowledge that, but for the patent license, your conveying the
-covered work in a country, or your recipient's use of the covered work
-in a country, would infringe one or more identifiable patents in that
-country that you have reason to believe are valid.
-
-  If, pursuant to or in connection with a single transaction or
-arrangement, you convey, or propagate by procuring conveyance of, a
-covered work, and grant a patent license to some of the parties
-receiving the covered work authorizing them to use, propagate, modify
-or convey a specific copy of the covered work, then the patent license
-you grant is automatically extended to all recipients of the covered
-work and works based on it.
-
-  A patent license is "discriminatory" if it does not include within
-the scope of its coverage, prohibits the exercise of, or is
-conditioned on the non-exercise of one or more of the rights that are
-specifically granted under this License.  You may not convey a covered
-work if you are a party to an arrangement with a third party that is
-in the business of distributing software, under which you make payment
-to the third party based on the extent of your activity of conveying
-the work, and under which the third party grants, to any of the
-parties who would receive the covered work from you, a discriminatory
-patent license (a) in connection with copies of the covered work
-conveyed by you (or copies made from those copies), or (b) primarily
-for and in connection with specific products or compilations that
-contain the covered work, unless you entered into that arrangement,
-or that patent license was granted, prior to 28 March 2007.
-
-  Nothing in this License shall be construed as excluding or limiting
-any implied license or other defenses to infringement that may
-otherwise be available to you under applicable patent law.
-
-  12. No Surrender of Others' Freedom.
-
-  If conditions are imposed on you (whether by court order, agreement or
-otherwise) that contradict the conditions of this License, they do not
-excuse you from the conditions of this License.  If you cannot convey a
-covered work so as to satisfy simultaneously your obligations under this
-License and any other pertinent obligations, then as a consequence you may
-not convey it at all.  For example, if you agree to terms that obligate you
-to collect a royalty for further conveying from those to whom you convey
-the Program, the only way you could satisfy both those terms and this
-License would be to refrain entirely from conveying the Program.
-
-  13. Use with the GNU Affero General Public License.
-
-  Notwithstanding any other provision of this License, you have
-permission to link or combine any covered work with a work licensed
-under version 3 of the GNU Affero General Public License into a single
-combined work, and to convey the resulting work.  The terms of this
-License will continue to apply to the part which is the covered work,
-but the special requirements of the GNU Affero General Public License,
-section 13, concerning interaction through a network will apply to the
-combination as such.
-
-  14. Revised Versions of this License.
-
-  The Free Software Foundation may publish revised and/or new versions of
-the GNU General Public License from time to time.  Such new versions will
-be similar in spirit to the present version, but may differ in detail to
-address new problems or concerns.
-
-  Each version is given a distinguishing version number.  If the
-Program specifies that a certain numbered version of the GNU General
-Public License "or any later version" applies to it, you have the
-option of following the terms and conditions either of that numbered
-version or of any later version published by the Free Software
-Foundation.  If the Program does not specify a version number of the
-GNU General Public License, you may choose any version ever published
-by the Free Software Foundation.
-
-  If the Program specifies that a proxy can decide which future
-versions of the GNU General Public License can be used, that proxy's
-public statement of acceptance of a version permanently authorizes you
-to choose that version for the Program.
-
-  Later license versions may give you additional or different
-permissions.  However, no additional obligations are imposed on any
-author or copyright holder as a result of your choosing to follow a
-later version.
-
-  15. Disclaimer of Warranty.
-
-  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
-APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
-HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
-OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
-THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
-PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
-IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
-ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
-
-  16. Limitation of Liability.
-
-  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
-WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
-THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
-GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
-USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
-DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
-PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
-EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
-SUCH DAMAGES.
-
-  17. Interpretation of Sections 15 and 16.
-
-  If the disclaimer of warranty and limitation of liability provided
-above cannot be given local legal effect according to their terms,
-reviewing courts shall apply local law that most closely approximates
-an absolute waiver of all civil liability in connection with the
-Program, unless a warranty or assumption of liability accompanies a
-copy of the Program in return for a fee.
-
-                     END OF TERMS AND CONDITIONS
-
-            How to Apply These Terms to Your New Programs
-
-  If you develop a new program, and you want it to be of the greatest
-possible use to the public, the best way to achieve this is to make it
-free software which everyone can redistribute and change under these terms.
-
-  To do so, attach the following notices to the program.  It is safest
-to attach them to the start of each source file to most effectively
-state the exclusion of warranty; and each file should have at least
-the "copyright" line and a pointer to where the full notice is found.
-
-    <one line to give the program's name and a brief idea of what it does.>
-    Copyright (C) <year>  <name of author>
-
-    This program is free software: you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-    the Free Software Foundation, either version 3 of the License, or
-    (at your option) any later version.
-
-    This program is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-    GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-Also add information on how to contact you by electronic and paper mail.
-
-  If the program does terminal interaction, make it output a short
-notice like this when it starts in an interactive mode:
-
-    <program>  Copyright (C) <year>  <name of author>
-    This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
-    This is free software, and you are welcome to redistribute it
-    under certain conditions; type `show c' for details.
-
-The hypothetical commands `show w' and `show c' should show the appropriate
-parts of the General Public License.  Of course, your program's commands
-might be different; for a GUI interface, you would use an "about box".
-
-  You should also get your employer (if you work as a programmer) or school,
-if any, to sign a "copyright disclaimer" for the program, if necessary.
-For more information on this, and how to apply and follow the GNU GPL, see
-<http://www.gnu.org/licenses/>.
-
-  The GNU General Public License does not permit incorporating your program
-into proprietary programs.  If your program is a subroutine library, you
-may consider it more useful to permit linking proprietary applications with
-the library.  If this is what you want to do, use the GNU Lesser General
-Public License instead of this License.  But first, please read
-<http://www.gnu.org/philosophy/why-not-lgpl.html>.
+
    +                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
    diff --git a/dependency-check-cli/plugin-updates-report.html b/dependency-check-cli/plugin-updates-report.html index 10d4f6970..9b03b7ebd 100644 --- a/dependency-check-cli/plugin-updates-report.html +++ b/dependency-check-cli/plugin-updates-report.html @@ -1,13 +1,13 @@ - + dependency-check-cli - Plugin Updates Report @@ -54,7 +54,7 @@
  • - +
  • /
    • @@ -67,8 +67,8 @@ -
  • Last Published: 2014-01-16
  • |
    • -
  • Version: 1.0.8
    • +
  • Last Published: 2014-01-26
  • |
    • +
  • Version: 1.1.0
    • diff --git a/dependency-check-cli/pmd.html b/dependency-check-cli/pmd.html index ee8f1c288..1901d05db 100644 --- a/dependency-check-cli/pmd.html +++ b/dependency-check-cli/pmd.html @@ -1,13 +1,13 @@ - + dependency-check-cli - PMD Results @@ -54,7 +54,7 @@
  • - +
  • /
    • @@ -67,8 +67,8 @@ -
  • Last Published: 2014-01-16
  • |
    • -
  • Version: 1.0.8
    • +
  • Last Published: 2014-01-26
  • |
    • +
  • Version: 1.1.0
    • @@ -236,16 +236,19 @@ Line Useless parentheses. -245 +295 Useless parentheses. -254 +304 Useless parentheses. -263 +313 Useless parentheses. -426 +322 + +Useless parentheses. +503 diff --git a/dependency-check-cli/project-info.html b/dependency-check-cli/project-info.html index 99236f2bb..52b1313dc 100644 --- a/dependency-check-cli/project-info.html +++ b/dependency-check-cli/project-info.html @@ -1,13 +1,13 @@ - + dependency-check-cli - Project Information @@ -54,7 +54,7 @@
  • - +
  • /
    • @@ -67,8 +67,8 @@ -
  • Last Published: 2014-01-16
  • |
    • -
  • Version: 1.0.8
    • +
  • Last Published: 2014-01-26
  • |
    • +
  • Version: 1.1.0
    • diff --git a/dependency-check-cli/project-reports.html b/dependency-check-cli/project-reports.html index 564e03a59..6ec8edf52 100644 --- a/dependency-check-cli/project-reports.html +++ b/dependency-check-cli/project-reports.html @@ -1,13 +1,13 @@ - + dependency-check-cli - Generated Reports @@ -54,7 +54,7 @@
  • - +
  • /
    • @@ -67,8 +67,8 @@ -
  • Last Published: 2014-01-16
  • |
    • -
  • Version: 1.0.8
    • +
  • Last Published: 2014-01-26
  • |
    • +
  • Version: 1.1.0
    • diff --git a/dependency-check-cli/project-summary.html b/dependency-check-cli/project-summary.html index c1651e098..5c5419475 100644 --- a/dependency-check-cli/project-summary.html +++ b/dependency-check-cli/project-summary.html @@ -1,13 +1,13 @@ - + dependency-check-cli - Project Summary @@ -54,7 +54,7 @@
  • - +
  • /
    • @@ -67,8 +67,8 @@ -
  • Last Published: 2014-01-16
  • |
    • -
  • Version: 1.0.8
    • +
  • Last Published: 2014-01-26
  • |
    • +
  • Version: 1.1.0
    • @@ -203,7 +203,7 @@ dependency-check-cli Version -1.0.8 +1.1.0 Type jar diff --git a/dependency-check-cli/surefire-report.html b/dependency-check-cli/surefire-report.html index d9edfe331..ef3e7228e 100644 --- a/dependency-check-cli/surefire-report.html +++ b/dependency-check-cli/surefire-report.html @@ -1,13 +1,13 @@ - + dependency-check-cli - Surefire Report @@ -54,7 +54,7 @@
  • - +
  • /
    • @@ -67,8 +67,8 @@ -
  • Last Published: 2014-01-16
  • |
    • -
  • Version: 1.0.8
    • +
  • Last Published: 2014-01-26
  • |
    • +
  • Version: 1.1.0
    • @@ -259,7 +259,7 @@ function toggleDisplay(elementId) { 0 0 100% -0.055
    +0.065

    Note: failures are anticipated and checked for with assertions while errors are unanticipated.


    Package List

    @@ -280,7 +280,7 @@ function toggleDisplay(elementId) { 0 0 100% -0.055
    +0.065

    Note: package statistics are not computed recursively, they only sum up all of its testsuites numbers.

    org.owasp.dependencycheck.cli

    @@ -302,7 +302,7 @@ function toggleDisplay(elementId) { 0 0 100% -0.055

    +0.065

    Test Cases

    [Summary] [Package List] [Test Cases]

    @@ -312,15 +312,15 @@ function toggleDisplay(elementId) { testParse_printHelp -0.049 +0.06 testParse_printVersionInfo -0 +0.001 testParse_help -0 +0.001 testParse_scan @@ -340,11 +340,11 @@ function toggleDisplay(elementId) { testParse_scan_unknownFile -0.001 +0 testParse_scan_withFileExists -0.002

    +0
    diff --git a/dependency-check-cli/taglist.html b/dependency-check-cli/taglist.html index bbe12807d..1f6e4c738 100644 --- a/dependency-check-cli/taglist.html +++ b/dependency-check-cli/taglist.html @@ -1,13 +1,13 @@ - + dependency-check-cli - Tag List report @@ -54,7 +54,7 @@
  • - +
  • /
    • @@ -67,8 +67,8 @@ -
  • Last Published: 2014-01-16
  • |
    • -
  • Version: 1.0.8
    • +
  • Last Published: 2014-01-26
  • |
    • +
  • Version: 1.1.0
    • diff --git a/dependency-check-cli/xref-test/index.html b/dependency-check-cli/xref-test/index.html index 62faf075a..5d21f8fed 100644 --- a/dependency-check-cli/xref-test/index.html +++ b/dependency-check-cli/xref-test/index.html @@ -4,7 +4,7 @@ - Dependency-Check Command Line 1.0.8 Reference + Dependency-Check Command Line 1.1.0 Reference diff --git a/dependency-check-cli/xref-test/org/owasp/dependencycheck/cli/CliParserTest.html b/dependency-check-cli/xref-test/org/owasp/dependencycheck/cli/CliParserTest.html index cc82cab7d..e5982026e 100644 --- a/dependency-check-cli/xref-test/org/owasp/dependencycheck/cli/CliParserTest.html +++ b/dependency-check-cli/xref-test/org/owasp/dependencycheck/cli/CliParserTest.html @@ -9,274 +9,272 @@ 1 /* 2 * This file is part of Dependency-Check. 3 * -4 * Dependency-Check is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-Check is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * Dependency-Check. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. -18 */ -19 package org.owasp.dependencycheck.cli; -20 -21 import org.owasp.dependencycheck.cli.CliParser; -22 import java.io.ByteArrayOutputStream; -23 import java.io.File; -24 import java.io.FileNotFoundException; -25 import java.io.IOException; -26 import java.io.PrintStream; -27 import org.apache.commons.cli.ParseException; -28 import org.junit.After; -29 import org.junit.AfterClass; -30 import org.junit.Assert; -31 import org.junit.Before; -32 import org.junit.BeforeClass; -33 import org.junit.Test; -34 -35 /** -36 * -37 * @author Jeremy Long <jeremy.long@owasp.org> -38 */ -39 public class CliParserTest { -40 -41 @BeforeClass -42 public static void setUpClass() throws Exception { -43 } -44 -45 @AfterClass -46 public static void tearDownClass() throws Exception { -47 } -48 -49 @Before -50 public void setUp() throws Exception { -51 } -52 -53 @After -54 public void tearDown() throws Exception { -55 } -56 -57 /** -58 * Test of parse method, of class CliParser. -59 * -60 * @throws Exception thrown when an exception occurs. -61 */ -62 @Test -63 public void testParse() throws Exception { -64 -65 String[] args = {}; -66 PrintStream out = System.out; -67 -68 ByteArrayOutputStream baos = new ByteArrayOutputStream(); -69 System.setOut(new PrintStream(baos)); -70 -71 CliParser instance = new CliParser(); -72 instance.parse(args); -73 -74 Assert.assertFalse(instance.isGetVersion()); -75 Assert.assertFalse(instance.isGetHelp()); -76 Assert.assertFalse(instance.isRunScan()); -77 } -78 -79 /** -80 * Test of parse method with help arg, of class CliParser. -81 * -82 * @throws Exception thrown when an exception occurs. -83 */ -84 @Test -85 public void testParse_help() throws Exception { -86 -87 String[] args = {"-help"}; -88 PrintStream out = System.out; -89 -90 CliParser instance = new CliParser(); -91 instance.parse(args); -92 -93 Assert.assertFalse(instance.isGetVersion()); -94 Assert.assertTrue(instance.isGetHelp()); -95 Assert.assertFalse(instance.isRunScan()); -96 } -97 -98 /** -99 * Test of parse method with version arg, of class CliParser. -100 * -101 * @throws Exception thrown when an exception occurs. -102 */ -103 @Test -104 public void testParse_version() throws Exception { +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. +17 */ +18 package org.owasp.dependencycheck.cli; +19 +20 import java.io.ByteArrayOutputStream; +21 import java.io.File; +22 import java.io.FileNotFoundException; +23 import java.io.IOException; +24 import java.io.PrintStream; +25 import org.apache.commons.cli.ParseException; +26 import org.junit.After; +27 import org.junit.AfterClass; +28 import org.junit.Assert; +29 import org.junit.Before; +30 import org.junit.BeforeClass; +31 import org.junit.Test; +32 +33 /** +34 * +35 * @author Jeremy Long <jeremy.long@owasp.org> +36 */ +37 public class CliParserTest { +38 +39 @BeforeClass +40 public static void setUpClass() throws Exception { +41 } +42 +43 @AfterClass +44 public static void tearDownClass() throws Exception { +45 } +46 +47 @Before +48 public void setUp() throws Exception { +49 } +50 +51 @After +52 public void tearDown() throws Exception { +53 } +54 +55 /** +56 * Test of parse method, of class CliParser. +57 * +58 * @throws Exception thrown when an exception occurs. +59 */ +60 @Test +61 public void testParse() throws Exception { +62 +63 String[] args = {}; +64 PrintStream out = System.out; +65 +66 ByteArrayOutputStream baos = new ByteArrayOutputStream(); +67 System.setOut(new PrintStream(baos)); +68 +69 CliParser instance = new CliParser(); +70 instance.parse(args); +71 +72 Assert.assertFalse(instance.isGetVersion()); +73 Assert.assertFalse(instance.isGetHelp()); +74 Assert.assertFalse(instance.isRunScan()); +75 } +76 +77 /** +78 * Test of parse method with help arg, of class CliParser. +79 * +80 * @throws Exception thrown when an exception occurs. +81 */ +82 @Test +83 public void testParse_help() throws Exception { +84 +85 String[] args = {"-help"}; +86 PrintStream out = System.out; +87 +88 CliParser instance = new CliParser(); +89 instance.parse(args); +90 +91 Assert.assertFalse(instance.isGetVersion()); +92 Assert.assertTrue(instance.isGetHelp()); +93 Assert.assertFalse(instance.isRunScan()); +94 } +95 +96 /** +97 * Test of parse method with version arg, of class CliParser. +98 * +99 * @throws Exception thrown when an exception occurs. +100 */ +101 @Test +102 public void testParse_version() throws Exception { +103 +104 String[] args = {"-version"}; 105 -106 String[] args = {"-version"}; -107 -108 CliParser instance = new CliParser(); -109 instance.parse(args); -110 Assert.assertTrue(instance.isGetVersion()); -111 Assert.assertFalse(instance.isGetHelp()); -112 Assert.assertFalse(instance.isRunScan()); +106 CliParser instance = new CliParser(); +107 instance.parse(args); +108 Assert.assertTrue(instance.isGetVersion()); +109 Assert.assertFalse(instance.isGetHelp()); +110 Assert.assertFalse(instance.isRunScan()); +111 +112 } 113 -114 } -115 -116 /** -117 * Test of parse method with jar and cpe args, of class CliParser. -118 * -119 * @throws Exception thrown when an exception occurs. -120 */ -121 @Test -122 public void testParse_unknown() throws Exception { +114 /** +115 * Test of parse method with jar and cpe args, of class CliParser. +116 * +117 * @throws Exception thrown when an exception occurs. +118 */ +119 @Test +120 public void testParse_unknown() throws Exception { +121 +122 String[] args = {"-unknown"}; 123 -124 String[] args = {"-unknown"}; -125 -126 PrintStream out = System.out; -127 PrintStream err = System.err; -128 ByteArrayOutputStream baos_out = new ByteArrayOutputStream(); -129 ByteArrayOutputStream baos_err = new ByteArrayOutputStream(); -130 System.setOut(new PrintStream(baos_out)); -131 System.setErr(new PrintStream(baos_err)); +124 PrintStream out = System.out; +125 PrintStream err = System.err; +126 ByteArrayOutputStream baos_out = new ByteArrayOutputStream(); +127 ByteArrayOutputStream baos_err = new ByteArrayOutputStream(); +128 System.setOut(new PrintStream(baos_out)); +129 System.setErr(new PrintStream(baos_err)); +130 +131 CliParser instance = new CliParser(); 132 -133 CliParser instance = new CliParser(); -134 -135 try { -136 instance.parse(args); -137 } catch (ParseException ex) { -138 Assert.assertTrue(ex.getMessage().contains("Unrecognized option")); -139 } -140 Assert.assertFalse(instance.isGetVersion()); -141 Assert.assertFalse(instance.isGetHelp()); -142 Assert.assertFalse(instance.isRunScan()); -143 } -144 -145 /** -146 * Test of parse method with scan arg, of class CliParser. -147 * -148 * @throws Exception thrown when an exception occurs. -149 */ -150 @Test -151 public void testParse_scan() throws Exception { +133 try { +134 instance.parse(args); +135 } catch (ParseException ex) { +136 Assert.assertTrue(ex.getMessage().contains("Unrecognized option")); +137 } +138 Assert.assertFalse(instance.isGetVersion()); +139 Assert.assertFalse(instance.isGetHelp()); +140 Assert.assertFalse(instance.isRunScan()); +141 } +142 +143 /** +144 * Test of parse method with scan arg, of class CliParser. +145 * +146 * @throws Exception thrown when an exception occurs. +147 */ +148 @Test +149 public void testParse_scan() throws Exception { +150 +151 String[] args = {"-scan"}; 152 -153 String[] args = {"-scan"}; +153 CliParser instance = new CliParser(); 154 -155 CliParser instance = new CliParser(); -156 -157 try { -158 instance.parse(args); -159 } catch (ParseException ex) { -160 Assert.assertTrue(ex.getMessage().contains("Missing argument")); -161 } -162 -163 Assert.assertFalse(instance.isGetVersion()); -164 Assert.assertFalse(instance.isGetHelp()); -165 Assert.assertFalse(instance.isRunScan()); -166 } -167 -168 /** -169 * Test of parse method with jar arg, of class CliParser. -170 * -171 * @throws Exception thrown when an exception occurs. -172 */ -173 @Test -174 public void testParse_scan_unknownFile() throws Exception { +155 try { +156 instance.parse(args); +157 } catch (ParseException ex) { +158 Assert.assertTrue(ex.getMessage().contains("Missing argument")); +159 } +160 +161 Assert.assertFalse(instance.isGetVersion()); +162 Assert.assertFalse(instance.isGetHelp()); +163 Assert.assertFalse(instance.isRunScan()); +164 } +165 +166 /** +167 * Test of parse method with jar arg, of class CliParser. +168 * +169 * @throws Exception thrown when an exception occurs. +170 */ +171 @Test +172 public void testParse_scan_unknownFile() throws Exception { +173 +174 String[] args = {"-scan", "jar.that.does.not.exist", "-app", "test"}; 175 -176 String[] args = {"-scan", "jar.that.does.not.exist", "-app", "test"}; -177 -178 CliParser instance = new CliParser(); -179 try { -180 instance.parse(args); -181 } catch (FileNotFoundException ex) { -182 Assert.assertTrue(ex.getMessage().contains("Invalid 'scan' argument")); -183 } -184 -185 Assert.assertFalse(instance.isGetVersion()); -186 Assert.assertFalse(instance.isGetHelp()); -187 Assert.assertFalse(instance.isRunScan()); -188 } -189 -190 /** -191 * Test of parse method with jar arg, of class CliParser. -192 * -193 * @throws Exception thrown when an exception occurs. -194 */ -195 @Test -196 public void testParse_scan_withFileExists() throws Exception { -197 File path = new File(this.getClass().getClassLoader().getResource("checkSumTest.file").getPath()); -198 String[] args = {"-scan", path.getCanonicalPath(), "-out", "./", "-app", "test"}; -199 -200 CliParser instance = new CliParser(); -201 instance.parse(args); +176 CliParser instance = new CliParser(); +177 try { +178 instance.parse(args); +179 } catch (FileNotFoundException ex) { +180 Assert.assertTrue(ex.getMessage().contains("Invalid 'scan' argument")); +181 } +182 +183 Assert.assertFalse(instance.isGetVersion()); +184 Assert.assertFalse(instance.isGetHelp()); +185 Assert.assertFalse(instance.isRunScan()); +186 } +187 +188 /** +189 * Test of parse method with jar arg, of class CliParser. +190 * +191 * @throws Exception thrown when an exception occurs. +192 */ +193 @Test +194 public void testParse_scan_withFileExists() throws Exception { +195 File path = new File(this.getClass().getClassLoader().getResource("checkSumTest.file").getPath()); +196 String[] args = {"-scan", path.getCanonicalPath(), "-out", "./", "-app", "test"}; +197 +198 CliParser instance = new CliParser(); +199 instance.parse(args); +200 +201 Assert.assertEquals(path.getCanonicalPath(), instance.getScanFiles()[0]); 202 -203 Assert.assertEquals(path.getCanonicalPath(), instance.getScanFiles()[0]); -204 -205 Assert.assertFalse(instance.isGetVersion()); -206 Assert.assertFalse(instance.isGetHelp()); -207 Assert.assertTrue(instance.isRunScan()); -208 } -209 -210 /** -211 * Test of printVersionInfo, of class CliParser. -212 * -213 * @throws Exception thrown when an exception occurs. -214 */ -215 @Test -216 public void testParse_printVersionInfo() throws Exception { -217 -218 PrintStream out = System.out; -219 ByteArrayOutputStream baos = new ByteArrayOutputStream(); -220 System.setOut(new PrintStream(baos)); -221 -222 CliParser instance = new CliParser(); -223 instance.printVersionInfo(); -224 try { -225 baos.flush(); -226 String text = (new String(baos.toByteArray())).toLowerCase(); -227 String[] lines = text.split(System.getProperty("line.separator")); -228 Assert.assertEquals(1, lines.length); -229 Assert.assertTrue(text.contains("version")); -230 Assert.assertTrue(!text.contains("unknown")); -231 } catch (IOException ex) { -232 System.setOut(out); -233 Assert.fail("CliParser.printVersionInfo did not write anything to system.out."); -234 } finally { -235 System.setOut(out); -236 } -237 } -238 -239 /** -240 * Test of printHelp, of class CliParser. -241 * -242 * @throws Exception thrown when an exception occurs. -243 */ -244 @Test -245 public void testParse_printHelp() throws Exception { -246 -247 PrintStream out = System.out; -248 ByteArrayOutputStream baos = new ByteArrayOutputStream(); -249 System.setOut(new PrintStream(baos)); -250 -251 CliParser instance = new CliParser(); -252 String[] args = {"-h"}; -253 instance.parse(args); -254 instance.printHelp(); -255 args[0] = "-ah"; -256 instance.parse(args); -257 instance.printHelp(); -258 try { -259 baos.flush(); -260 String text = (new String(baos.toByteArray())); -261 String[] lines = text.split(System.getProperty("line.separator")); -262 Assert.assertTrue(lines[0].startsWith("usage: ")); -263 Assert.assertTrue((lines.length > 2)); -264 } catch (IOException ex) { -265 System.setOut(out); -266 Assert.fail("CliParser.printVersionInfo did not write anything to system.out."); -267 } finally { -268 System.setOut(out); -269 } -270 } -271 } +203 Assert.assertFalse(instance.isGetVersion()); +204 Assert.assertFalse(instance.isGetHelp()); +205 Assert.assertTrue(instance.isRunScan()); +206 } +207 +208 /** +209 * Test of printVersionInfo, of class CliParser. +210 * +211 * @throws Exception thrown when an exception occurs. +212 */ +213 @Test +214 public void testParse_printVersionInfo() throws Exception { +215 +216 PrintStream out = System.out; +217 ByteArrayOutputStream baos = new ByteArrayOutputStream(); +218 System.setOut(new PrintStream(baos)); +219 +220 CliParser instance = new CliParser(); +221 instance.printVersionInfo(); +222 try { +223 baos.flush(); +224 String text = (new String(baos.toByteArray())).toLowerCase(); +225 String[] lines = text.split(System.getProperty("line.separator")); +226 Assert.assertEquals(1, lines.length); +227 Assert.assertTrue(text.contains("version")); +228 Assert.assertTrue(!text.contains("unknown")); +229 } catch (IOException ex) { +230 System.setOut(out); +231 Assert.fail("CliParser.printVersionInfo did not write anything to system.out."); +232 } finally { +233 System.setOut(out); +234 } +235 } +236 +237 /** +238 * Test of printHelp, of class CliParser. +239 * +240 * @throws Exception thrown when an exception occurs. +241 */ +242 @Test +243 public void testParse_printHelp() throws Exception { +244 +245 PrintStream out = System.out; +246 ByteArrayOutputStream baos = new ByteArrayOutputStream(); +247 System.setOut(new PrintStream(baos)); +248 +249 CliParser instance = new CliParser(); +250 String[] args = {"-h"}; +251 instance.parse(args); +252 instance.printHelp(); +253 args[0] = "-ah"; +254 instance.parse(args); +255 instance.printHelp(); +256 try { +257 baos.flush(); +258 String text = (new String(baos.toByteArray())); +259 String[] lines = text.split(System.getProperty("line.separator")); +260 Assert.assertTrue(lines[0].startsWith("usage: ")); +261 Assert.assertTrue((lines.length > 2)); +262 } catch (IOException ex) { +263 System.setOut(out); +264 Assert.fail("CliParser.printVersionInfo did not write anything to system.out."); +265 } finally { +266 System.setOut(out); +267 } +268 } +269 }
    diff --git a/dependency-check-cli/xref-test/org/owasp/dependencycheck/cli/package-frame.html b/dependency-check-cli/xref-test/org/owasp/dependencycheck/cli/package-frame.html index 31f9c0937..6d247dda1 100644 --- a/dependency-check-cli/xref-test/org/owasp/dependencycheck/cli/package-frame.html +++ b/dependency-check-cli/xref-test/org/owasp/dependencycheck/cli/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Command Line 1.0.8 Reference Package org.owasp.dependencycheck.cli + Dependency-Check Command Line 1.1.0 Reference Package org.owasp.dependencycheck.cli diff --git a/dependency-check-cli/xref-test/org/owasp/dependencycheck/cli/package-summary.html b/dependency-check-cli/xref-test/org/owasp/dependencycheck/cli/package-summary.html index 052a7616c..38782ff87 100644 --- a/dependency-check-cli/xref-test/org/owasp/dependencycheck/cli/package-summary.html +++ b/dependency-check-cli/xref-test/org/owasp/dependencycheck/cli/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Command Line 1.0.8 Reference Package org.owasp.dependencycheck.cli + Dependency-Check Command Line 1.1.0 Reference Package org.owasp.dependencycheck.cli diff --git a/dependency-check-cli/xref-test/overview-frame.html b/dependency-check-cli/xref-test/overview-frame.html index 3edaeb176..35d5b44ff 100644 --- a/dependency-check-cli/xref-test/overview-frame.html +++ b/dependency-check-cli/xref-test/overview-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Command Line 1.0.8 Reference + Dependency-Check Command Line 1.1.0 Reference diff --git a/dependency-check-cli/xref-test/overview-summary.html b/dependency-check-cli/xref-test/overview-summary.html index 574e43a62..aef2c2e8a 100644 --- a/dependency-check-cli/xref-test/overview-summary.html +++ b/dependency-check-cli/xref-test/overview-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Command Line 1.0.8 Reference + Dependency-Check Command Line 1.1.0 Reference @@ -24,7 +24,7 @@ -

    Dependency-Check Command Line 1.0.8 Reference

    +

    Dependency-Check Command Line 1.1.0 Reference

    diff --git a/dependency-check-cli/xref/index.html b/dependency-check-cli/xref/index.html index 62faf075a..5d21f8fed 100644 --- a/dependency-check-cli/xref/index.html +++ b/dependency-check-cli/xref/index.html @@ -4,7 +4,7 @@ - Dependency-Check Command Line 1.0.8 Reference + Dependency-Check Command Line 1.1.0 Reference diff --git a/dependency-check-cli/xref/org/owasp/dependencycheck/App.html b/dependency-check-cli/xref/org/owasp/dependencycheck/App.html index 2b0ab7f43..cad556ddd 100644 --- a/dependency-check-cli/xref/org/owasp/dependencycheck/App.html +++ b/dependency-check-cli/xref/org/owasp/dependencycheck/App.html @@ -9,208 +9,227 @@ 1/*2 * This file is part of dependency-check-cli.3 * -4 * Dependency-check-cli is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-cli is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-cli. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. -18 */ -19package org.owasp.dependencycheck; -20 -21import java.io.File; -22import java.io.FileNotFoundException; -23import java.io.IOException; -24import java.io.InputStream; -25import java.util.List; -26import java.util.logging.Level; -27import java.util.logging.Logger; -28import org.apache.commons.cli.ParseException; -29import org.owasp.dependencycheck.reporting.ReportGenerator; -30import org.owasp.dependencycheck.dependency.Dependency; -31import org.owasp.dependencycheck.cli.CliParser; -32import org.owasp.dependencycheck.utils.LogUtils; -33import org.owasp.dependencycheck.utils.Settings; -34 -35/* -36 * This file is part of App. -37 * -38 * App is free software: you can redistribute it and/or modify it under the -39 * terms of the GNU General Public License as published by the Free Software -40 * Foundation, either version 3 of the License, or (at your option) any later -41 * version. -42 * -43 * App is distributed in the hope that it will be useful, but WITHOUT ANY -44 * WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR -45 * A PARTICULAR PURPOSE. See the GNU General Public License for more details. -46 * -47 * You should have received a copy of the GNU General Public License along with -48 * App. If not, see http://www.gnu.org/licenses/. -49 * -50 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. -51 */ -52/** -53 * The command line interface for the DependencyCheck application. -54 * -55 * @author Jeremy Long <jeremy.long@owasp.org> -56 */ -57publicclassApp { +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. +17 */ +18package org.owasp.dependencycheck; +19 +20import java.io.File; +21import java.io.FileNotFoundException; +22import java.io.IOException; +23import java.io.InputStream; +24import java.util.List; +25import java.util.logging.Level; +26import java.util.logging.Logger; +27import org.apache.commons.cli.ParseException; +28import org.owasp.dependencycheck.cli.CliParser; +29import org.owasp.dependencycheck.data.nvdcve.CveDB; +30import org.owasp.dependencycheck.data.nvdcve.DatabaseException; +31import org.owasp.dependencycheck.data.nvdcve.DatabaseProperties; +32import org.owasp.dependencycheck.dependency.Dependency; +33import org.owasp.dependencycheck.reporting.ReportGenerator; +34import org.owasp.dependencycheck.utils.LogUtils; +35import org.owasp.dependencycheck.utils.Settings; +36 +37/** +38 * The command line interface for the DependencyCheck application. +39 * +40 * @author Jeremy Long <jeremy.long@owasp.org> +41 */ +42publicclassApp { +43 +44/** +45 * The location of the log properties configuration file. +46 */ +47privatestaticfinal String LOG_PROPERTIES_FILE = "log.properties"; +48 +49/** +50 * The main method for the application. +51 * +52 * @param args the command line arguments +53 */ +54publicstaticvoid main(String[] args) { +55finalApp app = newApp(); +56 app.run(args); +57 } 5859/** -60 * The location of the log properties configuration file. -61 */ -62privatestaticfinal String LOG_PROPERTIES_FILE = "log.properties"; -63 -64/** -65 * The main method for the application. -66 * -67 * @param args the command line arguments -68 */ -69publicstaticvoid main(String[] args) { -70finalApp app = newApp(); -71 app.run(args); -72 } -73 -74/** -75 * Main CLI entry-point into the application. -76 * -77 * @param args the command line arguments -78 */ -79publicvoid run(String[] args) { -80 -81finalCliParser cli = newCliParser(); -82try { -83 cli.parse(args); -84 } catch (FileNotFoundException ex) { -85 System.err.println(ex.getMessage()); -86 cli.printHelp(); -87return; -88 } catch (ParseException ex) { -89 System.err.println(ex.getMessage()); -90 cli.printHelp(); -91return; -92 } -93 -94final InputStream in = App.class.getClassLoader().getResourceAsStream(LOG_PROPERTIES_FILE); -95 LogUtils.prepareLogger(in, cli.getVerboseLog()); -96 -97if (cli.isGetVersion()) { -98 cli.printVersionInfo(); -99 } elseif (cli.isRunScan()) { -100 updateSettings(cli.isAutoUpdate(), cli.getConnectionTimeout(), cli.getProxyUrl(), -101 cli.getProxyPort(), cli.getProxyUsername(), cli.getProxyPassword(), -102 cli.getDataDirectory(), cli.getPropertiesFile(), cli.getSuppressionFile()); -103 runScan(cli.getReportDirectory(), cli.getReportFormat(), cli.getApplicationName(), cli.getScanFiles()); -104 } else { -105 cli.printHelp(); -106 } -107 } -108 -109/** -110 * Scans the specified directories and writes the dependency reports to the -111 * reportDirectory. -112 * -113 * @param reportDirectory the path to the directory where the reports will -114 * be written -115 * @param outputFormat the output format of the report -116 * @param applicationName the application name for the report -117 * @param files the files/directories to scan -118 */ -119privatevoid runScan(String reportDirectory, String outputFormat, String applicationName, String[] files) { -120final Engine scanner = new Engine(); -121 -122for (String file : files) { -123 scanner.scan(file); -124 } -125 -126 scanner.analyzeDependencies(); -127final List<Dependency> dependencies = scanner.getDependencies(); -128 -129final ReportGenerator report = new ReportGenerator(applicationName, dependencies, scanner.getAnalyzers()); -130try { -131 report.generateReports(reportDirectory, outputFormat); -132 } catch (IOException ex) { -133 Logger.getLogger(App.class.getName()).log(Level.SEVERE, "There was an IO error while attempting to generate the report."); -134 Logger.getLogger(App.class.getName()).log(Level.INFO, null, ex); -135 } catch (Exception ex) { -136 Logger.getLogger(App.class.getName()).log(Level.SEVERE, "There was an error while attempting to generate the report."); -137 Logger.getLogger(App.class.getName()).log(Level.INFO, null, ex); -138 } -139 } -140 -141/** -142 * Updates the global Settings. -143 * -144 * @param autoUpdate whether or not to update cached web data sources -145 * @param connectionTimeout the timeout to use when downloading resources -146 * (null or blank will use default) -147 * @param proxyUrl the proxy url (null or blank means no proxy will be used) -148 * @param proxyPort the proxy port (null or blank means no port will be -149 * used) -150 * @param proxyUser the proxy user name -151 * @param proxyPass the password for the proxy -152 * @param dataDirectory the directory to store/retrieve persistent data from -153 * @param propertiesFile the properties file to utilize -154 * @param suppressionFile the path to the suppression file -155 */ -156privatevoid updateSettings(boolean autoUpdate, String connectionTimeout, String proxyUrl, String proxyPort, -157 String proxyUser, String proxyPass, String dataDirectory, File propertiesFile, -158 String suppressionFile) { -159 -160if (propertiesFile != null) { -161try { -162 Settings.mergeProperties(propertiesFile); -163 } catch (FileNotFoundException ex) { -164final String msg = String.format("Unable to load properties file '%s'", propertiesFile.getPath()); -165 Logger.getLogger(App.class.getName()).log(Level.SEVERE, msg); -166 Logger.getLogger(App.class.getName()).log(Level.FINE, null, ex); -167 } catch (IOException ex) { -168final String msg = String.format("Unable to find properties file '%s'", propertiesFile.getPath()); -169 Logger.getLogger(App.class.getName()).log(Level.SEVERE, msg); -170 Logger.getLogger(App.class.getName()).log(Level.FINE, null, ex); -171 } -172 } -173if (dataDirectory != null) { -174 Settings.setString(Settings.KEYS.DATA_DIRECTORY, dataDirectory); -175 } elseif (System.getProperty("basedir") != null) { -176final File dataDir = new File(System.getProperty("basedir"), "data"); -177 Settings.setString(Settings.KEYS.DATA_DIRECTORY, dataDir.getAbsolutePath()); -178 } else { -179final File jarPath = new File(App.class.getProtectionDomain().getCodeSource().getLocation().getPath()); -180final File base = jarPath.getParentFile(); -181final String sub = Settings.getString(Settings.KEYS.DATA_DIRECTORY); -182final File dataDir = new File(base, sub); -183 Settings.setString(Settings.KEYS.DATA_DIRECTORY, dataDir.getAbsolutePath()); -184 } -185 Settings.setBoolean(Settings.KEYS.AUTO_UPDATE, autoUpdate); -186if (proxyUrl != null && !proxyUrl.isEmpty()) { -187 Settings.setString(Settings.KEYS.PROXY_URL, proxyUrl); -188 } -189if (proxyPort != null && !proxyPort.isEmpty()) { -190 Settings.setString(Settings.KEYS.PROXY_PORT, proxyPort); -191 } -192if (proxyUser != null && !proxyUser.isEmpty()) { -193 Settings.setString(Settings.KEYS.PROXY_USERNAME, proxyUser); -194 } -195if (proxyPass != null && !proxyPass.isEmpty()) { -196 Settings.setString(Settings.KEYS.PROXY_PASSWORD, proxyPass); -197 } -198if (connectionTimeout != null && !connectionTimeout.isEmpty()) { -199 Settings.setString(Settings.KEYS.CONNECTION_TIMEOUT, connectionTimeout); -200 } -201if (suppressionFile != null && !suppressionFile.isEmpty()) { -202 Settings.setString(Settings.KEYS.SUPPRESSION_FILE, suppressionFile); -203 } -204 } -205 } +60 * Main CLI entry-point into the application. +61 * +62 * @param args the command line arguments +63 */ +64publicvoid run(String[] args) { +65 +66finalCliParser cli = newCliParser(); +67try { +68 cli.parse(args); +69 } catch (FileNotFoundException ex) { +70 System.err.println(ex.getMessage()); +71 cli.printHelp(); +72return; +73 } catch (ParseException ex) { +74 System.err.println(ex.getMessage()); +75 cli.printHelp(); +76return; +77 } +78 +79final InputStream in = App.class.getClassLoader().getResourceAsStream(LOG_PROPERTIES_FILE); +80 LogUtils.prepareLogger(in, cli.getVerboseLog()); +81 +82if (cli.isGetVersion()) { +83 cli.printVersionInfo(); +84 } elseif (cli.isRunScan()) { +85 updateSettings(cli); +86 runScan(cli.getReportDirectory(), cli.getReportFormat(), cli.getApplicationName(), cli.getScanFiles()); +87 } else { +88 cli.printHelp(); +89 } +90 } +91 +92/** +93 * Scans the specified directories and writes the dependency reports to the reportDirectory. +94 * +95 * @param reportDirectory the path to the directory where the reports will be written +96 * @param outputFormat the output format of the report +97 * @param applicationName the application name for the report +98 * @param files the files/directories to scan +99 */ +100privatevoid runScan(String reportDirectory, String outputFormat, String applicationName, String[] files) { +101final Engine scanner = new Engine(); +102 +103for (String file : files) { +104 scanner.scan(file); +105 } +106 +107 scanner.analyzeDependencies(); +108final List<Dependency> dependencies = scanner.getDependencies(); +109 DatabaseProperties prop = null; +110 CveDB cve = null; +111try { +112 cve = new CveDB(); +113 cve.open(); +114 prop = cve.getDatabaseProperties(); +115 } catch (DatabaseException ex) { +116 Logger.getLogger(App.class.getName()).log(Level.FINE, "Unable to retrieve DB Properties", ex); +117 } finally { +118if (cve != null) { +119 cve.close(); +120 } +121 } +122final ReportGenerator report = new ReportGenerator(applicationName, dependencies, scanner.getAnalyzers(), prop); +123try { +124 report.generateReports(reportDirectory, outputFormat); +125 } catch (IOException ex) { +126 Logger.getLogger(App.class.getName()).log(Level.SEVERE, "There was an IO error while attempting to generate the report."); +127 Logger.getLogger(App.class.getName()).log(Level.INFO, null, ex); +128 } catch (Exception ex) { +129 Logger.getLogger(App.class.getName()).log(Level.SEVERE, "There was an error while attempting to generate the report."); +130 Logger.getLogger(App.class.getName()).log(Level.INFO, null, ex); +131 } +132 } +133 +134/** +135 * Updates the global Settings. +136 * +137 * @param cli a reference to the CLI Parser that contains the command line arguments used to set the corresponding +138 * settings in the core engine. +139 */ +140privatevoid updateSettings(CliParser cli) { +141 +142finalboolean autoUpdate = cli.isAutoUpdate(); +143final String connectionTimeout = cli.getConnectionTimeout(); +144final String proxyUrl = cli.getProxyUrl(); +145final String proxyPort = cli.getProxyPort(); +146final String proxyUser = cli.getProxyUsername(); +147final String proxyPass = cli.getProxyPassword(); +148final String dataDirectory = cli.getDataDirectory(); +149final File propertiesFile = cli.getPropertiesFile(); +150final String suppressionFile = cli.getSuppressionFile(); +151finalboolean nexusDisabled = cli.isNexusDisabled(); +152final String nexusUrl = cli.getNexusUrl(); +153final String databaseDriverName = cli.getDatabaseDriverName(); +154final String databaseDriverPath = cli.getDatabaseDriverPath(); +155final String connectionString = cli.getConnectionString(); +156final String databaseUser = cli.getDatabaseUser(); +157final String databasePassword = cli.getDatabasePassword(); +158 +159if (propertiesFile != null) { +160try { +161 Settings.mergeProperties(propertiesFile); +162 } catch (FileNotFoundException ex) { +163final String msg = String.format("Unable to load properties file '%s'", propertiesFile.getPath()); +164 Logger.getLogger(App.class.getName()).log(Level.SEVERE, msg); +165 Logger.getLogger(App.class.getName()).log(Level.FINE, null, ex); +166 } catch (IOException ex) { +167final String msg = String.format("Unable to find properties file '%s'", propertiesFile.getPath()); +168 Logger.getLogger(App.class.getName()).log(Level.SEVERE, msg); +169 Logger.getLogger(App.class.getName()).log(Level.FINE, null, ex); +170 } +171 } +172if (dataDirectory != null) { +173 Settings.setString(Settings.KEYS.DATA_DIRECTORY, dataDirectory); +174 } elseif (System.getProperty("basedir") != null) { +175final File dataDir = new File(System.getProperty("basedir"), "data"); +176 Settings.setString(Settings.KEYS.DATA_DIRECTORY, dataDir.getAbsolutePath()); +177 } else { +178final File jarPath = new File(App.class.getProtectionDomain().getCodeSource().getLocation().getPath()); +179final File base = jarPath.getParentFile(); +180final String sub = Settings.getString(Settings.KEYS.DATA_DIRECTORY); +181final File dataDir = new File(base, sub); +182 Settings.setString(Settings.KEYS.DATA_DIRECTORY, dataDir.getAbsolutePath()); +183 } +184 Settings.setBoolean(Settings.KEYS.AUTO_UPDATE, autoUpdate); +185if (proxyUrl != null && !proxyUrl.isEmpty()) { +186 Settings.setString(Settings.KEYS.PROXY_URL, proxyUrl); +187 } +188if (proxyPort != null && !proxyPort.isEmpty()) { +189 Settings.setString(Settings.KEYS.PROXY_PORT, proxyPort); +190 } +191if (proxyUser != null && !proxyUser.isEmpty()) { +192 Settings.setString(Settings.KEYS.PROXY_USERNAME, proxyUser); +193 } +194if (proxyPass != null && !proxyPass.isEmpty()) { +195 Settings.setString(Settings.KEYS.PROXY_PASSWORD, proxyPass); +196 } +197if (connectionTimeout != null && !connectionTimeout.isEmpty()) { +198 Settings.setString(Settings.KEYS.CONNECTION_TIMEOUT, connectionTimeout); +199 } +200if (suppressionFile != null && !suppressionFile.isEmpty()) { +201 Settings.setString(Settings.KEYS.SUPPRESSION_FILE, suppressionFile); +202 } +203 Settings.setBoolean(Settings.KEYS.ANALYZER_NEXUS_ENABLED, !nexusDisabled); +204if (nexusUrl != null && !nexusUrl.isEmpty()) { +205 Settings.setString(Settings.KEYS.ANALYZER_NEXUS_URL, nexusUrl); +206 } +207 +208if (databaseDriverName != null && !databaseDriverName.isEmpty()) { +209 Settings.setString(Settings.KEYS.DB_DRIVER_NAME, databaseDriverName); +210 } +211if (databaseDriverPath != null && !databaseDriverPath.isEmpty()) { +212 Settings.setString(Settings.KEYS.DB_DRIVER_PATH, databaseDriverPath); +213 } +214if (connectionString != null && !connectionString.isEmpty()) { +215 Settings.setString(Settings.KEYS.DB_CONNECTION_STRING, connectionString); +216 } +217if (databaseUser != null && !databaseUser.isEmpty()) { +218 Settings.setString(Settings.KEYS.DB_USER, databaseUser); +219 } +220if (databasePassword != null && !databasePassword.isEmpty()) { +221 Settings.setString(Settings.KEYS.DB_PASSWORD, databasePassword); +222 } +223 } +224 }
    diff --git a/dependency-check-cli/xref/org/owasp/dependencycheck/cli/CliParser.html b/dependency-check-cli/xref/org/owasp/dependencycheck/cli/CliParser.html index 9f74ff2bc..0a35fbd27 100644 --- a/dependency-check-cli/xref/org/owasp/dependencycheck/cli/CliParser.html +++ b/dependency-check-cli/xref/org/owasp/dependencycheck/cli/CliParser.html @@ -9,581 +9,708 @@ 1/*2 * This file is part of dependency-check-cli.3 * -4 * Dependency-check-cli is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-cli is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-cli. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. -18 */ -19package org.owasp.dependencycheck.cli; -20 -21import java.io.File; -22import java.io.FileNotFoundException; -23import org.apache.commons.cli.CommandLine; -24import org.apache.commons.cli.CommandLineParser; -25import org.apache.commons.cli.HelpFormatter; -26import org.apache.commons.cli.Option; -27import org.apache.commons.cli.OptionBuilder; -28import org.apache.commons.cli.OptionGroup; -29import org.apache.commons.cli.Options; -30import org.apache.commons.cli.ParseException; -31import org.apache.commons.cli.PosixParser; -32import org.owasp.dependencycheck.reporting.ReportGenerator.Format; -33import org.owasp.dependencycheck.utils.Settings; -34 -35/** -36 * A utility to parse command line arguments for the DependencyCheck. -37 * -38 * @author Jeremy Long <jeremy.long@owasp.org> -39 */ -40publicfinalclassCliParser { -41 -42/** -43 * The command line. -44 */ -45private CommandLine line; -46/** -47 * The options for the command line parser. -48 */ -49privatefinal Options options = createCommandLineOptions(); +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. +17 */ +18package org.owasp.dependencycheck.cli; +19 +20import java.io.File; +21import java.io.FileNotFoundException; +22import org.apache.commons.cli.CommandLine; +23import org.apache.commons.cli.CommandLineParser; +24import org.apache.commons.cli.HelpFormatter; +25import org.apache.commons.cli.Option; +26import org.apache.commons.cli.OptionBuilder; +27import org.apache.commons.cli.OptionGroup; +28import org.apache.commons.cli.Options; +29import org.apache.commons.cli.ParseException; +30import org.apache.commons.cli.PosixParser; +31import org.owasp.dependencycheck.reporting.ReportGenerator.Format; +32import org.owasp.dependencycheck.utils.Settings; +33 +34/** +35 * A utility to parse command line arguments for the DependencyCheck. +36 * +37 * @author Jeremy Long <jeremy.long@owasp.org> +38 */ +39publicfinalclassCliParser { +40 +41/** +42 * The command line. +43 */ +44private CommandLine line; +45/** +46 * Indicates whether the arguments are valid. +47 */ +48privateboolean isValid = true; +4950/** -51 * Indicates whether the arguments are valid. -52 */ -53privateboolean isValid = true; -54 -55/** -56 * Parses the arguments passed in and captures the results for later use. -57 * -58 * @param args the command line arguments -59 * @throws FileNotFoundException is thrown when a 'file' argument does not -60 * point to a file that exists. -61 * @throws ParseException is thrown when a Parse Exception occurs. -62 */ -63publicvoid parse(String[] args) throws FileNotFoundException, ParseException { -64 line = parseArgs(args); -65 -66if (line != null) { -67 validateArgs(); -68 } -69 } -70 -71/** -72 * Parses the command line arguments. -73 * -74 * @param args the command line arguments -75 * @return the results of parsing the command line arguments -76 * @throws ParseException if the arguments are invalid -77 */ -78private CommandLine parseArgs(String[] args) throws ParseException { -79final CommandLineParser parser = new PosixParser(); -80return parser.parse(options, args); -81 } -82 -83/** -84 * Validates that the command line arguments are valid. -85 * -86 * @throws FileNotFoundException if there is a file specified by either the -87 * SCAN or CPE command line arguments that does not exist. -88 * @throws ParseException is thrown if there is an exception parsing the -89 * command line. -90 */ -91privatevoid validateArgs() throws FileNotFoundException, ParseException { -92if (isRunScan()) { -93 validatePathExists(getScanFiles(), "scan"); -94 validatePathExists(getReportDirectory(), "out"); -95if (!line.hasOption(ArgumentName.APP_NAME)) { -96thrownew ParseException("Missing 'app' argument; the scan cannot be run without the an application name."); -97 } -98if (line.hasOption(ArgumentName.OUTPUT_FORMAT)) { -99final String format = line.getOptionValue(ArgumentName.OUTPUT_FORMAT); -100try { -101 Format.valueOf(format); -102 } catch (IllegalArgumentException ex) { -103final String msg = String.format("An invalid 'format' of '%s' was specified. Supported output formats are XML, HTML, VULN, or ALL", format); -104thrownew ParseException(msg); -105 } -106 } -107 } -108 } -109 -110/** -111 * Validates whether or not the path(s) points at a file that exists; if the -112 * path(s) does not point to an existing file a FileNotFoundException is -113 * thrown. -114 * -115 * @param paths the paths to validate if they exists -116 * @param optType the option being validated (e.g. scan, out, etc.) -117 * @throws FileNotFoundException is thrown if one of the paths being -118 * validated does not exist. -119 */ -120privatevoid validatePathExists(String[] paths, String optType) throws FileNotFoundException { -121for (String path : paths) { -122 validatePathExists(path, optType); -123 } -124 } -125 -126/** -127 * Validates whether or not the path points at a file that exists; if the -128 * path does not point to an existing file a FileNotFoundException is -129 * thrown. -130 * -131 * @param path the paths to validate if they exists -132 * @param optType the option being validated (e.g. scan, out, etc.) -133 * @throws FileNotFoundException is thrown if the path being validated does -134 * not exist. -135 */ -136privatevoid validatePathExists(String path, String optType) throws FileNotFoundException { -137final File f = new File(path); -138if (!f.exists()) { -139 isValid = false; -140final String msg = String.format("Invalid '%s' argument: '%s'", optType, path); -141thrownew FileNotFoundException(msg); -142 } -143 } -144 -145/** -146 * Generates an Options collection that is used to parse the command line -147 * and to display the help message. -148 * -149 * @return the command line options used for parsing the command line -150 */ -151 @SuppressWarnings("static-access") -152private Options createCommandLineOptions() { -153final Option help = new Option(ArgumentName.HELP_SHORT, ArgumentName.HELP, false, -154"Print this message."); -155 -156final Option version = new Option(ArgumentName.VERSION_SHORT, ArgumentName.VERSION, -157 false, "Print the version information."); -158 -159final Option noUpdate = new Option(ArgumentName.DISABLE_AUTO_UPDATE_SHORT, ArgumentName.DISABLE_AUTO_UPDATE, -160 false, "Disables the automatic updating of the CPE data."); +51 * Parses the arguments passed in and captures the results for later use. +52 * +53 * @param args the command line arguments +54 * @throws FileNotFoundException is thrown when a 'file' argument does not point to a file that exists. +55 * @throws ParseException is thrown when a Parse Exception occurs. +56 */ +57publicvoid parse(String[] args) throws FileNotFoundException, ParseException { +58 line = parseArgs(args); +59 +60if (line != null) { +61 validateArgs(); +62 } +63 } +64 +65/** +66 * Parses the command line arguments. +67 * +68 * @param args the command line arguments +69 * @return the results of parsing the command line arguments +70 * @throws ParseException if the arguments are invalid +71 */ +72private CommandLine parseArgs(String[] args) throws ParseException { +73final CommandLineParser parser = new PosixParser(); +74final Options options = createCommandLineOptions(); +75return parser.parse(options, args); +76 } +77 +78/** +79 * Validates that the command line arguments are valid. +80 * +81 * @throws FileNotFoundException if there is a file specified by either the SCAN or CPE command line arguments that +82 * does not exist. +83 * @throws ParseException is thrown if there is an exception parsing the command line. +84 */ +85privatevoid validateArgs() throws FileNotFoundException, ParseException { +86if (isRunScan()) { +87 validatePathExists(getScanFiles(), "scan"); +88 validatePathExists(getReportDirectory(), "out"); +89if (!line.hasOption(ArgumentName.APP_NAME)) { +90thrownew ParseException("Missing 'app' argument; the scan cannot be run without the an application name."); +91 } +92if (line.hasOption(ArgumentName.OUTPUT_FORMAT)) { +93final String format = line.getOptionValue(ArgumentName.OUTPUT_FORMAT); +94try { +95 Format.valueOf(format); +96 } catch (IllegalArgumentException ex) { +97final String msg = String.format("An invalid 'format' of '%s' was specified. " +98 + "Supported output formats are XML, HTML, VULN, or ALL", format); +99thrownew ParseException(msg); +100 } +101 } +102 } +103 } +104 +105/** +106 * Validates whether or not the path(s) points at a file that exists; if the path(s) does not point to an existing +107 * file a FileNotFoundException is thrown. +108 * +109 * @param paths the paths to validate if they exists +110 * @param optType the option being validated (e.g. scan, out, etc.) +111 * @throws FileNotFoundException is thrown if one of the paths being validated does not exist. +112 */ +113privatevoid validatePathExists(String[] paths, String optType) throws FileNotFoundException { +114for (String path : paths) { +115 validatePathExists(path, optType); +116 } +117 } +118 +119/** +120 * Validates whether or not the path points at a file that exists; if the path does not point to an existing file a +121 * FileNotFoundException is thrown. +122 * +123 * @param path the paths to validate if they exists +124 * @param optType the option being validated (e.g. scan, out, etc.) +125 * @throws FileNotFoundException is thrown if the path being validated does not exist. +126 */ +127privatevoid validatePathExists(String path, String optType) throws FileNotFoundException { +128final File f = new File(path); +129if (!f.exists()) { +130 isValid = false; +131final String msg = String.format("Invalid '%s' argument: '%s'", optType, path); +132thrownew FileNotFoundException(msg); +133 } +134 } +135 +136/** +137 * Generates an Options collection that is used to parse the command line and to display the help message. +138 * +139 * @return the command line options used for parsing the command line +140 */ +141 @SuppressWarnings("static-access") +142private Options createCommandLineOptions() { +143 +144final Options options = new Options(); +145 addStandardOptions(options); +146 addAdvancedOptions(options); +147 +148return options; +149 } +150 +151/** +152 * Adds the standard command line options to the given options collection. +153 * +154 * @param options a collection of command line arguments +155 * @throws IllegalArgumentException thrown if there is an exception +156 */ +157 @SuppressWarnings("static-access") +158privatevoid addStandardOptions(final Options options) throws IllegalArgumentException { +159final Option help = new Option(ArgumentName.HELP_SHORT, ArgumentName.HELP, false, +160"Print this message."); 161 -162final Option appName = OptionBuilder.withArgName("name").hasArg().withLongOpt(ArgumentName.APP_NAME) -163 .withDescription("The name of the application being scanned. This is a required argument.") -164 .create(ArgumentName.APP_NAME_SHORT); -165 -166final Option connectionTimeout = OptionBuilder.withArgName("timeout").hasArg().withLongOpt(ArgumentName.CONNECTION_TIMEOUT) -167 .withDescription("The connection timeout (in milliseconds) to use when downloading resources.") -168 .create(ArgumentName.CONNECTION_TIMEOUT_SHORT); -169 -170final Option proxyUrl = OptionBuilder.withArgName("url").hasArg().withLongOpt(ArgumentName.PROXY_URL) -171 .withDescription("The proxy url to use when downloading resources.") -172 .create(ArgumentName.PROXY_URL_SHORT); -173 -174final Option proxyPort = OptionBuilder.withArgName("port").hasArg().withLongOpt(ArgumentName.PROXY_PORT) -175 .withDescription("The proxy port to use when downloading resources.") -176 .create(ArgumentName.PROXY_PORT_SHORT); -177 -178final Option proxyUsername = OptionBuilder.withArgName("user").hasArg().withLongOpt(ArgumentName.PROXY_USERNAME) -179 .withDescription("The proxy username to use when downloading resources.") -180 .create(ArgumentName.PROXY_USERNAME_SHORT); -181 -182final Option proxyPassword = OptionBuilder.withArgName("pass").hasArg().withLongOpt(ArgumentName.PROXY_PASSWORD) -183 .withDescription("The proxy password to use when downloading resources.") -184 .create(ArgumentName.PROXY_PASSWORD_SHORT); -185 -186final Option path = OptionBuilder.withArgName("path").hasArg().withLongOpt(ArgumentName.SCAN) -187 .withDescription("The path to scan - this option can be specified multiple times.") -188 .create(ArgumentName.SCAN_SHORT); -189 -190final Option props = OptionBuilder.withArgName("file").hasArg().withLongOpt(ArgumentName.PROP) -191 .withDescription("A property file to load.") -192 .create(ArgumentName.PROP_SHORT); -193 -194final Option data = OptionBuilder.withArgName("path").hasArg().withLongOpt(ArgumentName.DATA_DIRECTORY) -195 .withDescription("The location of the data directory used to store persistent data. This option should generally not be set.") -196 .create(ArgumentName.DATA_DIRECTORY_SHORT); -197 -198final Option out = OptionBuilder.withArgName("folder").hasArg().withLongOpt(ArgumentName.OUT) -199 .withDescription("The folder to write reports to. This defaults to the current directory.") -200 .create(ArgumentName.OUT_SHORT); -201 -202final Option outputFormat = OptionBuilder.withArgName("format").hasArg().withLongOpt(ArgumentName.OUTPUT_FORMAT) -203 .withDescription("The output format to write to (XML, HTML, VULN, ALL). The default is HTML.") -204 .create(ArgumentName.OUTPUT_FORMAT_SHORT); -205 -206final Option verboseLog = OptionBuilder.withArgName("file").hasArg().withLongOpt(ArgumentName.VERBOSE_LOG) -207 .withDescription("The file path to write verbose logging information.") -208 .create(ArgumentName.VERBOSE_LOG_SHORT); -209 -210final Option suppressionFile = OptionBuilder.withArgName("file").hasArg().withLongOpt(ArgumentName.SUPPRESION_FILE) -211 .withDescription("The file path to the suppression XML file.") -212 .create(ArgumentName.SUPPRESION_FILE_SHORT); -213 -214 -215final OptionGroup og = new OptionGroup(); -216 og.addOption(path); -217 -218final Options opts = new Options(); -219 opts.addOptionGroup(og); -220 opts.addOption(out); -221 opts.addOption(outputFormat); -222 opts.addOption(appName); -223 opts.addOption(version); -224 opts.addOption(help); -225 opts.addOption(noUpdate); -226 opts.addOption(props); -227 opts.addOption(data); -228 opts.addOption(verboseLog); -229 opts.addOption(suppressionFile); -230 opts.addOption(proxyPort); -231 opts.addOption(proxyUrl); -232 opts.addOption(proxyUsername); -233 opts.addOption(proxyPassword); -234 opts.addOption(connectionTimeout); +162final Option advancedHelp = OptionBuilder.withLongOpt(ArgumentName.ADVANCED_HELP) +163 .withDescription("Print the advanced help message.").create(); +164 +165final Option version = new Option(ArgumentName.VERSION_SHORT, ArgumentName.VERSION, +166 false, "Print the version information."); +167 +168final Option noUpdate = new Option(ArgumentName.DISABLE_AUTO_UPDATE_SHORT, ArgumentName.DISABLE_AUTO_UPDATE, +169 false, "Disables the automatic updating of the CPE data."); +170 +171final Option appName = OptionBuilder.withArgName("name").hasArg().withLongOpt(ArgumentName.APP_NAME) +172 .withDescription("The name of the application being scanned. This is a required argument.") +173 .create(ArgumentName.APP_NAME_SHORT); +174 +175final Option path = OptionBuilder.withArgName("path").hasArg().withLongOpt(ArgumentName.SCAN) +176 .withDescription("The path to scan - this option can be specified multiple times.") +177 .create(ArgumentName.SCAN_SHORT); +178 +179final Option props = OptionBuilder.withArgName("file").hasArg().withLongOpt(ArgumentName.PROP) +180 .withDescription("A property file to load.") +181 .create(ArgumentName.PROP_SHORT); +182 +183final Option out = OptionBuilder.withArgName("folder").hasArg().withLongOpt(ArgumentName.OUT) +184 .withDescription("The folder to write reports to. This defaults to the current directory.") +185 .create(ArgumentName.OUT_SHORT); +186 +187final Option outputFormat = OptionBuilder.withArgName("format").hasArg().withLongOpt(ArgumentName.OUTPUT_FORMAT) +188 .withDescription("The output format to write to (XML, HTML, VULN, ALL). The default is HTML.") +189 .create(ArgumentName.OUTPUT_FORMAT_SHORT); +190 +191final Option verboseLog = OptionBuilder.withArgName("file").hasArg().withLongOpt(ArgumentName.VERBOSE_LOG) +192 .withDescription("The file path to write verbose logging information.") +193 .create(ArgumentName.VERBOSE_LOG_SHORT); +194 +195final Option suppressionFile = OptionBuilder.withArgName("file").hasArg().withLongOpt(ArgumentName.SUPPRESION_FILE) +196 .withDescription("The file path to the suppression XML file.") +197 .create(); +198 +199final Option disableNexusAnalyzer = OptionBuilder.withLongOpt(ArgumentName.DISABLE_NEXUS) +200 .withDescription("Disable the Nexus Analyzer.") +201 .create(); +202 +203final Option nexusUrl = OptionBuilder.withArgName("url").hasArg().withLongOpt(ArgumentName.NEXUS_URL) +204 .withDescription("The url to the Nexus Server.") +205 .create(); +206 +207//This is an option group because it can be specified more then once. +208final OptionGroup og = new OptionGroup(); +209 og.addOption(path); +210 +211 options.addOptionGroup(og) +212 .addOption(out) +213 .addOption(outputFormat) +214 .addOption(appName) +215 .addOption(version) +216 .addOption(help) +217 .addOption(advancedHelp) +218 .addOption(noUpdate) +219 .addOption(props) +220 .addOption(verboseLog) +221 .addOption(suppressionFile) +222 .addOption(disableNexusAnalyzer) +223 .addOption(nexusUrl); +224 } +225 +226/** +227 * Adds the advanced command line options to the given options collection. These are split out for purposes of being +228 * able to display two different help messages. +229 * +230 * @param options a collection of command line arguments +231 * @throws IllegalArgumentException thrown if there is an exception +232 */ +233 @SuppressWarnings("static-access") +234privatevoid addAdvancedOptions(final Options options) throws IllegalArgumentException { 235 -236return opts; -237 } -238 -239/** -240 * Determines if the 'version' command line argument was passed in. -241 * -242 * @return whether or not the 'version' command line argument was passed in -243 */ -244publicboolean isGetVersion() { -245return (line != null) && line.hasOption(ArgumentName.VERSION); -246 } +236final Option data = OptionBuilder.withArgName("path").hasArg().withLongOpt(ArgumentName.DATA_DIRECTORY) +237 .withDescription("The location of the H2 Database file. This option should generally not be set.") +238 .create(ArgumentName.DATA_DIRECTORY_SHORT); +239 +240final Option connectionTimeout = OptionBuilder.withArgName("timeout").hasArg().withLongOpt(ArgumentName.CONNECTION_TIMEOUT) +241 .withDescription("The connection timeout (in milliseconds) to use when downloading resources.") +242 .create(ArgumentName.CONNECTION_TIMEOUT_SHORT); +243 +244final Option proxyUrl = OptionBuilder.withArgName("url").hasArg().withLongOpt(ArgumentName.PROXY_URL) +245 .withDescription("The proxy url to use when downloading resources.") +246 .create(ArgumentName.PROXY_URL_SHORT); 247 -248/** -249 * Determines if the 'help' command line argument was passed in. -250 * -251 * @return whether or not the 'help' command line argument was passed in -252 */ -253publicboolean isGetHelp() { -254return (line != null) && line.hasOption(ArgumentName.HELP); -255 } -256 -257/** -258 * Determines if the 'scan' command line argument was passed in. -259 * -260 * @return whether or not the 'scan' command line argument was passed in -261 */ -262publicboolean isRunScan() { -263return (line != null) && isValid && line.hasOption(ArgumentName.SCAN); -264 } -265 -266/** -267 * Displays the command line help message to the standard output. -268 */ -269publicvoid printHelp() { -270final HelpFormatter formatter = new HelpFormatter(); -271final String nl = System.getProperty("line.separator"); -272 -273 formatter.printHelp(Settings.getString("application.name", "DependencyCheck"), -274 nl + Settings.getString("application.name", "DependencyCheck") -275 + " can be used to identify if there are any known CVE vulnerabilities in libraries utilized by an application. " -276 + Settings.getString("application.name", "DependencyCheck") -277 + " will automatically update required data from the Internet, such as the CVE and CPE data files from nvd.nist.gov." + nl + nl, -278 options, -279"", -280true); -281 } -282 -283/** -284 * Retrieves the file command line parameter(s) specified for the 'scan' -285 * argument. -286 * -287 * @return the file paths specified on the command line for scan -288 */ -289public String[] getScanFiles() { -290return line.getOptionValues(ArgumentName.SCAN); -291 } -292 -293/** -294 * Returns the directory to write the reports to specified on the command -295 * line. -296 * -297 * @return the path to the reports directory. -298 */ -299public String getReportDirectory() { -300return line.getOptionValue(ArgumentName.OUT, "."); -301 } -302 -303/** -304 * Returns the output format specified on the command line. Defaults to HTML -305 * if no format was specified. -306 * -307 * @return the output format name. -308 */ -309public String getReportFormat() { -310return line.getOptionValue(ArgumentName.OUTPUT_FORMAT, "HTML"); -311 } -312 -313/** -314 * Returns the application name specified on the command line. -315 * -316 * @return the application name. -317 */ -318public String getApplicationName() { -319return line.getOptionValue(ArgumentName.APP_NAME); -320 } -321 -322/** -323 * Returns the connection timeout. -324 * -325 * @return the connection timeout -326 */ -327public String getConnectionTimeout() { -328return line.getOptionValue(ArgumentName.CONNECTION_TIMEOUT); -329 } -330 -331/** -332 * Returns the proxy url. -333 * -334 * @return the proxy url -335 */ -336public String getProxyUrl() { -337return line.getOptionValue(ArgumentName.PROXY_URL); -338 } -339 -340/** -341 * Returns the proxy port. -342 * -343 * @return the proxy port -344 */ -345public String getProxyPort() { -346return line.getOptionValue(ArgumentName.PROXY_PORT); -347 } -348 -349/** -350 * Returns the proxy username. -351 * -352 * @return the proxy username -353 */ -354public String getProxyUsername() { -355return line.getOptionValue(ArgumentName.PROXY_USERNAME); -356 } -357 -358/** -359 * Returns the proxy password. -360 * -361 * @return the proxy password -362 */ -363public String getProxyPassword() { -364return line.getOptionValue(ArgumentName.PROXY_PASSWORD); -365 } -366 -367/** -368 * Get the value of dataDirectory. -369 * -370 * @return the value of dataDirectory -371 */ -372public String getDataDirectory() { -373return line.getOptionValue(ArgumentName.DATA_DIRECTORY); -374 } -375 -376/** -377 * Returns the properties file specified on the command line. -378 * -379 * @return the properties file specified on the command line -380 */ -381public File getPropertiesFile() { -382final String path = line.getOptionValue(ArgumentName.PROP); -383if (path != null) { -384returnnew File(path); -385 } -386returnnull; +248final Option proxyPort = OptionBuilder.withArgName("port").hasArg().withLongOpt(ArgumentName.PROXY_PORT) +249 .withDescription("The proxy port to use when downloading resources.") +250 .create(ArgumentName.PROXY_PORT_SHORT); +251 +252final Option proxyUsername = OptionBuilder.withArgName("user").hasArg().withLongOpt(ArgumentName.PROXY_USERNAME) +253 .withDescription("The proxy username to use when downloading resources.") +254 .create(); +255 +256final Option proxyPassword = OptionBuilder.withArgName("pass").hasArg().withLongOpt(ArgumentName.PROXY_PASSWORD) +257 .withDescription("The proxy password to use when downloading resources.") +258 .create(); +259 +260final Option connectionString = OptionBuilder.withArgName("connStr").hasArg().withLongOpt(ArgumentName.CONNECTION_STRING) +261 .withDescription("The connection string to the database.") +262 .create(); +263final Option dbUser = OptionBuilder.withArgName("user").hasArg().withLongOpt(ArgumentName.DB_NAME) +264 .withDescription("The username used to connect to the database.") +265 .create(); +266final Option dbPassword = OptionBuilder.withArgName("password").hasArg().withLongOpt(ArgumentName.DB_PASSWORD) +267 .withDescription("The password for connecting to the database.") +268 .create(); +269final Option dbDriver = OptionBuilder.withArgName("driver").hasArg().withLongOpt(ArgumentName.DB_DRIVER) +270 .withDescription("The database driver name.") +271 .create(); +272final Option dbDriverPath = OptionBuilder.withArgName("path").hasArg().withLongOpt(ArgumentName.DB_DRIVER_PATH) +273 .withDescription("The path to the database driver; note, this does not need to be set unless the JAR is outside of the classpath.") +274 .create(); +275 +276 options.addOption(proxyPort) +277 .addOption(proxyUrl) +278 .addOption(proxyUsername) +279 .addOption(proxyPassword) +280 .addOption(connectionTimeout) +281 .addOption(connectionString) +282 .addOption(dbUser) +283 .addOption(data) +284 .addOption(dbPassword) +285 .addOption(dbDriver) +286 .addOption(dbDriverPath); +287 } +288 +289/** +290 * Determines if the 'version' command line argument was passed in. +291 * +292 * @return whether or not the 'version' command line argument was passed in +293 */ +294publicboolean isGetVersion() { +295return (line != null) && line.hasOption(ArgumentName.VERSION); +296 } +297 +298/** +299 * Determines if the 'help' command line argument was passed in. +300 * +301 * @return whether or not the 'help' command line argument was passed in +302 */ +303publicboolean isGetHelp() { +304return (line != null) && line.hasOption(ArgumentName.HELP); +305 } +306 +307/** +308 * Determines if the 'scan' command line argument was passed in. +309 * +310 * @return whether or not the 'scan' command line argument was passed in +311 */ +312publicboolean isRunScan() { +313return (line != null) && isValid && line.hasOption(ArgumentName.SCAN); +314 } +315 +316/** +317 * Returns true if the disableNexus command line argument was specified. +318 * +319 * @return true if the disableNexus command line argument was specified; otherwise false +320 */ +321publicboolean isNexusDisabled() { +322return (line != null) && line.hasOption(ArgumentName.DISABLE_NEXUS); +323 } +324 +325/** +326 * Returns the url to the nexus server if one was specified. +327 * +328 * @return the url to the nexus server; if none was specified this will return null; +329 */ +330public String getNexusUrl() { +331if (line == null || !line.hasOption(ArgumentName.NEXUS_URL)) { +332returnnull; +333 } else { +334return line.getOptionValue(ArgumentName.NEXUS_URL); +335 } +336 } +337 +338/** +339 * Displays the command line help message to the standard output. +340 */ +341publicvoid printHelp() { +342final HelpFormatter formatter = new HelpFormatter(); +343final Options options = new Options(); +344 addStandardOptions(options); +345if (line != null && line.hasOption(ArgumentName.ADVANCED_HELP)) { +346 addAdvancedOptions(options); +347 } +348final String helpMsg = String.format("%n%s" +349 + " can be used to identify if there are any known CVE vulnerabilities in libraries utilized by an application. " +350 + "%s will automatically update required data from the Internet, such as the CVE and CPE data files from nvd.nist.gov.%n%n", +351 Settings.getString("application.name", "DependencyCheck"), +352 Settings.getString("application.name", "DependencyCheck")); +353 +354 formatter.printHelp(Settings.getString("application.name", "DependencyCheck"), +355 helpMsg, +356 options, +357"", +358true); +359 +360 } +361 +362/** +363 * Retrieves the file command line parameter(s) specified for the 'scan' argument. +364 * +365 * @return the file paths specified on the command line for scan +366 */ +367public String[] getScanFiles() { +368return line.getOptionValues(ArgumentName.SCAN); +369 } +370 +371/** +372 * Returns the directory to write the reports to specified on the command line. +373 * +374 * @return the path to the reports directory. +375 */ +376public String getReportDirectory() { +377return line.getOptionValue(ArgumentName.OUT, "."); +378 } +379 +380/** +381 * Returns the output format specified on the command line. Defaults to HTML if no format was specified. +382 * +383 * @return the output format name. +384 */ +385public String getReportFormat() { +386return line.getOptionValue(ArgumentName.OUTPUT_FORMAT, "HTML"); 387 } 388389/** -390 * Returns the path to the verbose log file. +390 * Returns the application name specified on the command line.391 * -392 * @return the path to the verbose log file +392 * @return the application name.393 */ -394public String getVerboseLog() { -395return line.getOptionValue(ArgumentName.VERBOSE_LOG); +394public String getApplicationName() { +395return line.getOptionValue(ArgumentName.APP_NAME); 396 } 397398/** -399 * Returns the path to the suppression file. +399 * Returns the connection timeout.400 * -401 * @return the path to the suppression file +401 * @return the connection timeout402 */ -403public String getSuppressionFile() { -404return line.getOptionValue(ArgumentName.SUPPRESION_FILE); +403public String getConnectionTimeout() { +404return line.getOptionValue(ArgumentName.CONNECTION_TIMEOUT); 405 } 406407/** -408 * <p>Prints the manifest information to standard output.</p> -409 * <ul><li>Implementation-Title: ${pom.name}</li> -410 * <li>Implementation-Version: ${pom.version}</li></ul> +408 * Returns the proxy url. +409 * +410 * @return the proxy url411 */ -412publicvoid printVersionInfo() { -413final String version = String.format("%s version %s", -414 Settings.getString("application.name", "DependencyCheck"), -415 Settings.getString("application.version", "Unknown")); -416 System.out.println(version); -417 } -418 -419/** -420 * Checks if the auto update feature has been disabled. If it has been -421 * disabled via the command line this will return false. -422 * -423 * @return if auto-update is allowed. -424 */ -425publicboolean isAutoUpdate() { -426return (line == null) || !line.hasOption(ArgumentName.DISABLE_AUTO_UPDATE); -427 } -428 -429/** -430 * A collection of static final strings that represent the possible command -431 * line arguments. -432 */ -433publicstaticclassArgumentName { -434 -435/** -436 * The long CLI argument name specifying the directory/file to scan. -437 */ -438publicstaticfinal String SCAN = "scan"; -439/** -440 * The short CLI argument name specifying the directory/file to scan. -441 */ -442publicstaticfinal String SCAN_SHORT = "s"; -443/** -444 * The long CLI argument name specifying that the CPE/CVE/etc. data -445 * should not be automatically updated. -446 */ -447publicstaticfinal String DISABLE_AUTO_UPDATE = "noupdate"; -448/** -449 * The short CLI argument name specifying that the CPE/CVE/etc. data -450 * should not be automatically updated. -451 */ -452publicstaticfinal String DISABLE_AUTO_UPDATE_SHORT = "n"; -453/** -454 * The long CLI argument name specifying the directory to write the -455 * reports to. -456 */ -457publicstaticfinal String OUT = "out"; -458/** -459 * The short CLI argument name specifying the directory to write the -460 * reports to. -461 */ -462publicstaticfinal String OUT_SHORT = "o"; -463/** -464 * The long CLI argument name specifying the output format to write the -465 * reports to. -466 */ -467publicstaticfinal String OUTPUT_FORMAT = "format"; -468/** -469 * The short CLI argument name specifying the output format to write the -470 * reports to. -471 */ -472publicstaticfinal String OUTPUT_FORMAT_SHORT = "f"; -473/** -474 * The long CLI argument name specifying the name of the application to -475 * be scanned. -476 */ -477publicstaticfinal String APP_NAME = "app"; -478/** -479 * The short CLI argument name specifying the name of the application to -480 * be scanned. -481 */ -482publicstaticfinal String APP_NAME_SHORT = "a"; -483/** -484 * The long CLI argument name asking for help. -485 */ -486publicstaticfinal String HELP = "help"; -487/** -488 * The short CLI argument name asking for help. -489 */ -490publicstaticfinal String HELP_SHORT = "h"; -491/** -492 * The long CLI argument name asking for the version. -493 */ -494publicstaticfinal String VERSION_SHORT = "v"; -495/** -496 * The short CLI argument name asking for the version. -497 */ -498publicstaticfinal String VERSION = "version"; -499/** -500 * The short CLI argument name indicating the proxy port. -501 */ -502publicstaticfinal String PROXY_PORT_SHORT = "p"; -503/** -504 * The CLI argument name indicating the proxy port. -505 */ -506publicstaticfinal String PROXY_PORT = "proxyport"; -507/** -508 * The short CLI argument name indicating the proxy url. -509 */ -510publicstaticfinal String PROXY_URL_SHORT = "u"; -511/** -512 * The CLI argument name indicating the proxy url. -513 */ -514publicstaticfinal String PROXY_URL = "proxyurl"; -515/** -516 * The short CLI argument name indicating the proxy username. -517 */ -518publicstaticfinal String PROXY_USERNAME_SHORT = "pu"; -519/** -520 * The CLI argument name indicating the proxy username. -521 */ -522publicstaticfinal String PROXY_USERNAME = "proxyuser"; -523/** -524 * The short CLI argument name indicating the proxy password. -525 */ -526publicstaticfinal String PROXY_PASSWORD_SHORT = "pp"; -527/** -528 * The CLI argument name indicating the proxy password. -529 */ -530publicstaticfinal String PROXY_PASSWORD = "proxypass"; -531/** -532 * The short CLI argument name indicating the connection timeout. -533 */ -534publicstaticfinal String CONNECTION_TIMEOUT_SHORT = "c"; -535/** -536 * The CLI argument name indicating the connection timeout. -537 */ -538publicstaticfinal String CONNECTION_TIMEOUT = "connectiontimeout"; -539/** -540 * The short CLI argument name for setting the location of an additional -541 * properties file. -542 */ -543publicstaticfinal String PROP_SHORT = "p"; -544/** -545 * The CLI argument name for setting the location of an additional -546 * properties file. -547 */ -548publicstaticfinal String PROP = "propertyfile"; -549/** -550 * The CLI argument name for setting the location of the data directory. -551 */ -552publicstaticfinal String DATA_DIRECTORY = "data"; -553/** -554 * The short CLI argument name for setting the location of the data -555 * directory. -556 */ -557publicstaticfinal String DATA_DIRECTORY_SHORT = "d"; -558/** -559 * The CLI argument name for setting the location of the data directory. -560 */ -561publicstaticfinal String VERBOSE_LOG = "log"; -562/** -563 * The short CLI argument name for setting the location of the data -564 * directory. -565 */ -566publicstaticfinal String VERBOSE_LOG_SHORT = "l"; -567/** -568 * The CLI argument name for setting the location of the suppression -569 * file. +412public String getProxyUrl() { +413return line.getOptionValue(ArgumentName.PROXY_URL); +414 } +415 +416/** +417 * Returns the proxy port. +418 * +419 * @return the proxy port +420 */ +421public String getProxyPort() { +422return line.getOptionValue(ArgumentName.PROXY_PORT); +423 } +424 +425/** +426 * Returns the proxy username. +427 * +428 * @return the proxy username +429 */ +430public String getProxyUsername() { +431return line.getOptionValue(ArgumentName.PROXY_USERNAME); +432 } +433 +434/** +435 * Returns the proxy password. +436 * +437 * @return the proxy password +438 */ +439public String getProxyPassword() { +440return line.getOptionValue(ArgumentName.PROXY_PASSWORD); +441 } +442 +443/** +444 * Get the value of dataDirectory. +445 * +446 * @return the value of dataDirectory +447 */ +448public String getDataDirectory() { +449return line.getOptionValue(ArgumentName.DATA_DIRECTORY); +450 } +451 +452/** +453 * Returns the properties file specified on the command line. +454 * +455 * @return the properties file specified on the command line +456 */ +457public File getPropertiesFile() { +458final String path = line.getOptionValue(ArgumentName.PROP); +459if (path != null) { +460returnnew File(path); +461 } +462returnnull; +463 } +464 +465/** +466 * Returns the path to the verbose log file. +467 * +468 * @return the path to the verbose log file +469 */ +470public String getVerboseLog() { +471return line.getOptionValue(ArgumentName.VERBOSE_LOG); +472 } +473 +474/** +475 * Returns the path to the suppression file. +476 * +477 * @return the path to the suppression file +478 */ +479public String getSuppressionFile() { +480return line.getOptionValue(ArgumentName.SUPPRESION_FILE); +481 } +482 +483/** +484 * <p> +485 * Prints the manifest information to standard output.</p> +486 * <ul><li>Implementation-Title: ${pom.name}</li> +487 * <li>Implementation-Version: ${pom.version}</li></ul> +488 */ +489publicvoid printVersionInfo() { +490final String version = String.format("%s version %s", +491 Settings.getString("application.name", "DependencyCheck"), +492 Settings.getString("application.version", "Unknown")); +493 System.out.println(version); +494 } +495 +496/** +497 * Checks if the auto update feature has been disabled. If it has been disabled via the command line this will +498 * return false. +499 * +500 * @return if auto-update is allowed. +501 */ +502publicboolean isAutoUpdate() { +503return (line == null) || !line.hasOption(ArgumentName.DISABLE_AUTO_UPDATE); +504 } +505 +506/** +507 * Returns the database driver name if specified; otherwise null is returned. +508 * +509 * @return the database driver name if specified; otherwise null is returned +510 */ +511public String getDatabaseDriverName() { +512return line.getOptionValue(ArgumentName.DB_DRIVER); +513 } +514 +515/** +516 * Returns the database driver path if specified; otherwise null is returned. +517 * +518 * @return the database driver name if specified; otherwise null is returned +519 */ +520public String getDatabaseDriverPath() { +521return line.getOptionValue(ArgumentName.DB_DRIVER_PATH); +522 } +523 +524/** +525 * Returns the database connection string if specified; otherwise null is returned. +526 * +527 * @return the database connection string if specified; otherwise null is returned +528 */ +529public String getConnectionString() { +530return line.getOptionValue(ArgumentName.CONNECTION_STRING); +531 } +532 +533/** +534 * Returns the database database user name if specified; otherwise null is returned. +535 * +536 * @return the database database user name if specified; otherwise null is returned +537 */ +538public String getDatabaseUser() { +539return line.getOptionValue(ArgumentName.DB_NAME); +540 } +541 +542/** +543 * Returns the database database password if specified; otherwise null is returned. +544 * +545 * @return the database database password if specified; otherwise null is returned +546 */ +547public String getDatabasePassword() { +548return line.getOptionValue(ArgumentName.DB_PASSWORD); +549 } +550 +551/** +552 * A collection of static final strings that represent the possible command line arguments. +553 */ +554publicstaticclassArgumentName { +555 +556/** +557 * The long CLI argument name specifying the directory/file to scan. +558 */ +559publicstaticfinal String SCAN = "scan"; +560/** +561 * The short CLI argument name specifying the directory/file to scan. +562 */ +563publicstaticfinal String SCAN_SHORT = "s"; +564/** +565 * The long CLI argument name specifying that the CPE/CVE/etc. data should not be automatically updated. +566 */ +567publicstaticfinal String DISABLE_AUTO_UPDATE = "noupdate"; +568/** +569 * The short CLI argument name specifying that the CPE/CVE/etc. data should not be automatically updated.570 */ -571publicstaticfinal String SUPPRESION_FILE = "suppression"; +571publicstaticfinal String DISABLE_AUTO_UPDATE_SHORT = "n"; 572/** -573 * The short CLI argument name for setting the location of the -574 * suppression file. -575 */ -576publicstaticfinal String SUPPRESION_FILE_SHORT = "sf"; -577 } -578 } +573 * The long CLI argument name specifying the directory to write the reports to. +574 */ +575publicstaticfinal String OUT = "out"; +576/** +577 * The short CLI argument name specifying the directory to write the reports to. +578 */ +579publicstaticfinal String OUT_SHORT = "o"; +580/** +581 * The long CLI argument name specifying the output format to write the reports to. +582 */ +583publicstaticfinal String OUTPUT_FORMAT = "format"; +584/** +585 * The short CLI argument name specifying the output format to write the reports to. +586 */ +587publicstaticfinal String OUTPUT_FORMAT_SHORT = "f"; +588/** +589 * The long CLI argument name specifying the name of the application to be scanned. +590 */ +591publicstaticfinal String APP_NAME = "app"; +592/** +593 * The short CLI argument name specifying the name of the application to be scanned. +594 */ +595publicstaticfinal String APP_NAME_SHORT = "a"; +596/** +597 * The long CLI argument name asking for help. +598 */ +599publicstaticfinal String HELP = "help"; +600/** +601 * The long CLI argument name asking for advanced help. +602 */ +603publicstaticfinal String ADVANCED_HELP = "advancedHelp"; +604/** +605 * The short CLI argument name asking for help. +606 */ +607publicstaticfinal String HELP_SHORT = "h"; +608/** +609 * The long CLI argument name asking for the version. +610 */ +611publicstaticfinal String VERSION_SHORT = "v"; +612/** +613 * The short CLI argument name asking for the version. +614 */ +615publicstaticfinal String VERSION = "version"; +616/** +617 * The short CLI argument name indicating the proxy port. +618 */ +619publicstaticfinal String PROXY_PORT_SHORT = "p"; +620/** +621 * The CLI argument name indicating the proxy port. +622 */ +623publicstaticfinal String PROXY_PORT = "proxyport"; +624/** +625 * The short CLI argument name indicating the proxy url. +626 */ +627publicstaticfinal String PROXY_URL_SHORT = "u"; +628/** +629 * The CLI argument name indicating the proxy url. +630 */ +631publicstaticfinal String PROXY_URL = "proxyurl"; +632/** +633 * The CLI argument name indicating the proxy username. +634 */ +635publicstaticfinal String PROXY_USERNAME = "proxyuser"; +636/** +637 * The CLI argument name indicating the proxy password. +638 */ +639publicstaticfinal String PROXY_PASSWORD = "proxypass"; +640/** +641 * The short CLI argument name indicating the connection timeout. +642 */ +643publicstaticfinal String CONNECTION_TIMEOUT_SHORT = "c"; +644/** +645 * The CLI argument name indicating the connection timeout. +646 */ +647publicstaticfinal String CONNECTION_TIMEOUT = "connectiontimeout"; +648/** +649 * The short CLI argument name for setting the location of an additional properties file. +650 */ +651publicstaticfinal String PROP_SHORT = "p"; +652/** +653 * The CLI argument name for setting the location of an additional properties file. +654 */ +655publicstaticfinal String PROP = "propertyfile"; +656/** +657 * The CLI argument name for setting the location of the data directory. +658 */ +659publicstaticfinal String DATA_DIRECTORY = "data"; +660/** +661 * The short CLI argument name for setting the location of the data directory. +662 */ +663publicstaticfinal String DATA_DIRECTORY_SHORT = "d"; +664/** +665 * The CLI argument name for setting the location of the data directory. +666 */ +667publicstaticfinal String VERBOSE_LOG = "log"; +668/** +669 * The short CLI argument name for setting the location of the data directory. +670 */ +671publicstaticfinal String VERBOSE_LOG_SHORT = "l"; +672/** +673 * The CLI argument name for setting the location of the suppression file. +674 */ +675publicstaticfinal String SUPPRESION_FILE = "suppression"; +676/** +677 * Disables the Nexus Analyzer. +678 */ +679publicstaticfinal String DISABLE_NEXUS = "disableNexus"; +680/** +681 * The URL of the nexus server. +682 */ +683publicstaticfinal String NEXUS_URL = "nexus"; +684/** +685 * The CLI argument name for setting the connection string. +686 */ +687publicstaticfinal String CONNECTION_STRING = "connectionString"; +688/** +689 * The CLI argument name for setting the database user name. +690 */ +691publicstaticfinal String DB_NAME = "dbUser"; +692/** +693 * The CLI argument name for setting the database password. +694 */ +695publicstaticfinal String DB_PASSWORD = "dbPassword"; +696/** +697 * The CLI argument name for setting the database driver name. +698 */ +699publicstaticfinal String DB_DRIVER = "dbDriverName"; +700/** +701 * The CLI argument name for setting the path to the database driver; in case it is not on the class path. +702 */ +703publicstaticfinal String DB_DRIVER_PATH = "dbDriverPath"; +704 } +705 }
    diff --git a/dependency-check-cli/xref/org/owasp/dependencycheck/cli/package-frame.html b/dependency-check-cli/xref/org/owasp/dependencycheck/cli/package-frame.html index 25c1be1f1..4dcee2b23 100644 --- a/dependency-check-cli/xref/org/owasp/dependencycheck/cli/package-frame.html +++ b/dependency-check-cli/xref/org/owasp/dependencycheck/cli/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Command Line 1.0.8 Reference Package org.owasp.dependencycheck.cli + Dependency-Check Command Line 1.1.0 Reference Package org.owasp.dependencycheck.cli diff --git a/dependency-check-cli/xref/org/owasp/dependencycheck/cli/package-summary.html b/dependency-check-cli/xref/org/owasp/dependencycheck/cli/package-summary.html index e6502f8ab..46459b57e 100644 --- a/dependency-check-cli/xref/org/owasp/dependencycheck/cli/package-summary.html +++ b/dependency-check-cli/xref/org/owasp/dependencycheck/cli/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Command Line 1.0.8 Reference Package org.owasp.dependencycheck.cli + Dependency-Check Command Line 1.1.0 Reference Package org.owasp.dependencycheck.cli diff --git a/dependency-check-cli/xref/org/owasp/dependencycheck/package-frame.html b/dependency-check-cli/xref/org/owasp/dependencycheck/package-frame.html index cefc1913c..f343fe2e1 100644 --- a/dependency-check-cli/xref/org/owasp/dependencycheck/package-frame.html +++ b/dependency-check-cli/xref/org/owasp/dependencycheck/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Command Line 1.0.8 Reference Package org.owasp.dependencycheck + Dependency-Check Command Line 1.1.0 Reference Package org.owasp.dependencycheck diff --git a/dependency-check-cli/xref/org/owasp/dependencycheck/package-summary.html b/dependency-check-cli/xref/org/owasp/dependencycheck/package-summary.html index d821b3f02..e4da67251 100644 --- a/dependency-check-cli/xref/org/owasp/dependencycheck/package-summary.html +++ b/dependency-check-cli/xref/org/owasp/dependencycheck/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Command Line 1.0.8 Reference Package org.owasp.dependencycheck + Dependency-Check Command Line 1.1.0 Reference Package org.owasp.dependencycheck diff --git a/dependency-check-cli/xref/overview-frame.html b/dependency-check-cli/xref/overview-frame.html index 43ddf629f..d92b827e0 100644 --- a/dependency-check-cli/xref/overview-frame.html +++ b/dependency-check-cli/xref/overview-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Command Line 1.0.8 Reference + Dependency-Check Command Line 1.1.0 Reference diff --git a/dependency-check-cli/xref/overview-summary.html b/dependency-check-cli/xref/overview-summary.html index c06b506a0..a8f7c02f6 100644 --- a/dependency-check-cli/xref/overview-summary.html +++ b/dependency-check-cli/xref/overview-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Command Line 1.0.8 Reference + Dependency-Check Command Line 1.1.0 Reference @@ -24,7 +24,7 @@ -

    Dependency-Check Command Line 1.0.8 Reference

    +

    Dependency-Check Command Line 1.1.0 Reference

    diff --git a/dependency-check-core/apidocs/allclasses-frame.html b/dependency-check-core/apidocs/allclasses-frame.html index dcf838ed5..97eb1a673 100644 --- a/dependency-check-core/apidocs/allclasses-frame.html +++ b/dependency-check-core/apidocs/allclasses-frame.html @@ -2,10 +2,10 @@ - + -All Classes (Dependency-Check Core 1.0.8 API) - +All Classes (Dependency-Check Core 1.1.0 API) + @@ -42,6 +42,7 @@
  • Checksum
  • CiManagement
  • CiManagement.Notifiers
    • +
  • Confidence
  • ConnectionFactory
  • Contributor
  • Contributor.Properties
    • @@ -68,8 +69,6 @@
  • Developer
  • Developer.Properties
  • Developer.Roles
    • -
  • DirectoryLockException
    • -
  • DirectorySpinLock
  • DistributionManagement
  • Downloader
  • DownloadFailedException
    • @@ -77,7 +76,6 @@
  • DriverLoadException
  • Engine
  • Evidence
    • -
  • Evidence.Confidence
  • EvidenceCollection
  • Exclusion
  • Extension
    • @@ -93,7 +91,6 @@
  • IndexEntry
  • IndexException
  • InvalidDataException
    • -
  • InvalidDirectoryException
  • InvalidSettingException
  • IssueManagement
  • JarAnalyzer
    • diff --git a/dependency-check-core/apidocs/allclasses-noframe.html b/dependency-check-core/apidocs/allclasses-noframe.html index e52ae70ce..342a6e6b9 100644 --- a/dependency-check-core/apidocs/allclasses-noframe.html +++ b/dependency-check-core/apidocs/allclasses-noframe.html @@ -2,10 +2,10 @@ - + -All Classes (Dependency-Check Core 1.0.8 API) - +All Classes (Dependency-Check Core 1.1.0 API) + @@ -42,6 +42,7 @@
  • Checksum
  • CiManagement
  • CiManagement.Notifiers
    • +
  • Confidence
  • ConnectionFactory
  • Contributor
  • Contributor.Properties
    • @@ -68,8 +69,6 @@
  • Developer
  • Developer.Properties
  • Developer.Roles
    • -
  • DirectoryLockException
    • -
  • DirectorySpinLock
  • DistributionManagement
  • Downloader
  • DownloadFailedException
    • @@ -77,7 +76,6 @@
  • DriverLoadException
  • Engine
  • Evidence
    • -
  • Evidence.Confidence
  • EvidenceCollection
  • Exclusion
  • Extension
    • @@ -93,7 +91,6 @@
  • IndexEntry
  • IndexException
  • InvalidDataException
    • -
  • InvalidDirectoryException
  • InvalidSettingException
  • IssueManagement
  • JarAnalyzer
    • diff --git a/dependency-check-core/apidocs/constant-values.html b/dependency-check-core/apidocs/constant-values.html index a6593ad7e..71d897fee 100644 --- a/dependency-check-core/apidocs/constant-values.html +++ b/dependency-check-core/apidocs/constant-values.html @@ -2,16 +2,16 @@ - + -Constant Field Values (Dependency-Check Core 1.0.8 API) - +Constant Field Values (Dependency-Check Core 1.1.0 API) + @@ -77,34 +77,6 @@
    - - - - - - - - - - - - - - - - - - -
    org.owasp.dependencycheck.concurrency.DirectorySpinLock 
    Modifier and TypeConstant FieldValue
    - -public static final StringLOCK_NAME"data.lock"
    - -public static final intMAX_SPIN100
    - - -
      -
    • - @@ -152,7 +124,7 @@ public static final String - + - + - + - +
      org.owasp.dependencycheck.data.cpe.Fields 
      Modifier and Type DB_SCHEMA_VERSION"2.8""2.9"
      @@ -178,21 +150,21 @@ public static final String LAST_UPDATED"lastupdated.modified""NVD CVE Modified"
      public static final String LAST_UPDATED_BASE"lastupdated.""NVD CVE "
      public static final String MODIFIED"modified""Modified"
      diff --git a/dependency-check-core/apidocs/deprecated-list.html b/dependency-check-core/apidocs/deprecated-list.html index 94b5f7b19..1035a124c 100644 --- a/dependency-check-core/apidocs/deprecated-list.html +++ b/dependency-check-core/apidocs/deprecated-list.html @@ -2,16 +2,16 @@ - + -Deprecated List (Dependency-Check Core 1.0.8 API) - +Deprecated List (Dependency-Check Core 1.1.0 API) + @@ -69,7 +69,6 @@
      @@ -115,9 +114,8 @@ org.owasp.dependencycheck.utils.FileUtils.getDataDirectory(String, Class) -
      This method should no longer be used. See the implementation - in dependency-check-cli/App.java to see how the data directory should be - set.
      +
      This method should no longer be used. See the implementation in dependency-check-cli/App.java to see + how the data directory should be set.
      @@ -129,27 +127,6 @@
    - - - -
      -
    • - - - - - - - - - - -
      Deprecated Constructors 
      Constructor and Description
      org.owasp.dependencycheck.Engine(boolean) -
      This function should no longer be used; the autoupdate flag should be set using: - Settings.setBoolean(Settings.KEYS.AUTO_UPDATE, value);
      -
      -
      • -
    diff --git a/dependency-check-core/apidocs/help-doc.html b/dependency-check-core/apidocs/help-doc.html index fa0b40134..ba8cee8c4 100644 --- a/dependency-check-core/apidocs/help-doc.html +++ b/dependency-check-core/apidocs/help-doc.html @@ -2,16 +2,16 @@ - + -API Help (Dependency-Check Core 1.0.8 API) - +API Help (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/index-all.html b/dependency-check-core/apidocs/index-all.html index aad68cf69..b3eba7e67 100644 --- a/dependency-check-core/apidocs/index-all.html +++ b/dependency-check-core/apidocs/index-all.html @@ -2,16 +2,16 @@ - + -Index (Dependency-Check Core 1.0.8 API) - +Index (Dependency-Check Core 1.1.0 API) + @@ -74,15 +74,13 @@
     
    AbstractSuppressionAnalyzer - Class in org.owasp.dependencycheck.analyzer
    -
    Abstract base suppression analyzer that contains methods for parsing the - suppression xml file.
    +
    Abstract base suppression analyzer that contains methods for parsing the suppression xml file.
    AbstractSuppressionAnalyzer() - Constructor for class org.owasp.dependencycheck.analyzer.AbstractSuppressionAnalyzer
     
    AbstractTokenizingFilter - Class in org.owasp.dependencycheck.data.lucene
    -
    An abstract tokenizing filter that can be used as the base for a tokenizing - filter.
    +
    An abstract tokenizing filter that can be used as the base for a tokenizing filter.
    AbstractTokenizingFilter(TokenStream) - Constructor for class org.owasp.dependencycheck.data.lucene.AbstractTokenizingFilter
    @@ -150,20 +148,21 @@
    Adds evidence to the collection.
    -
    addEvidence(String, String, String, Evidence.Confidence) - Method in class org.owasp.dependencycheck.dependency.EvidenceCollection
    +
    addEvidence(String, String, String, Confidence) - Method in class org.owasp.dependencycheck.dependency.EvidenceCollection
    -
    Creates an Evidence object from the parameters and adds the resulting - object to the collection.
    +
    Creates an Evidence object from the parameters and adds the resulting object to the collection.
    addIdentifier(String, String, String) - Method in class org.owasp.dependencycheck.dependency.Dependency
    -
    Adds an entry to the list of detected Identifiers for the dependency - file.
    +
    Adds an entry to the list of detected Identifiers for the dependency file.
    +
    +
    addIdentifier(String, String, String, Confidence) - Method in class org.owasp.dependencycheck.dependency.Dependency
    +
    +
    Adds an entry to the list of detected Identifiers for the dependency file.
    addIdentifier(Identifier) - Method in class org.owasp.dependencycheck.dependency.Dependency
    -
    Adds an entry to the list of detected Identifiers for the dependency - file.
    +
    Adds an entry to the list of detected Identifiers for the dependency file.
    addReference(Reference) - Method in class org.owasp.dependencycheck.dependency.Vulnerability
    @@ -201,8 +200,7 @@
    AlphaNumericTokenizer - Class in org.owasp.dependencycheck.data.lucene
    -
    Tokenizes the input breaking it into tokens when non-alpha/numeric characters - are found.
    +
    Tokenizes the input breaking it into tokens when non-alpha/numeric characters are found.
    AlphaNumericTokenizer(Version, Reader) - Constructor for class org.owasp.dependencycheck.data.lucene.AlphaNumericTokenizer
    @@ -246,8 +244,7 @@
    analyze(Dependency, Engine) - Method in class org.owasp.dependencycheck.analyzer.CPEAnalyzer
    -
    Analyzes a dependency and attempts to determine if there are any CPE - identifiers for this dependency.
    +
    Analyzes a dependency and attempts to determine if there are any CPE identifiers for this dependency.
    analyze(Dependency, Engine) - Method in class org.owasp.dependencycheck.analyzer.CpeSuppressionAnalyzer
     
    @@ -257,8 +254,7 @@
    analyze(Dependency, Engine) - Method in class org.owasp.dependencycheck.analyzer.FalsePositiveAnalyzer
    -
    Analyzes the dependencies and removes bad/incorrect CPE associations - based on various heuristics.
    +
    Analyzes the dependencies and removes bad/incorrect CPE associations based on various heuristics.
    analyze(Dependency, Engine) - Method in class org.owasp.dependencycheck.analyzer.FileNameAnalyzer
    @@ -266,18 +262,18 @@
    analyze(Dependency, Engine) - Method in class org.owasp.dependencycheck.analyzer.HintAnalyzer
    -
    The HintAnalyzer uses knowledge about a dependency to add additional - information to help in identification of identifiers or vulnerabilities.
    +
    The HintAnalyzer uses knowledge about a dependency to add additional information to help in identification of + identifiers or vulnerabilities.
    analyze(Dependency, Engine) - Method in class org.owasp.dependencycheck.analyzer.JarAnalyzer
    -
    Loads a specified JAR file and collects information from the manifest and - checksums to identify the correct CPE information.
    +
    Loads a specified JAR file and collects information from the manifest and checksums to identify the correct CPE + information.
    analyze(Dependency, Engine) - Method in class org.owasp.dependencycheck.analyzer.JavaScriptAnalyzer
    -
    Loads a specified JAR file and collects information from the manifest and - checksums to identify the correct CPE information.
    +
    Loads a specified JAR file and collects information from the manifest and checksums to identify the correct CPE + information.
    analyze(Dependency, Engine) - Method in class org.owasp.dependencycheck.analyzer.NexusAnalyzer
    @@ -285,8 +281,7 @@
    analyze(Dependency, Engine) - Method in class org.owasp.dependencycheck.analyzer.NvdCveAnalyzer
    -
    Analyzes a dependency and attempts to determine if there are any CPE - identifiers for this dependency.
    +
    Analyzes a dependency and attempts to determine if there are any CPE identifiers for this dependency.
    analyze(Dependency, Engine) - Method in class org.owasp.dependencycheck.analyzer.VulnerabilitySuppressionAnalyzer
     
    @@ -296,10 +291,10 @@
    analyzePackageNames(ArrayList<JarAnalyzer.ClassNameInformation>, Dependency, boolean) - Method in class org.owasp.dependencycheck.analyzer.JarAnalyzer
    -
    Analyzes the path information of the classes contained within the - JarAnalyzer to try and determine possible vendor or product names.
    +
    Analyzes the path information of the classes contained within the JarAnalyzer to try and determine possible + vendor or product names.
    -
    analyzePOM(Dependency, ArrayList<JarAnalyzer.ClassNameInformation>) - Method in class org.owasp.dependencycheck.analyzer.JarAnalyzer
    +
    analyzePOM(Dependency, ArrayList<JarAnalyzer.ClassNameInformation>, Engine) - Method in class org.owasp.dependencycheck.analyzer.JarAnalyzer
    Attempts to find a pom.xml within the JAR file.
    @@ -343,8 +338,7 @@
     
    appendEscapedLuceneQuery(StringBuilder, CharSequence) - Static method in class org.owasp.dependencycheck.data.lucene.LuceneUtils
    -
    Appends the text to the supplied StringBuilder escaping Lucene control - characters in the process.
    +
    Appends the text to the supplied StringBuilder escaping Lucene control characters in the process.
    arch - Variable in class org.owasp.dependencycheck.jaxb.pom.generated.ActivationOS
     
    @@ -352,8 +346,9 @@
     
    ArchiveAnalyzer - Class in org.owasp.dependencycheck.analyzer
    -
    An analyzer that extracts files from archives and ensures any supported - files contained within the archive are added to the dependency list.
    +
    + An analyzer that extracts files from archives and ensures any supported files contained within the archive are added + to the dependency list.
    ArchiveAnalyzer() - Constructor for class org.owasp.dependencycheck.analyzer.ArchiveAnalyzer
     
    @@ -395,8 +390,7 @@
     
    AUTO_UPDATE - Static variable in class org.owasp.dependencycheck.utils.Settings.KEYS
    -
    The properties key indicating whether or not the cached data sources - should be updated.
    +
    The properties key indicating whether or not the cached data sources should be updated.
    @@ -476,8 +470,8 @@
     
    buildSearch(String, String, Set<String>, Set<String>) - Method in class org.owasp.dependencycheck.analyzer.CPEAnalyzer
    -
    Builds a Lucene search string by properly escaping data and - constructing a valid search query.
    +
    + Builds a Lucene search string by properly escaping data and constructing a valid search query.
    @@ -541,13 +535,15 @@
    clear() - Method in class org.owasp.dependencycheck.data.lucene.SearchFieldAnalyzer
    -
    Resets the analyzer and clears any internal state data that may have - been left-over from previous uses of the analyzer.
    +
    + Resets the analyzer and clears any internal state data that may have been left-over from previous uses of the + analyzer.
    clear() - Method in class org.owasp.dependencycheck.data.lucene.TokenPairConcatenatingFilter
    -
    Resets the Filter and clears any internal state data that may have - been left-over from previous uses of the Filter.
    +
    + Resets the Filter and clears any internal state data that may have been left-over from previous uses of the + Filter.
    clear() - Method in class org.owasp.dependencycheck.data.update.UpdateableNvdCve
    @@ -559,8 +555,7 @@
    close() - Method in interface org.owasp.dependencycheck.analyzer.Analyzer
    -
    The close method is called after all of the dependencies have been - analyzed.
    +
    The close method is called after all of the dependencies have been analyzed.
    close() - Method in class org.owasp.dependencycheck.analyzer.ArchiveAnalyzer
    @@ -572,7 +567,7 @@
    close() - Method in class org.owasp.dependencycheck.analyzer.JarAnalyzer
    -
    The close method does nothing for this Analyzer.
    +
    Deletes any files extracted from the JAR during analysis.
    close() - Method in class org.owasp.dependencycheck.analyzer.JavaScriptAnalyzer
    @@ -582,10 +577,6 @@
    Closes the data source.
    -
    close() - Method in class org.owasp.dependencycheck.concurrency.DirectorySpinLock
    -
    -
    Releases any locks and closes the underlying channel.
    -
    close() - Method in class org.owasp.dependencycheck.data.cpe.CpeMemoryIndex
    Closes the CPE Index.
    @@ -604,8 +595,7 @@
    closeResultSet(ResultSet) - Static method in class org.owasp.dependencycheck.utils.DBUtils
    -
    Closes the result set capturing and ignoring any SQLExceptions that - occur.
    +
    Closes the result set capturing and ignoring any SQLExceptions that occur.
    closeStatement(Statement) - Static method in class org.owasp.dependencycheck.utils.DBUtils
    @@ -647,6 +637,10 @@
    compareTo(DependencyVersion) - Method in class org.owasp.dependencycheck.utils.DependencyVersion
     
    +
    Confidence - Enum in org.owasp.dependencycheck.dependency
    +
    +
    A confidence enumeration.
    +
    configuration - Variable in class org.owasp.dependencycheck.jaxb.pom.generated.Notifier
     
    configuration - Variable in class org.owasp.dependencycheck.jaxb.pom.generated.Plugin
    @@ -667,10 +661,9 @@
    Loads the configured database driver and returns the database connection.
    -
    contains(Evidence.Confidence) - Method in class org.owasp.dependencycheck.dependency.EvidenceCollection
    +
    contains(Confidence) - Method in class org.owasp.dependencycheck.dependency.EvidenceCollection
    -
    Returns whether or not the collection contains evidence of a specified - Confidence.
    +
    Returns whether or not the collection contains evidence of a specified Confidence.
    containsUrl(String) - Static method in class org.owasp.dependencycheck.utils.UrlStringUtils
    @@ -682,8 +675,7 @@
    containsUsedVersion(DependencyVersion) - Method in class org.owasp.dependencycheck.dependency.EvidenceCollection
    -
    Used to determine if a given version was used (aka read) from the - EvidenceCollection.
    +
    Used to determine if a given version was used (aka read) from the EvidenceCollection.
    Contributor - Class in org.owasp.dependencycheck.jaxb.pom.generated
    @@ -714,8 +706,7 @@
    CORE_JAVA - Static variable in class org.owasp.dependencycheck.analyzer.FalsePositiveAnalyzer
    -
    Regex to identify core java libraries and a few other commonly - misidentified ones.
    +
    Regex to identify core java libraries and a few other commonly misidentified ones.
    CPE - Static variable in class org.owasp.dependencycheck.suppression.SuppressionHandler
    @@ -723,20 +714,18 @@
    CPEAnalyzer - Class in org.owasp.dependencycheck.analyzer
    -
    CPEAnalyzer is a utility class that takes a project dependency and attempts - to discern if there is an associated CPE.
    +
    CPEAnalyzer is a utility class that takes a project dependency and attempts to discern if there is an associated CPE.
    CPEAnalyzer() - Constructor for class org.owasp.dependencycheck.analyzer.CPEAnalyzer
     
    CpeMemoryIndex - Class in org.owasp.dependencycheck.data.cpe
    -
    An in memory lucene index that contains the vendor/product combinations from - the CPE (application) identifiers within the NVD CVE data.
    +
    An in memory lucene index that contains the vendor/product combinations from the CPE (application) identifiers within + the NVD CVE data.
    CpeSuppressionAnalyzer - Class in org.owasp.dependencycheck.analyzer
    -
    The suppression analyzer processes an externally defined XML document that - complies with the suppressions.xsd schema.
    +
    The suppression analyzer processes an externally defined XML document that complies with the suppressions.xsd schema.
    CpeSuppressionAnalyzer() - Constructor for class org.owasp.dependencycheck.analyzer.CpeSuppressionAnalyzer
     
    @@ -1112,23 +1101,21 @@
    CVE_META_URL - Static variable in class org.owasp.dependencycheck.utils.Settings.KEYS
    -
    The properties key for the URL to retrieve the "meta" data from about - the CVE entries.
    +
    The properties key for the URL to retrieve the "meta" data from about the CVE entries.
    CVE_MODIFIED_12_URL - Static variable in class org.owasp.dependencycheck.utils.Settings.KEYS
    -
    The properties key for the URL to retrieve the recently modified and - added CVE entries (last 8 days) using the 1.2 schema.
    +
    The properties key for the URL to retrieve the recently modified and added CVE entries (last 8 days) using + the 1.2 schema.
    CVE_MODIFIED_20_URL - Static variable in class org.owasp.dependencycheck.utils.Settings.KEYS
    -
    The properties key for the URL to retrieve the recently modified and - added CVE entries (last 8 days) using the 2.0 schema.
    +
    The properties key for the URL to retrieve the recently modified and added CVE entries (last 8 days) using + the 2.0 schema.
    CVE_MODIFIED_VALID_FOR_DAYS - Static variable in class org.owasp.dependencycheck.utils.Settings.KEYS
    -
    The properties key for the URL to retrieve the recently modified and - added CVE entries (last 8 days).
    +
    The properties key for the URL to retrieve the recently modified and added CVE entries (last 8 days).
    CVE_SCHEMA_1_2 - Static variable in class org.owasp.dependencycheck.utils.Settings.KEYS
    @@ -1304,8 +1291,9 @@
     
    DependencyBundlingAnalyzer - Class in org.owasp.dependencycheck.analyzer
    -
    This analyzer ensures dependencies that should be grouped together, to - remove excess noise from the report, are grouped.
    +
    + This analyzer ensures dependencies that should be grouped together, to remove excess noise from the report, are + grouped.
    DependencyBundlingAnalyzer() - Constructor for class org.owasp.dependencycheck.analyzer.DependencyBundlingAnalyzer
     
    @@ -1331,7 +1319,8 @@
     
    DependencyVersion - Class in org.owasp.dependencycheck.utils
    -
    Simple object to track the parts of a version number.
    +
    + Simple object to track the parts of a version number.
    DependencyVersion() - Constructor for class org.owasp.dependencycheck.utils.DependencyVersion
    @@ -1343,8 +1332,8 @@
    DependencyVersionUtil - Class in org.owasp.dependencycheck.utils
    -
    A utility class to extract version numbers from file names (or other - strings containing version numbers.
    +
    + A utility class to extract version numbers from file names (or other strings containing version numbers.
    DeploymentRepository - Class in org.owasp.dependencycheck.jaxb.pom.generated
    @@ -1356,8 +1345,8 @@
     
    determineCPE(Dependency) - Method in class org.owasp.dependencycheck.analyzer.CPEAnalyzer
    -
    Searches the data store of CPE entries, trying to identify the CPE for - the given dependency based on the evidence contained within.
    +
    Searches the data store of CPE entries, trying to identify the CPE for the given dependency based on the evidence + contained within.
    Developer - Class in org.owasp.dependencycheck.jaxb.pom.generated
    @@ -1389,34 +1378,6 @@
     
    directory - Variable in class org.owasp.dependencycheck.jaxb.pom.generated.Resource
     
    -
    DirectoryLockException - Exception in org.owasp.dependencycheck.concurrency
    -
    -
    If thrown, indicates that a problem occurred when locking a directory.
    -
    -
    DirectoryLockException() - Constructor for exception org.owasp.dependencycheck.concurrency.DirectoryLockException
    -
    -
    Constructs a new Directory Lock Exception.
    -
    -
    DirectoryLockException(String) - Constructor for exception org.owasp.dependencycheck.concurrency.DirectoryLockException
    -
    -
    Constructs a new Directory Lock Exception.
    -
    -
    DirectoryLockException(Throwable) - Constructor for exception org.owasp.dependencycheck.concurrency.DirectoryLockException
    -
    -
    Constructs a new Directory Lock Exception.
    -
    -
    DirectoryLockException(String, Throwable) - Constructor for exception org.owasp.dependencycheck.concurrency.DirectoryLockException
    -
    -
    Constructs a new Directory Lock Exception.
    -
    -
    DirectorySpinLock - Class in org.owasp.dependencycheck.concurrency
    -
    -
    Implements a spin lock on a given directory.
    -
    -
    DirectorySpinLock(File) - Constructor for class org.owasp.dependencycheck.concurrency.DirectorySpinLock
    -
    -
    Constructs a new spin lock on the given directory.
    -
    distribution - Variable in class org.owasp.dependencycheck.jaxb.pom.generated.License
     
    DistributionManagement - Class in org.owasp.dependencycheck.jaxb.pom.generated
    @@ -1511,13 +1472,6 @@
    Creates a new Engine.
    -
    Engine(boolean) - Constructor for class org.owasp.dependencycheck.Engine
    -
    -
    Deprecated. -
    This function should no longer be used; the autoupdate flag should be set using: - Settings.setBoolean(Settings.KEYS.AUTO_UPDATE, value);
    -
    -
    ENTRY - Static variable in class org.owasp.dependencycheck.data.update.xml.NvdCve12Handler.Element
    A node type in the NVD CVE Schema 1.2.
    @@ -1544,8 +1498,7 @@
     
    equals(Object) - Method in class org.owasp.dependencycheck.dependency.VulnerableSoftware
    -
    Standard equals implementation to compare this VulnerableSoftware to - another object.
    +
    Standard equals implementation to compare this VulnerableSoftware to another object.
    equals(Object) - Method in class org.owasp.dependencycheck.suppression.PropertyType
    @@ -1561,8 +1514,7 @@
    escapeLuceneQuery(CharSequence) - Static method in class org.owasp.dependencycheck.data.lucene.LuceneUtils
    -
    Escapes the text passed in so that it is treated as data instead of - control characters.
    +
    Escapes the text passed in so that it is treated as data instead of control characters.
    Evidence - Class in org.owasp.dependencycheck.dependency
    @@ -1572,14 +1524,10 @@
    Creates a new Evidence object.
    -
    Evidence(String, String, String, Evidence.Confidence) - Constructor for class org.owasp.dependencycheck.dependency.Evidence
    +
    Evidence(String, String, String, Confidence) - Constructor for class org.owasp.dependencycheck.dependency.Evidence
    Creates a new Evidence objects.
    -
    Evidence.Confidence - Enum in org.owasp.dependencycheck.dependency
    -
    -
    The confidence that the evidence is "high" quality.
    -
    EvidenceCollection - Class in org.owasp.dependencycheck.dependency
    Used to maintain a collection of Evidence.
    @@ -1632,8 +1580,8 @@
    extractImportantUrlData(String) - Static method in class org.owasp.dependencycheck.utils.UrlStringUtils
    -
    Takes a URL, in String format, and adds the important parts of the URL - to a list of strings.
    +
    + Takes a URL, in String format, and adds the important parts of the URL to a list of strings.
    ExtractionException - Exception in org.owasp.dependencycheck.utils
    @@ -1663,8 +1611,7 @@
    FalsePositiveAnalyzer - Class in org.owasp.dependencycheck.analyzer
    -
    This analyzer attempts to remove some well known false positives - - specifically regarding the java runtime.
    +
    This analyzer attempts to remove some well known false positives - specifically regarding the java runtime.
    FalsePositiveAnalyzer() - Constructor for class org.owasp.dependencycheck.analyzer.FalsePositiveAnalyzer
     
    @@ -1680,8 +1627,8 @@
    FieldAnalyzer - Class in org.owasp.dependencycheck.data.lucene
    -
    A Lucene Analyzer that utilizes the WhitespaceTokenizer, - WordDelimiterFilter, LowerCaseFilter, and StopFilter.
    +
    + A Lucene Analyzer that utilizes the WhitespaceTokenizer, WordDelimiterFilter, LowerCaseFilter, and StopFilter.
    FieldAnalyzer(Version) - Constructor for class org.owasp.dependencycheck.data.lucene.FieldAnalyzer
    @@ -1689,8 +1636,7 @@
    Fields - Class in org.owasp.dependencycheck.data.cpe
    -
    Fields is a collection of field names used within the Lucene index for CPE - entries.
    +
    Fields is a collection of field names used within the Lucene index for CPE entries.
    Fields() - Constructor for class org.owasp.dependencycheck.data.cpe.Fields
     
    @@ -1975,6 +1921,10 @@
    Get the value of confidence.
    +
    getConfidence() - Method in class org.owasp.dependencycheck.dependency.Identifier
    +
    +
    Get the value of confidence.
    +
    getConfiguration() - Method in class org.owasp.dependencycheck.jaxb.pom.generated.Notifier
    Gets the value of the configuration property.
    @@ -2073,7 +2023,8 @@
    getCweName(String) - Static method in class org.owasp.dependencycheck.data.cwe.CweDB
    -
    Returns the full CWE name from the CWE ID.
    +
    + Returns the full CWE name from the CWE ID.
    getDatabaseProperties() - Method in class org.owasp.dependencycheck.data.nvdcve.CveDB
    @@ -2087,9 +2038,8 @@
    getDataDirectory(String, Class) - Static method in class org.owasp.dependencycheck.utils.FileUtils
    Deprecated. -
    This method should no longer be used. See the implementation - in dependency-check-cli/App.java to see how the data directory should be - set.
    +
    This method should no longer be used. See the implementation in dependency-check-cli/App.java to see + how the data directory should be set.
    getDataFile(String) - Static method in class org.owasp.dependencycheck.utils.Settings
    @@ -2098,8 +2048,7 @@
    getDataSources() - Method in class org.owasp.dependencycheck.data.update.UpdateService
    -
    Returns an Iterator for all instances of the CachedWebDataSource - interface.
    +
    Returns an Iterator for all instances of the CachedWebDataSource interface.
    getDefaultGoal() - Method in class org.owasp.dependencycheck.jaxb.pom.generated.Build
    @@ -2319,7 +2268,8 @@
    getFilePath() - Method in class org.owasp.dependencycheck.dependency.Dependency
    -
    Gets the file path of the dependency.
    +
    + Gets the file path of the dependency.
    getFilePath() - Method in class org.owasp.dependencycheck.suppression.SuppressionRule
    @@ -2503,8 +2453,7 @@
    getLastModified(URL) - Static method in class org.owasp.dependencycheck.utils.Downloader
    -
    Makes an HTTP Head request to retrieve the last modified date of the - given URL.
    +
    Makes an HTTP Head request to retrieve the last modified date of the given URL.
    getLayout() - Method in class org.owasp.dependencycheck.jaxb.pom.generated.DeploymentRepository
    @@ -2538,15 +2487,18 @@
    Gets the value of the mailingLists property.
    +
    getMatchedAllPreviousCPE() - Method in class org.owasp.dependencycheck.dependency.Vulnerability
    +
    +
    Get the value of matchedAllPreviousCPE.
    +
    +
    getMatchedCPE() - Method in class org.owasp.dependencycheck.dependency.Vulnerability
    +
    +
    Get the value of matchedCPE.
    +
    getMaven() - Method in class org.owasp.dependencycheck.jaxb.pom.generated.Prerequisites
    Gets the value of the maven property.
    -
    getMaxWait() - Method in class org.owasp.dependencycheck.concurrency.DirectorySpinLock
    -
    -
    Get the maximum wait time, in seconds, that the spin lock will wait while - trying to obtain a lock.
    -
    getMD5Checksum(File) - Static method in class org.owasp.dependencycheck.utils.Checksum
    Calculates the MD5 checksum of a specified file.
    @@ -2559,6 +2511,10 @@
    Gets the value of the message property.
    +
    getMetaData() - Method in class org.owasp.dependencycheck.data.nvdcve.DatabaseProperties
    +
    +
    Returns a map of the meta data from the database properties.
    +
    getMissing() - Method in class org.owasp.dependencycheck.jaxb.pom.generated.ActivationFile
    Gets the value of the missing property.
    @@ -2877,6 +2833,10 @@
    Gets the value of the profiles property.
    +
    getProperties() - Method in class org.owasp.dependencycheck.data.nvdcve.DatabaseProperties
    +
    +
    Returns the collection of Database Properties as a properties collection.
    +
    getProperties() - Method in class org.owasp.dependencycheck.jaxb.pom.generated.Contributor
    Gets the value of the properties property.
    @@ -3095,7 +3055,8 @@
    getSupportedExtensions() - Method in interface org.owasp.dependencycheck.analyzer.Analyzer
    -
    Returns a list of supported file extensions.
    +
    + Returns a list of supported file extensions.
    getSupportedExtensions() - Method in class org.owasp.dependencycheck.analyzer.ArchiveAnalyzer
    @@ -3395,8 +3356,8 @@
    getWeighting() - Method in class org.owasp.dependencycheck.dependency.EvidenceCollection
    -
    Returns a set of Weightings - a list of terms that are believed to be of - higher confidence when also found in another location.
    +
    Returns a set of Weightings - a list of terms that are believed to be of higher confidence when also found in + another location.
    getWords() - Method in class org.owasp.dependencycheck.data.lucene.TokenPairConcatenatingFilter
    @@ -3478,9 +3439,14 @@
    Calculates the hashCode for this object.
    +
    hasMatchedAllPreviousCPE() - Method in class org.owasp.dependencycheck.dependency.Vulnerability
    +
    +
    Determines whether or not matchedAllPreviousCPE has been set.
    +
    hasNext() - Method in class org.owasp.dependencycheck.data.update.UpdateableNvdCve
    -
    Returns whether or not there is another item in the collection.
    +
    + Returns whether or not there is another item in the collection.
    hasPreviousVersion() - Method in class org.owasp.dependencycheck.dependency.VulnerableSoftware
    @@ -3522,8 +3488,8 @@
    idf(long, long) - Method in class org.owasp.dependencycheck.data.lucene.DependencySimilarity
    -
    Override the default idf implementation so that frequency within all - document is ignored.
    +
    + Override the default idf implementation so that frequency within all document is ignored.
    importXML(File, File) - Method in class org.owasp.dependencycheck.data.update.task.ProcessTask
    @@ -3537,22 +3503,19 @@
     
    incrementToken() - Method in class org.owasp.dependencycheck.data.lucene.TokenPairConcatenatingFilter
    -
    Increments the underlying TokenStream and sets CharTermAttributes to - construct an expanded set of tokens by concatenating tokens with the - previous token.
    +
    Increments the underlying TokenStream and sets CharTermAttributes to construct an expanded set of tokens by + concatenating tokens with the previous token.
    incrementToken() - Method in class org.owasp.dependencycheck.data.lucene.UrlTokenizingFilter
    -
    Increments the underlying TokenStream and sets CharTermAttributes to - construct an expanded set of tokens by concatenating tokens with the - previous token.
    +
    Increments the underlying TokenStream and sets CharTermAttributes to construct an expanded set of tokens by + concatenating tokens with the previous token.
    incrementToken() - Method in class org.owasp.dependencycheck.data.lucene.VersionTokenizingFilter
    Deprecated.
    -
    Increments the underlying TokenStream and sets CharTermAttributes to - construct an expanded set of tokens by concatenating tokens with the - previous token.
    +
    Increments the underlying TokenStream and sets CharTermAttributes to construct an expanded set of tokens by + concatenating tokens with the previous token.
    IndexEntry - Class in org.owasp.dependencycheck.data.cpe
    @@ -3602,8 +3565,7 @@
    initialize() - Method in interface org.owasp.dependencycheck.analyzer.Analyzer
    -
    The initialize method is called (once) prior to the analyze method being - called on all of the dependencies.
    +
    The initialize method is called (once) prior to the analyze method being called on all of the dependencies.
    initialize() - Method in class org.owasp.dependencycheck.analyzer.ArchiveAnalyzer
    @@ -3631,13 +3593,12 @@
    interpolateString(String, Properties) - Method in class org.owasp.dependencycheck.analyzer.JarAnalyzer
    -
    A utility function that will interpolate strings based on values given - in the properties file.
    +
    + A utility function that will interpolate strings based on values given in the properties file.
    InvalidDataException - Exception in org.owasp.dependencycheck.data.update.exception
    -
    An InvalidDataDataException is a generic exception used when trying to load - the NVD CVE meta data.
    +
    An InvalidDataDataException is a generic exception used when trying to load the NVD CVE meta data.
    InvalidDataException(String) - Constructor for exception org.owasp.dependencycheck.data.update.exception.InvalidDataException
    @@ -3647,26 +3608,6 @@
    Creates an InvalidDataException.
    -
    InvalidDirectoryException - Exception in org.owasp.dependencycheck.concurrency
    -
    -
    If thrown, indicates that there is a problem with a directory.
    -
    -
    InvalidDirectoryException() - Constructor for exception org.owasp.dependencycheck.concurrency.InvalidDirectoryException
    -
    -
    Constructs a new Invalid Directory Exception.
    -
    -
    InvalidDirectoryException(String) - Constructor for exception org.owasp.dependencycheck.concurrency.InvalidDirectoryException
    -
    -
    Constructs a new Invalid Directory Exception.
    -
    -
    InvalidDirectoryException(Throwable) - Constructor for exception org.owasp.dependencycheck.concurrency.InvalidDirectoryException
    -
    -
    Constructs a new Invalid Directory Exception.
    -
    -
    InvalidDirectoryException(String, Throwable) - Constructor for exception org.owasp.dependencycheck.concurrency.InvalidDirectoryException
    -
    -
    Constructs a new Invalid Directory Exception.
    -
    InvalidSettingException - Exception in org.owasp.dependencycheck.utils
    An exception used when an error occurs reading a setting.
    @@ -3877,9 +3818,10 @@
    iterator() - Method in class org.owasp.dependencycheck.data.update.UpdateableNvdCve
    -
    Returns an iterator for the NvdCveInfo contained.
    +
    + Returns an iterator for the NvdCveInfo contained.
    -
    iterator(Evidence.Confidence) - Method in class org.owasp.dependencycheck.dependency.EvidenceCollection
    +
    iterator(Confidence) - Method in class org.owasp.dependencycheck.dependency.EvidenceCollection
    Used to iterate over evidence of the specified confidence.
    @@ -3899,8 +3841,7 @@
    JarAnalyzer - Class in org.owasp.dependencycheck.analyzer
    -
    Used to load a JAR file and collect information that can be used to determine - the associated CPE.
    +
    Used to load a JAR file and collect information that can be used to determine the associated CPE.
    JarAnalyzer() - Constructor for class org.owasp.dependencycheck.analyzer.JarAnalyzer
    @@ -3912,8 +3853,7 @@
    JavaScriptAnalyzer - Class in org.owasp.dependencycheck.analyzer
    -
    Used to load a JAR file and collect information that can be used to determine - the associated CPE.
    +
    Used to load a JAR file and collect information that can be used to determine the associated CPE.
    JavaScriptAnalyzer() - Constructor for class org.owasp.dependencycheck.analyzer.JavaScriptAnalyzer
     
    @@ -3935,8 +3875,8 @@
    LAST_UPDATED - Static variable in class org.owasp.dependencycheck.data.nvdcve.DatabaseProperties
    -
    The properties file key for the last updated field - used to store the - last updated time of the Modified NVD CVE xml file.
    +
    The properties file key for the last updated field - used to store the last updated time of the Modified NVD CVE + xml file.
    LAST_UPDATED_BASE - Static variable in class org.owasp.dependencycheck.data.nvdcve.DatabaseProperties
    @@ -3965,19 +3905,15 @@
    Loads the specified class by registering the supplied paths to the class loader and then registers the driver with the driver manager.
    -
    LOCK_NAME - Static variable in class org.owasp.dependencycheck.concurrency.DirectorySpinLock
    -
    -
    The name of the lock file.
    -
    log(int, String) - Method in class org.owasp.dependencycheck.reporting.VelocityLoggerRedirect
    -
    Given a Velocity log level and message, this method will call the - appropriate Logger level and log the specified values.
    +
    Given a Velocity log level and message, this method will call the appropriate Logger level and log the specified + values.
    log(int, String, Throwable) - Method in class org.owasp.dependencycheck.reporting.VelocityLoggerRedirect
    -
    Given a Velocity log level, message and Throwable, this method will call - the appropriate Logger level and log the specified values.
    +
    Given a Velocity log level, message and Throwable, this method will call the appropriate Logger level and log the + specified values.
    LogFilter - Class in org.owasp.dependencycheck.utils
    @@ -3991,8 +3927,8 @@
    LuceneUtils - Class in org.owasp.dependencycheck.data.lucene
    -
    Lucene utils is a set of utilize written to make constructing Lucene - queries simpler.
    +
    + Lucene utils is a set of utilize written to make constructing Lucene queries simpler.
    @@ -4019,8 +3955,7 @@
     
    matches(String) - Method in class org.owasp.dependencycheck.suppression.PropertyType
    -
    Uses the object's properties to determine if the supplied string matches - the value of this property.
    +
    Uses the object's properties to determine if the supplied string matches the value of this property.
    matchesAtLeastThreeLevels(DependencyVersion) - Method in class org.owasp.dependencycheck.utils.DependencyVersion
    @@ -4054,10 +3989,6 @@
    The maximum number of threads to allocate when downloading files.
    -
    MAX_SPIN - Static variable in class org.owasp.dependencycheck.concurrency.DirectorySpinLock
    -
    -
    The maximum wait period used when attempting to obtain a lock.
    -
    MAX_THREAD_POOL_SIZE - Static variable in class org.owasp.dependencycheck.data.update.StandardUpdate
    The max thread pool size to use when downloading files.
    @@ -4080,8 +4011,7 @@
    mergeUsed(EvidenceCollection...) - Static method in class org.owasp.dependencycheck.dependency.EvidenceCollection
    -
    Merges multiple EvidenceCollections together, only merging evidence that - was used, into a new EvidenceCollection.
    +
    Merges multiple EvidenceCollections together, only merging evidence that was used, into a new EvidenceCollection.
    message - Variable in class org.owasp.dependencycheck.jaxb.pom.generated.Relocation
     
    @@ -4163,8 +4093,7 @@
     
    MODIFIED - Static variable in class org.owasp.dependencycheck.data.nvdcve.DatabaseProperties
    -
    Modified key word, used as a key to store information about the modified - file (i.e.
    +
    Modified key word, used as a key to store information about the modified file (i.e.
    module - Variable in class org.owasp.dependencycheck.jaxb.pom.generated.Model.Modules
     
    @@ -4208,12 +4137,12 @@
    next() - Method in class org.owasp.dependencycheck.data.update.UpdateableNvdCve
    -
    Returns the next item in the collection.
    +
    + Returns the next item in the collection.
    NexusAnalyzer - Class in org.owasp.dependencycheck.analyzer
    -
    Analyzer which will attempt to locate a dependency on a Nexus service - by SHA-1 digest of the dependency.
    +
    Analyzer which will attempt to locate a dependency on a Nexus service by SHA-1 digest of the dependency.
    NexusAnalyzer() - Constructor for class org.owasp.dependencycheck.analyzer.NexusAnalyzer
     
    @@ -4247,8 +4176,7 @@
    NonClosingStream - Class in org.owasp.dependencycheck.utils
    -
    NonClosingStream is a stream filter which prevents another class that - processes the stream from closing it.
    +
    NonClosingStream is a stream filter which prevents another class that processes the stream from closing it.
    NonClosingStream(InputStream) - Constructor for class org.owasp.dependencycheck.utils.NonClosingStream
    @@ -4290,8 +4218,7 @@
     
    NvdCve12Handler.Element - Class in org.owasp.dependencycheck.data.update.xml
    -
    A simple class to maintain information about the current element while - parsing the NVD CVE XML.
    +
    A simple class to maintain information about the current element while parsing the NVD CVE XML.
    NvdCve12Handler.Element() - Constructor for class org.owasp.dependencycheck.data.update.xml.NvdCve12Handler.Element
     
    @@ -4303,15 +4230,14 @@
     
    NvdCve20Handler.Element - Class in org.owasp.dependencycheck.data.update.xml
    -
    A simple class to maintain information about the current element while - parsing the NVD CVE XML.
    +
    A simple class to maintain information about the current element while parsing the NVD CVE XML.
    NvdCve20Handler.Element() - Constructor for class org.owasp.dependencycheck.data.update.xml.NvdCve20Handler.Element
     
    NvdCveAnalyzer - Class in org.owasp.dependencycheck.analyzer
    -
    NvdCveAnalyzer is a utility class that takes a project dependency and - attempts to discern if there is an associated CVEs.
    +
    NvdCveAnalyzer is a utility class that takes a project dependency and attempts to discern if there is an associated + CVEs.
    NvdCveAnalyzer() - Constructor for class org.owasp.dependencycheck.analyzer.NvdCveAnalyzer
     
    @@ -4343,26 +4269,6 @@
    Create a new ObjectFactory that can be used to create new instances of schema derived classes for package: org.owasp.dependencycheck.analyzer.pom.generated
    -
    obtainExclusiveLock() - Method in class org.owasp.dependencycheck.concurrency.DirectorySpinLock
    -
    -
    Attempts to obtain an exclusive lock; an exception is thrown if the lock - could not be obtained.
    -
    -
    obtainLock(boolean, long) - Method in class org.owasp.dependencycheck.concurrency.DirectorySpinLock
    -
    -
    Attempts to obtain a lock; an exception is thrown if the lock could not - be obtained.
    -
    -
    obtainLock(boolean) - Method in class org.owasp.dependencycheck.concurrency.DirectorySpinLock
    -
    -
    Attempts to obtain a lock; an exception is thrown if the lock could not - be obtained.
    -
    -
    obtainSharedLock() - Method in class org.owasp.dependencycheck.concurrency.DirectorySpinLock
    -
    -
    Attempts to obtain an exclusive lock; an exception is thrown if the lock - could not be obtained.
    -
    open() - Method in class org.owasp.dependencycheck.analyzer.CPEAnalyzer
    Opens the data source.
    @@ -4404,15 +4310,6 @@ Analyzers are used to inspect the identified dependencies, collect Evidence, and process the dependencies.
    -
    org.owasp.dependencycheck.concurrency - package org.owasp.dependencycheck.concurrency
    -
    -
    - - org.owasp.dependencycheck.concurrency - - - Contains classes used to create shared and exclusive locks on directories.
    -
    org.owasp.dependencycheck.data.cpe - package org.owasp.dependencycheck.data.cpe
    @@ -4441,7 +4338,13 @@ Contains classes used to work with the Lucene Indexes.
    org.owasp.dependencycheck.data.nexus - package org.owasp.dependencycheck.data.nexus
    -
     
    +
    +
    + + org.owasp.dependencycheck.data.nexus + +
    +
    org.owasp.dependencycheck.data.nvdcve - package org.owasp.dependencycheck.data.nvdcve
    @@ -4582,17 +4485,19 @@
     
    parseManifest(Dependency, ArrayList<JarAnalyzer.ClassNameInformation>) - Method in class org.owasp.dependencycheck.analyzer.JarAnalyzer
    -
    Reads the manifest from the JAR file and collects the entries.
    +
    + Reads the manifest from the JAR file and collects the entries.
    parseName(String) - Method in class org.owasp.dependencycheck.data.cpe.IndexEntry
    -
    Parses a name attribute value, from the cpe.xml, into its - corresponding parts: vendor, product.
    +
    + Parses a name attribute value, from the cpe.xml, into its corresponding parts: vendor, product.
    parseName(String) - Method in class org.owasp.dependencycheck.dependency.VulnerableSoftware
    -
    Parses a name attribute value, from the cpe.xml, into its - corresponding parts: vendor, product, version, revision.
    +
    + Parses a name attribute value, from the cpe.xml, into its corresponding parts: vendor, product, version, + revision.
    parseSuppressionRules(File) - Method in class org.owasp.dependencycheck.suppression.SuppressionParser
    @@ -4600,13 +4505,12 @@
    parseVersion(String) - Method in class org.owasp.dependencycheck.utils.DependencyVersion
    -
    Parses a version string into its sub parts: major, minor, revision, - build, etc.
    +
    Parses a version string into its sub parts: major, minor, revision, build, etc.
    parseVersion(String) - Static method in class org.owasp.dependencycheck.utils.DependencyVersionUtil
    -
    A utility class to extract version numbers from file names (or other - strings containing version numbers.
    +
    + A utility class to extract version numbers from file names (or other strings containing version numbers.
    Example:
    Give the file name: library-name-1.4.1r2-release.jar
    This function would return: 1.4.1.r2
    @@ -4719,13 +4623,11 @@
     
    process(Dependency) - Method in class org.owasp.dependencycheck.suppression.SuppressionRule
    -
    Processes a given dependency to determine if any CPE, CVE, CWE, or CVSS - scores should be suppressed.
    +
    Processes a given dependency to determine if any CPE, CVE, CWE, or CVSS scores should be suppressed.
    ProcessTask - Class in org.owasp.dependencycheck.data.update.task
    -
    A callable task that will process a given set of NVD CVE xml files and update - the Cve Database accordingly.
    +
    A callable task that will process a given set of NVD CVE xml files and update the Cve Database accordingly.
    ProcessTask(CveDB, CallableDownloadTask) - Constructor for class org.owasp.dependencycheck.data.update.task.ProcessTask
    @@ -4797,8 +4699,8 @@
     
    PropertyType - Class in org.owasp.dependencycheck.suppression
    -
    A simple PropertyType used to represent a string value that could be used as - a regular expression or could be case insensitive.
    +
    A simple PropertyType used to represent a string value that could be used as a regular expression or could be case + insensitive.
    PropertyType() - Constructor for class org.owasp.dependencycheck.suppression.PropertyType
     
    @@ -4808,8 +4710,7 @@
    PROXY_PORT - Static variable in class org.owasp.dependencycheck.utils.Settings.KEYS
    -
    The properties key for the proxy port - this must be an integer - value.
    +
    The properties key for the proxy port - this must be an integer value.
    PROXY_URL - Static variable in class org.owasp.dependencycheck.utils.Settings.KEYS
    @@ -4833,10 +4734,6 @@
     
    relativePath - Variable in class org.owasp.dependencycheck.jaxb.pom.generated.Parent
     
    -
    release() - Method in class org.owasp.dependencycheck.concurrency.DirectorySpinLock
    -
    -
    Releases the lock.
    -
    releases - Variable in class org.owasp.dependencycheck.jaxb.pom.generated.Repository
     
    relocation - Variable in class org.owasp.dependencycheck.jaxb.pom.generated.DistributionManagement
    @@ -4849,7 +4746,8 @@
     
    remove() - Method in class org.owasp.dependencycheck.data.update.UpdateableNvdCve
    -
    Removes the current NvdCveInfo object from the collection.
    +
    + Removes the current NvdCveInfo object from the collection.
    removeProperty(String) - Static method in class org.owasp.dependencycheck.utils.Settings
    @@ -4861,7 +4759,7 @@
    The ReportGenerator is used to, as the name implies, generate reports.
    -
    ReportGenerator(String, List<Dependency>, List<Analyzer>) - Constructor for class org.owasp.dependencycheck.reporting.ReportGenerator
    +
    ReportGenerator(String, List<Dependency>, List<Analyzer>, DatabaseProperties) - Constructor for class org.owasp.dependencycheck.reporting.ReportGenerator
    Constructs a new ReportGenerator.
    @@ -4996,8 +4894,7 @@
    save(NvdCveInfo) - Method in class org.owasp.dependencycheck.data.nvdcve.DatabaseProperties
    -
    Writes a properties file containing the last updated date to the - VULNERABLE_CPE directory.
    +
    Writes a properties file containing the last updated date to the VULNERABLE_CPE directory.
    saveEntry(String, String, IndexWriter) - Method in class org.owasp.dependencycheck.data.cpe.CpeMemoryIndex
    @@ -5057,8 +4954,9 @@
    searchCPE(String, String, Set<String>, Set<String>) - Method in class org.owasp.dependencycheck.analyzer.CPEAnalyzer
    -
    Searches the Lucene CPE index to identify possible CPE entries - associated with the supplied vendor, product, and version.
    +
    + Searches the Lucene CPE index to identify possible CPE entries associated with the supplied vendor, product, and + version.
    SearchFieldAnalyzer - Class in org.owasp.dependencycheck.data.lucene
    @@ -5070,8 +4968,7 @@
    searchSha1(String) - Method in class org.owasp.dependencycheck.data.nexus.NexusSearch
    -
    Searches the configured Nexus repository for the given sha1 - hash.
    +
    Searches the configured Nexus repository for the given sha1 hash.
    SearchVersionAnalyzer - Class in org.owasp.dependencycheck.data.lucene
    @@ -5192,7 +5089,11 @@
    Sets the value of the comments property.
    -
    setConfidence(Evidence.Confidence) - Method in class org.owasp.dependencycheck.dependency.Evidence
    +
    setConfidence(Confidence) - Method in class org.owasp.dependencycheck.dependency.Evidence
    +
    +
    Set the value of confidence.
    +
    +
    setConfidence(Confidence) - Method in class org.owasp.dependencycheck.dependency.Identifier
    Set the value of confidence.
    @@ -5596,15 +5497,14 @@
    Sets the value of the mailingLists property.
    +
    setMatchedCPE(String, String) - Method in class org.owasp.dependencycheck.dependency.Vulnerability
    +
    +
    Sets the CPE that caused this vulnerability to be flagged.
    +
    setMaven(String) - Method in class org.owasp.dependencycheck.jaxb.pom.generated.Prerequisites
    Sets the value of the maven property.
    -
    setMaxWait(long) - Method in class org.owasp.dependencycheck.concurrency.DirectorySpinLock
    -
    -
    Set the maximum wait time, in seconds, that the spin lock will wait while - trying to obtain a lock.
    -
    setMd5sum(String) - Method in class org.owasp.dependencycheck.dependency.Dependency
    Sets the MD5 Checksum of the dependency.
    @@ -6067,7 +5967,8 @@
    setType(String) - Method in class org.owasp.dependencycheck.dependency.Identifier
    -
    Set the value of type.
    +
    + Set the value of type.
    setType(String) - Method in class org.owasp.dependencycheck.jaxb.pom.generated.Dependency
    @@ -6417,8 +6318,8 @@
     
    TokenPairConcatenatingFilter - Class in org.owasp.dependencycheck.data.lucene
    -
    Takes a TokenStream and adds additional tokens by concatenating pairs of - words.
    +
    + Takes a TokenStream and adds additional tokens by concatenating pairs of words.
    TokenPairConcatenatingFilter(TokenStream) - Constructor for class org.owasp.dependencycheck.data.lucene.TokenPairConcatenatingFilter
    @@ -6436,8 +6337,7 @@
     
    toString() - Method in class org.owasp.dependencycheck.dependency.Dependency
    -
    Standard toString() implementation showing the filename, actualFilePath, - and filePath.
    +
    Standard toString() implementation showing the filename, actualFilePath, and filePath.
    toString() - Method in class org.owasp.dependencycheck.dependency.EvidenceCollection
    @@ -6449,8 +6349,7 @@
    toString() - Method in class org.owasp.dependencycheck.dependency.VulnerableSoftware
    -
    Standard toString() implementation display the name and whether or not - previous versions are also affected.
    +
    Standard toString() implementation display the name and whether or not previous versions are also affected.
    toString() - Method in class org.owasp.dependencycheck.suppression.PropertyType
    @@ -6476,19 +6375,18 @@
     
    update() - Method in interface org.owasp.dependencycheck.data.update.CachedWebDataSource
    -
    Determines if an update to the current data store is needed, if it is the - new data is downloaded from the Internet and imported into the current - cached data store.
    +
    Determines if an update to the current data store is needed, if it is the new data is downloaded from the + Internet and imported into the current cached data store.
    update() - Method in class org.owasp.dependencycheck.data.update.NvdCveUpdater
    -
    Downloads the latest NVD CVE XML file from the web and imports it into - the current CVE Database.
    +
    + Downloads the latest NVD CVE XML file from the web and imports it into the current CVE Database.
    update() - Method in class org.owasp.dependencycheck.data.update.StandardUpdate
    -
    Downloads the latest NVD CVE XML file from the web and imports it into - the current CVE Database.
    +
    + Downloads the latest NVD CVE XML file from the web and imports it into the current CVE Database.
    UpdateableNvdCve - Class in org.owasp.dependencycheck.data.update
    @@ -6558,8 +6456,8 @@
     
    UrlTokenizingFilter - Class in org.owasp.dependencycheck.data.lucene
    -
    Takes a TokenStream and splits or adds tokens to correctly index version - numbers.
    +
    + Takes a TokenStream and splits or adds tokens to correctly index version numbers.
    UrlTokenizingFilter(TokenStream) - Constructor for class org.owasp.dependencycheck.data.lucene.UrlTokenizingFilter
    @@ -6577,7 +6475,7 @@
    Returns the enum constant of this type with the specified name.
    -
    valueOf(String) - Static method in enum org.owasp.dependencycheck.dependency.Evidence.Confidence
    +
    valueOf(String) - Static method in enum org.owasp.dependencycheck.dependency.Confidence
    Returns the enum constant of this type with the specified name.
    @@ -6590,7 +6488,7 @@
    Returns an array containing the constants of this enum type, in the order they are declared.
    -
    values() - Static method in enum org.owasp.dependencycheck.dependency.Evidence.Confidence
    +
    values() - Static method in enum org.owasp.dependencycheck.dependency.Confidence
    Returns an array containing the constants of this enum type, in the order they are declared.
    @@ -6602,9 +6500,9 @@ the order they are declared.
    VelocityLoggerRedirect - Class in org.owasp.dependencycheck.reporting
    -
    DependencyCheck uses Logger as a logging - framework, and Apache Velocity uses a custom logging implementation that - outputs to a file named velocity.log by default.
    +
    + DependencyCheck uses Logger as a logging framework, and Apache Velocity uses a custom + logging implementation that outputs to a file named velocity.log by default.
    VelocityLoggerRedirect() - Constructor for class org.owasp.dependencycheck.reporting.VelocityLoggerRedirect
     
    @@ -6696,8 +6594,7 @@ the order they are declared.
     
    VulnerabilitySuppressionAnalyzer - Class in org.owasp.dependencycheck.analyzer
    -
    The suppression analyzer processes an externally defined XML document that - complies with the suppressions.xsd schema.
    +
    The suppression analyzer processes an externally defined XML document that complies with the suppressions.xsd schema.
    VulnerabilitySuppressionAnalyzer() - Constructor for class org.owasp.dependencycheck.analyzer.VulnerabilitySuppressionAnalyzer
     
    @@ -6723,8 +6620,7 @@ the order they are declared.
    withinRange(long, long, int) - Method in class org.owasp.dependencycheck.data.update.StandardUpdate
    -
    Determines if the epoch date is within the range specified of the - compareTo epoch time.
    +
    Determines if the epoch date is within the range specified of the compareTo epoch time.
    A B C D E F G H I J L M N O P R S T U V W  diff --git a/dependency-check-core/apidocs/index.html b/dependency-check-core/apidocs/index.html index 1fb216898..9e78fa056 100644 --- a/dependency-check-core/apidocs/index.html +++ b/dependency-check-core/apidocs/index.html @@ -2,9 +2,9 @@ - + -Dependency-Check Core 1.0.8 API +Dependency-Check Core 1.1.0 API @@ -126,14 +126,6 @@ extends Creates a new Engine. - -Engine(boolean autoUpdate) -
    Deprecated.  -
    This function should no longer be used; the autoupdate flag should be set using: - Settings.setBoolean(Settings.KEYS.AUTO_UPDATE, value);
    -
    - - @@ -252,27 +244,13 @@ extends -
      +

      • Engine

        public Engine()
        Creates a new Engine.
      - - - -
        -
      • -

        Engine

        -
        @Deprecated
-public Engine(boolean autoUpdate)
        -
        Deprecated. This function should no longer be used; the autoupdate flag should be set using: - Settings.setBoolean(Settings.KEYS.AUTO_UPDATE, value);
        -
        Creates a new Engine.
        -
        Parameters:
        autoUpdate - indicates whether or not data should be updated from the Internet
        -
        • -
    diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/AbstractAnalyzer.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/AbstractAnalyzer.html index 195277a5c..84c4a3a32 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/AbstractAnalyzer.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/AbstractAnalyzer.html @@ -2,16 +2,16 @@ - + -AbstractAnalyzer (Dependency-Check Core 1.0.8 API) - +AbstractAnalyzer (Dependency-Check Core 1.1.0 API) + @@ -216,9 +216,8 @@ implements

    newHashSet

    protected static Set<String> newHashSet(String... strings)
    -
    Utility method to help in the creation of the extensions set. This - constructs a new Set that can be used in a final static - declaration.

    +
    Utility method to help in the creation of the extensions set. This constructs a new Set that can be used in a + final static declaration.

    This implementation was copied from http://stackoverflow.com/questions/2041778/initialize-java-hashset-values-by-construction
    diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/AbstractSuppressionAnalyzer.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/AbstractSuppressionAnalyzer.html index 44cee63ec..1cbf2c53f 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/AbstractSuppressionAnalyzer.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/AbstractSuppressionAnalyzer.html @@ -2,16 +2,16 @@ - + -AbstractSuppressionAnalyzer (Dependency-Check Core 1.0.8 API) - +AbstractSuppressionAnalyzer (Dependency-Check Core 1.1.0 API) + @@ -112,8 +112,7 @@ 
    public abstract class AbstractSuppressionAnalyzer
 extends AbstractAnalyzer
    -
    Abstract base suppression analyzer that contains methods for parsing the - suppression xml file.
    +
    Abstract base suppression analyzer that contains methods for parsing the suppression xml file.
    Author:
    Jeremy Long
    @@ -254,8 +253,7 @@ extends String extension)
    Returns whether or not this analyzer can process the given extension.
    Parameters:
    extension - the file extension to test for support.
    -
    Returns:
    whether or not the specified file extension is supported by this - analyzer.
    +
    Returns:
    whether or not the specified file extension is supported by this analyzer.
    diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/AnalysisException.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/AnalysisException.html index d005e7148..304eee8b3 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/AnalysisException.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/AnalysisException.html @@ -2,16 +2,16 @@ - + -AnalysisException (Dependency-Check Core 1.0.8 API) - +AnalysisException (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/AnalysisPhase.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/AnalysisPhase.html index 896bc5f84..136010453 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/AnalysisPhase.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/AnalysisPhase.html @@ -2,16 +2,16 @@ - + -AnalysisPhase (Dependency-Check Core 1.0.8 API) - +AnalysisPhase (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/Analyzer.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/Analyzer.html index 15a7f5820..cc3d0d9ae 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/Analyzer.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/Analyzer.html @@ -2,16 +2,16 @@ - + -Analyzer (Dependency-Check Core 1.0.8 API) - +Analyzer (Dependency-Check Core 1.1.0 API) + @@ -94,9 +94,8 @@ 

    public interface Analyzer
    -
    An interface that defines an Analyzer that is used to identify Dependencies. - An analyzer will collect information about the dependency in the form of - Evidence.
    +
    An interface that defines an Analyzer that is used to identify Dependencies. An analyzer will collect information + about the dependency in the form of Evidence.
    Author:
    Jeremy Long
    @@ -127,8 +126,7 @@ void     close() -
    The close method is called after all of the dependencies have been - analyzed.
    +
    The close method is called after all of the dependencies have been analyzed.
    @@ -146,14 +144,14 @@ Set<String> getSupportedExtensions() -
    Returns a list of supported file extensions.
    +
    + Returns a list of supported file extensions.
    void initialize() -
    The initialize method is called (once) prior to the analyze method being - called on all of the dependencies.
    +
    The initialize method is called (once) prior to the analyze method being called on all of the dependencies.
    @@ -186,15 +184,13 @@ 
    void analyze(Dependency dependency,
            Engine engine)
              throws AnalysisException
    -
    Analyzes the given dependency. The analysis could be anything from - identifying an Identifier for the dependency, to finding vulnerabilities, - etc. Additionally, if the analyzer collects enough information to add a - description or license information for the dependency it should be added.
    -
    Parameters:
    dependency - a dependency to analyze.
    engine - the engine that is scanning the dependencies - this is - useful if we need to check other dependencies
    +
    Analyzes the given dependency. The analysis could be anything from identifying an Identifier for the dependency, + to finding vulnerabilities, etc. Additionally, if the analyzer collects enough information to add a description + or license information for the dependency it should be added.
    +
    Parameters:
    dependency - a dependency to analyze.
    engine - the engine that is scanning the dependencies - this is useful if we need to check other + dependencies
    Throws:
    -
    AnalysisException - is thrown if there is an error analyzing the - dependency file
    +
    AnalysisException - is thrown if there is an error analyzing the dependency file
    @@ -204,16 +200,17 @@

  • getSupportedExtensions

    Set<String> getSupportedExtensions()
    -

    Returns a list of supported file extensions. An example would be an - analyzer that inspected java jar files. The getSupportedExtensions - function would return a set with a single element "jar".

    +

    + Returns a list of supported file extensions. An example would be an analyzer that inspected java jar files. The + getSupportedExtensions function would return a set with a single element "jar".

    -

    Note: when implementing this the extensions returned MUST be - lowercase.

    +

    + Note: when implementing this the extensions returned MUST be lowercase.

    Returns:
    The file extensions supported by this analyzer. -

    If the analyzer returns null it will not cause additional files to be - analyzed but will be executed against every file loaded

    +

    + If the analyzer returns null it will not cause additional files to be analyzed but will be executed against every + file loaded

    • @@ -236,8 +233,7 @@ 
    boolean supportsExtension(String extension)
    Returns whether or not this analyzer can process the given extension.
    Parameters:
    extension - the file extension to test for support.
    -
    Returns:
    whether or not the specified file extension is supported by this - analyzer.
    +
    Returns:
    whether or not the specified file extension is supported by this analyzer.
    @@ -259,11 +255,9 @@

    initialize

    void initialize()
                 throws Exception
    -
    The initialize method is called (once) prior to the analyze method being - called on all of the dependencies.
    +
    The initialize method is called (once) prior to the analyze method being called on all of the dependencies.
    Throws:
    -
    Exception - is thrown if an exception occurs initializing the - analyzer.
    +
    Exception - is thrown if an exception occurs initializing the analyzer.
    @@ -274,8 +268,7 @@

    close

    void close()
            throws Exception
    -
    The close method is called after all of the dependencies have been - analyzed.
    +
    The close method is called after all of the dependencies have been analyzed.
    Throws:
    Exception - is thrown if an exception occurs closing the analyzer.
    diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/AnalyzerService.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/AnalyzerService.html index 7a2cac3ba..de89e6019 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/AnalyzerService.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/AnalyzerService.html @@ -2,16 +2,16 @@ - + -AnalyzerService (Dependency-Check Core 1.0.8 API) - +AnalyzerService (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/ArchiveAnalyzer.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/ArchiveAnalyzer.html index 93910572a..6d946c88a 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/ArchiveAnalyzer.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/ArchiveAnalyzer.html @@ -2,16 +2,16 @@ - + -ArchiveAnalyzer (Dependency-Check Core 1.0.8 API) - +ArchiveAnalyzer (Dependency-Check Core 1.1.0 API) + @@ -109,8 +109,9 @@ 
    public class ArchiveAnalyzer
 extends AbstractAnalyzer
 implements Analyzer
    -

    An analyzer that extracts files from archives and ensures any supported - files contained within the archive are added to the dependency list.

    +

    + An analyzer that extracts files from archives and ensures any supported files contained within the archive are added + to the dependency list.

    Author:
    Jeremy Long
    @@ -277,8 +278,7 @@ implements supportsExtension in interface Analyzer
    Parameters:
    extension - the file extension to test for support.
    -
    Returns:
    whether or not the specified file extension is supported by this - analyzer.
    +
    Returns:
    whether or not the specified file extension is supported by this analyzer.
    @@ -310,8 +310,7 @@ implements initialize in class AbstractAnalyzer
    Throws:
    -
    Exception - is thrown if there is an exception deleting or creating - temporary files
    +
    Exception - is thrown if there is an exception deleting or creating temporary files
    @@ -329,8 +328,7 @@ implements close in class AbstractAnalyzer
    Throws:
    -
    Exception - thrown if there is an exception deleting temporary - files
    +
    Exception - thrown if there is an exception deleting temporary files
    @@ -342,9 +340,8 @@ implements Dependency dependency, Engine engine) throws AnalysisException -
    Analyzes a given dependency. If the dependency is an archive, such as a - WAR or EAR, the contents are extracted, scanned, and added to the list of - dependencies within the engine.
    +
    Analyzes a given dependency. If the dependency is an archive, such as a WAR or EAR, the contents are extracted, + scanned, and added to the list of dependencies within the engine.
    Specified by:
    analyze in interface Analyzer
    diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/ArchiveExtractionException.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/ArchiveExtractionException.html index cca1133f2..7dc5de0a2 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/ArchiveExtractionException.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/ArchiveExtractionException.html @@ -2,16 +2,16 @@ - + -ArchiveExtractionException (Dependency-Check Core 1.0.8 API) - +ArchiveExtractionException (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/CPEAnalyzer.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/CPEAnalyzer.html index 6346c6cfd..83af9882a 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/CPEAnalyzer.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/CPEAnalyzer.html @@ -2,16 +2,16 @@ - + -CPEAnalyzer (Dependency-Check Core 1.0.8 API) - +CPEAnalyzer (Dependency-Check Core 1.1.0 API) + @@ -104,9 +104,8 @@ 
    public class CPEAnalyzer
 extends Object
 implements Analyzer
    -
    CPEAnalyzer is a utility class that takes a project dependency and attempts - to discern if there is an associated CPE. It uses the evidence contained - within the dependency to search the Lucene index.
    +
    CPEAnalyzer is a utility class that takes a project dependency and attempts to discern if there is an associated CPE. + It uses the evidence contained within the dependency to search the Lucene index.
    Author:
    Jeremy Long
    @@ -148,8 +147,7 @@ implements void analyze(Dependency dependency, Engine engine) -
    Analyzes a dependency and attempts to determine if there are any CPE - identifiers for this dependency.
    +
    Analyzes a dependency and attempts to determine if there are any CPE identifiers for this dependency.
    @@ -158,8 +156,8 @@ implements String product, Set<String> vendorWeighting, Set<String> productWeightings) -
    Builds a Lucene search string by properly escaping data and - constructing a valid search query.
    +
    + Builds a Lucene search string by properly escaping data and constructing a valid search query.
    @@ -171,8 +169,8 @@ implements protected void determineCPE(Dependency dependency) -
    Searches the data store of CPE entries, trying to identify the CPE for - the given dependency based on the evidence contained within.
    +
    Searches the data store of CPE entries, trying to identify the CPE for the given dependency based on the evidence + contained within.
    @@ -211,8 +209,9 @@ implements String product, Set<String> vendorWeightings, Set<String> productWeightings) -
    Searches the Lucene CPE index to identify possible CPE entries - associated with the supplied vendor, product, and version.
    +
    + Searches the Lucene CPE index to identify possible CPE entries associated with the supplied vendor, product, and + version.
    @@ -271,10 +270,9 @@ implements DatabaseException
    Opens the data source.
    Throws:
    -
    IOException - when the Lucene directory to be queried does not - exist or is corrupt.
    -
    DatabaseException - when the database throws an exception. This - usually occurs when the database is in use by another process.
    +
    IOException - when the Lucene directory to be queried does not exist or is corrupt.
    +
    DatabaseException - when the database throws an exception. This usually occurs when the database is in use + by another process.
    @@ -301,9 +299,8 @@ implements IOException, org.apache.lucene.queryparser.classic.ParseException -
    Searches the data store of CPE entries, trying to identify the CPE for - the given dependency based on the evidence contained within. The - dependency passed in is updated with any identified CPE values.
    +
    Searches the data store of CPE entries, trying to identify the CPE for the given dependency based on the evidence + contained within. The dependency passed in is updated with any identified CPE values.
    Parameters:
    dependency - the dependency to search for CPE entries on.
    Throws:
    org.apache.lucene.index.CorruptIndexException - is thrown when the Lucene index is corrupt.
    @@ -324,14 +321,14 @@ implements IOException, org.apache.lucene.queryparser.classic.ParseException -

    Searches the Lucene CPE index to identify possible CPE entries - associated with the supplied vendor, product, and version.

    +

    + Searches the Lucene CPE index to identify possible CPE entries associated with the supplied vendor, product, and + version.

    -

    If either the vendorWeightings or productWeightings lists have been - populated this data is used to add weighting factors to the search.

    -
    Parameters:
    vendor - the text used to search the vendor field
    product - the text used to search the product field
    vendorWeightings - a list of strings to use to add weighting factors - to the vendor field
    productWeightings - Adds a list of strings that will be used to add - weighting factors to the product search
    +

    + If either the vendorWeightings or productWeightings lists have been populated this data is used to add weighting + factors to the search.

    +
    Parameters:
    vendor - the text used to search the vendor field
    product - the text used to search the product field
    vendorWeightings - a list of strings to use to add weighting factors to the vendor field
    productWeightings - Adds a list of strings that will be used to add weighting factors to the product search
    Returns:
    a list of possible CPE values
    Throws:
    org.apache.lucene.index.CorruptIndexException - when the Lucene index is corrupt
    @@ -349,15 +346,13 @@ implements String product, Set<String> vendorWeighting, Set<String> productWeightings) -

    Builds a Lucene search string by properly escaping data and - constructing a valid search query.

    +

    + Builds a Lucene search string by properly escaping data and constructing a valid search query.

    -

    If either the possibleVendor or possibleProducts lists have been - populated this data is used to add weighting factors to the search string - generated.

    -
    Parameters:
    vendor - text to search the vendor field
    product - text to search the product field
    vendorWeighting - a list of strings to apply to the vendor to boost - the terms weight
    productWeightings - a list of strings to apply to the product to - boost the terms weight
    +

    + If either the possibleVendor or possibleProducts lists have been populated this data is used to add weighting + factors to the search string generated.

    +
    Parameters:
    vendor - text to search the vendor field
    product - text to search the product field
    vendorWeighting - a list of strings to apply to the vendor to boost the terms weight
    productWeightings - a list of strings to apply to the product to boost the terms weight
    Returns:
    the Lucene query
    @@ -370,15 +365,13 @@ implements Dependency dependency, Engine engine) throws AnalysisException -
    Analyzes a dependency and attempts to determine if there are any CPE - identifiers for this dependency.
    +
    Analyzes a dependency and attempts to determine if there are any CPE identifiers for this dependency.
    Specified by:
    analyze in interface Analyzer
    Parameters:
    dependency - The Dependency to analyze.
    engine - The analysis engine
    Throws:
    -
    AnalysisException - is thrown if there is an issue analyzing the - dependency.
    +
    AnalysisException - is thrown if there is an issue analyzing the dependency.
    diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/CpeSuppressionAnalyzer.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/CpeSuppressionAnalyzer.html index cf67db1f9..67ce570ab 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/CpeSuppressionAnalyzer.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/CpeSuppressionAnalyzer.html @@ -2,16 +2,16 @@ - + -CpeSuppressionAnalyzer (Dependency-Check Core 1.0.8 API) - +CpeSuppressionAnalyzer (Dependency-Check Core 1.1.0 API) + @@ -113,9 +113,8 @@ 
    public class CpeSuppressionAnalyzer
 extends AbstractSuppressionAnalyzer
    -
    The suppression analyzer processes an externally defined XML document that - complies with the suppressions.xsd schema. Any identified CPE entries within - the dependencies that match will be removed.
    +
    The suppression analyzer processes an externally defined XML document that complies with the suppressions.xsd schema. + Any identified CPE entries within the dependencies that match will be removed.
    Author:
    Jeremy Long
    @@ -257,15 +256,13 @@ extends Engine engine) throws AnalysisException
    Description copied from interface: Analyzer
    -
    Analyzes the given dependency. The analysis could be anything from - identifying an Identifier for the dependency, to finding vulnerabilities, - etc. Additionally, if the analyzer collects enough information to add a - description or license information for the dependency it should be added.
    -
    Parameters:
    dependency - a dependency to analyze.
    engine - the engine that is scanning the dependencies - this is - useful if we need to check other dependencies
    +
    Analyzes the given dependency. The analysis could be anything from identifying an Identifier for the dependency, + to finding vulnerabilities, etc. Additionally, if the analyzer collects enough information to add a description + or license information for the dependency it should be added.
    +
    Parameters:
    dependency - a dependency to analyze.
    engine - the engine that is scanning the dependencies - this is useful if we need to check other + dependencies
    Throws:
    -
    AnalysisException - is thrown if there is an error analyzing the - dependency file
    +
    AnalysisException - is thrown if there is an error analyzing the dependency file
    diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/DependencyBundlingAnalyzer.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/DependencyBundlingAnalyzer.html index b74a84c52..675223fe1 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/DependencyBundlingAnalyzer.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/DependencyBundlingAnalyzer.html @@ -2,16 +2,16 @@ - + -DependencyBundlingAnalyzer (Dependency-Check Core 1.0.8 API) - +DependencyBundlingAnalyzer (Dependency-Check Core 1.1.0 API) + @@ -109,13 +109,12 @@ 
    public class DependencyBundlingAnalyzer
 extends AbstractAnalyzer
 implements Analyzer
    -

    This analyzer ensures dependencies that should be grouped together, to - remove excess noise from the report, are grouped. An example would be Spring, - Spring Beans, Spring MVC, etc. If they are all for the same version and have - the same relative path then these should be grouped into a single dependency - under the core/main library.

    -

    Note, this grouping only works on dependencies with identified CVE - entries

    +

    + This analyzer ensures dependencies that should be grouped together, to remove excess noise from the report, are + grouped. An example would be Spring, Spring Beans, Spring MVC, etc. If they are all for the same version and have the + same relative path then these should be grouped into a single dependency under the core/main library.

    +

    + Note, this grouping only works on dependencies with identified CVE entries

    Author:
    Jeremy Long
    @@ -277,8 +276,7 @@ implements supportsExtension in interface Analyzer
    Parameters:
    extension - the file extension to test for support
    -
    Returns:
    whether or not the specified file extension is supported by this - analyzer.
    +
    Returns:
    whether or not the specified file extension is supported by this analyzer.
    @@ -304,16 +302,14 @@ implements Dependency ignore, Engine engine) throws AnalysisException -
    Analyzes a set of dependencies. If they have been found to have the same - base path and the same set of identifiers they are likely related. The - related dependencies are bundled into a single reportable item.
    +
    Analyzes a set of dependencies. If they have been found to have the same base path and the same set of + identifiers they are likely related. The related dependencies are bundled into a single reportable item.
    Specified by:
    analyze in interface Analyzer
    Parameters:
    ignore - this analyzer ignores the dependency being analyzed
    engine - the engine that is scanning the dependencies
    Throws:
    -
    AnalysisException - is thrown if there is an error reading the JAR - file.
    +
    AnalysisException - is thrown if there is an error reading the JAR file.
    diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/FalsePositiveAnalyzer.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/FalsePositiveAnalyzer.html index def7b0a00..cc630720c 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/FalsePositiveAnalyzer.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/FalsePositiveAnalyzer.html @@ -2,16 +2,16 @@ - + -FalsePositiveAnalyzer (Dependency-Check Core 1.0.8 API) - +FalsePositiveAnalyzer (Dependency-Check Core 1.1.0 API) + @@ -108,8 +108,7 @@ 
    public class FalsePositiveAnalyzer
 extends AbstractAnalyzer
    -
    This analyzer attempts to remove some well known false positives - - specifically regarding the java runtime.
    +
    This analyzer attempts to remove some well known false positives - specifically regarding the java runtime.
    Author:
    Jeremy Long
    @@ -139,8 +138,7 @@ extends static Pattern CORE_JAVA -
    Regex to identify core java libraries and a few other commonly - misidentified ones.
    +
    Regex to identify core java libraries and a few other commonly misidentified ones.
    @@ -179,8 +177,7 @@ extends void analyze(Dependency dependency, Engine engine) -
    Analyzes the dependencies and removes bad/incorrect CPE associations - based on various heuristics.
    +
    Analyzes the dependencies and removes bad/incorrect CPE associations based on various heuristics.
    @@ -243,8 +240,7 @@ extends

    CORE_JAVA

    public static final Pattern CORE_JAVA
    -
    Regex to identify core java libraries and a few other commonly - misidentified ones.
    +
    Regex to identify core java libraries and a few other commonly misidentified ones.
    @@ -313,8 +309,7 @@ extends String extension)
    Returns whether or not this analyzer can process the given extension.
    Parameters:
    extension - the file extension to test for support
    -
    Returns:
    whether or not the specified file extension is supported by this - analyzer.
    +
    Returns:
    whether or not the specified file extension is supported by this analyzer.
    @@ -337,12 +332,10 @@ extends Dependency dependency, Engine engine) throws AnalysisException -
    Analyzes the dependencies and removes bad/incorrect CPE associations - based on various heuristics.
    +
    Analyzes the dependencies and removes bad/incorrect CPE associations based on various heuristics.
    Parameters:
    dependency - the dependency to analyze.
    engine - the engine that is scanning the dependencies
    Throws:
    -
    AnalysisException - is thrown if there is an error reading the JAR - file.
    +
    AnalysisException - is thrown if there is an error reading the JAR file.
    diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/FileNameAnalyzer.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/FileNameAnalyzer.html index 3f4211977..78e0bfce3 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/FileNameAnalyzer.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/FileNameAnalyzer.html @@ -2,16 +2,16 @@ - + -FileNameAnalyzer (Dependency-Check Core 1.0.8 API) - +FileNameAnalyzer (Dependency-Check Core 1.1.0 API) + @@ -271,8 +271,7 @@ implements supportsExtension in interface Analyzer
    Parameters:
    extension - the file extension to test for support.
    -
    Returns:
    whether or not the specified file extension is supported by this - analyzer.
    +
    Returns:
    whether or not the specified file extension is supported by this analyzer.
    @@ -304,8 +303,7 @@ implements analyze in interface Analyzer
    Parameters:
    dependency - the dependency to analyze.
    engine - the engine that is scanning the dependencies
    Throws:
    -
    AnalysisException - is thrown if there is an error reading the JAR - file.
    +
    AnalysisException - is thrown if there is an error reading the JAR file.
    diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/HintAnalyzer.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/HintAnalyzer.html index 0a8f907b3..98367d478 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/HintAnalyzer.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/HintAnalyzer.html @@ -2,16 +2,16 @@ - + -HintAnalyzer (Dependency-Check Core 1.0.8 API) - +HintAnalyzer (Dependency-Check Core 1.1.0 API) + @@ -150,8 +150,8 @@ implements void analyze(Dependency dependency, Engine engine) -
    The HintAnalyzer uses knowledge about a dependency to add additional - information to help in identification of identifiers or vulnerabilities.
    +
    The HintAnalyzer uses knowledge about a dependency to add additional information to help in identification of + identifiers or vulnerabilities.
    @@ -271,8 +271,7 @@ implements supportsExtension in interface Analyzer
    Parameters:
    extension - the file extension to test for support.
    -
    Returns:
    whether or not the specified file extension is supported by this - analyzer.
    +
    Returns:
    whether or not the specified file extension is supported by this analyzer.
    @@ -298,15 +297,14 @@ implements Dependency dependency, Engine engine) throws AnalysisException -
    The HintAnalyzer uses knowledge about a dependency to add additional - information to help in identification of identifiers or vulnerabilities.
    +
    The HintAnalyzer uses knowledge about a dependency to add additional information to help in identification of + identifiers or vulnerabilities.
    Specified by:
    analyze in interface Analyzer
    Parameters:
    dependency - The dependency being analyzed
    engine - The scanning engine
    Throws:
    -
    AnalysisException - is thrown if there is an exception analyzing - the dependency.
    +
    AnalysisException - is thrown if there is an exception analyzing the dependency.
    diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/JarAnalyzer.ClassNameInformation.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/JarAnalyzer.ClassNameInformation.html index 2934dbc92..95e5844b6 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/JarAnalyzer.ClassNameInformation.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/JarAnalyzer.ClassNameInformation.html @@ -2,16 +2,16 @@ - + -JarAnalyzer.ClassNameInformation (Dependency-Check Core 1.0.8 API) - +JarAnalyzer.ClassNameInformation (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/JarAnalyzer.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/JarAnalyzer.html index 1e3244b2f..449cb6efc 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/JarAnalyzer.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/JarAnalyzer.html @@ -2,16 +2,16 @@ - + -JarAnalyzer (Dependency-Check Core 1.0.8 API) - +JarAnalyzer (Dependency-Check Core 1.1.0 API) + @@ -109,8 +109,7 @@ 
    public class JarAnalyzer
 extends AbstractAnalyzer
 implements Analyzer
    -
    Used to load a JAR file and collect information that can be used to determine - the associated CPE.
    +
    Used to load a JAR file and collect information that can be used to determine the associated CPE.
    Author:
    Jeremy Long
    @@ -175,8 +174,8 @@ implements void analyze(Dependency dependency, Engine engine) -
    Loads a specified JAR file and collects information from the manifest and - checksums to identify the correct CPE information.
    +
    Loads a specified JAR file and collects information from the manifest and checksums to identify the correct CPE + information.
    @@ -184,21 +183,22 @@ implements analyzePackageNames(ArrayList<JarAnalyzer.ClassNameInformation> classNames, Dependency dependency, boolean addPackagesAsEvidence) -
    Analyzes the path information of the classes contained within the - JarAnalyzer to try and determine possible vendor or product names.
    +
    Analyzes the path information of the classes contained within the JarAnalyzer to try and determine possible + vendor or product names.
    protected boolean -analyzePOM(Dependency dependency, - ArrayList<JarAnalyzer.ClassNameInformation> classes) +analyzePOM(Dependency dependency, + ArrayList<JarAnalyzer.ClassNameInformation> classes, + Engine engine)
    Attempts to find a pom.xml within the JAR file.
    void close() -
    The close method does nothing for this Analyzer.
    +
    Deletes any files extracted from the JAR during analysis.
    @@ -229,15 +229,16 @@ implements protected String interpolateString(String text, Properties properties) -
    A utility function that will interpolate strings based on values given - in the properties file.
    +
    + A utility function that will interpolate strings based on values given in the properties file.
    protected boolean parseManifest(Dependency dependency, ArrayList<JarAnalyzer.ClassNameInformation> classInformation) -
    Reads the manifest from the JAR file and collects the entries.
    +
    + Reads the manifest from the JAR file and collects the entries.
    @@ -333,8 +334,7 @@ implements supportsExtension in interface Analyzer
    Parameters:
    extension - the file extension to test for support.
    -
    Returns:
    whether or not the specified file extension is supported by this - analyzer.
    +
    Returns:
    whether or not the specified file extension is supported by this analyzer.
    @@ -360,34 +360,32 @@ implements Dependency dependency, Engine engine) throws AnalysisException -
    Loads a specified JAR file and collects information from the manifest and - checksums to identify the correct CPE information.
    +
    Loads a specified JAR file and collects information from the manifest and checksums to identify the correct CPE + information.
    Specified by:
    analyze in interface Analyzer
    Parameters:
    dependency - the dependency to analyze.
    engine - the engine that is scanning the dependencies
    Throws:
    -
    AnalysisException - is thrown if there is an error reading the JAR - file.
    +
    AnalysisException - is thrown if there is an error reading the JAR file.
    - +

    • analyzePOM

      protected boolean analyzePOM(Dependency dependency,
-                 ArrayList<JarAnalyzer.ClassNameInformation> classes)
+                 ArrayList<JarAnalyzer.ClassNameInformation> classes,
+                 Engine engine)
                       throws AnalysisException
      -
      Attempts to find a pom.xml within the JAR file. If found it extracts - information and adds it to the evidence. This will attempt to interpolate - the strings contained within the pom.properties if one exists.
      -
      Parameters:
      dependency - the dependency being analyzed
      classes - a collection of class name information
      +
      Attempts to find a pom.xml within the JAR file. If found it extracts information and adds it to the evidence. + This will attempt to interpolate the strings contained within the pom.properties if one exists.
      +
      Parameters:
      dependency - the dependency being analyzed
      classes - a collection of class name information
      engine - the analysis engine, used to add additional dependencies
      Returns:
      whether or not evidence was added to the dependency
      Throws:
      -
      AnalysisException - is thrown if there is an exception parsing the - pom
      +
      AnalysisException - is thrown if there is an exception parsing the pom
    @@ -399,12 +397,9 @@ implements ArrayList<JarAnalyzer.ClassNameInformation> classNames, Dependency dependency, boolean addPackagesAsEvidence) -
    Analyzes the path information of the classes contained within the - JarAnalyzer to try and determine possible vendor or product names. If any - are found they are stored in the packageVendor and packageProduct - hashSets.
    -
    Parameters:
    classNames - a list of class names
    dependency - a dependency to analyze
    addPackagesAsEvidence - a flag indicating whether or not package - names should be added as evidence.
    +
    Analyzes the path information of the classes contained within the JarAnalyzer to try and determine possible + vendor or product names. If any are found they are stored in the packageVendor and packageProduct hashSets.
    +
    Parameters:
    classNames - a list of class names
    dependency - a dependency to analyze
    addPackagesAsEvidence - a flag indicating whether or not package names should be added as evidence.
    @@ -416,12 +411,12 @@ implements Dependency dependency, ArrayList<JarAnalyzer.ClassNameInformation> classInformation) throws IOException -

    Reads the manifest from the JAR file and collects the entries. Some - vendorKey entries are:

    • Implementation Title
      • +

      + Reads the manifest from the JAR file and collects the entries. Some vendorKey entries are:

      +
      • Implementation Title
      • Implementation Version
      • Implementation Vendor
        • -
      • Implementation VendorId
      • Bundle Name
      • Bundle - Version
      • Bundle Vendor
      • Bundle Description
      • Main - Class
      +
    • Implementation VendorId
    • Bundle Name
    • Bundle Version
    • Bundle Vendor
    • Bundle + Description
    • Main Class
    However, all but a handful of specific entries are read in.
    Parameters:
    dependency - A reference to the dependency
    classInformation - a collection of class information
    Returns:
    whether evidence was identified parsing the manifest
    @@ -435,14 +430,16 @@ implements

  • initialize

    -
    public void initialize()
    +
    public void initialize()
+                throws Exception
    The initialize method does nothing for this Analyzer.
    Specified by:
    initialize in interface Analyzer
    Overrides:
    initialize in class AbstractAnalyzer
    -
    +
    Throws:
    +
    Exception - is thrown if there is an exception creating a temporary directory
    • @@ -452,7 +449,7 @@ implements

    close

    public void close()
    -
    The close method does nothing for this Analyzer.
    +
    Deletes any files extracted from the JAR during analysis.
    Specified by:
    close in interface Analyzer
    @@ -469,27 +466,28 @@ implements String interpolateString(String text, Properties properties) -

    A utility function that will interpolate strings based on values given - in the properties file. It will also interpolate the strings contained - within the properties file so that properties can reference other +

    + A utility function that will interpolate strings based on values given in the properties file. It will also + interpolate the strings contained within the properties file so that properties can reference other properties.

    -

    Note: if there is no property found the reference will be - removed. In other words, if the interpolated string will be replaced with - an empty string. +

    + Note: if there is no property found the reference will be removed. In other words, if the interpolated + string will be replaced with an empty string.

    -

    Example:

    +

    + Example:

    Properties p = new Properties(); p.setProperty("key", "value"); String s = interpolateString("'${key}' and '${nothing}'", p); System.out.println(s); -

    Will result in:

    +

    + Will result in:

    'value' and ''
    -
    Parameters:
    text - the string that contains references to properties.
    properties - a collection of properties that may be referenced - within the text.
    +
    Parameters:
    text - the string that contains references to properties.
    properties - a collection of properties that may be referenced within the text.
    Returns:
    the interpolated text.
    diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/JavaScriptAnalyzer.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/JavaScriptAnalyzer.html index 15de2d988..3c93ecf9b 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/JavaScriptAnalyzer.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/JavaScriptAnalyzer.html @@ -2,16 +2,16 @@ - + -JavaScriptAnalyzer (Dependency-Check Core 1.0.8 API) - +JavaScriptAnalyzer (Dependency-Check Core 1.1.0 API) + @@ -109,8 +109,7 @@ 
    public class JavaScriptAnalyzer
 extends AbstractAnalyzer
 implements Analyzer
    -
    Used to load a JAR file and collect information that can be used to determine - the associated CPE.
    +
    Used to load a JAR file and collect information that can be used to determine the associated CPE.
    Author:
    Jeremy Long
    @@ -152,8 +151,8 @@ implements void analyze(Dependency dependency, Engine engine) -
    Loads a specified JAR file and collects information from the manifest and - checksums to identify the correct CPE information.
    +
    Loads a specified JAR file and collects information from the manifest and checksums to identify the correct CPE + information.
    @@ -278,8 +277,7 @@ implements supportsExtension in interface Analyzer
    Parameters:
    extension - the file extension to test for support.
    -
    Returns:
    whether or not the specified file extension is supported by this - analyzer.
    +
    Returns:
    whether or not the specified file extension is supported by this analyzer.
    @@ -305,15 +303,14 @@ implements Dependency dependency, Engine engine) throws AnalysisException -
    Loads a specified JAR file and collects information from the manifest and - checksums to identify the correct CPE information.
    +
    Loads a specified JAR file and collects information from the manifest and checksums to identify the correct CPE + information.
    Specified by:
    analyze in interface Analyzer
    Parameters:
    dependency - the dependency to analyze.
    engine - the engine that is scanning the dependencies
    Throws:
    -
    AnalysisException - is thrown if there is an error reading the JAR - file.
    +
    AnalysisException - is thrown if there is an error reading the JAR file.
    diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/NexusAnalyzer.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/NexusAnalyzer.html index f26523663..dd63799fc 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/NexusAnalyzer.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/NexusAnalyzer.html @@ -2,16 +2,16 @@ - + -NexusAnalyzer (Dependency-Check Core 1.0.8 API) - +NexusAnalyzer (Dependency-Check Core 1.1.0 API) + @@ -108,18 +108,15 @@ 
    public class NexusAnalyzer
 extends AbstractAnalyzer
    -
    Analyzer which will attempt to locate a dependency on a Nexus service - by SHA-1 digest of the dependency. +
    Analyzer which will attempt to locate a dependency on a Nexus service by SHA-1 digest of the dependency. There are two settings which govern this behavior:
    Author:
    colezlaw
    @@ -256,7 +253,7 @@ extends initialize in class AbstractAnalyzer
    Throws:
    -
    Exception - if there's an error during initialization.
    +
    Exception - if there's an error during initialization
    diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/NvdCveAnalyzer.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/NvdCveAnalyzer.html index 98c7aeb26..41a3889a4 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/NvdCveAnalyzer.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/NvdCveAnalyzer.html @@ -2,16 +2,16 @@ - + -NvdCveAnalyzer (Dependency-Check Core 1.0.8 API) - +NvdCveAnalyzer (Dependency-Check Core 1.1.0 API) + @@ -104,9 +104,8 @@ 
    public class NvdCveAnalyzer
 extends Object
 implements Analyzer
    -
    NvdCveAnalyzer is a utility class that takes a project dependency and - attempts to discern if there is an associated CVEs. It uses the the - identifiers found by other analyzers to lookup the CVE data.
    +
    NvdCveAnalyzer is a utility class that takes a project dependency and attempts to discern if there is an associated + CVEs. It uses the the identifiers found by other analyzers to lookup the CVE data.
    Author:
    Jeremy Long
    @@ -148,8 +147,7 @@ implements void analyze(Dependency dependency, Engine engine) -
    Analyzes a dependency and attempts to determine if there are any CPE - identifiers for this dependency.
    +
    Analyzes a dependency and attempts to determine if there are any CPE identifiers for this dependency.
    @@ -261,8 +259,7 @@ implements SQLException - thrown when there is a SQL Exception
    IOException - thrown when there is an IO Exception
    DatabaseException - thrown when there is a database exceptions
    -
    ClassNotFoundException - thrown if the h2 database driver cannot be - loaded
    +
    ClassNotFoundException - thrown if the h2 database driver cannot be loaded
    @@ -315,15 +312,13 @@ implements Dependency dependency, Engine engine) throws AnalysisException -
    Analyzes a dependency and attempts to determine if there are any CPE - identifiers for this dependency.
    +
    Analyzes a dependency and attempts to determine if there are any CPE identifiers for this dependency.
    Specified by:
    analyze in interface Analyzer
    Parameters:
    dependency - The Dependency to analyze
    engine - The analysis engine
    Throws:
    -
    AnalysisException - is thrown if there is an issue analyzing the - dependency
    +
    AnalysisException - is thrown if there is an issue analyzing the dependency
    diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/VulnerabilitySuppressionAnalyzer.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/VulnerabilitySuppressionAnalyzer.html index 339f5cbae..882160081 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/VulnerabilitySuppressionAnalyzer.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/VulnerabilitySuppressionAnalyzer.html @@ -2,16 +2,16 @@ - + -VulnerabilitySuppressionAnalyzer (Dependency-Check Core 1.0.8 API) - +VulnerabilitySuppressionAnalyzer (Dependency-Check Core 1.1.0 API) + @@ -113,9 +113,8 @@ 
    public class VulnerabilitySuppressionAnalyzer
 extends AbstractSuppressionAnalyzer
    -
    The suppression analyzer processes an externally defined XML document that - complies with the suppressions.xsd schema. Any identified Vulnerability - entries within the dependencies that match will be removed.
    +
    The suppression analyzer processes an externally defined XML document that complies with the suppressions.xsd schema. + Any identified Vulnerability entries within the dependencies that match will be removed.
    Author:
    Jeremy Long
    @@ -257,15 +256,13 @@ extends Engine engine) throws AnalysisException
    Description copied from interface: Analyzer
    -
    Analyzes the given dependency. The analysis could be anything from - identifying an Identifier for the dependency, to finding vulnerabilities, - etc. Additionally, if the analyzer collects enough information to add a - description or license information for the dependency it should be added.
    -
    Parameters:
    dependency - a dependency to analyze.
    engine - the engine that is scanning the dependencies - this is - useful if we need to check other dependencies
    +
    Analyzes the given dependency. The analysis could be anything from identifying an Identifier for the dependency, + to finding vulnerabilities, etc. Additionally, if the analyzer collects enough information to add a description + or license information for the dependency it should be added.
    +
    Parameters:
    dependency - a dependency to analyze.
    engine - the engine that is scanning the dependencies - this is useful if we need to check other + dependencies
    Throws:
    -
    AnalysisException - is thrown if there is an error analyzing the - dependency file
    +
    AnalysisException - is thrown if there is an error analyzing the dependency file
    diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/AbstractAnalyzer.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/AbstractAnalyzer.html index 47d62c133..7bd7cf0d7 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/AbstractAnalyzer.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/AbstractAnalyzer.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.analyzer.AbstractAnalyzer (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.analyzer.AbstractAnalyzer (Dependency-Check Core 1.1.0 API) + @@ -107,36 +107,35 @@ class  AbstractSuppressionAnalyzer -
    Abstract base suppression analyzer that contains methods for parsing the - suppression xml file.
    +
    Abstract base suppression analyzer that contains methods for parsing the suppression xml file.
    class  ArchiveAnalyzer -
    An analyzer that extracts files from archives and ensures any supported - files contained within the archive are added to the dependency list.
    +
    + An analyzer that extracts files from archives and ensures any supported files contained within the archive are added + to the dependency list.
    class  CpeSuppressionAnalyzer -
    The suppression analyzer processes an externally defined XML document that - complies with the suppressions.xsd schema.
    +
    The suppression analyzer processes an externally defined XML document that complies with the suppressions.xsd schema.
    class  DependencyBundlingAnalyzer -
    This analyzer ensures dependencies that should be grouped together, to - remove excess noise from the report, are grouped.
    +
    + This analyzer ensures dependencies that should be grouped together, to remove excess noise from the report, are + grouped.
    class  FalsePositiveAnalyzer -
    This analyzer attempts to remove some well known false positives - - specifically regarding the java runtime.
    +
    This analyzer attempts to remove some well known false positives - specifically regarding the java runtime.
    @@ -152,29 +151,25 @@ class  JarAnalyzer -
    Used to load a JAR file and collect information that can be used to determine - the associated CPE.
    +
    Used to load a JAR file and collect information that can be used to determine the associated CPE.
    class  JavaScriptAnalyzer -
    Used to load a JAR file and collect information that can be used to determine - the associated CPE.
    +
    Used to load a JAR file and collect information that can be used to determine the associated CPE.
    class  NexusAnalyzer -
    Analyzer which will attempt to locate a dependency on a Nexus service - by SHA-1 digest of the dependency.
    +
    Analyzer which will attempt to locate a dependency on a Nexus service by SHA-1 digest of the dependency.
    class  VulnerabilitySuppressionAnalyzer -
    The suppression analyzer processes an externally defined XML document that - complies with the suppressions.xsd schema.
    +
    The suppression analyzer processes an externally defined XML document that complies with the suppressions.xsd schema.
    diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/AbstractSuppressionAnalyzer.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/AbstractSuppressionAnalyzer.html index c28c348b4..19d48fe6e 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/AbstractSuppressionAnalyzer.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/AbstractSuppressionAnalyzer.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.analyzer.AbstractSuppressionAnalyzer (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.analyzer.AbstractSuppressionAnalyzer (Dependency-Check Core 1.1.0 API) + @@ -107,15 +107,13 @@ class  CpeSuppressionAnalyzer -
    The suppression analyzer processes an externally defined XML document that - complies with the suppressions.xsd schema.
    +
    The suppression analyzer processes an externally defined XML document that complies with the suppressions.xsd schema.
    class  VulnerabilitySuppressionAnalyzer -
    The suppression analyzer processes an externally defined XML document that - complies with the suppressions.xsd schema.
    +
    The suppression analyzer processes an externally defined XML document that complies with the suppressions.xsd schema.
    diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/AnalysisException.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/AnalysisException.html index 9acf7db39..55f089a19 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/AnalysisException.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/AnalysisException.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.analyzer.AnalysisException (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.analyzer.AnalysisException (Dependency-Check Core 1.1.0 API) + @@ -113,8 +113,7 @@ void NvdCveAnalyzer.analyze(Dependency dependency, Engine engine) -
    Analyzes a dependency and attempts to determine if there are any CPE - identifiers for this dependency.
    +
    Analyzes a dependency and attempts to determine if there are any CPE identifiers for this dependency.
    @@ -128,24 +127,24 @@ void JavaScriptAnalyzer.analyze(Dependency dependency, Engine engine) -
    Loads a specified JAR file and collects information from the manifest and - checksums to identify the correct CPE information.
    +
    Loads a specified JAR file and collects information from the manifest and checksums to identify the correct CPE + information.
    void JarAnalyzer.analyze(Dependency dependency, Engine engine) -
    Loads a specified JAR file and collects information from the manifest and - checksums to identify the correct CPE information.
    +
    Loads a specified JAR file and collects information from the manifest and checksums to identify the correct CPE + information.
    void HintAnalyzer.analyze(Dependency dependency, Engine engine) -
    The HintAnalyzer uses knowledge about a dependency to add additional - information to help in identification of identifiers or vulnerabilities.
    +
    The HintAnalyzer uses knowledge about a dependency to add additional information to help in identification of + identifiers or vulnerabilities.
    @@ -159,8 +158,7 @@ void FalsePositiveAnalyzer.analyze(Dependency dependency, Engine engine) -
    Analyzes the dependencies and removes bad/incorrect CPE associations - based on various heuristics.
    +
    Analyzes the dependencies and removes bad/incorrect CPE associations based on various heuristics.
    @@ -179,8 +177,7 @@ void CPEAnalyzer.analyze(Dependency dependency, Engine engine) -
    Analyzes a dependency and attempts to determine if there are any CPE - identifiers for this dependency.
    +
    Analyzes a dependency and attempts to determine if there are any CPE identifiers for this dependency.
    @@ -199,8 +196,9 @@ protected boolean -JarAnalyzer.analyzePOM(Dependency dependency, - ArrayList<JarAnalyzer.ClassNameInformation> classes) +JarAnalyzer.analyzePOM(Dependency dependency, + ArrayList<JarAnalyzer.ClassNameInformation> classes, + Engine engine)
    Attempts to find a pom.xml within the JAR file.
    diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/AnalysisPhase.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/AnalysisPhase.html index 238e2675d..fb68bb007 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/AnalysisPhase.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/AnalysisPhase.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.analyzer.AnalysisPhase (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.analyzer.AnalysisPhase (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/Analyzer.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/Analyzer.html index 933dc75dc..166ceb107 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/Analyzer.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/Analyzer.html @@ -2,16 +2,16 @@ - + -Uses of Interface org.owasp.dependencycheck.analyzer.Analyzer (Dependency-Check Core 1.0.8 API) - +Uses of Interface org.owasp.dependencycheck.analyzer.Analyzer (Dependency-Check Core 1.1.0 API) + @@ -159,43 +159,41 @@ class  AbstractSuppressionAnalyzer -
    Abstract base suppression analyzer that contains methods for parsing the - suppression xml file.
    +
    Abstract base suppression analyzer that contains methods for parsing the suppression xml file.
    class  ArchiveAnalyzer -
    An analyzer that extracts files from archives and ensures any supported - files contained within the archive are added to the dependency list.
    +
    + An analyzer that extracts files from archives and ensures any supported files contained within the archive are added + to the dependency list.
    class  CPEAnalyzer -
    CPEAnalyzer is a utility class that takes a project dependency and attempts - to discern if there is an associated CPE.
    +
    CPEAnalyzer is a utility class that takes a project dependency and attempts to discern if there is an associated CPE.
    class  CpeSuppressionAnalyzer -
    The suppression analyzer processes an externally defined XML document that - complies with the suppressions.xsd schema.
    +
    The suppression analyzer processes an externally defined XML document that complies with the suppressions.xsd schema.
    class  DependencyBundlingAnalyzer -
    This analyzer ensures dependencies that should be grouped together, to - remove excess noise from the report, are grouped.
    +
    + This analyzer ensures dependencies that should be grouped together, to remove excess noise from the report, are + grouped.
    class  FalsePositiveAnalyzer -
    This analyzer attempts to remove some well known false positives - - specifically regarding the java runtime.
    +
    This analyzer attempts to remove some well known false positives - specifically regarding the java runtime.
    @@ -211,36 +209,32 @@ class  JarAnalyzer -
    Used to load a JAR file and collect information that can be used to determine - the associated CPE.
    +
    Used to load a JAR file and collect information that can be used to determine the associated CPE.
    class  JavaScriptAnalyzer -
    Used to load a JAR file and collect information that can be used to determine - the associated CPE.
    +
    Used to load a JAR file and collect information that can be used to determine the associated CPE.
    class  NexusAnalyzer -
    Analyzer which will attempt to locate a dependency on a Nexus service - by SHA-1 digest of the dependency.
    +
    Analyzer which will attempt to locate a dependency on a Nexus service by SHA-1 digest of the dependency.
    class  NvdCveAnalyzer -
    NvdCveAnalyzer is a utility class that takes a project dependency and - attempts to discern if there is an associated CVEs.
    +
    NvdCveAnalyzer is a utility class that takes a project dependency and attempts to discern if there is an associated + CVEs.
    class  VulnerabilitySuppressionAnalyzer -
    The suppression analyzer processes an externally defined XML document that - complies with the suppressions.xsd schema.
    +
    The suppression analyzer processes an externally defined XML document that complies with the suppressions.xsd schema.
    @@ -272,9 +266,10 @@ -ReportGenerator(String applicationName, +ReportGenerator(String applicationName, List<Dependency> dependencies, - List<Analyzer> analyzers) + List<Analyzer> analyzers, + DatabaseProperties properties)
    Constructs a new ReportGenerator.
    diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/AnalyzerService.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/AnalyzerService.html index 63e142c4a..6627a804f 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/AnalyzerService.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/AnalyzerService.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.analyzer.AnalyzerService (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.analyzer.AnalyzerService (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/ArchiveAnalyzer.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/ArchiveAnalyzer.html index af7657168..79600e23e 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/ArchiveAnalyzer.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/ArchiveAnalyzer.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.analyzer.ArchiveAnalyzer (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.analyzer.ArchiveAnalyzer (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/ArchiveExtractionException.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/ArchiveExtractionException.html index a668571eb..c5052b3f7 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/ArchiveExtractionException.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/ArchiveExtractionException.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.analyzer.ArchiveExtractionException (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.analyzer.ArchiveExtractionException (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/CPEAnalyzer.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/CPEAnalyzer.html index e3e3fc34c..061460d60 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/CPEAnalyzer.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/CPEAnalyzer.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.analyzer.CPEAnalyzer (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.analyzer.CPEAnalyzer (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/CpeSuppressionAnalyzer.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/CpeSuppressionAnalyzer.html index 5274bae2f..e1ad274a5 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/CpeSuppressionAnalyzer.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/CpeSuppressionAnalyzer.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.analyzer.CpeSuppressionAnalyzer (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.analyzer.CpeSuppressionAnalyzer (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/DependencyBundlingAnalyzer.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/DependencyBundlingAnalyzer.html index fbf3b265a..0ef706747 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/DependencyBundlingAnalyzer.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/DependencyBundlingAnalyzer.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.analyzer.DependencyBundlingAnalyzer (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.analyzer.DependencyBundlingAnalyzer (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/FalsePositiveAnalyzer.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/FalsePositiveAnalyzer.html index 3aa449cba..8037bf8fe 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/FalsePositiveAnalyzer.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/FalsePositiveAnalyzer.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.analyzer.FalsePositiveAnalyzer (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.analyzer.FalsePositiveAnalyzer (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/FileNameAnalyzer.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/FileNameAnalyzer.html index 2ae9df9ed..592413347 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/FileNameAnalyzer.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/FileNameAnalyzer.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.analyzer.FileNameAnalyzer (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.analyzer.FileNameAnalyzer (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/HintAnalyzer.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/HintAnalyzer.html index b6d25052c..c24fd6174 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/HintAnalyzer.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/HintAnalyzer.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.analyzer.HintAnalyzer (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.analyzer.HintAnalyzer (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/JarAnalyzer.ClassNameInformation.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/JarAnalyzer.ClassNameInformation.html index ad3503fb9..de4713a17 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/JarAnalyzer.ClassNameInformation.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/JarAnalyzer.ClassNameInformation.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.analyzer.JarAnalyzer.ClassNameInformation (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.analyzer.JarAnalyzer.ClassNameInformation (Dependency-Check Core 1.1.0 API) + @@ -109,14 +109,15 @@ JarAnalyzer.analyzePackageNames(ArrayList<JarAnalyzer.ClassNameInformation> classNames, Dependency dependency, boolean addPackagesAsEvidence) -
    Analyzes the path information of the classes contained within the - JarAnalyzer to try and determine possible vendor or product names.
    +
    Analyzes the path information of the classes contained within the JarAnalyzer to try and determine possible + vendor or product names.
    protected boolean -JarAnalyzer.analyzePOM(Dependency dependency, - ArrayList<JarAnalyzer.ClassNameInformation> classes) +JarAnalyzer.analyzePOM(Dependency dependency, + ArrayList<JarAnalyzer.ClassNameInformation> classes, + Engine engine)
    Attempts to find a pom.xml within the JAR file.
    @@ -124,7 +125,8 @@ protected boolean JarAnalyzer.parseManifest(Dependency dependency, ArrayList<JarAnalyzer.ClassNameInformation> classInformation) -
    Reads the manifest from the JAR file and collects the entries.
    +
    + Reads the manifest from the JAR file and collects the entries.
    diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/JarAnalyzer.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/JarAnalyzer.html index e9d695263..6a51335c4 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/JarAnalyzer.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/JarAnalyzer.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.analyzer.JarAnalyzer (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.analyzer.JarAnalyzer (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/JavaScriptAnalyzer.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/JavaScriptAnalyzer.html index 318dcedd9..aa0711442 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/JavaScriptAnalyzer.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/JavaScriptAnalyzer.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.analyzer.JavaScriptAnalyzer (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.analyzer.JavaScriptAnalyzer (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/NexusAnalyzer.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/NexusAnalyzer.html index 5b26f1274..0eac2e1a8 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/NexusAnalyzer.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/NexusAnalyzer.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.analyzer.NexusAnalyzer (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.analyzer.NexusAnalyzer (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/NvdCveAnalyzer.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/NvdCveAnalyzer.html index ef5cb41ca..1fd160d8a 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/NvdCveAnalyzer.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/NvdCveAnalyzer.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.analyzer.NvdCveAnalyzer (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.analyzer.NvdCveAnalyzer (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/VulnerabilitySuppressionAnalyzer.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/VulnerabilitySuppressionAnalyzer.html index b33e8f767..190aa4cfa 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/VulnerabilitySuppressionAnalyzer.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/class-use/VulnerabilitySuppressionAnalyzer.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.analyzer.VulnerabilitySuppressionAnalyzer (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.analyzer.VulnerabilitySuppressionAnalyzer (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/package-frame.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/package-frame.html index 3c4612194..51e62f602 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/package-frame.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/package-frame.html @@ -2,10 +2,10 @@ - + -org.owasp.dependencycheck.analyzer (Dependency-Check Core 1.0.8 API) - +org.owasp.dependencycheck.analyzer (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/package-summary.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/package-summary.html index de19d5561..3c16da60e 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/package-summary.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/package-summary.html @@ -2,16 +2,16 @@ - + -org.owasp.dependencycheck.analyzer (Dependency-Check Core 1.0.8 API) - +org.owasp.dependencycheck.analyzer (Dependency-Check Core 1.1.0 API) + @@ -38,7 +38,7 @@
    • Frames
      • @@ -110,8 +110,7 @@ AbstractSuppressionAnalyzer -
      Abstract base suppression analyzer that contains methods for parsing the - suppression xml file.
      +
      Abstract base suppression analyzer that contains methods for parsing the suppression xml file.
      @@ -121,36 +120,35 @@ ArchiveAnalyzer -
      An analyzer that extracts files from archives and ensures any supported - files contained within the archive are added to the dependency list.
      +
      + An analyzer that extracts files from archives and ensures any supported files contained within the archive are added + to the dependency list.
      CPEAnalyzer -
      CPEAnalyzer is a utility class that takes a project dependency and attempts - to discern if there is an associated CPE.
      +
      CPEAnalyzer is a utility class that takes a project dependency and attempts to discern if there is an associated CPE.
      CpeSuppressionAnalyzer -
      The suppression analyzer processes an externally defined XML document that - complies with the suppressions.xsd schema.
      +
      The suppression analyzer processes an externally defined XML document that complies with the suppressions.xsd schema.
      DependencyBundlingAnalyzer -
      This analyzer ensures dependencies that should be grouped together, to - remove excess noise from the report, are grouped.
      +
      + This analyzer ensures dependencies that should be grouped together, to remove excess noise from the report, are + grouped.
      FalsePositiveAnalyzer -
      This analyzer attempts to remove some well known false positives - - specifically regarding the java runtime.
      +
      This analyzer attempts to remove some well known false positives - specifically regarding the java runtime.
      @@ -166,8 +164,7 @@ JarAnalyzer -
      Used to load a JAR file and collect information that can be used to determine - the associated CPE.
      +
      Used to load a JAR file and collect information that can be used to determine the associated CPE.
      @@ -179,29 +176,26 @@ JavaScriptAnalyzer -
      Used to load a JAR file and collect information that can be used to determine - the associated CPE.
      +
      Used to load a JAR file and collect information that can be used to determine the associated CPE.
      NexusAnalyzer -
      Analyzer which will attempt to locate a dependency on a Nexus service - by SHA-1 digest of the dependency.
      +
      Analyzer which will attempt to locate a dependency on a Nexus service by SHA-1 digest of the dependency.
      NvdCveAnalyzer -
      NvdCveAnalyzer is a utility class that takes a project dependency and - attempts to discern if there is an associated CVEs.
      +
      NvdCveAnalyzer is a utility class that takes a project dependency and attempts to discern if there is an associated + CVEs.
      VulnerabilitySuppressionAnalyzer -
      The suppression analyzer processes an externally defined XML document that - complies with the suppressions.xsd schema.
      +
      The suppression analyzer processes an externally defined XML document that complies with the suppressions.xsd schema.
      @@ -282,7 +276,7 @@
      • Frames
        • diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/package-tree.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/package-tree.html index 65f8d5ab9..1100d3406 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/package-tree.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/package-tree.html @@ -2,16 +2,16 @@ - + -org.owasp.dependencycheck.analyzer Class Hierarchy (Dependency-Check Core 1.0.8 API) - +org.owasp.dependencycheck.analyzer Class Hierarchy (Dependency-Check Core 1.1.0 API) + @@ -38,7 +38,7 @@
        • Frames
          • @@ -147,7 +147,7 @@
          • Frames
            • diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/package-use.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/package-use.html index 0a31b6399..4865cc8db 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/package-use.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/analyzer/package-use.html @@ -2,16 +2,16 @@ - + -Uses of Package org.owasp.dependencycheck.analyzer (Dependency-Check Core 1.0.8 API) - +Uses of Package org.owasp.dependencycheck.analyzer (Dependency-Check Core 1.1.0 API) + @@ -149,8 +149,7 @@ AbstractSuppressionAnalyzer -
            Abstract base suppression analyzer that contains methods for parsing the - suppression xml file.
            +
            Abstract base suppression analyzer that contains methods for parsing the suppression xml file.
            diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/class-use/Engine.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/class-use/Engine.html index ea093a06f..ce47cf5ff 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/class-use/Engine.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/class-use/Engine.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.Engine (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.Engine (Dependency-Check Core 1.1.0 API) + @@ -124,8 +124,7 @@ void NvdCveAnalyzer.analyze(Dependency dependency, Engine engine) -
            Analyzes a dependency and attempts to determine if there are any CPE - identifiers for this dependency.
            +
            Analyzes a dependency and attempts to determine if there are any CPE identifiers for this dependency.
            @@ -139,24 +138,24 @@ void JavaScriptAnalyzer.analyze(Dependency dependency, Engine engine) -
            Loads a specified JAR file and collects information from the manifest and - checksums to identify the correct CPE information.
            +
            Loads a specified JAR file and collects information from the manifest and checksums to identify the correct CPE + information.
            void JarAnalyzer.analyze(Dependency dependency, Engine engine) -
            Loads a specified JAR file and collects information from the manifest and - checksums to identify the correct CPE information.
            +
            Loads a specified JAR file and collects information from the manifest and checksums to identify the correct CPE + information.
            void HintAnalyzer.analyze(Dependency dependency, Engine engine) -
            The HintAnalyzer uses knowledge about a dependency to add additional - information to help in identification of identifiers or vulnerabilities.
            +
            The HintAnalyzer uses knowledge about a dependency to add additional information to help in identification of + identifiers or vulnerabilities.
            @@ -170,8 +169,7 @@ void FalsePositiveAnalyzer.analyze(Dependency dependency, Engine engine) -
            Analyzes the dependencies and removes bad/incorrect CPE associations - based on various heuristics.
            +
            Analyzes the dependencies and removes bad/incorrect CPE associations based on various heuristics.
            @@ -190,8 +188,7 @@ void CPEAnalyzer.analyze(Dependency dependency, Engine engine) -
            Analyzes a dependency and attempts to determine if there are any CPE - identifiers for this dependency.
            +
            Analyzes a dependency and attempts to determine if there are any CPE identifiers for this dependency.
            @@ -208,6 +205,14 @@
            Analyzes the given dependency.
            + +protected boolean +JarAnalyzer.analyzePOM(Dependency dependency, + ArrayList<JarAnalyzer.ClassNameInformation> classes, + Engine engine) +
            Attempts to find a pom.xml within the JAR file.
            + + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cpe/CpeMemoryIndex.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cpe/CpeMemoryIndex.html index 209507517..d3e815c41 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cpe/CpeMemoryIndex.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cpe/CpeMemoryIndex.html @@ -2,16 +2,16 @@ - + -CpeMemoryIndex (Dependency-Check Core 1.0.8 API) - +CpeMemoryIndex (Dependency-Check Core 1.1.0 API) + @@ -99,8 +99,8 @@ 
            public final class CpeMemoryIndex
 extends Object
            -
            An in memory lucene index that contains the vendor/product combinations from - the CPE (application) identifiers within the NVD CVE data.
            +
            An in memory lucene index that contains the vendor/product combinations from the CPE (application) identifiers within + the NVD CVE data.
            Author:
            Jeremy Long
            @@ -280,8 +280,7 @@ extends Returns:
            the TopDocs found by the search
            Throws:
            org.apache.lucene.queryparser.classic.ParseException - thrown when the searchString is invalid
            -
            IOException - is thrown if there is an issue with the underlying - Index
            +
            IOException - is thrown if there is an issue with the underlying Index
          diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cpe/Fields.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cpe/Fields.html index 6f04cd576..08e084db0 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cpe/Fields.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cpe/Fields.html @@ -2,16 +2,16 @@ - + -Fields (Dependency-Check Core 1.0.8 API) - +Fields (Dependency-Check Core 1.1.0 API) + @@ -99,8 +99,7 @@ 
          public abstract class Fields
 extends Object
          -
          Fields is a collection of field names used within the Lucene index for CPE - entries.
          +
          Fields is a collection of field names used within the Lucene index for CPE entries.
          Author:
          Jeremy Long
          diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cpe/IndexEntry.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cpe/IndexEntry.html index 62bf9688f..d79fb7c9e 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cpe/IndexEntry.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cpe/IndexEntry.html @@ -2,16 +2,16 @@ - + -IndexEntry (Dependency-Check Core 1.0.8 API) - +IndexEntry (Dependency-Check Core 1.1.0 API) + @@ -182,8 +182,8 @@ implements void parseName(String cpeName) -
          Parses a name attribute value, from the cpe.xml, into its - corresponding parts: vendor, product.
          +
          + Parses a name attribute value, from the cpe.xml, into its corresponding parts: vendor, product.
          @@ -351,16 +351,18 @@ implements String cpeName) throws UnsupportedEncodingException -

          Parses a name attribute value, from the cpe.xml, into its - corresponding parts: vendor, product.

          -

          Example:

          +

          + Parses a name attribute value, from the cpe.xml, into its corresponding parts: vendor, product.

          +

          + Example:

          nbsp;nbsp;nbsp;cpe:/a:apache:struts:1.1:rc2 -

          Results in:

          • Vendor: apache
          • Product: struts
            • +

            + Results in:

            • Vendor: apache
            • Product: struts
            -

            If it is necessary to parse the CPE into more parts (i.e. to include - version and revision) then you should use the - VulnerableSoftware.parseName().

          +

          + If it is necessary to parse the CPE into more parts (i.e. to include version and revision) then you should use + the VulnerableSoftware.parseName().

          Parameters:
          cpeName - the cpe name
          Throws:
          UnsupportedEncodingException - should never be thrown...
          diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cpe/IndexException.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cpe/IndexException.html index 62fa3ae5e..84e550151 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cpe/IndexException.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cpe/IndexException.html @@ -2,16 +2,16 @@ - + -IndexException (Dependency-Check Core 1.0.8 API) - +IndexException (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cpe/class-use/CpeMemoryIndex.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cpe/class-use/CpeMemoryIndex.html index 333fd8f58..7814ca780 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cpe/class-use/CpeMemoryIndex.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cpe/class-use/CpeMemoryIndex.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.data.cpe.CpeMemoryIndex (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.data.cpe.CpeMemoryIndex (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cpe/class-use/Fields.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cpe/class-use/Fields.html index 72a717acb..7d4d53f9f 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cpe/class-use/Fields.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cpe/class-use/Fields.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.data.cpe.Fields (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.data.cpe.Fields (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cpe/class-use/IndexEntry.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cpe/class-use/IndexEntry.html index b098599b4..bc7962eab 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cpe/class-use/IndexEntry.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cpe/class-use/IndexEntry.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.data.cpe.IndexEntry (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.data.cpe.IndexEntry (Dependency-Check Core 1.1.0 API) + @@ -121,8 +121,9 @@ String product, Set<String> vendorWeightings, Set<String> productWeightings) -
          Searches the Lucene CPE index to identify possible CPE entries - associated with the supplied vendor, product, and version.
          +
          + Searches the Lucene CPE index to identify possible CPE entries associated with the supplied vendor, product, and + version.
          diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cpe/class-use/IndexException.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cpe/class-use/IndexException.html index 0ab6870d4..8f702cbf5 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cpe/class-use/IndexException.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cpe/class-use/IndexException.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.data.cpe.IndexException (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.data.cpe.IndexException (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cpe/package-frame.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cpe/package-frame.html index 2d650cb90..5f97d78b8 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cpe/package-frame.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cpe/package-frame.html @@ -2,10 +2,10 @@ - + -org.owasp.dependencycheck.data.cpe (Dependency-Check Core 1.0.8 API) - +org.owasp.dependencycheck.data.cpe (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cpe/package-summary.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cpe/package-summary.html index 7fd84023c..f4055b767 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cpe/package-summary.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cpe/package-summary.html @@ -2,16 +2,16 @@ - + -org.owasp.dependencycheck.data.cpe (Dependency-Check Core 1.0.8 API) - +org.owasp.dependencycheck.data.cpe (Dependency-Check Core 1.1.0 API) + @@ -37,7 +37,7 @@
            @@ -88,15 +88,14 @@ CpeMemoryIndex -
            An in memory lucene index that contains the vendor/product combinations from - the CPE (application) identifiers within the NVD CVE data.
            +
            An in memory lucene index that contains the vendor/product combinations from the CPE (application) identifiers within + the NVD CVE data.
            Fields -
            Fields is a collection of field names used within the Lucene index for CPE - entries.
            +
            Fields is a collection of field names used within the Lucene index for CPE entries.
            @@ -158,7 +157,7 @@
            diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cpe/package-tree.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cpe/package-tree.html index e19c90dee..a1166bc10 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cpe/package-tree.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cpe/package-tree.html @@ -2,16 +2,16 @@ - + -org.owasp.dependencycheck.data.cpe Class Hierarchy (Dependency-Check Core 1.0.8 API) - +org.owasp.dependencycheck.data.cpe Class Hierarchy (Dependency-Check Core 1.1.0 API) + @@ -37,7 +37,7 @@
            @@ -110,7 +110,7 @@
            diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cpe/package-use.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cpe/package-use.html index 0cbcfa33c..b238fb1a3 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cpe/package-use.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cpe/package-use.html @@ -2,16 +2,16 @@ - + -Uses of Package org.owasp.dependencycheck.data.cpe (Dependency-Check Core 1.0.8 API) - +Uses of Package org.owasp.dependencycheck.data.cpe (Dependency-Check Core 1.1.0 API) + @@ -141,8 +141,8 @@ CpeMemoryIndex -
            An in memory lucene index that contains the vendor/product combinations from - the CPE (application) identifiers within the NVD CVE data.
            +
            An in memory lucene index that contains the vendor/product combinations from the CPE (application) identifiers within + the NVD CVE data.
            diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cwe/CweDB.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cwe/CweDB.html index 4315962bf..7ad16cb58 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cwe/CweDB.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cwe/CweDB.html @@ -2,16 +2,16 @@ - + -CweDB (Dependency-Check Core 1.0.8 API) - +CweDB (Dependency-Check Core 1.1.0 API) + @@ -122,7 +122,8 @@ extends static String getCweName(String cweId) -
            Returns the full CWE name from the CWE ID.
            +
            + Returns the full CWE name from the CWE ID.
            @@ -154,7 +155,8 @@ extends

            getCweName

            public static String getCweName(String cweId)
            -

            Returns the full CWE name from the CWE ID.

            +

            + Returns the full CWE name from the CWE ID.

            Parameters:
            cweId - the CWE ID
            Returns:
            the full name of the CWE
            diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cwe/CweHandler.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cwe/CweHandler.html index dff795e45..e2192dfed 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cwe/CweHandler.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cwe/CweHandler.html @@ -2,16 +2,16 @@ - + -CweHandler (Dependency-Check Core 1.0.8 API) - +CweHandler (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cwe/class-use/CweDB.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cwe/class-use/CweDB.html index b7b465e39..d22566ffa 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cwe/class-use/CweDB.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cwe/class-use/CweDB.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.data.cwe.CweDB (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.data.cwe.CweDB (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cwe/class-use/CweHandler.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cwe/class-use/CweHandler.html index 0616378a7..73cf33fdb 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cwe/class-use/CweHandler.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cwe/class-use/CweHandler.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.data.cwe.CweHandler (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.data.cwe.CweHandler (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cwe/package-frame.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cwe/package-frame.html index 4c4a0ea1b..f6eb68638 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cwe/package-frame.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cwe/package-frame.html @@ -2,10 +2,10 @@ - + -org.owasp.dependencycheck.data.cwe (Dependency-Check Core 1.0.8 API) - +org.owasp.dependencycheck.data.cwe (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cwe/package-summary.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cwe/package-summary.html index 960ee5ab1..eb735261d 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cwe/package-summary.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cwe/package-summary.html @@ -2,16 +2,16 @@ - + -org.owasp.dependencycheck.data.cwe (Dependency-Check Core 1.0.8 API) - +org.owasp.dependencycheck.data.cwe (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cwe/package-tree.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cwe/package-tree.html index b161dfdab..f4334f5de 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cwe/package-tree.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cwe/package-tree.html @@ -2,16 +2,16 @@ - + -org.owasp.dependencycheck.data.cwe Class Hierarchy (Dependency-Check Core 1.0.8 API) - +org.owasp.dependencycheck.data.cwe Class Hierarchy (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cwe/package-use.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cwe/package-use.html index 81ccf3184..843655b2f 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cwe/package-use.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/cwe/package-use.html @@ -2,16 +2,16 @@ - + -Uses of Package org.owasp.dependencycheck.data.cwe (Dependency-Check Core 1.0.8 API) - +Uses of Package org.owasp.dependencycheck.data.cwe (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/AbstractTokenizingFilter.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/AbstractTokenizingFilter.html index e19371fcc..e246124ee 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/AbstractTokenizingFilter.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/AbstractTokenizingFilter.html @@ -2,16 +2,16 @@ - + -AbstractTokenizingFilter (Dependency-Check Core 1.0.8 API) - +AbstractTokenizingFilter (Dependency-Check Core 1.1.0 API) + @@ -122,8 +122,7 @@ 
            public abstract class AbstractTokenizingFilter
 extends org.apache.lucene.analysis.TokenFilter
            -
            An abstract tokenizing filter that can be used as the base for a tokenizing - filter.
            +
            An abstract tokenizing filter that can be used as the base for a tokenizing filter.
            Author:
            Jeremy Long
            diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/AlphaNumericTokenizer.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/AlphaNumericTokenizer.html index e9d7f0739..20d9cbc34 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/AlphaNumericTokenizer.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/AlphaNumericTokenizer.html @@ -2,16 +2,16 @@ - + -AlphaNumericTokenizer (Dependency-Check Core 1.0.8 API) - +AlphaNumericTokenizer (Dependency-Check Core 1.1.0 API) + @@ -123,8 +123,7 @@ 
            public class AlphaNumericTokenizer
 extends org.apache.lucene.analysis.util.CharTokenizer
            -
            Tokenizes the input breaking it into tokens when non-alpha/numeric characters - are found.
            +
            Tokenizes the input breaking it into tokens when non-alpha/numeric characters are found.
            Author:
            Jeremy Long
            diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/DependencySimilarity.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/DependencySimilarity.html index 073b0e5ed..956579863 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/DependencySimilarity.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/DependencySimilarity.html @@ -2,16 +2,16 @@ - + -DependencySimilarity (Dependency-Check Core 1.0.8 API) - +DependencySimilarity (Dependency-Check Core 1.1.0 API) + @@ -185,8 +185,8 @@ extends org.apache.lucene.search.similarities.DefaultSimilarity float idf(long docFreq, long numDocs) -
            Override the default idf implementation so that frequency within all - document is ignored.
            +
            + Override the default idf implementation so that frequency within all document is ignored.
            @@ -250,12 +250,10 @@ extends org.apache.lucene.search.similarities.DefaultSimilarity

            idf

            public float idf(long docFreq,
         long numDocs)
            -

            Override the default idf implementation so that frequency within all - document is ignored.

            +

            + Override the default idf implementation so that frequency within all document is ignored.

            - See this - article for more details.
            + See this article for more details.
            Overrides:
            idf in class org.apache.lucene.search.similarities.DefaultSimilarity
            diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/FieldAnalyzer.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/FieldAnalyzer.html index 2c71a4770..33a089c92 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/FieldAnalyzer.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/FieldAnalyzer.html @@ -2,16 +2,16 @@ - + -FieldAnalyzer (Dependency-Check Core 1.0.8 API) - +FieldAnalyzer (Dependency-Check Core 1.1.0 API) + @@ -108,9 +108,9 @@ 
            public class FieldAnalyzer
 extends org.apache.lucene.analysis.Analyzer
            -

            A Lucene Analyzer that utilizes the WhitespaceTokenizer, - WordDelimiterFilter, LowerCaseFilter, and StopFilter. The intended purpose of - this Analyzer is to index the CPE fields vendor and product.

            +

            + A Lucene Analyzer that utilizes the WhitespaceTokenizer, WordDelimiterFilter, LowerCaseFilter, and StopFilter. The + intended purpose of this Analyzer is to index the CPE fields vendor and product.

            Author:
            Jeremy Long
            diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/LuceneUtils.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/LuceneUtils.html index 6cc54ffd1..92231602d 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/LuceneUtils.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/LuceneUtils.html @@ -2,16 +2,16 @@ - + -LuceneUtils (Dependency-Check Core 1.0.8 API) - +LuceneUtils (Dependency-Check Core 1.1.0 API) + @@ -99,8 +99,8 @@ 
            public final class LuceneUtils
 extends Object
            -

            Lucene utils is a set of utilize written to make constructing Lucene - queries simpler.

            +

            + Lucene utils is a set of utilize written to make constructing Lucene queries simpler.

            Author:
            Jeremy Long
            @@ -146,15 +146,13 @@ extends static void appendEscapedLuceneQuery(StringBuilder buf, CharSequence text) -
            Appends the text to the supplied StringBuilder escaping Lucene control - characters in the process.
            +
            Appends the text to the supplied StringBuilder escaping Lucene control characters in the process.
            static String escapeLuceneQuery(CharSequence text) -
            Escapes the text passed in so that it is treated as data instead of - control characters.
            +
            Escapes the text passed in so that it is treated as data instead of control characters.
            @@ -186,8 +184,8 @@ extends

            CURRENT_VERSION

            public static final org.apache.lucene.util.Version CURRENT_VERSION
            -
            The current version of Lucene being used. Declaring this one place so an - upgrade doesn't require hunting through the code base.
            +
            The current version of Lucene being used. Declaring this one place so an upgrade doesn't require hunting through + the code base.
          @@ -206,8 +204,7 @@ extends StringBuilder buf, CharSequence text) -
          Appends the text to the supplied StringBuilder escaping Lucene control - characters in the process.
          +
          Appends the text to the supplied StringBuilder escaping Lucene control characters in the process.
          Parameters:
          buf - a StringBuilder to append the escaped text to
          text - the data to be escaped
        @@ -218,8 +215,7 @@ extends

        escapeLuceneQuery

        public static String escapeLuceneQuery(CharSequence text)
        -
        Escapes the text passed in so that it is treated as data instead of - control characters.
        +
        Escapes the text passed in so that it is treated as data instead of control characters.
        Parameters:
        text - data to be escaped
        Returns:
        the escaped text.
        diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/SearchFieldAnalyzer.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/SearchFieldAnalyzer.html index 703d931d2..bb8031bc7 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/SearchFieldAnalyzer.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/SearchFieldAnalyzer.html @@ -2,16 +2,16 @@ - + -SearchFieldAnalyzer (Dependency-Check Core 1.0.8 API) - +SearchFieldAnalyzer (Dependency-Check Core 1.1.0 API) + @@ -181,8 +181,9 @@ extends org.apache.lucene.analysis.Analyzer void clear() -
        Resets the analyzer and clears any internal state data that may have - been left-over from previous uses of the analyzer.
        +
        + Resets the analyzer and clears any internal state data that may have been left-over from previous uses of the + analyzer.
        @@ -263,10 +264,11 @@ extends org.apache.lucene.analysis.Analyzer

      • clear

        public void clear()
        -

        Resets the analyzer and clears any internal state data that may have - been left-over from previous uses of the analyzer.

        -

        If this analyzer is re-used this method must be called between - uses.

        +

        + Resets the analyzer and clears any internal state data that may have been left-over from previous uses of the + analyzer.

        +

        + If this analyzer is re-used this method must be called between uses.

      diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/SearchVersionAnalyzer.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/SearchVersionAnalyzer.html index b2de45784..ad0d45efc 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/SearchVersionAnalyzer.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/SearchVersionAnalyzer.html @@ -2,16 +2,16 @@ - + -SearchVersionAnalyzer (Dependency-Check Core 1.0.8 API) - +SearchVersionAnalyzer (Dependency-Check Core 1.1.0 API) + @@ -112,8 +112,7 @@ 
      @Deprecated
 public class SearchVersionAnalyzer
 extends org.apache.lucene.analysis.Analyzer
      -
      SearchVersionAnalyzer is a Lucene Analyzer used to analyze version - information.
      +
      SearchVersionAnalyzer is a Lucene Analyzer used to analyze version information.
      Author:
      Jeremy Long
      diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/TokenPairConcatenatingFilter.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/TokenPairConcatenatingFilter.html index ab3e9e5ab..6656130a4 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/TokenPairConcatenatingFilter.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/TokenPairConcatenatingFilter.html @@ -2,16 +2,16 @@ - + -TokenPairConcatenatingFilter (Dependency-Check Core 1.0.8 API) - +TokenPairConcatenatingFilter (Dependency-Check Core 1.1.0 API) + @@ -118,10 +118,10 @@ 
      public final class TokenPairConcatenatingFilter
 extends org.apache.lucene.analysis.TokenFilter
      -

      Takes a TokenStream and adds additional tokens by concatenating pairs of - words.

      -

      Example: "Spring Framework Core" -> "Spring SpringFramework - Framework FrameworkCore Core".

      +

      + Takes a TokenStream and adds additional tokens by concatenating pairs of words.

      +

      + Example: "Spring Framework Core" -> "Spring SpringFramework Framework FrameworkCore Core".

      Author:
      Jeremy Long
      @@ -194,8 +194,9 @@ extends org.apache.lucene.analysis.TokenFilter void clear() -
      Resets the Filter and clears any internal state data that may have - been left-over from previous uses of the Filter.
      +
      + Resets the Filter and clears any internal state data that may have been left-over from previous uses of the + Filter.
      @@ -213,9 +214,8 @@ extends org.apache.lucene.analysis.TokenFilter boolean incrementToken() -
      Increments the underlying TokenStream and sets CharTermAttributes to - construct an expanded set of tokens by concatenating tokens with the - previous token.
      +
      Increments the underlying TokenStream and sets CharTermAttributes to construct an expanded set of tokens by + concatenating tokens with the previous token.
      @@ -303,9 +303,8 @@ extends org.apache.lucene.analysis.TokenFilter

      incrementToken

      public boolean incrementToken()
                        throws IOException
      -
      Increments the underlying TokenStream and sets CharTermAttributes to - construct an expanded set of tokens by concatenating tokens with the - previous token.
      +
      Increments the underlying TokenStream and sets CharTermAttributes to construct an expanded set of tokens by + concatenating tokens with the previous token.
      Specified by:
      incrementToken in class org.apache.lucene.analysis.TokenStream
      @@ -321,10 +320,11 @@ extends org.apache.lucene.analysis.TokenFilter

    • clear

      public void clear()
      -

      Resets the Filter and clears any internal state data that may have - been left-over from previous uses of the Filter.

      -

      If this Filter is re-used this method must be called between - uses.

      +

      + Resets the Filter and clears any internal state data that may have been left-over from previous uses of the + Filter.

      +

      + If this Filter is re-used this method must be called between uses.

    diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/UrlTokenizingFilter.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/UrlTokenizingFilter.html index b1cbfc635..66e64c3d5 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/UrlTokenizingFilter.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/UrlTokenizingFilter.html @@ -2,16 +2,16 @@ - + -UrlTokenizingFilter (Dependency-Check Core 1.0.8 API) - +UrlTokenizingFilter (Dependency-Check Core 1.1.0 API) + @@ -123,10 +123,10 @@ 
    public final class UrlTokenizingFilter
 extends AbstractTokenizingFilter
    -

    Takes a TokenStream and splits or adds tokens to correctly index version - numbers.

    -

    Example: "3.0.0.RELEASE" -> "3 3.0 3.0.0 RELEASE - 3.0.0.RELEASE".

    +

    + Takes a TokenStream and splits or adds tokens to correctly index version numbers.

    +

    + Example: "3.0.0.RELEASE" -> "3 3.0 3.0.0 RELEASE 3.0.0.RELEASE".

    Author:
    Jeremy Long
    @@ -199,9 +199,8 @@ extends boolean incrementToken() -
    Increments the underlying TokenStream and sets CharTermAttributes to - construct an expanded set of tokens by concatenating tokens with the - previous token.
    +
    Increments the underlying TokenStream and sets CharTermAttributes to construct an expanded set of tokens by + concatenating tokens with the previous token.
    @@ -274,9 +273,8 @@ extends IOException -
    Increments the underlying TokenStream and sets CharTermAttributes to - construct an expanded set of tokens by concatenating tokens with the - previous token.
    +
    Increments the underlying TokenStream and sets CharTermAttributes to construct an expanded set of tokens by + concatenating tokens with the previous token.
    Specified by:
    incrementToken in class org.apache.lucene.analysis.TokenStream
    diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/VersionAnalyzer.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/VersionAnalyzer.html index dfb99da32..3fee1e62d 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/VersionAnalyzer.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/VersionAnalyzer.html @@ -2,16 +2,16 @@ - + -VersionAnalyzer (Dependency-Check Core 1.0.8 API) - +VersionAnalyzer (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/VersionTokenizingFilter.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/VersionTokenizingFilter.html index 29432c186..24e9d40c0 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/VersionTokenizingFilter.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/VersionTokenizingFilter.html @@ -2,16 +2,16 @@ - + -VersionTokenizingFilter (Dependency-Check Core 1.0.8 API) - +VersionTokenizingFilter (Dependency-Check Core 1.1.0 API) + @@ -127,10 +127,10 @@ 
    @Deprecated
 public final class VersionTokenizingFilter
 extends AbstractTokenizingFilter
    -

    Takes a TokenStream and splits or adds tokens to correctly index version - numbers.

    -

    Example: "3.0.0.RELEASE" -> "3 3.0 3.0.0 RELEASE - 3.0.0.RELEASE".

    +

    + Takes a TokenStream and splits or adds tokens to correctly index version numbers.

    +

    + Example: "3.0.0.RELEASE" -> "3 3.0 3.0.0 RELEASE 3.0.0.RELEASE".

    Author:
    Jeremy Long
    @@ -205,9 +205,8 @@ extends boolean incrementToken()
    Deprecated. 
    -
    Increments the underlying TokenStream and sets CharTermAttributes to - construct an expanded set of tokens by concatenating tokens with the - previous token.
    +
    Increments the underlying TokenStream and sets CharTermAttributes to construct an expanded set of tokens by + concatenating tokens with the previous token.
    @@ -282,9 +281,8 @@ extends IOException
    Deprecated. 
    -
    Increments the underlying TokenStream and sets CharTermAttributes to - construct an expanded set of tokens by concatenating tokens with the - previous token.
    +
    Increments the underlying TokenStream and sets CharTermAttributes to construct an expanded set of tokens by + concatenating tokens with the previous token.
    Specified by:
    incrementToken in class org.apache.lucene.analysis.TokenStream
    diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/class-use/AbstractTokenizingFilter.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/class-use/AbstractTokenizingFilter.html index 4df2730f9..77f955351 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/class-use/AbstractTokenizingFilter.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/class-use/AbstractTokenizingFilter.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.data.lucene.AbstractTokenizingFilter (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.data.lucene.AbstractTokenizingFilter (Dependency-Check Core 1.1.0 API) + @@ -106,8 +106,8 @@ class  UrlTokenizingFilter -
    Takes a TokenStream and splits or adds tokens to correctly index version - numbers.
    +
    + Takes a TokenStream and splits or adds tokens to correctly index version numbers.
    diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/class-use/AlphaNumericTokenizer.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/class-use/AlphaNumericTokenizer.html index 0ddd562ee..c83ac45cf 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/class-use/AlphaNumericTokenizer.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/class-use/AlphaNumericTokenizer.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.data.lucene.AlphaNumericTokenizer (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.data.lucene.AlphaNumericTokenizer (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/class-use/DependencySimilarity.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/class-use/DependencySimilarity.html index c55b98389..80b88c8c4 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/class-use/DependencySimilarity.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/class-use/DependencySimilarity.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.data.lucene.DependencySimilarity (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.data.lucene.DependencySimilarity (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/class-use/FieldAnalyzer.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/class-use/FieldAnalyzer.html index 85191f5e1..c3305a94e 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/class-use/FieldAnalyzer.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/class-use/FieldAnalyzer.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.data.lucene.FieldAnalyzer (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.data.lucene.FieldAnalyzer (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/class-use/LuceneUtils.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/class-use/LuceneUtils.html index 4c7c331fc..c17903fea 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/class-use/LuceneUtils.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/class-use/LuceneUtils.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.data.lucene.LuceneUtils (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.data.lucene.LuceneUtils (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/class-use/SearchFieldAnalyzer.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/class-use/SearchFieldAnalyzer.html index 91e82942f..f82dea041 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/class-use/SearchFieldAnalyzer.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/class-use/SearchFieldAnalyzer.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.data.lucene.SearchFieldAnalyzer (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.data.lucene.SearchFieldAnalyzer (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/class-use/SearchVersionAnalyzer.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/class-use/SearchVersionAnalyzer.html index a8704ec35..b427c9f11 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/class-use/SearchVersionAnalyzer.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/class-use/SearchVersionAnalyzer.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.data.lucene.SearchVersionAnalyzer (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.data.lucene.SearchVersionAnalyzer (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/class-use/TokenPairConcatenatingFilter.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/class-use/TokenPairConcatenatingFilter.html index 0702b1f8f..4533103c6 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/class-use/TokenPairConcatenatingFilter.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/class-use/TokenPairConcatenatingFilter.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.data.lucene.TokenPairConcatenatingFilter (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.data.lucene.TokenPairConcatenatingFilter (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/class-use/UrlTokenizingFilter.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/class-use/UrlTokenizingFilter.html index 307ef06d2..c5f6093cb 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/class-use/UrlTokenizingFilter.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/class-use/UrlTokenizingFilter.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.data.lucene.UrlTokenizingFilter (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.data.lucene.UrlTokenizingFilter (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/class-use/VersionAnalyzer.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/class-use/VersionAnalyzer.html index f530dca63..6e5245452 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/class-use/VersionAnalyzer.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/class-use/VersionAnalyzer.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.data.lucene.VersionAnalyzer (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.data.lucene.VersionAnalyzer (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/class-use/VersionTokenizingFilter.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/class-use/VersionTokenizingFilter.html index 95f6a2a7e..100df3215 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/class-use/VersionTokenizingFilter.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/class-use/VersionTokenizingFilter.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.data.lucene.VersionTokenizingFilter (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.data.lucene.VersionTokenizingFilter (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/package-frame.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/package-frame.html index 80c7b202c..aa07ca0b4 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/package-frame.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/package-frame.html @@ -2,10 +2,10 @@ - + -org.owasp.dependencycheck.data.lucene (Dependency-Check Core 1.0.8 API) - +org.owasp.dependencycheck.data.lucene (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/package-summary.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/package-summary.html index 15a046904..55d9bc1ad 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/package-summary.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/package-summary.html @@ -2,16 +2,16 @@ - + -org.owasp.dependencycheck.data.lucene (Dependency-Check Core 1.0.8 API) - +org.owasp.dependencycheck.data.lucene (Dependency-Check Core 1.1.0 API) + @@ -88,15 +88,13 @@ AbstractTokenizingFilter -
    An abstract tokenizing filter that can be used as the base for a tokenizing - filter.
    +
    An abstract tokenizing filter that can be used as the base for a tokenizing filter.
    AlphaNumericTokenizer -
    Tokenizes the input breaking it into tokens when non-alpha/numeric characters - are found.
    +
    Tokenizes the input breaking it into tokens when non-alpha/numeric characters are found.
    @@ -106,15 +104,15 @@ FieldAnalyzer -
    A Lucene Analyzer that utilizes the WhitespaceTokenizer, - WordDelimiterFilter, LowerCaseFilter, and StopFilter.
    +
    + A Lucene Analyzer that utilizes the WhitespaceTokenizer, WordDelimiterFilter, LowerCaseFilter, and StopFilter.
    LuceneUtils -
    Lucene utils is a set of utilize written to make constructing Lucene - queries simpler.
    +
    + Lucene utils is a set of utilize written to make constructing Lucene queries simpler.
    @@ -132,15 +130,15 @@ TokenPairConcatenatingFilter -
    Takes a TokenStream and adds additional tokens by concatenating pairs of - words.
    +
    + Takes a TokenStream and adds additional tokens by concatenating pairs of words.
    UrlTokenizingFilter -
    Takes a TokenStream and splits or adds tokens to correctly index version - numbers.
    +
    + Takes a TokenStream and splits or adds tokens to correctly index version numbers.
    diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/package-tree.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/package-tree.html index 7dfb4d5ca..1c080b1cf 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/package-tree.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/package-tree.html @@ -2,16 +2,16 @@ - + -org.owasp.dependencycheck.data.lucene Class Hierarchy (Dependency-Check Core 1.0.8 API) - +org.owasp.dependencycheck.data.lucene Class Hierarchy (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/package-use.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/package-use.html index 9ad27dcef..5c3d6efab 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/package-use.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/lucene/package-use.html @@ -2,16 +2,16 @@ - + -Uses of Package org.owasp.dependencycheck.data.lucene (Dependency-Check Core 1.0.8 API) - +Uses of Package org.owasp.dependencycheck.data.lucene (Dependency-Check Core 1.1.0 API) + @@ -101,8 +101,7 @@ AbstractTokenizingFilter -
    An abstract tokenizing filter that can be used as the base for a tokenizing - filter.
    +
    An abstract tokenizing filter that can be used as the base for a tokenizing filter.
    diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nexus/MavenArtifact.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nexus/MavenArtifact.html index 668e8e4bd..0e4ac2004 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nexus/MavenArtifact.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nexus/MavenArtifact.html @@ -2,16 +2,16 @@ - + -MavenArtifact (Dependency-Check Core 1.0.8 API) - +MavenArtifact (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nexus/NexusSearch.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nexus/NexusSearch.html index 90e8881a5..9db36396d 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nexus/NexusSearch.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nexus/NexusSearch.html @@ -2,16 +2,16 @@ - + -NexusSearch (Dependency-Check Core 1.0.8 API) - +NexusSearch (Dependency-Check Core 1.1.0 API) + @@ -142,8 +142,7 @@ extends MavenArtifact searchSha1(String sha1) -
    Searches the configured Nexus repository for the given sha1 - hash.
    +
    Searches the configured Nexus repository for the given sha1 hash.
    @@ -176,8 +175,8 @@ extends URL rootURL)
    Creates a NexusSearch for the given repository URL.
    -
    Parameters:
    rootURL - the root URL of the repository on which searches should execute. - full URL's are calculated relative to this URL, so it should end with a /
    +
    Parameters:
    rootURL - the root URL of the repository on which searches should execute. full URL's are calculated + relative to this URL, so it should end with a /
    @@ -196,14 +195,13 @@ extends MavenArtifact searchSha1(String sha1) throws IOException -
    Searches the configured Nexus repository for the given sha1 - hash. If the artifact is found, a MavenArtifact is populated - with the coordinate information.
    +
    Searches the configured Nexus repository for the given sha1 hash. If the artifact is found, a + MavenArtifact is populated with the coordinate information.
    Parameters:
    sha1 - The SHA-1 hash string for which to search
    Returns:
    the populated Maven coordinates
    Throws:
    -
    IOException - if it's unable to connect to the specified repositor or - if the specified artifact is not found.
    +
    IOException - if it's unable to connect to the specified repositor or if the specified artifact is not + found.
    diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nexus/class-use/MavenArtifact.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nexus/class-use/MavenArtifact.html index 535b30bd2..69f4aeaf8 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nexus/class-use/MavenArtifact.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nexus/class-use/MavenArtifact.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.data.nexus.MavenArtifact (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.data.nexus.MavenArtifact (Dependency-Check Core 1.1.0 API) + @@ -78,7 +78,13 @@ org.owasp.dependencycheck.data.nexus -  + +
    + + org.owasp.dependencycheck.data.nexus + +
    + @@ -99,8 +105,7 @@ MavenArtifact NexusSearch.searchSha1(String sha1) -
    Searches the configured Nexus repository for the given sha1 - hash.
    +
    Searches the configured Nexus repository for the given sha1 hash.
    diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nexus/class-use/NexusSearch.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nexus/class-use/NexusSearch.html index 7e18c4af6..8e01b909f 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nexus/class-use/NexusSearch.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nexus/class-use/NexusSearch.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.data.nexus.NexusSearch (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.data.nexus.NexusSearch (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nexus/package-frame.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nexus/package-frame.html index f6f5eb2d2..c7136ea15 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nexus/package-frame.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nexus/package-frame.html @@ -2,10 +2,10 @@ - + -org.owasp.dependencycheck.data.nexus (Dependency-Check Core 1.0.8 API) - +org.owasp.dependencycheck.data.nexus (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nexus/package-summary.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nexus/package-summary.html index 5be19f42b..3f8f83c89 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nexus/package-summary.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nexus/package-summary.html @@ -2,16 +2,16 @@ - + -org.owasp.dependencycheck.data.nexus (Dependency-Check Core 1.0.8 API) - +org.owasp.dependencycheck.data.nexus (Dependency-Check Core 1.1.0 API) + @@ -65,6 +65,14 @@

    Package org.owasp.dependencycheck.data.nexus

    +
    +
    + + org.owasp.dependencycheck.data.nexus + +
    +
    +

    See: Description

      @@ -92,6 +100,21 @@
    + + + +

    Package org.owasp.dependencycheck.data.nexus Description

    +
    + + org.owasp.dependencycheck.data.nexus + + +

    + Contains classes related to searching a Nexus repository.

    +

    + These are used to abstract Nexus searching away from OWASP Dependency Check so they can be reused elsewhere.

    + +
    diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nexus/package-tree.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nexus/package-tree.html index b5c4e660c..a016ac06d 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nexus/package-tree.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nexus/package-tree.html @@ -2,16 +2,16 @@ - + -org.owasp.dependencycheck.data.nexus Class Hierarchy (Dependency-Check Core 1.0.8 API) - +org.owasp.dependencycheck.data.nexus Class Hierarchy (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nexus/package-use.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nexus/package-use.html index 95d37899b..0fc70e4ab 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nexus/package-use.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nexus/package-use.html @@ -2,16 +2,16 @@ - + -Uses of Package org.owasp.dependencycheck.data.nexus (Dependency-Check Core 1.0.8 API) - +Uses of Package org.owasp.dependencycheck.data.nexus (Dependency-Check Core 1.1.0 API) + @@ -78,7 +78,13 @@ org.owasp.dependencycheck.data.nexus -  + +
    + + org.owasp.dependencycheck.data.nexus + +
    + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/ConnectionFactory.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/ConnectionFactory.html index 895c45912..c81826c3d 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/ConnectionFactory.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/ConnectionFactory.html @@ -2,16 +2,16 @@ - + -ConnectionFactory (Dependency-Check Core 1.0.8 API) - +ConnectionFactory (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/CveDB.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/CveDB.html index ccbd6f341..a5ee809d6 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/CveDB.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/CveDB.html @@ -2,16 +2,16 @@ - + -CveDB (Dependency-Check Core 1.0.8 API) - +CveDB (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/DatabaseException.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/DatabaseException.html index 7cd306732..b4a6b0fd0 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/DatabaseException.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/DatabaseException.html @@ -2,16 +2,16 @@ - + -DatabaseException (Dependency-Check Core 1.0.8 API) - +DatabaseException (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/DatabaseProperties.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/DatabaseProperties.html index aa3b17159..8b208adb9 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/DatabaseProperties.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/DatabaseProperties.html @@ -2,16 +2,16 @@ - + -DatabaseProperties (Dependency-Check Core 1.0.8 API) - +DatabaseProperties (Dependency-Check Core 1.1.0 API) + @@ -123,8 +123,8 @@ extends static String LAST_UPDATED -
    The properties file key for the last updated field - used to store the - last updated time of the Modified NVD CVE xml file.
    +
    The properties file key for the last updated field - used to store the last updated time of the Modified NVD CVE + xml file.
    @@ -136,8 +136,7 @@ extends static String MODIFIED -
    Modified key word, used as a key to store information about the modified - file (i.e.
    +
    Modified key word, used as a key to store information about the modified file (i.e.
    @@ -156,6 +155,18 @@ extends Method and Description +Map +getMetaData() +
    Returns a map of the meta data from the database properties.
    + + + +Properties +getProperties() +
    Returns the collection of Database Properties as a properties collection.
    + + + String getProperty(String key)
    Returns the property value for the given key.
    @@ -177,8 +188,7 @@ extends void save(NvdCveInfo updatedValue) -
    Writes a properties file containing the last updated date to the - VULNERABLE_CPE directory.
    +
    Writes a properties file containing the last updated date to the VULNERABLE_CPE directory.
    @@ -210,8 +220,8 @@ extends

    MODIFIED

    public static final String MODIFIED
    -
    Modified key word, used as a key to store information about the modified - file (i.e. the containing the last 8 days of updates)..
    +
    Modified key word, used as a key to store information about the modified file (i.e. the containing the last 8 + days of updates)..
    See Also:
    Constant Field Values
    @@ -222,8 +232,8 @@ extends

    LAST_UPDATED

    public static final String LAST_UPDATED
    -
    The properties file key for the last updated field - used to store the - last updated time of the Modified NVD CVE xml file.
    +
    The properties file key for the last updated field - used to store the last updated time of the Modified NVD CVE + xml file.
    See Also:
    Constant Field Values
    @@ -234,9 +244,8 @@ extends

    LAST_UPDATED_BASE

    public static final String LAST_UPDATED_BASE
    -
    Stores the last updated time for each of the NVD CVE files. These - timestamps should be updated if we process the modified file within 7 - days of the last update.
    +
    Stores the last updated time for each of the NVD CVE files. These timestamps should be updated if we process the + modified file within 7 days of the last update.
    See Also:
    Constant Field Values
    @@ -267,8 +276,7 @@ extends NvdCveInfo updatedValue) throws UpdateException -
    Writes a properties file containing the last updated date to the - VULNERABLE_CPE directory.
    +
    Writes a properties file containing the last updated date to the VULNERABLE_CPE directory.
    Parameters:
    updatedValue - the updated NVD CVE entry
    Throws:
    UpdateException - is thrown if there is an update exception
    @@ -281,8 +289,8 @@ extends

    getProperty

    public String getProperty(String key)
    -
    Returns the property value for the given key. If the key is not contained - in the underlying properties null is returned.
    +
    Returns the property value for the given key. If the key is not contained in the underlying properties null is + returned.
    Parameters:
    key - the property key
    Returns:
    the value of the property
    @@ -290,17 +298,40 @@ extends -
      +

      • getProperty

        public String getProperty(String key,
                  String defaultValue)
        -
        Returns the property value for the given key. If the key is not contained - in the underlying properties the default value is returned.
        +
        Returns the property value for the given key. If the key is not contained in the underlying properties the + default value is returned.
        Parameters:
        key - the property key
        defaultValue - the default value
        Returns:
        the value of the property
      + + + +
        +
      • +

        getProperties

        +
        public Properties getProperties()
        +
        Returns the collection of Database Properties as a properties collection.
        +
        Returns:
        the collection of Database Properties
        +
        • +
      + + + +
        +
      • +

        getMetaData

        +
        public Map getMetaData()
        +
        Returns a map of the meta data from the database properties. This primarily contains timestamps of when the NVD + CVE information was last updated.
        +
        Returns:
        a map of the database meta data
        +
        • +
    diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/DriverLoadException.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/DriverLoadException.html index 6a078b303..14f87ad5a 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/DriverLoadException.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/DriverLoadException.html @@ -2,16 +2,16 @@ - + -DriverLoadException (Dependency-Check Core 1.0.8 API) - +DriverLoadException (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/DriverLoader.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/DriverLoader.html index 2c4129c30..3632a7eeb 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/DriverLoader.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/DriverLoader.html @@ -2,16 +2,16 @@ - + -DriverLoader (Dependency-Check Core 1.0.8 API) - +DriverLoader (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/class-use/ConnectionFactory.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/class-use/ConnectionFactory.html index d210ff692..eb6d3a644 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/class-use/ConnectionFactory.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/class-use/ConnectionFactory.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.data.nvdcve.ConnectionFactory (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.data.nvdcve.ConnectionFactory (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/class-use/CveDB.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/class-use/CveDB.html index 2b02cbcc2..f20733dc1 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/class-use/CveDB.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/class-use/CveDB.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.data.nvdcve.CveDB (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.data.nvdcve.CveDB (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/class-use/DatabaseException.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/class-use/DatabaseException.html index cc831e276..020f7e62c 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/class-use/DatabaseException.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/class-use/DatabaseException.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.data.nvdcve.DatabaseException (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.data.nvdcve.DatabaseException (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/class-use/DatabaseProperties.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/class-use/DatabaseProperties.html index 62de5a4fe..eaa8b20f4 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/class-use/DatabaseProperties.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/class-use/DatabaseProperties.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.data.nvdcve.DatabaseProperties (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.data.nvdcve.DatabaseProperties (Dependency-Check Core 1.1.0 API) + @@ -87,6 +87,17 @@ Contains classes used to work with the NVD CVE data.
    + +org.owasp.dependencycheck.reporting + +
    + + org.owasp.dependencycheck.reporting + + + Contains classes used to generate reports.
    + + @@ -112,6 +123,27 @@ +
  • + + +

    Uses of DatabaseProperties in org.owasp.dependencycheck.reporting

    + + + + + + + + + + +
    Constructors in org.owasp.dependencycheck.reporting with parameters of type DatabaseProperties 
    Constructor and Description
    ReportGenerator(String applicationName, + List<Dependency> dependencies, + List<Analyzer> analyzers, + DatabaseProperties properties) +
    Constructs a new ReportGenerator.
    +
    +
    • diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/class-use/DriverLoadException.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/class-use/DriverLoadException.html index 3c34a6cbc..d17cf1aed 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/class-use/DriverLoadException.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/class-use/DriverLoadException.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.data.nvdcve.DriverLoadException (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.data.nvdcve.DriverLoadException (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/class-use/DriverLoader.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/class-use/DriverLoader.html index 7268a5e67..f5cd1b7fb 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/class-use/DriverLoader.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/class-use/DriverLoader.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.data.nvdcve.DriverLoader (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.data.nvdcve.DriverLoader (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/package-frame.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/package-frame.html index 97fd6a74c..0778b52d5 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/package-frame.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/package-frame.html @@ -2,10 +2,10 @@ - + -org.owasp.dependencycheck.data.nvdcve (Dependency-Check Core 1.0.8 API) - +org.owasp.dependencycheck.data.nvdcve (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/package-summary.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/package-summary.html index c7d1b96a4..7683eba60 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/package-summary.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/package-summary.html @@ -2,16 +2,16 @@ - + -org.owasp.dependencycheck.data.nvdcve (Dependency-Check Core 1.0.8 API) - +org.owasp.dependencycheck.data.nvdcve (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/package-tree.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/package-tree.html index d54c1fb76..61e0e4575 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/package-tree.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/package-tree.html @@ -2,16 +2,16 @@ - + -org.owasp.dependencycheck.data.nvdcve Class Hierarchy (Dependency-Check Core 1.0.8 API) - +org.owasp.dependencycheck.data.nvdcve Class Hierarchy (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/package-use.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/package-use.html index fde74a294..48f4e530b 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/package-use.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/nvdcve/package-use.html @@ -2,16 +2,16 @@ - + -Uses of Package org.owasp.dependencycheck.data.nvdcve (Dependency-Check Core 1.0.8 API) - +Uses of Package org.owasp.dependencycheck.data.nvdcve (Dependency-Check Core 1.1.0 API) + @@ -131,6 +131,17 @@ +org.owasp.dependencycheck.reporting + +
    + + org.owasp.dependencycheck.reporting + + + Contains classes used to generate reports.
    + + + org.owasp.dependencycheck.utils
    @@ -244,6 +255,23 @@ +
  • + + + + + + + + + + + + +
    Classes in org.owasp.dependencycheck.data.nvdcve used by org.owasp.dependencycheck.reporting 
    Class and Description
    DatabaseProperties +
    This is a wrapper around a set of properties that are stored in the database.
    +
    +
  • diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/CachedWebDataSource.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/CachedWebDataSource.html index a2245b3b6..c4b17dc75 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/CachedWebDataSource.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/CachedWebDataSource.html @@ -2,16 +2,16 @@ - + -CachedWebDataSource (Dependency-Check Core 1.0.8 API) - +CachedWebDataSource (Dependency-Check Core 1.1.0 API) + @@ -94,8 +94,8 @@ 

    public interface CachedWebDataSource
    -
    Defines a data source who's data is retrieved from the Internet. This data - can be downloaded and the local cache updated.
    +
    Defines a data source who's data is retrieved from the Internet. This data can be downloaded and the local cache + updated.
    Author:
    Jeremy Long
    • @@ -119,9 +119,8 @@ void update() -
    Determines if an update to the current data store is needed, if it is the - new data is downloaded from the Internet and imported into the current - cached data store.
    +
    Determines if an update to the current data store is needed, if it is the new data is downloaded from the + Internet and imported into the current cached data store.
    @@ -147,12 +146,10 @@

    update

    void update()
             throws UpdateException
    -
    Determines if an update to the current data store is needed, if it is the - new data is downloaded from the Internet and imported into the current - cached data store.
    +
    Determines if an update to the current data store is needed, if it is the new data is downloaded from the + Internet and imported into the current cached data store.
    Throws:
    -
    UpdateException - is thrown if there is an exception downloading - the data or updating the data store.
    +
    UpdateException - is thrown if there is an exception downloading the data or updating the data store.
    diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/NvdCveInfo.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/NvdCveInfo.html index 0de75eb61..1e4abf0ee 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/NvdCveInfo.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/NvdCveInfo.html @@ -2,16 +2,16 @@ - + -NvdCveInfo (Dependency-Check Core 1.0.8 API) - +NvdCveInfo (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/NvdCveUpdater.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/NvdCveUpdater.html index d0e62b52a..80604eb5b 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/NvdCveUpdater.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/NvdCveUpdater.html @@ -2,16 +2,16 @@ - + -NvdCveUpdater (Dependency-Check Core 1.0.8 API) - +NvdCveUpdater (Dependency-Check Core 1.1.0 API) + @@ -145,8 +145,8 @@ implements void update() -
    Downloads the latest NVD CVE XML file from the web and imports it into - the current CVE Database.
    +
    + Downloads the latest NVD CVE XML file from the web and imports it into the current CVE Database.
    @@ -196,14 +196,13 @@ implements UpdateException -

    Downloads the latest NVD CVE XML file from the web and imports it into - the current CVE Database.

    +

    + Downloads the latest NVD CVE XML file from the web and imports it into the current CVE Database.

    Specified by:
    update in interface CachedWebDataSource
    Throws:
    -
    UpdateException - is thrown if there is an error updating the - database
    +
    UpdateException - is thrown if there is an error updating the database
    diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/StandardUpdate.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/StandardUpdate.html index eb413d812..d7665a9b4 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/StandardUpdate.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/StandardUpdate.html @@ -2,16 +2,16 @@ - + -StandardUpdate (Dependency-Check Core 1.0.8 API) - +StandardUpdate (Dependency-Check Core 1.1.0 API) + @@ -181,8 +181,8 @@ extends void update() -
    Downloads the latest NVD CVE XML file from the web and imports it into - the current CVE Database.
    +
    + Downloads the latest NVD CVE XML file from the web and imports it into the current CVE Database.
    @@ -196,8 +196,7 @@ extends withinRange(long date, long compareTo, int range) -
    Determines if the epoch date is within the range specified of the - compareTo epoch time.
    +
    Determines if the epoch date is within the range specified of the compareTo epoch time.
    @@ -253,10 +252,8 @@ extends Constructs a new Standard Update Task.
    Throws:
    MalformedURLException - thrown if a configured URL is malformed
    -
    DownloadFailedException - thrown if a timestamp cannot be checked - on a configured URL
    -
    UpdateException - thrown if there is an exception generating the - update task
    +
    DownloadFailedException - thrown if a timestamp cannot be checked on a configured URL
    +
    UpdateException - thrown if there is an exception generating the update task
    @@ -286,11 +283,10 @@ extends UpdateException -

    Downloads the latest NVD CVE XML file from the web and imports it into - the current CVE Database.

    +

    + Downloads the latest NVD CVE XML file from the web and imports it into the current CVE Database.

    Throws:
    -
    UpdateException - is thrown if there is an error updating the - database
    +
    UpdateException - is thrown if there is an error updating the database
    @@ -303,18 +299,14 @@ extends MalformedURLException, DownloadFailedException, UpdateException -
    Determines if the index needs to be updated. This is done by fetching the - NVD CVE meta data and checking the last update date. If the data needs to - be refreshed this method will return the NvdCveUrl for the files that - need to be updated.
    +
    Determines if the index needs to be updated. This is done by fetching the NVD CVE meta data and checking the last + update date. If the data needs to be refreshed this method will return the NvdCveUrl for the files that need to + be updated.
    Returns:
    the collection of files that need to be updated
    Throws:
    -
    MalformedURLException - is thrown if the URL for the NVD CVE Meta - data is incorrect
    -
    DownloadFailedException - is thrown if there is an error. - downloading the NVD CVE download data file
    -
    UpdateException - Is thrown if there is an issue with the last - updated properties file
    +
    MalformedURLException - is thrown if the URL for the NVD CVE Meta data is incorrect
    +
    DownloadFailedException - is thrown if there is an error. downloading the NVD CVE download data file
    +
    UpdateException - Is thrown if there is an issue with the last updated properties file
    @@ -349,10 +341,9 @@ extends Determines if the epoch date is within the range specified of the - compareTo epoch time. This takes the (compareTo-date)/1000/60/60/24 to - get the number of days. If the calculated days is less then the range the - date is considered valid.
    +
    Determines if the epoch date is within the range specified of the compareTo epoch time. This takes the + (compareTo-date)/1000/60/60/24 to get the number of days. If the calculated days is less then the range the date + is considered valid.
    Parameters:
    date - the date to be checked.
    compareTo - the date to compare to.
    range - the range in days to be considered valid.
    Returns:
    whether or not the date is within the range.
    diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/UpdateService.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/UpdateService.html index 13f210592..4c354b4dc 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/UpdateService.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/UpdateService.html @@ -2,16 +2,16 @@ - + -UpdateService (Dependency-Check Core 1.0.8 API) - +UpdateService (Dependency-Check Core 1.1.0 API) + @@ -122,8 +122,7 @@ extends     Iterator<CachedWebDataSource> getDataSources() -
    Returns an Iterator for all instances of the CachedWebDataSource - interface.
    +
    Returns an Iterator for all instances of the CachedWebDataSource interface.
    @@ -172,8 +171,7 @@ extends

    getDataSources

    public Iterator<CachedWebDataSource> getDataSources()
    -
    Returns an Iterator for all instances of the CachedWebDataSource - interface.
    +
    Returns an Iterator for all instances of the CachedWebDataSource interface.
    Returns:
    an iterator of CachedWebDataSource.
    diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/UpdateableNvdCve.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/UpdateableNvdCve.html index d2519efdb..6e2eda31c 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/UpdateableNvdCve.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/UpdateableNvdCve.html @@ -2,16 +2,16 @@ - + -UpdateableNvdCve (Dependency-Check Core 1.0.8 API) - +UpdateableNvdCve (Dependency-Check Core 1.1.0 API) + @@ -104,8 +104,8 @@ 
    public class UpdateableNvdCve
 extends Object
 implements Iterable<NvdCveInfo>, Iterator<NvdCveInfo>
    -
    Contains a collection of updateable NvdCveInfo objects. This is used to - determine which files need to be downloaded and processed.
    +
    Contains a collection of updateable NvdCveInfo objects. This is used to determine which files need to be downloaded + and processed.
    Author:
    Jeremy Long
    @@ -181,7 +181,8 @@ implements boolean hasNext() -
    Returns whether or not there is another item in the collection.
    +
    + Returns whether or not there is another item in the collection.
    @@ -193,19 +194,22 @@ implements Iterator<NvdCveInfo> iterator() -
    Returns an iterator for the NvdCveInfo contained.
    +
    + Returns an iterator for the NvdCveInfo contained.
    NvdCveInfo next() -
    Returns the next item in the collection.
    +
    + Returns the next item in the collection.
    void remove() -
    Removes the current NvdCveInfo object from the collection.
    +
    + Removes the current NvdCveInfo object from the collection.
    @@ -258,8 +262,7 @@ implements

    getCollection

    protected Map<String,NvdCveInfo> getCollection()
    -
    Returns the collection of NvdCveInfo objects. This method is mainly used - for testing.
    +
    Returns the collection of NvdCveInfo objects. This method is mainly used for testing.
    Returns:
    the collection of NvdCveInfo objects
    @@ -286,8 +289,8 @@ implements MalformedURLException, DownloadFailedException
    Adds a new entry of updateable information to the contained collection.
    -
    Parameters:
    id - the key for the item to be added
    url - the URL to download the item
    oldUrl - the URL for the old version of the item (the NVD CVE old - schema still contains useful data we need).
    +
    Parameters:
    id - the key for the item to be added
    url - the URL to download the item
    oldUrl - the URL for the old version of the item (the NVD CVE old schema still contains useful data we + need).
    Throws:
    MalformedURLException - thrown if the URL provided is invalid
    DownloadFailedException - thrown if the download fails.
    @@ -306,8 +309,8 @@ implements MalformedURLException, DownloadFailedException
    Adds a new entry of updateable information to the contained collection.
    -
    Parameters:
    id - the key for the item to be added
    url - the URL to download the item
    oldUrl - the URL for the old version of the item (the NVD CVE old - schema still contains useful data we need).
    needsUpdate - whether or not the data needs to be updated
    +
    Parameters:
    id - the key for the item to be added
    url - the URL to download the item
    oldUrl - the URL for the old version of the item (the NVD CVE old schema still contains useful data we + need).
    needsUpdate - whether or not the data needs to be updated
    Throws:
    MalformedURLException - thrown if the URL provided is invalid
    DownloadFailedException - thrown if the download fails.
    @@ -342,8 +345,10 @@ implements

    iterator

    public Iterator<NvdCveInfo> iterator()
    -

    Returns an iterator for the NvdCveInfo contained.

    -

    This method is not thread safe.

    +

    + Returns an iterator for the NvdCveInfo contained.

    +

    + This method is not thread safe.

    Specified by:
    iterator in interface Iterable<NvdCveInfo>
    @@ -357,13 +362,14 @@ implements

    hasNext

    public boolean hasNext()
    -

    Returns whether or not there is another item in the collection.

    -

    This method is not thread safe.

    +

    + Returns whether or not there is another item in the collection.

    +

    + This method is not thread safe.

    Specified by:
    hasNext in interface Iterator<NvdCveInfo>
    -
    Returns:
    true or false depending on whether or not another item exists in - the collection
    +
    Returns:
    true or false depending on whether or not another item exists in the collection
    @@ -373,8 +379,10 @@ implements

    next

    public NvdCveInfo next()
    -

    Returns the next item in the collection.

    -

    This method is not thread safe.

    +

    + Returns the next item in the collection.

    +

    + This method is not thread safe.

    Specified by:
    next in interface Iterator<NvdCveInfo>
    @@ -388,8 +396,10 @@ implements

    remove

    public void remove()
    -

    Removes the current NvdCveInfo object from the collection.

    -

    This method is not thread safe.

    +

    + Removes the current NvdCveInfo object from the collection.

    +

    + This method is not thread safe.

    Specified by:
    remove in interface Iterator<NvdCveInfo>
    diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/class-use/CachedWebDataSource.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/class-use/CachedWebDataSource.html index e5b1c81bd..975b1c98c 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/class-use/CachedWebDataSource.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/class-use/CachedWebDataSource.html @@ -2,16 +2,16 @@ - + -Uses of Interface org.owasp.dependencycheck.data.update.CachedWebDataSource (Dependency-Check Core 1.0.8 API) - +Uses of Interface org.owasp.dependencycheck.data.update.CachedWebDataSource (Dependency-Check Core 1.1.0 API) + @@ -120,8 +120,7 @@ Iterator<CachedWebDataSource> UpdateService.getDataSources() -
    Returns an Iterator for all instances of the CachedWebDataSource - interface.
    +
    Returns an Iterator for all instances of the CachedWebDataSource interface.
    diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/class-use/NvdCveInfo.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/class-use/NvdCveInfo.html index 9d2b1988c..a06f65273 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/class-use/NvdCveInfo.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/class-use/NvdCveInfo.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.data.update.NvdCveInfo (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.data.update.NvdCveInfo (Dependency-Check Core 1.1.0 API) + @@ -126,8 +126,7 @@ void DatabaseProperties.save(NvdCveInfo updatedValue) -
    Writes a properties file containing the last updated date to the - VULNERABLE_CPE directory.
    +
    Writes a properties file containing the last updated date to the VULNERABLE_CPE directory.
    @@ -147,7 +146,8 @@ NvdCveInfo UpdateableNvdCve.next() -
    Returns the next item in the collection.
    +
    + Returns the next item in the collection.
    @@ -168,7 +168,8 @@ Iterator<NvdCveInfo> UpdateableNvdCve.iterator() -
    Returns an iterator for the NvdCveInfo contained.
    +
    + Returns an iterator for the NvdCveInfo contained.
    diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/class-use/NvdCveUpdater.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/class-use/NvdCveUpdater.html index d40ab3d67..cf04c24c6 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/class-use/NvdCveUpdater.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/class-use/NvdCveUpdater.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.data.update.NvdCveUpdater (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.data.update.NvdCveUpdater (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/class-use/StandardUpdate.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/class-use/StandardUpdate.html index cf6da5d25..778e14b20 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/class-use/StandardUpdate.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/class-use/StandardUpdate.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.data.update.StandardUpdate (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.data.update.StandardUpdate (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/class-use/UpdateService.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/class-use/UpdateService.html index d12a630ac..8f253482e 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/class-use/UpdateService.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/class-use/UpdateService.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.data.update.UpdateService (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.data.update.UpdateService (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/class-use/UpdateableNvdCve.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/class-use/UpdateableNvdCve.html index 454f6d46f..eab668414 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/class-use/UpdateableNvdCve.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/class-use/UpdateableNvdCve.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.data.update.UpdateableNvdCve (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.data.update.UpdateableNvdCve (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/exception/InvalidDataException.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/exception/InvalidDataException.html index 153a06e9f..58735ee71 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/exception/InvalidDataException.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/exception/InvalidDataException.html @@ -2,16 +2,16 @@ - + -InvalidDataException (Dependency-Check Core 1.0.8 API) - +InvalidDataException (Dependency-Check Core 1.1.0 API) + @@ -113,8 +113,7 @@ 
    public class InvalidDataException
 extends Exception
    -
    An InvalidDataDataException is a generic exception used when trying to load - the NVD CVE meta data.
    +
    An InvalidDataDataException is a generic exception used when trying to load the NVD CVE meta data.
    Author:
    Jeremy Long
    See Also:
    Serialized Form
    diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/exception/UpdateException.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/exception/UpdateException.html index 6f675e64f..467602990 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/exception/UpdateException.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/exception/UpdateException.html @@ -2,16 +2,16 @@ - + -UpdateException (Dependency-Check Core 1.0.8 API) - +UpdateException (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/exception/class-use/InvalidDataException.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/exception/class-use/InvalidDataException.html index ca12948fb..913cd1ce9 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/exception/class-use/InvalidDataException.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/exception/class-use/InvalidDataException.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.data.update.exception.InvalidDataException (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.data.update.exception.InvalidDataException (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/exception/class-use/UpdateException.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/exception/class-use/UpdateException.html index e1386411d..ffe345d15 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/exception/class-use/UpdateException.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/exception/class-use/UpdateException.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.data.update.exception.UpdateException (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.data.update.exception.UpdateException (Dependency-Check Core 1.1.0 API) + @@ -126,8 +126,7 @@ void DatabaseProperties.save(NvdCveInfo updatedValue) -
    Writes a properties file containing the last updated date to the - VULNERABLE_CPE directory.
    +
    Writes a properties file containing the last updated date to the VULNERABLE_CPE directory.
    @@ -153,23 +152,22 @@ void StandardUpdate.update() -
    Downloads the latest NVD CVE XML file from the web and imports it into - the current CVE Database.
    +
    + Downloads the latest NVD CVE XML file from the web and imports it into the current CVE Database.
    void NvdCveUpdater.update() -
    Downloads the latest NVD CVE XML file from the web and imports it into - the current CVE Database.
    +
    + Downloads the latest NVD CVE XML file from the web and imports it into the current CVE Database.
    void CachedWebDataSource.update() -
    Determines if an update to the current data store is needed, if it is the - new data is downloaded from the Internet and imported into the current - cached data store.
    +
    Determines if an update to the current data store is needed, if it is the new data is downloaded from the + Internet and imported into the current cached data store.
    diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/exception/package-frame.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/exception/package-frame.html index 1e12bc07c..9a1c2df74 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/exception/package-frame.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/exception/package-frame.html @@ -2,10 +2,10 @@ - + -org.owasp.dependencycheck.data.update.exception (Dependency-Check Core 1.0.8 API) - +org.owasp.dependencycheck.data.update.exception (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/exception/package-summary.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/exception/package-summary.html index 984214266..786b12a25 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/exception/package-summary.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/exception/package-summary.html @@ -2,16 +2,16 @@ - + -org.owasp.dependencycheck.data.update.exception (Dependency-Check Core 1.0.8 API) - +org.owasp.dependencycheck.data.update.exception (Dependency-Check Core 1.1.0 API) + @@ -87,8 +87,7 @@ InvalidDataException -
    An InvalidDataDataException is a generic exception used when trying to load - the NVD CVE meta data.
    +
    An InvalidDataDataException is a generic exception used when trying to load the NVD CVE meta data.
    diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/exception/package-tree.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/exception/package-tree.html index b5ac99787..1af382346 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/exception/package-tree.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/exception/package-tree.html @@ -2,16 +2,16 @@ - + -org.owasp.dependencycheck.data.update.exception Class Hierarchy (Dependency-Check Core 1.0.8 API) - +org.owasp.dependencycheck.data.update.exception Class Hierarchy (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/exception/package-use.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/exception/package-use.html index a6f9d189c..d953be3e5 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/exception/package-use.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/exception/package-use.html @@ -2,16 +2,16 @@ - + -Uses of Package org.owasp.dependencycheck.data.update.exception (Dependency-Check Core 1.0.8 API) - +Uses of Package org.owasp.dependencycheck.data.update.exception (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/package-frame.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/package-frame.html index 3be2860d0..9858186f2 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/package-frame.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/package-frame.html @@ -2,10 +2,10 @@ - + -org.owasp.dependencycheck.data.update (Dependency-Check Core 1.0.8 API) - +org.owasp.dependencycheck.data.update (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/package-summary.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/package-summary.html index fa87aaaf5..4e8847a3c 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/package-summary.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/package-summary.html @@ -2,16 +2,16 @@ - + -org.owasp.dependencycheck.data.update (Dependency-Check Core 1.0.8 API) - +org.owasp.dependencycheck.data.update (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/package-tree.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/package-tree.html index d2c67f32b..b7c94516f 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/package-tree.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/package-tree.html @@ -2,16 +2,16 @@ - + -org.owasp.dependencycheck.data.update Class Hierarchy (Dependency-Check Core 1.0.8 API) - +org.owasp.dependencycheck.data.update Class Hierarchy (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/package-use.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/package-use.html index dc2f51d94..e23284e29 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/package-use.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/package-use.html @@ -2,16 +2,16 @@ - + -Uses of Package org.owasp.dependencycheck.data.update (Dependency-Check Core 1.0.8 API) - +Uses of Package org.owasp.dependencycheck.data.update (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/task/CallableDownloadTask.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/task/CallableDownloadTask.html index aeced9c6d..77111620b 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/task/CallableDownloadTask.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/task/CallableDownloadTask.html @@ -2,16 +2,16 @@ - + -CallableDownloadTask (Dependency-Check Core 1.0.8 API) - +CallableDownloadTask (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/task/ProcessTask.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/task/ProcessTask.html index 3baa6abe8..adc46ca8b 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/task/ProcessTask.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/task/ProcessTask.html @@ -2,16 +2,16 @@ - + -ProcessTask (Dependency-Check Core 1.0.8 API) - +ProcessTask (Dependency-Check Core 1.1.0 API) + @@ -104,8 +104,7 @@ 
    public class ProcessTask
 extends Object
 implements Callable<ProcessTask>
    -
    A callable task that will process a given set of NVD CVE xml files and update - the Cve Database accordingly.
    +
    A callable task that will process a given set of NVD CVE xml files and update the Cve Database accordingly.
    Author:
    Jeremy Long
    @@ -202,8 +201,7 @@ implements CveDB cveDB, CallableDownloadTask filePair)
    Constructs a new ProcessTask used to process an NVD CVE update.
    -
    Parameters:
    cveDB - the data store object
    filePair - the download task that contains the URL references to - download
    +
    Parameters:
    cveDB - the data store object
    filePair - the download task that contains the URL references to download
    @@ -250,8 +248,8 @@ implements call in interface Callable<ProcessTask>
    Returns:
    this object
    Throws:
    -
    Exception - thrown if there is an exception; note that any - UpdateExceptions are simply added to the tasks exception collection
    +
    Exception - thrown if there is an exception; note that any UpdateExceptions are simply added to the tasks + exception collection
    @@ -271,14 +269,12 @@ implements Imports the NVD CVE XML File into the Lucene Index.
    Parameters:
    file - the file containing the NVD CVE XML
    oldVersion - contains the file containing the NVD CVE XML 1.2
    Throws:
    -
    ParserConfigurationException - is thrown if there is a parser - configuration exception
    +
    ParserConfigurationException - is thrown if there is a parser configuration exception
    SAXException - is thrown if there is a SAXException
    IOException - is thrown if there is a IO Exception
    SQLException - is thrown if there is a SQL exception
    DatabaseException - is thrown if there is a database exception
    -
    ClassNotFoundException - thrown if the h2 database driver cannot be - loaded
    +
    ClassNotFoundException - thrown if the h2 database driver cannot be loaded
    diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/task/class-use/CallableDownloadTask.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/task/class-use/CallableDownloadTask.html index c585cd8c3..7c41c9fee 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/task/class-use/CallableDownloadTask.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/task/class-use/CallableDownloadTask.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.data.update.task.CallableDownloadTask (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.data.update.task.CallableDownloadTask (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/task/class-use/ProcessTask.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/task/class-use/ProcessTask.html index b4ab6d32f..befdea291 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/task/class-use/ProcessTask.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/task/class-use/ProcessTask.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.data.update.task.ProcessTask (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.data.update.task.ProcessTask (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/task/package-frame.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/task/package-frame.html index e92f5dd95..466bcb72f 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/task/package-frame.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/task/package-frame.html @@ -2,10 +2,10 @@ - + -org.owasp.dependencycheck.data.update.task (Dependency-Check Core 1.0.8 API) - +org.owasp.dependencycheck.data.update.task (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/task/package-summary.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/task/package-summary.html index 8f6508381..3ad685877 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/task/package-summary.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/task/package-summary.html @@ -2,16 +2,16 @@ - + -org.owasp.dependencycheck.data.update.task (Dependency-Check Core 1.0.8 API) - +org.owasp.dependencycheck.data.update.task (Dependency-Check Core 1.1.0 API) + @@ -93,8 +93,7 @@ ProcessTask -
    A callable task that will process a given set of NVD CVE xml files and update - the Cve Database accordingly.
    +
    A callable task that will process a given set of NVD CVE xml files and update the Cve Database accordingly.
    diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/task/package-tree.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/task/package-tree.html index c96f17dea..e56ace2a3 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/task/package-tree.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/task/package-tree.html @@ -2,16 +2,16 @@ - + -org.owasp.dependencycheck.data.update.task Class Hierarchy (Dependency-Check Core 1.0.8 API) - +org.owasp.dependencycheck.data.update.task Class Hierarchy (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/task/package-use.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/task/package-use.html index b5bd65c11..65161b391 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/task/package-use.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/task/package-use.html @@ -2,16 +2,16 @@ - + -Uses of Package org.owasp.dependencycheck.data.update.task (Dependency-Check Core 1.0.8 API) - +Uses of Package org.owasp.dependencycheck.data.update.task (Dependency-Check Core 1.1.0 API) + @@ -105,8 +105,7 @@ ProcessTask -
    A callable task that will process a given set of NVD CVE xml files and update - the Cve Database accordingly.
    +
    A callable task that will process a given set of NVD CVE xml files and update the Cve Database accordingly.
    diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/xml/NvdCve12Handler.Element.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/xml/NvdCve12Handler.Element.html index 29361a6c6..3fef255a2 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/xml/NvdCve12Handler.Element.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/xml/NvdCve12Handler.Element.html @@ -2,16 +2,16 @@ - + -NvdCve12Handler.Element (Dependency-Check Core 1.0.8 API) - +NvdCve12Handler.Element (Dependency-Check Core 1.1.0 API) + @@ -103,8 +103,7 @@ 
    protected static class NvdCve12Handler.Element
 extends Object
    -
    A simple class to maintain information about the current element while - parsing the NVD CVE XML.
    +
    A simple class to maintain information about the current element while parsing the NVD CVE XML.
    diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/xml/NvdCve12Handler.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/xml/NvdCve12Handler.html index aa6d986ff..75bb96c85 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/xml/NvdCve12Handler.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/xml/NvdCve12Handler.html @@ -2,16 +2,16 @@ - + -NvdCve12Handler (Dependency-Check Core 1.0.8 API) - +NvdCve12Handler (Dependency-Check Core 1.1.0 API) + @@ -108,11 +108,9 @@ 
    public class NvdCve12Handler
 extends org.xml.sax.helpers.DefaultHandler
    -
    A SAX Handler that will parse the NVD CVE XML (schema version 1.2). This - parses the xml and retrieves a listing of CPEs that have previous versions - specified. The previous version information is not in the 2.0 version of the - schema and is useful to ensure accurate identification (or at least - complete).
    +
    A SAX Handler that will parse the NVD CVE XML (schema version 1.2). This parses the xml and retrieves a listing of + CPEs that have previous versions specified. The previous version information is not in the 2.0 version of the schema + and is useful to ensure accurate identification (or at least complete).
    Author:
    Jeremy Long
    @@ -136,8 +134,7 @@ extends protected static class  NvdCve12Handler.Element -
    A simple class to maintain information about the current element while - parsing the NVD CVE XML.
    +
    A simple class to maintain information about the current element while parsing the NVD CVE XML.
    diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/xml/NvdCve20Handler.Element.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/xml/NvdCve20Handler.Element.html index fa22728a3..17eea5bb4 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/xml/NvdCve20Handler.Element.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/xml/NvdCve20Handler.Element.html @@ -2,16 +2,16 @@ - + -NvdCve20Handler.Element (Dependency-Check Core 1.0.8 API) - +NvdCve20Handler.Element (Dependency-Check Core 1.1.0 API) + @@ -103,8 +103,7 @@ 
    protected static class NvdCve20Handler.Element
 extends Object
    -
    A simple class to maintain information about the current element while - parsing the NVD CVE XML.
    +
    A simple class to maintain information about the current element while parsing the NVD CVE XML.
    diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/xml/NvdCve20Handler.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/xml/NvdCve20Handler.html index 701606d3c..fdc4a9295 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/xml/NvdCve20Handler.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/xml/NvdCve20Handler.html @@ -2,16 +2,16 @@ - + -NvdCve20Handler (Dependency-Check Core 1.0.8 API) - +NvdCve20Handler (Dependency-Check Core 1.1.0 API) + @@ -132,8 +132,7 @@ extends protected static class  NvdCve20Handler.Element -
    A simple class to maintain information about the current element while - parsing the NVD CVE XML.
    +
    A simple class to maintain information about the current element while parsing the NVD CVE XML.
    @@ -356,8 +355,7 @@ extends Map<String,List<VulnerableSoftware>> map)
    Sets the prevVersionVulnMap.
    -
    Parameters:
    map - the map of vulnerable software with previous versions being - vulnerable
    +
    Parameters:
    map - the map of vulnerable software with previous versions being vulnerable
    diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/xml/class-use/NvdCve12Handler.Element.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/xml/class-use/NvdCve12Handler.Element.html index c2abc6350..b068fe866 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/xml/class-use/NvdCve12Handler.Element.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/xml/class-use/NvdCve12Handler.Element.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.data.update.xml.NvdCve12Handler.Element (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.data.update.xml.NvdCve12Handler.Element (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/xml/class-use/NvdCve12Handler.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/xml/class-use/NvdCve12Handler.html index f30cbc5e7..451e8c67f 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/xml/class-use/NvdCve12Handler.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/xml/class-use/NvdCve12Handler.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.data.update.xml.NvdCve12Handler (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.data.update.xml.NvdCve12Handler (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/xml/class-use/NvdCve20Handler.Element.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/xml/class-use/NvdCve20Handler.Element.html index fe942412a..92f28b3f2 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/xml/class-use/NvdCve20Handler.Element.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/xml/class-use/NvdCve20Handler.Element.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.data.update.xml.NvdCve20Handler.Element (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.data.update.xml.NvdCve20Handler.Element (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/xml/class-use/NvdCve20Handler.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/xml/class-use/NvdCve20Handler.html index 35b8bd5d8..da7ebec0f 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/xml/class-use/NvdCve20Handler.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/xml/class-use/NvdCve20Handler.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.data.update.xml.NvdCve20Handler (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.data.update.xml.NvdCve20Handler (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/xml/package-frame.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/xml/package-frame.html index 35870df8d..2875897da 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/xml/package-frame.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/xml/package-frame.html @@ -2,10 +2,10 @@ - + -org.owasp.dependencycheck.data.update.xml (Dependency-Check Core 1.0.8 API) - +org.owasp.dependencycheck.data.update.xml (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/xml/package-summary.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/xml/package-summary.html index 92cb927f9..dfa5fb33f 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/xml/package-summary.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/xml/package-summary.html @@ -2,16 +2,16 @@ - + -org.owasp.dependencycheck.data.update.xml (Dependency-Check Core 1.0.8 API) - +org.owasp.dependencycheck.data.update.xml (Dependency-Check Core 1.1.0 API) + @@ -93,8 +93,7 @@ NvdCve12Handler.Element -
    A simple class to maintain information about the current element while - parsing the NVD CVE XML.
    +
    A simple class to maintain information about the current element while parsing the NVD CVE XML.
    @@ -106,8 +105,7 @@ NvdCve20Handler.Element -
    A simple class to maintain information about the current element while - parsing the NVD CVE XML.
    +
    A simple class to maintain information about the current element while parsing the NVD CVE XML.
    diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/xml/package-tree.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/xml/package-tree.html index db7330b2b..cd790a9d8 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/xml/package-tree.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/xml/package-tree.html @@ -2,16 +2,16 @@ - + -org.owasp.dependencycheck.data.update.xml Class Hierarchy (Dependency-Check Core 1.0.8 API) - +org.owasp.dependencycheck.data.update.xml Class Hierarchy (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/xml/package-use.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/xml/package-use.html index 9f72437b3..d3e241b6b 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/xml/package-use.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/data/update/xml/package-use.html @@ -2,16 +2,16 @@ - + -Uses of Package org.owasp.dependencycheck.data.update.xml (Dependency-Check Core 1.0.8 API) - +Uses of Package org.owasp.dependencycheck.data.update.xml (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/Confidence.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/Confidence.html new file mode 100644 index 000000000..d6a15f67f --- /dev/null +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/Confidence.html @@ -0,0 +1,362 @@ + + + + + + +Confidence (Dependency-Check Core 1.1.0 API) + + + + + + + +
    + + + + + +
    +
    + + + +
    + +
    +
    + + +
    + + +
    + + +
    +
    org.owasp.dependencycheck.dependency
    +

    Enum Confidence

    +
    +
    + +
    + +
    +
    + +
    +
    +
      +
    • + +
        +
      • + + +

        Enum Constant Detail

        + + + +
          +
        • +

          HIGHEST

          +
          public static final Confidence HIGHEST
          +
          High confidence evidence.
          +
          • +
        + + + +
          +
        • +

          HIGH

          +
          public static final Confidence HIGH
          +
          High confidence evidence.
          +
          • +
        + + + +
          +
        • +

          MEDIUM

          +
          public static final Confidence MEDIUM
          +
          Medium confidence evidence.
          +
          • +
        + + + +
          +
        • +

          LOW

          +
          public static final Confidence LOW
          +
          Low confidence evidence.
          +
          • +
        +
        • +
      + +
        +
      • + + +

        Method Detail

        + + + +
          +
        • +

          values

          +
          public static Confidence[] values()
          +
          Returns an array containing the constants of this enum type, in +the order they are declared. This method may be used to iterate +over the constants as follows: +
          +for (Confidence c : Confidence.values())
+    System.out.println(c);
+
          +
          Returns:
          an array containing the constants of this enum type, in +the order they are declared
          +
          • +
        + + + +
          +
        • +

          valueOf

          +
          public static Confidence valueOf(String name)
          +
          Returns the enum constant of this type with the specified name. +The string must match exactly an identifier used to declare an +enum constant in this type. (Extraneous whitespace characters are +not permitted.)
          +
          Parameters:
          name - the name of the enum constant to be returned.
          +
          Returns:
          the enum constant with the specified name
          +
          Throws:
          +
          IllegalArgumentException - if this enum type has no constant +with the specified name
          +
          NullPointerException - if the argument is null
          +
          • +
        +
        • +
      +
      • +
    +
    +
    + + +
    + + + + + +
    +
    + + + +
    + +
    +
    + + +
    + + +
    + +

    Copyright © 2012–2014 OWASP. All rights reserved.

    + + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/Dependency.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/Dependency.html index d26ac1db5..8b990aeaf 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/Dependency.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/Dependency.html @@ -2,16 +2,16 @@ - + -Dependency (Dependency-Check Core 1.0.8 API) - +Dependency (Dependency-Check Core 1.1.0 API) + @@ -37,7 +37,7 @@
    @@ -601,11 +609,24 @@ implements String type, String value, String url) -
    Adds an entry to the list of detected Identifiers for the dependency - file.
    +
    Adds an entry to the list of detected Identifiers for the dependency file.
    Parameters:
    type - the type of identifier (such as CPE)
    value - the value of the identifier
    url - the URL of the identifier
    + + + +
      +
    • +

      addIdentifier

      +
      public void addIdentifier(String type,
+                 String value,
+                 String url,
+                 Confidence confidence)
      +
      Adds an entry to the list of detected Identifiers for the dependency file.
      +
      Parameters:
      type - the type of identifier (such as CPE)
      value - the value of the identifier
      url - the URL of the identifier
      confidence - the confidence in the Identifier being accurate
      +
      • +
    @@ -613,8 +634,7 @@ implements

    addIdentifier

    public void addIdentifier(Identifier identifier)
    -
    Adds an entry to the list of detected Identifiers for the dependency - file.
    +
    Adds an entry to the list of detected Identifiers for the dependency file.
    Parameters:
    identifier - the identifier to add
    @@ -823,8 +843,7 @@ implements

    compareTo

    public int compareTo(Dependency o)
    -
    Implementation of the Comparable interface. The comparison is - solely based on the file name.
    +
    Implementation of the Comparable interface. The comparison is solely based on the file name.
    Specified by:
    compareTo in interface Comparable<Dependency>
    @@ -868,8 +887,7 @@ implements

    toString

    public String toString()
    -
    Standard toString() implementation showing the filename, actualFilePath, - and filePath.
    +
    Standard toString() implementation showing the filename, actualFilePath, and filePath.
    Overrides:
    toString in class Object
    @@ -902,7 +920,7 @@ implements
      diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/Evidence.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/Evidence.html index 91b42dd6d..5d3184bdf 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/Evidence.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/Evidence.html @@ -2,16 +2,16 @@ - + -Evidence (Dependency-Check Core 1.0.8 API) - +Evidence (Dependency-Check Core 1.1.0 API) + @@ -38,7 +38,7 @@
      - +
        @@ -298,7 +277,7 @@ implements String source, String name, String value, - Evidence.Confidence confidence) + Confidence confidence)
        Creates a new Evidence objects.
        Parameters:
        source - the source of the evidence.
        name - the name of the evidence.
        value - the value of the evidence.
        confidence - the confidence of the evidence.
        @@ -373,10 +352,8 @@ implements

        getValue

        public String getValue(Boolean setUsed)
        -
        Get the value of value. If setUsed is set to false this call to get will - not mark the evidence as used.
        -
        Parameters:
        setUsed - whether or not this call to getValue should cause the used - flag to be updated
        +
        Get the value of value. If setUsed is set to false this call to get will not mark the evidence as used.
        +
        Parameters:
        setUsed - whether or not this call to getValue should cause the used flag to be updated
        Returns:
        the value of value
      @@ -419,18 +396,18 @@ implements

    • getConfidence

      -
      public Evidence.Confidence getConfidence()
      +
      public Confidence getConfidence()
      Get the value of confidence.
      Returns:
      the value of confidence
    - +

    • setConfidence

      -
      public void setConfidence(Evidence.Confidence confidence)
      +
      public void setConfidence(Confidence confidence)
      Set the value of confidence.
      Parameters:
      confidence - new value of confidence
      • @@ -506,7 +483,7 @@ implements
      • Frames
        • @@ -530,7 +507,7 @@ implements
      • Summary: 
        • -
      • Nested | 
        • +
      • Nested | 
      • Field | 
      • Constr | 
      • Method
        • diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/EvidenceCollection.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/EvidenceCollection.html index 42f5aaca3..f930659ad 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/EvidenceCollection.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/EvidenceCollection.html @@ -2,16 +2,16 @@ - + -EvidenceCollection (Dependency-Check Core 1.0.8 API) - +EvidenceCollection (Dependency-Check Core 1.1.0 API) + @@ -37,7 +37,7 @@
      @@ -152,12 +152,11 @@ implements void -addEvidence(String source, +addEvidence(String source, String name, String value, - Evidence.Confidence confidence) -
      Creates an Evidence object from the parameters and adds the resulting - object to the collection.
      + Confidence confidence)       +
      Creates an Evidence object from the parameters and adds the resulting object to the collection.
      @@ -168,9 +167,8 @@ implements boolean -contains(Evidence.Confidence confidence) -
      Returns whether or not the collection contains evidence of a specified - Confidence.
      +contains(Confidence confidence) +
      Returns whether or not the collection contains evidence of a specified Confidence.
      @@ -182,8 +180,7 @@ implements boolean containsUsedVersion(DependencyVersion version) -
      Used to determine if a given version was used (aka read) from the - EvidenceCollection.
      +
      Used to determine if a given version was used (aka read) from the EvidenceCollection.
      @@ -208,8 +205,8 @@ implements Set<String> getWeighting() -
      Returns a set of Weightings - a list of terms that are believed to be of - higher confidence when also found in another location.
      +
      Returns a set of Weightings - a list of terms that are believed to be of higher confidence when also found in + another location.
      @@ -220,7 +217,7 @@ implements Iterable<Evidence> -iterator(Evidence.Confidence confidence) +iterator(Confidence confidence)
      Used to iterate over evidence of the specified confidence.
      @@ -233,8 +230,7 @@ implements static EvidenceCollection mergeUsed(EvidenceCollection... ec) -
      Merges multiple EvidenceCollections together, only merging evidence that - was used, into a new EvidenceCollection.
      +
      Merges multiple EvidenceCollections together, only merging evidence that was used, into a new EvidenceCollection.
      @@ -289,16 +285,15 @@ implements +

      • iterator

        -
        public final Iterable<Evidence> iterator(Evidence.Confidence confidence)
        +
        public final Iterable<Evidence> iterator(Confidence confidence)
        Used to iterate over evidence of the specified confidence.
        -
        Parameters:
        confidence - the confidence level for the evidence to be iterated - over.
        +
        Parameters:
        confidence - the confidence level for the evidence to be iterated over.
        Returns:
        Iterable an iterable collection of evidence
      @@ -313,7 +308,7 @@ implements Parameters:
      e - Evidence.
    - +
      @@ -322,9 +317,8 @@ implements String source, String name, String value, - Evidence.Confidence confidence) -
      Creates an Evidence object from the parameters and adds the resulting - object to the collection.
      + Confidence confidence) +
      Creates an Evidence object from the parameters and adds the resulting object to the collection.
      Parameters:
      source - the source of the Evidence.
      name - the name of the Evidence.
      value - the value of the Evidence.
      confidence - the confidence of the Evidence.
    @@ -335,17 +329,13 @@ implements

    addWeighting

    public void addWeighting(String str)
    -
    Adds term to the weighting collection. The terms added here are used - later to boost the score of other terms. This is a way of combining - evidence from multiple sources to boost the confidence of the given - evidence. +
    Adds term to the weighting collection. The terms added here are used later to boost the score of other terms. + This is a way of combining evidence from multiple sources to boost the confidence of the given evidence. - Example: The term 'Apache' is found in the manifest of a JAR and is added - to the Collection. When we parse the package names within the JAR file we - may add these package names to the "weighted" strings collection to boost - the score in the Lucene query. That way when we construct the Lucene - query we find the term Apache in the collection AND in the weighted - strings; as such, we will boost the confidence of the term Apache.
    + Example: The term 'Apache' is found in the manifest of a JAR and is added to the Collection. When we parse the + package names within the JAR file we may add these package names to the "weighted" strings collection to boost + the score in the Lucene query. That way when we construct the Lucene query we find the term Apache in the + collection AND in the weighted strings; as such, we will boost the confidence of the term Apache.
    Parameters:
    str - to add to the weighting collection.
    @@ -356,8 +346,8 @@ implements

    getWeighting

    public Set<String> getWeighting()
    -
    Returns a set of Weightings - a list of terms that are believed to be of - higher confidence when also found in another location.
    +
    Returns a set of Weightings - a list of terms that are believed to be of higher confidence when also found in + another location.
    Returns:
    Set
    @@ -430,21 +420,19 @@ implements

    containsUsedVersion

    public boolean containsUsedVersion(DependencyVersion version)
    -
    Used to determine if a given version was used (aka read) from the - EvidenceCollection.
    +
    Used to determine if a given version was used (aka read) from the EvidenceCollection.
    Parameters:
    version - the version to search for within the collected evidence.
    Returns:
    whether or not the string was used.
    - +

    • contains

      -
      public boolean contains(Evidence.Confidence confidence)
      -
      Returns whether or not the collection contains evidence of a specified - Confidence.
      +
      public boolean contains(Confidence confidence)
      +
      Returns whether or not the collection contains evidence of a specified Confidence.
      Parameters:
      confidence - A Confidence value.
      Returns:
      boolean.
      • @@ -456,8 +444,7 @@ implements

      mergeUsed

      public static EvidenceCollection mergeUsed(EvidenceCollection... ec)
      -
      Merges multiple EvidenceCollections together, only merging evidence that - was used, into a new EvidenceCollection.
      +
      Merges multiple EvidenceCollections together, only merging evidence that was used, into a new EvidenceCollection.
      Parameters:
      ec - One or more EvidenceCollections.
      Returns:
      a new EvidenceCollection containing the used evidence.
      @@ -525,7 +512,7 @@ implements
        diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/Identifier.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/Identifier.html index 702c4933f..cebab8abf 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/Identifier.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/Identifier.html @@ -2,16 +2,16 @@ - + -Identifier (Dependency-Check Core 1.0.8 API) - +Identifier (Dependency-Check Core 1.1.0 API) + @@ -164,33 +164,45 @@ implements equals(Object obj)  +Confidence +getConfidence() +
        Get the value of confidence.
        + + + String getDescription()
        Get the value of description.
        - + String getType()
        Get the value of type.
        - + String getUrl()
        Get the value of url.
        - + String getValue()
        Get the value of value.
        - + int hashCode()  + +void +setConfidence(Confidence confidence) +
        Set the value of confidence.
        + + void setDescription(String description) @@ -200,7 +212,8 @@ implements void setType(String type) -
        Set the value of type.
        +
        + Set the value of type.
        @@ -278,6 +291,28 @@ implements + + +
          +
        • +

          getConfidence

          +
          public Confidence getConfidence()
          +
          Get the value of confidence.
          +
          Returns:
          the value of confidence
          +
          • +
        + + + +
          +
        • +

          setConfidence

          +
          public void setConfidence(Confidence confidence)
          +
          Set the value of confidence.
          +
          Parameters:
          confidence - new value of confidence
          +
          • +
        @@ -340,7 +375,9 @@ implements

        setType

        public void setType(String type)
        -

        Set the value of type.

        Example would be "CPE".

        +

        + Set the value of type.

        + Example would be "CPE".

        Parameters:
        type - new value of type
      @@ -413,8 +450,7 @@ implements

      compareTo

      public int compareTo(Identifier o)
      -
      Implementation of the comparator interface. This compares the value of - the identifier only.
      +
      Implementation of the comparator interface. This compares the value of the identifier only.
      Specified by:
      compareTo in interface Comparable<Identifier>
      diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/Reference.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/Reference.html index 33fe2c98a..9177f527f 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/Reference.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/Reference.html @@ -2,16 +2,16 @@ - + -Reference (Dependency-Check Core 1.0.8 API) - +Reference (Dependency-Check Core 1.1.0 API) + @@ -104,8 +104,7 @@ 
      public class Reference
 extends Object
 implements Serializable, Comparable<Reference>
      -
      An external reference for a vulnerability. This contains a name, URL, and a - source.
      +
      An external reference for a vulnerability. This contains a name, URL, and a source.
      Author:
      Jeremy Long
      See Also:
      Serialized Form
      diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/Vulnerability.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/Vulnerability.html index 0726522bc..13a6cce11 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/Vulnerability.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/Vulnerability.html @@ -2,16 +2,16 @@ - + -Vulnerability (Dependency-Check Core 1.0.8 API) - +Vulnerability (Dependency-Check Core 1.1.0 API) + @@ -236,6 +236,18 @@ implements String +getMatchedAllPreviousCPE() +
      Get the value of matchedAllPreviousCPE.
      + + + +String +getMatchedCPE() +
      Get the value of matchedCPE.
      + + + +String getName()
      Get the value of name.
      @@ -257,59 +269,72 @@ implements hashCode()  +boolean +hasMatchedAllPreviousCPE() +
      Determines whether or not matchedAllPreviousCPE has been set.
      + + + void setCvssAccessComplexity(String cvssAccessComplexity)
      Set the value of cvssAccessComplexity.
      - + void setCvssAccessVector(String cvssAccessVector)
      Set the value of cvssAccessVector.
      - + void setCvssAuthentication(String cvssAuthentication)
      Set the value of cvssAuthentication.
      - + void setCvssAvailabilityImpact(String cvssAvailabilityImpact)
      Set the value of cvssAvailabilityImpact.
      - + void setCvssConfidentialityImpact(String cvssConfidentialityImpact)
      Set the value of cvssConfidentialityImpact.
      - + void setCvssIntegrityImpact(String cvssIntegrityImpact)
      Set the value of cvssIntegrityImpact.
      - + void setCvssScore(float cvssScore)
      Set the value of cvssScore.
      - + void setCwe(String cwe)
      Set the value of cwe.
      - + void setDescription(String description)
      Set the value of description.
      + +void +setMatchedCPE(String cpeId, + String previous) +
      Sets the CPE that caused this vulnerability to be flagged.
      + + void setName(String name) @@ -506,8 +531,7 @@ implements String cpe, String previousVersion)
      Adds an entry for vulnerable software.
      -
      Parameters:
      cpe - string representation of a cpe
      previousVersion - the previous version (previousVersion - cpe would - be considered vulnerable)
      +
      Parameters:
      cpe - string representation of a cpe
      previousVersion - the previous version (previousVersion - cpe would be considered vulnerable)
      Returns:
      if the add succeeded
    @@ -728,7 +752,7 @@ implements -
      +

      • compareTo

        public int compareTo(Vulnerability v)
        @@ -737,8 +761,54 @@ implements compareTo in interface Comparable<Vulnerability>
        Parameters:
        v - a vulnerability to be compared
        -
        Returns:
        a negative integer, zero, or a positive integer as this object is - less than, equal to, or greater than the specified vulnerability
        +
        Returns:
        a negative integer, zero, or a positive integer as this object is less than, equal to, or greater than + the specified vulnerability
        +
        • +
      + + + +
        +
      • +

        setMatchedCPE

        +
        public void setMatchedCPE(String cpeId,
+                 String previous)
        +
        Sets the CPE that caused this vulnerability to be flagged.
        +
        Parameters:
        cpeId - a CPE identifier
        previous - a flag indicating whether or not all previous versions were affected (any non-null value is + considered true)
        +
        • +
      + + + +
        +
      • +

        getMatchedCPE

        +
        public String getMatchedCPE()
        +
        Get the value of matchedCPE.
        +
        Returns:
        the value of matchedCPE
        +
        • +
      + + + +
        +
      • +

        getMatchedAllPreviousCPE

        +
        public String getMatchedAllPreviousCPE()
        +
        Get the value of matchedAllPreviousCPE.
        +
        Returns:
        the value of matchedAllPreviousCPE
        +
        • +
      + + + +
        +
      • +

        hasMatchedAllPreviousCPE

        +
        public boolean hasMatchedAllPreviousCPE()
        +
        Determines whether or not matchedAllPreviousCPE has been set.
        +
        Returns:
        true if matchedAllPreviousCPE is not null; otherwise false
      diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/VulnerabilityComparator.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/VulnerabilityComparator.html index 1702cd0ff..ea58b74d3 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/VulnerabilityComparator.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/VulnerabilityComparator.html @@ -2,16 +2,16 @@ - + -VulnerabilityComparator (Dependency-Check Core 1.0.8 API) - +VulnerabilityComparator (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/VulnerableSoftware.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/VulnerableSoftware.html index 5ddb8e2c2..081f89acb 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/VulnerableSoftware.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/VulnerableSoftware.html @@ -2,16 +2,16 @@ - + -VulnerableSoftware (Dependency-Check Core 1.0.8 API) - +VulnerableSoftware (Dependency-Check Core 1.1.0 API) + @@ -109,8 +109,7 @@ 
      public class VulnerableSoftware
 extends IndexEntry
 implements Serializable, Comparable<VulnerableSoftware>
      -
      A record containing information about vulnerable software. This is referenced - from a vulnerability.
      +
      A record containing information about vulnerable software. This is referenced from a vulnerability.
      Author:
      Jeremy Long
      See Also:
      Serialized Form
      @@ -158,8 +157,7 @@ implements boolean equals(Object obj) -
      Standard equals implementation to compare this VulnerableSoftware to - another object.
      +
      Standard equals implementation to compare this VulnerableSoftware to another object.
      @@ -207,8 +205,9 @@ implements void parseName(String cpeName) -
      Parses a name attribute value, from the cpe.xml, into its - corresponding parts: vendor, product, version, revision.
      +
      + Parses a name attribute value, from the cpe.xml, into its corresponding parts: vendor, product, version, + revision.
      @@ -250,8 +249,7 @@ implements String toString() -
      Standard toString() implementation display the name and whether or not - previous versions are also affected.
      +
      Standard toString() implementation display the name and whether or not previous versions are also affected.
      @@ -319,12 +317,15 @@ implements String cpeName) throws UnsupportedEncodingException -

      Parses a name attribute value, from the cpe.xml, into its - corresponding parts: vendor, product, version, revision.

      -

      Example:

      +

      + Parses a name attribute value, from the cpe.xml, into its corresponding parts: vendor, product, version, + revision.

      +

      + Example:

         cpe:/a:apache:struts:1.1:rc2 -

      Results in:

      • Vendor: apache
      • Product: struts
        • +

        + Results in:

        • Vendor: apache
        • Product: struts
        • Version: 1.1
        • Revision: rc2
      Overrides:
      @@ -374,8 +375,7 @@ implements

      equals

      public boolean equals(Object obj)
      -
      Standard equals implementation to compare this VulnerableSoftware to - another object.
      +
      Standard equals implementation to compare this VulnerableSoftware to another object.
      Overrides:
      equals in class IndexEntry
      @@ -404,8 +404,7 @@ implements

      toString

      public String toString()
      -
      Standard toString() implementation display the name and whether or not - previous versions are also affected.
      +
      Standard toString() implementation display the name and whether or not previous versions are also affected.
      Overrides:
      toString in class IndexEntry
      diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/class-use/Confidence.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/class-use/Confidence.html new file mode 100644 index 000000000..27d70cca3 --- /dev/null +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/class-use/Confidence.html @@ -0,0 +1,252 @@ + + + + + + +Uses of Class org.owasp.dependencycheck.dependency.Confidence (Dependency-Check Core 1.1.0 API) + + + + + + + +
      + + + + + +
      +
      +
        +
      • Prev
        • +
      • Next
        • +
      + + +
      + +
      + + +
      + +
      +

      Uses of Class
      org.owasp.dependencycheck.dependency.Confidence

      +
      +
      + +
      + +
      + + + + + +
      +
      +
        +
      • Prev
        • +
      • Next
        • +
      + + +
      + +
      + + +
      + +

      Copyright © 2012–2014 OWASP. All rights reserved.

      + + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/class-use/Dependency.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/class-use/Dependency.html index 1b52eab0d..415500e95 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/class-use/Dependency.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/class-use/Dependency.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.dependency.Dependency (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.dependency.Dependency (Dependency-Check Core 1.1.0 API) + @@ -177,8 +177,7 @@ void NvdCveAnalyzer.analyze(Dependency dependency, Engine engine) -
      Analyzes a dependency and attempts to determine if there are any CPE - identifiers for this dependency.
      +
      Analyzes a dependency and attempts to determine if there are any CPE identifiers for this dependency.
      @@ -192,24 +191,24 @@ void JavaScriptAnalyzer.analyze(Dependency dependency, Engine engine) -
      Loads a specified JAR file and collects information from the manifest and - checksums to identify the correct CPE information.
      +
      Loads a specified JAR file and collects information from the manifest and checksums to identify the correct CPE + information.
      void JarAnalyzer.analyze(Dependency dependency, Engine engine) -
      Loads a specified JAR file and collects information from the manifest and - checksums to identify the correct CPE information.
      +
      Loads a specified JAR file and collects information from the manifest and checksums to identify the correct CPE + information.
      void HintAnalyzer.analyze(Dependency dependency, Engine engine) -
      The HintAnalyzer uses knowledge about a dependency to add additional - information to help in identification of identifiers or vulnerabilities.
      +
      The HintAnalyzer uses knowledge about a dependency to add additional information to help in identification of + identifiers or vulnerabilities.
      @@ -223,8 +222,7 @@ void FalsePositiveAnalyzer.analyze(Dependency dependency, Engine engine) -
      Analyzes the dependencies and removes bad/incorrect CPE associations - based on various heuristics.
      +
      Analyzes the dependencies and removes bad/incorrect CPE associations based on various heuristics.
      @@ -243,8 +241,7 @@ void CPEAnalyzer.analyze(Dependency dependency, Engine engine) -
      Analyzes a dependency and attempts to determine if there are any CPE - identifiers for this dependency.
      +
      Analyzes a dependency and attempts to determine if there are any CPE identifiers for this dependency.
      @@ -266,29 +263,31 @@ JarAnalyzer.analyzePackageNames(ArrayList<JarAnalyzer.ClassNameInformation> classNames, Dependency dependency, boolean addPackagesAsEvidence) -
      Analyzes the path information of the classes contained within the - JarAnalyzer to try and determine possible vendor or product names.
      +
      Analyzes the path information of the classes contained within the JarAnalyzer to try and determine possible + vendor or product names.
      protected boolean -JarAnalyzer.analyzePOM(Dependency dependency, - ArrayList<JarAnalyzer.ClassNameInformation> classes) +JarAnalyzer.analyzePOM(Dependency dependency, + ArrayList<JarAnalyzer.ClassNameInformation> classes, + Engine engine)
      Attempts to find a pom.xml within the JAR file.
      protected void CPEAnalyzer.determineCPE(Dependency dependency) -
      Searches the data store of CPE entries, trying to identify the CPE for - the given dependency based on the evidence contained within.
      +
      Searches the data store of CPE entries, trying to identify the CPE for the given dependency based on the evidence + contained within.
      protected boolean JarAnalyzer.parseManifest(Dependency dependency, ArrayList<JarAnalyzer.ClassNameInformation> classInformation) -
      Reads the manifest from the JAR file and collects the entries.
      +
      + Reads the manifest from the JAR file and collects the entries.
      @@ -361,9 +360,10 @@ -ReportGenerator(String applicationName, +ReportGenerator(String applicationName, List<Dependency> dependencies, - List<Analyzer> analyzers) + List<Analyzer> analyzers, + DatabaseProperties properties)
      Constructs a new ReportGenerator.
      @@ -384,8 +384,7 @@ void SuppressionRule.process(Dependency dependency) -
      Processes a given dependency to determine if any CPE, CVE, CWE, or CVSS - scores should be suppressed.
      +
      Processes a given dependency to determine if any CPE, CVE, CWE, or CVSS scores should be suppressed.
      diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/class-use/Evidence.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/class-use/Evidence.html index 5e0257e01..4173760d4 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/class-use/Evidence.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/class-use/Evidence.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.dependency.Evidence (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.dependency.Evidence (Dependency-Check Core 1.1.0 API) + @@ -130,7 +130,7 @@ Iterable<Evidence> -EvidenceCollection.iterator(Evidence.Confidence confidence) +EvidenceCollection.iterator(Confidence confidence)
      Used to iterate over evidence of the specified confidence.
      diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/class-use/EvidenceCollection.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/class-use/EvidenceCollection.html index afdfbc822..7cf851e8b 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/class-use/EvidenceCollection.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/class-use/EvidenceCollection.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.dependency.EvidenceCollection (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.dependency.EvidenceCollection (Dependency-Check Core 1.1.0 API) + @@ -142,8 +142,7 @@ static EvidenceCollection EvidenceCollection.mergeUsed(EvidenceCollection... ec) -
      Merges multiple EvidenceCollections together, only merging evidence that - was used, into a new EvidenceCollection.
      +
      Merges multiple EvidenceCollections together, only merging evidence that was used, into a new EvidenceCollection.
      @@ -164,8 +163,7 @@ static EvidenceCollection EvidenceCollection.mergeUsed(EvidenceCollection... ec) -
      Merges multiple EvidenceCollections together, only merging evidence that - was used, into a new EvidenceCollection.
      +
      Merges multiple EvidenceCollections together, only merging evidence that was used, into a new EvidenceCollection.
      diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/class-use/Identifier.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/class-use/Identifier.html index c8fe23911..47bda3c71 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/class-use/Identifier.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/class-use/Identifier.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.dependency.Identifier (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.dependency.Identifier (Dependency-Check Core 1.1.0 API) + @@ -121,8 +121,7 @@ void Dependency.addIdentifier(Identifier identifier) -
      Adds an entry to the list of detected Identifiers for the dependency - file.
      +
      Adds an entry to the list of detected Identifiers for the dependency file.
      diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/class-use/Reference.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/class-use/Reference.html index 162eb6f39..b2f89eca3 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/class-use/Reference.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/class-use/Reference.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.dependency.Reference (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.dependency.Reference (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/class-use/Vulnerability.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/class-use/Vulnerability.html index 474d77fa5..9d252fb90 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/class-use/Vulnerability.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/class-use/Vulnerability.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.dependency.Vulnerability (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.dependency.Vulnerability (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/class-use/VulnerabilityComparator.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/class-use/VulnerabilityComparator.html index e39624806..023086bcd 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/class-use/VulnerabilityComparator.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/class-use/VulnerabilityComparator.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.dependency.VulnerabilityComparator (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.dependency.VulnerabilityComparator (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/class-use/VulnerableSoftware.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/class-use/VulnerableSoftware.html index 4cb89156f..b2557c13b 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/class-use/VulnerableSoftware.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/class-use/VulnerableSoftware.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.dependency.VulnerableSoftware (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.dependency.VulnerableSoftware (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/package-frame.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/package-frame.html index 48547fb4e..4cab30628 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/package-frame.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/package-frame.html @@ -2,10 +2,10 @@ - + -org.owasp.dependencycheck.dependency (Dependency-Check Core 1.0.8 API) - +org.owasp.dependencycheck.dependency (Dependency-Check Core 1.1.0 API) + @@ -24,7 +24,7 @@

    Enums

    diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/package-summary.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/package-summary.html index 0496c2467..97aa80527 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/package-summary.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/package-summary.html @@ -2,16 +2,16 @@ - + -org.owasp.dependencycheck.dependency (Dependency-Check Core 1.0.8 API) - +org.owasp.dependencycheck.dependency (Dependency-Check Core 1.1.0 API) + @@ -143,9 +143,9 @@ -Evidence.Confidence +Confidence -
    The confidence that the evidence is "high" quality.
    +
    A confidence enumeration.
    diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/package-tree.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/package-tree.html index 4711a5717..508f77954 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/package-tree.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/package-tree.html @@ -2,16 +2,16 @@ - + -org.owasp.dependencycheck.dependency Class Hierarchy (Dependency-Check Core 1.0.8 API) - +org.owasp.dependencycheck.dependency Class Hierarchy (Dependency-Check Core 1.1.0 API) + @@ -96,7 +96,7 @@ diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/package-use.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/package-use.html index 98e028375..7499609a6 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/package-use.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/dependency/package-use.html @@ -2,16 +2,16 @@ - + -Uses of Package org.owasp.dependencycheck.dependency (Dependency-Check Core 1.0.8 API) - +Uses of Package org.owasp.dependencycheck.dependency (Dependency-Check Core 1.1.0 API) + @@ -239,20 +239,20 @@ +Confidence +
    A confidence enumeration.
    + + + Dependency
    A program dependency.
    - + Evidence
    Evidence is a piece of information about a Dependency.
    - -Evidence.Confidence -
    The confidence that the evidence is "high" quality.
    - - EvidenceCollection
    Used to maintain a collection of Evidence.
    diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/exception/NoDataException.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/exception/NoDataException.html index d46bf5b08..9ecea46fa 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/exception/NoDataException.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/exception/NoDataException.html @@ -2,16 +2,16 @@ - + -NoDataException (Dependency-Check Core 1.0.8 API) - +NoDataException (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/exception/class-use/NoDataException.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/exception/class-use/NoDataException.html index 5247ca0b2..bb27a4c4a 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/exception/class-use/NoDataException.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/exception/class-use/NoDataException.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.exception.NoDataException (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.exception.NoDataException (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/exception/package-frame.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/exception/package-frame.html index 5b7f2206d..959dd4c1f 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/exception/package-frame.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/exception/package-frame.html @@ -2,10 +2,10 @@ - + -org.owasp.dependencycheck.exception (Dependency-Check Core 1.0.8 API) - +org.owasp.dependencycheck.exception (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/exception/package-summary.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/exception/package-summary.html index abf6a9f96..4d05efb7d 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/exception/package-summary.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/exception/package-summary.html @@ -2,16 +2,16 @@ - + -org.owasp.dependencycheck.exception (Dependency-Check Core 1.0.8 API) - +org.owasp.dependencycheck.exception (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/exception/package-tree.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/exception/package-tree.html index 546d34fed..ea935715a 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/exception/package-tree.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/exception/package-tree.html @@ -2,16 +2,16 @@ - + -org.owasp.dependencycheck.exception Class Hierarchy (Dependency-Check Core 1.0.8 API) - +org.owasp.dependencycheck.exception Class Hierarchy (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/exception/package-use.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/exception/package-use.html index b2aa0079f..ef9e545ab 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/exception/package-use.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/exception/package-use.html @@ -2,16 +2,16 @@ - + -Uses of Package org.owasp.dependencycheck.exception (Dependency-Check Core 1.0.8 API) - +Uses of Package org.owasp.dependencycheck.exception (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/MavenNamespaceFilter.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/MavenNamespaceFilter.html index a96b45a76..18419ddb9 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/MavenNamespaceFilter.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/MavenNamespaceFilter.html @@ -2,16 +2,16 @@ - + -MavenNamespaceFilter (Dependency-Check Core 1.0.8 API) - +MavenNamespaceFilter (Dependency-Check Core 1.1.0 API) + @@ -108,9 +108,9 @@ 
    public class MavenNamespaceFilter
 extends org.xml.sax.helpers.XMLFilterImpl
    -
    This filter is used when parsing POM documents. Some POM documents do not - specify the xmlns="http://maven.apache.org/POM/4.0.0". This filter ensures - that the correct namespace is added so that both types of POMs can be read.
    +
    This filter is used when parsing POM documents. Some POM documents do not specify the + xmlns="http://maven.apache.org/POM/4.0.0". This filter ensures that the correct namespace is added so that both types + of POMs can be read.
    Author:
    Jeremy Long
    diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/class-use/MavenNamespaceFilter.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/class-use/MavenNamespaceFilter.html index f629879b1..07e641dda 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/class-use/MavenNamespaceFilter.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/class-use/MavenNamespaceFilter.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.jaxb.pom.MavenNamespaceFilter (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.jaxb.pom.MavenNamespaceFilter (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Activation.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Activation.html index 62adbe81c..942511800 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Activation.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Activation.html @@ -2,16 +2,16 @@ - + -Activation (Dependency-Check Core 1.0.8 API) - +Activation (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/ActivationFile.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/ActivationFile.html index fa51934b4..967237b8c 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/ActivationFile.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/ActivationFile.html @@ -2,16 +2,16 @@ - + -ActivationFile (Dependency-Check Core 1.0.8 API) - +ActivationFile (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/ActivationOS.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/ActivationOS.html index 54fd2bd45..eb67677ac 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/ActivationOS.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/ActivationOS.html @@ -2,16 +2,16 @@ - + -ActivationOS (Dependency-Check Core 1.0.8 API) - +ActivationOS (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/ActivationProperty.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/ActivationProperty.html index 203659fb2..27424e5da 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/ActivationProperty.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/ActivationProperty.html @@ -2,16 +2,16 @@ - + -ActivationProperty (Dependency-Check Core 1.0.8 API) - +ActivationProperty (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Build.Extensions.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Build.Extensions.html index 45ae29571..12d176916 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Build.Extensions.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Build.Extensions.html @@ -2,16 +2,16 @@ - + -Build.Extensions (Dependency-Check Core 1.0.8 API) - +Build.Extensions (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Build.Filters.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Build.Filters.html index 95f5ec564..b154b39ca 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Build.Filters.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Build.Filters.html @@ -2,16 +2,16 @@ - + -Build.Filters (Dependency-Check Core 1.0.8 API) - +Build.Filters (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Build.Plugins.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Build.Plugins.html index b4fd4a7ec..dbf4e16e1 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Build.Plugins.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Build.Plugins.html @@ -2,16 +2,16 @@ - + -Build.Plugins (Dependency-Check Core 1.0.8 API) - +Build.Plugins (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Build.Resources.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Build.Resources.html index 9a10354ec..ae8daba8b 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Build.Resources.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Build.Resources.html @@ -2,16 +2,16 @@ - + -Build.Resources (Dependency-Check Core 1.0.8 API) - +Build.Resources (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Build.TestResources.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Build.TestResources.html index 90325fcdd..70141e380 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Build.TestResources.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Build.TestResources.html @@ -2,16 +2,16 @@ - + -Build.TestResources (Dependency-Check Core 1.0.8 API) - +Build.TestResources (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Build.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Build.html index 2e993a48b..f3516c327 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Build.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Build.html @@ -2,16 +2,16 @@ - + -Build (Dependency-Check Core 1.0.8 API) - +Build (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/BuildBase.Filters.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/BuildBase.Filters.html index 7d871c6dd..bb5525cd5 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/BuildBase.Filters.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/BuildBase.Filters.html @@ -2,16 +2,16 @@ - + -BuildBase.Filters (Dependency-Check Core 1.0.8 API) - +BuildBase.Filters (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/BuildBase.Plugins.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/BuildBase.Plugins.html index cd077f947..fb5b98219 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/BuildBase.Plugins.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/BuildBase.Plugins.html @@ -2,16 +2,16 @@ - + -BuildBase.Plugins (Dependency-Check Core 1.0.8 API) - +BuildBase.Plugins (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/BuildBase.Resources.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/BuildBase.Resources.html index 99ce0d0f0..23c88fef6 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/BuildBase.Resources.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/BuildBase.Resources.html @@ -2,16 +2,16 @@ - + -BuildBase.Resources (Dependency-Check Core 1.0.8 API) - +BuildBase.Resources (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/BuildBase.TestResources.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/BuildBase.TestResources.html index f3451d329..c3cee15ca 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/BuildBase.TestResources.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/BuildBase.TestResources.html @@ -2,16 +2,16 @@ - + -BuildBase.TestResources (Dependency-Check Core 1.0.8 API) - +BuildBase.TestResources (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/BuildBase.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/BuildBase.html index 05526ad77..4ea6a9fcb 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/BuildBase.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/BuildBase.html @@ -2,16 +2,16 @@ - + -BuildBase (Dependency-Check Core 1.0.8 API) - +BuildBase (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/CiManagement.Notifiers.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/CiManagement.Notifiers.html index 3d91977fd..85620e8c2 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/CiManagement.Notifiers.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/CiManagement.Notifiers.html @@ -2,16 +2,16 @@ - + -CiManagement.Notifiers (Dependency-Check Core 1.0.8 API) - +CiManagement.Notifiers (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/CiManagement.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/CiManagement.html index 4483e94d5..c88ad36f0 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/CiManagement.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/CiManagement.html @@ -2,16 +2,16 @@ - + -CiManagement (Dependency-Check Core 1.0.8 API) - +CiManagement (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Contributor.Properties.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Contributor.Properties.html index 49932c83d..444d89a15 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Contributor.Properties.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Contributor.Properties.html @@ -2,16 +2,16 @@ - + -Contributor.Properties (Dependency-Check Core 1.0.8 API) - +Contributor.Properties (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Contributor.Roles.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Contributor.Roles.html index dc4fd0649..51c1cf988 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Contributor.Roles.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Contributor.Roles.html @@ -2,16 +2,16 @@ - + -Contributor.Roles (Dependency-Check Core 1.0.8 API) - +Contributor.Roles (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Contributor.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Contributor.html index e719c007e..0813313b8 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Contributor.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Contributor.html @@ -2,16 +2,16 @@ - + -Contributor (Dependency-Check Core 1.0.8 API) - +Contributor (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Dependency.Exclusions.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Dependency.Exclusions.html index 595af7cdd..daf6e006d 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Dependency.Exclusions.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Dependency.Exclusions.html @@ -2,16 +2,16 @@ - + -Dependency.Exclusions (Dependency-Check Core 1.0.8 API) - +Dependency.Exclusions (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Dependency.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Dependency.html index 4b472974c..8bed8733f 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Dependency.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Dependency.html @@ -2,16 +2,16 @@ - + -Dependency (Dependency-Check Core 1.0.8 API) - +Dependency (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/DependencyManagement.Dependencies.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/DependencyManagement.Dependencies.html index 14b6fea95..fdd741197 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/DependencyManagement.Dependencies.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/DependencyManagement.Dependencies.html @@ -2,16 +2,16 @@ - + -DependencyManagement.Dependencies (Dependency-Check Core 1.0.8 API) - +DependencyManagement.Dependencies (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/DependencyManagement.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/DependencyManagement.html index 5e23f05b1..a58196bb8 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/DependencyManagement.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/DependencyManagement.html @@ -2,16 +2,16 @@ - + -DependencyManagement (Dependency-Check Core 1.0.8 API) - +DependencyManagement (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/DeploymentRepository.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/DeploymentRepository.html index d9d82b609..e1a82dcbb 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/DeploymentRepository.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/DeploymentRepository.html @@ -2,16 +2,16 @@ - + -DeploymentRepository (Dependency-Check Core 1.0.8 API) - +DeploymentRepository (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Developer.Properties.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Developer.Properties.html index e65c135ad..806c9bae9 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Developer.Properties.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Developer.Properties.html @@ -2,16 +2,16 @@ - + -Developer.Properties (Dependency-Check Core 1.0.8 API) - +Developer.Properties (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Developer.Roles.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Developer.Roles.html index 2fe9200dc..a9aa41599 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Developer.Roles.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Developer.Roles.html @@ -2,16 +2,16 @@ - + -Developer.Roles (Dependency-Check Core 1.0.8 API) - +Developer.Roles (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Developer.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Developer.html index 87a947066..25218acdd 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Developer.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Developer.html @@ -2,16 +2,16 @@ - + -Developer (Dependency-Check Core 1.0.8 API) - +Developer (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/DistributionManagement.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/DistributionManagement.html index 3ddd57780..637457602 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/DistributionManagement.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/DistributionManagement.html @@ -2,16 +2,16 @@ - + -DistributionManagement (Dependency-Check Core 1.0.8 API) - +DistributionManagement (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Exclusion.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Exclusion.html index 74d032d9c..5641935bd 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Exclusion.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Exclusion.html @@ -2,16 +2,16 @@ - + -Exclusion (Dependency-Check Core 1.0.8 API) - +Exclusion (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Extension.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Extension.html index 3a229730b..812da754b 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Extension.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Extension.html @@ -2,16 +2,16 @@ - + -Extension (Dependency-Check Core 1.0.8 API) - +Extension (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/IssueManagement.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/IssueManagement.html index b04a6ab9c..9718aa807 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/IssueManagement.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/IssueManagement.html @@ -2,16 +2,16 @@ - + -IssueManagement (Dependency-Check Core 1.0.8 API) - +IssueManagement (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/License.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/License.html index 529adb31a..baa26915a 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/License.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/License.html @@ -2,16 +2,16 @@ - + -License (Dependency-Check Core 1.0.8 API) - +License (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/MailingList.OtherArchives.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/MailingList.OtherArchives.html index 3e1b15d58..70e806035 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/MailingList.OtherArchives.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/MailingList.OtherArchives.html @@ -2,16 +2,16 @@ - + -MailingList.OtherArchives (Dependency-Check Core 1.0.8 API) - +MailingList.OtherArchives (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/MailingList.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/MailingList.html index 6d58f8084..706ae064c 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/MailingList.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/MailingList.html @@ -2,16 +2,16 @@ - + -MailingList (Dependency-Check Core 1.0.8 API) - +MailingList (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Model.Contributors.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Model.Contributors.html index 9f165c957..68c4868e6 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Model.Contributors.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Model.Contributors.html @@ -2,16 +2,16 @@ - + -Model.Contributors (Dependency-Check Core 1.0.8 API) - +Model.Contributors (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Model.Dependencies.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Model.Dependencies.html index 0db518847..a54694c90 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Model.Dependencies.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Model.Dependencies.html @@ -2,16 +2,16 @@ - + -Model.Dependencies (Dependency-Check Core 1.0.8 API) - +Model.Dependencies (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Model.Developers.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Model.Developers.html index f759d84ae..5d09deabb 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Model.Developers.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Model.Developers.html @@ -2,16 +2,16 @@ - + -Model.Developers (Dependency-Check Core 1.0.8 API) - +Model.Developers (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Model.Licenses.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Model.Licenses.html index 24e13bee7..19403b09b 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Model.Licenses.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Model.Licenses.html @@ -2,16 +2,16 @@ - + -Model.Licenses (Dependency-Check Core 1.0.8 API) - +Model.Licenses (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Model.MailingLists.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Model.MailingLists.html index 4681c2800..8b75cd8f1 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Model.MailingLists.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Model.MailingLists.html @@ -2,16 +2,16 @@ - + -Model.MailingLists (Dependency-Check Core 1.0.8 API) - +Model.MailingLists (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Model.Modules.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Model.Modules.html index bfa186419..c67a03066 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Model.Modules.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Model.Modules.html @@ -2,16 +2,16 @@ - + -Model.Modules (Dependency-Check Core 1.0.8 API) - +Model.Modules (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Model.PluginRepositories.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Model.PluginRepositories.html index f89b95099..ed7e1fcaf 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Model.PluginRepositories.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Model.PluginRepositories.html @@ -2,16 +2,16 @@ - + -Model.PluginRepositories (Dependency-Check Core 1.0.8 API) - +Model.PluginRepositories (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Model.Profiles.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Model.Profiles.html index b14ff8cab..36f56233c 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Model.Profiles.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Model.Profiles.html @@ -2,16 +2,16 @@ - + -Model.Profiles (Dependency-Check Core 1.0.8 API) - +Model.Profiles (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Model.Properties.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Model.Properties.html index 7c3dc3555..f7428c215 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Model.Properties.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Model.Properties.html @@ -2,16 +2,16 @@ - + -Model.Properties (Dependency-Check Core 1.0.8 API) - +Model.Properties (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Model.Reports.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Model.Reports.html index c9cd3e7a3..a8f7cce02 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Model.Reports.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Model.Reports.html @@ -2,16 +2,16 @@ - + -Model.Reports (Dependency-Check Core 1.0.8 API) - +Model.Reports (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Model.Repositories.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Model.Repositories.html index 1930b11bc..49bf1bea4 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Model.Repositories.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Model.Repositories.html @@ -2,16 +2,16 @@ - + -Model.Repositories (Dependency-Check Core 1.0.8 API) - +Model.Repositories (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Model.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Model.html index 44f0a166b..2d26f0001 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Model.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Model.html @@ -2,16 +2,16 @@ - + -Model (Dependency-Check Core 1.0.8 API) - +Model (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Notifier.Configuration.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Notifier.Configuration.html index 03e89587e..9bb407aeb 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Notifier.Configuration.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Notifier.Configuration.html @@ -2,16 +2,16 @@ - + -Notifier.Configuration (Dependency-Check Core 1.0.8 API) - +Notifier.Configuration (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Notifier.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Notifier.html index 9018be5d4..2b65cd289 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Notifier.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Notifier.html @@ -2,16 +2,16 @@ - + -Notifier (Dependency-Check Core 1.0.8 API) - +Notifier (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/ObjectFactory.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/ObjectFactory.html index 492a5c466..10af05ea7 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/ObjectFactory.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/ObjectFactory.html @@ -2,16 +2,16 @@ - + -ObjectFactory (Dependency-Check Core 1.0.8 API) - +ObjectFactory (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Organization.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Organization.html index 4687f9df7..a783a3662 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Organization.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Organization.html @@ -2,16 +2,16 @@ - + -Organization (Dependency-Check Core 1.0.8 API) - +Organization (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Parent.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Parent.html index 6ed6c1517..ef21c12e5 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Parent.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Parent.html @@ -2,16 +2,16 @@ - + -Parent (Dependency-Check Core 1.0.8 API) - +Parent (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Plugin.Configuration.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Plugin.Configuration.html index 0141eccda..bb30f2ec6 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Plugin.Configuration.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Plugin.Configuration.html @@ -2,16 +2,16 @@ - + -Plugin.Configuration (Dependency-Check Core 1.0.8 API) - +Plugin.Configuration (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Plugin.Dependencies.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Plugin.Dependencies.html index b28aa4703..04be44d7f 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Plugin.Dependencies.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Plugin.Dependencies.html @@ -2,16 +2,16 @@ - + -Plugin.Dependencies (Dependency-Check Core 1.0.8 API) - +Plugin.Dependencies (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Plugin.Executions.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Plugin.Executions.html index 0a8c1b4a2..c34684717 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Plugin.Executions.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Plugin.Executions.html @@ -2,16 +2,16 @@ - + -Plugin.Executions (Dependency-Check Core 1.0.8 API) - +Plugin.Executions (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Plugin.Goals.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Plugin.Goals.html index 82807adcb..126e094fd 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Plugin.Goals.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Plugin.Goals.html @@ -2,16 +2,16 @@ - + -Plugin.Goals (Dependency-Check Core 1.0.8 API) - +Plugin.Goals (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Plugin.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Plugin.html index b391ecfba..967c02cc8 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Plugin.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Plugin.html @@ -2,16 +2,16 @@ - + -Plugin (Dependency-Check Core 1.0.8 API) - +Plugin (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/PluginExecution.Configuration.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/PluginExecution.Configuration.html index 0f95e3251..6a4e77050 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/PluginExecution.Configuration.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/PluginExecution.Configuration.html @@ -2,16 +2,16 @@ - + -PluginExecution.Configuration (Dependency-Check Core 1.0.8 API) - +PluginExecution.Configuration (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/PluginExecution.Goals.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/PluginExecution.Goals.html index f6ac7a592..62995d1c5 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/PluginExecution.Goals.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/PluginExecution.Goals.html @@ -2,16 +2,16 @@ - + -PluginExecution.Goals (Dependency-Check Core 1.0.8 API) - +PluginExecution.Goals (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/PluginExecution.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/PluginExecution.html index 05ba24597..2e3010997 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/PluginExecution.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/PluginExecution.html @@ -2,16 +2,16 @@ - + -PluginExecution (Dependency-Check Core 1.0.8 API) - +PluginExecution (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/PluginManagement.Plugins.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/PluginManagement.Plugins.html index b4a1b5298..6eefeaa38 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/PluginManagement.Plugins.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/PluginManagement.Plugins.html @@ -2,16 +2,16 @@ - + -PluginManagement.Plugins (Dependency-Check Core 1.0.8 API) - +PluginManagement.Plugins (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/PluginManagement.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/PluginManagement.html index 39801fb7b..fe092ae65 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/PluginManagement.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/PluginManagement.html @@ -2,16 +2,16 @@ - + -PluginManagement (Dependency-Check Core 1.0.8 API) - +PluginManagement (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Prerequisites.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Prerequisites.html index d6f0c119f..5f1cbf39a 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Prerequisites.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Prerequisites.html @@ -2,16 +2,16 @@ - + -Prerequisites (Dependency-Check Core 1.0.8 API) - +Prerequisites (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Profile.Dependencies.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Profile.Dependencies.html index 6e0efc505..8b9f6c870 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Profile.Dependencies.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Profile.Dependencies.html @@ -2,16 +2,16 @@ - + -Profile.Dependencies (Dependency-Check Core 1.0.8 API) - +Profile.Dependencies (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Profile.Modules.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Profile.Modules.html index b67d644d4..0fa4749c4 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Profile.Modules.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Profile.Modules.html @@ -2,16 +2,16 @@ - + -Profile.Modules (Dependency-Check Core 1.0.8 API) - +Profile.Modules (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Profile.PluginRepositories.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Profile.PluginRepositories.html index 6dd18ac25..1faa7c349 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Profile.PluginRepositories.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Profile.PluginRepositories.html @@ -2,16 +2,16 @@ - + -Profile.PluginRepositories (Dependency-Check Core 1.0.8 API) - +Profile.PluginRepositories (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Profile.Properties.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Profile.Properties.html index 8cd5c0919..586f07569 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Profile.Properties.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Profile.Properties.html @@ -2,16 +2,16 @@ - + -Profile.Properties (Dependency-Check Core 1.0.8 API) - +Profile.Properties (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Profile.Reports.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Profile.Reports.html index 0d0d62913..b8665f3ab 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Profile.Reports.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Profile.Reports.html @@ -2,16 +2,16 @@ - + -Profile.Reports (Dependency-Check Core 1.0.8 API) - +Profile.Reports (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Profile.Repositories.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Profile.Repositories.html index 294e67b7c..faa207472 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Profile.Repositories.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Profile.Repositories.html @@ -2,16 +2,16 @@ - + -Profile.Repositories (Dependency-Check Core 1.0.8 API) - +Profile.Repositories (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Profile.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Profile.html index bb3c75618..113440f1a 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Profile.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Profile.html @@ -2,16 +2,16 @@ - + -Profile (Dependency-Check Core 1.0.8 API) - +Profile (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Relocation.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Relocation.html index 0c5a5cf57..f358c0f6c 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Relocation.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Relocation.html @@ -2,16 +2,16 @@ - + -Relocation (Dependency-Check Core 1.0.8 API) - +Relocation (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/ReportPlugin.Configuration.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/ReportPlugin.Configuration.html index 715653a8d..2d1238a0d 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/ReportPlugin.Configuration.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/ReportPlugin.Configuration.html @@ -2,16 +2,16 @@ - + -ReportPlugin.Configuration (Dependency-Check Core 1.0.8 API) - +ReportPlugin.Configuration (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/ReportPlugin.ReportSets.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/ReportPlugin.ReportSets.html index eedc1a9bb..f57a2a55e 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/ReportPlugin.ReportSets.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/ReportPlugin.ReportSets.html @@ -2,16 +2,16 @@ - + -ReportPlugin.ReportSets (Dependency-Check Core 1.0.8 API) - +ReportPlugin.ReportSets (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/ReportPlugin.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/ReportPlugin.html index 54f49f483..96eebe3d9 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/ReportPlugin.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/ReportPlugin.html @@ -2,16 +2,16 @@ - + -ReportPlugin (Dependency-Check Core 1.0.8 API) - +ReportPlugin (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/ReportSet.Configuration.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/ReportSet.Configuration.html index 772fe956c..ec49b1f5e 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/ReportSet.Configuration.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/ReportSet.Configuration.html @@ -2,16 +2,16 @@ - + -ReportSet.Configuration (Dependency-Check Core 1.0.8 API) - +ReportSet.Configuration (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/ReportSet.Reports.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/ReportSet.Reports.html index 09ae2c696..98b1bdcb9 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/ReportSet.Reports.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/ReportSet.Reports.html @@ -2,16 +2,16 @@ - + -ReportSet.Reports (Dependency-Check Core 1.0.8 API) - +ReportSet.Reports (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/ReportSet.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/ReportSet.html index 48bcd21a2..d7ee1cb3e 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/ReportSet.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/ReportSet.html @@ -2,16 +2,16 @@ - + -ReportSet (Dependency-Check Core 1.0.8 API) - +ReportSet (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Reporting.Plugins.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Reporting.Plugins.html index 37f3e387b..c205ac1be 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Reporting.Plugins.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Reporting.Plugins.html @@ -2,16 +2,16 @@ - + -Reporting.Plugins (Dependency-Check Core 1.0.8 API) - +Reporting.Plugins (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Reporting.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Reporting.html index b159b42a7..cbfee5996 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Reporting.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Reporting.html @@ -2,16 +2,16 @@ - + -Reporting (Dependency-Check Core 1.0.8 API) - +Reporting (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Repository.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Repository.html index a09deaf05..891943ab4 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Repository.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Repository.html @@ -2,16 +2,16 @@ - + -Repository (Dependency-Check Core 1.0.8 API) - +Repository (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/RepositoryPolicy.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/RepositoryPolicy.html index 323000118..899f26578 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/RepositoryPolicy.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/RepositoryPolicy.html @@ -2,16 +2,16 @@ - + -RepositoryPolicy (Dependency-Check Core 1.0.8 API) - +RepositoryPolicy (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Resource.Excludes.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Resource.Excludes.html index de9840a23..c4125892d 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Resource.Excludes.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Resource.Excludes.html @@ -2,16 +2,16 @@ - + -Resource.Excludes (Dependency-Check Core 1.0.8 API) - +Resource.Excludes (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Resource.Includes.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Resource.Includes.html index dec01c1e8..267d86b24 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Resource.Includes.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Resource.Includes.html @@ -2,16 +2,16 @@ - + -Resource.Includes (Dependency-Check Core 1.0.8 API) - +Resource.Includes (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Resource.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Resource.html index 80fec1e9b..eee3d2990 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Resource.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Resource.html @@ -2,16 +2,16 @@ - + -Resource (Dependency-Check Core 1.0.8 API) - +Resource (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Scm.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Scm.html index 40ec812d0..91c2c5c18 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Scm.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Scm.html @@ -2,16 +2,16 @@ - + -Scm (Dependency-Check Core 1.0.8 API) - +Scm (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Site.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Site.html index af38e1c1a..26c954644 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Site.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/Site.html @@ -2,16 +2,16 @@ - + -Site (Dependency-Check Core 1.0.8 API) - +Site (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Activation.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Activation.html index 1273043af..86bb48e4f 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Activation.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Activation.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Activation (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Activation (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/ActivationFile.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/ActivationFile.html index 538d6f246..293a4b5a5 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/ActivationFile.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/ActivationFile.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.ActivationFile (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.ActivationFile (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/ActivationOS.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/ActivationOS.html index 4525e7f04..161ff7585 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/ActivationOS.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/ActivationOS.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.ActivationOS (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.ActivationOS (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/ActivationProperty.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/ActivationProperty.html index ca9adeafb..064476c67 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/ActivationProperty.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/ActivationProperty.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.ActivationProperty (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.ActivationProperty (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Build.Extensions.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Build.Extensions.html index c58de54e1..8b49a6354 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Build.Extensions.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Build.Extensions.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Build.Extensions (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Build.Extensions (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Build.Filters.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Build.Filters.html index 60e5fec96..d8a5990d7 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Build.Filters.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Build.Filters.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Build.Filters (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Build.Filters (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Build.Plugins.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Build.Plugins.html index bcb7caecf..46f1b4d0c 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Build.Plugins.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Build.Plugins.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Build.Plugins (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Build.Plugins (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Build.Resources.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Build.Resources.html index fcaafa5cc..ffed59e37 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Build.Resources.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Build.Resources.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Build.Resources (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Build.Resources (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Build.TestResources.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Build.TestResources.html index 3ef7fd910..65085b5f4 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Build.TestResources.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Build.TestResources.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Build.TestResources (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Build.TestResources (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Build.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Build.html index 729418011..2c697afc2 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Build.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Build.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Build (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Build (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/BuildBase.Filters.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/BuildBase.Filters.html index 0e7e78263..3282b24ff 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/BuildBase.Filters.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/BuildBase.Filters.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.BuildBase.Filters (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.BuildBase.Filters (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/BuildBase.Plugins.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/BuildBase.Plugins.html index 02d02e5e4..c938bf3c9 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/BuildBase.Plugins.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/BuildBase.Plugins.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.BuildBase.Plugins (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.BuildBase.Plugins (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/BuildBase.Resources.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/BuildBase.Resources.html index d3f223caa..0b25ed89c 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/BuildBase.Resources.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/BuildBase.Resources.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.BuildBase.Resources (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.BuildBase.Resources (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/BuildBase.TestResources.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/BuildBase.TestResources.html index 9272141ce..de3fb216f 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/BuildBase.TestResources.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/BuildBase.TestResources.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.BuildBase.TestResources (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.BuildBase.TestResources (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/BuildBase.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/BuildBase.html index 057b5f7a5..225ec6c29 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/BuildBase.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/BuildBase.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.BuildBase (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.BuildBase (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/CiManagement.Notifiers.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/CiManagement.Notifiers.html index c90b98be8..923dabf52 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/CiManagement.Notifiers.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/CiManagement.Notifiers.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.CiManagement.Notifiers (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.CiManagement.Notifiers (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/CiManagement.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/CiManagement.html index 96e1d614d..9b9eb402f 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/CiManagement.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/CiManagement.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.CiManagement (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.CiManagement (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Contributor.Properties.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Contributor.Properties.html index 544a6965c..689769e5f 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Contributor.Properties.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Contributor.Properties.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Contributor.Properties (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Contributor.Properties (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Contributor.Roles.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Contributor.Roles.html index d92a3b5f5..17f5bdc8f 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Contributor.Roles.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Contributor.Roles.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Contributor.Roles (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Contributor.Roles (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Contributor.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Contributor.html index 6b819b80f..d7b0d1beb 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Contributor.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Contributor.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Contributor (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Contributor (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Dependency.Exclusions.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Dependency.Exclusions.html index 250dc2949..b29e74b17 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Dependency.Exclusions.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Dependency.Exclusions.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Dependency.Exclusions (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Dependency.Exclusions (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Dependency.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Dependency.html index 11ca2d542..70ba24f27 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Dependency.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Dependency.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Dependency (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Dependency (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/DependencyManagement.Dependencies.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/DependencyManagement.Dependencies.html index 4a6c69948..d6c285b58 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/DependencyManagement.Dependencies.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/DependencyManagement.Dependencies.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.DependencyManagement.Dependencies (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.DependencyManagement.Dependencies (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/DependencyManagement.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/DependencyManagement.html index 0b442c691..71abb10f9 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/DependencyManagement.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/DependencyManagement.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.DependencyManagement (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.DependencyManagement (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/DeploymentRepository.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/DeploymentRepository.html index 08fbedf6a..64cd37199 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/DeploymentRepository.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/DeploymentRepository.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.DeploymentRepository (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.DeploymentRepository (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Developer.Properties.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Developer.Properties.html index 81a5a3fd0..268c49e8f 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Developer.Properties.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Developer.Properties.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Developer.Properties (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Developer.Properties (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Developer.Roles.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Developer.Roles.html index ab4f06334..7a8dc98ef 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Developer.Roles.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Developer.Roles.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Developer.Roles (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Developer.Roles (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Developer.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Developer.html index 1a2b42763..818c49842 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Developer.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Developer.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Developer (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Developer (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/DistributionManagement.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/DistributionManagement.html index 8e35dd109..f0de046ee 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/DistributionManagement.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/DistributionManagement.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.DistributionManagement (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.DistributionManagement (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Exclusion.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Exclusion.html index da2aed7bd..a65024b02 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Exclusion.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Exclusion.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Exclusion (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Exclusion (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Extension.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Extension.html index 9b362ebae..7a4aa1db1 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Extension.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Extension.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Extension (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Extension (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/IssueManagement.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/IssueManagement.html index ac5f7d51b..ca5d810a0 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/IssueManagement.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/IssueManagement.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.IssueManagement (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.IssueManagement (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/License.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/License.html index b09bc945f..379d9d873 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/License.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/License.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.License (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.License (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/MailingList.OtherArchives.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/MailingList.OtherArchives.html index 94e185972..59abf9593 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/MailingList.OtherArchives.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/MailingList.OtherArchives.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.MailingList.OtherArchives (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.MailingList.OtherArchives (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/MailingList.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/MailingList.html index 855051130..af145a384 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/MailingList.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/MailingList.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.MailingList (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.MailingList (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Model.Contributors.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Model.Contributors.html index afb056698..342e4106b 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Model.Contributors.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Model.Contributors.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Model.Contributors (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Model.Contributors (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Model.Dependencies.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Model.Dependencies.html index 046c27b5a..a986e452e 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Model.Dependencies.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Model.Dependencies.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Model.Dependencies (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Model.Dependencies (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Model.Developers.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Model.Developers.html index 9411e04ab..baed3c79f 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Model.Developers.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Model.Developers.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Model.Developers (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Model.Developers (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Model.Licenses.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Model.Licenses.html index 341c990d4..84333d54c 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Model.Licenses.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Model.Licenses.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Model.Licenses (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Model.Licenses (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Model.MailingLists.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Model.MailingLists.html index 5689290f8..1ffd2a53f 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Model.MailingLists.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Model.MailingLists.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Model.MailingLists (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Model.MailingLists (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Model.Modules.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Model.Modules.html index 8509cc48e..6125eeb76 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Model.Modules.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Model.Modules.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Model.Modules (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Model.Modules (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Model.PluginRepositories.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Model.PluginRepositories.html index de8d139c0..71eef992b 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Model.PluginRepositories.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Model.PluginRepositories.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Model.PluginRepositories (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Model.PluginRepositories (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Model.Profiles.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Model.Profiles.html index b7445ddb4..6e6b6a9ce 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Model.Profiles.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Model.Profiles.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Model.Profiles (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Model.Profiles (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Model.Properties.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Model.Properties.html index c99261842..e4c0bbbab 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Model.Properties.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Model.Properties.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Model.Properties (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Model.Properties (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Model.Reports.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Model.Reports.html index e4977f573..4eb505228 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Model.Reports.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Model.Reports.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Model.Reports (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Model.Reports (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Model.Repositories.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Model.Repositories.html index 6ebca6658..8682616d5 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Model.Repositories.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Model.Repositories.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Model.Repositories (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Model.Repositories (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Model.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Model.html index a64ae09a3..a71f00c77 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Model.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Model.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Model (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Model (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Notifier.Configuration.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Notifier.Configuration.html index e5345c171..fdf273717 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Notifier.Configuration.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Notifier.Configuration.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Notifier.Configuration (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Notifier.Configuration (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Notifier.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Notifier.html index 42541af18..d202f88a7 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Notifier.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Notifier.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Notifier (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Notifier (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/ObjectFactory.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/ObjectFactory.html index f3abe0116..3ffa364af 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/ObjectFactory.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/ObjectFactory.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.ObjectFactory (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.ObjectFactory (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Organization.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Organization.html index 1b2440c87..59017ae43 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Organization.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Organization.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Organization (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Organization (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Parent.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Parent.html index 06abe361a..1e9ef2452 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Parent.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Parent.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Parent (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Parent (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Plugin.Configuration.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Plugin.Configuration.html index b3c897bcf..d00681294 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Plugin.Configuration.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Plugin.Configuration.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Plugin.Configuration (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Plugin.Configuration (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Plugin.Dependencies.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Plugin.Dependencies.html index 625744c37..288065d30 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Plugin.Dependencies.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Plugin.Dependencies.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Plugin.Dependencies (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Plugin.Dependencies (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Plugin.Executions.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Plugin.Executions.html index 231c3de1d..b96733ddc 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Plugin.Executions.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Plugin.Executions.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Plugin.Executions (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Plugin.Executions (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Plugin.Goals.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Plugin.Goals.html index 97f60b0ee..f0fc0335a 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Plugin.Goals.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Plugin.Goals.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Plugin.Goals (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Plugin.Goals (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Plugin.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Plugin.html index bc388dbeb..8f208d966 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Plugin.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Plugin.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Plugin (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Plugin (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/PluginExecution.Configuration.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/PluginExecution.Configuration.html index cceeced81..d6140e09b 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/PluginExecution.Configuration.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/PluginExecution.Configuration.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.PluginExecution.Configuration (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.PluginExecution.Configuration (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/PluginExecution.Goals.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/PluginExecution.Goals.html index 38d30aae2..908330cfa 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/PluginExecution.Goals.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/PluginExecution.Goals.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.PluginExecution.Goals (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.PluginExecution.Goals (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/PluginExecution.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/PluginExecution.html index 46d5d06bc..006f6696c 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/PluginExecution.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/PluginExecution.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.PluginExecution (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.PluginExecution (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/PluginManagement.Plugins.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/PluginManagement.Plugins.html index 7e0be17d5..4e606ccc6 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/PluginManagement.Plugins.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/PluginManagement.Plugins.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.PluginManagement.Plugins (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.PluginManagement.Plugins (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/PluginManagement.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/PluginManagement.html index cc9cfe976..1d7b27509 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/PluginManagement.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/PluginManagement.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.PluginManagement (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.PluginManagement (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Prerequisites.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Prerequisites.html index 8a5056ed1..561e0ed4f 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Prerequisites.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Prerequisites.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Prerequisites (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Prerequisites (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Profile.Dependencies.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Profile.Dependencies.html index 84b982703..5c47b131a 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Profile.Dependencies.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Profile.Dependencies.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Profile.Dependencies (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Profile.Dependencies (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Profile.Modules.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Profile.Modules.html index eb59f2380..e4413d5ec 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Profile.Modules.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Profile.Modules.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Profile.Modules (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Profile.Modules (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Profile.PluginRepositories.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Profile.PluginRepositories.html index 4e594fae7..277e6db32 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Profile.PluginRepositories.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Profile.PluginRepositories.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Profile.PluginRepositories (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Profile.PluginRepositories (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Profile.Properties.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Profile.Properties.html index 9919d635e..616c8a190 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Profile.Properties.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Profile.Properties.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Profile.Properties (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Profile.Properties (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Profile.Reports.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Profile.Reports.html index 6db812dc5..1b971d56a 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Profile.Reports.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Profile.Reports.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Profile.Reports (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Profile.Reports (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Profile.Repositories.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Profile.Repositories.html index 6380f6a13..ea4ae37bb 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Profile.Repositories.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Profile.Repositories.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Profile.Repositories (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Profile.Repositories (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Profile.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Profile.html index e12d64e59..3f645ff81 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Profile.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Profile.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Profile (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Profile (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Relocation.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Relocation.html index 158947ae7..00862f5c9 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Relocation.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Relocation.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Relocation (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Relocation (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/ReportPlugin.Configuration.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/ReportPlugin.Configuration.html index b9f08a853..0eb11ef08 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/ReportPlugin.Configuration.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/ReportPlugin.Configuration.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.ReportPlugin.Configuration (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.ReportPlugin.Configuration (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/ReportPlugin.ReportSets.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/ReportPlugin.ReportSets.html index 2ac4bf2f7..afcfae904 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/ReportPlugin.ReportSets.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/ReportPlugin.ReportSets.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.ReportPlugin.ReportSets (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.ReportPlugin.ReportSets (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/ReportPlugin.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/ReportPlugin.html index cb51ed3a9..298968ddf 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/ReportPlugin.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/ReportPlugin.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.ReportPlugin (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.ReportPlugin (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/ReportSet.Configuration.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/ReportSet.Configuration.html index 5730f70fe..aabdafd9d 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/ReportSet.Configuration.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/ReportSet.Configuration.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.ReportSet.Configuration (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.ReportSet.Configuration (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/ReportSet.Reports.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/ReportSet.Reports.html index ded4a3bb7..3fc9a4ad0 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/ReportSet.Reports.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/ReportSet.Reports.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.ReportSet.Reports (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.ReportSet.Reports (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/ReportSet.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/ReportSet.html index 5f9ec8c13..819a63296 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/ReportSet.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/ReportSet.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.ReportSet (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.ReportSet (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Reporting.Plugins.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Reporting.Plugins.html index 4817d00fe..fa58f8b18 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Reporting.Plugins.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Reporting.Plugins.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Reporting.Plugins (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Reporting.Plugins (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Reporting.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Reporting.html index 386a147bf..2231b90e3 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Reporting.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Reporting.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Reporting (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Reporting (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Repository.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Repository.html index b3fe0a399..63b498516 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Repository.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Repository.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Repository (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Repository (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/RepositoryPolicy.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/RepositoryPolicy.html index ac5c726e3..c055919b0 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/RepositoryPolicy.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/RepositoryPolicy.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.RepositoryPolicy (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.RepositoryPolicy (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Resource.Excludes.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Resource.Excludes.html index ab25ef4cd..423717c71 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Resource.Excludes.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Resource.Excludes.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Resource.Excludes (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Resource.Excludes (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Resource.Includes.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Resource.Includes.html index 2001ade51..e5e383a47 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Resource.Includes.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Resource.Includes.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Resource.Includes (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Resource.Includes (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Resource.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Resource.html index 2109c960c..f4b34bf05 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Resource.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Resource.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Resource (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Resource (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Scm.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Scm.html index 7d847c366..83a27bf8d 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Scm.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Scm.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Scm (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Scm (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Site.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Site.html index 57d744992..f7b3d2d9b 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Site.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/class-use/Site.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Site (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.jaxb.pom.generated.Site (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/package-frame.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/package-frame.html index 42031f499..dba85104d 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/package-frame.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/package-frame.html @@ -2,10 +2,10 @@ - + -org.owasp.dependencycheck.jaxb.pom.generated (Dependency-Check Core 1.0.8 API) - +org.owasp.dependencycheck.jaxb.pom.generated (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/package-summary.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/package-summary.html index 17392d344..9849c934b 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/package-summary.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/package-summary.html @@ -2,16 +2,16 @@ - + -org.owasp.dependencycheck.jaxb.pom.generated (Dependency-Check Core 1.0.8 API) - +org.owasp.dependencycheck.jaxb.pom.generated (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/package-tree.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/package-tree.html index 316a23499..8599f673e 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/package-tree.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/package-tree.html @@ -2,16 +2,16 @@ - + -org.owasp.dependencycheck.jaxb.pom.generated Class Hierarchy (Dependency-Check Core 1.0.8 API) - +org.owasp.dependencycheck.jaxb.pom.generated Class Hierarchy (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/package-use.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/package-use.html index 5ec9cbb7c..0123dd01b 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/package-use.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/generated/package-use.html @@ -2,16 +2,16 @@ - + -Uses of Package org.owasp.dependencycheck.jaxb.pom.generated (Dependency-Check Core 1.0.8 API) - +Uses of Package org.owasp.dependencycheck.jaxb.pom.generated (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/package-frame.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/package-frame.html index 67fc3e0a2..44b1f4fd9 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/package-frame.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/package-frame.html @@ -2,10 +2,10 @@ - + -org.owasp.dependencycheck.jaxb.pom (Dependency-Check Core 1.0.8 API) - +org.owasp.dependencycheck.jaxb.pom (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/package-summary.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/package-summary.html index cdeab130a..57dc18368 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/package-summary.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/package-summary.html @@ -2,16 +2,16 @@ - + -org.owasp.dependencycheck.jaxb.pom (Dependency-Check Core 1.0.8 API) - +org.owasp.dependencycheck.jaxb.pom (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/package-tree.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/package-tree.html index 1ea260925..b3c991de2 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/package-tree.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/package-tree.html @@ -2,16 +2,16 @@ - + -org.owasp.dependencycheck.jaxb.pom Class Hierarchy (Dependency-Check Core 1.0.8 API) - +org.owasp.dependencycheck.jaxb.pom Class Hierarchy (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/package-use.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/package-use.html index be6e85817..ccb0f49d4 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/package-use.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/jaxb/pom/package-use.html @@ -2,16 +2,16 @@ - + -Uses of Package org.owasp.dependencycheck.jaxb.pom (Dependency-Check Core 1.0.8 API) - +Uses of Package org.owasp.dependencycheck.jaxb.pom (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/package-frame.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/package-frame.html index 910cf5db0..f8e8ba711 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/package-frame.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/package-frame.html @@ -2,10 +2,10 @@ - + -org.owasp.dependencycheck (Dependency-Check Core 1.0.8 API) - +org.owasp.dependencycheck (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/package-summary.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/package-summary.html index 456506b64..f169fbd5a 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/package-summary.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/package-summary.html @@ -2,16 +2,16 @@ - + -org.owasp.dependencycheck (Dependency-Check Core 1.0.8 API) - +org.owasp.dependencycheck (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/package-tree.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/package-tree.html index b38a3c144..52485e2ae 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/package-tree.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/package-tree.html @@ -2,16 +2,16 @@ - + -org.owasp.dependencycheck Class Hierarchy (Dependency-Check Core 1.0.8 API) - +org.owasp.dependencycheck Class Hierarchy (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/package-use.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/package-use.html index f3dbb5e2c..27cbdf3fa 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/package-use.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/package-use.html @@ -2,16 +2,16 @@ - + -Uses of Package org.owasp.dependencycheck (Dependency-Check Core 1.0.8 API) - +Uses of Package org.owasp.dependencycheck (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/reporting/ReportGenerator.Format.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/reporting/ReportGenerator.Format.html index a775741bf..fca919134 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/reporting/ReportGenerator.Format.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/reporting/ReportGenerator.Format.html @@ -2,16 +2,16 @@ - + -ReportGenerator.Format (Dependency-Check Core 1.0.8 API) - +ReportGenerator.Format (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/reporting/ReportGenerator.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/reporting/ReportGenerator.html index 04f5c11ce..27b0b58f7 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/reporting/ReportGenerator.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/reporting/ReportGenerator.html @@ -2,16 +2,16 @@ - + -ReportGenerator (Dependency-Check Core 1.0.8 API) - +ReportGenerator (Dependency-Check Core 1.1.0 API) + @@ -99,10 +99,8 @@ 
    public class ReportGenerator
 extends Object
    -
    The ReportGenerator is used to, as the name implies, generate reports. - Internally the generator uses the Velocity Templating Engine. The - ReportGenerator exposes a list of Dependencies to the template when - generating the report.
    +
    The ReportGenerator is used to, as the name implies, generate reports. Internally the generator uses the Velocity + Templating Engine. The ReportGenerator exposes a list of Dependencies to the template when generating the report.
    Author:
    Jeremy Long
    @@ -144,9 +142,10 @@ extends Constructor and Description -ReportGenerator(String applicationName, +ReportGenerator(String applicationName, List<Dependency> dependencies, - List<Analyzer> analyzers) + List<Analyzer> analyzers, + DatabaseProperties properties)
    Constructs a new ReportGenerator.
    @@ -208,7 +207,7 @@ extends +
      @@ -216,9 +215,10 @@ extends String applicationName, List<Dependency> dependencies, - List<Analyzer> analyzers) + List<Analyzer> analyzers, + DatabaseProperties properties)
      Constructs a new ReportGenerator.
      -
      Parameters:
      applicationName - the application name being analyzed
      dependencies - the list of dependencies
      analyzers - the list of analyzers used.
      +
      Parameters:
      applicationName - the application name being analyzed
      dependencies - the list of dependencies
      analyzers - the list of analyzers used
      properties - the database properties (containing timestamps of the NVD CVE data)
    @@ -257,8 +257,7 @@ extends IOException, Exception
    Generates the Dependency Reports for the identified dependencies.
    -
    Parameters:
    outputDir - the path where the reports should be written
    outputFormat - the format the report should be written in (XML, - HTML, ALL)
    +
    Parameters:
    outputDir - the path where the reports should be written
    outputFormat - the format the report should be written in (XML, HTML, ALL)
    Throws:
    IOException - is thrown when the template file does not exist
    Exception - is thrown if there is an error writing out the reports.
    @@ -274,9 +273,8 @@ extends String outFileName) throws IOException, Exception -
    Generates a report from a given Velocity Template. The template name - provided can be the name of a template contained in the jar file, such as - 'XmlReport' or 'HtmlReport', or the template name can be the path to a +
    Generates a report from a given Velocity Template. The template name provided can be the name of a template + contained in the jar file, such as 'XmlReport' or 'HtmlReport', or the template name can be the path to a template file.
    Parameters:
    templateName - the name of the template to load.
    outFileName - the filename and path to write the report to.
    Throws:
    diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/reporting/VelocityLoggerRedirect.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/reporting/VelocityLoggerRedirect.html index 6bb982b53..445f9bf54 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/reporting/VelocityLoggerRedirect.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/reporting/VelocityLoggerRedirect.html @@ -2,16 +2,16 @@ - + -VelocityLoggerRedirect (Dependency-Check Core 1.0.8 API) - +VelocityLoggerRedirect (Dependency-Check Core 1.1.0 API) + @@ -104,18 +104,16 @@ 
    public class VelocityLoggerRedirect
 extends Object
 implements org.apache.velocity.runtime.log.LogChute
    -

    DependencyCheck uses Logger as a logging - framework, and Apache Velocity uses a custom logging implementation that - outputs to a file named velocity.log by default. This class is an - implementation of a custom Velocity logger that redirects all velocity - logging to the Java Logger class. +

    + DependencyCheck uses Logger as a logging framework, and Apache Velocity uses a custom + logging implementation that outputs to a file named velocity.log by default. This class is an implementation of a + custom Velocity logger that redirects all velocity logging to the Java Logger class.

    - This class was written to address permission issues when using - Dependency-Check in a server environment (such as the Jenkins plugin). In - some circumstances, Velocity would attempt to create velocity.log in an - un-writable directory.

    + This class was written to address permission issues when using Dependency-Check in a server environment (such as the + Jenkins plugin). In some circumstances, Velocity would attempt to create velocity.log in an un-writable + directory.

    Author:
    -
    Steve Springett (steve.springett@owasp.org)
    +
    Steve Springett
    @@ -182,8 +180,8 @@ implements org.apache.velocity.runtime.log.LogChute void log(int level, String message) -
    Given a Velocity log level and message, this method will call the - appropriate Logger level and log the specified values.
    +
    Given a Velocity log level and message, this method will call the appropriate Logger level and log the specified + values.
    @@ -191,8 +189,8 @@ implements org.apache.velocity.runtime.log.LogChute log(int level, String message, Throwable t) -
    Given a Velocity log level, message and Throwable, this method will call - the appropriate Logger level and log the specified values.
    +
    Given a Velocity log level, message and Throwable, this method will call the appropriate Logger level and log the + specified values.
    @@ -256,8 +254,8 @@ implements org.apache.velocity.runtime.log.LogChute

    log

    public void log(int level,
        String message)
    -
    Given a Velocity log level and message, this method will call the - appropriate Logger level and log the specified values.
    +
    Given a Velocity log level and message, this method will call the appropriate Logger level and log the specified + values.
    Specified by:
    log in interface org.apache.velocity.runtime.log.LogChute
    @@ -273,8 +271,8 @@ implements org.apache.velocity.runtime.log.LogChute 
    public void log(int level,
        String message,
        Throwable t)
    -
    Given a Velocity log level, message and Throwable, this method will call - the appropriate Logger level and log the specified values.
    +
    Given a Velocity log level, message and Throwable, this method will call the appropriate Logger level and log the + specified values.
    Specified by:
    log in interface org.apache.velocity.runtime.log.LogChute
    diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/reporting/class-use/ReportGenerator.Format.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/reporting/class-use/ReportGenerator.Format.html index aa57b34f2..f89078d11 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/reporting/class-use/ReportGenerator.Format.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/reporting/class-use/ReportGenerator.Format.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.reporting.ReportGenerator.Format (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.reporting.ReportGenerator.Format (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/reporting/class-use/ReportGenerator.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/reporting/class-use/ReportGenerator.html index 9c1d4a524..81d5f3bc6 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/reporting/class-use/ReportGenerator.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/reporting/class-use/ReportGenerator.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.reporting.ReportGenerator (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.reporting.ReportGenerator (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/reporting/class-use/VelocityLoggerRedirect.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/reporting/class-use/VelocityLoggerRedirect.html index 0dcadde17..0331d9324 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/reporting/class-use/VelocityLoggerRedirect.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/reporting/class-use/VelocityLoggerRedirect.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.reporting.VelocityLoggerRedirect (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.reporting.VelocityLoggerRedirect (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/reporting/package-frame.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/reporting/package-frame.html index f89b8b4aa..af686b66c 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/reporting/package-frame.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/reporting/package-frame.html @@ -2,10 +2,10 @@ - + -org.owasp.dependencycheck.reporting (Dependency-Check Core 1.0.8 API) - +org.owasp.dependencycheck.reporting (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/reporting/package-summary.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/reporting/package-summary.html index 7d636d07d..4cca848b3 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/reporting/package-summary.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/reporting/package-summary.html @@ -2,16 +2,16 @@ - + -org.owasp.dependencycheck.reporting (Dependency-Check Core 1.0.8 API) - +org.owasp.dependencycheck.reporting (Dependency-Check Core 1.1.0 API) + @@ -94,9 +94,9 @@ VelocityLoggerRedirect -
    DependencyCheck uses Logger as a logging - framework, and Apache Velocity uses a custom logging implementation that - outputs to a file named velocity.log by default.
    +
    + DependencyCheck uses Logger as a logging framework, and Apache Velocity uses a custom + logging implementation that outputs to a file named velocity.log by default.
    diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/reporting/package-tree.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/reporting/package-tree.html index 8e06b456c..100516048 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/reporting/package-tree.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/reporting/package-tree.html @@ -2,16 +2,16 @@ - + -org.owasp.dependencycheck.reporting Class Hierarchy (Dependency-Check Core 1.0.8 API) - +org.owasp.dependencycheck.reporting Class Hierarchy (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/reporting/package-use.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/reporting/package-use.html index cac99e53c..75fb3bf0b 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/reporting/package-use.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/reporting/package-use.html @@ -2,16 +2,16 @@ - + -Uses of Package org.owasp.dependencycheck.reporting (Dependency-Check Core 1.0.8 API) - +Uses of Package org.owasp.dependencycheck.reporting (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/suppression/PropertyType.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/suppression/PropertyType.html index 0a0ef731b..e40501997 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/suppression/PropertyType.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/suppression/PropertyType.html @@ -2,16 +2,16 @@ - + -PropertyType (Dependency-Check Core 1.0.8 API) - +PropertyType (Dependency-Check Core 1.1.0 API) + @@ -99,9 +99,8 @@ 
    public class PropertyType
 extends Object
    -
    A simple PropertyType used to represent a string value that could be used as - a regular expression or could be case insensitive. The equals method has been - over-ridden so that the object will correctly compare to strings.
    +
    A simple PropertyType used to represent a string value that could be used as a regular expression or could be case + insensitive. The equals method has been over-ridden so that the object will correctly compare to strings.
    Author:
    Jeremy Long
    @@ -172,8 +171,7 @@ extends boolean matches(String text) -
    Uses the object's properties to determine if the supplied string matches - the value of this property.
    +
    Uses the object's properties to determine if the supplied string matches the value of this property.
    @@ -312,8 +310,7 @@ extends

    matches

    public boolean matches(String text)
    -
    Uses the object's properties to determine if the supplied string matches - the value of this property.
    +
    Uses the object's properties to determine if the supplied string matches the value of this property.
    Parameters:
    text - the String to validate
    Returns:
    whether the text supplied is matched by the value of the property
    diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/suppression/SuppressionErrorHandler.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/suppression/SuppressionErrorHandler.html index 77aec1695..523b26919 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/suppression/SuppressionErrorHandler.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/suppression/SuppressionErrorHandler.html @@ -2,16 +2,16 @@ - + -SuppressionErrorHandler (Dependency-Check Core 1.0.8 API) - +SuppressionErrorHandler (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/suppression/SuppressionHandler.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/suppression/SuppressionHandler.html index 61d0fb106..50412ee14 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/suppression/SuppressionHandler.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/suppression/SuppressionHandler.html @@ -2,16 +2,16 @@ - + -SuppressionHandler (Dependency-Check Core 1.0.8 API) - +SuppressionHandler (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/suppression/SuppressionParseException.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/suppression/SuppressionParseException.html index 237bb103d..50ccc55ec 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/suppression/SuppressionParseException.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/suppression/SuppressionParseException.html @@ -2,16 +2,16 @@ - + -SuppressionParseException (Dependency-Check Core 1.0.8 API) - +SuppressionParseException (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/suppression/SuppressionParser.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/suppression/SuppressionParser.html index d0063a6a2..b63d80e39 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/suppression/SuppressionParser.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/suppression/SuppressionParser.html @@ -2,16 +2,16 @@ - + -SuppressionParser (Dependency-Check Core 1.0.8 API) - +SuppressionParser (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/suppression/SuppressionRule.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/suppression/SuppressionRule.html index cfe9689ea..3a9e4ceaf 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/suppression/SuppressionRule.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/suppression/SuppressionRule.html @@ -2,16 +2,16 @@ - + -SuppressionRule (Dependency-Check Core 1.0.8 API) - +SuppressionRule (Dependency-Check Core 1.1.0 API) + @@ -223,8 +223,7 @@ extends void process(Dependency dependency) -
    Processes a given dependency to determine if any CPE, CVE, CWE, or CVSS - scores should be suppressed.
    +
    Processes a given dependency to determine if any CPE, CVE, CWE, or CVSS scores should be suppressed.
    @@ -529,9 +528,8 @@ extends

    process

    public void process(Dependency dependency)
    -
    Processes a given dependency to determine if any CPE, CVE, CWE, or CVSS - scores should be suppressed. If any should be, they are removed from the - dependency.
    +
    Processes a given dependency to determine if any CPE, CVE, CWE, or CVSS scores should be suppressed. If any + should be, they are removed from the dependency.
    Parameters:
    dependency - a project dependency to analyze
    diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/suppression/class-use/PropertyType.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/suppression/class-use/PropertyType.html index df5896f30..efb6972ce 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/suppression/class-use/PropertyType.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/suppression/class-use/PropertyType.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.suppression.PropertyType (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.suppression.PropertyType (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/suppression/class-use/SuppressionErrorHandler.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/suppression/class-use/SuppressionErrorHandler.html index 933aa5704..b08dd516a 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/suppression/class-use/SuppressionErrorHandler.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/suppression/class-use/SuppressionErrorHandler.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.suppression.SuppressionErrorHandler (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.suppression.SuppressionErrorHandler (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/suppression/class-use/SuppressionHandler.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/suppression/class-use/SuppressionHandler.html index 76d9ca612..108d3fd41 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/suppression/class-use/SuppressionHandler.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/suppression/class-use/SuppressionHandler.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.suppression.SuppressionHandler (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.suppression.SuppressionHandler (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/suppression/class-use/SuppressionParseException.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/suppression/class-use/SuppressionParseException.html index d33ffb8f1..364fea800 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/suppression/class-use/SuppressionParseException.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/suppression/class-use/SuppressionParseException.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.suppression.SuppressionParseException (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.suppression.SuppressionParseException (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/suppression/class-use/SuppressionParser.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/suppression/class-use/SuppressionParser.html index bef46d3dd..d781f0e7e 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/suppression/class-use/SuppressionParser.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/suppression/class-use/SuppressionParser.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.suppression.SuppressionParser (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.suppression.SuppressionParser (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/suppression/class-use/SuppressionRule.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/suppression/class-use/SuppressionRule.html index b01e197d9..bf56b3743 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/suppression/class-use/SuppressionRule.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/suppression/class-use/SuppressionRule.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.suppression.SuppressionRule (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.suppression.SuppressionRule (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/suppression/package-frame.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/suppression/package-frame.html index 9063dc238..8f86b4164 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/suppression/package-frame.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/suppression/package-frame.html @@ -2,10 +2,10 @@ - + -org.owasp.dependencycheck.suppression (Dependency-Check Core 1.0.8 API) - +org.owasp.dependencycheck.suppression (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/suppression/package-summary.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/suppression/package-summary.html index 2a46d3e54..4fa8906b5 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/suppression/package-summary.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/suppression/package-summary.html @@ -2,16 +2,16 @@ - + -org.owasp.dependencycheck.suppression (Dependency-Check Core 1.0.8 API) - +org.owasp.dependencycheck.suppression (Dependency-Check Core 1.1.0 API) + @@ -88,8 +88,8 @@ PropertyType -
    A simple PropertyType used to represent a string value that could be used as - a regular expression or could be case insensitive.
    +
    A simple PropertyType used to represent a string value that could be used as a regular expression or could be case + insensitive.
    diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/suppression/package-tree.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/suppression/package-tree.html index 513f31078..db3732412 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/suppression/package-tree.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/suppression/package-tree.html @@ -2,16 +2,16 @@ - + -org.owasp.dependencycheck.suppression Class Hierarchy (Dependency-Check Core 1.0.8 API) - +org.owasp.dependencycheck.suppression Class Hierarchy (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/suppression/package-use.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/suppression/package-use.html index 1f903ba21..6245ea38e 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/suppression/package-use.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/suppression/package-use.html @@ -2,16 +2,16 @@ - + -Uses of Package org.owasp.dependencycheck.suppression (Dependency-Check Core 1.0.8 API) - +Uses of Package org.owasp.dependencycheck.suppression (Dependency-Check Core 1.1.0 API) + @@ -128,8 +128,8 @@ PropertyType -
    A simple PropertyType used to represent a string value that could be used as - a regular expression or could be case insensitive.
    +
    A simple PropertyType used to represent a string value that could be used as a regular expression or could be case + insensitive.
    diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/Checksum.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/Checksum.html index 4a0363dc5..4123e8670 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/Checksum.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/Checksum.html @@ -2,16 +2,16 @@ - + -Checksum (Dependency-Check Core 1.0.8 API) - +Checksum (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/DBUtils.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/DBUtils.html index 05ea746be..12c3aeebc 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/DBUtils.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/DBUtils.html @@ -2,16 +2,16 @@ - + -DBUtils (Dependency-Check Core 1.0.8 API) - +DBUtils (Dependency-Check Core 1.1.0 API) + @@ -122,8 +122,7 @@ extends static void closeResultSet(ResultSet rs) -
    Closes the result set capturing and ignoring any SQLExceptions that - occur.
    +
    Closes the result set capturing and ignoring any SQLExceptions that occur.
    @@ -172,8 +171,7 @@ extends Parameters:
    statement - a prepared statement that just executed an insert
    Returns:
    a primary key
    Throws:
    -
    DatabaseException - thrown if there is an exception obtaining the - key
    +
    DatabaseException - thrown if there is an exception obtaining the key
    @@ -194,8 +192,7 @@ extends

    closeResultSet

    public static void closeResultSet(ResultSet rs)
    -
    Closes the result set capturing and ignoring any SQLExceptions that - occur.
    +
    Closes the result set capturing and ignoring any SQLExceptions that occur.
    Parameters:
    rs - a ResultSet to close
    diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/DependencyVersion.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/DependencyVersion.html index dd6e752e7..1ea4cbfad 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/DependencyVersion.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/DependencyVersion.html @@ -2,16 +2,16 @@ - + -DependencyVersion (Dependency-Check Core 1.0.8 API) - +DependencyVersion (Dependency-Check Core 1.1.0 API) + @@ -104,15 +104,15 @@ 
    public class DependencyVersion
 extends Object
 implements Iterable, Comparable<DependencyVersion>
    -

    Simple object to track the parts of a version number. The parts are - contained in a List such that version 1.2.3 will be stored as: - versionParts[0] = 1; +

    + Simple object to track the parts of a version number. The parts are contained in a List such that version 1.2.3 will + be stored as: versionParts[0] = 1; versionParts[1] = 2; versionParts[2] = 3;

    -

    Note, the parser contained in this class expects the version numbers to be - separated by periods. If a different separator is used the parser will likely - fail.

    +

    + Note, the parser contained in this class expects the version numbers to be separated by periods. If a different + separator is used the parser will likely fail.

    Author:
    Jeremy Long
    @@ -194,8 +194,7 @@ implements void parseVersion(String version) -
    Parses a version string into its sub parts: major, minor, revision, - build, etc.
    +
    Parses a version string into its sub parts: major, minor, revision, build, etc.
    @@ -250,9 +249,8 @@ implements String version)
    Constructor for a DependencyVersion that will parse a version string. - Note, this should only be used when the version passed in is - already known to be a well formated version number. Otherwise, - DependencyVersionUtil.parseVersion() should be used instead.
    + Note, this should only be used when the version passed in is already known to be a well formated version + number. Otherwise, DependencyVersionUtil.parseVersion() should be used instead.
    Parameters:
    version - the well formated version number to parse
    @@ -271,9 +269,8 @@ implements

    parseVersion

    public final void parseVersion(String version)
    -
    Parses a version string into its sub parts: major, minor, revision, - build, etc. Note, this should only be used to parse something that - is already known to be a version number.
    +
    Parses a version string into its sub parts: major, minor, revision, build, etc. Note, this should only be + used to parse something that is already known to be a version number.
    Parameters:
    version - the version string to parse
    @@ -363,9 +360,8 @@ implements

    matchesAtLeastThreeLevels

    public boolean matchesAtLeastThreeLevels(DependencyVersion version)
    -
    Determines if the three most major major version parts are identical. For - instances, if version 1.2.3.4 was compared to 1.2.3 this function would - return true.
    +
    Determines if the three most major major version parts are identical. For instances, if version 1.2.3.4 was + compared to 1.2.3 this function would return true.
    Parameters:
    version - the version number to compare
    Returns:
    true if the first three major parts of the version are identical
    diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/DependencyVersionUtil.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/DependencyVersionUtil.html index ee1cb3cea..4630488d1 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/DependencyVersionUtil.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/DependencyVersionUtil.html @@ -2,16 +2,16 @@ - + -DependencyVersionUtil (Dependency-Check Core 1.0.8 API) - +DependencyVersionUtil (Dependency-Check Core 1.1.0 API) + @@ -99,8 +99,8 @@ 
    public final class DependencyVersionUtil
 extends Object
    -

    A utility class to extract version numbers from file names (or other - strings containing version numbers.

    +

    + A utility class to extract version numbers from file names (or other strings containing version numbers.

    Author:
    Jeremy Long
    @@ -124,8 +124,8 @@ extends static DependencyVersion parseVersion(String text) -
    A utility class to extract version numbers from file names (or other - strings containing version numbers.
    +
    + A utility class to extract version numbers from file names (or other strings containing version numbers.
    Example:
    Give the file name: library-name-1.4.1r2-release.jar
    This function would return: 1.4.1.r2
    @@ -160,8 +160,8 @@ extends

    parseVersion

    public static DependencyVersion parseVersion(String text)
    -

    A utility class to extract version numbers from file names (or other - strings containing version numbers.
    +

    + A utility class to extract version numbers from file names (or other strings containing version numbers.
    Example:
    Give the file name: library-name-1.4.1r2-release.jar
    This function would return: 1.4.1.r2

    diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/DownloadFailedException.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/DownloadFailedException.html index a2b003c36..1bd44b09a 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/DownloadFailedException.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/DownloadFailedException.html @@ -2,16 +2,16 @@ - + -DownloadFailedException (Dependency-Check Core 1.0.8 API) - +DownloadFailedException (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/Downloader.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/Downloader.html index 0fbafe845..45180a82a 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/Downloader.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/Downloader.html @@ -2,16 +2,16 @@ - + -Downloader (Dependency-Check Core 1.0.8 API) - +Downloader (Dependency-Check Core 1.1.0 API) + @@ -130,8 +130,7 @@ extends static long getLastModified(URL url) -
    Makes an HTTP Head request to retrieve the last modified date of the - given URL.
    +
    Makes an HTTP Head request to retrieve the last modified date of the given URL.
    @@ -168,8 +167,7 @@ extends Retrieves a file from a given URL and saves it to the outputPath.
    Parameters:
    url - the URL of the file to download.
    outputPath - the path to the save the file to.
    Throws:
    -
    DownloadFailedException - is thrown if there is an error - downloading the file.
    +
    DownloadFailedException - is thrown if there is an error downloading the file.
    @@ -180,14 +178,12 @@ extends URL url) throws DownloadFailedException -
    Makes an HTTP Head request to retrieve the last modified date of the - given URL. If the file:// protocol is specified, then the lastTimestamp - of the file is returned.
    +
    Makes an HTTP Head request to retrieve the last modified date of the given URL. If the file:// protocol is + specified, then the lastTimestamp of the file is returned.
    Parameters:
    url - the URL to retrieve the timestamp from
    Returns:
    an epoch timestamp
    Throws:
    -
    DownloadFailedException - is thrown if an exception occurs making - the HTTP request
    +
    DownloadFailedException - is thrown if an exception occurs making the HTTP request
    diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/ExtractionException.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/ExtractionException.html index b0dbe35a7..126ab9482 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/ExtractionException.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/ExtractionException.html @@ -2,16 +2,16 @@ - + -ExtractionException (Dependency-Check Core 1.0.8 API) - +ExtractionException (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/FileUtils.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/FileUtils.html index 810c01307..cbd6bb153 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/FileUtils.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/FileUtils.html @@ -2,16 +2,16 @@ - + -FileUtils (Dependency-Check Core 1.0.8 API) - +FileUtils (Dependency-Check Core 1.1.0 API) + @@ -146,9 +146,8 @@ extends getDataDirectory(String configuredFilePath, Class clazz)
    Deprecated.  -
    This method should no longer be used. See the implementation - in dependency-check-cli/App.java to see how the data directory should be - set.
    +
    This method should no longer be used. See the implementation in dependency-check-cli/App.java to see + how the data directory should be set.
    @@ -208,8 +207,7 @@ extends File file) throws IOException -
    Deletes a file. If the File is a directory it will recursively delete the - contents.
    +
    Deletes a file. If the File is a directory it will recursively delete the contents.
    Parameters:
    file - the File to delete
    Throws:
    IOException - is thrown if the file could not be deleted
    @@ -225,14 +223,11 @@ extends File getDataDirectory(String configuredFilePath, Class clazz) throws IOException -
    Deprecated. This method should no longer be used. See the implementation - in dependency-check-cli/App.java to see how the data directory should be - set.
    -
    Returns the data directory. If a path was specified in - dependencycheck.properties or was specified using the Settings object, - and the path exists, that path will be returned as a File object. If it - does not exist, then a File object will be created based on the file - location of the JAR containing the specified class.
    +
    Deprecated. This method should no longer be used. See the implementation in dependency-check-cli/App.java to see + how the data directory should be set.
    +
    Returns the data directory. If a path was specified in dependencycheck.properties or was specified using the + Settings object, and the path exists, that path will be returned as a File object. If it does not exist, then a + File object will be created based on the file location of the JAR containing the specified class.
    Parameters:
    configuredFilePath - the configured relative or absolute path
    clazz - the class to resolve the path
    Returns:
    a File object
    Throws:
    @@ -249,10 +244,8 @@ public static File getPathToJar(Class clazz) throws UnsupportedEncodingException
    Deprecated. this should no longer be used.
    -
    Retrieves the physical path to the parent directory containing the - provided class. For example, if a JAR file contained a class - org.something.clazz this method would return the parent directory of the - JAR file.
    +
    Retrieves the physical path to the parent directory containing the provided class. For example, if a JAR file + contained a class org.something.clazz this method would return the parent directory of the JAR file.
    Parameters:
    clazz - the class to determine the parent directory of
    Returns:
    the parent directory of the file containing the specified class.
    Throws:
    @@ -271,8 +264,7 @@ public static Extracts the contents of an archive into the specified directory.
    Parameters:
    archive - an archive file such as a WAR or EAR
    extractTo - a directory to extract the contents to
    Throws:
    -
    ExtractionException - thrown if an exception occurs while - extracting the files
    +
    ExtractionException - thrown if an exception occurs while extracting the files
    @@ -285,14 +277,12 @@ public static File extractTo, Engine engine) throws ExtractionException -
    Extracts the contents of an archive into the specified directory. The - files are only extracted if they are supported by the analyzers loaded - into the specified engine. If the engine is specified as null then all - files are extracted.
    +
    Extracts the contents of an archive into the specified directory. The files are only extracted if they are + supported by the analyzers loaded into the specified engine. If the engine is specified as null then all files + are extracted.
    Parameters:
    archive - an archive file such as a WAR or EAR
    extractTo - a directory to extract the contents to
    engine - the scanning engine
    Throws:
    -
    ExtractionException - thrown if there is an error extracting the - files
    +
    ExtractionException - thrown if there is an error extracting the files
    diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/Filter.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/Filter.html index ee43bad65..a7a335fc8 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/Filter.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/Filter.html @@ -2,16 +2,16 @@ - + -Filter (Dependency-Check Core 1.0.8 API) - +Filter (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/InvalidSettingException.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/InvalidSettingException.html index 778853684..c91cb72bc 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/InvalidSettingException.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/InvalidSettingException.html @@ -2,16 +2,16 @@ - + -InvalidSettingException (Dependency-Check Core 1.0.8 API) - +InvalidSettingException (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/LogFilter.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/LogFilter.html index e5d388ff9..3fdcc2b27 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/LogFilter.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/LogFilter.html @@ -2,16 +2,16 @@ - + -LogFilter (Dependency-Check Core 1.0.8 API) - +LogFilter (Dependency-Check Core 1.1.0 API) + @@ -104,9 +104,8 @@ 
    public class LogFilter
 extends Object
 implements Filter
    -
    A simple log filter to limit the entries written to the verbose log file. The - verbose log file uses the root logger as I couldn't get anything else to - work; as such, this filter limits the log entries to specific classes.
    +
    A simple log filter to limit the entries written to the verbose log file. The verbose log file uses the root logger + as I couldn't get anything else to work; as such, this filter limits the log entries to specific classes.
    Author:
    Jeremy Long
    diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/LogUtils.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/LogUtils.html index 1ab40d923..b7e98203b 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/LogUtils.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/LogUtils.html @@ -2,16 +2,16 @@ - + -LogUtils (Dependency-Check Core 1.0.8 API) - +LogUtils (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/NonClosingStream.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/NonClosingStream.html index f06077d75..43c01a292 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/NonClosingStream.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/NonClosingStream.html @@ -2,16 +2,16 @@ - + -NonClosingStream (Dependency-Check Core 1.0.8 API) - +NonClosingStream (Dependency-Check Core 1.1.0 API) + @@ -113,9 +113,8 @@ 
    public class NonClosingStream
 extends FilterInputStream
    -
    NonClosingStream is a stream filter which prevents another class that - processes the stream from closing it. This is necessary when dealing with - things like JAXB and zipInputStreams.
    +
    NonClosingStream is a stream filter which prevents another class that processes the stream from closing it. This is + necessary when dealing with things like JAXB and zipInputStreams.
    Author:
    Jeremy Long
    diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/Settings.KEYS.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/Settings.KEYS.html index cdd82aa12..a144116d2 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/Settings.KEYS.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/Settings.KEYS.html @@ -2,16 +2,16 @@ - + -Settings.KEYS (Dependency-Check Core 1.0.8 API) - +Settings.KEYS (Dependency-Check Core 1.1.0 API) + @@ -137,8 +137,7 @@ extends static String AUTO_UPDATE -
    The properties key indicating whether or not the cached data sources - should be updated.
    +
    The properties key indicating whether or not the cached data sources should be updated.
    @@ -150,29 +149,27 @@ extends static String CVE_META_URL -
    The properties key for the URL to retrieve the "meta" data from about - the CVE entries.
    +
    The properties key for the URL to retrieve the "meta" data from about the CVE entries.
    static String CVE_MODIFIED_12_URL -
    The properties key for the URL to retrieve the recently modified and - added CVE entries (last 8 days) using the 1.2 schema.
    +
    The properties key for the URL to retrieve the recently modified and added CVE entries (last 8 days) using + the 1.2 schema.
    static String CVE_MODIFIED_20_URL -
    The properties key for the URL to retrieve the recently modified and - added CVE entries (last 8 days) using the 2.0 schema.
    +
    The properties key for the URL to retrieve the recently modified and added CVE entries (last 8 days) using + the 2.0 schema.
    static String CVE_MODIFIED_VALID_FOR_DAYS -
    The properties key for the URL to retrieve the recently modified and - added CVE entries (last 8 days).
    +
    The properties key for the URL to retrieve the recently modified and added CVE entries (last 8 days).
    @@ -244,8 +241,7 @@ extends static String PROXY_PORT -
    The properties key for the proxy port - this must be an integer - value.
    +
    The properties key for the proxy port - this must be an integer value.
    @@ -309,8 +305,7 @@ extends

    AUTO_UPDATE

    public static final String AUTO_UPDATE
    -
    The properties key indicating whether or not the cached data sources - should be updated.
    +
    The properties key indicating whether or not the cached data sources should be updated.
    See Also:
    Constant Field Values
    @@ -321,8 +316,7 @@ extends

    DB_DRIVER_NAME

    public static final String DB_DRIVER_NAME
    -
    The database driver class name. If this is not in the properties file - the embedded database is used.
    +
    The database driver class name. If this is not in the properties file the embedded database is used.
    See Also:
    Constant Field Values
    @@ -333,8 +327,7 @@ extends

    DB_DRIVER_PATH

    public static final String DB_DRIVER_PATH
    -
    The database driver class name. If this is not in the properties file - the embedded database is used.
    +
    The database driver class name. If this is not in the properties file the embedded database is used.
    See Also:
    Constant Field Values
    @@ -345,8 +338,7 @@ extends

    DB_CONNECTION_STRING

    public static final String DB_CONNECTION_STRING
    -
    The database connection string. If this is not in the properties file - the embedded database is used.
    +
    The database connection string. If this is not in the properties file the embedded database is used.
    See Also:
    Constant Field Values
    @@ -390,8 +382,7 @@ extends

    CVE_META_URL

    public static final String CVE_META_URL
    -
    The properties key for the URL to retrieve the "meta" data from about - the CVE entries.
    +
    The properties key for the URL to retrieve the "meta" data from about the CVE entries.
    See Also:
    Constant Field Values
    @@ -402,8 +393,8 @@ extends

    CVE_MODIFIED_20_URL

    public static final String CVE_MODIFIED_20_URL
    -
    The properties key for the URL to retrieve the recently modified and - added CVE entries (last 8 days) using the 2.0 schema.
    +
    The properties key for the URL to retrieve the recently modified and added CVE entries (last 8 days) using + the 2.0 schema.
    See Also:
    Constant Field Values
    @@ -414,8 +405,8 @@ extends

    CVE_MODIFIED_12_URL

    public static final String CVE_MODIFIED_12_URL
    -
    The properties key for the URL to retrieve the recently modified and - added CVE entries (last 8 days) using the 1.2 schema.
    +
    The properties key for the URL to retrieve the recently modified and added CVE entries (last 8 days) using + the 1.2 schema.
    See Also:
    Constant Field Values
    @@ -426,8 +417,7 @@ extends

    CVE_MODIFIED_VALID_FOR_DAYS

    public static final String CVE_MODIFIED_VALID_FOR_DAYS
    -
    The properties key for the URL to retrieve the recently modified and - added CVE entries (last 8 days).
    +
    The properties key for the URL to retrieve the recently modified and added CVE entries (last 8 days).
    See Also:
    Constant Field Values
    @@ -438,9 +428,8 @@ extends

    CVE_START_YEAR

    public static final String CVE_START_YEAR
    -
    The properties key for the telling us how many cvr.url.* URLs exists. - This is used in combination with CVE_BASE_URL to be able to retrieve - the URLs for all of the files that make up the NVD CVE listing.
    +
    The properties key for the telling us how many cvr.url.* URLs exists. This is used in combination with + CVE_BASE_URL to be able to retrieve the URLs for all of the files that make up the NVD CVE listing.
    See Also:
    Constant Field Values
    @@ -484,8 +473,7 @@ extends

    PROXY_PORT

    public static final String PROXY_PORT
    -
    The properties key for the proxy port - this must be an integer - value.
    +
    The properties key for the proxy port - this must be an integer value.
    See Also:
    Constant Field Values
    diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/Settings.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/Settings.html index f8c60b7a8..ed2842f1d 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/Settings.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/Settings.html @@ -2,16 +2,16 @@ - + -Settings (Dependency-Check Core 1.0.8 API) - +Settings (Dependency-Check Core 1.1.0 API) + @@ -290,16 +290,13 @@ extends File filePath) throws FileNotFoundException, IOException -
    Merges a new properties file into the current properties. This method - allows for the loading of a user provided properties file.

    - Note: even if using this method - system properties will be loaded before - properties loaded from files.
    +
    Merges a new properties file into the current properties. This method allows for the loading of a user provided + properties file.

    + Note: even if using this method - system properties will be loaded before properties loaded from files.
    Parameters:
    filePath - the path to the properties file to merge.
    Throws:
    -
    FileNotFoundException - is thrown when the filePath points to a - non-existent file
    -
    IOException - is thrown when there is an exception loading/merging - the properties
    +
    FileNotFoundException - is thrown when the filePath points to a non-existent file
    +
    IOException - is thrown when there is an exception loading/merging the properties
    @@ -311,16 +308,13 @@ extends String filePath) throws FileNotFoundException, IOException -
    Merges a new properties file into the current properties. This method - allows for the loading of a user provided properties file.

    - Note: even if using this method - system properties will be loaded before - properties loaded from files.
    +
    Merges a new properties file into the current properties. This method allows for the loading of a user provided + properties file.

    + Note: even if using this method - system properties will be loaded before properties loaded from files.
    Parameters:
    filePath - the path to the properties file to merge.
    Throws:
    -
    FileNotFoundException - is thrown when the filePath points to a - non-existent file
    -
    IOException - is thrown when there is an exception loading/merging - the properties
    +
    FileNotFoundException - is thrown when the filePath points to a non-existent file
    +
    IOException - is thrown when there is an exception loading/merging the properties
    @@ -331,14 +325,12 @@ extends InputStream stream) throws IOException -
    Merges a new properties file into the current properties. This method - allows for the loading of a user provided properties file.

    - Note: even if using this method - system properties will be loaded before - properties loaded from files.
    +
    Merges a new properties file into the current properties. This method allows for the loading of a user provided + properties file.

    + Note: even if using this method - system properties will be loaded before properties loaded from files.
    Parameters:
    stream - an Input Stream pointing at a properties file to merge
    Throws:
    -
    IOException - is thrown when there is an exception loading/merging - the properties
    +
    IOException - is thrown when there is an exception loading/merging the properties
    @@ -348,10 +340,9 @@ extends

    getFile

    public static File getFile(String key)
    -
    Returns a value from the properties file as a File object. If the value - was specified as a system property or passed in via the -Dprop=value - argument - this method will return the value from the system properties - before the values in the contained configuration file.
    +
    Returns a value from the properties file as a File object. If the value was specified as a system property or + passed in via the -Dprop=value argument - this method will return the value from the system properties before the + values in the contained configuration file.
    Parameters:
    key - the key to lookup within the properties file
    Returns:
    the property from the properties file converted to a File object
    @@ -363,15 +354,13 @@ extends

    getDataFile

    public static File getDataFile(String key)
    -
    Returns a value from the properties file as a File object. If the value - was specified as a system property or passed in via the -Dprop=value - argument - this method will return the value from the system properties - before the values in the contained configuration file. +
    Returns a value from the properties file as a File object. If the value was specified as a system property or + passed in via the -Dprop=value argument - this method will return the value from the system properties before the + values in the contained configuration file. - This method will check the configured base directory and will use this as - the base of the file path. Additionally, if the base directory begins - with a leading "[JAR]\" sequence with the path to the folder containing - the JAR file containing this class.
    + This method will check the configured base directory and will use this as the base of the file path. + Additionally, if the base directory begins with a leading "[JAR]\" sequence with the path to the folder + containing the JAR file containing this class.
    Parameters:
    key - the key to lookup within the properties file
    Returns:
    the property from the properties file converted to a File object
    @@ -384,9 +373,8 @@ extends String getString(String key, String defaultValue) -
    Returns a value from the properties file. If the value was specified as a - system property or passed in via the -Dprop=value argument - this method - will return the value from the system properties before the values in the +
    Returns a value from the properties file. If the value was specified as a system property or passed in via the + -Dprop=value argument - this method will return the value from the system properties before the values in the contained configuration file.
    Parameters:
    key - the key to lookup within the properties file
    defaultValue - the default value for the requested property
    Returns:
    the property from the properties file
    @@ -410,9 +398,8 @@ extends

    getString

    public static String getString(String key)
    -
    Returns a value from the properties file. If the value was specified as a - system property or passed in via the -Dprop=value argument - this method - will return the value from the system properties before the values in the +
    Returns a value from the properties file. If the value was specified as a system property or passed in via the + -Dprop=value argument - this method will return the value from the system properties before the values in the contained configuration file.
    Parameters:
    key - the key to lookup within the properties file
    Returns:
    the property from the properties file
    @@ -425,8 +412,7 @@ extends

    removeProperty

    public static void removeProperty(String key)
    -
    Removes a property from the local properties collection. This is mainly - used in test cases.
    +
    Removes a property from the local properties collection. This is mainly used in test cases.
    Parameters:
    key - the property key to remove
    @@ -438,15 +424,13 @@ extends String key) throws InvalidSettingException -
    Returns an int value from the properties file. If the value was specified - as a system property or passed in via the -Dprop=value argument - this - method will return the value from the system properties before the values - in the contained configuration file.
    +
    Returns an int value from the properties file. If the value was specified as a system property or passed in via + the -Dprop=value argument - this method will return the value from the system properties before the values in the + contained configuration file.
    Parameters:
    key - the key to lookup within the properties file
    Returns:
    the property from the properties file
    Throws:
    -
    InvalidSettingException - is thrown if there is an error retrieving - the setting
    +
    InvalidSettingException - is thrown if there is an error retrieving the setting
    @@ -457,13 +441,12 @@ extends String key, int defaultValue) -
    Returns an int value from the properties file. If the value was specified - as a system property or passed in via the -Dprop=value argument - this - method will return the value from the system properties before the values - in the contained configuration file.
    +
    Returns an int value from the properties file. If the value was specified as a system property or passed in via + the -Dprop=value argument - this method will return the value from the system properties before the values in the + contained configuration file.
    Parameters:
    key - the key to lookup within the properties file
    defaultValue - the default value to return
    -
    Returns:
    the property from the properties file or the defaultValue if the - property does not exist or cannot be converted to an integer
    +
    Returns:
    the property from the properties file or the defaultValue if the property does not exist or cannot be + converted to an integer
    @@ -474,15 +457,13 @@ extends String key) throws InvalidSettingException -
    Returns a long value from the properties file. If the value was specified - as a system property or passed in via the -Dprop=value argument - this - method will return the value from the system properties before the values - in the contained configuration file.
    +
    Returns a long value from the properties file. If the value was specified as a system property or passed in via + the -Dprop=value argument - this method will return the value from the system properties before the values in the + contained configuration file.
    Parameters:
    key - the key to lookup within the properties file
    Returns:
    the property from the properties file
    Throws:
    -
    InvalidSettingException - is thrown if there is an error retrieving - the setting
    +
    InvalidSettingException - is thrown if there is an error retrieving the setting
    @@ -493,16 +474,13 @@ extends String key) throws InvalidSettingException -
    Returns a boolean value from the properties file. If the value was - specified as a system property or passed in via the - -Dprop=value argument this method will return the value from - the system properties before the values in the contained configuration - file.
    +
    Returns a boolean value from the properties file. If the value was specified as a system property or passed in + via the -Dprop=value argument this method will return the value from the system properties before + the values in the contained configuration file.
    Parameters:
    key - the key to lookup within the properties file
    Returns:
    the property from the properties file
    Throws:
    -
    InvalidSettingException - is thrown if there is an error retrieving - the setting
    +
    InvalidSettingException - is thrown if there is an error retrieving the setting
    diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/UrlStringUtils.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/UrlStringUtils.html index ac7fd4da7..fa5c74668 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/UrlStringUtils.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/UrlStringUtils.html @@ -2,16 +2,16 @@ - + -UrlStringUtils (Dependency-Check Core 1.0.8 API) - +UrlStringUtils (Dependency-Check Core 1.1.0 API) + @@ -128,8 +128,8 @@ extends static List<String> extractImportantUrlData(String text) -
    Takes a URL, in String format, and adds the important parts of the URL - to a list of strings.
    +
    + Takes a URL, in String format, and adds the important parts of the URL to a list of strings.
    @@ -167,8 +167,8 @@ extends

    containsUrl

    public static boolean containsUrl(String text)
    -
    Tests if the text provided contains a URL. This is somewhat limited - search in that it only looks for (ftp|http|https)://
    +
    Tests if the text provided contains a URL. This is somewhat limited search in that it only looks for + (ftp|http|https)://
    Parameters:
    text - the text to search
    Returns:
    true if the text contains a url, otherwise false
    @@ -193,11 +193,13 @@ extends List<String> extractImportantUrlData(String text) throws MalformedURLException -

    Takes a URL, in String format, and adds the important parts of the URL - to a list of strings.

    -

    Example, given the following input:

    +

    + Takes a URL, in String format, and adds the important parts of the URL to a list of strings.

    +

    + Example, given the following input:

    "https://www.somedomain.com/path1/path2/file.php?id=439" -

    The function would return:

    +

    + The function would return:

    {"some.domain", "path1", "path2", "file"}
    Parameters:
    text - a URL
    Returns:
    importantParts a list of the important parts of the URL
    diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/class-use/Checksum.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/class-use/Checksum.html index 631b63497..656fc5982 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/class-use/Checksum.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/class-use/Checksum.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.utils.Checksum (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.utils.Checksum (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/class-use/DBUtils.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/class-use/DBUtils.html index 8a3a0aab6..f7958ecef 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/class-use/DBUtils.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/class-use/DBUtils.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.utils.DBUtils (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.utils.DBUtils (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/class-use/DependencyVersion.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/class-use/DependencyVersion.html index ed5977f07..516e36960 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/class-use/DependencyVersion.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/class-use/DependencyVersion.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.utils.DependencyVersion (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.utils.DependencyVersion (Dependency-Check Core 1.1.0 API) + @@ -117,8 +117,7 @@ boolean EvidenceCollection.containsUsedVersion(DependencyVersion version) -
    Used to determine if a given version was used (aka read) from the - EvidenceCollection.
    +
    Used to determine if a given version was used (aka read) from the EvidenceCollection.
    @@ -138,8 +137,8 @@ static DependencyVersion DependencyVersionUtil.parseVersion(String text) -
    A utility class to extract version numbers from file names (or other - strings containing version numbers.
    +
    + A utility class to extract version numbers from file names (or other strings containing version numbers.
    Example:
    Give the file name: library-name-1.4.1r2-release.jar
    This function would return: 1.4.1.r2
    diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/class-use/DependencyVersionUtil.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/class-use/DependencyVersionUtil.html index f8695c741..f0064d812 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/class-use/DependencyVersionUtil.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/class-use/DependencyVersionUtil.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.utils.DependencyVersionUtil (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.utils.DependencyVersionUtil (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/class-use/DownloadFailedException.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/class-use/DownloadFailedException.html index e0529d86c..e906f2c88 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/class-use/DownloadFailedException.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/class-use/DownloadFailedException.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.utils.DownloadFailedException (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.utils.DownloadFailedException (Dependency-Check Core 1.1.0 API) + @@ -173,8 +173,7 @@ static long Downloader.getLastModified(URL url) -
    Makes an HTTP Head request to retrieve the last modified date of the - given URL.
    +
    Makes an HTTP Head request to retrieve the last modified date of the given URL.
    diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/class-use/Downloader.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/class-use/Downloader.html index 398c2d320..095de84ee 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/class-use/Downloader.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/class-use/Downloader.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.utils.Downloader (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.utils.Downloader (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/class-use/ExtractionException.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/class-use/ExtractionException.html index afd3a0bdf..f4745ee6f 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/class-use/ExtractionException.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/class-use/ExtractionException.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.utils.ExtractionException (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.utils.ExtractionException (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/class-use/FileUtils.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/class-use/FileUtils.html index e32b880db..8e1ae4f20 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/class-use/FileUtils.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/class-use/FileUtils.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.utils.FileUtils (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.utils.FileUtils (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/class-use/Filter.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/class-use/Filter.html index e08b699dd..e6f87183c 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/class-use/Filter.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/class-use/Filter.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.utils.Filter (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.utils.Filter (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/class-use/InvalidSettingException.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/class-use/InvalidSettingException.html index 931c12610..4e58c8a1f 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/class-use/InvalidSettingException.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/class-use/InvalidSettingException.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.utils.InvalidSettingException (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.utils.InvalidSettingException (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/class-use/LogFilter.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/class-use/LogFilter.html index de330e15f..e2cb56cec 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/class-use/LogFilter.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/class-use/LogFilter.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.utils.LogFilter (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.utils.LogFilter (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/class-use/LogUtils.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/class-use/LogUtils.html index 7439be766..5e2d6a286 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/class-use/LogUtils.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/class-use/LogUtils.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.utils.LogUtils (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.utils.LogUtils (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/class-use/NonClosingStream.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/class-use/NonClosingStream.html index 01a0d9fbd..d7e5255c5 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/class-use/NonClosingStream.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/class-use/NonClosingStream.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.utils.NonClosingStream (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.utils.NonClosingStream (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/class-use/Settings.KEYS.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/class-use/Settings.KEYS.html index 95a7621c1..593688ec9 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/class-use/Settings.KEYS.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/class-use/Settings.KEYS.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.utils.Settings.KEYS (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.utils.Settings.KEYS (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/class-use/Settings.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/class-use/Settings.html index 2ba69c186..9bdea5eb6 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/class-use/Settings.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/class-use/Settings.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.utils.Settings (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.utils.Settings (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/class-use/UrlStringUtils.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/class-use/UrlStringUtils.html index 6adc4da53..cbfc81ef0 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/class-use/UrlStringUtils.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/class-use/UrlStringUtils.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.utils.UrlStringUtils (Dependency-Check Core 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.utils.UrlStringUtils (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/package-frame.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/package-frame.html index fccc192ee..8bb366895 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/package-frame.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/package-frame.html @@ -2,10 +2,10 @@ - + -org.owasp.dependencycheck.utils (Dependency-Check Core 1.0.8 API) - +org.owasp.dependencycheck.utils (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/package-summary.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/package-summary.html index 28c84711f..381dc83a4 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/package-summary.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/package-summary.html @@ -2,16 +2,16 @@ - + -org.owasp.dependencycheck.utils (Dependency-Check Core 1.0.8 API) - +org.owasp.dependencycheck.utils (Dependency-Check Core 1.1.0 API) + @@ -98,14 +98,15 @@ DependencyVersion -
    Simple object to track the parts of a version number.
    +
    + Simple object to track the parts of a version number.
    DependencyVersionUtil -
    A utility class to extract version numbers from file names (or other - strings containing version numbers.
    +
    + A utility class to extract version numbers from file names (or other strings containing version numbers.
    @@ -139,8 +140,7 @@ NonClosingStream -
    NonClosingStream is a stream filter which prevents another class that - processes the stream from closing it.
    +
    NonClosingStream is a stream filter which prevents another class that processes the stream from closing it.
    diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/package-tree.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/package-tree.html index e67dfb4bc..679171805 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/package-tree.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/package-tree.html @@ -2,16 +2,16 @@ - + -org.owasp.dependencycheck.utils Class Hierarchy (Dependency-Check Core 1.0.8 API) - +org.owasp.dependencycheck.utils Class Hierarchy (Dependency-Check Core 1.1.0 API) + diff --git a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/package-use.html b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/package-use.html index 5f2727844..b3bf9fde1 100644 --- a/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/package-use.html +++ b/dependency-check-core/apidocs/org/owasp/dependencycheck/utils/package-use.html @@ -2,16 +2,16 @@ - + -Uses of Package org.owasp.dependencycheck.utils (Dependency-Check Core 1.0.8 API) - +Uses of Package org.owasp.dependencycheck.utils (Dependency-Check Core 1.1.0 API) + @@ -139,7 +139,8 @@ DependencyVersion -
    Simple object to track the parts of a version number.
    +
    + Simple object to track the parts of a version number.
    @@ -156,7 +157,8 @@ DependencyVersion -
    Simple object to track the parts of a version number.
    +
    + Simple object to track the parts of a version number.
    diff --git a/dependency-check-core/apidocs/overview-frame.html b/dependency-check-core/apidocs/overview-frame.html index 5ffabb92d..695588641 100644 --- a/dependency-check-core/apidocs/overview-frame.html +++ b/dependency-check-core/apidocs/overview-frame.html @@ -2,10 +2,10 @@ - + -Overview List (Dependency-Check Core 1.0.8 API) - +Overview List (Dependency-Check Core 1.1.0 API) + @@ -15,7 +15,6 @@
    -

    Dependency-Check Core 1.0.8 API

    +

    Dependency-Check Core 1.1.0 API

    @@ -98,17 +98,6 @@ - - - - - + - + - - - - + + + + - + - + - + - + - + - + - + - + - + - + - + - + -
    org.owasp.dependencycheck.concurrency -
    - - org.owasp.dependencycheck.concurrency - - - Contains classes used to create shared and exclusive locks on directories.
    -
    org.owasp.dependencycheck.data.cpe
    @@ -119,7 +108,7 @@ Contains classes for working with the CPE Lucene Index.
    org.owasp.dependencycheck.data.cwe
    @@ -130,7 +119,7 @@ Contains classes for working with the CWE Database.
    org.owasp.dependencycheck.data.lucene
    @@ -141,11 +130,17 @@ Contains classes used to work with the Lucene Indexes.
    org.owasp.dependencycheck.data.nexus 
    org.owasp.dependencycheck.data.nexus +
    + + org.owasp.dependencycheck.data.nexus + +
    +
    org.owasp.dependencycheck.data.nvdcve
    @@ -156,7 +151,7 @@ Contains classes used to work with the NVD CVE data.
    org.owasp.dependencycheck.data.update
    @@ -166,7 +161,7 @@
    org.owasp.dependencycheck.data.update.exception
    @@ -176,7 +171,7 @@
    org.owasp.dependencycheck.data.update.task
    @@ -186,7 +181,7 @@
    org.owasp.dependencycheck.data.update.xml
    @@ -196,7 +191,7 @@
    org.owasp.dependencycheck.dependency
    @@ -207,7 +202,7 @@ Contains the core Dependency implementation.
    org.owasp.dependencycheck.exception
    @@ -217,7 +212,7 @@
    org.owasp.dependencycheck.jaxb.pom
    @@ -228,11 +223,11 @@ This package contains utility classes used to parse pom.xml files.
    org.owasp.dependencycheck.jaxb.pom.generated  
    org.owasp.dependencycheck.reporting
    @@ -243,7 +238,7 @@ Contains classes used to generate reports.
    org.owasp.dependencycheck.suppression
    @@ -254,7 +249,7 @@ Contains classes used to suppress findings.
    org.owasp.dependencycheck.utils
    diff --git a/dependency-check-core/apidocs/overview-tree.html b/dependency-check-core/apidocs/overview-tree.html index 44b752611..5d079df0b 100644 --- a/dependency-check-core/apidocs/overview-tree.html +++ b/dependency-check-core/apidocs/overview-tree.html @@ -2,16 +2,16 @@ - + -Class Hierarchy (Dependency-Check Core 1.0.8 API) - +Class Hierarchy (Dependency-Check Core 1.1.0 API) + @@ -69,7 +69,6 @@ diff --git a/dependency-check-core/checkstyle.html b/dependency-check-core/checkstyle.html index 7d828d053..57284e7bd 100644 --- a/dependency-check-core/checkstyle.html +++ b/dependency-check-core/checkstyle.html @@ -1,13 +1,13 @@ - + dependency-check-core - Checkstyle Results @@ -54,7 +54,7 @@
  • - +
  • /
    • @@ -67,8 +67,8 @@ -
  • Last Published: 2014-01-16
  • |
    • -
  • Version: 1.0.8
    • +
  • Last Published: 2014-01-26
  • |
    • +
  • Version: 1.1.0
    • @@ -88,7 +88,7 @@ Project Information - +
  • @@ -184,6 +184,13 @@ FindBugs Report
    • + +
  • + + + + JavaNCSS Report +
    • @@ -227,10 +234,10 @@     		Warnings Warnings Errors Errors
    169185 0 03
    +0

    Files

    @@ -238,57 +245,9 @@ - - - - - - - - - - - - - - - -
    Files I Infos W WarningsE Errors
    org/owasp/dependencycheck/Engine.java001
    org/owasp/dependencycheck/data/nvdcve/CveDB.java001
    org/owasp/dependencycheck/dependency/VulnerableSoftware.java001
    +E Errors
    -

    Details

    -
    -

    org/owasp/dependencycheck/Engine.java

    - - - - - - - - -
    ViolationMessageLine
    Errors'=' should be on the previous line.64
    -
    -

    org/owasp/dependencycheck/data/nvdcve/CveDB.java

    - - - - - - - - -
    ViolationMessageLine
    ErrorsMust have at least one statement.120
    -
    -

    org/owasp/dependencycheck/dependency/VulnerableSoftware.java

    - - - - - - - - -
    ViolationMessageLine
    ErrorsNested if-else depth is 5 (max allowed is 4).82
    +

    Details

    diff --git a/dependency-check-core/checkstyle.rss b/dependency-check-core/checkstyle.rss index b2b2c8afc..a0139e562 100644 --- a/dependency-check-core/checkstyle.rss +++ b/dependency-check-core/checkstyle.rss @@ -25,8 +25,8 @@ under the License. en-us ©2012 - 2014 OWASP - File: 169, - Errors: 3, + <title>File: 185, + Errors: 0, Warnings: 0, Infos: 0 @@ -45,6 +45,20 @@ under the License. + + dependency-check-maven/target/classes/log.properties + + + 0 + + + 0 + + + 0 + + + org/owasp/dependencycheck/data/lucene/package-info.java @@ -99,6 +113,20 @@ under the License. 0 + + + + dependency-check-maven/target/generated-classes/cobertura/mojo.properties + + + 0 + + + 0 + + + 0 + @@ -155,6 +183,20 @@ under the License. 0 + + + + dependency-check-ant/target/generated-classes/cobertura/cobertura.properties + + + 0 + + + 0 + + + 0 + @@ -309,6 +351,20 @@ under the License. 0 + + + + dependency-check-ant/target/generated-classes/cobertura/task.properties + + + 0 + + + 0 + + + 0 + @@ -323,6 +379,20 @@ under the License. 0 + + + + dependency-check-maven/target/maven-archiver/pom.properties + + + 0 + + + 0 + + + 0 + @@ -407,6 +477,20 @@ under the License. 0 + + + + dependency-check-maven/target/maven-plugin-help.properties + + + 0 + + + 0 + + + 0 + @@ -435,6 +519,20 @@ under the License. 0 + + + + dependency-check-ant/target/classes/task.properties + + + 0 + + + 0 + + + 0 + @@ -491,6 +589,20 @@ under the License. 0 + + + + dependency-check-maven/target/generated-classes/cobertura/log.properties + + + 0 + + + 0 + + + 0 + @@ -564,7 +676,7 @@ under the License. - org/owasp/dependencycheck/jaxb/pom/generated/Exclusion.java + org/owasp/dependencycheck/data/nvdcve/CorruptDatabaseException.java 0 @@ -578,7 +690,7 @@ under the License. - org/owasp/dependencycheck/data/nvdcve/CorruptDatabaseException.java + org/owasp/dependencycheck/jaxb/pom/generated/Exclusion.java 0 @@ -687,6 +799,20 @@ under the License. 0 + + + + dependency-check-ant/target/generated-classes/cobertura/taskdefs.properties + + + 0 + + + 0 + + + 0 + @@ -741,7 +867,7 @@ under the License. 0 - 1 + 0 @@ -841,6 +967,20 @@ under the License. 0 + + + + dependency-check-ant/target/maven-archiver/pom.properties + + + 0 + + + 0 + + + 0 + @@ -911,6 +1051,20 @@ under the License. 0 + + + + dependency-check-cli/target/maven-archiver/pom.properties + + + 0 + + + 0 + + + 0 + @@ -1079,6 +1233,20 @@ under the License. 0 + + + + dependency-check-ant/target/classes/log.properties + + + 0 + + + 0 + + + 0 + @@ -1135,6 +1303,20 @@ under the License. 0 + + + + dependency-check-cli/target/generated-classes/cobertura/log.properties + + + 0 + + + 0 + + + 0 + @@ -1163,20 +1345,6 @@ under the License. 0 - - - - org/owasp/dependencycheck/concurrency/DirectoryLockException.java - - - 0 - - - 0 - - - 0 - @@ -1219,6 +1387,20 @@ under the License. 0 + + + + org/owasp/dependencycheck/dependency/Confidence.java + + + 0 + + + 0 + + + 0 + @@ -1233,6 +1415,20 @@ under the License. 0 + + + + dependency-check-ant/target/classes/taskdefs.properties + + + 0 + + + 0 + + + 0 + @@ -1539,7 +1735,21 @@ under the License. 0 - 1 + 0 + + + + + dependency-check-maven/target/generated-classes/cobertura/cobertura.properties + + + 0 + + + 0 + + + 0 @@ -1625,20 +1835,6 @@ under the License. 0 - - - - org/owasp/dependencycheck/concurrency/package-info.java - - - 0 - - - 0 - - - 0 - @@ -1723,20 +1919,6 @@ under the License. 0 - - - - org/owasp/dependencycheck/concurrency/DirectorySpinLock.java - - - 0 - - - 0 - - - 0 - @@ -1768,7 +1950,7 @@ under the License. - org/owasp/dependencycheck/jaxb/pom/generated/Extension.java + org/owasp/dependencycheck/analyzer/VulnerabilitySuppressionAnalyzer.java 0 @@ -1782,7 +1964,7 @@ under the License. - org/owasp/dependencycheck/analyzer/VulnerabilitySuppressionAnalyzer.java + org/owasp/dependencycheck/jaxb/pom/generated/Extension.java 0 @@ -1810,7 +1992,7 @@ under the License. - org/owasp/dependencycheck/data/nvdcve/ConnectionFactory.java + org/owasp/dependencycheck/data/nvdcve/CveDB.java 0 @@ -1824,7 +2006,7 @@ under the License. - org/owasp/dependencycheck/data/nvdcve/CveDB.java + org/owasp/dependencycheck/data/nvdcve/ConnectionFactory.java 0 @@ -1833,7 +2015,7 @@ under the License. 0 - 1 + 0 @@ -1905,6 +2087,20 @@ under the License. 0 + + + + dependency-check-cli/target/generated-classes/cobertura/cobertura.properties + + + 0 + + + 0 + + + 0 + @@ -1933,6 +2129,20 @@ under the License. 0 + + + + dependency-check-ant/target/generated-classes/cobertura/log.properties + + + 0 + + + 0 + + + 0 + @@ -1975,6 +2185,20 @@ under the License. 0 + + + + dependency-check-cli/target/classes/log.properties + + + 0 + + + 0 + + + 0 + @@ -2157,6 +2381,20 @@ under the License. 0 + + + + dependency-check-maven/target/classes/mojo.properties + + + 0 + + + 0 + + + 0 + @@ -2367,20 +2605,6 @@ under the License. 0 - - - - org/owasp/dependencycheck/concurrency/InvalidDirectoryException.java - - - 0 - - - 0 - - - 0 - diff --git a/dependency-check-core/cobertura/frame-packages.html b/dependency-check-core/cobertura/frame-packages.html index 279deaf11..6cc714928 100644 --- a/dependency-check-core/cobertura/frame-packages.html +++ b/dependency-check-core/cobertura/frame-packages.html @@ -19,9 +19,6 @@ org.owasp.dependencycheck.analyzer -org.owasp.dependencycheck.concurrency - - org.owasp.dependencycheck.data.cpe diff --git a/dependency-check-core/cobertura/frame-sourcefiles-org.owasp.dependencycheck.analyzer.html b/dependency-check-core/cobertura/frame-sourcefiles-org.owasp.dependencycheck.analyzer.html index 52df49446..a1edacd86 100644 --- a/dependency-check-core/cobertura/frame-sourcefiles-org.owasp.dependencycheck.analyzer.html +++ b/dependency-check-core/cobertura/frame-sourcefiles-org.owasp.dependencycheck.analyzer.html @@ -45,25 +45,25 @@ org.owasp.dependencycheck.analyzer CpeSuppressionAnalyzer (60%) -DependencyBundlingAnalyzer (33%) +DependencyBundlingAnalyzer (48%) -FalsePositiveAnalyzer (69%) +FalsePositiveAnalyzer (73%) -FileNameAnalyzer (100%) +FileNameAnalyzer (95%) HintAnalyzer (94%) -JarAnalyzer (77%) +JarAnalyzer (59%) JavaScriptAnalyzer (0%) -NexusAnalyzer (41%) +NexusAnalyzer (73%) NvdCveAnalyzer (75%) diff --git a/dependency-check-core/cobertura/frame-sourcefiles-org.owasp.dependencycheck.data.nexus.html b/dependency-check-core/cobertura/frame-sourcefiles-org.owasp.dependencycheck.data.nexus.html index a6ca45214..f8f7f9205 100644 --- a/dependency-check-core/cobertura/frame-sourcefiles-org.owasp.dependencycheck.data.nexus.html +++ b/dependency-check-core/cobertura/frame-sourcefiles-org.owasp.dependencycheck.data.nexus.html @@ -15,10 +15,10 @@ org.owasp.dependencycheck.data.nexus - + - +
    MavenArtifact (0%)MavenArtifact (73%)
    NexusSearch (25%)NexusSearch (83%)
    diff --git a/dependency-check-core/cobertura/frame-sourcefiles-org.owasp.dependencycheck.data.nvdcve.html b/dependency-check-core/cobertura/frame-sourcefiles-org.owasp.dependencycheck.data.nvdcve.html index 13e561b98..b97a3edd6 100644 --- a/dependency-check-core/cobertura/frame-sourcefiles-org.owasp.dependencycheck.data.nvdcve.html +++ b/dependency-check-core/cobertura/frame-sourcefiles-org.owasp.dependencycheck.data.nvdcve.html @@ -15,19 +15,19 @@ org.owasp.dependencycheck.data.nvdcve - + - + - + diff --git a/dependency-check-core/cobertura/frame-sourcefiles-org.owasp.dependencycheck.dependency.html b/dependency-check-core/cobertura/frame-sourcefiles-org.owasp.dependencycheck.dependency.html index 43be5c6cd..2a9934e00 100644 --- a/dependency-check-core/cobertura/frame-sourcefiles-org.owasp.dependencycheck.dependency.html +++ b/dependency-check-core/cobertura/frame-sourcefiles-org.owasp.dependencycheck.dependency.html @@ -15,22 +15,25 @@ org.owasp.dependencycheck.dependency
    ConnectionFactory (44%)ConnectionFactory (47%)
    CorruptDatabaseException (0%)
    CveDB (47%)CveDB (46%)
    DatabaseException (0%)
    DatabaseProperties (92%)DatabaseProperties (84%)
    DriverLoadException (33%)
    - + - + + + + - + - + diff --git a/dependency-check-core/cobertura/frame-sourcefiles-org.owasp.dependencycheck.html b/dependency-check-core/cobertura/frame-sourcefiles-org.owasp.dependencycheck.html index dd076e7c3..3d8a50aad 100644 --- a/dependency-check-core/cobertura/frame-sourcefiles-org.owasp.dependencycheck.html +++ b/dependency-check-core/cobertura/frame-sourcefiles-org.owasp.dependencycheck.html @@ -15,7 +15,7 @@ org.owasp.dependencycheck
    Dependency (60%)Confidence (100%)
    Evidence (53%)Dependency (64%)
    Evidence (48%)
    EvidenceCollection (72%)
    Identifier (41%)Identifier (45%)
    Reference (47%)
    Vulnerability (70%)Vulnerability (68%)
    VulnerabilityComparator (100%)
    - +
    Engine (57%)Engine (59%)
    diff --git a/dependency-check-core/cobertura/frame-sourcefiles-org.owasp.dependencycheck.jaxb.pom.html b/dependency-check-core/cobertura/frame-sourcefiles-org.owasp.dependencycheck.jaxb.pom.html index d02f1047e..a659f17b3 100644 --- a/dependency-check-core/cobertura/frame-sourcefiles-org.owasp.dependencycheck.jaxb.pom.html +++ b/dependency-check-core/cobertura/frame-sourcefiles-org.owasp.dependencycheck.jaxb.pom.html @@ -15,7 +15,7 @@ org.owasp.dependencycheck.jaxb.pom - +
    MavenNamespaceFilter (100%)MavenNamespaceFilter (15%)
    diff --git a/dependency-check-core/cobertura/frame-sourcefiles-org.owasp.dependencycheck.reporting.html b/dependency-check-core/cobertura/frame-sourcefiles-org.owasp.dependencycheck.reporting.html index eb6100d99..1dfc348d6 100644 --- a/dependency-check-core/cobertura/frame-sourcefiles-org.owasp.dependencycheck.reporting.html +++ b/dependency-check-core/cobertura/frame-sourcefiles-org.owasp.dependencycheck.reporting.html @@ -15,7 +15,7 @@ org.owasp.dependencycheck.reporting - + diff --git a/dependency-check-core/cobertura/frame-sourcefiles-org.owasp.dependencycheck.utils.html b/dependency-check-core/cobertura/frame-sourcefiles-org.owasp.dependencycheck.utils.html index bc654fa6f..c8b6ccdee 100644 --- a/dependency-check-core/cobertura/frame-sourcefiles-org.owasp.dependencycheck.utils.html +++ b/dependency-check-core/cobertura/frame-sourcefiles-org.owasp.dependencycheck.utils.html @@ -54,7 +54,7 @@ org.owasp.dependencycheck.utils - + diff --git a/dependency-check-core/cobertura/frame-sourcefiles.html b/dependency-check-core/cobertura/frame-sourcefiles.html index 843dc6c41..077113790 100644 --- a/dependency-check-core/cobertura/frame-sourcefiles.html +++ b/dependency-check-core/cobertura/frame-sourcefiles.html @@ -78,7 +78,10 @@ All Packages - + + + + @@ -93,7 +96,7 @@ All Packages - + @@ -108,16 +111,16 @@ All Packages - + - + - + @@ -138,12 +141,6 @@ All Packages - - - - - - @@ -162,10 +159,10 @@ All Packages - + - + @@ -180,7 +177,7 @@ All Packages - + @@ -189,7 +186,7 @@ All Packages - + @@ -201,7 +198,7 @@ All Packages - + @@ -213,16 +210,13 @@ All Packages - - - - + @@ -243,19 +237,19 @@ All Packages - + - + - + - + @@ -318,7 +312,7 @@ All Packages - + @@ -348,7 +342,7 @@ All Packages - + @@ -399,7 +393,7 @@ All Packages - + diff --git a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.analyzer.html b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.analyzer.html index 9fafc1788..769fe1662 100644 --- a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.analyzer.html +++ b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.analyzer.html @@ -16,7 +16,7 @@
    ReportGenerator (51%)ReportGenerator (52%)
    VelocityLoggerRedirect (57%)NonClosingStream (100%)
    Settings (59%)Settings (58%)
    UrlStringUtils (82%)CiManagement (0%)
    ConnectionFactory (44%)Confidence (100%)
    ConnectionFactory (47%)
    Contributor (5%)CpeSuppressionAnalyzer (60%)
    CveDB (47%)CveDB (46%)
    CweDB (47%)DatabaseException (0%)
    DatabaseProperties (92%)DatabaseProperties (84%)
    Dependency (60%)Dependency (64%)
    Dependency (9%)
    DependencyBundlingAnalyzer (33%)DependencyBundlingAnalyzer (48%)
    DependencyManagement (0%)Developer (5%)
    DirectoryLockException (25%)
    DirectorySpinLock (65%)
    DistributionManagement (5%)
    DriverShim (25%)
    Engine (57%)Engine (59%)
    Evidence (53%)Evidence (48%)
    EvidenceCollection (72%)ExtractionException (0%)
    FalsePositiveAnalyzer (69%)FalsePositiveAnalyzer (73%)
    FieldAnalyzer (100%)Fields (0%)
    FileNameAnalyzer (100%)FileNameAnalyzer (95%)
    FileUtils (10%)HintAnalyzer (94%)
    Identifier (41%)Identifier (45%)
    IndexEntry (63%)InvalidDataException (0%)
    InvalidDirectoryException (0%)
    InvalidSettingException (0%)
    IssueManagement (14%)
    JarAnalyzer (77%)JarAnalyzer (59%)
    JavaScriptAnalyzer (0%)MailingList (0%)
    MavenArtifact (0%)MavenArtifact (73%)
    MavenNamespaceFilter (100%)MavenNamespaceFilter (15%)
    Model (13%)
    NexusAnalyzer (41%)NexusAnalyzer (73%)
    NexusSearch (25%)NexusSearch (83%)
    NoDataException (0%)Relocation (0%)
    ReportGenerator (51%)ReportGenerator (52%)
    ReportPlugin (14%)SearchVersionAnalyzer (0%)
    Settings (59%)Settings (58%)
    Site (10%)VersionTokenizingFilter (0%)
    Vulnerability (70%)Vulnerability (68%)
    VulnerabilityComparator (100%)
    - +
    Package # Classes Line Coverage Branch Coverage Complexity
    org.owasp.dependencycheck.analyzer22
    70%
    887/1263
    58%
    435/746
    		3.994
    org.owasp.dependencycheck.analyzer22
    65%
    961/1466
    54%
    498/914
    		4.564
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.cpe.html b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.cpe.html index d2d900e57..c3070efba 100644 --- a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.cpe.html +++ b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.cpe.html @@ -43,6 +43,6 @@ var classTable = new SortableTable(document.getElementById("classResults"), ["String", "Percentage", "Percentage", "FormattedNumber"]); classTable.sort(0); -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.cwe.html b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.cwe.html index 0fbb03d1e..46c8071b9 100644 --- a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.cwe.html +++ b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.cwe.html @@ -39,6 +39,6 @@ var classTable = new SortableTable(document.getElementById("classResults"), ["String", "Percentage", "Percentage", "FormattedNumber"]); classTable.sort(0); -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.lucene.html b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.lucene.html index 75c9bad92..aa674c1db 100644 --- a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.lucene.html +++ b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.lucene.html @@ -57,6 +57,6 @@ var classTable = new SortableTable(document.getElementById("classResults"), ["String", "Percentage", "Percentage", "FormattedNumber"]); classTable.sort(0); -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.nexus.html b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.nexus.html index 4d56750f7..2b3a13063 100644 --- a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.nexus.html +++ b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.nexus.html @@ -16,7 +16,7 @@ - +
    Package # Classes Line Coverage Branch Coverage Complexity
    org.owasp.dependencycheck.data.nexus2
    12%
    6/47
    75%
    3/4
    		1.571
    org.owasp.dependencycheck.data.nexus2
    78%
    39/50
    100%
    4/4
    		1.571
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.nvdcve.html b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.nvdcve.html index 52b5d411c..a22746439 100644 --- a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.nvdcve.html +++ b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.nvdcve.html @@ -16,7 +16,7 @@ - +
    Package # Classes Line Coverage Branch Coverage Complexity
    org.owasp.dependencycheck.data.nvdcve9
    47%
    262/557
    52%
    75/142
    		3.211
    org.owasp.dependencycheck.data.nvdcve9
    48%
    280/579
    54%
    78/144
    		3.203
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.update.exception.html b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.update.exception.html index 576a6e49d..7b662a0f7 100644 --- a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.update.exception.html +++ b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.update.exception.html @@ -39,6 +39,6 @@ var classTable = new SortableTable(document.getElementById("classResults"), ["String", "Percentage", "Percentage", "FormattedNumber"]); classTable.sort(0); -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.update.html b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.update.html index 7021abb38..b97c77aae 100644 --- a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.update.html +++ b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.update.html @@ -50,6 +50,6 @@ var classTable = new SortableTable(document.getElementById("classResults"), ["String", "Percentage", "Percentage", "FormattedNumber"]); classTable.sort(0); -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.update.task.html b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.update.task.html index a3cb17209..e06e8cf4e 100644 --- a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.update.task.html +++ b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.update.task.html @@ -39,6 +39,6 @@ var classTable = new SortableTable(document.getElementById("classResults"), ["String", "Percentage", "Percentage", "FormattedNumber"]); classTable.sort(0); -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.update.xml.html b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.update.xml.html index e82c63ab4..8bc9fc284 100644 --- a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.update.xml.html +++ b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.data.update.xml.html @@ -41,6 +41,6 @@ var classTable = new SortableTable(document.getElementById("classResults"), ["String", "Percentage", "Percentage", "FormattedNumber"]); classTable.sort(0); -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.dependency.html b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.dependency.html index b6551ff27..0af7492a4 100644 --- a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.dependency.html +++ b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.dependency.html @@ -16,7 +16,7 @@ - +
    Package # Classes Line Coverage Branch Coverage Complexity
    org.owasp.dependencycheck.dependency14
    64%
    343/534
    36%
    138/376
    		2.439
    org.owasp.dependencycheck.dependency14
    65%
    359/550
    36%
    139/380
    		2.383
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.exception.html b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.exception.html index aa6873ddc..e299cdc84 100644 --- a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.exception.html +++ b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.exception.html @@ -37,6 +37,6 @@ var classTable = new SortableTable(document.getElementById("classResults"), ["String", "Percentage", "Percentage", "FormattedNumber"]); classTable.sort(0); -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.html b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.html index 62bcc59fb..0bab4ec82 100644 --- a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.html +++ b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.html @@ -16,25 +16,24 @@ - - - + + - - + + - + - + - + - +
    Package # Classes Line Coverage Branch Coverage Complexity
    org.owasp.dependencycheck1
    57%
    104/181
    71%
    47/66
    		3.889
    org.owasp.dependencycheck.analyzer22
    70%
    887/1263
    58%
    435/746
    		3.994
    org.owasp.dependencycheck.concurrency3
    56%
    53/94
    66%
    16/24
    		2.611
    org.owasp.dependencycheck1
    59%
    105/177
    73%
    47/64
    		4
    org.owasp.dependencycheck.analyzer22
    65%
    961/1466
    54%
    498/914
    		4.564
    org.owasp.dependencycheck.data.cpe4
    65%
    93/141
    41%
    24/58
    		2.567
    org.owasp.dependencycheck.data.cwe2
    35%
    11/31
    25%
    2/8
    		2.8
    org.owasp.dependencycheck.data.lucene11
    67%
    97/144
    70%
    35/50
    		2.5
    org.owasp.dependencycheck.data.nexus2
    12%
    6/47
    75%
    3/4
    		1.571
    org.owasp.dependencycheck.data.nvdcve9
    47%
    262/557
    52%
    75/142
    		3.211
    org.owasp.dependencycheck.data.nexus2
    78%
    39/50
    100%
    4/4
    		1.571
    org.owasp.dependencycheck.data.nvdcve9
    48%
    280/579
    54%
    78/144
    		3.203
    org.owasp.dependencycheck.data.update6
    21%
    45/206
    6%
    4/60
    		2.543
    org.owasp.dependencycheck.data.update.exception2
    0%
    0/12
    N/A
    N/A
    		1
    org.owasp.dependencycheck.data.update.task2
    0%
    0/106
    0%
    0/22
    		2.824
    org.owasp.dependencycheck.data.update.xml4
    85%
    171/201
    88%
    101/114
    		2.914
    org.owasp.dependencycheck.dependency14
    64%
    343/534
    36%
    138/376
    		2.439
    org.owasp.dependencycheck.dependency14
    65%
    359/550
    36%
    139/380
    		2.383
    org.owasp.dependencycheck.exception1
    0%
    0/8
    N/A
    N/A
    		1
    org.owasp.dependencycheck.jaxb.pom1
    100%
    13/13
    50%
    1/2
    		1.25
    org.owasp.dependencycheck.jaxb.pom1
    15%
    2/13
    0%
    0/2
    		1.25
    org.owasp.dependencycheck.jaxb.pom.generated87
    7%
    74/945
    1%
    1/98
    		1.091
    org.owasp.dependencycheck.reporting3
    52%
    53/101
    18%
    8/44
    		4.273
    org.owasp.dependencycheck.reporting3
    53%
    55/103
    20%
    9/44
    		4.273
    org.owasp.dependencycheck.suppression6
    77%
    182/234
    73%
    96/130
    		2.792
    org.owasp.dependencycheck.utils19
    46%
    240/512
    50%
    100/198
    		3.024
    org.owasp.dependencycheck.utils19
    46%
    241/516
    50%
    100/198
    		3.024
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.jaxb.pom.generated.html b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.jaxb.pom.generated.html index 33b825aa6..ab87dbf43 100644 --- a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.jaxb.pom.generated.html +++ b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.jaxb.pom.generated.html @@ -160,6 +160,6 @@ var classTable = new SortableTable(document.getElementById("classResults"), ["String", "Percentage", "Percentage", "FormattedNumber"]); classTable.sort(0); -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.jaxb.pom.html b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.jaxb.pom.html index 1a3c0e8b3..5df8c30f8 100644 --- a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.jaxb.pom.html +++ b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.jaxb.pom.html @@ -16,7 +16,7 @@ - +
    Package # Classes Line Coverage Branch Coverage Complexity
    org.owasp.dependencycheck.jaxb.pom1
    100%
    13/13
    50%
    1/2
    		1.25
    org.owasp.dependencycheck.jaxb.pom1
    15%
    2/13
    0%
    0/2
    		1.25
    org.owasp.dependencycheck.jaxb.pom.generated87
    7%
    74/945
    1%
    1/98
    		1.091
    @@ -29,7 +29,7 @@ packageTable.sort(0); - +
    Classes in this Package Line Coverage Branch Coverage Complexity
    MavenNamespaceFilter
    100%
    13/13
    50%
    1/2
    		1.25
    MavenNamespaceFilter
    15%
    2/13
    0%
    0/2
    		1.25
    @@ -38,6 +38,6 @@ var classTable = new SortableTable(document.getElementById("classResults"), ["String", "Percentage", "Percentage", "FormattedNumber"]); classTable.sort(0); -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.reporting.html b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.reporting.html index 49d19b961..c20f3c350 100644 --- a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.reporting.html +++ b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.reporting.html @@ -16,7 +16,7 @@ - +
    Package # Classes Line Coverage Branch Coverage Complexity
    org.owasp.dependencycheck.reporting3
    52%
    53/101
    18%
    8/44
    		4.273
    org.owasp.dependencycheck.reporting3
    53%
    55/103
    20%
    9/44
    		4.273
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.suppression.html b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.suppression.html index 56ba17adf..0ad504435 100644 --- a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.suppression.html +++ b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.suppression.html @@ -47,6 +47,6 @@ var classTable = new SortableTable(document.getElementById("classResults"), ["String", "Percentage", "Percentage", "FormattedNumber"]); classTable.sort(0); -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.utils.html b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.utils.html index 392ca2689..b096178d4 100644 --- a/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.utils.html +++ b/dependency-check-core/cobertura/frame-summary-org.owasp.dependencycheck.utils.html @@ -16,7 +16,7 @@ - +
    Package # Classes Line Coverage Branch Coverage Complexity
    org.owasp.dependencycheck.utils19
    46%
    240/512
    50%
    100/198
    		3.024
    org.owasp.dependencycheck.utils19
    46%
    241/516
    50%
    100/198
    		3.024
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/frame-summary.html b/dependency-check-core/cobertura/frame-summary.html index 86fc9e4db..355f340c8 100644 --- a/dependency-check-core/cobertura/frame-summary.html +++ b/dependency-check-core/cobertura/frame-summary.html @@ -16,26 +16,25 @@ - - - - + + + - - + + - + - + - + - +
    Package # Classes Line Coverage Branch Coverage Complexity
    All Packages199
    49%
    2634/5330
    50%
    1086/2142
    		2.185
    org.owasp.dependencycheck1
    57%
    104/181
    71%
    47/66
    		3.889
    org.owasp.dependencycheck.analyzer22
    70%
    887/1263
    58%
    435/746
    		3.994
    org.owasp.dependencycheck.concurrency3
    56%
    53/94
    66%
    16/24
    		2.611
    All Packages196
    49%
    2715/5482
    49%
    1138/2290
    		2.257
    org.owasp.dependencycheck1
    59%
    105/177
    73%
    47/64
    		4
    org.owasp.dependencycheck.analyzer22
    65%
    961/1466
    54%
    498/914
    		4.564
    org.owasp.dependencycheck.data.cpe4
    65%
    93/141
    41%
    24/58
    		2.567
    org.owasp.dependencycheck.data.cwe2
    35%
    11/31
    25%
    2/8
    		2.8
    org.owasp.dependencycheck.data.lucene11
    67%
    97/144
    70%
    35/50
    		2.5
    org.owasp.dependencycheck.data.nexus2
    12%
    6/47
    75%
    3/4
    		1.571
    org.owasp.dependencycheck.data.nvdcve9
    47%
    262/557
    52%
    75/142
    		3.211
    org.owasp.dependencycheck.data.nexus2
    78%
    39/50
    100%
    4/4
    		1.571
    org.owasp.dependencycheck.data.nvdcve9
    48%
    280/579
    54%
    78/144
    		3.203
    org.owasp.dependencycheck.data.update6
    21%
    45/206
    6%
    4/60
    		2.543
    org.owasp.dependencycheck.data.update.exception2
    0%
    0/12
    N/A
    N/A
    		1
    org.owasp.dependencycheck.data.update.task2
    0%
    0/106
    0%
    0/22
    		2.824
    org.owasp.dependencycheck.data.update.xml4
    85%
    171/201
    88%
    101/114
    		2.914
    org.owasp.dependencycheck.dependency14
    64%
    343/534
    36%
    138/376
    		2.439
    org.owasp.dependencycheck.dependency14
    65%
    359/550
    36%
    139/380
    		2.383
    org.owasp.dependencycheck.exception1
    0%
    0/8
    N/A
    N/A
    		1
    org.owasp.dependencycheck.jaxb.pom1
    100%
    13/13
    50%
    1/2
    		1.25
    org.owasp.dependencycheck.jaxb.pom1
    15%
    2/13
    0%
    0/2
    		1.25
    org.owasp.dependencycheck.jaxb.pom.generated87
    7%
    74/945
    1%
    1/98
    		1.091
    org.owasp.dependencycheck.reporting3
    52%
    53/101
    18%
    8/44
    		4.273
    org.owasp.dependencycheck.reporting3
    53%
    55/103
    20%
    9/44
    		4.273
    org.owasp.dependencycheck.suppression6
    77%
    182/234
    73%
    96/130
    		2.792
    org.owasp.dependencycheck.utils19
    46%
    240/512
    50%
    100/198
    		3.024
    org.owasp.dependencycheck.utils19
    46%
    241/516
    50%
    100/198
    		3.024
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.Engine.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.Engine.html index d7eecdc92..dc7b472e0 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.Engine.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.Engine.html @@ -12,7 +12,7 @@
     
    - +
    Classes in this File Line Coverage Branch Coverage Complexity
    Engine
    57%
    104/181
    71%
    47/66
    		3.889
    Engine
    59%
    105/177
    73%
    47/64
    		4
     
    @@ -24,720 +24,700 @@  3   
      *
     4   - 
      * Dependency-check-core is free software: you can redistribute it and/or modify it
    + 
      * Licensed under the Apache License, Version 2.0 (the "License");
     5   - 
      * under the terms of the GNU General Public License as published by the Free
    + 
      * you may not use this file except in compliance with the License.
     6   - 
      * Software Foundation, either version 3 of the License, or (at your option) any
    + 
      * You may obtain a copy of the License at
     7   - 
      * later version.
    + 
      *
     8   - 
      *
    + 
      *     http://www.apache.org/licenses/LICENSE-2.0
     9   - 
      * Dependency-check-core is distributed in the hope that it will be useful, but
    + 
      *
     10   - 
      * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
    + 
      * Unless required by applicable law or agreed to in writing, software
     11   - 
      * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
    + 
      * distributed under the License is distributed on an "AS IS" BASIS,
     12   - 
      * details.
    + 
      * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13   - 
      *
    + 
      * See the License for the specific language governing permissions and
     14   - 
      * You should have received a copy of the GNU General Public License along with
    + 
      * limitations under the License.
     15   - 
      * dependency-check-core. If not, see http://www.gnu.org/licenses/.
    + 
      *
     16   - 
      *
    -  17   
      * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
    +  17   + 
      */
     18   - 
      */
    -  19   
     package org.owasp.dependencycheck;
    +  19   + 
     
     20   - 
     
    -  21   
     import java.io.File;
    -  22   +  21   
     import java.util.ArrayList;
    -  23   +  22   
     import java.util.EnumMap;
    -  24   +  23   
     import java.util.HashSet;
    -  25   +  24   
     import java.util.Iterator;
    -  26   +  25   
     import java.util.List;
    -  27   +  26   
     import java.util.Set;
    -  28   +  27   
     import java.util.logging.Level;
    -  29   +  28   
     import java.util.logging.Logger;
    -  30   +  29   
     import org.owasp.dependencycheck.analyzer.AnalysisException;
    -  31   +  30   
     import org.owasp.dependencycheck.analyzer.AnalysisPhase;
    -  32   +  31   
     import org.owasp.dependencycheck.analyzer.Analyzer;
    -  33   +  32   
     import org.owasp.dependencycheck.analyzer.AnalyzerService;
    -  34   +  33   
     import org.owasp.dependencycheck.data.cpe.CpeMemoryIndex;
    -  35   +  34   
     import org.owasp.dependencycheck.data.cpe.IndexException;
    -  36   +  35   
     import org.owasp.dependencycheck.data.nvdcve.CveDB;
    -  37   +  36   
     import org.owasp.dependencycheck.data.nvdcve.DatabaseException;
    -  38   +  37   
     import org.owasp.dependencycheck.data.update.CachedWebDataSource;
    -  39   +  38   
     import org.owasp.dependencycheck.data.update.UpdateService;
    -  40   +  39   
     import org.owasp.dependencycheck.data.update.exception.UpdateException;
    -  41   +  40   
     import org.owasp.dependencycheck.dependency.Dependency;
    -  42   +  41   
     import org.owasp.dependencycheck.exception.NoDataException;
    -  43   +  42   
     import org.owasp.dependencycheck.utils.FileUtils;
    -  44   +  43   
     import org.owasp.dependencycheck.utils.InvalidSettingException;
    -  45   +  44   
     import org.owasp.dependencycheck.utils.Settings;
    +  45   + 
     
     46   - 
     
    -  47   
     /**
    -  48   +  47   
      * Scans files, directories, etc. for Dependencies. Analyzers are loaded and used to process the files found by the
    -  49   +  48   
      * scan, if a file is encountered and an Analyzer is associated with the file type then the file is turned into a
    -  50   +  49   
      * dependency.
    -  51   +  50   
      *
    -  52   +  51   
      * @author Jeremy Long <jeremy.long@owasp.org>
    -  53   +  52   
      */
    -  54   +  53   
     public class Engine {
    +  54   + 
     
     55   - 
     
    + 
         /**
     56   - 
         /**
    -  57   
          * The list of dependencies.
    +  57   + 
          */
     58   - 
          */
    -  59  6 
         private final List<Dependency> dependencies = new ArrayList<Dependency>();
    + 
         private final List<Dependency> dependencies;
    +  59   + 
         /**
     60   - 
         /**
    -  61   
          * A Map of analyzers grouped by Analysis phase.
    +  61   + 
          */
     62   - 
          */
    -  63  6 
         private final EnumMap<AnalysisPhase, List<Analyzer>> analyzers
    + 
         private final EnumMap<AnalysisPhase, List<Analyzer>> analyzers;
    +  63   + 
         /**
     64   - 
                 = new EnumMap<AnalysisPhase, List<Analyzer>>(AnalysisPhase.class);
    -  65   - 
         /**
    -  66   
          * A set of extensions supported by the analyzers.
    +  65   + 
          */
    +  66   + 
         private final Set<String> extensions;
     67   - 
          */
    -  68  6 
         private final Set<String> extensions = new HashSet<String>();
    + 
     
    +  68   + 
         /**
     69   - 
     
    + 
          * Creates a new Engine.
     70   - 
         /**
    -  71   - 
          * Creates a new Engine.
    -  72   
          */
    -  73  6 
         public Engine() {
    -  74  6 
             boolean autoUpdate = true;
    +  71  12 
         public Engine() {
    +  72  12 
             this.extensions = new HashSet<String>();
    +  73  12 
             this.dependencies = new ArrayList<Dependency>();
    +  74  12 
             this.analyzers = new EnumMap<AnalysisPhase, List<Analyzer>>(AnalysisPhase.class);
     75   + 
     
    +  76  12 
             boolean autoUpdate = true;
    +  77   
             try {
    -  76  6 
                 autoUpdate = Settings.getBoolean(Settings.KEYS.AUTO_UPDATE);
    -  77  0 
             } catch (InvalidSettingException ex) {
    -  78  0 
                 Logger.getLogger(Engine.class.getName()).log(Level.FINE, "Invalid setting for auto-update; using true.");
    -  79  6 
             }
    -  80  6 
             if (autoUpdate) {
    -  81  0 
                 doUpdates();
    -  82   +  78  12 
                 autoUpdate = Settings.getBoolean(Settings.KEYS.AUTO_UPDATE);
    +  79  0 
             } catch (InvalidSettingException ex) {
    +  80  0 
                 Logger.getLogger(Engine.class.getName()).log(Level.FINE, "Invalid setting for auto-update; using true.");
    +  81  12 
             }
    +  82  12 
             if (autoUpdate) {
    +  83  0 
                 doUpdates();
    +  84   
             }
    -  83  6 
             loadAnalyzers();
    -  84  6 
         }
    -  85   - 
     
    -  86   - 
         /**
    +  85  12 
             loadAnalyzers();
    +  86  12 
         }
     87   - 
          * Creates a new Engine.
    + 
     
     88   - 
          *
    + 
         /**
     89   - 
          * @param autoUpdate indicates whether or not data should be updated from the Internet
    -  90   - 
          * @deprecated This function should no longer be used; the autoupdate flag should be set using:
    -  91   - 
          * <code>Settings.setBoolean(Settings.KEYS.AUTO_UPDATE, value);</code>
    -  92   - 
          */
    -  93   - 
         @Deprecated
    -  94  0 
         public Engine(boolean autoUpdate) {
    -  95  0 
             if (autoUpdate) {
    -  96  0 
                 doUpdates();
    -  97   - 
             }
    -  98  0 
             loadAnalyzers();
    -  99  0 
         }
    -  100   - 
     
    -  101   - 
         /**
    -  102   
          * Loads the analyzers specified in the configuration file (or system properties).
    -  103   +  90   
          */
    -  104   +  91   
         private void loadAnalyzers() {
    -  105   +  92   
     
    -  106  60 
             for (AnalysisPhase phase : AnalysisPhase.values()) {
    -  107  54 
                 analyzers.put(phase, new ArrayList<Analyzer>());
    -  108   +  93  120 
             for (AnalysisPhase phase : AnalysisPhase.values()) {
    +  94  108 
                 analyzers.put(phase, new ArrayList<Analyzer>());
    +  95   
             }
    -  109   +  96   
     
    -  110  6 
             final AnalyzerService service = AnalyzerService.getInstance();
    -  111  6 
             final Iterator<Analyzer> iterator = service.getAnalyzers();
    -  112  72 
             while (iterator.hasNext()) {
    -  113  66 
                 final Analyzer a = iterator.next();
    -  114  66 
                 analyzers.get(a.getAnalysisPhase()).add(a);
    -  115  66 
                 if (a.getSupportedExtensions() != null) {
    -  116  18 
                     extensions.addAll(a.getSupportedExtensions());
    -  117   +  97  12 
             final AnalyzerService service = AnalyzerService.getInstance();
    +  98  12 
             final Iterator<Analyzer> iterator = service.getAnalyzers();
    +  99  144 
             while (iterator.hasNext()) {
    +  100  132 
                 final Analyzer a = iterator.next();
    +  101  132 
                 analyzers.get(a.getAnalysisPhase()).add(a);
    +  102  132 
                 if (a.getSupportedExtensions() != null) {
    +  103  36 
                     extensions.addAll(a.getSupportedExtensions());
    +  104   
                 }
    -  118  66 
             }
    -  119  6 
         }
    -  120   +  105  132 
             }
    +  106  12 
         }
    +  107   
     
    -  121   +  108   
         /**
    -  122   +  109   
          * Get the List of the analyzers for a specific phase of analysis.
    -  123   +  110   
          *
    -  124   +  111   
          * @param phase the phase to get the configured analyzers.
    -  125   +  112   
          * @return the analyzers loaded
    -  126   +  113   
          */
    -  127   +  114   
         public List<Analyzer> getAnalyzers(AnalysisPhase phase) {
    -  128  0 
             return analyzers.get(phase);
    -  129   +  115  0 
             return analyzers.get(phase);
    +  116   
         }
    -  130   +  117   
     
    -  131   +  118   
         /**
    -  132   +  119   
          * Get the dependencies identified.
    -  133   +  120   
          *
    -  134   +  121   
          * @return the dependencies identified
    -  135   +  122   
          */
    -  136   +  123   
         public List<Dependency> getDependencies() {
    -  137  38 
             return dependencies;
    -  138   +  124  76 
             return dependencies;
    +  125   
         }
    -  139   +  126   
     
    -  140   +  127   
         /**
    -  141   +  128   
          * Scans an array of files or directories. If a directory is specified, it will be scanned recursively. Any
    -  142   +  129   
          * dependencies identified are added to the dependency collection.
    -  143   +  130   
          *
    -  144   +  131   
          * @since v0.3.2.5
    +  132   + 
          *
    +  133   + 
          * @param paths an array of paths to files or directories to be analyzed.
    +  134   + 
          */
    +  135   + 
         public void scan(String[] paths) {
    +  136  0 
             for (String path : paths) {
    +  137  0 
                 final File file = new File(path);
    +  138  0 
                 scan(file);
    +  139   + 
             }
    +  140  0 
         }
    +  141   + 
     
    +  142   + 
         /**
    +  143   + 
          * Scans a given file or directory. If a directory is specified, it will be scanned recursively. Any dependencies
    +  144   + 
          * identified are added to the dependency collection.
     145   
          *
     146   - 
          * @param paths an array of paths to files or directories to be analyzed.
    + 
          * @param path the path to a file or directory to be analyzed.
     147   
          */
     148   - 
         public void scan(String[] paths) {
    -  149  0 
             for (String path : paths) {
    -  150  0 
                 final File file = new File(path);
    -  151  0 
                 scan(file);
    + 
         public void scan(String path) {
    +  149  0 
             final File file = new File(path);
    +  150  0 
             scan(file);
    +  151  0 
         }
     152   - 
             }
    -  153  0 
         }
    -  154   
     
    -  155   +  153   
         /**
    +  154   + 
          * Scans an array of files or directories. If a directory is specified, it will be scanned recursively. Any
    +  155   + 
          * dependencies identified are added to the dependency collection.
     156   - 
          * Scans a given file or directory. If a directory is specified, it will be scanned recursively. Any dependencies
    + 
          *
     157   - 
          * identified are added to the dependency collection.
    + 
          * @since v0.3.2.5
     158   
          *
     159   - 
          * @param path the path to a file or directory to be analyzed.
    + 
          * @param files an array of paths to files or directories to be analyzed.
     160   
          */
     161   - 
         public void scan(String path) {
    -  162  0 
             final File file = new File(path);
    -  163  0 
             scan(file);
    -  164  0 
         }
    -  165   - 
     
    -  166   - 
         /**
    -  167   - 
          * Scans an array of files or directories. If a directory is specified, it will be scanned recursively. Any
    -  168   - 
          * dependencies identified are added to the dependency collection.
    -  169   - 
          *
    -  170   - 
          * @since v0.3.2.5
    -  171   - 
          *
    -  172   - 
          * @param files an array of paths to files or directories to be analyzed.
    -  173   - 
          */
    -  174   
         public void scan(File[] files) {
    -  175  0 
             for (File file : files) {
    -  176  0 
                 scan(file);
    -  177   +  162  0 
             for (File file : files) {
    +  163  0 
                 scan(file);
    +  164   
             }
    -  178  0 
         }
    -  179   +  165  0 
         }
    +  166   
     
    -  180   +  167   
         /**
    -  181   +  168   
          * Scans a list of files or directories. If a directory is specified, it will be scanned recursively. Any
    -  182   +  169   
          * dependencies identified are added to the dependency collection.
    -  183   +  170   
          *
    -  184   +  171   
          * @since v0.3.2.5
    -  185   +  172   
          *
    -  186   +  173   
          * @param files a set of paths to files or directories to be analyzed.
    -  187   +  174   
          */
    -  188   +  175   
         public void scan(Set<File> files) {
    -  189  0 
             for (File file : files) {
    -  190  0 
                 scan(file);
    -  191  0 
             }
    -  192  0 
         }
    -  193   +  176  0 
             for (File file : files) {
    +  177  0 
                 scan(file);
    +  178  0 
             }
    +  179  0 
         }
    +  180   
     
    -  194   +  181   
         /**
    -  195   +  182   
          * Scans a list of files or directories. If a directory is specified, it will be scanned recursively. Any
    -  196   +  183   
          * dependencies identified are added to the dependency collection.
    -  197   +  184   
          *
    -  198   +  185   
          * @since v0.3.2.5
    -  199   +  186   
          *
    -  200   +  187   
          * @param files a set of paths to files or directories to be analyzed.
    -  201   +  188   
          */
    -  202   +  189   
         public void scan(List<File> files) {
    -  203  0 
             for (File file : files) {
    -  204  0 
                 scan(file);
    -  205  0 
             }
    -  206  0 
         }
    -  207   +  190  0 
             for (File file : files) {
    +  191  0 
                 scan(file);
    +  192  0 
             }
    +  193  0 
         }
    +  194   
     
    -  208   +  195   
         /**
    -  209   +  196   
          * Scans a given file or directory. If a directory is specified, it will be scanned recursively. Any dependencies
    -  210   +  197   
          * identified are added to the dependency collection.
    -  211   +  198   
          *
    -  212   +  199   
          * @since v0.3.2.4
    -  213   +  200   
          *
    -  214   +  201   
          * @param file the path to a file or directory to be analyzed.
    -  215   +  202   
          */
    -  216   +  203   
         public void scan(File file) {
    -  217  13 
             if (file.exists()) {
    -  218  13 
                 if (file.isDirectory()) {
    -  219  8 
                     scanDirectory(file);
    -  220   +  204  26 
             if (file.exists()) {
    +  205  26 
                 if (file.isDirectory()) {
    +  206  16 
                     scanDirectory(file);
    +  207   
                 } else {
    -  221  5 
                     scanFile(file);
    -  222   +  208  10 
                     scanFile(file);
    +  209   
                 }
    -  223   +  210   
             }
    -  224  13 
         }
    -  225   +  211  26 
         }
    +  212   
     
    -  226   +  213   
         /**
    -  227   +  214   
          * Recursively scans files and directories. Any dependencies identified are added to the dependency collection.
    -  228   +  215   
          *
    -  229   +  216   
          * @param dir the directory to scan.
    -  230   +  217   
          */
    -  231   +  218   
         protected void scanDirectory(File dir) {
    -  232  33 
             final File[] files = dir.listFiles();
    -  233  33 
             if (files != null) {
    -  234  68 
                 for (File f : files) {
    -  235  35 
                     if (f.isDirectory()) {
    -  236  25 
                         scanDirectory(f);
    -  237   +  219  70 
             final File[] files = dir.listFiles();
    +  220  70 
             if (files != null) {
    +  221  162 
                 for (File f : files) {
    +  222  92 
                     if (f.isDirectory()) {
    +  223  54 
                         scanDirectory(f);
    +  224   
                     } else {
    -  238  10 
                         scanFile(f);
    -  239   +  225  38 
                         scanFile(f);
    +  226   
                     }
    -  240   +  227   
                 }
    +  228   + 
             }
    +  229  70 
         }
    +  230   + 
     
    +  231   + 
         /**
    +  232   + 
          * Scans a specified file. If a dependency is identified it is added to the dependency collection.
    +  233   + 
          *
    +  234   + 
          * @param file The file to scan.
    +  235   + 
          */
    +  236   + 
         protected void scanFile(File file) {
    +  237  48 
             if (!file.isFile()) {
    +  238  0 
                 final String msg = String.format("Path passed to scanFile(File) is not a file: %s. Skipping the file.", file.toString());
    +  239  0 
                 Logger.getLogger(Engine.class.getName()).log(Level.FINE, msg);
    +  240  0 
                 return;
     241   
             }
    -  242  33 
         }
    -  243   - 
     
    -  244   - 
         /**
    -  245   - 
          * Scans a specified file. If a dependency is identified it is added to the dependency collection.
    -  246   - 
          *
    -  247   - 
          * @param file The file to scan.
    -  248   - 
          */
    +  242  48 
             final String fileName = file.getName();
    +  243  48 
             final String extension = FileUtils.getFileExtension(fileName);
    +  244  48 
             if (extension != null) {
    +  245  48 
                 if (extensions.contains(extension)) {
    +  246  48 
                     final Dependency dependency = new Dependency(file);
    +  247  48 
                     dependencies.add(dependency);
    +  248  48 
                 }
     249   - 
         protected void scanFile(File file) {
    -  250  15 
             if (!file.isFile()) {
    -  251  0 
                 final String msg = String.format("Path passed to scanFile(File) is not a file: %s. Skipping the file.", file.toString());
    -  252  0 
                 Logger.getLogger(Engine.class.getName()).log(Level.FINE, msg);
    -  253  0 
                 return;
    -  254   - 
             }
    -  255  15 
             final String fileName = file.getName();
    -  256  15 
             final String extension = FileUtils.getFileExtension(fileName);
    -  257  15 
             if (extension != null) {
    -  258  15 
                 if (extensions.contains(extension)) {
    -  259  15 
                     final Dependency dependency = new Dependency(file);
    -  260  15 
                     dependencies.add(dependency);
    -  261  15 
                 }
    -  262   
             } else {
    -  263  0 
                 final String msg = String.format("No file extension found on file '%s'. The file was not analyzed.",
    -  264   +  250  0 
                 final String msg = String.format("No file extension found on file '%s'. The file was not analyzed.",
    +  251   
                         file.toString());
    -  265  0 
                 Logger.getLogger(Engine.class.getName()).log(Level.FINEST, msg);
    -  266   +  252  0 
                 Logger.getLogger(Engine.class.getName()).log(Level.FINEST, msg);
    +  253   
             }
    -  267  15 
         }
    -  268   +  254  48 
         }
    +  255   
     
    -  269   +  256   
         /**
    -  270   +  257   
          * Runs the analyzers against all of the dependencies.
    -  271   +  258   
          */
    -  272   +  259   
         public void analyzeDependencies() {
    -  273   +  260   
             //need to ensure that data exists
    -  274   +  261   
             try {
    -  275  3 
                 ensureDataExists();
    -  276  0 
             } catch (NoDataException ex) {
    -  277  0 
                 final String msg = String.format("%s%n%nUnable to continue dependency-check analysis.", ex.getMessage());
    -  278  0 
                 Logger.getLogger(Engine.class.getName()).log(Level.SEVERE, msg);
    -  279  0 
                 Logger.getLogger(Engine.class.getName()).log(Level.FINE, null, ex);
    -  280  0 
                 return;
    -  281  0 
             } catch (DatabaseException ex) {
    -  282  0 
                 final String msg = String.format("%s%n%nUnable to continue dependency-check analysis.", ex.getMessage());
    -  283  0 
                 Logger.getLogger(Engine.class.getName()).log(Level.SEVERE, msg);
    -  284  0 
                 Logger.getLogger(Engine.class.getName()).log(Level.FINE, null, ex);
    -  285  0 
                 return;
    -  286   +  262  6 
                 ensureDataExists();
    +  263  0 
             } catch (NoDataException ex) {
    +  264  0 
                 final String msg = String.format("%s%n%nUnable to continue dependency-check analysis.", ex.getMessage());
    +  265  0 
                 Logger.getLogger(Engine.class.getName()).log(Level.SEVERE, msg);
    +  266  0 
                 Logger.getLogger(Engine.class.getName()).log(Level.FINE, null, ex);
    +  267  0 
                 return;
    +  268  0 
             } catch (DatabaseException ex) {
    +  269  0 
                 final String msg = String.format("%s%n%nUnable to continue dependency-check analysis.", ex.getMessage());
    +  270  0 
                 Logger.getLogger(Engine.class.getName()).log(Level.SEVERE, msg);
    +  271  0 
                 Logger.getLogger(Engine.class.getName()).log(Level.FINE, null, ex);
    +  272  0 
                 return;
    +  273   
     
    -  287  3 
             }
    -  288   +  274  6 
             }
    +  275   
     
    -  289  3 
             final String logHeader = String.format("%n"
    -  290   +  276  6 
             final String logHeader = String.format("%n"
    +  277   
                     + "----------------------------------------------------%n"
    -  291   +  278   
                     + "BEGIN ANALYSIS%n"
    -  292   +  279   
                     + "----------------------------------------------------");
    -  293  3 
             Logger.getLogger(Engine.class.getName()).log(Level.FINE, logHeader);
    -  294  3 
             Logger.getLogger(Engine.class.getName()).log(Level.INFO, "Analysis Starting");
    -  295   +  280  6 
             Logger.getLogger(Engine.class.getName()).log(Level.FINE, logHeader);
    +  281  6 
             Logger.getLogger(Engine.class.getName()).log(Level.INFO, "Analysis Starting");
    +  282   
     
    -  296   +  283   
             //phase one initialize
    -  297  30 
             for (AnalysisPhase phase : AnalysisPhase.values()) {
    -  298  27 
                 final List<Analyzer> analyzerList = analyzers.get(phase);
    -  299  27 
                 for (Analyzer a : analyzerList) {
    -  300   +  284  60 
             for (AnalysisPhase phase : AnalysisPhase.values()) {
    +  285  54 
                 final List<Analyzer> analyzerList = analyzers.get(phase);
    +  286  54 
                 for (Analyzer a : analyzerList) {
    +  287   
                     try {
    -  301  33 
                         final String msg = String.format("Initializing %s", a.getName());
    -  302  33 
                         Logger.getLogger(Engine.class.getName()).log(Level.FINE, msg);
    -  303  33 
                         a.initialize();
    -  304  0 
                     } catch (Exception ex) {
    -  305  0 
                         final String msg = String.format("Exception occurred initializing %s.", a.getName());
    -  306  0 
                         Logger.getLogger(Engine.class.getName()).log(Level.SEVERE, msg);
    -  307  0 
                         Logger.getLogger(Engine.class.getName()).log(Level.INFO, null, ex);
    -  308   +  288  66 
                         final String msg = String.format("Initializing %s", a.getName());
    +  289  66 
                         Logger.getLogger(Engine.class.getName()).log(Level.FINE, msg);
    +  290  66 
                         a.initialize();
    +  291  0 
                     } catch (Exception ex) {
    +  292  0 
                         final String msg = String.format("Exception occurred initializing %s.", a.getName());
    +  293  0 
                         Logger.getLogger(Engine.class.getName()).log(Level.SEVERE, msg);
    +  294  0 
                         Logger.getLogger(Engine.class.getName()).log(Level.INFO, null, ex);
    +  295   
                         try {
    -  309  0 
                             a.close();
    -  310  0 
                         } catch (Exception ex1) {
    -  311  0 
                             Logger.getLogger(Engine.class.getName()).log(Level.FINEST, null, ex1);
    -  312  0 
                         }
    -  313  33 
                     }
    -  314  33 
                 }
    -  315   +  296  0 
                             a.close();
    +  297  0 
                         } catch (Exception ex1) {
    +  298  0 
                             Logger.getLogger(Engine.class.getName()).log(Level.FINEST, null, ex1);
    +  299  0 
                         }
    +  300  66 
                     }
    +  301  66 
                 }
    +  302   
             }
    -  316   +  303   
     
    -  317   +  304   
             // analysis phases
    -  318  30 
             for (AnalysisPhase phase : AnalysisPhase.values()) {
    -  319  27 
                 final List<Analyzer> analyzerList = analyzers.get(phase);
    -  320   +  305  60 
             for (AnalysisPhase phase : AnalysisPhase.values()) {
    +  306  54 
                 final List<Analyzer> analyzerList = analyzers.get(phase);
    +  307   
     
    -  321  27 
                 for (Analyzer a : analyzerList) {
    -  322   +  308  54 
                 for (Analyzer a : analyzerList) {
    +  309   
                     /* need to create a copy of the collection because some of the
    -  323   +  310   
                      * analyzers may modify it. This prevents ConcurrentModificationExceptions.
    -  324   +  311   
                      * This is okay for adds/deletes because it happens per analyzer.
    -  325   +  312   
                      */
    -  326  33 
                     final String msg = String.format("Begin Analyzer '%s'", a.getName());
    -  327  33 
                     Logger.getLogger(Engine.class.getName()).log(Level.FINE, msg);
    -  328  33 
                     final Set<Dependency> dependencySet = new HashSet<Dependency>();
    -  329  33 
                     dependencySet.addAll(dependencies);
    -  330  33 
                     for (Dependency d : dependencySet) {
    -  331  95 
                         if (a.supportsExtension(d.getFileExtension())) {
    -  332  84 
                             final String msgFile = String.format("Begin Analysis of '%s'", d.getActualFilePath());
    -  333  84 
                             Logger.getLogger(Engine.class.getName()).log(Level.FINE, msgFile);
    -  334   +  313  66 
                     final String msg = String.format("Begin Analyzer '%s'", a.getName());
    +  314  66 
                     Logger.getLogger(Engine.class.getName()).log(Level.FINE, msg);
    +  315  66 
                     final Set<Dependency> dependencySet = new HashSet<Dependency>();
    +  316  66 
                     dependencySet.addAll(dependencies);
    +  317  66 
                     for (Dependency d : dependencySet) {
    +  318  190 
                         if (a.supportsExtension(d.getFileExtension())) {
    +  319  168 
                             final String msgFile = String.format("Begin Analysis of '%s'", d.getActualFilePath());
    +  320  168 
                             Logger.getLogger(Engine.class.getName()).log(Level.FINE, msgFile);
    +  321   
                             try {
    -  335  84 
                                 a.analyze(d, this);
    -  336  0 
                             } catch (AnalysisException ex) {
    -  337  0 
                                 d.addAnalysisException(ex);
    -  338  0 
                             } catch (Throwable ex) {
    -  339  0 
                                 final String axMsg = String.format("An unexpected error occurred during analysis of '%s'", d.getActualFilePath());
    -  340  0 
                                 final AnalysisException ax = new AnalysisException(axMsg, ex);
    -  341  0 
                                 d.addAnalysisException(ax);
    -  342  0 
                                 Logger.getLogger(Engine.class.getName()).log(Level.SEVERE, axMsg);
    -  343  0 
                                 Logger.getLogger(Engine.class.getName()).log(Level.FINE, axMsg, ex);
    -  344  84 
                             }
    -  345   +  322  168 
                                 a.analyze(d, this);
    +  323  0 
                             } catch (AnalysisException ex) {
    +  324  0 
                                 d.addAnalysisException(ex);
    +  325  0 
                             } catch (Throwable ex) {
    +  326  0 
                                 final String axMsg = String.format("An unexpected error occurred during analysis of '%s'", d.getActualFilePath());
    +  327  0 
                                 final AnalysisException ax = new AnalysisException(axMsg, ex);
    +  328  0 
                                 d.addAnalysisException(ax);
    +  329  0 
                                 Logger.getLogger(Engine.class.getName()).log(Level.SEVERE, axMsg);
    +  330  0 
                                 Logger.getLogger(Engine.class.getName()).log(Level.FINE, axMsg, ex);
    +  331  168 
                             }
    +  332   
                         }
    -  346  95 
                     }
    -  347  33 
                 }
    -  348   +  333  190 
                     }
    +  334  66 
                 }
    +  335   
             }
    -  349   +  336   
     
    -  350   +  337   
             //close/cleanup
    -  351  30 
             for (AnalysisPhase phase : AnalysisPhase.values()) {
    -  352  27 
                 final List<Analyzer> analyzerList = analyzers.get(phase);
    -  353  27 
                 for (Analyzer a : analyzerList) {
    -  354  33 
                     final String msg = String.format("Closing Analyzer '%s'", a.getName());
    -  355  33 
                     Logger.getLogger(Engine.class.getName()).log(Level.FINE, msg);
    -  356   +  338  60 
             for (AnalysisPhase phase : AnalysisPhase.values()) {
    +  339  54 
                 final List<Analyzer> analyzerList = analyzers.get(phase);
    +  340  54 
                 for (Analyzer a : analyzerList) {
    +  341  66 
                     final String msg = String.format("Closing Analyzer '%s'", a.getName());
    +  342  66 
                     Logger.getLogger(Engine.class.getName()).log(Level.FINE, msg);
    +  343   
                     try {
    -  357  33 
                         a.close();
    -  358  0 
                     } catch (Exception ex) {
    -  359  0 
                         Logger.getLogger(Engine.class.getName()).log(Level.FINEST, null, ex);
    -  360  33 
                     }
    -  361  33 
                 }
    -  362   +  344  66 
                         a.close();
    +  345  0 
                     } catch (Exception ex) {
    +  346  0 
                         Logger.getLogger(Engine.class.getName()).log(Level.FINEST, null, ex);
    +  347  66 
                     }
    +  348  66 
                 }
    +  349   
             }
    -  363   +  350   
     
    -  364  3 
             final String logFooter = String.format("%n"
    -  365   +  351  6 
             final String logFooter = String.format("%n"
    +  352   
                     + "----------------------------------------------------%n"
    -  366   +  353   
                     + "END ANALYSIS%n"
    -  367   +  354   
                     + "----------------------------------------------------");
    -  368  3 
             Logger.getLogger(Engine.class.getName()).log(Level.FINE, logFooter);
    -  369  3 
         }
    -  370   +  355  6 
             Logger.getLogger(Engine.class.getName()).log(Level.FINE, logFooter);
    +  356  6 
             Logger.getLogger(Engine.class.getName()).log(Level.INFO, "Analysis Complete");
    +  357  6 
         }
    +  358   
     
    -  371   +  359   
         /**
    -  372   +  360   
          * Cycles through the cached web data sources and calls update on all of them.
    -  373   +  361   
          */
    -  374   +  362   
         private void doUpdates() {
    -  375  0 
             final UpdateService service = UpdateService.getInstance();
    -  376  0 
             final Iterator<CachedWebDataSource> iterator = service.getDataSources();
    -  377  0 
             while (iterator.hasNext()) {
    -  378  0 
                 final CachedWebDataSource source = iterator.next();
    -  379   +  363  0 
             final UpdateService service = UpdateService.getInstance();
    +  364  0 
             final Iterator<CachedWebDataSource> iterator = service.getDataSources();
    +  365  0 
             while (iterator.hasNext()) {
    +  366  0 
                 final CachedWebDataSource source = iterator.next();
    +  367   
                 try {
    -  380  0 
                     source.update();
    -  381  0 
                 } catch (UpdateException ex) {
    -  382  0 
                     Logger.getLogger(Engine.class.getName()).log(Level.WARNING,
    -  383   +  368  0 
                     source.update();
    +  369  0 
                 } catch (UpdateException ex) {
    +  370  0 
                     Logger.getLogger(Engine.class.getName()).log(Level.WARNING,
    +  371   
                             "Unable to update Cached Web DataSource, using local data instead. Results may not include recent vulnerabilities.");
    -  384  0 
                     Logger.getLogger(Engine.class.getName()).log(Level.FINE,
    -  385   +  372  0 
                     Logger.getLogger(Engine.class.getName()).log(Level.FINE,
    +  373   
                             String.format("Unable to update details for %s", source.getClass().getName()), ex);
    -  386  0 
                 }
    -  387  0 
             }
    -  388  0 
         }
    -  389   +  374  0 
                 }
    +  375  0 
             }
    +  376  0 
         }
    +  377   
     
    -  390   +  378   
         /**
    -  391   +  379   
          * Returns a full list of all of the analyzers. This is useful for reporting which analyzers where used.
    -  392   +  380   
          *
    -  393   +  381   
          * @return a list of Analyzers
    -  394   +  382   
          */
    -  395   +  383   
         public List<Analyzer> getAnalyzers() {
    -  396  1 
             final List<Analyzer> ret = new ArrayList<Analyzer>();
    -  397  10 
             for (AnalysisPhase phase : AnalysisPhase.values()) {
    -  398  9 
                 final List<Analyzer> analyzerList = analyzers.get(phase);
    -  399  9 
                 ret.addAll(analyzerList);
    -  400   +  384  2 
             final List<Analyzer> ret = new ArrayList<Analyzer>();
    +  385  20 
             for (AnalysisPhase phase : AnalysisPhase.values()) {
    +  386  18 
                 final List<Analyzer> analyzerList = analyzers.get(phase);
    +  387  18 
                 ret.addAll(analyzerList);
    +  388   
             }
    -  401  1 
             return ret;
    -  402   +  389  2 
             return ret;
    +  390   
         }
    -  403   +  391   
     
    -  404   +  392   
         /**
    -  405   +  393   
          * Checks all analyzers to see if an extension is supported.
    -  406   +  394   
          *
    -  407   +  395   
          * @param ext a file extension
    -  408   +  396   
          * @return true or false depending on whether or not the file extension is supported
    -  409   +  397   
          */
    -  410   +  398   
         public boolean supportsExtension(String ext) {
    -  411  143 
             if (ext == null) {
    -  412  8 
                 return false;
    -  413   +  399  304 
             if (ext == null) {
    +  400  16 
                 return false;
    +  401   
             }
    -  414  1267 
             for (AnalysisPhase phase : AnalysisPhase.values()) {
    -  415  1142 
                 final List<Analyzer> analyzerList = analyzers.get(phase);
    -  416  1142 
                 for (Analyzer a : analyzerList) {
    -  417  1399 
                     if (a.getSupportedExtensions() != null && a.supportsExtension(ext)) {
    -  418  10 
                         return true;
    -  419   +  402  2570 
             for (AnalysisPhase phase : AnalysisPhase.values()) {
    +  403  2320 
                 final List<Analyzer> analyzerList = analyzers.get(phase);
    +  404  2320 
                 for (Analyzer a : analyzerList) {
    +  405  2852 
                     if (a.getSupportedExtensions() != null && a.supportsExtension(ext)) {
    +  406  38 
                         return true;
    +  407   
                     }
    -  420  1389 
                 }
    -  421   +  408  2814 
                 }
    +  409   
             }
    -  422  125 
             return false;
    -  423   +  410  250 
             return false;
    +  411   
         }
    -  424   +  412   
     
    -  425   +  413   
         /**
    -  426   +  414   
          * Checks the CPE Index to ensure documents exists. If none exist a NoDataException is thrown.
    -  427   +  415   
          *
    -  428   +  416   
          * @throws NoDataException thrown if no data exists in the CPE Index
    -  429   +  417   
          * @throws DatabaseException thrown if there is an exception opening the database
    -  430   +  418   
          */
    -  431   +  419   
         private void ensureDataExists() throws NoDataException, DatabaseException {
    -  432  3 
             final CpeMemoryIndex cpe = CpeMemoryIndex.getInstance();
    -  433  3 
             final CveDB cve = new CveDB();
    -  434   +  420  6 
             final CpeMemoryIndex cpe = CpeMemoryIndex.getInstance();
    +  421  6 
             final CveDB cve = new CveDB();
    +  422   
     
    -  435   +  423   
             try {
    -  436  3 
                 cve.open();
    -  437  3 
                 cpe.open(cve);
    -  438  0 
             } catch (IndexException ex) {
    -  439  0 
                 throw new NoDataException(ex.getMessage(), ex);
    -  440  0 
             } catch (DatabaseException ex) {
    -  441  0 
                 throw new NoDataException(ex.getMessage(), ex);
    -  442   +  424  6 
                 cve.open();
    +  425  6 
                 cpe.open(cve);
    +  426  0 
             } catch (IndexException ex) {
    +  427  0 
                 throw new NoDataException(ex.getMessage(), ex);
    +  428  0 
             } catch (DatabaseException ex) {
    +  429  0 
                 throw new NoDataException(ex.getMessage(), ex);
    +  430   
             } finally {
    -  443  3 
                 cve.close();
    -  444  3 
             }
    -  445  3 
             if (cpe.numDocs() <= 0) {
    -  446  0 
                 cpe.close();
    -  447  0 
                 throw new NoDataException("No documents exist");
    -  448   +  431  6 
                 cve.close();
    +  432  6 
             }
    +  433  6 
             if (cpe.numDocs() <= 0) {
    +  434  0 
                 cpe.close();
    +  435  0 
                 throw new NoDataException("No documents exist");
    +  436   
             }
    -  449  3 
         }
    -  450   +  437  6 
         }
    +  438   
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AbstractAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AbstractAnalyzer.html index 72b91db8c..a240aafc5 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AbstractAnalyzer.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AbstractAnalyzer.html @@ -24,131 +24,127 @@  3   
      *
     4   - 
      * Dependency-check-core is free software: you can redistribute it and/or modify it
    + 
      * Licensed under the Apache License, Version 2.0 (the "License");
     5   - 
      * under the terms of the GNU General Public License as published by the Free
    + 
      * you may not use this file except in compliance with the License.
     6   - 
      * Software Foundation, either version 3 of the License, or (at your option) any
    + 
      * You may obtain a copy of the License at
     7   - 
      * later version.
    + 
      *
     8   - 
      *
    + 
      *     http://www.apache.org/licenses/LICENSE-2.0
     9   - 
      * Dependency-check-core is distributed in the hope that it will be useful, but
    + 
      *
     10   - 
      * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
    + 
      * Unless required by applicable law or agreed to in writing, software
     11   - 
      * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
    + 
      * distributed under the License is distributed on an "AS IS" BASIS,
     12   - 
      * details.
    + 
      * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13   - 
      *
    + 
      * See the License for the specific language governing permissions and
     14   - 
      * You should have received a copy of the GNU General Public License along with
    + 
      * limitations under the License.
     15   - 
      * dependency-check-core. If not, see http://www.gnu.org/licenses/.
    + 
      *
     16   - 
      *
    -  17   
      * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
    +  17   + 
      */
     18   - 
      */
    -  19   
     package org.owasp.dependencycheck.analyzer;
    +  19   + 
     
     20   - 
     
    -  21   
     import java.util.Collections;
    -  22   +  21   
     import java.util.HashSet;
    -  23   +  22   
     import java.util.Set;
    +  23   + 
     
     24   - 
     
    -  25   
     /**
    -  26   +  25   
      *
    -  27   +  26   
      * @author Jeremy Long <jeremy.long@owasp.org>
    -  28   +  27   
      */
    -  29  57 
     public abstract class AbstractAnalyzer implements Analyzer {
    +  28  134 
     public abstract class AbstractAnalyzer implements Analyzer {
    +  29   + 
     
     30   - 
     
    + 
         /**
     31   - 
         /**
    + 
          * Utility method to help in the creation of the extensions set. This constructs a new Set that can be used in a
     32   - 
          * Utility method to help in the creation of the extensions set. This
    + 
          * final static declaration.<br/><br/>
     33   - 
          * constructs a new Set that can be used in a final static
    + 
          *
     34   - 
          * declaration.<br/><br/>
    -  35   - 
          *
    -  36   
          * This implementation was copied from
    -  37   +  35   
          * http://stackoverflow.com/questions/2041778/initialize-java-hashset-values-by-construction
    -  38   +  36   
          *
    -  39   +  37   
          * @param strings a list of strings to add to the set.
    -  40   +  38   
          * @return a Set of strings.
    -  41   +  39   
          */
    -  42   +  40   
         protected static Set<String> newHashSet(String... strings) {
    -  43  6 
             final Set<String> set = new HashSet<String>();
    -  44   +  41  12 
             final Set<String> set = new HashSet<String>();
    +  42   
     
    -  45  6 
             Collections.addAll(set, strings);
    -  46  6 
             return set;
    -  47   +  43  12 
             Collections.addAll(set, strings);
    +  44  12 
             return set;
    +  45   
         }
    +  46   + 
     
    +  47   + 
         /**
     48   - 
     
    -  49   - 
         /**
    -  50   
          * The initialize method does nothing for this Analyzer.
    +  49   + 
          *
    +  50   + 
          * @throws Exception thrown if there is an exception
     51   - 
          *
    + 
          */
     52   - 
          * @throws Exception thrown if there is an exception
    + 
         @Override
     53   - 
          */
    -  54   - 
         @Override
    -  55   
         public void initialize() throws Exception {
    +  54   + 
             //do nothing
    +  55  38 
         }
     56   - 
             //do nothing
    -  57  19 
         }
    -  58   
     
    -  59   +  57   
         /**
    -  60   +  58   
          * The close method does nothing for this Analyzer.
    -  61   +  59   
          *
    -  62   +  60   
          * @throws Exception thrown if there is an exception
    -  63   +  61   
          */
    -  64   +  62   
         @Override
    -  65   +  63   
         public void close() throws Exception {
    -  66   +  64   
             //do nothing
    -  67  22 
         }
    -  68   +  65  44 
         }
    +  66   
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AbstractSuppressionAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AbstractSuppressionAnalyzer.html index 84366789f..d56df135e 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AbstractSuppressionAnalyzer.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AbstractSuppressionAnalyzer.html @@ -24,210 +24,204 @@  3   
      *
     4   - 
      * Dependency-check-core is free software: you can redistribute it and/or modify it
    + 
      * Licensed under the Apache License, Version 2.0 (the "License");
     5   - 
      * under the terms of the GNU General Public License as published by the Free
    + 
      * you may not use this file except in compliance with the License.
     6   - 
      * Software Foundation, either version 3 of the License, or (at your option) any
    + 
      * You may obtain a copy of the License at
     7   - 
      * later version.
    + 
      *
     8   - 
      *
    + 
      *     http://www.apache.org/licenses/LICENSE-2.0
     9   - 
      * Dependency-check-core is distributed in the hope that it will be useful, but
    + 
      *
     10   - 
      * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
    + 
      * Unless required by applicable law or agreed to in writing, software
     11   - 
      * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
    + 
      * distributed under the License is distributed on an "AS IS" BASIS,
     12   - 
      * details.
    + 
      * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13   - 
      *
    + 
      * See the License for the specific language governing permissions and
     14   - 
      * You should have received a copy of the GNU General Public License along with
    + 
      * limitations under the License.
     15   - 
      * dependency-check-core. If not, see http://www.gnu.org/licenses/.
    + 
      *
     16   - 
      *
    -  17   
      * Copyright (c) 2013 Jeremy Long. All Rights Reserved.
    +  17   + 
      */
     18   - 
      */
    -  19   
     package org.owasp.dependencycheck.analyzer;
    +  19   + 
     
     20   - 
     
    -  21   
     import java.io.File;
    -  22   +  21   
     import java.util.List;
    -  23   +  22   
     import java.util.Set;
    -  24   +  23   
     import java.util.logging.Level;
    -  25   +  24   
     import java.util.logging.Logger;
    -  26   +  25   
     import org.owasp.dependencycheck.suppression.SuppressionParseException;
    -  27   +  26   
     import org.owasp.dependencycheck.suppression.SuppressionParser;
    -  28   +  27   
     import org.owasp.dependencycheck.suppression.SuppressionRule;
    -  29   +  28   
     import org.owasp.dependencycheck.utils.Settings;
    +  29   + 
     
     30   - 
     
    -  31   
     /**
    +  31   + 
      * Abstract base suppression analyzer that contains methods for parsing the suppression xml file.
     32   - 
      * Abstract base suppression analyzer that contains methods for parsing the
    -  33   - 
      * suppression xml file.
    -  34   
      *
    -  35   +  33   
      * @author Jeremy Long <jeremy.long@owasp.org>
    -  36   +  34   
      */
    -  37  2 
     public abstract class AbstractSuppressionAnalyzer extends AbstractAnalyzer {
    -  38   +  35  4 
     public abstract class AbstractSuppressionAnalyzer extends AbstractAnalyzer {
    +  36   
     
    -  39   +  37   
         //<editor-fold defaultstate="collapsed" desc="All standard implementation details of Analyzer">
    -  40   +  38   
         /**
    -  41   +  39   
          * Returns a list of file EXTENSIONS supported by this analyzer.
    -  42   +  40   
          *
    -  43   +  41   
          * @return a list of file EXTENSIONS supported by this analyzer.
    -  44   +  42   
          */
    -  45   +  43   
         public Set<String> getSupportedExtensions() {
    -  46  264 
             return null;
    +  44  528 
             return null;
    +  45   + 
         }
    +  46   + 
     
     47   - 
         }
    + 
         /**
     48   - 
     
    -  49   - 
         /**
    -  50   
          * Returns whether or not this analyzer can process the given extension.
    -  51   +  49   
          *
    -  52   +  50   
          * @param extension the file extension to test for support.
    +  51   + 
          * @return whether or not the specified file extension is supported by this analyzer.
    +  52   + 
          */
     53   - 
          * @return whether or not the specified file extension is supported by this
    + 
         @Override
     54   - 
          * analyzer.
    -  55   - 
          */
    -  56   - 
         @Override
    -  57   
         public boolean supportsExtension(String extension) {
    -  58  18 
             return true;
    -  59   +  55  36 
             return true;
    +  56   
         }
    -  60   +  57   
     
    -  61   +  58   
         //</editor-fold>
    -  62   +  59   
         /**
    -  63   +  60   
          * The initialize method loads the suppression XML file.
    -  64   +  61   
          *
    -  65   +  62   
          * @throws Exception thrown if there is an exception
    -  66   +  63   
          */
    -  67   +  64   
         @Override
    -  68   +  65   
         public void initialize() throws Exception {
    -  69  6 
             super.initialize();
    -  70  6 
             loadSuppressionData();
    -  71  6 
         }
    -  72   +  66  12 
             super.initialize();
    +  67  12 
             loadSuppressionData();
    +  68  12 
         }
    +  69   
         /**
    -  73   +  70   
          * The list of suppression rules
    -  74   +  71   
          */
    -  75   +  72   
         private List<SuppressionRule> rules;
    -  76   +  73   
     
    -  77   +  74   
         /**
    -  78   +  75   
          * Get the value of rules.
    -  79   +  76   
          *
    -  80   +  77   
          * @return the value of rules
    -  81   +  78   
          */
    -  82   +  79   
         public List<SuppressionRule> getRules() {
    -  83  18 
             return rules;
    -  84   +  80  36 
             return rules;
    +  81   
         }
    -  85   +  82   
     
    -  86   +  83   
         /**
    -  87   +  84   
          * Set the value of rules.
    -  88   +  85   
          *
    -  89   +  86   
          * @param rules new value of rules
    -  90   +  87   
          */
    -  91   +  88   
         public void setRules(List<SuppressionRule> rules) {
    -  92  0 
             this.rules = rules;
    -  93  0 
         }
    -  94   +  89  0 
             this.rules = rules;
    +  90  0 
         }
    +  91   
     
    -  95   +  92   
         /**
    -  96   +  93   
          * Loads the suppression rules file.
    -  97   +  94   
          *
    -  98   +  95   
          * @throws SuppressionParseException thrown if the XML cannot be parsed.
    -  99   +  96   
          */
    -  100   +  97   
         private void loadSuppressionData() throws SuppressionParseException {
    -  101  6 
             final File file = Settings.getFile(Settings.KEYS.SUPPRESSION_FILE);
    -  102  6 
             if (file != null) {
    -  103  0 
                 final SuppressionParser parser = new SuppressionParser();
    -  104   +  98  12 
             final File file = Settings.getFile(Settings.KEYS.SUPPRESSION_FILE);
    +  99  12 
             if (file != null) {
    +  100  0 
                 final SuppressionParser parser = new SuppressionParser();
    +  101   
                 try {
    -  105  0 
                     rules = parser.parseSuppressionRules(file);
    -  106  0 
                 } catch (SuppressionParseException ex) {
    -  107  0 
                     final String msg = String.format("Unable to parse suppression xml file '%s'", file.getPath());
    -  108  0 
                     Logger.getLogger(AbstractSuppressionAnalyzer.class.getName()).log(Level.WARNING, msg);
    -  109  0 
                     Logger.getLogger(AbstractSuppressionAnalyzer.class.getName()).log(Level.WARNING, ex.getMessage());
    -  110  0 
                     Logger.getLogger(AbstractSuppressionAnalyzer.class.getName()).log(Level.FINE, null, ex);
    -  111  0 
                     throw ex;
    -  112  0 
                 }
    -  113   +  102  0 
                     rules = parser.parseSuppressionRules(file);
    +  103  0 
                 } catch (SuppressionParseException ex) {
    +  104  0 
                     final String msg = String.format("Unable to parse suppression xml file '%s'", file.getPath());
    +  105  0 
                     Logger.getLogger(AbstractSuppressionAnalyzer.class.getName()).log(Level.WARNING, msg);
    +  106  0 
                     Logger.getLogger(AbstractSuppressionAnalyzer.class.getName()).log(Level.WARNING, ex.getMessage());
    +  107  0 
                     Logger.getLogger(AbstractSuppressionAnalyzer.class.getName()).log(Level.FINE, null, ex);
    +  108  0 
                     throw ex;
    +  109  0 
                 }
    +  110   
             }
    -  114  6 
         }
    -  115   +  111  12 
         }
    +  112   
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AnalysisException.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AnalysisException.html index 2de469771..f9bef835e 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AnalysisException.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AnalysisException.html @@ -24,127 +24,125 @@  3   
      *
     4   - 
      * Dependency-check-core is free software: you can redistribute it and/or modify it
    + 
      * Licensed under the Apache License, Version 2.0 (the "License");
     5   - 
      * under the terms of the GNU General Public License as published by the Free
    + 
      * you may not use this file except in compliance with the License.
     6   - 
      * Software Foundation, either version 3 of the License, or (at your option) any
    + 
      * You may obtain a copy of the License at
     7   - 
      * later version.
    + 
      *
     8   - 
      *
    + 
      *     http://www.apache.org/licenses/LICENSE-2.0
     9   - 
      * Dependency-check-core is distributed in the hope that it will be useful, but
    + 
      *
     10   - 
      * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
    + 
      * Unless required by applicable law or agreed to in writing, software
     11   - 
      * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
    + 
      * distributed under the License is distributed on an "AS IS" BASIS,
     12   - 
      * details.
    + 
      * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13   - 
      *
    + 
      * See the License for the specific language governing permissions and
     14   - 
      * You should have received a copy of the GNU General Public License along with
    + 
      * limitations under the License.
     15   - 
      * dependency-check-core. If not, see http://www.gnu.org/licenses/.
    + 
      *
     16   - 
      *
    -  17   
      * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
    +  17   + 
      */
     18   - 
      */
    -  19   
     package org.owasp.dependencycheck.analyzer;
    +  19   + 
     
     20   - 
     
    -  21   
     /**
    -  22   +  21   
      * An exception thrown when the analysis of a dependency fails.
    -  23   +  22   
      *
    -  24   +  23   
      * @author Jeremy Long <jeremy.long@owasp.org>
    -  25   +  24   
      */
    -  26   +  25   
     public class AnalysisException extends Exception {
    +  26   + 
     
     27   - 
     
    + 
         /**
     28   - 
         /**
    -  29   
          * The serial version UID for serialization.
    +  29   + 
          */
     30   - 
          */
    -  31   
         private static final long serialVersionUID = 1L;
    +  31   + 
     
     32   - 
     
    + 
         /**
     33   - 
         /**
    + 
          * Creates a new AnalysisException.
     34   - 
          * Creates a new AnalysisException.
    + 
          */
     35   - 
          */
    -  36   
         public AnalysisException() {
    -  37  0 
             super();
    -  38  0 
         }
    +  36  0 
             super();
    +  37  0 
         }
    +  38   + 
     
     39   - 
     
    + 
         /**
     40   - 
         /**
    + 
          * Creates a new AnalysisException.
     41   - 
          * Creates a new AnalysisException.
    + 
          *
     42   - 
          *
    + 
          * @param msg a message for the exception.
     43   - 
          * @param msg a message for the exception.
    + 
          */
     44   - 
          */
    -  45   
         public AnalysisException(String msg) {
    -  46  0 
             super(msg);
    -  47  0 
         }
    +  45  0 
             super(msg);
    +  46  0 
         }
    +  47   + 
     
     48   - 
     
    + 
         /**
     49   - 
         /**
    + 
          * Creates a new AnalysisException.
     50   - 
          * Creates a new AnalysisException.
    + 
          *
     51   - 
          *
    + 
          * @param ex the cause of the failure.
     52   - 
          * @param ex the cause of the failure.
    + 
          */
     53   - 
          */
    -  54   
         public AnalysisException(Throwable ex) {
    -  55  0 
             super(ex);
    -  56  0 
         }
    -  57   +  54  0 
             super(ex);
    +  55  0 
         }
    +  56   
     
    -  58   +  57   
         /**
    -  59   +  58   
          * Creates a new AnalysisException.
    -  60   +  59   
          *
    -  61   +  60   
          * @param msg a message for the exception.
    -  62   +  61   
          * @param ex the cause of the failure.
    -  63   +  62   
          */
    -  64   +  63   
         public AnalysisException(String msg, Throwable ex) {
    -  65  0 
             super(msg, ex);
    -  66  0 
         }
    -  67   +  64  0 
             super(msg, ex);
    +  65  0 
         }
    +  66   
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AnalysisPhase.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AnalysisPhase.html index d7d4f940e..c44422050 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AnalysisPhase.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AnalysisPhase.html @@ -24,119 +24,117 @@  3   
      *
     4   - 
      * Dependency-check-core is free software: you can redistribute it and/or modify it
    + 
      * Licensed under the Apache License, Version 2.0 (the "License");
     5   - 
      * under the terms of the GNU General Public License as published by the Free
    + 
      * you may not use this file except in compliance with the License.
     6   - 
      * Software Foundation, either version 3 of the License, or (at your option) any
    + 
      * You may obtain a copy of the License at
     7   - 
      * later version.
    + 
      *
     8   - 
      *
    + 
      *     http://www.apache.org/licenses/LICENSE-2.0
     9   - 
      * Dependency-check-core is distributed in the hope that it will be useful, but
    + 
      *
     10   - 
      * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
    + 
      * Unless required by applicable law or agreed to in writing, software
     11   - 
      * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
    + 
      * distributed under the License is distributed on an "AS IS" BASIS,
     12   - 
      * details.
    + 
      * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13   - 
      *
    + 
      * See the License for the specific language governing permissions and
     14   - 
      * You should have received a copy of the GNU General Public License along with
    + 
      * limitations under the License.
     15   - 
      * dependency-check-core. If not, see http://www.gnu.org/licenses/.
    + 
      *
     16   - 
      *
    -  17   
      * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
    +  17   + 
      */
     18   - 
      */
    -  19   
     package org.owasp.dependencycheck.analyzer;
    +  19   + 
     
     20   - 
     
    -  21   
     /**
    -  22   +  21   
      * An enumeration defining the phases of analysis.
    -  23   +  22   
      *
    -  24   +  23   
      * @author Jeremy Long <jeremy.long@owasp.org>
    -  25   +  24   
      */
    -  26  162 
     public enum AnalysisPhase {
    -  27   +  25  342 
     public enum AnalysisPhase {
    +  26   
     
    +  27   + 
         /**
     28   - 
         /**
    -  29   
          * Initialization phase.
    -  30   +  29   
          */
    -  31  1 
         INITIAL,
    +  30  2 
         INITIAL,
    +  31   + 
         /**
     32   - 
         /**
    -  33   
          * Information collection phase.
    -  34   +  33   
          */
    -  35  1 
         INFORMATION_COLLECTION,
    +  34  2 
         INFORMATION_COLLECTION,
    +  35   + 
         /**
     36   - 
         /**
    -  37   
          * Pre identifier analysis phase.
    -  38   +  37   
          */
    -  39  1 
         PRE_IDENTIFIER_ANALYSIS,
    +  38  2 
         PRE_IDENTIFIER_ANALYSIS,
    +  39   + 
         /**
     40   - 
         /**
    -  41   
          * Identifier analysis phase.
    -  42   +  41   
          */
    -  43  1 
         IDENTIFIER_ANALYSIS,
    +  42  2 
         IDENTIFIER_ANALYSIS,
    +  43   + 
         /**
     44   - 
         /**
    -  45   
          * Post identifier analysis phase.
    -  46   +  45   
          */
    -  47  1 
         POST_IDENTIFIER_ANALYSIS,
    +  46  2 
         POST_IDENTIFIER_ANALYSIS,
    +  47   + 
         /**
     48   - 
         /**
    -  49   
          * Pre finding analysis phase.
    -  50   +  49   
          */
    -  51  1 
         PRE_FINDING_ANALYSIS,
    +  50  2 
         PRE_FINDING_ANALYSIS,
    +  51   + 
         /**
     52   - 
         /**
    -  53   
          * Finding analysis phase.
    -  54   +  53   
          */
    -  55  1 
         FINDING_ANALYSIS,
    +  54  2 
         FINDING_ANALYSIS,
    +  55   + 
         /**
     56   - 
         /**
    -  57   
          * Post analysis phase.
    -  58   +  57   
          */
    -  59  1 
         POST_FINDING_ANALYSIS,
    -  60   +  58  2 
         POST_FINDING_ANALYSIS,
    +  59   
         /**
    -  61   +  60   
          * The final analysis phase.
    -  62   +  61   
          */
    -  63  1 
         FINAL
    -  64   +  62  2 
         FINAL
    +  63   
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.Analyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.Analyzer.html index 50c6fdcaa..934f0b760 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.Analyzer.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.Analyzer.html @@ -24,205 +24,191 @@  3   
      *
     4   - 
      * Dependency-check-core is free software: you can redistribute it and/or modify it
    + 
      * Licensed under the Apache License, Version 2.0 (the "License");
     5   - 
      * under the terms of the GNU General Public License as published by the Free
    + 
      * you may not use this file except in compliance with the License.
     6   - 
      * Software Foundation, either version 3 of the License, or (at your option) any
    + 
      * You may obtain a copy of the License at
     7   - 
      * later version.
    + 
      *
     8   - 
      *
    + 
      *     http://www.apache.org/licenses/LICENSE-2.0
     9   - 
      * Dependency-check-core is distributed in the hope that it will be useful, but
    + 
      *
     10   - 
      * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
    + 
      * Unless required by applicable law or agreed to in writing, software
     11   - 
      * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
    + 
      * distributed under the License is distributed on an "AS IS" BASIS,
     12   - 
      * details.
    + 
      * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13   - 
      *
    + 
      * See the License for the specific language governing permissions and
     14   - 
      * You should have received a copy of the GNU General Public License along with
    + 
      * limitations under the License.
     15   - 
      * dependency-check-core. If not, see http://www.gnu.org/licenses/.
    + 
      *
     16   - 
      *
    -  17   
      * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
    +  17   + 
      */
     18   - 
      */
    -  19   
     package org.owasp.dependencycheck.analyzer;
    +  19   + 
     
     20   - 
     
    -  21   
     import java.util.Set;
    -  22   +  21   
     import org.owasp.dependencycheck.Engine;
    -  23   +  22   
     import org.owasp.dependencycheck.dependency.Dependency;
    +  23   + 
     
     24   - 
     
    -  25   
     /**
    +  25   + 
      * An interface that defines an Analyzer that is used to identify Dependencies. An analyzer will collect information
     26   - 
      * An interface that defines an Analyzer that is used to identify Dependencies.
    + 
      * about the dependency in the form of Evidence.
     27   - 
      * An analyzer will collect information about the dependency in the form of
    -  28   - 
      * Evidence.
    -  29   
      *
    -  30   +  28   
      * @author Jeremy Long <jeremy.long@owasp.org>
    -  31   +  29   
      */
    -  32   +  30   
     public interface Analyzer {
    +  31   + 
     
    +  32   + 
         /**
     33   - 
     
    + 
          * Analyzes the given dependency. The analysis could be anything from identifying an Identifier for the dependency,
     34   - 
         /**
    + 
          * to finding vulnerabilities, etc. Additionally, if the analyzer collects enough information to add a description
     35   - 
          * Analyzes the given dependency. The analysis could be anything from
    + 
          * or license information for the dependency it should be added.
     36   - 
          * identifying an Identifier for the dependency, to finding vulnerabilities,
    + 
          *
     37   - 
          * etc. Additionally, if the analyzer collects enough information to add a
    -  38   - 
          * description or license information for the dependency it should be added.
    -  39   - 
          *
    -  40   
          * @param dependency a dependency to analyze.
    +  38   + 
          * @param engine the engine that is scanning the dependencies - this is useful if we need to check other
    +  39   + 
          * dependencies
    +  40   + 
          * @throws AnalysisException is thrown if there is an error analyzing the dependency file
     41   - 
          * @param engine the engine that is scanning the dependencies - this is
    + 
          */
     42   - 
          * useful if we need to check other dependencies
    -  43   - 
          * @throws AnalysisException is thrown if there is an error analyzing the
    -  44   - 
          * dependency file
    -  45   - 
          */
    -  46   
         void analyze(Dependency dependency, Engine engine) throws AnalysisException;
    +  43   + 
     
    +  44   + 
         /**
    +  45   + 
          * <p>
    +  46   + 
          * Returns a list of supported file extensions. An example would be an analyzer that inspected java jar files. The
     47   - 
     
    + 
          * getSupportedExtensions function would return a set with a single element "jar".</p>
     48   - 
         /**
    + 
          *
     49   - 
          * <p>Returns a list of supported file extensions. An example would be an
    + 
          * <p>
     50   - 
          * analyzer that inspected java jar files. The getSupportedExtensions
    + 
          * <b>Note:</b> when implementing this the extensions returned MUST be lowercase.</p>
     51   - 
          * function would return a set with a single element "jar".</p>
    + 
          *
     52   - 
          *
    -  53   - 
          * <p><b>Note:</b> when implementing this the extensions returned MUST be
    -  54   - 
          * lowercase.</p>
    -  55   - 
          *
    -  56   
          * @return The file extensions supported by this analyzer.
    +  53   + 
          *
    +  54   + 
          * <p>
    +  55   + 
          * If the analyzer returns null it will not cause additional files to be analyzed but will be executed against every
    +  56   + 
          * file loaded</p>
     57   - 
          *
    + 
          */
     58   - 
          * <p>If the analyzer returns null it will not cause additional files to be
    -  59   - 
          * analyzed but will be executed against every file loaded</p>
    -  60   - 
          */
    -  61   
         Set<String> getSupportedExtensions();
    -  62   +  59   
     
    -  63   +  60   
         /**
    -  64   +  61   
          * Returns the name of the analyzer.
    -  65   +  62   
          *
    -  66   +  63   
          * @return the name of the analyzer.
    -  67   +  64   
          */
    -  68   +  65   
         String getName();
    -  69   +  66   
     
    -  70   +  67   
         /**
    -  71   +  68   
          * Returns whether or not this analyzer can process the given extension.
    -  72   +  69   
          *
    -  73   +  70   
          * @param extension the file extension to test for support.
    -  74   - 
          * @return whether or not the specified file extension is supported by this
    -  75   - 
          * analyzer.
    -  76   +  71   + 
          * @return whether or not the specified file extension is supported by this analyzer.
    +  72   
          */
    -  77   +  73   
         boolean supportsExtension(String extension);
    -  78   +  74   
     
    -  79   +  75   
         /**
    -  80   +  76   
          * Returns the phase that the analyzer is intended to run in.
    -  81   +  77   
          *
    -  82   +  78   
          * @return the phase that the analyzer is intended to run in.
    -  83   +  79   
          */
    -  84   +  80   
         AnalysisPhase getAnalysisPhase();
    +  81   + 
     
    +  82   + 
         /**
    +  83   + 
          * The initialize method is called (once) prior to the analyze method being called on all of the dependencies.
    +  84   + 
          *
     85   - 
     
    + 
          * @throws Exception is thrown if an exception occurs initializing the analyzer.
     86   - 
         /**
    + 
          */
     87   - 
          * The initialize method is called (once) prior to the analyze method being
    -  88   - 
          * called on all of the dependencies.
    -  89   - 
          *
    -  90   - 
          * @throws Exception is thrown if an exception occurs initializing the
    -  91   - 
          * analyzer.
    -  92   - 
          */
    -  93   
         void initialize() throws Exception;
    -  94   +  88   
     
    -  95   +  89   
         /**
    -  96   - 
          * The close method is called after all of the dependencies have been
    -  97   - 
          * analyzed.
    -  98   +  90   + 
          * The close method is called after all of the dependencies have been analyzed.
    +  91   
          *
    -  99   +  92   
          * @throws Exception is thrown if an exception occurs closing the analyzer.
    -  100   +  93   
          */
    -  101   +  94   
         void close() throws Exception;
    -  102   +  95   
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AnalyzerService.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AnalyzerService.html index 1010a97d1..b1fceb125 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AnalyzerService.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.AnalyzerService.html @@ -24,126 +24,124 @@  3   
      *
     4   - 
      * Dependency-check-core is free software: you can redistribute it and/or modify it
    + 
      * Licensed under the Apache License, Version 2.0 (the "License");
     5   - 
      * under the terms of the GNU General Public License as published by the Free
    + 
      * you may not use this file except in compliance with the License.
     6   - 
      * Software Foundation, either version 3 of the License, or (at your option) any
    + 
      * You may obtain a copy of the License at
     7   - 
      * later version.
    + 
      *
     8   - 
      *
    + 
      *     http://www.apache.org/licenses/LICENSE-2.0
     9   - 
      * Dependency-check-core is distributed in the hope that it will be useful, but
    + 
      *
     10   - 
      * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
    + 
      * Unless required by applicable law or agreed to in writing, software
     11   - 
      * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
    + 
      * distributed under the License is distributed on an "AS IS" BASIS,
     12   - 
      * details.
    + 
      * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13   - 
      *
    + 
      * See the License for the specific language governing permissions and
     14   - 
      * You should have received a copy of the GNU General Public License along with
    + 
      * limitations under the License.
     15   - 
      * dependency-check-core. If not, see http://www.gnu.org/licenses/.
    + 
      *
     16   - 
      *
    -  17   
      * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
    +  17   + 
      */
     18   - 
      */
    -  19   
     package org.owasp.dependencycheck.analyzer;
    +  19   + 
     
     20   - 
     
    -  21   
     import java.util.Iterator;
    -  22   +  21   
     import java.util.ServiceLoader;
    +  22   + 
     
     23   - 
     
    -  24   
     /**
    -  25   +  24   
      *
    -  26   +  25   
      * @author Jeremy Long <jeremy.long@owasp.org>
    -  27   +  26   
      */
    -  28   +  27   
     public final class AnalyzerService {
    +  28   + 
     
     29   - 
     
    + 
         /**
     30   - 
         /**
    -  31   
          * The analyzer service singleton.
    +  31   + 
          */
     32   - 
          */
    -  33   
         private static AnalyzerService service;
    +  33   + 
         /**
     34   - 
         /**
    -  35   
          * The service loader for analyzers.
    +  35   + 
          */
     36   - 
          */
    -  37   
         private final ServiceLoader<Analyzer> loader;
    +  37   + 
     
     38   - 
     
    + 
         /**
     39   - 
         /**
    -  40   
          * Creates a new instance of AnalyzerService.
    -  41   +  40   
          */
    -  42  1 
         private AnalyzerService() {
    -  43  1 
             loader = ServiceLoader.load(Analyzer.class);
    -  44  1 
         }
    +  41  2 
         private AnalyzerService() {
    +  42  2 
             loader = ServiceLoader.load(Analyzer.class);
    +  43  2 
         }
    +  44   + 
     
     45   - 
     
    + 
         /**
     46   - 
         /**
    -  47   
          * Retrieve the singleton instance of AnalyzerService.
    +  47   + 
          *
     48   - 
          *
    -  49   
          * @return a singleton AnalyzerService.
    +  49   + 
          */
     50   - 
          */
    -  51   
         public static synchronized AnalyzerService getInstance() {
    -  52  7 
             if (service == null) {
    -  53  1 
                 service = new AnalyzerService();
    -  54   +  51  14 
             if (service == null) {
    +  52  2 
                 service = new AnalyzerService();
    +  53   
             }
    -  55  7 
             return service;
    +  54  14 
             return service;
    +  55   + 
         }
     56   - 
         }
    -  57   
     
    -  58   +  57   
         /**
    -  59   +  58   
          * Returns an Iterator for all instances of the Analyzer interface.
    -  60   +  59   
          *
    -  61   +  60   
          * @return an iterator of Analyzers.
    -  62   +  61   
          */
    -  63   +  62   
         public Iterator<Analyzer> getAnalyzers() {
    -  64  7 
             return loader.iterator();
    -  65   +  63  14 
             return loader.iterator();
    +  64   
         }
    -  66   +  65   
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.ArchiveAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.ArchiveAnalyzer.html index 849410bc7..1d1aaa2be 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.ArchiveAnalyzer.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.ArchiveAnalyzer.html @@ -12,7 +12,7 @@
     
    - +
    Classes in this File Line Coverage Branch Coverage Complexity
    ArchiveAnalyzer
    65%
    98/150
    69%
    43/62
    		6.273
    ArchiveAnalyzer
    65%
    101/155
    69%
    46/66
    		6.545
     
    @@ -24,104 +24,104 @@  3   
      *
     4   - 
      * Dependency-check-core is free software: you can redistribute it and/or modify it
    + 
      * Licensed under the Apache License, Version 2.0 (the "License");
     5   - 
      * under the terms of the GNU General Public License as published by the Free
    + 
      * you may not use this file except in compliance with the License.
     6   - 
      * Software Foundation, either version 3 of the License, or (at your option) any
    + 
      * You may obtain a copy of the License at
     7   - 
      * later version.
    + 
      *
     8   - 
      *
    + 
      *     http://www.apache.org/licenses/LICENSE-2.0
     9   - 
      * Dependency-check-core is distributed in the hope that it will be useful, but
    + 
      *
     10   - 
      * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
    + 
      * Unless required by applicable law or agreed to in writing, software
     11   - 
      * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
    + 
      * distributed under the License is distributed on an "AS IS" BASIS,
     12   - 
      * details.
    + 
      * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13   - 
      *
    + 
      * See the License for the specific language governing permissions and
     14   - 
      * You should have received a copy of the GNU General Public License along with
    + 
      * limitations under the License.
     15   - 
      * dependency-check-core. If not, see http://www.gnu.org/licenses/.
    -  16   
      *
    -  17   +  16   
      * Copyright (c) 2013 Jeremy Long. All Rights Reserved.
    -  18   +  17   
      */
    -  19   +  18   
     package org.owasp.dependencycheck.analyzer;
    +  19   + 
     
     20   - 
     
    -  21   
     import java.io.BufferedInputStream;
    -  22   +  21   
     import java.io.BufferedOutputStream;
    -  23   +  22   
     import java.io.File;
    -  24   +  23   
     import java.io.FileInputStream;
    -  25   +  24   
     import java.io.FileNotFoundException;
    -  26   +  25   
     import java.io.FileOutputStream;
    -  27   +  26   
     import java.io.IOException;
    -  28   +  27   
     import java.util.ArrayList;
    -  29   +  28   
     import java.util.Collections;
    -  30   +  29   
     import java.util.HashSet;
    -  31   +  30   
     import java.util.List;
    -  32   +  31   
     import java.util.Set;
    -  33   +  32   
     import java.util.logging.Level;
    -  34   +  33   
     import java.util.logging.Logger;
    -  35   +  34   
     import org.apache.commons.compress.archivers.ArchiveEntry;
    -  36   +  35   
     import org.apache.commons.compress.archivers.ArchiveInputStream;
    -  37   +  36   
     import org.apache.commons.compress.archivers.tar.TarArchiveInputStream;
    -  38   +  37   
     import org.apache.commons.compress.archivers.zip.ZipArchiveInputStream;
    -  39   +  38   
     import org.apache.commons.compress.compressors.CompressorInputStream;
    -  40   +  39   
     import org.apache.commons.compress.compressors.gzip.GzipCompressorInputStream;
    -  41   +  40   
     import org.apache.commons.compress.compressors.gzip.GzipUtils;
    -  42   +  41   
     import org.h2.store.fs.FileUtils;
    -  43   +  42   
     import org.owasp.dependencycheck.Engine;
    -  44   +  43   
     import org.owasp.dependencycheck.dependency.Dependency;
    -  45   +  44   
     import org.owasp.dependencycheck.utils.Settings;
    -  46   +  45   
     
    -  47   +  46   
     /**
    +  47   + 
      * <p>
     48   - 
      * <p>An analyzer that extracts files from archives and ensures any supported
    + 
      * An analyzer that extracts files from archives and ensures any supported files contained within the archive are added
     49   - 
      * files contained within the archive are added to the dependency list.</p>
    + 
      * to the dependency list.</p>
     50   
      *
     51   
      * @author Jeremy Long <jeremy.long@owasp.org>
     52   
      */
    -  53  11 
     public class ArchiveAnalyzer extends AbstractAnalyzer implements Analyzer {
    +  53  22 
     public class ArchiveAnalyzer extends AbstractAnalyzer implements Analyzer {
     54   
     
     55   @@ -135,532 +135,523 @@  59   
         /**
     60   - 
          * The count of directories created during analysis. This is used for
    + 
          * The count of directories created during analysis. This is used for creating temporary directories.
     61   - 
          * creating temporary directories.
    -  62   
          */
    -  63  1 
         private static int dirCount = 0;
    +  62  2 
         private static int dirCount = 0;
    +  63   + 
         /**
     64   - 
         /**
    -  65   
          * The parent directory for the individual directories per archive.
    -  66   +  65   
          */
    -  67  11 
         private File tempFileLocation = null;
    +  66  22 
         private File tempFileLocation = null;
    +  67   + 
         /**
     68   - 
         /**
    + 
          * The max scan depth that the analyzer will recursively extract nested archives.
     69   - 
          * The max scan depth that the analyzer will recursively extract nested
    -  70   - 
          * archives.
    + 
          */
    +  70  2 
         private static final int MAX_SCAN_DEPTH = Settings.getInt("archive.scan.depth", 3);
     71   - 
          */
    -  72  1 
         private static final int MAX_SCAN_DEPTH = Settings.getInt("archive.scan.depth", 3);
    -  73   
         /**
    -  74   +  72   
          * Tracks the current scan/extraction depth for nested archives.
    +  73   + 
          */
    +  74  22 
         private int scanDepth = 0;
     75   - 
          */
    -  76  11 
         private int scanDepth = 0;
    -  77   
         //<editor-fold defaultstate="collapsed" desc="All standard implementation details of Analyzer">
    -  78   +  76   
         /**
    -  79   +  77   
          * The name of the analyzer.
    -  80   +  78   
          */
    -  81   +  79   
         private static final String ANALYZER_NAME = "Archive Analyzer";
    -  82   +  80   
         /**
    -  83   +  81   
          * The phase that this analyzer is intended to run in.
    +  82   + 
          */
    +  83  2 
         private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.INITIAL;
     84   - 
          */
    -  85  1 
         private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.INITIAL;
    -  86   
         /**
    -  87   +  85   
          * The set of file extensions supported by this analyzer.
    +  86   + 
          */
    +  87  2 
         private static final Set<String> EXTENSIONS = newHashSet("zip", "ear", "war", "tar", "gz", "tgz");
     88   - 
          */
    -  89  1 
         private static final Set<String> EXTENSIONS = newHashSet("zip", "ear", "war", "tar", "gz", "tgz");
    + 
     
    +  89   + 
         /**
     90   - 
     
    -  91   - 
         /**
    -  92   
          * Returns a list of file EXTENSIONS supported by this analyzer.
    -  93   +  91   
          *
    -  94   +  92   
          * @return a list of file EXTENSIONS supported by this analyzer.
    -  95   +  93   
          */
    -  96   +  94   
         public Set<String> getSupportedExtensions() {
    -  97  149 
             return EXTENSIONS;
    +  95  316 
             return EXTENSIONS;
    +  96   + 
         }
    +  97   + 
     
     98   - 
         }
    + 
         /**
     99   - 
     
    -  100   - 
         /**
    -  101   
          * Returns the name of the analyzer.
    -  102   +  100   
          *
    -  103   +  101   
          * @return the name of the analyzer.
    -  104   +  102   
          */
    -  105   +  103   
         public String getName() {
    -  106  10 
             return ANALYZER_NAME;
    +  104  20 
             return ANALYZER_NAME;
    +  105   + 
         }
    +  106   + 
     
     107   - 
         }
    + 
         /**
     108   - 
     
    -  109   - 
         /**
    -  110   
          * Returns whether or not this analyzer can process the given extension.
    -  111   +  109   
          *
    -  112   +  110   
          * @param extension the file extension to test for support.
    +  111   + 
          * @return whether or not the specified file extension is supported by this analyzer.
    +  112   + 
          */
     113   - 
          * @return whether or not the specified file extension is supported by this
    -  114   - 
          * analyzer.
    -  115   - 
          */
    -  116   
         public boolean supportsExtension(String extension) {
    -  117  154 
             return EXTENSIONS.contains(extension);
    +  114  344 
             return EXTENSIONS.contains(extension);
    +  115   + 
         }
    +  116   + 
     
    +  117   + 
         /**
     118   - 
         }
    -  119   - 
     
    -  120   - 
         /**
    -  121   
          * Returns the phase that the analyzer is intended to run in.
    -  122   +  119   
          *
    -  123   +  120   
          * @return the phase that the analyzer is intended to run in.
    -  124   +  121   
          */
    -  125   +  122   
         public AnalysisPhase getAnalysisPhase() {
    -  126  7 
             return ANALYSIS_PHASE;
    -  127   +  123  14 
             return ANALYSIS_PHASE;
    +  124   
         }
    -  128   +  125   
         //</editor-fold>
    -  129   +  126   
     
    -  130   +  127   
         /**
    -  131   +  128   
          * The initialize method does nothing for this Analyzer.
    -  132   +  129   
          *
    -  133   - 
          * @throws Exception is thrown if there is an exception deleting or creating
    -  134   - 
          * temporary files
    -  135   +  130   + 
          * @throws Exception is thrown if there is an exception deleting or creating temporary files
    +  131   
          */
    -  136   +  132   
         @Override
    -  137   +  133   
         public void initialize() throws Exception {
    -  138  9 
             final File baseDir = Settings.getTempDirectory();
    -  139  9 
             if (!baseDir.exists()) {
    -  140  0 
                 if (!baseDir.mkdirs()) {
    -  141  0 
                     final String msg = String.format("Unable to make a temporary folder '%s'", baseDir.getPath());
    -  142  0 
                     throw new AnalysisException(msg);
    -  143   +  134  18 
             final File baseDir = Settings.getTempDirectory();
    +  135  18 
             if (!baseDir.exists()) {
    +  136  0 
                 if (!baseDir.mkdirs()) {
    +  137  0 
                     final String msg = String.format("Unable to make a temporary folder '%s'", baseDir.getPath());
    +  138  0 
                     throw new AnalysisException(msg);
    +  139   
                 }
    -  144   +  140   
             }
    -  145  9 
             tempFileLocation = File.createTempFile("check", "tmp", baseDir);
    -  146  9 
             if (!tempFileLocation.delete()) {
    -  147  0 
                 final String msg = String.format("Unable to delete temporary file '%s'.", tempFileLocation.getAbsolutePath());
    +  141  18 
             tempFileLocation = File.createTempFile("check", "tmp", baseDir);
    +  142  18 
             if (!tempFileLocation.delete()) {
    +  143  0 
                 final String msg = String.format("Unable to delete temporary file '%s'.", tempFileLocation.getAbsolutePath());
    +  144  0 
                 throw new AnalysisException(msg);
    +  145   + 
             }
    +  146  18 
             if (!tempFileLocation.mkdirs()) {
    +  147  0 
                 final String msg = String.format("Unable to create directory '%s'.", tempFileLocation.getAbsolutePath());
     148  0 
                 throw new AnalysisException(msg);
     149   
             }
    -  150  9 
             if (!tempFileLocation.mkdirs()) {
    -  151  0 
                 final String msg = String.format("Unable to create directory '%s'.", tempFileLocation.getAbsolutePath());
    -  152  0 
                 throw new AnalysisException(msg);
    +  150  18 
         }
    +  151   + 
     
    +  152   + 
         /**
     153   - 
             }
    -  154  9 
         }
    -  155   - 
     
    -  156   - 
         /**
    -  157   
          * The close method does nothing for this Analyzer.
    +  154   + 
          *
    +  155   + 
          * @throws Exception thrown if there is an exception deleting temporary files
    +  156   + 
          */
    +  157   + 
         @Override
     158   - 
          *
    -  159   - 
          * @throws Exception thrown if there is an exception deleting temporary
    -  160   - 
          * files
    -  161   - 
          */
    -  162   - 
         @Override
    -  163   
         public void close() throws Exception {
    -  164  9 
             if (tempFileLocation != null && tempFileLocation.exists()) {
    -  165  9 
                 FileUtils.deleteRecursive(tempFileLocation.getAbsolutePath(), true);
    +  159  18 
             if (tempFileLocation != null && tempFileLocation.exists()) {
    +  160  18 
                 FileUtils.deleteRecursive(tempFileLocation.getAbsolutePath(), true);
    +  161   + 
             }
    +  162  18 
         }
    +  163   + 
     
    +  164   + 
         /**
    +  165   + 
          * Analyzes a given dependency. If the dependency is an archive, such as a WAR or EAR, the contents are extracted,
     166   - 
             }
    -  167  9 
         }
    + 
          * scanned, and added to the list of dependencies within the engine.
    +  167   + 
          *
     168   - 
     
    -  169   - 
         /**
    -  170   - 
          * Analyzes a given dependency. If the dependency is an archive, such as a
    -  171   - 
          * WAR or EAR, the contents are extracted, scanned, and added to the list of
    -  172   - 
          * dependencies within the engine.
    -  173   - 
          *
    -  174   
          * @param dependency the dependency to analyze
    -  175   +  169   
          * @param engine the engine scanning
    -  176   +  170   
          * @throws AnalysisException thrown if there is an analysis exception
    -  177   +  171   
          */
    -  178   +  172   
         @Override
    -  179   +  173   
         public void analyze(Dependency dependency, Engine engine) throws AnalysisException {
    -  180  8 
             final File f = new File(dependency.getActualFilePath());
    -  181  8 
             final File tmpDir = getNextTempDirectory();
    -  182  8 
             extractFiles(f, tmpDir, engine);
    -  183   +  174  16 
             final File f = new File(dependency.getActualFilePath());
    +  175  16 
             final File tmpDir = getNextTempDirectory();
    +  176  16 
             extractFiles(f, tmpDir, engine);
    +  177   
     
    -  184   +  178   
             //make a copy
    -  185  8 
             final List<Dependency> dependencies = new ArrayList<Dependency>(engine.getDependencies());
    -  186  8 
             engine.scan(tmpDir);
    -  187  8 
             final List<Dependency> newDependencies = engine.getDependencies();
    -  188  8 
             if (dependencies.size() != newDependencies.size()) {
    -  189   +  179  16 
             final List<Dependency> dependencies = new ArrayList<Dependency>(engine.getDependencies());
    +  180  16 
             engine.scan(tmpDir);
    +  181  16 
             final List<Dependency> newDependencies = engine.getDependencies();
    +  182  16 
             if (dependencies.size() != newDependencies.size()) {
    +  183   
                 //get the new dependencies
    -  190  6 
                 final Set<Dependency> dependencySet = new HashSet<Dependency>();
    -  191  6 
                 dependencySet.addAll(newDependencies);
    -  192  6 
                 dependencySet.removeAll(dependencies);
    -  193   +  184  12 
                 final Set<Dependency> dependencySet = new HashSet<Dependency>();
    +  185  12 
                 dependencySet.addAll(newDependencies);
    +  186  12 
                 dependencySet.removeAll(dependencies);
    +  187   
     
    -  194  6 
                 for (Dependency d : dependencySet) {
    -  195   +  188  12 
                 for (Dependency d : dependencySet) {
    +  189   
                     //fix the dependency's display name and path
    -  196  10 
                     final String displayPath = String.format("%s%s",
    -  197   +  190  38 
                     final String displayPath = String.format("%s%s",
    +  191   
                             dependency.getFilePath(),
    -  198   +  192   
                             d.getActualFilePath().substring(tmpDir.getAbsolutePath().length()));
    -  199  10 
                     final String displayName = String.format("%s%s%s",
    -  200   +  193  38 
                     final String displayName = String.format("%s%s%s",
    +  194   
                             dependency.getFileName(),
    -  201   +  195   
                             File.separator,
    -  202   +  196   
                             d.getFileName());
    -  203  10 
                     d.setFilePath(displayPath);
    -  204  10 
                     d.setFileName(displayName);
    -  205   +  197  38 
                     d.setFilePath(displayPath);
    +  198  38 
                     d.setFileName(displayName);
    +  199   
     
    -  206   +  200   
                     //TODO - can we get more evidence from the parent? EAR contains module name, etc.
    -  207   - 
     
    -  208   +  201   
                     //analyze the dependency (i.e. extract files) if it is a supported type.
    -  209  10 
                     if (this.supportsExtension(d.getFileExtension()) && scanDepth < MAX_SCAN_DEPTH) {
    -  210  3 
                         scanDepth += 1;
    -  211  3 
                         analyze(d, engine);
    -  212  3 
                         scanDepth -= 1;
    -  213   +  202  38 
                     if (this.supportsExtension(d.getFileExtension()) && scanDepth < MAX_SCAN_DEPTH) {
    +  203  6 
                         scanDepth += 1;
    +  204  6 
                         analyze(d, engine);
    +  205  6 
                         scanDepth -= 1;
    +  206   
                     }
    -  214  10 
                 }
    -  215   +  207  38 
                 }
    +  208   
             }
    -  216  8 
             Collections.sort(engine.getDependencies());
    -  217  8 
         }
    -  218   +  209  16 
             Collections.sort(engine.getDependencies());
    +  210  16 
         }
    +  211   
     
    -  219   +  212   
         /**
    -  220   +  213   
          * Retrieves the next temporary directory to extract an archive too.
    -  221   +  214   
          *
    -  222   +  215   
          * @return a directory
    -  223   +  216   
          * @throws AnalysisException thrown if unable to create temporary directory
    -  224   +  217   
          */
    -  225   +  218   
         private File getNextTempDirectory() throws AnalysisException {
    -  226  8 
             dirCount += 1;
    -  227  8 
             final File directory = new File(tempFileLocation, String.valueOf(dirCount));
    -  228   +  219  16 
             dirCount += 1;
    +  220  16 
             final File directory = new File(tempFileLocation, String.valueOf(dirCount));
    +  221   
             //getting an exception for some directories not being able to be created; might be because the directory already exists?
    -  229  8 
             if (directory.exists()) {
    -  230  0 
                 return getNextTempDirectory();
    -  231   +  222  16 
             if (directory.exists()) {
    +  223  0 
                 return getNextTempDirectory();
    +  224   
             }
    -  232  8 
             if (!directory.mkdirs()) {
    -  233  0 
                 final String msg = String.format("Unable to create temp directory '%s'.", directory.getAbsolutePath());
    -  234  0 
                 throw new AnalysisException(msg);
    -  235   +  225  16 
             if (!directory.mkdirs()) {
    +  226  0 
                 final String msg = String.format("Unable to create temp directory '%s'.", directory.getAbsolutePath());
    +  227  0 
                 throw new AnalysisException(msg);
    +  228   
             }
    -  236  8 
             return directory;
    -  237   +  229  16 
             return directory;
    +  230   
         }
    -  238   +  231   
     
    -  239   +  232   
         /**
    -  240   +  233   
          * Extracts the contents of an archive into the specified directory.
    -  241   +  234   
          *
    -  242   +  235   
          * @param archive an archive file such as a WAR or EAR
    -  243   +  236   
          * @param destination a directory to extract the contents to
    -  244   +  237   
          * @param engine the scanning engine
    -  245   +  238   
          * @throws AnalysisException thrown if the archive is not found
    -  246   +  239   
          */
    -  247   +  240   
         private void extractFiles(File archive, File destination, Engine engine) throws AnalysisException {
    -  248  8 
             if (archive == null || destination == null) {
    -  249  0 
                 return;
    -  250   +  241  16 
             if (archive == null || destination == null) {
    +  242  0 
                 return;
    +  243   
             }
    -  251   +  244   
     
    -  252  8 
             FileInputStream fis = null;
    +  245  16 
             FileInputStream fis = null;
    +  246   + 
             try {
    +  247  16 
                 fis = new FileInputStream(archive);
    +  248  0 
             } catch (FileNotFoundException ex) {
    +  249  0 
                 Logger.getLogger(ArchiveAnalyzer.class.getName()).log(Level.INFO, null, ex);
    +  250  0 
                 throw new AnalysisException("Archive file was not found.", ex);
    +  251  16 
             }
    +  252  16 
             final String archiveExt = org.owasp.dependencycheck.utils.FileUtils.getFileExtension(archive.getName()).toLowerCase();
     253   
             try {
    -  254  8 
                 fis = new FileInputStream(archive);
    -  255  0 
             } catch (FileNotFoundException ex) {
    -  256  0 
                 Logger.getLogger(ArchiveAnalyzer.class.getName()).log(Level.INFO, null, ex);
    -  257  0 
                 throw new AnalysisException("Archive file was not found.", ex);
    -  258  8 
             }
    -  259  8 
             final String archiveExt = org.owasp.dependencycheck.utils.FileUtils.getFileExtension(archive.getName()).toLowerCase();
    -  260   - 
             try {
    -  261  8 
                 if ("zip".equals(archiveExt) || "war".equals(archiveExt) || "ear".equals(archiveExt)) {
    -  262  3 
                     extractArchive(new ZipArchiveInputStream(new BufferedInputStream(fis)), destination, engine);
    -  263  5 
                 } else if ("tar".equals(archiveExt)) {
    -  264  3 
                     extractArchive(new TarArchiveInputStream(new BufferedInputStream(fis)), destination, engine);
    -  265  2 
                 } else if ("gz".equals(archiveExt) || "tgz".equals(archiveExt)) {
    -  266  2 
                     final String uncompressedName = GzipUtils.getUncompressedFilename(archive.getName());
    -  267  2 
                     final String uncompressedExt = org.owasp.dependencycheck.utils.FileUtils.getFileExtension(uncompressedName).toLowerCase();
    -  268  2 
                     if (engine.supportsExtension(uncompressedExt)) {
    -  269  2 
                         decompressFile(new GzipCompressorInputStream(new BufferedInputStream(fis)), new File(destination, uncompressedName));
    -  270   +  254  16 
                 if ("zip".equals(archiveExt) || "war".equals(archiveExt) || "ear".equals(archiveExt)) {
    +  255  6 
                     extractArchive(new ZipArchiveInputStream(new BufferedInputStream(fis)), destination, engine);
    +  256  10 
                 } else if ("tar".equals(archiveExt)) {
    +  257  6 
                     extractArchive(new TarArchiveInputStream(new BufferedInputStream(fis)), destination, engine);
    +  258  4 
                 } else if ("gz".equals(archiveExt) || "tgz".equals(archiveExt)) {
    +  259  4 
                     final String uncompressedName = GzipUtils.getUncompressedFilename(archive.getName());
    +  260  4 
                     final String uncompressedExt = org.owasp.dependencycheck.utils.FileUtils.getFileExtension(uncompressedName).toLowerCase();
    +  261  4 
                     if (engine.supportsExtension(uncompressedExt)) {
    +  262  4 
                         decompressFile(new GzipCompressorInputStream(new BufferedInputStream(fis)), new File(destination, uncompressedName));
    +  263   
                     }
    -  271   +  264   
                 }
    -  272  0 
             } catch (ArchiveExtractionException ex) {
    -  273  0 
                 final String msg = String.format("Exception extracting archive '%s'.", archive.getName());
    -  274  0 
                 Logger.getLogger(ArchiveAnalyzer.class.getName()).log(Level.WARNING, msg);
    -  275  0 
                 Logger.getLogger(ArchiveAnalyzer.class.getName()).log(Level.FINE, null, ex);
    -  276  0 
             } catch (IOException ex) {
    -  277  0 
                 final String msg = String.format("Exception reading archive '%s'.", archive.getName());
    -  278  0 
                 Logger.getLogger(ArchiveAnalyzer.class.getName()).log(Level.WARNING, msg);
    -  279  0 
                 Logger.getLogger(ArchiveAnalyzer.class.getName()).log(Level.FINE, null, ex);
    -  280   +  265  0 
             } catch (ArchiveExtractionException ex) {
    +  266  0 
                 final String msg = String.format("Exception extracting archive '%s'.", archive.getName());
    +  267  0 
                 Logger.getLogger(ArchiveAnalyzer.class.getName()).log(Level.WARNING, msg);
    +  268  0 
                 Logger.getLogger(ArchiveAnalyzer.class.getName()).log(Level.FINE, null, ex);
    +  269  0 
             } catch (IOException ex) {
    +  270  0 
                 final String msg = String.format("Exception reading archive '%s'.", archive.getName());
    +  271  0 
                 Logger.getLogger(ArchiveAnalyzer.class.getName()).log(Level.WARNING, msg);
    +  272  0 
                 Logger.getLogger(ArchiveAnalyzer.class.getName()).log(Level.FINE, null, ex);
    +  273   
             } finally {
    -  281  0 
                 try {
    -  282  8 
                     fis.close();
    -  283  0 
                 } catch (IOException ex) {
    -  284  0 
                     Logger.getLogger(ArchiveAnalyzer.class.getName()).log(Level.FINEST, null, ex);
    -  285  8 
                 }
    -  286  0 
             }
    -  287  8 
         }
    -  288   +  274  0 
                 try {
    +  275  16 
                     fis.close();
    +  276  0 
                 } catch (IOException ex) {
    +  277  0 
                     Logger.getLogger(ArchiveAnalyzer.class.getName()).log(Level.FINEST, null, ex);
    +  278  16 
                 }
    +  279  0 
             }
    +  280  16 
         }
    +  281   
     
    -  289   +  282   
         /**
    -  290   +  283   
          * Extracts files from an archive.
    -  291   +  284   
          *
    -  292   +  285   
          * @param input the archive to extract files from
    -  293   +  286   
          * @param destination the location to write the files too
    -  294   +  287   
          * @param engine the dependency-check engine
    -  295   - 
          * @throws ArchiveExtractionException thrown if there is an exception
    -  296   - 
          * extracting files from the archive
    -  297   +  288   + 
          * @throws ArchiveExtractionException thrown if there is an exception extracting files from the archive
    +  289   
          */
    -  298   +  290   
         private void extractArchive(ArchiveInputStream input, File destination, Engine engine) throws ArchiveExtractionException {
    -  299   +  291   
             ArchiveEntry entry;
    +  292   + 
             try {
    +  293  362 
                 while ((entry = input.getNextEntry()) != null) {
    +  294  350 
                     if (entry.isDirectory()) {
    +  295  50 
                         final File d = new File(destination, entry.getName());
    +  296  50 
                         if (!d.exists()) {
    +  297  50 
                             if (!d.mkdirs()) {
    +  298  0 
                                 final String msg = String.format("Unable to create directory '%s'.", d.getAbsolutePath());
    +  299  0 
                                 throw new AnalysisException(msg);
     300   - 
             try {
    -  301  172 
                 while ((entry = input.getNextEntry()) != null) {
    -  302  166 
                     if (entry.isDirectory()) {
    -  303  25 
                         final File d = new File(destination, entry.getName());
    -  304  25 
                         if (!d.exists()) {
    -  305  25 
                             if (!d.mkdirs()) {
    -  306  0 
                                 final String msg = String.format("Unable to create '%s'.", d.getAbsolutePath());
    -  307  0 
                                 throw new AnalysisException(msg);
    -  308   
                             }
    -  309   +  301   
                         }
    -  310  25 
                     } else {
    -  311  141 
                         final File file = new File(destination, entry.getName());
    -  312  141 
                         final String ext = org.owasp.dependencycheck.utils.FileUtils.getFileExtension(file.getName());
    -  313  141 
                         if (engine.supportsExtension(ext)) {
    -  314  8 
                             BufferedOutputStream bos = null;
    -  315   +  302  50 
                     } else {
    +  303  300 
                         final File file = new File(destination, entry.getName());
    +  304  300 
                         final String ext = org.owasp.dependencycheck.utils.FileUtils.getFileExtension(file.getName());
    +  305  300 
                         if (engine.supportsExtension(ext)) {
    +  306  34 
                             BufferedOutputStream bos = null;
    +  307   
                             FileOutputStream fos;
    -  316   +  308   
                             try {
    -  317  8 
                                 fos = new FileOutputStream(file);
    -  318  8 
                                 bos = new BufferedOutputStream(fos, BUFFER_SIZE);
    -  319   +  309  34 
                                 final File parent = file.getParentFile();
    +  310  34 
                                 if (!parent.isDirectory()) {
    +  311  2 
                                     if (!parent.mkdirs()) {
    +  312  0 
                                         final String msg = String.format("Unable to build directory '%s'.", parent.getAbsolutePath());
    +  313  0 
                                         throw new AnalysisException(msg);
    +  314   + 
                                     }
    +  315   + 
                                 }
    +  316  34 
                                 fos = new FileOutputStream(file);
    +  317  34 
                                 bos = new BufferedOutputStream(fos, BUFFER_SIZE);
    +  318   
                                 int count;
    -  320  8 
                                 final byte data[] = new byte[BUFFER_SIZE];
    -  321  1711 
                                 while ((count = input.read(data, 0, BUFFER_SIZE)) != -1) {
    -  322  1703 
                                     bos.write(data, 0, count);
    -  323   +  319  34 
                                 final byte data[] = new byte[BUFFER_SIZE];
    +  320  6734 
                                 while ((count = input.read(data, 0, BUFFER_SIZE)) != -1) {
    +  321  6700 
                                     bos.write(data, 0, count);
    +  322   
                                 }
    -  324  8 
                                 bos.flush();
    -  325  0 
                             } catch (FileNotFoundException ex) {
    -  326  0 
                                 Logger.getLogger(ArchiveAnalyzer.class
    -  327   +  323  34 
                                 bos.flush();
    +  324  0 
                             } catch (FileNotFoundException ex) {
    +  325  0 
                                 Logger.getLogger(ArchiveAnalyzer.class
    +  326   
                                         .getName()).log(Level.FINE, null, ex);
    -  328  0 
                                 final String msg = String.format("Unable to find file '%s'.", file.getName());
    -  329  0 
                                 throw new AnalysisException(msg, ex);
    -  330  0 
                             } catch (IOException ex) {
    -  331  0 
                                 Logger.getLogger(ArchiveAnalyzer.class
    -  332   +  327  0 
                                 final String msg = String.format("Unable to find file '%s'.", file.getName());
    +  328  0 
                                 throw new AnalysisException(msg, ex);
    +  329  0 
                             } catch (IOException ex) {
    +  330  0 
                                 Logger.getLogger(ArchiveAnalyzer.class
    +  331   
                                         .getName()).log(Level.FINE, null, ex);
    -  333  0 
                                 final String msg = String.format("IO Exception while parsing file '%s'.", file.getName());
    -  334  0 
                                 throw new AnalysisException(msg, ex);
    -  335   +  332  0 
                                 final String msg = String.format("IO Exception while parsing file '%s'.", file.getName());
    +  333  0 
                                 throw new AnalysisException(msg, ex);
    +  334   
                             } finally {
    -  336  8 
                                 if (bos != null) {
    -  337   +  335  34 
                                 if (bos != null) {
    +  336   
                                     try {
    -  338  8 
                                         bos.close();
    -  339  0 
                                     } catch (IOException ex) {
    -  340  0 
                                         Logger.getLogger(ArchiveAnalyzer.class
    -  341   +  337  34 
                                         bos.close();
    +  338  0 
                                     } catch (IOException ex) {
    +  339  0 
                                         Logger.getLogger(ArchiveAnalyzer.class
    +  340   
                                                 .getName()).log(Level.FINEST, null, ex);
    -  342  8 
                                     }
    -  343   +  341  34 
                                     }
    +  342   
                                 }
    -  344   +  343   
                             }
    -  345   +  344   
                         }
    -  346  141 
                     }
    -  347   +  345  300 
                     }
    +  346   
                 }
    -  348  0 
             } catch (IOException ex) {
    -  349  0 
                 throw new ArchiveExtractionException(ex);
    -  350  0 
             } catch (Throwable ex) {
    -  351  0 
                 throw new ArchiveExtractionException(ex);
    -  352   +  347  0 
             } catch (IOException ex) {
    +  348  0 
                 throw new ArchiveExtractionException(ex);
    +  349  0 
             } catch (Throwable ex) {
    +  350  0 
                 throw new ArchiveExtractionException(ex);
    +  351   
             } finally {
    -  353  6 
                 if (input != null) {
    -  354   +  352  12 
                 if (input != null) {
    +  353   
                     try {
    -  355  6 
                         input.close();
    -  356  0 
                     } catch (IOException ex) {
    -  357  0 
                         Logger.getLogger(ArchiveAnalyzer.class.getName()).log(Level.FINEST, null, ex);
    -  358  6 
                     }
    +  354  12 
                         input.close();
    +  355  0 
                     } catch (IOException ex) {
    +  356  0 
                         Logger.getLogger(ArchiveAnalyzer.class.getName()).log(Level.FINEST, null, ex);
    +  357  12 
                     }
    +  358   + 
                 }
     359   - 
                 }
    -  360   
             }
    -  361  6 
         }
    -  362   +  360  12 
         }
    +  361   
     
    -  363   +  362   
         /**
    -  364   +  363   
          * Decompresses a file.
    -  365   +  364   
          *
    -  366   +  365   
          * @param inputStream the compressed file
    -  367   +  366   
          * @param outputFile the location to write the decompressed file
    +  367   + 
          * @throws ArchiveExtractionException thrown if there is an exception decompressing the file
     368   - 
          * @throws ArchiveExtractionException thrown if there is an exception
    -  369   - 
          * decompressing the file
    -  370   
          */
    -  371   +  369   
         private void decompressFile(CompressorInputStream inputStream, File outputFile) throws ArchiveExtractionException {
    -  372  2 
             FileOutputStream out = null;
    -  373   +  370  4 
             FileOutputStream out = null;
    +  371   
             try {
    -  374  2 
                 out = new FileOutputStream(outputFile);
    -  375  2 
                 final byte[] buffer = new byte[BUFFER_SIZE];
    -  376  2 
                 int n = 0;
    -  377  272 
                 while (-1 != (n = inputStream.read(buffer))) {
    -  378  270 
                     out.write(buffer, 0, n);
    -  379   +  372  4 
                 out = new FileOutputStream(outputFile);
    +  373  4 
                 final byte[] buffer = new byte[BUFFER_SIZE];
    +  374  4 
                 int n = 0;
    +  375  544 
                 while (-1 != (n = inputStream.read(buffer))) {
    +  376  540 
                     out.write(buffer, 0, n);
    +  377   
                 }
    -  380  0 
             } catch (FileNotFoundException ex) {
    -  381  0 
                 Logger.getLogger(ArchiveAnalyzer.class.getName()).log(Level.FINE, null, ex);
    -  382  0 
                 throw new ArchiveExtractionException(ex);
    -  383  0 
             } catch (IOException ex) {
    -  384  0 
                 Logger.getLogger(ArchiveAnalyzer.class.getName()).log(Level.FINE, null, ex);
    -  385  0 
                 throw new ArchiveExtractionException(ex);
    -  386   +  378  0 
             } catch (FileNotFoundException ex) {
    +  379  0 
                 Logger.getLogger(ArchiveAnalyzer.class.getName()).log(Level.FINE, null, ex);
    +  380  0 
                 throw new ArchiveExtractionException(ex);
    +  381  0 
             } catch (IOException ex) {
    +  382  0 
                 Logger.getLogger(ArchiveAnalyzer.class.getName()).log(Level.FINE, null, ex);
    +  383  0 
                 throw new ArchiveExtractionException(ex);
    +  384   
             } finally {
    -  387  2 
                 if (out != null) {
    -  388   +  385  4 
                 if (out != null) {
    +  386   
                     try {
    -  389  2 
                         out.close();
    -  390  0 
                     } catch (IOException ex) {
    -  391  0 
                         Logger.getLogger(ArchiveAnalyzer.class.getName()).log(Level.FINEST, null, ex);
    -  392  2 
                     }
    -  393   +  387  4 
                         out.close();
    +  388  0 
                     } catch (IOException ex) {
    +  389  0 
                         Logger.getLogger(ArchiveAnalyzer.class.getName()).log(Level.FINEST, null, ex);
    +  390  4 
                     }
    +  391   
                 }
    -  394   +  392   
             }
    -  395  2 
         }
    -  396   +  393  4 
         }
    +  394   
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.ArchiveExtractionException.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.ArchiveExtractionException.html index cf25ffd17..1432add25 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.ArchiveExtractionException.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.ArchiveExtractionException.html @@ -24,127 +24,125 @@  3   
      *
     4   - 
      * Dependency-check-core is free software: you can redistribute it and/or modify it
    + 
      * Licensed under the Apache License, Version 2.0 (the "License");
     5   - 
      * under the terms of the GNU General Public License as published by the Free
    + 
      * you may not use this file except in compliance with the License.
     6   - 
      * Software Foundation, either version 3 of the License, or (at your option) any
    + 
      * You may obtain a copy of the License at
     7   - 
      * later version.
    + 
      *
     8   - 
      *
    + 
      *     http://www.apache.org/licenses/LICENSE-2.0
     9   - 
      * Dependency-check-core is distributed in the hope that it will be useful, but
    + 
      *
     10   - 
      * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
    + 
      * Unless required by applicable law or agreed to in writing, software
     11   - 
      * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
    + 
      * distributed under the License is distributed on an "AS IS" BASIS,
     12   - 
      * details.
    + 
      * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13   - 
      *
    + 
      * See the License for the specific language governing permissions and
     14   - 
      * You should have received a copy of the GNU General Public License along with
    + 
      * limitations under the License.
     15   - 
      * dependency-check-core. If not, see http://www.gnu.org/licenses/.
    + 
      *
     16   - 
      *
    -  17   
      * Copyright (c) 2013 Jeremy Long. All Rights Reserved.
    +  17   + 
      */
     18   - 
      */
    -  19   
     package org.owasp.dependencycheck.analyzer;
    +  19   + 
     
     20   - 
     
    -  21   
     /**
    -  22   +  21   
      * An exception thrown when files in an archive cannot be extracted.
    -  23   +  22   
      *
    -  24   +  23   
      * @author Jeremy Long <jeremy.long@owasp.org>
    -  25   +  24   
      */
    -  26   +  25   
     public class ArchiveExtractionException extends Exception {
    +  26   + 
     
     27   - 
     
    + 
         /**
     28   - 
         /**
    -  29   
          * The serial version UID for serialization.
    +  29   + 
          */
     30   - 
          */
    -  31   
         private static final long serialVersionUID = 1L;
    +  31   + 
     
     32   - 
     
    + 
         /**
     33   - 
         /**
    + 
          * Creates a new ArchiveExtractionException.
     34   - 
          * Creates a new ArchiveExtractionException.
    + 
          */
     35   - 
          */
    -  36   
         public ArchiveExtractionException() {
    -  37  0 
             super();
    -  38  0 
         }
    +  36  0 
             super();
    +  37  0 
         }
    +  38   + 
     
     39   - 
     
    + 
         /**
     40   - 
         /**
    + 
          * Creates a new ArchiveExtractionException.
     41   - 
          * Creates a new ArchiveExtractionException.
    + 
          *
     42   - 
          *
    + 
          * @param msg a message for the exception.
     43   - 
          * @param msg a message for the exception.
    + 
          */
     44   - 
          */
    -  45   
         public ArchiveExtractionException(String msg) {
    -  46  0 
             super(msg);
    -  47  0 
         }
    +  45  0 
             super(msg);
    +  46  0 
         }
    +  47   + 
     
     48   - 
     
    + 
         /**
     49   - 
         /**
    + 
          * Creates a new ArchiveExtractionException.
     50   - 
          * Creates a new ArchiveExtractionException.
    + 
          *
     51   - 
          *
    + 
          * @param ex the cause of the failure.
     52   - 
          * @param ex the cause of the failure.
    + 
          */
     53   - 
          */
    -  54   
         public ArchiveExtractionException(Throwable ex) {
    -  55  0 
             super(ex);
    -  56  0 
         }
    -  57   +  54  0 
             super(ex);
    +  55  0 
         }
    +  56   
     
    -  58   +  57   
         /**
    -  59   +  58   
          * Creates a new ArchiveExtractionException.
    -  60   +  59   
          *
    -  61   +  60   
          * @param msg a message for the exception.
    -  62   +  61   
          * @param ex the cause of the failure.
    -  63   +  62   
          */
    -  64   +  63   
         public ArchiveExtractionException(String msg, Throwable ex) {
    -  65  0 
             super(msg, ex);
    -  66  0 
         }
    -  67   +  64  0 
             super(msg, ex);
    +  65  0 
         }
    +  66   
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.CPEAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.CPEAnalyzer.html index 804c40282..1893f7656 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.CPEAnalyzer.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.CPEAnalyzer.html @@ -12,9 +12,9 @@
     
    - - - + + +
    Classes in this File Line Coverage Branch Coverage Complexity
    CPEAnalyzer
    91%
    176/193
    84%
    105/124
    		4.167
    CPEAnalyzer$IdentifierConfidence
    100%
    3/3
    N/A
    N/A
    		4.167
    CPEAnalyzer$IdentifierMatch
    38%
    15/39
    16%
    4/24
    		4.167
    CPEAnalyzer
    91%
    180/197
    84%
    107/126
    		4.2
    CPEAnalyzer$IdentifierConfidence
    100%
    3/3
    N/A
    N/A
    		4.2
    CPEAnalyzer$IdentifierMatch
    38%
    15/39
    16%
    4/24
    		4.2
     
    @@ -26,818 +26,816 @@  3   
      *
     4   - 
      * Dependency-check-core is free software: you can redistribute it and/or modify it
    + 
      * Licensed under the Apache License, Version 2.0 (the "License");
     5   - 
      * under the terms of the GNU General Public License as published by the Free
    + 
      * you may not use this file except in compliance with the License.
     6   - 
      * Software Foundation, either version 3 of the License, or (at your option) any
    + 
      * You may obtain a copy of the License at
     7   - 
      * later version.
    + 
      *
     8   - 
      *
    + 
      *     http://www.apache.org/licenses/LICENSE-2.0
     9   - 
      * Dependency-check-core is distributed in the hope that it will be useful, but
    + 
      *
     10   - 
      * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
    + 
      * Unless required by applicable law or agreed to in writing, software
     11   - 
      * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
    + 
      * distributed under the License is distributed on an "AS IS" BASIS,
     12   - 
      * details.
    + 
      * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13   - 
      *
    + 
      * See the License for the specific language governing permissions and
     14   - 
      * You should have received a copy of the GNU General Public License along with
    + 
      * limitations under the License.
     15   - 
      * dependency-check-core. If not, see http://www.gnu.org/licenses/.
    + 
      *
     16   - 
      *
    -  17   
      * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
    +  17   + 
      */
     18   - 
      */
    -  19   
     package org.owasp.dependencycheck.analyzer;
    +  19   + 
     
     20   - 
     
    -  21   
     import java.io.IOException;
    -  22   +  21   
     import java.io.UnsupportedEncodingException;
    -  23   +  22   
     import java.net.URLEncoder;
    -  24   +  23   
     import java.util.ArrayList;
    -  25   +  24   
     import java.util.Collections;
    -  26   +  25   
     import java.util.List;
    -  27   +  26   
     import java.util.Set;
    -  28   +  27   
     import java.util.StringTokenizer;
    -  29   +  28   
     import java.util.logging.Level;
    -  30   +  29   
     import java.util.logging.Logger;
    -  31   +  30   
     import org.apache.lucene.document.Document;
    -  32   +  31   
     import org.apache.lucene.index.CorruptIndexException;
    -  33   +  32   
     import org.apache.lucene.queryparser.classic.ParseException;
    -  34   +  33   
     import org.apache.lucene.search.ScoreDoc;
    -  35   +  34   
     import org.apache.lucene.search.TopDocs;
    -  36   +  35   
     import org.owasp.dependencycheck.Engine;
    -  37   - 
     import org.owasp.dependencycheck.data.lucene.LuceneUtils;
    -  38   - 
     import org.owasp.dependencycheck.dependency.Dependency;
    -  39   - 
     import org.owasp.dependencycheck.dependency.Evidence;
    -  40   - 
     import org.owasp.dependencycheck.dependency.Evidence.Confidence;
    -  41   - 
     import org.owasp.dependencycheck.dependency.EvidenceCollection;
    -  42   +  36   
     import org.owasp.dependencycheck.data.cpe.CpeMemoryIndex;
    -  43   +  37   
     import org.owasp.dependencycheck.data.cpe.Fields;
    -  44   +  38   
     import org.owasp.dependencycheck.data.cpe.IndexEntry;
    -  45   +  39   
     import org.owasp.dependencycheck.data.cpe.IndexException;
    -  46   +  40   + 
     import org.owasp.dependencycheck.data.lucene.LuceneUtils;
    +  41   
     import org.owasp.dependencycheck.data.nvdcve.CveDB;
    -  47   +  42   
     import org.owasp.dependencycheck.data.nvdcve.DatabaseException;
    -  48   +  43   + 
     import org.owasp.dependencycheck.dependency.Confidence;
    +  44   + 
     import org.owasp.dependencycheck.dependency.Dependency;
    +  45   + 
     import org.owasp.dependencycheck.dependency.Evidence;
    +  46   + 
     import org.owasp.dependencycheck.dependency.EvidenceCollection;
    +  47   
     import org.owasp.dependencycheck.dependency.Identifier;
    -  49   +  48   
     import org.owasp.dependencycheck.dependency.VulnerableSoftware;
    -  50   +  49   
     import org.owasp.dependencycheck.utils.DependencyVersion;
    -  51   +  50   
     import org.owasp.dependencycheck.utils.DependencyVersionUtil;
    +  51   + 
     
     52   - 
     
    -  53   
     /**
    +  53   + 
      * CPEAnalyzer is a utility class that takes a project dependency and attempts to discern if there is an associated CPE.
     54   - 
      * CPEAnalyzer is a utility class that takes a project dependency and attempts
    + 
      * It uses the evidence contained within the dependency to search the Lucene index.
     55   - 
      * to discern if there is an associated CPE. It uses the evidence contained
    -  56   - 
      * within the dependency to search the Lucene index.
    -  57   
      *
    -  58   +  56   
      * @author Jeremy Long <jeremy.long@owasp.org>
    -  59   +  57   
      */
    -  60  10 
     public class CPEAnalyzer implements Analyzer {
    -  61   +  58  20 
     public class CPEAnalyzer implements Analyzer {
    +  59   
     
    -  62   +  60   
         /**
    -  63   +  61   
          * The maximum number of query results to return.
    -  64   +  62   
          */
    -  65   +  63   
         static final int MAX_QUERY_RESULTS = 25;
    -  66   +  64   
         /**
    -  67   +  65   
          * The weighting boost to give terms when constructing the Lucene query.
    -  68   +  66   
          */
    -  69   +  67   
         static final String WEIGHTING_BOOST = "^5";
    +  68   + 
         /**
    +  69   + 
          * A string representation of a regular expression defining characters utilized within the CPE Names.
     70   - 
         /**
    -  71   - 
          * A string representation of a regular expression defining characters
    -  72   - 
          * utilized within the CPE Names.
    -  73   
          */
    -  74   +  71   
         static final String CLEANSE_CHARACTER_RX = "[^A-Za-z0-9 ._-]";
    -  75   +  72   
         /**
    +  73   + 
          * A string representation of a regular expression used to remove all but alpha characters.
    +  74   + 
          */
    +  75   + 
         static final String CLEANSE_NONALPHA_RX = "[^A-Za-z]*";
     76   - 
          * A string representation of a regular expression used to remove all but
    + 
         /**
     77   - 
          * alpha characters.
    + 
          * The additional size to add to a new StringBuilder to account for extra data that will be written into the string.
     78   
          */
     79   - 
         static final String CLEANSE_NONALPHA_RX = "[^A-Za-z]*";
    + 
         static final int STRING_BUILDER_BUFFER = 20;
     80   
         /**
     81   - 
          * The additional size to add to a new StringBuilder to account for extra
    -  82   - 
          * data that will be written into the string.
    -  83   - 
          */
    -  84   - 
         static final int STRING_BUILDER_BUFFER = 20;
    -  85   - 
         /**
    -  86   
          * The CPE in memory index.
    -  87   +  82   
          */
    -  88   +  83   
         private CpeMemoryIndex cpe;
    +  84   + 
         /**
    +  85   + 
          * The CVE Database.
    +  86   + 
          */
    +  87   + 
         private CveDB cve;
    +  88   + 
     
     89   
         /**
     90   - 
          * The CVE Database.
    -  91   - 
          */
    -  92   - 
         private CveDB cve;
    -  93   - 
     
    -  94   - 
         /**
    -  95   
          * Opens the data source.
    +  91   + 
          *
    +  92   + 
          * @throws IOException when the Lucene directory to be queried does not exist or is corrupt.
    +  93   + 
          * @throws DatabaseException when the database throws an exception. This usually occurs when the database is in use
    +  94   + 
          * by another process.
    +  95   + 
          */
     96   - 
          *
    -  97   - 
          * @throws IOException when the Lucene directory to be queried does not
    -  98   - 
          * exist or is corrupt.
    -  99   - 
          * @throws DatabaseException when the database throws an exception. This
    -  100   - 
          * usually occurs when the database is in use by another process.
    -  101   - 
          */
    -  102   
         public void open() throws IOException, DatabaseException {
    -  103  11 
             Logger.getLogger(CPEAnalyzer.class.getName()).log(Level.FINE, "Opening the CVE Database");
    -  104  11 
             cve = new CveDB();
    -  105  11 
             cve.open();
    -  106  11 
             Logger.getLogger(CPEAnalyzer.class.getName()).log(Level.FINE, "Creating the Lucene CPE Index");
    -  107  11 
             cpe = CpeMemoryIndex.getInstance();
    -  108   +  97  22 
             Logger.getLogger(CPEAnalyzer.class.getName()).log(Level.FINE, "Opening the CVE Database");
    +  98  22 
             cve = new CveDB();
    +  99  22 
             cve.open();
    +  100  22 
             Logger.getLogger(CPEAnalyzer.class.getName()).log(Level.FINE, "Creating the Lucene CPE Index");
    +  101  22 
             cpe = CpeMemoryIndex.getInstance();
    +  102   
             try {
    -  109  11 
                 cpe.open(cve);
    -  110  0 
             } catch (IndexException ex) {
    -  111  0 
                 Logger.getLogger(CPEAnalyzer.class.getName()).log(Level.FINE, "IndexException", ex);
    -  112  0 
                 throw new DatabaseException(ex);
    -  113  11 
             }
    -  114  11 
         }
    -  115   +  103  22 
                 cpe.open(cve);
    +  104  0 
             } catch (IndexException ex) {
    +  105  0 
                 Logger.getLogger(CPEAnalyzer.class.getName()).log(Level.FINE, "IndexException", ex);
    +  106  0 
                 throw new DatabaseException(ex);
    +  107  22 
             }
    +  108  22 
         }
    +  109   
     
    -  116   +  110   
         /**
    -  117   +  111   
          * Closes the data sources.
    -  118   +  112   
          */
    -  119   +  113   
         @Override
    -  120   +  114   
         public void close() {
    -  121  11 
             if (cpe != null) {
    -  122  11 
                 cpe.close();
    +  115  22 
             if (cpe != null) {
    +  116  22 
                 cpe.close();
    +  117   + 
             }
    +  118  22 
             if (cve != null) {
    +  119  22 
                 cve.close();
    +  120   + 
             }
    +  121  22 
         }
    +  122   + 
     
     123   - 
             }
    -  124  11 
             if (cve != null) {
    -  125  11 
                 cve.close();
    -  126   - 
             }
    -  127  11 
         }
    -  128   - 
     
    -  129   
         /**
    -  130   - 
          * Searches the data store of CPE entries, trying to identify the CPE for
    -  131   - 
          * the given dependency based on the evidence contained within. The
    -  132   - 
          * dependency passed in is updated with any identified CPE values.
    -  133   +  124   + 
          * Searches the data store of CPE entries, trying to identify the CPE for the given dependency based on the evidence
    +  125   + 
          * contained within. The dependency passed in is updated with any identified CPE values.
    +  126   
          *
    -  134   +  127   
          * @param dependency the dependency to search for CPE entries on.
    -  135   +  128   
          * @throws CorruptIndexException is thrown when the Lucene index is corrupt.
    -  136   +  129   
          * @throws IOException is thrown when an IOException occurs.
    -  137   +  130   
          * @throws ParseException is thrown when the Lucene query cannot be parsed.
    -  138   +  131   
          */
    -  139   +  132   
         protected void determineCPE(Dependency dependency) throws CorruptIndexException, IOException, ParseException {
    -  140  19 
             Confidence confidence = Confidence.HIGHEST;
    -  141   +  133  38 
             Confidence confidence = Confidence.HIGHEST;
    +  134   
     
    -  142  19 
             String vendors = addEvidenceWithoutDuplicateTerms("", dependency.getVendorEvidence(), confidence);
    -  143  19 
             String products = addEvidenceWithoutDuplicateTerms("", dependency.getProductEvidence(), confidence);
    -  144   +  135  38 
             String vendors = addEvidenceWithoutDuplicateTerms("", dependency.getVendorEvidence(), confidence);
    +  136  38 
             String products = addEvidenceWithoutDuplicateTerms("", dependency.getProductEvidence(), confidence);
    +  137   
             /* bug fix for #40 - version evidence is not showing up as "used" in the reports if there is no
    -  145   +  138   
              * CPE identified. As such, we are "using" the evidence and ignoring the results. */
    -  146  19 
             addEvidenceWithoutDuplicateTerms("", dependency.getVersionEvidence(), confidence);
    -  147   +  139  38 
             addEvidenceWithoutDuplicateTerms("", dependency.getVersionEvidence(), confidence);
    +  140   
     
    -  148  19 
             int ctr = 0;
    -  149   +  141  38 
             int ctr = 0;
    +  142   
             do {
    -  150  76 
                 if (!vendors.isEmpty() && !products.isEmpty()) {
    -  151  72 
                     final List<IndexEntry> entries = searchCPE(vendors, products, dependency.getProductEvidence().getWeighting(),
    -  152   +  143  152 
                 if (!vendors.isEmpty() && !products.isEmpty()) {
    +  144  144 
                     final List<IndexEntry> entries = searchCPE(vendors, products, dependency.getProductEvidence().getWeighting(),
    +  145   
                             dependency.getVendorEvidence().getWeighting());
    -  153   +  146   
     
    -  154  72 
                     for (IndexEntry e : entries) {
    -  155  729 
                         if (verifyEntry(e, dependency)) {
    -  156  71 
                             final String vendor = e.getVendor();
    -  157  71 
                             final String product = e.getProduct();
    -  158  71 
                             determineIdentifiers(dependency, vendor, product);
    -  159   +  147  144 
                     for (IndexEntry e : entries) {
    +  148  1458 
                         if (verifyEntry(e, dependency)) {
    +  149  142 
                             final String vendor = e.getVendor();
    +  150  142 
                             final String product = e.getProduct();
    +  151  142 
                             determineIdentifiers(dependency, vendor, product);
    +  152   
                         }
    -  160  729 
                     }
    +  153  1458 
                     }
    +  154   + 
                 }
    +  155  152 
                 confidence = reduceConfidence(confidence);
    +  156  152 
                 if (dependency.getVendorEvidence().contains(confidence)) {
    +  157  122 
                     vendors = addEvidenceWithoutDuplicateTerms(vendors, dependency.getVendorEvidence(), confidence);
    +  158   + 
                 }
    +  159  152 
                 if (dependency.getProductEvidence().contains(confidence)) {
    +  160  128 
                     products = addEvidenceWithoutDuplicateTerms(products, dependency.getProductEvidence(), confidence);
     161   
                 }
    -  162  76 
                 confidence = reduceConfidence(confidence);
    -  163  76 
                 if (dependency.getVendorEvidence().contains(confidence)) {
    -  164  61 
                     vendors = addEvidenceWithoutDuplicateTerms(vendors, dependency.getVendorEvidence(), confidence);
    -  165   - 
                 }
    -  166  76 
                 if (dependency.getProductEvidence().contains(confidence)) {
    -  167  64 
                     products = addEvidenceWithoutDuplicateTerms(products, dependency.getProductEvidence(), confidence);
    -  168   - 
                 }
    -  169   +  162   
                 /* bug fix for #40 - version evidence is not showing up as "used" in the reports if there is no
    -  170   +  163   
                  * CPE identified. As such, we are "using" the evidence and ignoring the results. */
    -  171  76 
                 if (dependency.getVersionEvidence().contains(confidence)) {
    -  172  37 
                     addEvidenceWithoutDuplicateTerms("", dependency.getVersionEvidence(), confidence);
    +  164  152 
                 if (dependency.getVersionEvidence().contains(confidence)) {
    +  165  74 
                     addEvidenceWithoutDuplicateTerms("", dependency.getVersionEvidence(), confidence);
    +  166   + 
                 }
    +  167  152 
             } while ((++ctr) < 4);
    +  168  38 
         }
    +  169   + 
     
    +  170   + 
         /**
    +  171   + 
          * Returns the text created by concatenating the text and the values from the EvidenceCollection (filtered for a
    +  172   + 
          * specific confidence). This attempts to prevent duplicate terms from being added.<br/<br/> Note, if the evidence
     173   - 
                 }
    -  174  76 
             } while ((++ctr) < 4);
    -  175  19 
         }
    -  176   - 
     
    -  177   - 
         /**
    -  178   - 
          * Returns the text created by concatenating the text and the values from
    -  179   - 
          * the EvidenceCollection (filtered for a specific confidence). This
    -  180   - 
          * attempts to prevent duplicate terms from being added.<br/<br/> Note, if
    -  181   - 
          * the evidence is longer then 200 characters it will be truncated.
    -  182   + 
          * is longer then 200 characters it will be truncated.
    +  174   
          *
    -  183   +  175   
          * @param text the base text.
    -  184   +  176   
          * @param ec an EvidenceCollection
    -  185   +  177   
          * @param confidenceFilter a Confidence level to filter the evidence by.
    -  186   +  178   
          * @return the new evidence text
    -  187   +  179   
          */
    -  188   +  180   
         private String addEvidenceWithoutDuplicateTerms(final String text, final EvidenceCollection ec, Confidence confidenceFilter) {
    -  189  219 
             final String txt = (text == null) ? "" : text;
    -  190  219 
             final StringBuilder sb = new StringBuilder(txt.length() + (20 * ec.size()));
    -  191  219 
             sb.append(' ').append(txt).append(' ');
    -  192  219 
             for (Evidence e : ec.iterator(confidenceFilter)) {
    -  193  409 
                 String value = e.getValue();
    -  194   +  181  438 
             final String txt = (text == null) ? "" : text;
    +  182  438 
             final StringBuilder sb = new StringBuilder(txt.length() + (20 * ec.size()));
    +  183  438 
             sb.append(' ').append(txt).append(' ');
    +  184  438 
             for (Evidence e : ec.iterator(confidenceFilter)) {
    +  185  848 
                 String value = e.getValue();
    +  186   
     
    -  195   +  187   
                 //hack to get around the fact that lucene does a really good job of recognizing domains and not
    -  196   +  188   
                 // splitting them. TODO - put together a better lucene analyzer specific to the domain.
    -  197  409 
                 if (value.startsWith("http://")) {
    -  198  32 
                     value = value.substring(7).replaceAll("\\.", " ");
    -  199   +  189  848 
                 if (value.startsWith("http://")) {
    +  190  64 
                     value = value.substring(7).replaceAll("\\.", " ");
    +  191   
                 }
    -  200  409 
                 if (value.startsWith("https://")) {
    -  201  0 
                     value = value.substring(8).replaceAll("\\.", " ");
    +  192  848 
                 if (value.startsWith("https://")) {
    +  193  0 
                     value = value.substring(8).replaceAll("\\.", " ");
    +  194   + 
                 }
    +  195  848 
                 if (sb.indexOf(" " + value + " ") < 0) {
    +  196  546 
                     sb.append(value).append(' ');
    +  197   + 
                 }
    +  198  848 
             }
    +  199  438 
             return sb.toString().trim();
    +  200   + 
         }
    +  201   + 
     
     202   - 
                 }
    -  203  409 
                 if (sb.indexOf(" " + value + " ") < 0) {
    -  204  270 
                     sb.append(value).append(' ');
    + 
         /**
    +  203   + 
          * Reduces the given confidence by one level. This returns LOW if the confidence passed in is not HIGH.
    +  204   + 
          *
     205   - 
                 }
    -  206  409 
             }
    -  207  219 
             return sb.toString().trim();
    -  208   - 
         }
    -  209   - 
     
    -  210   - 
         /**
    -  211   - 
          * Reduces the given confidence by one level. This returns LOW if the
    -  212   - 
          * confidence passed in is not HIGH.
    -  213   - 
          *
    -  214   
          * @param c the confidence to reduce.
    -  215   +  206   
          * @return One less then the confidence passed in.
    -  216   +  207   
          */
    -  217   +  208   
         private Confidence reduceConfidence(final Confidence c) {
    -  218  76 
             if (c == Confidence.HIGHEST) {
    -  219  19 
                 return Confidence.HIGH;
    -  220  57 
             } else if (c == Confidence.HIGH) {
    -  221  19 
                 return Confidence.MEDIUM;
    +  209  152 
             if (c == Confidence.HIGHEST) {
    +  210  38 
                 return Confidence.HIGH;
    +  211  114 
             } else if (c == Confidence.HIGH) {
    +  212  38 
                 return Confidence.MEDIUM;
    +  213   + 
             } else {
    +  214  76 
                 return Confidence.LOW;
    +  215   + 
             }
    +  216   + 
         }
    +  217   + 
     
    +  218   + 
         /**
    +  219   + 
          * <p>
    +  220   + 
          * Searches the Lucene CPE index to identify possible CPE entries associated with the supplied vendor, product, and
    +  221   + 
          * version.</p>
     222   - 
             } else {
    -  223  38 
                 return Confidence.LOW;
    + 
          *
    +  223   + 
          * <p>
     224   - 
             }
    + 
          * If either the vendorWeightings or productWeightings lists have been populated this data is used to add weighting
     225   - 
         }
    + 
          * factors to the search.</p>
     226   - 
     
    + 
          *
     227   - 
         /**
    -  228   - 
          * <p>Searches the Lucene CPE index to identify possible CPE entries
    -  229   - 
          * associated with the supplied vendor, product, and version.</p>
    -  230   - 
          *
    -  231   - 
          * <p>If either the vendorWeightings or productWeightings lists have been
    -  232   - 
          * populated this data is used to add weighting factors to the search.</p>
    -  233   - 
          *
    -  234   
          * @param vendor the text used to search the vendor field
    -  235   +  228   
          * @param product the text used to search the product field
    -  236   - 
          * @param vendorWeightings a list of strings to use to add weighting factors
    -  237   - 
          * to the vendor field
    -  238   - 
          * @param productWeightings Adds a list of strings that will be used to add
    -  239   - 
          * weighting factors to the product search
    -  240   +  229   + 
          * @param vendorWeightings a list of strings to use to add weighting factors to the vendor field
    +  230   + 
          * @param productWeightings Adds a list of strings that will be used to add weighting factors to the product search
    +  231   
          * @return a list of possible CPE values
    -  241   +  232   
          * @throws CorruptIndexException when the Lucene index is corrupt
    -  242   +  233   
          * @throws IOException when the Lucene index is not found
    -  243   +  234   
          * @throws ParseException when the generated query is not valid
    -  244   +  235   
          */
    -  245   +  236   
         protected List<IndexEntry> searchCPE(String vendor, String product,
    -  246   +  237   
                 Set<String> vendorWeightings, Set<String> productWeightings)
    -  247   +  238   
                 throws CorruptIndexException, IOException, ParseException {
    -  248  73 
             final ArrayList<IndexEntry> ret = new ArrayList<IndexEntry>(MAX_QUERY_RESULTS);
    -  249   +  239  146 
             final ArrayList<IndexEntry> ret = new ArrayList<IndexEntry>(MAX_QUERY_RESULTS);
    +  240   
     
    -  250  73 
             final String searchString = buildSearch(vendor, product, vendorWeightings, productWeightings);
    -  251  73 
             if (searchString == null) {
    -  252  0 
                 return ret;
    +  241  146 
             final String searchString = buildSearch(vendor, product, vendorWeightings, productWeightings);
    +  242  146 
             if (searchString == null) {
    +  243  0 
                 return ret;
    +  244   + 
             }
    +  245   + 
     
    +  246  146 
             final TopDocs docs = cpe.search(searchString, MAX_QUERY_RESULTS);
    +  247  2444 
             for (ScoreDoc d : docs.scoreDocs) {
    +  248  2298 
                 if (d.score >= 0.08) {
    +  249  1500 
                     final Document doc = cpe.getDocument(d.doc);
    +  250  1500 
                     final IndexEntry entry = new IndexEntry();
    +  251  1500 
                     entry.setVendor(doc.get(Fields.VENDOR));
    +  252  1500 
                     entry.setProduct(doc.get(Fields.PRODUCT));
     253   - 
             }
    -  254   - 
     
    -  255  73 
             final TopDocs docs = cpe.search(searchString, MAX_QUERY_RESULTS);
    -  256  1222 
             for (ScoreDoc d : docs.scoreDocs) {
    -  257  1149 
                 if (d.score >= 0.08) {
    -  258  750 
                     final Document doc = cpe.getDocument(d.doc);
    -  259  750 
                     final IndexEntry entry = new IndexEntry();
    -  260  750 
                     entry.setVendor(doc.get(Fields.VENDOR));
    -  261  750 
                     entry.setProduct(doc.get(Fields.PRODUCT));
    -  262   
     //                if (d.score < 0.08) {
    -  263   +  254   
     //                    System.out.print(entry.getVendor());
    -  264   +  255   
     //                    System.out.print(":");
    -  265   +  256   
     //                    System.out.print(entry.getProduct());
    -  266   +  257   
     //                    System.out.print(":");
    -  267   +  258   
     //                    System.out.println(d.score);
    -  268   +  259   
     //                }
    -  269  750 
                     entry.setSearchScore(d.score);
    -  270  750 
                     if (!ret.contains(entry)) {
    -  271  750 
                         ret.add(entry);
    -  272   +  260  1500 
                     entry.setSearchScore(d.score);
    +  261  1500 
                     if (!ret.contains(entry)) {
    +  262  1500 
                         ret.add(entry);
    +  263   
                     }
    -  273   +  264   
                 }
    +  265   + 
             }
    +  266  146 
             return ret;
    +  267   + 
         }
    +  268   + 
     
    +  269   + 
         /**
    +  270   + 
          * <p>
    +  271   + 
          * Builds a Lucene search string by properly escaping data and constructing a valid search query.</p>
    +  272   + 
          *
    +  273   + 
          * <p>
     274   - 
             }
    -  275  73 
             return ret;
    + 
          * If either the possibleVendor or possibleProducts lists have been populated this data is used to add weighting
    +  275   + 
          * factors to the search string generated.</p>
     276   - 
         }
    + 
          *
     277   - 
     
    -  278   - 
         /**
    -  279   - 
          * <p>Builds a Lucene search string by properly escaping data and
    -  280   - 
          * constructing a valid search query.</p>
    -  281   - 
          *
    -  282   - 
          * <p>If either the possibleVendor or possibleProducts lists have been
    -  283   - 
          * populated this data is used to add weighting factors to the search string
    -  284   - 
          * generated.</p>
    -  285   - 
          *
    -  286   
          * @param vendor text to search the vendor field
    -  287   +  278   
          * @param product text to search the product field
    -  288   - 
          * @param vendorWeighting a list of strings to apply to the vendor to boost
    -  289   - 
          * the terms weight
    -  290   - 
          * @param productWeightings a list of strings to apply to the product to
    -  291   - 
          * boost the terms weight
    -  292   +  279   + 
          * @param vendorWeighting a list of strings to apply to the vendor to boost the terms weight
    +  280   + 
          * @param productWeightings a list of strings to apply to the product to boost the terms weight
    +  281   
          * @return the Lucene query
    -  293   +  282   
          */
    -  294   +  283   
         protected String buildSearch(String vendor, String product,
    -  295   +  284   
                 Set<String> vendorWeighting, Set<String> productWeightings) {
    -  296  77 
             final String v = vendor; //.replaceAll("[^\\w\\d]", " ");
    -  297  77 
             final String p = product; //.replaceAll("[^\\w\\d]", " ");
    -  298  77 
             final StringBuilder sb = new StringBuilder(v.length() + p.length()
    -  299   +  285  154 
             final String v = vendor; //.replaceAll("[^\\w\\d]", " ");
    +  286  154 
             final String p = product; //.replaceAll("[^\\w\\d]", " ");
    +  287  154 
             final StringBuilder sb = new StringBuilder(v.length() + p.length()
    +  288   
                     + Fields.PRODUCT.length() + Fields.VENDOR.length() + STRING_BUILDER_BUFFER);
    +  289   + 
     
    +  290  154 
             if (!appendWeightedSearch(sb, Fields.PRODUCT, p, productWeightings)) {
    +  291  0 
                 return null;
    +  292   + 
             }
    +  293  154 
             sb.append(" AND ");
    +  294  154 
             if (!appendWeightedSearch(sb, Fields.VENDOR, v, vendorWeighting)) {
    +  295  0 
                 return null;
    +  296   + 
             }
    +  297  154 
             return sb.toString();
    +  298   + 
         }
    +  299   + 
     
     300   - 
     
    -  301  77 
             if (!appendWeightedSearch(sb, Fields.PRODUCT, p, productWeightings)) {
    -  302  0 
                 return null;
    + 
         /**
    +  301   + 
          * This method constructs a Lucene query for a given field. The searchText is split into separate words and if the
    +  302   + 
          * word is within the list of weighted words then an additional weighting is applied to the term as it is appended
     303   - 
             }
    -  304  77 
             sb.append(" AND ");
    -  305  77 
             if (!appendWeightedSearch(sb, Fields.VENDOR, v, vendorWeighting)) {
    -  306  0 
                 return null;
    -  307   - 
             }
    -  308  77 
             return sb.toString();
    -  309   - 
         }
    -  310   - 
     
    -  311   - 
         /**
    -  312   - 
          * This method constructs a Lucene query for a given field. The searchText
    -  313   - 
          * is split into separate words and if the word is within the list of
    -  314   - 
          * weighted words then an additional weighting is applied to the term as it
    -  315   - 
          * is appended into the query.
    -  316   + 
          * into the query.
    +  304   
          *
    -  317   +  305   
          * @param sb a StringBuilder that the query text will be appended to.
    -  318   - 
          * @param field the field within the Lucene index that the query is
    -  319   - 
          * searching.
    -  320   +  306   + 
          * @param field the field within the Lucene index that the query is searching.
    +  307   
          * @param searchText text used to construct the query.
    -  321   - 
          * @param weightedText a list of terms that will be considered higher
    -  322   - 
          * importance when searching.
    -  323   +  308   + 
          * @param weightedText a list of terms that will be considered higher importance when searching.
    +  309   
          * @return if the append was successful.
    -  324   +  310   
          */
    -  325   +  311   
         private boolean appendWeightedSearch(StringBuilder sb, String field, String searchText, Set<String> weightedText) {
    -  326  154 
             sb.append(" ").append(field).append(":( ");
    -  327   +  312  308 
             sb.append(" ").append(field).append(":( ");
    +  313   
     
    -  328  154 
             final String cleanText = cleanseText(searchText);
    -  329   +  314  308 
             final String cleanText = cleanseText(searchText);
    +  315   
     
    -  330  154 
             if ("".equals(cleanText)) {
    -  331  0 
                 return false;
    -  332   +  316  308 
             if ("".equals(cleanText)) {
    +  317  0 
                 return false;
    +  318   
             }
    -  333   +  319   
     
    -  334  154 
             if (weightedText == null || weightedText.isEmpty()) {
    -  335  40 
                 LuceneUtils.appendEscapedLuceneQuery(sb, cleanText);
    -  336   +  320  308 
             if (weightedText == null || weightedText.isEmpty()) {
    +  321  80 
                 LuceneUtils.appendEscapedLuceneQuery(sb, cleanText);
    +  322   
             } else {
    -  337  114 
                 final StringTokenizer tokens = new StringTokenizer(cleanText);
    -  338  1211 
                 while (tokens.hasMoreElements()) {
    -  339  1097 
                     final String word = tokens.nextToken();
    -  340  1097 
                     String temp = null;
    -  341  1097 
                     for (String weighted : weightedText) {
    -  342  2202 
                         final String weightedStr = cleanseText(weighted);
    -  343  2202 
                         if (equalsIgnoreCaseAndNonAlpha(word, weightedStr)) {
    -  344  251 
                             temp = LuceneUtils.escapeLuceneQuery(word) + WEIGHTING_BOOST;
    -  345  251 
                             if (!word.equalsIgnoreCase(weightedStr)) {
    -  346  18 
                                 temp += " " + LuceneUtils.escapeLuceneQuery(weightedStr) + WEIGHTING_BOOST;
    -  347   +  323  228 
                 final StringTokenizer tokens = new StringTokenizer(cleanText);
    +  324  2434 
                 while (tokens.hasMoreElements()) {
    +  325  2206 
                     final String word = tokens.nextToken();
    +  326  2206 
                     String temp = null;
    +  327  2206 
                     for (String weighted : weightedText) {
    +  328  4428 
                         final String weightedStr = cleanseText(weighted);
    +  329  4428 
                         if (equalsIgnoreCaseAndNonAlpha(word, weightedStr)) {
    +  330  502 
                             temp = LuceneUtils.escapeLuceneQuery(word) + WEIGHTING_BOOST;
    +  331  502 
                             if (!word.equalsIgnoreCase(weightedStr)) {
    +  332  36 
                                 temp += " " + LuceneUtils.escapeLuceneQuery(weightedStr) + WEIGHTING_BOOST;
    +  333   
                             }
    -  348   +  334   
                         }
    -  349  2202 
                     }
    -  350  1097 
                     if (temp == null) {
    -  351  846 
                         temp = LuceneUtils.escapeLuceneQuery(word);
    -  352   +  335  4428 
                     }
    +  336  2206 
                     if (temp == null) {
    +  337  1704 
                         temp = LuceneUtils.escapeLuceneQuery(word);
    +  338   
                     }
    -  353  1097 
                     sb.append(" ").append(temp);
    -  354  1097 
                 }
    -  355   +  339  2206 
                     sb.append(" ").append(temp);
    +  340  2206 
                 }
    +  341   
             }
    -  356  154 
             sb.append(" ) ");
    -  357  154 
             return true;
    -  358   +  342  308 
             sb.append(" ) ");
    +  343  308 
             return true;
    +  344   
         }
    -  359   +  345   
     
    -  360   +  346   
         /**
    -  361   - 
          * Removes characters from the input text that are not used within the CPE
    -  362   - 
          * index.
    -  363   +  347   + 
          * Removes characters from the input text that are not used within the CPE index.
    +  348   
          *
    -  364   +  349   
          * @param text is the text to remove the characters from.
    -  365   +  350   
          * @return the text having removed some characters.
    -  366   +  351   
          */
    -  367   +  352   
         private String cleanseText(String text) {
    -  368  2356 
             return text.replaceAll(CLEANSE_CHARACTER_RX, " ");
    -  369   +  353  4736 
             return text.replaceAll(CLEANSE_CHARACTER_RX, " ");
    +  354   
         }
    -  370   +  355   
     
    -  371   +  356   
         /**
    -  372   - 
          * Compares two strings after lower casing them and removing the non-alpha
    -  373   - 
          * characters.
    -  374   +  357   + 
          * Compares two strings after lower casing them and removing the non-alpha characters.
    +  358   
          *
    -  375   +  359   
          * @param l string one to compare.
    -  376   +  360   
          * @param r string two to compare.
    -  377   +  361   
          * @return whether or not the two strings are similar.
    -  378   +  362   
          */
    -  379   +  363   
         private boolean equalsIgnoreCaseAndNonAlpha(String l, String r) {
    -  380  2202 
             if (l == null || r == null) {
    -  381  0 
                 return false;
    -  382   +  364  4428 
             if (l == null || r == null) {
    +  365  0 
                 return false;
    +  366   
             }
    +  367   + 
     
    +  368  4428 
             final String left = l.replaceAll(CLEANSE_NONALPHA_RX, "");
    +  369  4428 
             final String right = r.replaceAll(CLEANSE_NONALPHA_RX, "");
    +  370  4428 
             return left.equalsIgnoreCase(right);
    +  371   + 
         }
    +  372   + 
     
    +  373   + 
         /**
    +  374   + 
          * Ensures that the CPE Identified matches the dependency. This validates that the product, vendor, and version
    +  375   + 
          * information for the CPE are contained within the dependencies evidence.
    +  376   + 
          *
    +  377   + 
          * @param entry a CPE entry.
    +  378   + 
          * @param dependency the dependency that the CPE entries could be for.
    +  379   + 
          * @return whether or not the entry is valid.
    +  380   + 
          */
    +  381   + 
         private boolean verifyEntry(final IndexEntry entry, final Dependency dependency) {
    +  382  1458 
             boolean isValid = false;
     383   
     
    -  384  2202 
             final String left = l.replaceAll(CLEANSE_NONALPHA_RX, "");
    -  385  2202 
             final String right = r.replaceAll(CLEANSE_NONALPHA_RX, "");
    -  386  2202 
             return left.equalsIgnoreCase(right);
    -  387   - 
         }
    +  384  1458 
             if (collectionContainsString(dependency.getProductEvidence(), entry.getProduct())
    +  385   + 
                     && collectionContainsString(dependency.getVendorEvidence(), entry.getVendor())) {
    +  386   + 
                 //&& collectionContainsVersion(dependency.getVersionEvidence(), entry.getVersion())
    +  387  142 
                 isValid = true;
     388   - 
     
    -  389   - 
         /**
    + 
             }
    +  389  1458 
             return isValid;
     390   - 
          * Ensures that the CPE Identified matches the dependency. This validates
    + 
         }
     391   - 
          * that the product, vendor, and version information for the CPE are
    + 
     
     392   - 
          * contained within the dependencies evidence.
    + 
         /**
     393   - 
          *
    + 
          * Used to determine if the EvidenceCollection contains a specific string.
     394   - 
          * @param entry a CPE entry.
    + 
          *
     395   - 
          * @param dependency the dependency that the CPE entries could be for.
    + 
          * @param ec an EvidenceCollection
     396   - 
          * @return whether or not the entry is valid.
    + 
          * @param text the text to search for
     397   - 
          */
    + 
          * @return whether or not the EvidenceCollection contains the string
     398   - 
         private boolean verifyEntry(final IndexEntry entry, final Dependency dependency) {
    -  399  729 
             boolean isValid = false;
    + 
          */
    +  399   + 
         private boolean collectionContainsString(EvidenceCollection ec, String text) {
     400   
     
    -  401  729 
             if (collectionContainsString(dependency.getProductEvidence(), entry.getProduct())
    -  402   - 
                     && collectionContainsString(dependency.getVendorEvidence(), entry.getVendor())) {
    -  403   - 
                 //&& collectionContainsVersion(dependency.getVersionEvidence(), entry.getVersion())
    -  404  71 
                 isValid = true;
    -  405   - 
             }
    -  406  729 
             return isValid;
    -  407   - 
         }
    -  408   - 
     
    -  409   - 
         /**
    -  410   - 
          * Used to determine if the EvidenceCollection contains a specific string.
    -  411   - 
          *
    -  412   - 
          * @param ec an EvidenceCollection
    -  413   - 
          * @param text the text to search for
    -  414   - 
          * @return whether or not the EvidenceCollection contains the string
    -  415   - 
          */
    -  416   - 
         private boolean collectionContainsString(EvidenceCollection ec, String text) {
    -  417   - 
     
    -  418   +  401   
             //<editor-fold defaultstate="collapsed" desc="This code fold contains an old version of the code, delete once more testing is done">
    -  419   +  402   
             //        String[] splitText = text.split("[\\s_-]");
    -  420   +  403   
             //
    -  421   +  404   
             //        for (String search : splitText) {
    -  422   +  405   
             //            //final String search = text.replaceAll("[\\s_-]", "").toLowerCase();
    -  423   +  406   
             //            if (ec.containsUsedString(search)) {
    -  424   +  407   
             //                return true;
    -  425   +  408   
             //            }
    -  426   +  409   
             //        }
    -  427   +  410   
             //</editor-fold>
    -  428   - 
     
    -  429   +  411   
             //TODO - likely need to change the split... not sure if this will work for CPE with special chars
    -  430  806 
             if (text == null) {
    -  431  0 
                 return false;
    -  432   +  412  1612 
             if (text == null) {
    +  413  0 
                 return false;
    +  414   
             }
    -  433  806 
             final String[] words = text.split("[\\s_-]");
    -  434  806 
             final List<String> list = new ArrayList<String>();
    -  435  806 
             String tempWord = null;
    -  436  2270 
             for (String word : words) {
    -  437   +  415  1612 
             final String[] words = text.split("[\\s_-]");
    +  416  1612 
             final List<String> list = new ArrayList<String>();
    +  417  1612 
             String tempWord = null;
    +  418  4556 
             for (String word : words) {
    +  419   
                 /*
    -  438   - 
                 single letter words should be concatenated with the next word.
    -  439   - 
                 so { "m", "core", "sample" } -> { "mcore", "sample" }
    -  440   - 
                 */
    -  441  1464 
                 if (tempWord != null) {
    -  442  17 
                     list.add(tempWord + word);
    -  443  17 
                     tempWord = null;
    -  444  1447 
                 } else if (word.length() <= 2) {
    -  445  40 
                     tempWord = word;
    -  446   +  420   + 
                  single letter words should be concatenated with the next word.
    +  421   + 
                  so { "m", "core", "sample" } -> { "mcore", "sample" }
    +  422   + 
                  */
    +  423  2944 
                 if (tempWord != null) {
    +  424  34 
                     list.add(tempWord + word);
    +  425  34 
                     tempWord = null;
    +  426  2910 
                 } else if (word.length() <= 2) {
    +  427  80 
                     tempWord = word;
    +  428   
                 } else {
    -  447  1407 
                     list.add(word);
    -  448   +  429  2830 
                     list.add(word);
    +  430   
                 }
    -  449   +  431   
             }
    -  450  806 
             if (tempWord != null && !list.isEmpty()) {
    -  451  19 
                 final String tmp = list.get(list.size() - 1) + tempWord;
    -  452  19 
                 list.add(tmp);
    -  453   +  432  1612 
             if (tempWord != null && !list.isEmpty()) {
    +  433  38 
                 final String tmp = list.get(list.size() - 1) + tempWord;
    +  434  38 
                 list.add(tmp);
    +  435   
             }
    -  454  806 
             boolean contains = true;
    -  455  806 
             for (String word : list) {
    -  456  1443 
                 contains &= ec.containsUsedString(word);
    -  457  1443 
             }
    -  458  806 
             return contains;
    -  459   +  436  1612 
             boolean contains = true;
    +  437  1612 
             for (String word : list) {
    +  438  2902 
                 contains &= ec.containsUsedString(word);
    +  439  2902 
             }
    +  440  1612 
             return contains;
    +  441   
         }
    -  460   +  442   
     
    -  461   +  443   
         /**
    -  462   - 
          * Analyzes a dependency and attempts to determine if there are any CPE
    -  463   - 
          * identifiers for this dependency.
    -  464   +  444   + 
          * Analyzes a dependency and attempts to determine if there are any CPE identifiers for this dependency.
    +  445   
          *
    -  465   +  446   
          * @param dependency The Dependency to analyze.
    -  466   +  447   
          * @param engine The analysis engine
    -  467   - 
          * @throws AnalysisException is thrown if there is an issue analyzing the
    -  468   - 
          * dependency.
    -  469   +  448   + 
          * @throws AnalysisException is thrown if there is an issue analyzing the dependency.
    +  449   
          */
    -  470   +  450   
         @Override
    -  471   +  451   
         public void analyze(Dependency dependency, Engine engine) throws AnalysisException {
    -  472   +  452   
             try {
    -  473  15 
                 determineCPE(dependency);
    -  474  0 
             } catch (CorruptIndexException ex) {
    -  475  0 
                 throw new AnalysisException("CPE Index is corrupt.", ex);
    -  476  0 
             } catch (IOException ex) {
    -  477  0 
                 throw new AnalysisException("Failure opening the CPE Index.", ex);
    -  478  0 
             } catch (ParseException ex) {
    -  479  0 
                 throw new AnalysisException("Unable to parse the generated Lucene query for this dependency.", ex);
    -  480  15 
             }
    -  481  15 
         }
    +  453  30 
                 determineCPE(dependency);
    +  454  0 
             } catch (CorruptIndexException ex) {
    +  455  0 
                 throw new AnalysisException("CPE Index is corrupt.", ex);
    +  456  0 
             } catch (IOException ex) {
    +  457  0 
                 throw new AnalysisException("Failure opening the CPE Index.", ex);
    +  458  0 
             } catch (ParseException ex) {
    +  459  0 
                 throw new AnalysisException("Unable to parse the generated Lucene query for this dependency.", ex);
    +  460  30 
             }
    +  461  30 
         }
    +  462   + 
     
    +  463   + 
         /**
    +  464   + 
          * Returns true because this analyzer supports all dependency types.
    +  465   + 
          *
    +  466   + 
          * @return true.
    +  467   + 
          */
    +  468   + 
         @Override
    +  469   + 
         public Set<String> getSupportedExtensions() {
    +  470  264 
             return null;
    +  471   + 
         }
    +  472   + 
     
    +  473   + 
         /**
    +  474   + 
          * Returns the name of this analyzer.
    +  475   + 
          *
    +  476   + 
          * @return the name of this analyzer.
    +  477   + 
          */
    +  478   + 
         @Override
    +  479   + 
         public String getName() {
    +  480  18 
             return "CPE Analyzer";
    +  481   + 
         }
     482   
     
     483   @@ -847,522 +845,482 @@  485   
          *
     486   - 
          * @return true.
    -  487   - 
          */
    -  488   - 
         @Override
    -  489   - 
         public Set<String> getSupportedExtensions() {
    -  490  132 
             return null;
    -  491   - 
         }
    -  492   - 
     
    -  493   - 
         /**
    -  494   - 
          * Returns the name of this analyzer.
    -  495   - 
          *
    -  496   - 
          * @return the name of this analyzer.
    -  497   - 
          */
    -  498   - 
         @Override
    -  499   - 
         public String getName() {
    -  500  9 
             return "CPE Analyzer";
    -  501   - 
         }
    -  502   - 
     
    -  503   - 
         /**
    -  504   - 
          * Returns true because this analyzer supports all dependency types.
    -  505   - 
          *
    -  506   
          * @param extension the file extension of the dependency being analyzed.
    -  507   +  487   
          * @return true.
    +  488   + 
          */
    +  489   + 
         @Override
    +  490   + 
         public boolean supportsExtension(String extension) {
    +  491  18 
             return true;
    +  492   + 
         }
    +  493   + 
     
    +  494   + 
         /**
    +  495   + 
          * Returns the analysis phase that this analyzer should run in.
    +  496   + 
          *
    +  497   + 
          * @return the analysis phase that this analyzer should run in.
    +  498   + 
          */
    +  499   + 
         @Override
    +  500   + 
         public AnalysisPhase getAnalysisPhase() {
    +  501  12 
             return AnalysisPhase.IDENTIFIER_ANALYSIS;
    +  502   + 
         }
    +  503   + 
     
    +  504   + 
         /**
    +  505   + 
          * Opens the CPE Lucene Index.
    +  506   + 
          *
    +  507   + 
          * @throws Exception is thrown if there is an issue opening the index.
     508   
          */
     509   
         @Override
     510   - 
         public boolean supportsExtension(String extension) {
    -  511  9 
             return true;
    -  512   - 
         }
    + 
         public void initialize() throws Exception {
    +  511  6 
             this.open();
    +  512  6 
         }
     513   
     
     514   
         /**
     515   - 
          * Returns the analysis phase that this analyzer should run in.
    + 
          * Retrieves a list of CPE values from the CveDB based on the vendor and product passed in. The list is then
     516   - 
          *
    + 
          * validated to find only CPEs that are valid for the given dependency. It is possible that the CPE identified is a
     517   - 
          * @return the analysis phase that this analyzer should run in.
    + 
          * best effort "guess" based on the vendor, product, and version information.
     518   - 
          */
    + 
          *
     519   - 
         @Override
    -  520   - 
         public AnalysisPhase getAnalysisPhase() {
    -  521  6 
             return AnalysisPhase.IDENTIFIER_ANALYSIS;
    -  522   - 
         }
    -  523   - 
     
    -  524   - 
         /**
    -  525   - 
          * Opens the CPE Lucene Index.
    -  526   - 
          *
    -  527   - 
          * @throws Exception is thrown if there is an issue opening the index.
    -  528   - 
          */
    -  529   - 
         @Override
    -  530   - 
         public void initialize() throws Exception {
    -  531  3 
             this.open();
    -  532  3 
         }
    -  533   - 
     
    -  534   - 
         /**
    -  535   - 
          * Retrieves a list of CPE values from the CveDB based on the vendor and
    -  536   - 
          * product passed in. The list is then validated to find only CPEs that are
    -  537   - 
          * valid for the given dependency. It is possible that the CPE identified is
    -  538   - 
          * a best effort "guess" based on the vendor, product, and version
    -  539   - 
          * information.
    -  540   - 
          *
    -  541   
          * @param dependency the Dependency being analyzed
    -  542   +  520   
          * @param vendor the vendor for the CPE being analyzed
    -  543   +  521   
          * @param product the product for the CPE being analyzed
    -  544   +  522   
          * @throws UnsupportedEncodingException is thrown if UTF-8 is not supported
    -  545   +  523   
          */
    -  546   +  524   
         private void determineIdentifiers(Dependency dependency, String vendor, String product) throws UnsupportedEncodingException {
    -  547  71 
             final Set<VulnerableSoftware> cpes = cve.getCPEs(vendor, product);
    -  548  71 
             DependencyVersion bestGuess = new DependencyVersion("-");
    -  549  71 
             Confidence bestGuessConf = null;
    -  550  71 
             final List<IdentifierMatch> collected = new ArrayList<IdentifierMatch>();
    -  551  355 
             for (Confidence conf : Confidence.values()) {
    -  552  284 
                 for (Evidence evidence : dependency.getVersionEvidence().iterator(conf)) {
    -  553  160 
                     final DependencyVersion evVer = DependencyVersionUtil.parseVersion(evidence.getValue());
    -  554  160 
                     if (evVer == null) {
    -  555  0 
                         continue;
    -  556   +  525  142 
             final Set<VulnerableSoftware> cpes = cve.getCPEs(vendor, product);
    +  526  142 
             DependencyVersion bestGuess = new DependencyVersion("-");
    +  527  142 
             Confidence bestGuessConf = null;
    +  528  142 
             final List<IdentifierMatch> collected = new ArrayList<IdentifierMatch>();
    +  529  710 
             for (Confidence conf : Confidence.values()) {
    +  530  568 
                 for (Evidence evidence : dependency.getVersionEvidence().iterator(conf)) {
    +  531  384 
                     final DependencyVersion evVer = DependencyVersionUtil.parseVersion(evidence.getValue());
    +  532  384 
                     if (evVer == null) {
    +  533  0 
                         continue;
    +  534   
                     }
    -  557  160 
                     for (VulnerableSoftware vs : cpes) {
    -  558   +  535  384 
                     for (VulnerableSoftware vs : cpes) {
    +  536   
                         DependencyVersion dbVer;
    -  559  9104 
                         if (vs.getRevision() != null && !vs.getRevision().isEmpty()) {
    -  560  2855 
                             dbVer = DependencyVersionUtil.parseVersion(vs.getVersion() + "." + vs.getRevision());
    -  561   +  537  22696 
                         if (vs.getRevision() != null && !vs.getRevision().isEmpty()) {
    +  538  7070 
                             dbVer = DependencyVersionUtil.parseVersion(vs.getVersion() + "." + vs.getRevision());
    +  539   
                         } else {
    -  562  6249 
                             dbVer = DependencyVersionUtil.parseVersion(vs.getVersion());
    -  563   +  540  15626 
                             dbVer = DependencyVersionUtil.parseVersion(vs.getVersion());
    +  541   
                         }
    -  564  9104 
                         if (dbVer == null //special case, no version specified - everything is vulnerable
    -  565   +  542  22696 
                         if (dbVer == null //special case, no version specified - everything is vulnerable
    +  543   
                                 || evVer.equals(dbVer)) { //yeah! exact match
    -  566  169 
                             final String url = String.format("http://web.nvd.nist.gov/view/vuln/search?cpe=%s", URLEncoder.encode(vs.getName(), "UTF-8"));
    -  567  169 
                             final IdentifierMatch match = new IdentifierMatch("cpe", vs.getName(), url, IdentifierConfidence.EXACT_MATCH, conf);
    -  568  169 
                             collected.add(match);
    -  569  169 
                         } else {
    -  570   +  544  402 
                             final String url = String.format("http://web.nvd.nist.gov/view/vuln/search?cpe=%s", URLEncoder.encode(vs.getName(), "UTF-8"));
    +  545  402 
                             final IdentifierMatch match = new IdentifierMatch("cpe", vs.getName(), url, IdentifierConfidence.EXACT_MATCH, conf);
    +  546  402 
                             collected.add(match);
    +  547  402 
                         } else {
    +  548   
                             //TODO the following isn't quite right is it? need to think about this guessing game a bit more.
    -  571  8935 
                             if (evVer.getVersionParts().size() <= dbVer.getVersionParts().size()
    -  572   +  549  22294 
                             if (evVer.getVersionParts().size() <= dbVer.getVersionParts().size()
    +  550   
                                     && evVer.matchesAtLeastThreeLevels(dbVer)) {
    -  573  412 
                                 if (bestGuessConf == null || bestGuessConf.compareTo(conf) > 0) {
    -  574  10 
                                     if (bestGuess.getVersionParts().size() < dbVer.getVersionParts().size()) {
    -  575  10 
                                         bestGuess = dbVer;
    -  576  10 
                                         bestGuessConf = conf;
    -  577   +  551  832 
                                 if (bestGuessConf == null || bestGuessConf.compareTo(conf) > 0) {
    +  552  20 
                                     if (bestGuess.getVersionParts().size() < dbVer.getVersionParts().size()) {
    +  553  20 
                                         bestGuess = dbVer;
    +  554  20 
                                         bestGuessConf = conf;
    +  555   
                                     }
    -  578   +  556   
                                 }
    -  579   +  557   
                             }
    -  580   +  558   
                         }
    -  581  9104 
                     }
    -  582  160 
                     if (bestGuessConf == null || bestGuessConf.compareTo(conf) > 0) {
    -  583  49 
                         if (bestGuess.getVersionParts().size() < evVer.getVersionParts().size()) {
    -  584  49 
                             bestGuess = evVer;
    -  585  49 
                             bestGuessConf = conf;
    -  586   +  559  22696 
                     }
    +  560  384 
                     if (bestGuessConf == null || bestGuessConf.compareTo(conf) > 0) {
    +  561  98 
                         if (bestGuess.getVersionParts().size() < evVer.getVersionParts().size()) {
    +  562  98 
                             bestGuess = evVer;
    +  563  98 
                             bestGuessConf = conf;
    +  564   
                         }
    +  565   + 
                     }
    +  566  384 
                 }
    +  567   + 
             }
    +  568  142 
             final String cpeName = String.format("cpe:/a:%s:%s:%s", vendor, product, bestGuess.toString());
    +  569  142 
             final String url = null; //String.format("http://web.nvd.nist.gov/view/vuln/search?cpe=%s", URLEncoder.encode(cpeName, "UTF-8"));
    +  570  142 
             if (bestGuessConf == null) {
    +  571  24 
                 bestGuessConf = Confidence.LOW;
    +  572   + 
             }
    +  573  142 
             final IdentifierMatch match = new IdentifierMatch("cpe", cpeName, url, IdentifierConfidence.BEST_GUESS, bestGuessConf);
    +  574  142 
             collected.add(match);
    +  575   + 
     
    +  576  142 
             Collections.sort(collected);
    +  577  142 
             final IdentifierConfidence bestIdentifierQuality = collected.get(0).getConfidence();
    +  578  142 
             final Confidence bestEvidenceQuality = collected.get(0).getEvidenceConfidence();
    +  579  142 
             for (IdentifierMatch m : collected) {
    +  580  544 
                 if (bestIdentifierQuality.equals(m.getConfidence())
    +  581   + 
                         && bestEvidenceQuality.equals(m.getEvidenceConfidence())) {
    +  582  216 
                     final Identifier i = m.getIdentifier();
    +  583  216 
                     if (bestIdentifierQuality == IdentifierConfidence.BEST_GUESS) {
    +  584  46 
                         i.setConfidence(Confidence.LOW);
    +  585   + 
                     } else {
    +  586  170 
                         i.setConfidence(bestEvidenceQuality);
     587   
                     }
    -  588  160 
                 }
    +  588  216 
                     dependency.addIdentifier(i);
     589   - 
             }
    -  590  71 
             final String cpeName = String.format("cpe:/a:%s:%s:%s", vendor, product, bestGuess.toString());
    -  591  71 
             final String url = null; //String.format("http://web.nvd.nist.gov/view/vuln/search?cpe=%s", URLEncoder.encode(cpeName, "UTF-8"));
    -  592  71 
             if (bestGuessConf == null) {
    -  593  12 
                 bestGuessConf = Confidence.LOW;
    + 
                 }
    +  590  544 
             }
    +  591  142 
         }
    +  592   + 
     
    +  593   + 
         /**
     594   - 
             }
    -  595  71 
             final IdentifierMatch match = new IdentifierMatch("cpe", cpeName, url, IdentifierConfidence.BEST_GUESS, bestGuessConf);
    -  596  71 
             collected.add(match);
    + 
          * The confidence whether the identifier is an exact match, or a best guess.
    +  595   + 
          */
    +  596  6 
         private enum IdentifierConfidence {
     597   
     
    -  598  71 
             Collections.sort(collected);
    -  599  71 
             final IdentifierConfidence bestIdentifierQuality = collected.get(0).getConfidence();
    -  600  71 
             final Confidence bestEvidenceQuality = collected.get(0).getEvidenceConfidence();
    -  601  71 
             for (IdentifierMatch m : collected) {
    -  602  240 
                 if (bestIdentifierQuality.equals(m.getConfidence())
    -  603   - 
                         && bestEvidenceQuality.equals(m.getEvidenceConfidence())) {
    -  604  88 
                     dependency.addIdentifier(m.getIdentifier());
    -  605   - 
                 }
    -  606  240 
             }
    -  607  71 
         }
    -  608   - 
     
    -  609   - 
         /**
    -  610   - 
          * The confidence whether the identifier is an exact match, or a best guess.
    -  611   - 
          */
    -  612  3 
         private enum IdentifierConfidence {
    -  613   - 
     
    -  614   +  598   
             /**
    -  615   +  599   
              * An exact match for the CPE.
    -  616   +  600   
              */
    -  617  1 
             EXACT_MATCH,
    -  618   +  601  2 
             EXACT_MATCH,
    +  602   
             /**
    -  619   +  603   
              * A best guess for the CPE.
    -  620   +  604   
              */
    -  621  1 
             BEST_GUESS
    -  622   +  605  2 
             BEST_GUESS
    +  606   
         }
    -  623   +  607   
     
    -  624   +  608   
         /**
    -  625   - 
          * A simple object to hold an identifier and carry information about the
    -  626   - 
          * confidence in the identifier.
    -  627   +  609   + 
          * A simple object to hold an identifier and carry information about the confidence in the identifier.
    +  610   
          */
    -  628  265 
         private static class IdentifierMatch implements Comparable<IdentifierMatch> {
    -  629   +  611  674 
         private static class IdentifierMatch implements Comparable<IdentifierMatch> {
    +  612   
     
    -  630   +  613   
             /**
    -  631   +  614   
              * Constructs an IdentifierMatch.
    -  632   +  615   
              *
    -  633   +  616   
              * @param type the type of identifier (such as CPE)
    -  634   +  617   
              * @param value the value of the identifier
    -  635   +  618   
              * @param url the URL of the identifier
    -  636   - 
              * @param identifierConfidence the confidence in the identifier: best
    -  637   - 
              * guess or exact match
    -  638   - 
              * @param evidenceConfidence the confidence of the evidence used to find
    -  639   - 
              * the identifier
    -  640   +  619   + 
              * @param identifierConfidence the confidence in the identifier: best guess or exact match
    +  620   + 
              * @param evidenceConfidence the confidence of the evidence used to find the identifier
    +  621   
              */
    -  641  240 
             IdentifierMatch(String type, String value, String url, IdentifierConfidence identifierConfidence, Confidence evidenceConfidence) {
    -  642  240 
                 this.identifier = new Identifier(type, value, url);
    -  643  240 
                 this.confidence = identifierConfidence;
    -  644  240 
                 this.evidenceConfidence = evidenceConfidence;
    -  645  240 
             }
    -  646   +  622  544 
             IdentifierMatch(String type, String value, String url, IdentifierConfidence identifierConfidence, Confidence evidenceConfidence) {
    +  623  544 
                 this.identifier = new Identifier(type, value, url);
    +  624  544 
                 this.confidence = identifierConfidence;
    +  625  544 
                 this.evidenceConfidence = evidenceConfidence;
    +  626  544 
             }
    +  627   
             //<editor-fold defaultstate="collapsed" desc="Property implementations: evidenceConfidence, confidence, identifier">
    -  647   +  628   
             /**
    -  648   +  629   
              * The confidence in the evidence used to identify this match.
    -  649   +  630   
              */
    -  650   +  631   
             private Confidence evidenceConfidence;
    -  651   +  632   
     
    -  652   +  633   
             /**
    -  653   +  634   
              * Get the value of evidenceConfidence
    -  654   +  635   
              *
    -  655   +  636   
              * @return the value of evidenceConfidence
    -  656   +  637   
              */
    -  657   +  638   
             public Confidence getEvidenceConfidence() {
    -  658  263 
                 return evidenceConfidence;
    -  659   +  639  590 
                 return evidenceConfidence;
    +  640   
             }
    -  660   +  641   
     
    -  661   +  642   
             /**
    -  662   +  643   
              * Set the value of evidenceConfidence
    -  663   +  644   
              *
    -  664   +  645   
              * @param evidenceConfidence new value of evidenceConfidence
    -  665   +  646   
              */
    -  666   +  647   
             public void setEvidenceConfidence(Confidence evidenceConfidence) {
    -  667  0 
                 this.evidenceConfidence = evidenceConfidence;
    -  668  0 
             }
    -  669   +  648  0 
                 this.evidenceConfidence = evidenceConfidence;
    +  649  0 
             }
    +  650   
             /**
    -  670   +  651   
              * The confidence whether this is an exact match, or a best guess.
    -  671   +  652   
              */
    -  672   +  653   
             private IdentifierConfidence confidence;
    -  673   +  654   
     
    -  674   +  655   
             /**
    -  675   +  656   
              * Get the value of confidence.
    -  676   +  657   
              *
    -  677   +  658   
              * @return the value of confidence
    -  678   +  659   
              */
    -  679   +  660   
             public IdentifierConfidence getConfidence() {
    -  680  311 
                 return confidence;
    -  681   +  661  686 
                 return confidence;
    +  662   
             }
    -  682   +  663   
     
    -  683   +  664   
             /**
    -  684   +  665   
              * Set the value of confidence.
    -  685   +  666   
              *
    -  686   +  667   
              * @param confidence new value of confidence
    -  687   +  668   
              */
    -  688   +  669   
             public void setConfidence(IdentifierConfidence confidence) {
    -  689  0 
                 this.confidence = confidence;
    -  690  0 
             }
    -  691   +  670  0 
                 this.confidence = confidence;
    +  671  0 
             }
    +  672   
             /**
    -  692   +  673   
              * The CPE identifier.
    -  693   +  674   
              */
    -  694   +  675   
             private Identifier identifier;
    -  695   +  676   
     
    -  696   +  677   
             /**
    -  697   +  678   
              * Get the value of identifier.
    -  698   +  679   
              *
    -  699   +  680   
              * @return the value of identifier
    -  700   +  681   
              */
    -  701   +  682   
             public Identifier getIdentifier() {
    -  702  88 
                 return identifier;
    -  703   +  683  216 
                 return identifier;
    +  684   
             }
    -  704   +  685   
     
    -  705   +  686   
             /**
    -  706   +  687   
              * Set the value of identifier.
    -  707   +  688   
              *
    -  708   +  689   
              * @param identifier new value of identifier
    -  709   +  690   
              */
    -  710   +  691   
             public void setIdentifier(Identifier identifier) {
    -  711  0 
                 this.identifier = identifier;
    -  712  0 
             }
    -  713   +  692  0 
                 this.identifier = identifier;
    +  693  0 
             }
    +  694   
             //</editor-fold>
    -  714   +  695   
             //<editor-fold defaultstate="collapsed" desc="Standard implementations of toString, hashCode, and equals">
    -  715   +  696   
     
    -  716   +  697   
             /**
    -  717   +  698   
              * Standard toString() implementation.
    -  718   +  699   
              *
    -  719   +  700   
              * @return the string representation of the object
    -  720   +  701   
              */
    -  721   +  702   
             @Override
    -  722   +  703   
             public String toString() {
    -  723  0 
                 return "IdentifierMatch{" + "evidenceConfidence=" + evidenceConfidence
    -  724   +  704  0 
                 return "IdentifierMatch{" + "evidenceConfidence=" + evidenceConfidence
    +  705   
                         + ", confidence=" + confidence + ", identifier=" + identifier + '}';
    -  725   +  706   
             }
    -  726   +  707   
     
    -  727   +  708   
             /**
    -  728   +  709   
              * Standard hashCode() implementation.
    -  729   +  710   
              *
    -  730   +  711   
              * @return the hashCode
    -  731   +  712   
              */
    -  732   +  713   
             @Override
    -  733   +  714   
             public int hashCode() {
    -  734  0 
                 int hash = 5;
    -  735  0 
                 hash = 97 * hash + (this.evidenceConfidence != null ? this.evidenceConfidence.hashCode() : 0);
    -  736  0 
                 hash = 97 * hash + (this.confidence != null ? this.confidence.hashCode() : 0);
    -  737  0 
                 hash = 97 * hash + (this.identifier != null ? this.identifier.hashCode() : 0);
    -  738  0 
                 return hash;
    -  739   +  715  0 
                 int hash = 5;
    +  716  0 
                 hash = 97 * hash + (this.evidenceConfidence != null ? this.evidenceConfidence.hashCode() : 0);
    +  717  0 
                 hash = 97 * hash + (this.confidence != null ? this.confidence.hashCode() : 0);
    +  718  0 
                 hash = 97 * hash + (this.identifier != null ? this.identifier.hashCode() : 0);
    +  719  0 
                 return hash;
    +  720   
             }
    -  740   +  721   
     
    -  741   +  722   
             /**
    -  742   +  723   
              * Standard equals implementation.
    -  743   +  724   
              *
    -  744   +  725   
              * @param obj the object to compare
    -  745   +  726   
              * @return true if the objects are equal, otherwise false
    -  746   +  727   
              */
    -  747   +  728   
             @Override
    -  748   +  729   
             public boolean equals(Object obj) {
    -  749  0 
                 if (obj == null) {
    -  750  0 
                     return false;
    -  751   +  730  0 
                 if (obj == null) {
    +  731  0 
                     return false;
    +  732   
                 }
    -  752  0 
                 if (getClass() != obj.getClass()) {
    -  753  0 
                     return false;
    -  754   +  733  0 
                 if (getClass() != obj.getClass()) {
    +  734  0 
                     return false;
    +  735   
                 }
    -  755  0 
                 final IdentifierMatch other = (IdentifierMatch) obj;
    -  756  0 
                 if (this.evidenceConfidence != other.evidenceConfidence) {
    -  757  0 
                     return false;
    -  758   +  736  0 
                 final IdentifierMatch other = (IdentifierMatch) obj;
    +  737  0 
                 if (this.evidenceConfidence != other.evidenceConfidence) {
    +  738  0 
                     return false;
    +  739   
                 }
    -  759  0 
                 if (this.confidence != other.confidence) {
    -  760  0 
                     return false;
    -  761   +  740  0 
                 if (this.confidence != other.confidence) {
    +  741  0 
                     return false;
    +  742   
                 }
    -  762  0 
                 if (this.identifier != other.identifier && (this.identifier == null || !this.identifier.equals(other.identifier))) {
    -  763  0 
                     return false;
    -  764   +  743  0 
                 if (this.identifier != other.identifier && (this.identifier == null || !this.identifier.equals(other.identifier))) {
    +  744  0 
                     return false;
    +  745   
                 }
    -  765  0 
                 return true;
    -  766   +  746  0 
                 return true;
    +  747   
             }
    -  767   +  748   
             //</editor-fold>
    -  768   +  749   
     
    -  769   +  750   
             /**
    -  770   - 
              * Standard implementation of compareTo that compares identifier
    -  771   - 
              * confidence, evidence confidence, and then the identifier.
    -  772   +  751   + 
              * Standard implementation of compareTo that compares identifier confidence, evidence confidence, and then the
    +  752   + 
              * identifier.
    +  753   
              *
    -  773   +  754   
              * @param o the IdentifierMatch to compare to
    -  774   +  755   
              * @return the natural ordering of IdentifierMatch
    -  775   +  756   
              */
    -  776   +  757   
             @Override
    -  777   +  758   
             public int compareTo(IdentifierMatch o) {
    -  778  265 
                 int conf = this.confidence.compareTo(o.confidence);
    -  779  265 
                 if (conf == 0) {
    -  780  193 
                     conf = this.evidenceConfidence.compareTo(o.evidenceConfidence);
    -  781  193 
                     if (conf == 0) {
    -  782  83 
                         conf = identifier.compareTo(o.identifier);
    -  783   +  759  674 
                 int conf = this.confidence.compareTo(o.confidence);
    +  760  674 
                 if (conf == 0) {
    +  761  522 
                     conf = this.evidenceConfidence.compareTo(o.evidenceConfidence);
    +  762  522 
                     if (conf == 0) {
    +  763  286 
                         conf = identifier.compareTo(o.identifier);
    +  764   
                     }
    -  784   +  765   
                 }
    -  785  265 
                 return conf;
    -  786   +  766  674 
                 return conf;
    +  767   
             }
    -  787   +  768   
         }
    -  788   +  769   
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.CpeSuppressionAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.CpeSuppressionAnalyzer.html index 954b17082..834e43088 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.CpeSuppressionAnalyzer.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.CpeSuppressionAnalyzer.html @@ -24,143 +24,139 @@  3   
      *
     4   - 
      * Dependency-check-core is free software: you can redistribute it and/or modify it
    + 
      * Licensed under the Apache License, Version 2.0 (the "License");
     5   - 
      * under the terms of the GNU General Public License as published by the Free
    + 
      * you may not use this file except in compliance with the License.
     6   - 
      * Software Foundation, either version 3 of the License, or (at your option) any
    + 
      * You may obtain a copy of the License at
     7   - 
      * later version.
    + 
      *
     8   - 
      *
    + 
      *     http://www.apache.org/licenses/LICENSE-2.0
     9   - 
      * Dependency-check-core is distributed in the hope that it will be useful, but
    + 
      *
     10   - 
      * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
    + 
      * Unless required by applicable law or agreed to in writing, software
     11   - 
      * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
    + 
      * distributed under the License is distributed on an "AS IS" BASIS,
     12   - 
      * details.
    + 
      * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13   - 
      *
    + 
      * See the License for the specific language governing permissions and
     14   - 
      * You should have received a copy of the GNU General Public License along with
    + 
      * limitations under the License.
     15   - 
      * dependency-check-core. If not, see http://www.gnu.org/licenses/.
    + 
      *
     16   - 
      *
    -  17   
      * Copyright (c) 2013 Jeremy Long. All Rights Reserved.
    +  17   + 
      */
     18   - 
      */
    -  19   
     package org.owasp.dependencycheck.analyzer;
    +  19   + 
     
     20   - 
     
    -  21   
     import org.owasp.dependencycheck.Engine;
    -  22   +  21   
     import org.owasp.dependencycheck.dependency.Dependency;
    -  23   +  22   
     import org.owasp.dependencycheck.suppression.SuppressionRule;
    +  23   + 
     
     24   - 
     
    -  25   
     /**
    +  25   + 
      * The suppression analyzer processes an externally defined XML document that complies with the suppressions.xsd schema.
     26   - 
      * The suppression analyzer processes an externally defined XML document that
    + 
      * Any identified CPE entries within the dependencies that match will be removed.
     27   - 
      * complies with the suppressions.xsd schema. Any identified CPE entries within
    -  28   - 
      * the dependencies that match will be removed.
    -  29   
      *
    -  30   +  28   
      * @author Jeremy Long <jeremy.long@owasp.org>
    -  31   +  29   
      */
    -  32  1 
     public class CpeSuppressionAnalyzer extends AbstractSuppressionAnalyzer {
    -  33   +  30  2 
     public class CpeSuppressionAnalyzer extends AbstractSuppressionAnalyzer {
    +  31   
     
    -  34   +  32   
         //<editor-fold defaultstate="collapsed" desc="All standard implmentation details of Analyzer">
    -  35   +  33   
         /**
    -  36   +  34   
          * The name of the analyzer.
    -  37   +  35   
          */
    -  38   +  36   
         private static final String ANALYZER_NAME = "Cpe Suppression Analyzer";
    -  39   +  37   
         /**
    -  40   +  38   
          * The phase that this analyzer is intended to run in.
    +  39   + 
          */
    +  40  2 
         private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.POST_IDENTIFIER_ANALYSIS;
     41   - 
          */
    -  42  1 
         private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.POST_IDENTIFIER_ANALYSIS;
    + 
     
    +  42   + 
         /**
     43   - 
     
    -  44   - 
         /**
    -  45   
          * Returns the name of the analyzer.
    -  46   +  44   
          *
    -  47   +  45   
          * @return the name of the analyzer.
    +  46   + 
          */
    +  47   + 
         @Override
     48   - 
          */
    -  49   - 
         @Override
    -  50   
         public String getName() {
    -  51  9 
             return ANALYZER_NAME;
    +  49  18 
             return ANALYZER_NAME;
    +  50   + 
         }
    +  51   + 
     
     52   - 
         }
    -  53   - 
     
    -  54   
         /**
    -  55   +  53   
          * Returns the phase that the analyzer is intended to run in.
    -  56   +  54   
          *
    -  57   +  55   
          * @return the phase that the analyzer is intended to run in.
    -  58   +  56   
          */
    -  59   +  57   
         @Override
    -  60   +  58   
         public AnalysisPhase getAnalysisPhase() {
    -  61  6 
             return ANALYSIS_PHASE;
    -  62   +  59  12 
             return ANALYSIS_PHASE;
    +  60   
         }
    -  63   +  61   
         //</editor-fold>
    -  64   +  62   
     
    -  65   +  63   
         @Override
    -  66   +  64   
         public void analyze(final Dependency dependency, final Engine engine) throws AnalysisException {
    -  67   +  65   
     
    -  68  9 
             if (getRules() == null || getRules().size() <= 0) {
    -  69  9 
                 return;
    -  70   +  66  18 
             if (getRules() == null || getRules().size() <= 0) {
    +  67  18 
                 return;
    +  68   
             }
    -  71   +  69   
     
    -  72  0 
             for (final SuppressionRule rule : getRules()) {
    -  73  0 
                 rule.process(dependency);
    -  74  0 
             }
    -  75  0 
         }
    -  76   +  70  0 
             for (final SuppressionRule rule : getRules()) {
    +  71  0 
                 rule.process(dependency);
    +  72  0 
             }
    +  73  0 
         }
    +  74   
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.DependencyBundlingAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.DependencyBundlingAnalyzer.html index accf10ae5..742bdd88a 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.DependencyBundlingAnalyzer.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.DependencyBundlingAnalyzer.html @@ -12,7 +12,7 @@
     
    - +
    Classes in this File Line Coverage Branch Coverage Complexity
    DependencyBundlingAnalyzer
    33%
    37/109
    26%
    25/94
    		6.5
    DependencyBundlingAnalyzer
    48%
    71/145
    40%
    60/150
    		7.846
     
    @@ -24,61 +24,61 @@  3   
      *
     4   - 
      * Dependency-check-core is free software: you can redistribute it and/or modify it
    + 
      * Licensed under the Apache License, Version 2.0 (the "License");
     5   - 
      * under the terms of the GNU General Public License as published by the Free
    + 
      * you may not use this file except in compliance with the License.
     6   - 
      * Software Foundation, either version 3 of the License, or (at your option) any
    + 
      * You may obtain a copy of the License at
     7   - 
      * later version.
    + 
      *
     8   - 
      *
    + 
      *     http://www.apache.org/licenses/LICENSE-2.0
     9   - 
      * Dependency-check-core is distributed in the hope that it will be useful, but
    + 
      *
     10   - 
      * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
    + 
      * Unless required by applicable law or agreed to in writing, software
     11   - 
      * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
    + 
      * distributed under the License is distributed on an "AS IS" BASIS,
     12   - 
      * details.
    + 
      * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13   - 
      *
    + 
      * See the License for the specific language governing permissions and
     14   - 
      * You should have received a copy of the GNU General Public License along with
    + 
      * limitations under the License.
     15   - 
      * dependency-check-core. If not, see http://www.gnu.org/licenses/.
    -  16   
      *
    -  17   +  16   
      * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
    -  18   +  17   
      */
    -  19   +  18   
     package org.owasp.dependencycheck.analyzer;
    -  20   +  19   
     
    -  21   +  20   
     import java.io.File;
    -  22   +  21   
     import java.util.HashSet;
    -  23   +  22   
     import java.util.Iterator;
    -  24   +  23   
     import java.util.ListIterator;
    -  25   +  24   
     import java.util.Set;
    -  26   +  25   
     import java.util.logging.Level;
    -  27   +  26   
     import java.util.logging.Logger;
    -  28   +  27   
     import java.util.regex.Matcher;
    -  29   +  28   
     import java.util.regex.Pattern;
    -  30   +  29   
     import org.owasp.dependencycheck.Engine;
    -  31   +  30   
     import org.owasp.dependencycheck.dependency.Dependency;
    +  31   + 
     import org.owasp.dependencycheck.dependency.Identifier;
     32   
     import org.owasp.dependencycheck.utils.DependencyVersion;
     33   @@ -90,498 +90,610 @@  36   
     /**
     37   - 
      * <p>This analyzer ensures dependencies that should be grouped together, to
    + 
      * <p>
     38   - 
      * remove excess noise from the report, are grouped. An example would be Spring,
    + 
      * This analyzer ensures dependencies that should be grouped together, to remove excess noise from the report, are
     39   - 
      * Spring Beans, Spring MVC, etc. If they are all for the same version and have
    + 
      * grouped. An example would be Spring, Spring Beans, Spring MVC, etc. If they are all for the same version and have the
     40   - 
      * the same relative path then these should be grouped into a single dependency
    + 
      * same relative path then these should be grouped into a single dependency under the core/main library.</p>
     41   - 
      * under the core/main library.</p>
    + 
      * <p>
     42   - 
      * <p>Note, this grouping only works on dependencies with identified CVE
    + 
      * Note, this grouping only works on dependencies with identified CVE entries</p>
     43   - 
      * entries</p>
    -  44   
      *
    -  45   +  44   
      * @author Jeremy Long <jeremy.long@owasp.org>
    -  46   +  45   
      */
    -  47  1 
     public class DependencyBundlingAnalyzer extends AbstractAnalyzer implements Analyzer {
    +  46  12 
     public class DependencyBundlingAnalyzer extends AbstractAnalyzer implements Analyzer {
    +  47   + 
     
     48   - 
     
    -  49   
         //<editor-fold defaultstate="collapsed" desc="Constants and Member Variables">
    +  49   + 
         /**
     50   - 
         /**
    -  51   
          * A pattern for obtaining the first part of a filename.
    -  52   +  51   
          */
    -  53  1 
         private static final Pattern STARTING_TEXT_PATTERN = Pattern.compile("^[a-zA-Z]*");
    +  52  2 
         private static final Pattern STARTING_TEXT_PATTERN = Pattern.compile("^[a-zA-Z]*");
    +  53   + 
         /**
     54   - 
         /**
    -  55   
          * a flag indicating if this analyzer has run. This analyzer only runs once.
    -  56   +  55   
          */
    -  57  1 
         private boolean analyzed = false;
    +  56  12 
         private boolean analyzed = false;
    +  57   + 
         //</editor-fold>
     58   - 
         //</editor-fold>
    -  59   
         //<editor-fold defaultstate="collapsed" desc="All standard implementation details of Analyzer">
    +  59   + 
         /**
     60   - 
         /**
    -  61   
          * The set of file extensions supported by this analyzer.
    -  62   +  61   
          */
    -  63  1 
         private static final Set<String> EXTENSIONS = null;
    +  62  2 
         private static final Set<String> EXTENSIONS = null;
    +  63   + 
         /**
     64   - 
         /**
    -  65   
          * The name of the analyzer.
    +  65   + 
          */
     66   - 
          */
    -  67   
         private static final String ANALYZER_NAME = "Dependency Bundling Analyzer";
    +  67   + 
         /**
     68   - 
         /**
    -  69   
          * The phase that this analyzer is intended to run in.
    -  70   +  69   
          */
    -  71  1 
         private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.PRE_FINDING_ANALYSIS;
    +  70  2 
         private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.PRE_FINDING_ANALYSIS;
    +  71   + 
     
     72   - 
     
    + 
         /**
     73   - 
         /**
    -  74   
          * Returns a list of file EXTENSIONS supported by this analyzer.
    +  74   + 
          *
     75   - 
          *
    -  76   
          * @return a list of file EXTENSIONS supported by this analyzer.
    +  76   + 
          */
     77   - 
          */
    -  78   
         public Set<String> getSupportedExtensions() {
    -  79  132 
             return EXTENSIONS;
    +  78  266 
             return EXTENSIONS;
    +  79   + 
         }
     80   - 
         }
    + 
     
     81   - 
     
    + 
         /**
     82   - 
         /**
    -  83   
          * Returns the name of the analyzer.
    +  83   + 
          *
     84   - 
          *
    -  85   
          * @return the name of the analyzer.
    +  85   + 
          */
     86   - 
          */
    -  87   
         public String getName() {
    -  88  9 
             return ANALYZER_NAME;
    +  87  20 
             return ANALYZER_NAME;
    +  88   + 
         }
     89   - 
         }
    + 
     
     90   - 
     
    + 
         /**
     91   - 
         /**
    -  92   
          * Returns whether or not this analyzer can process the given extension.
    +  92   + 
          *
     93   - 
          *
    -  94   
          * @param extension the file extension to test for support
    +  94   + 
          * @return whether or not the specified file extension is supported by this analyzer.
     95   - 
          * @return whether or not the specified file extension is supported by this
    + 
          */
     96   - 
          * analyzer.
    -  97   - 
          */
    -  98   
         public boolean supportsExtension(String extension) {
    -  99  9 
             return true;
    +  97  20 
             return true;
    +  98   + 
         }
    +  99   + 
     
     100   - 
         }
    + 
         /**
     101   - 
     
    -  102   - 
         /**
    -  103   
          * Returns the phase that the analyzer is intended to run in.
    -  104   +  102   
          *
    -  105   +  103   
          * @return the phase that the analyzer is intended to run in.
    -  106   +  104   
          */
    -  107   +  105   
         public AnalysisPhase getAnalysisPhase() {
    -  108  6 
             return ANALYSIS_PHASE;
    -  109   +  106  14 
             return ANALYSIS_PHASE;
    +  107   
         }
    -  110   +  108   
         //</editor-fold>
    +  109   + 
     
    +  110   + 
         /**
     111   - 
     
    + 
          * Analyzes a set of dependencies. If they have been found to have the same base path and the same set of
     112   - 
         /**
    + 
          * identifiers they are likely related. The related dependencies are bundled into a single reportable item.
     113   - 
          * Analyzes a set of dependencies. If they have been found to have the same
    + 
          *
     114   - 
          * base path and the same set of identifiers they are likely related. The
    -  115   - 
          * related dependencies are bundled into a single reportable item.
    -  116   - 
          *
    -  117   
          * @param ignore this analyzer ignores the dependency being analyzed
    -  118   +  115   
          * @param engine the engine that is scanning the dependencies
    -  119   - 
          * @throws AnalysisException is thrown if there is an error reading the JAR
    -  120   - 
          * file.
    -  121   +  116   + 
          * @throws AnalysisException is thrown if there is an error reading the JAR file.
    +  117   
          */
    -  122   +  118   
         @Override
    -  123   +  119   
         public void analyze(Dependency ignore, Engine engine) throws AnalysisException {
    -  124  9 
             if (!analyzed) {
    -  125  1 
                 analyzed = true;
    -  126  1 
                 final Set<Dependency> dependenciesToRemove = new HashSet<Dependency>();
    -  127  1 
                 final ListIterator<Dependency> mainIterator = engine.getDependencies().listIterator();
    -  128   +  120  18 
             if (!analyzed) {
    +  121  2 
                 analyzed = true;
    +  122  2 
                 final Set<Dependency> dependenciesToRemove = new HashSet<Dependency>();
    +  123  2 
                 final ListIterator<Dependency> mainIterator = engine.getDependencies().listIterator();
    +  124   
                 //for (Dependency nextDependency : engine.getDependencies()) {
    -  129  4 
                 while (mainIterator.hasNext()) {
    -  130  3 
                     final Dependency dependency = mainIterator.next();
    -  131  3 
                     if (mainIterator.hasNext()) {
    -  132  2 
                         final ListIterator<Dependency> subIterator = engine.getDependencies().listIterator(mainIterator.nextIndex());
    -  133  5 
                         while (subIterator.hasNext()) {
    -  134  3 
                             final Dependency nextDependency = subIterator.next();
    -  135   - 
     
    -  136  3 
                             if (identifiersMatch(dependency, nextDependency)
    -  137   - 
                                     && hasSameBasePath(dependency, nextDependency)
    -  138   - 
                                     && fileNameMatch(dependency, nextDependency)) {
    -  139   - 
     
    -  140  0 
                                 if (isCore(dependency, nextDependency)) {
    -  141  0 
                                     dependency.addRelatedDependency(nextDependency);
    -  142   - 
                                     //move any "related dependencies" to the new "parent" dependency
    -  143  0 
                                     final Iterator<Dependency> i = nextDependency.getRelatedDependencies().iterator();
    -  144  0 
                                     while (i.hasNext()) {
    -  145  0 
                                         dependency.addRelatedDependency(i.next());
    -  146  0 
                                         i.remove();
    -  147   - 
                                     }
    -  148  0 
                                     dependenciesToRemove.add(nextDependency);
    -  149  0 
                                 } else {
    -  150  0 
                                     nextDependency.addRelatedDependency(dependency);
    -  151   - 
                                     //move any "related dependencies" to the new "parent" dependency
    -  152  0 
                                     final Iterator<Dependency> i = dependency.getRelatedDependencies().iterator();
    -  153  0 
                                     while (i.hasNext()) {
    -  154  0 
                                         nextDependency.addRelatedDependency(i.next());
    -  155  0 
                                         i.remove();
    -  156   - 
                                     }
    -  157  0 
                                     dependenciesToRemove.add(dependency);
    -  158   +  125  8 
                 while (mainIterator.hasNext()) {
    +  126  6 
                     final Dependency dependency = mainIterator.next();
    +  127  6 
                     if (mainIterator.hasNext()) {
    +  128  4 
                         final ListIterator<Dependency> subIterator = engine.getDependencies().listIterator(mainIterator.nextIndex());
    +  129  10 
                         while (subIterator.hasNext()) {
    +  130  6 
                             final Dependency nextDependency = subIterator.next();
    +  131  6 
                             if (isShadedJar(dependency, nextDependency)) {
    +  132  0 
                                 if (dependency.getFileName().toLowerCase().endsWith("pom.xml")) {
    +  133  0 
                                     dependenciesToRemove.add(dependency);
    +  134   + 
                                 } else {
    +  135  0 
                                     dependenciesToRemove.add(nextDependency);
    +  136   
                                 }
    -  159   +  137  6 
                             } else if (hashesMatch(dependency, nextDependency)) {
    +  138  0 
                                 if (isCore(dependency, nextDependency)) {
    +  139  0 
                                     mergeDependencies(dependency, nextDependency, dependenciesToRemove);
    +  140   + 
                                 } else {
    +  141  0 
                                     mergeDependencies(nextDependency, dependency, dependenciesToRemove);
    +  142   + 
                                 }
    +  143  6 
                             } else if (cpeIdentifiersMatch(dependency, nextDependency)
    +  144   + 
                                     && hasSameBasePath(dependency, nextDependency)
    +  145   + 
                                     && fileNameMatch(dependency, nextDependency)) {
    +  146   + 
     
    +  147  0 
                                 if (isCore(dependency, nextDependency)) {
    +  148  0 
                                     mergeDependencies(dependency, nextDependency, dependenciesToRemove);
    +  149   + 
                                 } else {
    +  150  0 
                                     mergeDependencies(nextDependency, dependency, dependenciesToRemove);
    +  151   + 
                                 }
    +  152   
                             }
    -  160  3 
                         }
    -  161   +  153  6 
                         }
    +  154   
                     }
    -  162  3 
                 }
    -  163   +  155  6 
                 }
    +  156   
                 //removing dependencies here as ensuring correctness and avoiding ConcurrentUpdateExceptions
    -  164   +  157   
                 // was difficult because of the inner iterator.
    -  165  1 
                 for (Dependency d : dependenciesToRemove) {
    -  166  0 
                     engine.getDependencies().remove(d);
    -  167  0 
                 }
    +  158  2 
                 for (Dependency d : dependenciesToRemove) {
    +  159  0 
                     engine.getDependencies().remove(d);
    +  160  0 
                 }
    +  161   + 
             }
    +  162  18 
         }
    +  163   + 
     
    +  164   + 
         /**
    +  165   + 
          * Adds the relatedDependency to the dependency's related dependencies.
    +  166   + 
          *
    +  167   + 
          * @param dependency the main dependency
     168   - 
             }
    -  169  9 
         }
    + 
          * @param relatedDependency a collection of dependencies to be removed from the main analysis loop, this is the
    +  169   + 
          * source of dependencies to remove
     170   - 
     
    + 
          * @param dependenciesToRemove a collection of dependencies that will be removed from the main analysis loop, this
     171   - 
         /**
    + 
          * function adds to this collection
     172   - 
          * Attempts to trim a maven repo to a common base path. This is typically
    + 
          */
     173   - 
          * [drive]\[repo_location]\repository\[path1]\[path2].
    -  174   - 
          *
    -  175   - 
          * @param path the path to trim
    -  176   - 
          * @return a string representing the base path.
    -  177   - 
          */
    -  178   - 
         private String getBaseRepoPath(final String path) {
    -  179  0 
             int pos = path.indexOf("repository" + File.separator) + 11;
    -  180  0 
             if (pos < 0) {
    -  181  0 
                 return path;
    + 
         private void mergeDependencies(final Dependency dependency, final Dependency relatedDependency, final Set<Dependency> dependenciesToRemove) {
    +  174  0 
             dependency.addRelatedDependency(relatedDependency);
    +  175  0 
             final Iterator<Dependency> i = relatedDependency.getRelatedDependencies().iterator();
    +  176  0 
             while (i.hasNext()) {
    +  177  0 
                 dependency.addRelatedDependency(i.next());
    +  178  0 
                 i.remove();
    +  179   + 
             }
    +  180  0 
             dependenciesToRemove.add(relatedDependency);
    +  181  0 
         }
     182   - 
             }
    -  183  0 
             int tmp = path.indexOf(File.separator, pos);
    -  184  0 
             if (tmp <= 0) {
    -  185  0 
                 return path;
    -  186   - 
             }
    -  187  0 
             if (tmp > 0) {
    -  188  0 
                 pos = tmp + 1;
    -  189   - 
             }
    -  190  0 
             tmp = path.indexOf(File.separator, pos);
    -  191  0 
             if (tmp > 0) {
    -  192  0 
                 pos = tmp + 1;
    -  193   - 
             }
    -  194  0 
             return path.substring(0, pos);
    -  195   - 
         }
    -  196   
     
    -  197   +  183   
         /**
    -  198   - 
          * Returns true if the file names (and version if it exists) of the two
    -  199   - 
          * dependencies are sufficiently similar.
    -  200   +  184   + 
          * Attempts to trim a maven repo to a common base path. This is typically
    +  185   + 
          * [drive]\[repo_location]\repository\[path1]\[path2].
    +  186   
          *
    -  201   - 
          * @param dependency1 a dependency2 to compare
    -  202   - 
          * @param dependency2 a dependency2 to compare
    -  203   - 
          * @return true if the identifiers in the two supplied dependencies are
    -  204   - 
          * equal
    -  205   +  187   + 
          * @param path the path to trim
    +  188   + 
          * @return a string representing the base path.
    +  189   
          */
    -  206   - 
         private boolean fileNameMatch(Dependency dependency1, Dependency dependency2) {
    -  207  0 
             if (dependency1 == null || dependency1.getFileName() == null
    -  208   - 
                     || dependency2 == null || dependency2.getFileName() == null) {
    -  209  0 
                 return false;
    -  210   +  190   + 
         private String getBaseRepoPath(final String path) {
    +  191  0 
             int pos = path.indexOf("repository" + File.separator) + 11;
    +  192  0 
             if (pos < 0) {
    +  193  0 
                 return path;
    +  194   
             }
    -  211  0 
             String fileName1 = dependency1.getFileName();
    -  212  0 
             String fileName2 = dependency2.getFileName();
    -  213   - 
     
    -  214   - 
             //update to deal with archive analyzer, the starting name maybe the same
    -  215   - 
             // as this is incorrectly looking at the starting path
    -  216  0 
             final File one = new File(fileName1);
    -  217  0 
             final File two = new File(fileName2);
    -  218  0 
             final String oneParent = one.getParent();
    -  219  0 
             final String twoParent = two.getParent();
    -  220  0 
             if (oneParent != null) {
    -  221  0 
                 if (oneParent.equals(twoParent)) {
    -  222  0 
                     fileName1 = one.getName();
    -  223  0 
                     fileName2 = two.getName();
    -  224   - 
                 } else {
    -  225  0 
                     return false;
    -  226   - 
                 }
    -  227  0 
             } else if (twoParent != null) {
    -  228  0 
                 return false;
    -  229   +  195  0 
             int tmp = path.indexOf(File.separator, pos);
    +  196  0 
             if (tmp <= 0) {
    +  197  0 
                 return path;
    +  198   
             }
    -  230   - 
     
    -  231   - 
             //version check
    -  232  0 
             final DependencyVersion version1 = DependencyVersionUtil.parseVersion(fileName1);
    -  233  0 
             final DependencyVersion version2 = DependencyVersionUtil.parseVersion(fileName2);
    -  234  0 
             if (version1 != null && version2 != null) {
    -  235  0 
                 if (!version1.equals(version2)) {
    -  236  0 
                     return false;
    -  237   - 
                 }
    -  238   +  199  0 
             if (tmp > 0) {
    +  200  0 
                 pos = tmp + 1;
    +  201   
             }
    -  239   - 
     
    -  240   - 
             //filename check
    -  241  0 
             final Matcher match1 = STARTING_TEXT_PATTERN.matcher(fileName1);
    -  242  0 
             final Matcher match2 = STARTING_TEXT_PATTERN.matcher(fileName2);
    -  243  0 
             if (match1.find() && match2.find()) {
    -  244  0 
                 return match1.group().equals(match2.group());
    -  245   +  202  0 
             tmp = path.indexOf(File.separator, pos);
    +  203  0 
             if (tmp > 0) {
    +  204  0 
                 pos = tmp + 1;
    +  205   
             }
    -  246   - 
     
    -  247  0 
             return false;
    -  248   +  206  0 
             return path.substring(0, pos);
    +  207   
         }
    +  208   + 
     
    +  209   + 
         /**
    +  210   + 
          * Returns true if the file names (and version if it exists) of the two dependencies are sufficiently similar.
    +  211   + 
          *
    +  212   + 
          * @param dependency1 a dependency2 to compare
    +  213   + 
          * @param dependency2 a dependency2 to compare
    +  214   + 
          * @return true if the identifiers in the two supplied dependencies are equal
    +  215   + 
          */
    +  216   + 
         private boolean fileNameMatch(Dependency dependency1, Dependency dependency2) {
    +  217  0 
             if (dependency1 == null || dependency1.getFileName() == null
    +  218   + 
                     || dependency2 == null || dependency2.getFileName() == null) {
    +  219  0 
                 return false;
    +  220   + 
             }
    +  221  0 
             String fileName1 = dependency1.getFileName();
    +  222  0 
             String fileName2 = dependency2.getFileName();
    +  223   + 
     
    +  224   + 
             //update to deal with archive analyzer, the starting name maybe the same
    +  225   + 
             // as this is incorrectly looking at the starting path
    +  226  0 
             final File one = new File(fileName1);
    +  227  0 
             final File two = new File(fileName2);
    +  228  0 
             final String oneParent = one.getParent();
    +  229  0 
             final String twoParent = two.getParent();
    +  230  0 
             if (oneParent != null) {
    +  231  0 
                 if (oneParent.equals(twoParent)) {
    +  232  0 
                     fileName1 = one.getName();
    +  233  0 
                     fileName2 = two.getName();
    +  234   + 
                 } else {
    +  235  0 
                     return false;
    +  236   + 
                 }
    +  237  0 
             } else if (twoParent != null) {
    +  238  0 
                 return false;
    +  239   + 
             }
    +  240   + 
     
    +  241   + 
             //version check
    +  242  0 
             final DependencyVersion version1 = DependencyVersionUtil.parseVersion(fileName1);
    +  243  0 
             final DependencyVersion version2 = DependencyVersionUtil.parseVersion(fileName2);
    +  244  0 
             if (version1 != null && version2 != null) {
    +  245  0 
                 if (!version1.equals(version2)) {
    +  246  0 
                     return false;
    +  247   + 
                 }
    +  248   + 
             }
     249   
     
     250   - 
         /**
    -  251   - 
          * Returns true if the identifiers in the two supplied dependencies are
    -  252   - 
          * equal.
    -  253   - 
          *
    -  254   - 
          * @param dependency1 a dependency2 to compare
    + 
             //filename check
    +  251  0 
             final Matcher match1 = STARTING_TEXT_PATTERN.matcher(fileName1);
    +  252  0 
             final Matcher match2 = STARTING_TEXT_PATTERN.matcher(fileName2);
    +  253  0 
             if (match1.find() && match2.find()) {
    +  254  0 
                 return match1.group().equals(match2.group());
     255   - 
          * @param dependency2 a dependency2 to compare
    + 
             }
     256   - 
          * @return true if the identifiers in the two supplied dependencies are
    -  257   - 
          * equal
    + 
     
    +  257  0 
             return false;
     258   - 
          */
    + 
         }
     259   - 
         private boolean identifiersMatch(Dependency dependency1, Dependency dependency2) {
    -  260  3 
             if (dependency1 == null || dependency1.getIdentifiers() == null
    + 
     
    +  260   + 
         /**
     261   - 
                     || dependency2 == null || dependency2.getIdentifiers() == null) {
    -  262  0 
                 return false;
    + 
          * Returns true if the CPE identifiers in the two supplied dependencies are equal.
    +  262   + 
          *
     263   - 
             }
    -  264  3 
             final boolean matches = dependency1.getIdentifiers().size() > 0
    + 
          * @param dependency1 a dependency2 to compare
    +  264   + 
          * @param dependency2 a dependency2 to compare
     265   - 
                     && dependency2.getIdentifiers().equals(dependency1.getIdentifiers());
    -  266  3 
             if (LogUtils.isVerboseLoggingEnabled()) {
    -  267  0 
                 final String msg = String.format("IdentifiersMatch=%s (%s, %s)", matches, dependency1.getFileName(), dependency2.getFileName());
    -  268  0 
                 Logger.getLogger(DependencyBundlingAnalyzer.class.getName()).log(Level.FINE, msg);
    + 
          * @return true if the identifiers in the two supplied dependencies are equal
    +  266   + 
          */
    +  267   + 
         private boolean cpeIdentifiersMatch(Dependency dependency1, Dependency dependency2) {
    +  268  6 
             if (dependency1 == null || dependency1.getIdentifiers() == null
     269   - 
             }
    -  270  3 
             return matches;
    + 
                     || dependency2 == null || dependency2.getIdentifiers() == null) {
    +  270  0 
                 return false;
     271   - 
         }
    -  272   - 
     
    -  273   - 
         /**
    -  274   - 
          * Determines if the two dependencies have the same base path.
    -  275   - 
          *
    -  276   - 
          * @param dependency1 a Dependency object
    -  277   - 
          * @param dependency2 a Dependency object
    + 
             }
    +  272  6 
             boolean matches = false;
    +  273  6 
             int cpeCount1 = 0;
    +  274  6 
             int cpeCount2 = 0;
    +  275  6 
             for (Identifier i : dependency1.getIdentifiers()) {
    +  276  6 
                 if ("cpe".equals(i.getType())) {
    +  277  6 
                     cpeCount1 += 1;
     278   - 
          * @return true if the base paths of the dependencies are identical
    -  279   - 
          */
    -  280   - 
         private boolean hasSameBasePath(Dependency dependency1, Dependency dependency2) {
    -  281  1 
             if (dependency1 == null || dependency2 == null) {
    -  282  0 
                 return false;
    + 
                 }
    +  279  6 
             }
    +  280  6 
             for (Identifier i : dependency2.getIdentifiers()) {
    +  281  10 
                 if ("cpe".equals(i.getType())) {
    +  282  6 
                     cpeCount2 += 1;
     283   - 
             }
    -  284  1 
             final File lFile = new File(dependency1.getFilePath());
    -  285  1 
             String left = lFile.getParent();
    -  286  1 
             final File rFile = new File(dependency2.getFilePath());
    -  287  1 
             String right = rFile.getParent();
    -  288  1 
             if (left == null) {
    -  289  0 
                 return right == null;
    + 
                 }
    +  284  10 
             }
    +  285  6 
             if (cpeCount1 > 0 && cpeCount1 == cpeCount2) {
    +  286  6 
                 for (Identifier i : dependency1.getIdentifiers()) {
    +  287  6 
                     matches |= dependency2.getIdentifiers().contains(i);
    +  288  6 
                     if (!matches) {
    +  289  4 
                         break;
     290   + 
                     }
    +  291  2 
                 }
    +  292   
             }
    -  291  1 
             if (left.equalsIgnoreCase(right)) {
    -  292  0 
                 return true;
    -  293   +  293  6 
             if (LogUtils.isVerboseLoggingEnabled()) {
    +  294  0 
                 final String msg = String.format("IdentifiersMatch=%s (%s, %s)", matches, dependency1.getFileName(), dependency2.getFileName());
    +  295  0 
                 Logger.getLogger(DependencyBundlingAnalyzer.class.getName()).log(Level.FINE, msg);
    +  296   
             }
    -  294  1 
             if (left.matches(".*[/\\\\]repository[/\\\\].*") && right.matches(".*[/\\\\]repository[/\\\\].*")) {
    -  295  0 
                 left = getBaseRepoPath(left);
    -  296  0 
                 right = getBaseRepoPath(right);
    -  297   - 
             }
    -  298  1 
             return left.equalsIgnoreCase(right);
    -  299   +  297  6 
             return matches;
    +  298   
         }
    -  300   +  299   
     
    -  301   +  300   
         /**
    +  301   + 
          * Determines if the two dependencies have the same base path.
     302   - 
          * This is likely a very broken attempt at determining if the 'left'
    -  303   - 
          * dependency is the 'core' library in comparison to the 'right' library.
    -  304   
          *
    +  303   + 
          * @param dependency1 a Dependency object
    +  304   + 
          * @param dependency2 a Dependency object
     305   - 
          * @param left the dependency to test
    + 
          * @return true if the base paths of the dependencies are identical
     306   - 
          * @param right the dependency to test against
    -  307   - 
          * @return a boolean indicating whether or not the left dependency should be
    -  308   - 
          * considered the "core" version.
    -  309   
          */
    +  307   + 
         private boolean hasSameBasePath(Dependency dependency1, Dependency dependency2) {
    +  308  2 
             if (dependency1 == null || dependency2 == null) {
    +  309  0 
                 return false;
     310   - 
         private boolean isCore(Dependency left, Dependency right) {
    -  311  0 
             final String leftName = left.getFileName().toLowerCase();
    -  312  0 
             final String rightName = right.getFileName().toLowerCase();
    -  313   - 
             final boolean returnVal;
    -  314  0 
             if (rightName.contains("core") && !leftName.contains("core")) {
    -  315  0 
                 returnVal = false;
    -  316  0 
             } else if (!rightName.contains("core") && leftName.contains("core")) {
    -  317  0 
                 returnVal = true;
    -  318   - 
             } else {
    -  319   - 
                 /*
    + 
             }
    +  311  2 
             final File lFile = new File(dependency1.getFilePath());
    +  312  2 
             String left = lFile.getParent();
    +  313  2 
             final File rFile = new File(dependency2.getFilePath());
    +  314  2 
             String right = rFile.getParent();
    +  315  2 
             if (left == null) {
    +  316  0 
                 return right == null;
    +  317   + 
             }
    +  318  2 
             if (left.equalsIgnoreCase(right)) {
    +  319  0 
                 return true;
     320   - 
                  * considered splitting the names up and comparing the components,
    -  321   - 
                  * but decided that the file name length should be sufficient as the
    -  322   - 
                  * "core" component, if this follows a normal naming protocol should
    -  323   - 
                  * be shorter:
    + 
             }
    +  321  2 
             if (left.matches(".*[/\\\\]repository[/\\\\].*") && right.matches(".*[/\\\\]repository[/\\\\].*")) {
    +  322  0 
                 left = getBaseRepoPath(left);
    +  323  0 
                 right = getBaseRepoPath(right);
     324   - 
                  * axis2-saaj-1.4.1.jar
    -  325   - 
                  * axis2-1.4.1.jar       <-----
    -  326   - 
                  * axis2-kernal-1.4.1.jar
    + 
             }
    +  325  2 
             if (left.equalsIgnoreCase(right)) {
    +  326  0 
                 return true;
     327   - 
                  */
    -  328  0 
                 returnVal = leftName.length() <= rightName.length();
    -  329   
             }
    -  330  0 
             if (LogUtils.isVerboseLoggingEnabled()) {
    -  331  0 
                 final String msg = String.format("IsCore=%s (%s, %s)", returnVal, left.getFileName(), right.getFileName());
    -  332  0 
                 Logger.getLogger(DependencyBundlingAnalyzer.class.getName()).log(Level.FINE, msg);
    -  333   - 
             }
    -  334  0 
             return returnVal;
    +  328   + 
             //new code
    +  329  2 
             for (Dependency child : dependency2.getRelatedDependencies()) {
    +  330  0 
                 if (hasSameBasePath(dependency1, child)) {
    +  331  0 
                     return true;
    +  332   + 
                 }
    +  333  0 
             }
    +  334  2 
             return false;
     335   
         }
     336   + 
     
    +  337   + 
         /**
    +  338   + 
          * This is likely a very broken attempt at determining if the 'left' dependency is the 'core' library in comparison
    +  339   + 
          * to the 'right' library.
    +  340   + 
          *
    +  341   + 
          * @param left the dependency to test
    +  342   + 
          * @param right the dependency to test against
    +  343   + 
          * @return a boolean indicating whether or not the left dependency should be considered the "core" version.
    +  344   + 
          */
    +  345   + 
         boolean isCore(Dependency left, Dependency right) {
    +  346  4 
             final String leftName = left.getFileName().toLowerCase();
    +  347  4 
             final String rightName = right.getFileName().toLowerCase();
    +  348   + 
     
    +  349   + 
             final boolean returnVal;
    +  350  4 
             if (!rightName.matches(".*\\.(tar|tgz|gz|zip|ear|war).+") && leftName.matches(".*\\.(tar|tgz|gz|zip|ear|war).+")
    +  351   + 
                     || rightName.contains("core") && !leftName.contains("core")
    +  352   + 
                     || rightName.contains("kernel") && !leftName.contains("kernel")) {
    +  353  0 
                 returnVal = false;
    +  354  4 
             } else if (rightName.matches(".*\\.(tar|tgz|gz|zip|ear|war).+") && !leftName.matches(".*\\.(tar|tgz|gz|zip|ear|war).+")
    +  355   + 
                     || !rightName.contains("core") && leftName.contains("core")
    +  356   + 
                     || !rightName.contains("kernel") && leftName.contains("kernel")) {
    +  357  4 
                 returnVal = true;
    +  358   + 
             } else {
    +  359   + 
                 /*
    +  360   + 
                  * considered splitting the names up and comparing the components,
    +  361   + 
                  * but decided that the file name length should be sufficient as the
    +  362   + 
                  * "core" component, if this follows a normal naming protocol should
    +  363   + 
                  * be shorter:
    +  364   + 
                  * axis2-saaj-1.4.1.jar
    +  365   + 
                  * axis2-1.4.1.jar       <-----
    +  366   + 
                  * axis2-kernal-1.4.1.jar
    +  367   + 
                  */
    +  368  0 
                 returnVal = leftName.length() <= rightName.length();
    +  369   + 
             }
    +  370  4 
             if (LogUtils.isVerboseLoggingEnabled()) {
    +  371  0 
                 final String msg = String.format("IsCore=%s (%s, %s)", returnVal, left.getFileName(), right.getFileName());
    +  372  0 
                 Logger.getLogger(DependencyBundlingAnalyzer.class.getName()).log(Level.FINE, msg);
    +  373   + 
             }
    +  374  4 
             return returnVal;
    +  375   + 
         }
    +  376   + 
     
    +  377   + 
         /**
    +  378   + 
          * Compares the SHA1 hashes of two dependencies to determine if they are equal.
    +  379   + 
          *
    +  380   + 
          * @param dependency1 a dependency object to compare
    +  381   + 
          * @param dependency2 a dependency object to compare
    +  382   + 
          * @return true if the sha1 hashes of the two dependencies match; otherwise false
    +  383   + 
          */
    +  384   + 
         private boolean hashesMatch(Dependency dependency1, Dependency dependency2) {
    +  385  6 
             if (dependency1 == null || dependency2 == null || dependency1.getSha1sum() == null || dependency2.getSha1sum() == null) {
    +  386  0 
                 return false;
    +  387   + 
             }
    +  388  6 
             return dependency1.getSha1sum().equals(dependency2.getSha1sum());
    +  389   + 
         }
    +  390   + 
     
    +  391   + 
         /**
    +  392   + 
          * Determines if the jar is shaded and the created pom.xml identified the same CPE as the jar - if so, the pom.xml
    +  393   + 
          * dependency should be removed.
    +  394   + 
          *
    +  395   + 
          * @param dependency a dependency to check
    +  396   + 
          * @param nextDependency another dependency to check
    +  397   + 
          * @return true if on of the dependencies is a pom.xml and the identifiers between the two collections match;
    +  398   + 
          * otherwise false
    +  399   + 
          */
    +  400   + 
         private boolean isShadedJar(Dependency dependency, Dependency nextDependency) {
    +  401  6 
             final String mainName = dependency.getFileName().toLowerCase();
    +  402  6 
             final String nextName = nextDependency.getFileName().toLowerCase();
    +  403  6 
             if (mainName.endsWith(".jar") && nextName.endsWith("pom.xml")) {
    +  404  0 
                 return dependency.getIdentifiers().containsAll(nextDependency.getIdentifiers());
    +  405  6 
             } else if (nextName.endsWith(".jar") && mainName.endsWith("pom.xml")) {
    +  406  0 
                 return nextDependency.getIdentifiers().containsAll(dependency.getIdentifiers());
    +  407   + 
             }
    +  408  6 
             return false;
    +  409   + 
         }
    +  410   
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.FalsePositiveAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.FalsePositiveAnalyzer.html index c7a0c0b15..8c7bb04b1 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.FalsePositiveAnalyzer.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.FalsePositiveAnalyzer.html @@ -12,7 +12,7 @@
     
    - +
    Classes in this File Line Coverage Branch Coverage Complexity
    FalsePositiveAnalyzer
    69%
    80/115
    46%
    52/112
    		6.455
    FalsePositiveAnalyzer
    73%
    84/115
    52%
    60/114
    		6.545
     
    @@ -24,628 +24,610 @@  3   
      *
     4   - 
      * Dependency-check-core is free software: you can redistribute it and/or modify it
    + 
      * Licensed under the Apache License, Version 2.0 (the "License");
     5   - 
      * under the terms of the GNU General Public License as published by the Free
    + 
      * you may not use this file except in compliance with the License.
     6   - 
      * Software Foundation, either version 3 of the License, or (at your option) any
    + 
      * You may obtain a copy of the License at
     7   - 
      * later version.
    + 
      *
     8   - 
      *
    + 
      *     http://www.apache.org/licenses/LICENSE-2.0
     9   - 
      * Dependency-check-core is distributed in the hope that it will be useful, but
    + 
      *
     10   - 
      * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
    + 
      * Unless required by applicable law or agreed to in writing, software
     11   - 
      * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
    + 
      * distributed under the License is distributed on an "AS IS" BASIS,
     12   - 
      * details.
    + 
      * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13   - 
      *
    + 
      * See the License for the specific language governing permissions and
     14   - 
      * You should have received a copy of the GNU General Public License along with
    + 
      * limitations under the License.
     15   - 
      * dependency-check-core. If not, see http://www.gnu.org/licenses/.
    + 
      *
     16   - 
      *
    -  17   
      * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
    +  17   + 
      */
     18   - 
      */
    -  19   
     package org.owasp.dependencycheck.analyzer;
    +  19   + 
     
     20   - 
     
    -  21   
     import java.io.UnsupportedEncodingException;
    -  22   +  21   
     import java.net.URLEncoder;
    -  23   +  22   
     import java.util.ArrayList;
    -  24   +  23   
     import java.util.Collections;
    -  25   +  24   
     import java.util.Iterator;
    -  26   +  25   
     import java.util.List;
    -  27   +  26   
     import java.util.ListIterator;
    -  28   +  27   
     import java.util.Set;
    -  29   +  28   
     import java.util.logging.Level;
    -  30   +  29   
     import java.util.logging.Logger;
    -  31   +  30   
     import java.util.regex.Matcher;
    -  32   +  31   
     import java.util.regex.Pattern;
    -  33   +  32   
     import org.owasp.dependencycheck.Engine;
    -  34   +  33   
     import org.owasp.dependencycheck.dependency.Dependency;
    -  35   +  34   
     import org.owasp.dependencycheck.dependency.Identifier;
    -  36   +  35   
     import org.owasp.dependencycheck.dependency.VulnerableSoftware;
    +  36   + 
     
     37   - 
     
    -  38   
     /**
    +  38   + 
      * This analyzer attempts to remove some well known false positives - specifically regarding the java runtime.
     39   - 
      * This analyzer attempts to remove some well known false positives -
    -  40   - 
      * specifically regarding the java runtime.
    -  41   
      *
    -  42   +  40   
      * @author Jeremy Long <jeremy.long@owasp.org>
    -  43   +  41   
      */
    -  44  7 
     public class FalsePositiveAnalyzer extends AbstractAnalyzer {
    -  45   +  42  24 
     public class FalsePositiveAnalyzer extends AbstractAnalyzer {
    +  43   
     
    -  46   +  44   
         //<editor-fold defaultstate="collapsed" desc="All standard implmentation details of Analyzer">
    -  47   +  45   
         /**
    -  48   +  46   
          * The set of file extensions supported by this analyzer.
    +  47   + 
          */
    +  48  2 
         private static final Set<String> EXTENSIONS = null;
     49   - 
          */
    -  50  1 
         private static final Set<String> EXTENSIONS = null;
    -  51   
         /**
    -  52   +  50   
          * The name of the analyzer.
    -  53   +  51   
          */
    -  54   +  52   
         private static final String ANALYZER_NAME = "False Positive Analyzer";
    -  55   +  53   
         /**
    -  56   +  54   
          * The phase that this analyzer is intended to run in.
    +  55   + 
          */
    +  56  2 
         private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.POST_IDENTIFIER_ANALYSIS;
     57   - 
          */
    -  58  1 
         private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.POST_IDENTIFIER_ANALYSIS;
    + 
     
    +  58   + 
         /**
     59   - 
     
    -  60   - 
         /**
    -  61   
          * Returns a list of file EXTENSIONS supported by this analyzer.
    -  62   +  60   
          *
    -  63   +  61   
          * @return a list of file EXTENSIONS supported by this analyzer.
    -  64   +  62   
          */
    -  65   +  63   
         public Set<String> getSupportedExtensions() {
    -  66  132 
             return EXTENSIONS;
    +  64  266 
             return EXTENSIONS;
    +  65   + 
         }
    +  66   + 
     
     67   - 
         }
    + 
         /**
     68   - 
     
    -  69   - 
         /**
    -  70   
          * Returns the name of the analyzer.
    -  71   +  69   
          *
    -  72   +  70   
          * @return the name of the analyzer.
    -  73   +  71   
          */
    -  74   +  72   
         public String getName() {
    -  75  9 
             return ANALYZER_NAME;
    +  73  20 
             return ANALYZER_NAME;
    +  74   + 
         }
    +  75   + 
     
     76   - 
         }
    + 
         /**
     77   - 
     
    -  78   - 
         /**
    -  79   
          * Returns whether or not this analyzer can process the given extension.
    -  80   +  78   
          *
    -  81   +  79   
          * @param extension the file extension to test for support
    +  80   + 
          * @return whether or not the specified file extension is supported by this analyzer.
    +  81   + 
          */
     82   - 
          * @return whether or not the specified file extension is supported by this
    -  83   - 
          * analyzer.
    -  84   - 
          */
    -  85   
         public boolean supportsExtension(String extension) {
    -  86  9 
             return true;
    +  83  20 
             return true;
    +  84   + 
         }
    +  85   + 
     
    +  86   + 
         /**
     87   - 
         }
    -  88   - 
     
    -  89   - 
         /**
    -  90   
          * Returns the phase that the analyzer is intended to run in.
    -  91   +  88   
          *
    -  92   +  89   
          * @return the phase that the analyzer is intended to run in.
    -  93   +  90   
          */
    -  94   +  91   
         public AnalysisPhase getAnalysisPhase() {
    -  95  6 
             return ANALYSIS_PHASE;
    -  96   +  92  14 
             return ANALYSIS_PHASE;
    +  93   
         }
    -  97   +  94   
         //</editor-fold>
    +  95   + 
     
    +  96   + 
         /**
    +  97   + 
          * Analyzes the dependencies and removes bad/incorrect CPE associations based on various heuristics.
     98   - 
     
    + 
          *
     99   - 
         /**
    -  100   - 
          * Analyzes the dependencies and removes bad/incorrect CPE associations
    -  101   - 
          * based on various heuristics.
    -  102   - 
          *
    -  103   
          * @param dependency the dependency to analyze.
    -  104   +  100   
          * @param engine the engine that is scanning the dependencies
    -  105   - 
          * @throws AnalysisException is thrown if there is an error reading the JAR
    -  106   - 
          * file.
    -  107   +  101   + 
          * @throws AnalysisException is thrown if there is an error reading the JAR file.
    +  102   
          */
    -  108   +  103   
         @Override
    -  109   +  104   
         public void analyze(Dependency dependency, Engine engine) throws AnalysisException {
    -  110  15 
             removeJreEntries(dependency);
    -  111  15 
             removeBadMatches(dependency);
    -  112  15 
             removeWrongVersionMatches(dependency);
    -  113  15 
             removeSpuriousCPE(dependency);
    -  114  15 
             addFalseNegativeCPEs(dependency);
    -  115  15 
         }
    +  105  32 
             removeJreEntries(dependency);
    +  106  32 
             removeBadMatches(dependency);
    +  107  32 
             removeWrongVersionMatches(dependency);
    +  108  32 
             removeSpuriousCPE(dependency);
    +  109  32 
             addFalseNegativeCPEs(dependency);
    +  110  32 
         }
    +  111   + 
     
    +  112   + 
         /**
    +  113   + 
          * <p>
    +  114   + 
          * Intended to remove spurious CPE entries. By spurious we mean duplicate, less specific CPE entries.</p>
    +  115   + 
          * <p>
     116   - 
     
    + 
          * Example:</p>
     117   - 
         /**
    + 
          * <code>
     118   - 
          * <p>Intended to remove spurious CPE entries. By spurious we mean
    -  119   - 
          * duplicate, less specific CPE entries.</p>
    -  120   - 
          * <p>Example:</p>
    -  121   - 
          * <code>
    -  122   
          * cpe:/a:some-vendor:some-product
    -  123   +  119   
          * cpe:/a:some-vendor:some-product:1.5
    +  120   + 
          * cpe:/a:some-vendor:some-product:1.5.2
    +  121   + 
          * </code>
    +  122   + 
          * <p>
    +  123   + 
          * Should be trimmed to:</p>
     124   - 
          * cpe:/a:some-vendor:some-product:1.5.2
    -  125   - 
          * </code>
    -  126   - 
          * <p>Should be trimmed to:</p>
    -  127   
          * <code>
    -  128   +  125   
          * cpe:/a:some-vendor:some-product:1.5.2
    -  129   +  126   
          * </code>
    +  127   + 
          *
    +  128   + 
          * @param dependency the dependency being analyzed
    +  129   + 
          */
     130   - 
          *
    -  131   - 
          * @param dependency the dependency being analyzed
    -  132   - 
          */
    -  133   
         @SuppressWarnings("null")
    -  134   +  131   
         private void removeSpuriousCPE(Dependency dependency) {
    -  135  15 
             final List<Identifier> ids = new ArrayList<Identifier>();
    -  136  15 
             ids.addAll(dependency.getIdentifiers());
    -  137  15 
             Collections.sort(ids);
    -  138  15 
             final ListIterator<Identifier> mainItr = ids.listIterator();
    -  139  36 
             while (mainItr.hasNext()) {
    -  140  21 
                 final Identifier currentId = mainItr.next();
    -  141  21 
                 final VulnerableSoftware currentCpe = parseCpe(currentId.getType(), currentId.getValue());
    -  142  21 
                 if (currentCpe == null) {
    -  143  0 
                     continue;
    -  144   +  132  32 
             final List<Identifier> ids = new ArrayList<Identifier>();
    +  133  32 
             ids.addAll(dependency.getIdentifiers());
    +  134  32 
             Collections.sort(ids);
    +  135  32 
             final ListIterator<Identifier> mainItr = ids.listIterator();
    +  136  84 
             while (mainItr.hasNext()) {
    +  137  52 
                 final Identifier currentId = mainItr.next();
    +  138  52 
                 final VulnerableSoftware currentCpe = parseCpe(currentId.getType(), currentId.getValue());
    +  139  52 
                 if (currentCpe == null) {
    +  140  10 
                     continue;
    +  141   
                 }
    -  145  21 
                 final ListIterator<Identifier> subItr = ids.listIterator(mainItr.nextIndex());
    -  146  32 
                 while (subItr.hasNext()) {
    -  147  11 
                     final Identifier nextId = subItr.next();
    -  148  11 
                     final VulnerableSoftware nextCpe = parseCpe(nextId.getType(), nextId.getValue());
    -  149  11 
                     if (nextCpe == null) {
    -  150  0 
                         continue;
    -  151   +  142  42 
                 final ListIterator<Identifier> subItr = ids.listIterator(mainItr.nextIndex());
    +  143  84 
                 while (subItr.hasNext()) {
    +  144  42 
                     final Identifier nextId = subItr.next();
    +  145  42 
                     final VulnerableSoftware nextCpe = parseCpe(nextId.getType(), nextId.getValue());
    +  146  42 
                     if (nextCpe == null) {
    +  147  20 
                         continue;
    +  148   
                     }
    -  152   +  149   
                     //TODO fix the version problem below
    -  153  11 
                     if (currentCpe.getVendor().equals(nextCpe.getVendor())) {
    -  154  3 
                         if (currentCpe.getProduct().equals(nextCpe.getProduct())) {
    -  155   +  150  22 
                     if (currentCpe.getVendor().equals(nextCpe.getVendor())) {
    +  151  6 
                         if (currentCpe.getProduct().equals(nextCpe.getProduct())) {
    +  152   
                             // see if one is contained in the other.. remove the contained one from dependency.getIdentifier
    -  156  3 
                             final String currentVersion = currentCpe.getVersion();
    -  157  3 
                             final String nextVersion = nextCpe.getVersion();
    -  158  3 
                             if (currentVersion == null && nextVersion == null) {
    -  159   +  153  6 
                             final String currentVersion = currentCpe.getVersion();
    +  154  6 
                             final String nextVersion = nextCpe.getVersion();
    +  155  6 
                             if (currentVersion == null && nextVersion == null) {
    +  156   
                                 //how did we get here?
    -  160  0 
                                 Logger.getLogger(FalsePositiveAnalyzer.class
    -  161   +  157  0 
                                 Logger.getLogger(FalsePositiveAnalyzer.class
    +  158   
                                         .getName()).log(Level.FINE, "currentVersion and nextVersion are both null?");
    -  162  3 
                             } else if (currentVersion == null && nextVersion != null) {
    -  163  3 
                                 dependency.getIdentifiers().remove(currentId);
    -  164  0 
                             } else if (nextVersion == null && currentVersion != null) {
    -  165  0 
                                 dependency.getIdentifiers().remove(nextId);
    -  166  0 
                             } else if (currentVersion.length() < nextVersion.length()) {
    -  167  0 
                                 if (nextVersion.startsWith(currentVersion) || "-".equals(currentVersion)) {
    -  168  0 
                                     dependency.getIdentifiers().remove(currentId);
    -  169   +  159  6 
                             } else if (currentVersion == null && nextVersion != null) {
    +  160  6 
                                 dependency.getIdentifiers().remove(currentId);
    +  161  0 
                             } else if (nextVersion == null && currentVersion != null) {
    +  162  0 
                                 dependency.getIdentifiers().remove(nextId);
    +  163  0 
                             } else if (currentVersion.length() < nextVersion.length()) {
    +  164  0 
                                 if (nextVersion.startsWith(currentVersion) || "-".equals(currentVersion)) {
    +  165  0 
                                     dependency.getIdentifiers().remove(currentId);
    +  166   
                                 }
    -  170   +  167   
                             } else {
    -  171  0 
                                 if (currentVersion.startsWith(nextVersion) || "-".equals(nextVersion)) {
    -  172  0 
                                     dependency.getIdentifiers().remove(nextId);
    -  173   +  168  0 
                                 if (currentVersion.startsWith(nextVersion) || "-".equals(nextVersion)) {
    +  169  0 
                                     dependency.getIdentifiers().remove(nextId);
    +  170   
                                 }
    -  174   +  171   
                             }
    -  175   +  172   
                         }
    -  176   +  173   
                     }
    -  177  11 
                 }
    -  178  21 
             }
    -  179  15 
         }
    -  180   +  174  22 
                 }
    +  175  42 
             }
    +  176  32 
         }
    +  177   
         /**
    +  178   + 
          * Regex to identify core java libraries and a few other commonly misidentified ones.
    +  179   + 
          */
    +  180  2 
         public static final Pattern CORE_JAVA = Pattern.compile("^cpe:/a:(sun|oracle|ibm):(j2[ems]e|"
     181   - 
          * Regex to identify core java libraries and a few other commonly
    -  182   - 
          * misidentified ones.
    -  183   - 
          */
    -  184  1 
         public static final Pattern CORE_JAVA = Pattern.compile("^cpe:/a:(sun|oracle|ibm):(j2[ems]e|"
    -  185   
                 + "java(_platfrom_micro_edition|_runtime_environment|_se|virtual_machine|se_development_kit|fx)?|"
    -  186   +  182   
                 + "jdk|jre|jsf|jsse)($|:.*)");
    -  187   +  183   
         /**
    -  188   +  184   
          * Regex to identify core java library files. This is currently incomplete.
    +  185   + 
          */
    +  186  2 
         public static final Pattern CORE_FILES = Pattern.compile("^((alt[-])?rt|jsf[-].*|jsse|jfxrt|jfr|jce|javaws|deploy|charsets)\\.jar$");
    +  187   + 
     
    +  188   + 
         /**
     189   - 
          */
    -  190  1 
         public static final Pattern CORE_FILES = Pattern.compile("^((alt[-])?rt|jsf[-].*|jsse|jfxrt|jfr|jce|javaws|deploy|charsets)\\.jar$");
    + 
          * Removes any CPE entries for the JDK/JRE unless the filename ends with rt.jar
    +  190   + 
          *
     191   - 
     
    -  192   - 
         /**
    -  193   - 
          * Removes any CPE entries for the JDK/JRE unless the filename ends with
    -  194   - 
          * rt.jar
    -  195   - 
          *
    -  196   
          * @param dependency the dependency to remove JRE CPEs from
    -  197   +  192   
          */
    -  198   +  193   
         private void removeJreEntries(Dependency dependency) {
    -  199  15 
             final Set<Identifier> identifiers = dependency.getIdentifiers();
    -  200  15 
             final Iterator<Identifier> itr = identifiers.iterator();
    -  201  37 
             while (itr.hasNext()) {
    -  202  22 
                 final Identifier i = itr.next();
    -  203  22 
                 final Matcher coreCPE = CORE_JAVA.matcher(i.getValue());
    -  204  22 
                 final Matcher coreFiles = CORE_FILES.matcher(dependency.getFileName());
    -  205  22 
                 if (coreCPE.matches() && !coreFiles.matches()) {
    -  206  0 
                     itr.remove();
    -  207   +  194  32 
             final Set<Identifier> identifiers = dependency.getIdentifiers();
    +  195  32 
             final Iterator<Identifier> itr = identifiers.iterator();
    +  196  88 
             while (itr.hasNext()) {
    +  197  56 
                 final Identifier i = itr.next();
    +  198  56 
                 final Matcher coreCPE = CORE_JAVA.matcher(i.getValue());
    +  199  56 
                 final Matcher coreFiles = CORE_FILES.matcher(dependency.getFileName());
    +  200  56 
                 if (coreCPE.matches() && !coreFiles.matches()) {
    +  201  0 
                     itr.remove();
    +  202   
                 }
    -  208   +  203   
     
    -  209   +  204   
                 //replacecd with the regex above.
    -  210   +  205   
                 //            if (("cpe:/a:sun:java".equals(i.getValue())
    -  211   +  206   
                 //                    || "cpe:/a:oracle:java".equals(i.getValue())
    -  212   +  207   
                 //                    || "cpe:/a:ibm:java".equals(i.getValue())
    -  213   +  208   
                 //                    || "cpe:/a:sun:j2se".equals(i.getValue())
    -  214   +  209   
                 //                    || "cpe:/a:oracle:j2se".equals(i.getValue())
    -  215   +  210   
                 //                    || i.getValue().startsWith("cpe:/a:sun:java:")
    -  216   +  211   
                 //                    || i.getValue().startsWith("cpe:/a:sun:j2se:")
    -  217   +  212   
                 //                    || i.getValue().startsWith("cpe:/a:sun:java:jre")
    -  218   +  213   
                 //                    || i.getValue().startsWith("cpe:/a:sun:java:jdk")
    -  219   +  214   
                 //                    || i.getValue().startsWith("cpe:/a:sun:java_se")
    -  220   +  215   
                 //                    || i.getValue().startsWith("cpe:/a:oracle:java_se")
    -  221   +  216   
                 //                    || i.getValue().startsWith("cpe:/a:oracle:java:")
    -  222   +  217   
                 //                    || i.getValue().startsWith("cpe:/a:oracle:j2se:")
    -  223   +  218   
                 //                    || i.getValue().startsWith("cpe:/a:oracle:jre")
    -  224   +  219   
                 //                    || i.getValue().startsWith("cpe:/a:oracle:jdk")
    -  225   +  220   
                 //                    || i.getValue().startsWith("cpe:/a:ibm:java:"))
    -  226   +  221   
                 //                    && !dependency.getFileName().toLowerCase().endsWith("rt.jar")) {
    -  227   +  222   
                 //                itr.remove();
    -  228   +  223   
                 //            }
    -  229  22 
             }
    -  230  15 
         }
    -  231   +  224  56 
             }
    +  225  32 
         }
    +  226   
     
    -  232   +  227   
         /**
    -  233   +  228   
          * Parses a CPE string into an IndexEntry.
    -  234   +  229   
          *
    -  235   +  230   
          * @param type the type of identifier
    -  236   +  231   
          * @param value the cpe identifier to parse
    -  237   +  232   
          * @return an VulnerableSoftware object constructed from the identifier
    -  238   +  233   
          */
    -  239   +  234   
         private VulnerableSoftware parseCpe(String type, String value) {
    -  240  32 
             if (!"cpe".equals(type)) {
    -  241  0 
                 return null;
    -  242   +  235  94 
             if (!"cpe".equals(type)) {
    +  236  30 
                 return null;
    +  237   
             }
    -  243  32 
             final VulnerableSoftware cpe = new VulnerableSoftware();
    -  244   +  238  64 
             final VulnerableSoftware cpe = new VulnerableSoftware();
    +  239   
             try {
    -  245  32 
                 cpe.parseName(value);
    -  246  0 
             } catch (UnsupportedEncodingException ex) {
    -  247  0 
                 Logger.getLogger(FalsePositiveAnalyzer.class.getName()).log(Level.FINEST, null, ex);
    -  248  0 
                 return null;
    -  249  32 
             }
    -  250  32 
             return cpe;
    -  251   +  240  64 
                 cpe.parseName(value);
    +  241  0 
             } catch (UnsupportedEncodingException ex) {
    +  242  0 
                 Logger.getLogger(FalsePositiveAnalyzer.class.getName()).log(Level.FINEST, null, ex);
    +  243  0 
                 return null;
    +  244  64 
             }
    +  245  64 
             return cpe;
    +  246   
         }
    +  247   + 
     
    +  248   + 
         /**
    +  249   + 
          * Removes bad CPE matches for a dependency. Unfortunately, right now these are hard-coded patches for specific
    +  250   + 
          * problems identified when testing this on a LARGE volume of jar files.
    +  251   + 
          *
     252   - 
     
    + 
          * @param dependency the dependency to analyze
     253   - 
         /**
    + 
          */
     254   - 
          * Removes bad CPE matches for a dependency. Unfortunately, right now these
    -  255   - 
          * are hard-coded patches for specific problems identified when testing this
    -  256   - 
          * on a LARGE volume of jar files.
    -  257   - 
          *
    -  258   - 
          * @param dependency the dependency to analyze
    -  259   - 
          */
    -  260   
         private void removeBadMatches(Dependency dependency) {
    -  261  15 
             final Set<Identifier> identifiers = dependency.getIdentifiers();
    -  262  15 
             final Iterator<Identifier> itr = identifiers.iterator();
    -  263   +  255  32 
             final Set<Identifier> identifiers = dependency.getIdentifiers();
    +  256  32 
             final Iterator<Identifier> itr = identifiers.iterator();
    +  257   
     
    -  264   +  258   
             /* TODO - can we utilize the pom's groupid and artifactId to filter??? most of
    -  265   +  259   
              * these are due to low quality data.  Other idea would be to say any CPE
    -  266   +  260   
              * found based on LOW confidence evidence should have a different CPE type? (this
    -  267   +  261   
              * might be a better solution then just removing the URL for "best-guess" matches).
    -  268   +  262   
              */
    -  269   - 
     
    -  270   +  263   
             //Set<Evidence> groupId = dependency.getVendorEvidence().getEvidence("pom", "groupid");
    -  271   +  264   
             //Set<Evidence> artifactId = dependency.getVendorEvidence().getEvidence("pom", "artifactid");
    -  272   - 
     
    -  273  37 
             while (itr.hasNext()) {
    -  274  22 
                 final Identifier i = itr.next();
    -  275   +  265  88 
             while (itr.hasNext()) {
    +  266  56 
                 final Identifier i = itr.next();
    +  267   
                 //TODO move this startswith expression to a configuration file?
    -  276  22 
                 if ("cpe".equals(i.getType())) {
    -  277  22 
                     if ((i.getValue().matches(".*c\\+\\+.*")
    -  278   +  268  56 
                 if ("cpe".equals(i.getType())) {
    +  269  46 
                     if ((i.getValue().matches(".*c\\+\\+.*")
    +  270   
                             || i.getValue().startsWith("cpe:/a:jquery:jquery")
    -  279   +  271   
                             || i.getValue().startsWith("cpe:/a:prototypejs:prototype")
    -  280   +  272   
                             || i.getValue().startsWith("cpe:/a:yahoo:yui")
    -  281   +  273   
                             || i.getValue().startsWith("cpe:/a:file:file")
    -  282   +  274   
                             || i.getValue().startsWith("cpe:/a:mozilla:mozilla")
    -  283   +  275   
                             || i.getValue().startsWith("cpe:/a:cvs:cvs")
    -  284   +  276   
                             || i.getValue().startsWith("cpe:/a:ftp:ftp")
    -  285   +  277   
                             || i.getValue().startsWith("cpe:/a:ssh:ssh"))
    -  286   - 
                             && dependency.getFileName().toLowerCase().endsWith(".jar")) {
    -  287  0 
                         itr.remove();
    -  288  22 
                     } else if (i.getValue().startsWith("cpe:/a:apache:maven")
    -  289   +  278   + 
                             && (dependency.getFileName().toLowerCase().endsWith(".jar")
    +  279   + 
                             || dependency.getFileName().toLowerCase().endsWith("pom.xml"))) {
    +  280  2 
                         itr.remove();
    +  281  44 
                     } else if (i.getValue().startsWith("cpe:/a:apache:maven")
    +  282   
                             && !dependency.getFileName().toLowerCase().matches("maven-core-[\\d\\.]+\\.jar")) {
    -  290  0 
                         itr.remove();
    -  291   +  283  0 
                         itr.remove();
    +  284   
                     }
    -  292   +  285   
                 }
    -  293  22 
             }
    -  294  15 
         }
    -  295   +  286  56 
             }
    +  287  32 
         }
    +  288   
     
    -  296   +  289   
         /**
    -  297   - 
          * Removes CPE matches for the wrong version of a dependency. Currently,
    -  298   - 
          * this only covers Axis 1 & 2.
    -  299   +  290   + 
          * Removes CPE matches for the wrong version of a dependency. Currently, this only covers Axis 1 & 2.
    +  291   
          *
    -  300   +  292   
          * @param dependency the dependency to analyze
    -  301   +  293   
          */
    -  302   +  294   
         private void removeWrongVersionMatches(Dependency dependency) {
    -  303  15 
             final Set<Identifier> identifiers = dependency.getIdentifiers();
    -  304  15 
             final Iterator<Identifier> itr = identifiers.iterator();
    -  305   +  295  32 
             final Set<Identifier> identifiers = dependency.getIdentifiers();
    +  296  32 
             final Iterator<Identifier> itr = identifiers.iterator();
    +  297   
     
    -  306  15 
             final String fileName = dependency.getFileName();
    -  307  15 
             if (fileName != null && fileName.contains("axis2")) {
    -  308  3 
                 while (itr.hasNext()) {
    -  309  2 
                     final Identifier i = itr.next();
    -  310  2 
                     if ("cpe".equals(i.getType())) {
    -  311  2 
                         final String cpe = i.getValue();
    -  312  2 
                         if (cpe != null && (cpe.startsWith("cpe:/a:apache:axis:") || "cpe:/a:apache:axis".equals(cpe))) {
    -  313  1 
                             itr.remove();
    -  314   +  298  32 
             final String fileName = dependency.getFileName();
    +  299  32 
             if (fileName != null && fileName.contains("axis2")) {
    +  300  8 
                 while (itr.hasNext()) {
    +  301  6 
                     final Identifier i = itr.next();
    +  302  6 
                     if ("cpe".equals(i.getType())) {
    +  303  4 
                         final String cpe = i.getValue();
    +  304  4 
                         if (cpe != null && (cpe.startsWith("cpe:/a:apache:axis:") || "cpe:/a:apache:axis".equals(cpe))) {
    +  305  2 
                             itr.remove();
    +  306   
                         }
    -  315   +  307   
                     }
    -  316  2 
                 }
    -  317  14 
             } else if (fileName != null && fileName.contains("axis")) {
    -  318  0 
                 while (itr.hasNext()) {
    -  319  0 
                     final Identifier i = itr.next();
    -  320  0 
                     if ("cpe".equals(i.getType())) {
    -  321  0 
                         final String cpe = i.getValue();
    -  322  0 
                         if (cpe != null && (cpe.startsWith("cpe:/a:apache:axis2:") || "cpe:/a:apache:axis2".equals(cpe))) {
    -  323  0 
                             itr.remove();
    -  324   +  308  6 
                 }
    +  309  30 
             } else if (fileName != null && fileName.contains("axis")) {
    +  310  0 
                 while (itr.hasNext()) {
    +  311  0 
                     final Identifier i = itr.next();
    +  312  0 
                     if ("cpe".equals(i.getType())) {
    +  313  0 
                         final String cpe = i.getValue();
    +  314  0 
                         if (cpe != null && (cpe.startsWith("cpe:/a:apache:axis2:") || "cpe:/a:apache:axis2".equals(cpe))) {
    +  315  0 
                             itr.remove();
    +  316   
                         }
    -  325   +  317   
                     }
    -  326  0 
                 }
    -  327   +  318  0 
                 }
    +  319   
             }
    -  328  15 
         }
    -  329   +  320  32 
         }
    +  321   
     
    -  330   +  322   
         /**
    -  331   - 
          * There are some known CPE entries, specifically regarding sun and oracle
    -  332   - 
          * products due to the acquisition and changes in product names, that based
    -  333   - 
          * on given evidence we can add the related CPE entries to ensure a complete
    -  334   +  323   + 
          * There are some known CPE entries, specifically regarding sun and oracle products due to the acquisition and
    +  324   + 
          * changes in product names, that based on given evidence we can add the related CPE entries to ensure a complete
    +  325   
          * list of CVE entries.
    -  335   +  326   
          *
    -  336   +  327   
          * @param dependency the dependency being analyzed
    -  337   +  328   
          */
    -  338   +  329   
         private void addFalseNegativeCPEs(Dependency dependency) {
    -  339  15 
             final Iterator<Identifier> itr = dependency.getIdentifiers().iterator();
    -  340  33 
             while (itr.hasNext()) {
    -  341  18 
                 final Identifier i = itr.next();
    -  342  18 
                 if ("cpe".equals(i.getType()) && i.getValue() != null
    -  343   +  330  32 
             final Iterator<Identifier> itr = dependency.getIdentifiers().iterator();
    +  331  78 
             while (itr.hasNext()) {
    +  332  46 
                 final Identifier i = itr.next();
    +  333  46 
                 if ("cpe".equals(i.getType()) && i.getValue() != null
    +  334   
                         && (i.getValue().startsWith("cpe:/a:oracle:opensso:")
    -  344   +  335   
                         || i.getValue().startsWith("cpe:/a:oracle:opensso_enterprise:")
    -  345   +  336   
                         || i.getValue().startsWith("cpe:/a:sun:opensso_enterprise:")
    -  346   +  337   
                         || i.getValue().startsWith("cpe:/a:sun:opensso:"))) {
    -  347  0 
                     final String newCpe = String.format("cpe:/a:sun:opensso_enterprise:%s", i.getValue().substring(22));
    -  348  0 
                     final String newCpe2 = String.format("cpe:/a:oracle:opensso_enterprise:%s", i.getValue().substring(22));
    -  349  0 
                     final String newCpe3 = String.format("cpe:/a:sun:opensso:%s", i.getValue().substring(22));
    -  350  0 
                     final String newCpe4 = String.format("cpe:/a:oracle:opensso:%s", i.getValue().substring(22));
    -  351   +  338  0 
                     final String newCpe = String.format("cpe:/a:sun:opensso_enterprise:%s", i.getValue().substring(22));
    +  339  0 
                     final String newCpe2 = String.format("cpe:/a:oracle:opensso_enterprise:%s", i.getValue().substring(22));
    +  340  0 
                     final String newCpe3 = String.format("cpe:/a:sun:opensso:%s", i.getValue().substring(22));
    +  341  0 
                     final String newCpe4 = String.format("cpe:/a:oracle:opensso:%s", i.getValue().substring(22));
    +  342   
                     try {
    +  343  0 
                         dependency.addIdentifier("cpe",
    +  344   + 
                                 newCpe,
    +  345   + 
                                 String.format("http://web.nvd.nist.gov/view/vuln/search?cpe=%s", URLEncoder.encode(newCpe, "UTF-8")));
    +  346  0 
                         dependency.addIdentifier("cpe",
    +  347   + 
                                 newCpe2,
    +  348   + 
                                 String.format("http://web.nvd.nist.gov/view/vuln/search?cpe=%s", URLEncoder.encode(newCpe2, "UTF-8")));
    +  349  0 
                         dependency.addIdentifier("cpe",
    +  350   + 
                                 newCpe3,
    +  351   + 
                                 String.format("http://web.nvd.nist.gov/view/vuln/search?cpe=%s", URLEncoder.encode(newCpe3, "UTF-8")));
     352  0 
                         dependency.addIdentifier("cpe",
     353   - 
                                 newCpe,
    -  354   - 
                                 String.format("http://web.nvd.nist.gov/view/vuln/search?cpe=%s", URLEncoder.encode(newCpe, "UTF-8")));
    -  355  0 
                         dependency.addIdentifier("cpe",
    -  356   - 
                                 newCpe2,
    -  357   - 
                                 String.format("http://web.nvd.nist.gov/view/vuln/search?cpe=%s", URLEncoder.encode(newCpe2, "UTF-8")));
    -  358  0 
                         dependency.addIdentifier("cpe",
    -  359   - 
                                 newCpe3,
    -  360   - 
                                 String.format("http://web.nvd.nist.gov/view/vuln/search?cpe=%s", URLEncoder.encode(newCpe3, "UTF-8")));
    -  361  0 
                         dependency.addIdentifier("cpe",
    -  362   
                                 newCpe4,
    -  363   +  354   
                                 String.format("http://web.nvd.nist.gov/view/vuln/search?cpe=%s", URLEncoder.encode(newCpe4, "UTF-8")));
    -  364  0 
                     } catch (UnsupportedEncodingException ex) {
    -  365  0 
                         Logger.getLogger(FalsePositiveAnalyzer.class
    -  366   +  355  0 
                     } catch (UnsupportedEncodingException ex) {
    +  356  0 
                         Logger.getLogger(FalsePositiveAnalyzer.class
    +  357   
                                 .getName()).log(Level.FINE, null, ex);
    -  367  0 
                     }
    -  368   +  358  0 
                     }
    +  359   
                 }
    -  369  18 
             }
    -  370  15 
         }
    -  371   +  360  46 
             }
    +  361  32 
         }
    +  362   
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.FileNameAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.FileNameAnalyzer.html index eb186a1cb..a9ee97f19 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.FileNameAnalyzer.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.FileNameAnalyzer.html @@ -12,7 +12,7 @@
     
    - +
    Classes in this File Line Coverage Branch Coverage Complexity
    FileNameAnalyzer
    100%
    22/22
    83%
    5/6
    		1.6
    FileNameAnalyzer
    95%
    23/24
    70%
    7/10
    		2
     
    @@ -24,245 +24,253 @@  3   
      *
     4   - 
      * Dependency-check-core is free software: you can redistribute it and/or modify it
    + 
      * Licensed under the Apache License, Version 2.0 (the "License");
     5   - 
      * under the terms of the GNU General Public License as published by the Free
    + 
      * you may not use this file except in compliance with the License.
     6   - 
      * Software Foundation, either version 3 of the License, or (at your option) any
    + 
      * You may obtain a copy of the License at
     7   - 
      * later version.
    + 
      *
     8   - 
      *
    + 
      *     http://www.apache.org/licenses/LICENSE-2.0
     9   - 
      * Dependency-check-core is distributed in the hope that it will be useful, but
    + 
      *
     10   - 
      * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
    + 
      * Unless required by applicable law or agreed to in writing, software
     11   - 
      * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
    + 
      * distributed under the License is distributed on an "AS IS" BASIS,
     12   - 
      * details.
    + 
      * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13   - 
      *
    + 
      * See the License for the specific language governing permissions and
     14   - 
      * You should have received a copy of the GNU General Public License along with
    + 
      * limitations under the License.
     15   - 
      * dependency-check-core. If not, see http://www.gnu.org/licenses/.
    + 
      *
     16   - 
      *
    -  17   
      * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
    +  17   + 
      */
     18   - 
      */
    -  19   
     package org.owasp.dependencycheck.analyzer;
    +  19   + 
     
     20   - 
     
    -  21   
     import java.io.File;
    -  22   - 
     import org.owasp.dependencycheck.dependency.Dependency;
    -  23   - 
     import org.owasp.dependencycheck.dependency.Evidence;
    -  24   +  21   
     import java.util.Set;
    -  25   +  22   
     import org.owasp.dependencycheck.Engine;
    -  26   +  23   + 
     import org.owasp.dependencycheck.dependency.Confidence;
    +  24   + 
     import org.owasp.dependencycheck.dependency.Dependency;
    +  25   
     import org.owasp.dependencycheck.utils.DependencyVersion;
    -  27   +  26   
     import org.owasp.dependencycheck.utils.DependencyVersionUtil;
    +  27   + 
     
     28   - 
     
    -  29   
     /**
    +  29   + 
      *
     30   - 
      *
    -  31   
      * Takes a dependency and analyzes the filename and determines the hashes.
    -  32   +  31   
      *
    -  33   +  32   
      * @author Jeremy Long <jeremy.long@owasp.org>
    -  34   +  33   
      */
    -  35  15 
     public class FileNameAnalyzer extends AbstractAnalyzer implements Analyzer {
    +  34  30 
     public class FileNameAnalyzer extends AbstractAnalyzer implements Analyzer {
    +  35   + 
     
     36   - 
     
    -  37   
         //<editor-fold defaultstate="collapsed" desc="All standard implmentation details of Analyzer">
    +  37   + 
         /**
     38   - 
         /**
    -  39   
          * The name of the analyzer.
    +  39   + 
          */
     40   - 
          */
    -  41   
         private static final String ANALYZER_NAME = "File Name Analyzer";
    +  41   + 
         /**
     42   - 
         /**
    -  43   
          * The phase that this analyzer is intended to run in.
    -  44   +  43   
          */
    -  45  1 
         private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.INFORMATION_COLLECTION;
    +  44  2 
         private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.INFORMATION_COLLECTION;
    +  45   + 
         /**
     46   - 
         /**
    -  47   
          * The set of file extensions supported by this analyzer.
    -  48   +  47   
          */
    -  49  1 
         private static final Set<String> EXTENSIONS = null;
    +  48  2 
         private static final Set<String> EXTENSIONS = null;
    +  49   + 
     
     50   - 
     
    + 
         /**
     51   - 
         /**
    -  52   
          * Returns a list of file EXTENSIONS supported by this analyzer.
    +  52   + 
          *
     53   - 
          *
    -  54   
          * @return a list of file EXTENSIONS supported by this analyzer.
    +  54   + 
          */
     55   - 
          */
    -  56   
         public Set<String> getSupportedExtensions() {
    -  57  140 
             return EXTENSIONS;
    +  56  298 
             return EXTENSIONS;
    +  57   + 
         }
     58   - 
         }
    + 
     
     59   - 
     
    + 
         /**
     60   - 
         /**
    -  61   
          * Returns the name of the analyzer.
    +  61   + 
          *
     62   - 
          *
    -  63   
          * @return the name of the analyzer.
    +  63   + 
          */
     64   - 
          */
    -  65   
         public String getName() {
    -  66  10 
             return ANALYZER_NAME;
    +  65  20 
             return ANALYZER_NAME;
    +  66   + 
         }
     67   - 
         }
    + 
     
     68   - 
     
    + 
         /**
     69   - 
         /**
    -  70   
          * Returns whether or not this analyzer can process the given extension.
    +  70   + 
          *
     71   - 
          *
    -  72   
          * @param extension the file extension to test for support.
    +  72   + 
          * @return whether or not the specified file extension is supported by this analyzer.
     73   - 
          * @return whether or not the specified file extension is supported by this
    + 
          */
     74   - 
          * analyzer.
    -  75   - 
          */
    -  76   
         public boolean supportsExtension(String extension) {
    -  77  10 
             return true;
    +  75  20 
             return true;
    +  76   + 
         }
    +  77   + 
     
     78   - 
         }
    + 
         /**
     79   - 
     
    -  80   - 
         /**
    -  81   
          * Returns the phase that the analyzer is intended to run in.
    -  82   +  80   
          *
    -  83   +  81   
          * @return the phase that the analyzer is intended to run in.
    -  84   +  82   
          */
    -  85   +  83   
         public AnalysisPhase getAnalysisPhase() {
    -  86  7 
             return ANALYSIS_PHASE;
    -  87   +  84  14 
             return ANALYSIS_PHASE;
    +  85   
         }
    -  88   +  86   
         //</editor-fold>
    -  89   +  87   
     
    -  90   +  88   
         /**
    -  91   +  89   
          * Collects information about the file name.
    -  92   +  90   
          *
    -  93   +  91   
          * @param dependency the dependency to analyze.
    -  94   +  92   
          * @param engine the engine that is scanning the dependencies
    -  95   - 
          * @throws AnalysisException is thrown if there is an error reading the JAR
    -  96   - 
          * file.
    -  97   +  93   + 
          * @throws AnalysisException is thrown if there is an error reading the JAR file.
    +  94   
          */
    -  98   +  95   
         @Override
    -  99   +  96   
         public void analyze(Dependency dependency, Engine engine) throws AnalysisException {
    -  100   +  97   
     
    -  101   +  98   
             //strip any path information that may get added by ArchiveAnalyzer, etc.
    -  102  18 
             final File f = new File(dependency.getFileName());
    -  103  18 
             String fileName = f.getName();
    -  104   +  99  36 
             final File f = new File(dependency.getFileName());
    +  100  36 
             String fileName = f.getName();
    +  101   
     
    -  105   +  102   
             //remove file extension
    -  106  18 
             final int pos = fileName.lastIndexOf(".");
    -  107  18 
             if (pos > 0) {
    -  108  18 
                 fileName = fileName.substring(0, pos);
    -  109   +  103  36 
             final int pos = fileName.lastIndexOf(".");
    +  104  36 
             if (pos > 0) {
    +  105  36 
                 fileName = fileName.substring(0, pos);
    +  106   
             }
    -  110   +  107   
     
    -  111   +  108   
             //add version evidence
    -  112  18 
             final DependencyVersion version = DependencyVersionUtil.parseVersion(fileName);
    -  113  18 
             if (version != null) {
    -  114  10 
                 dependency.getVersionEvidence().addEvidence("file", "name",
    -  115   - 
                         version.toString(), Evidence.Confidence.HIGHEST);
    -  116  10 
                 dependency.getVersionEvidence().addEvidence("file", "name",
    +  109  36 
             final DependencyVersion version = DependencyVersionUtil.parseVersion(fileName);
    +  110  36 
             if (version != null) {
    +  111   + 
                 // If the version number is just a number like 2 or 23, reduce the confidence
    +  112   + 
                 // a shade. This should hopefully correct for cases like log4j.jar or
    +  113   + 
                 // struts2-core.jar
    +  114  20 
                 if (version.getVersionParts() == null || version.getVersionParts().size() < 2) {
    +  115  0 
                     dependency.getVersionEvidence().addEvidence("file", "name",
    +  116   + 
                             version.toString(), Confidence.MEDIUM);
     117   - 
                         fileName, Evidence.Confidence.MEDIUM);
    -  118   - 
             }
    + 
                 } else {
    +  118  20 
                     dependency.getVersionEvidence().addEvidence("file", "name",
     119   - 
     
    + 
                             version.toString(), Confidence.HIGHEST);
     120   - 
             //add as vendor and product evidence
    -  121  18 
             if (fileName.contains("-")) {
    -  122  10 
                 dependency.getProductEvidence().addEvidence("file", "name",
    + 
                 }
    +  121  20 
                 dependency.getVersionEvidence().addEvidence("file", "name",
    +  122   + 
                         fileName, Confidence.MEDIUM);
     123   - 
                         fileName, Evidence.Confidence.HIGHEST);
    -  124  10 
                 dependency.getVendorEvidence().addEvidence("file", "name",
    -  125   - 
                         fileName, Evidence.Confidence.HIGHEST);
    -  126   - 
             } else {
    -  127  8 
                 dependency.getProductEvidence().addEvidence("file", "name",
    -  128   - 
                         fileName, Evidence.Confidence.HIGH);
    -  129  8 
                 dependency.getVendorEvidence().addEvidence("file", "name",
    -  130   - 
                         fileName, Evidence.Confidence.HIGH);
    -  131   
             }
    -  132  18 
         }
    +  124   + 
     
    +  125   + 
             //add as vendor and product evidence
    +  126  36 
             if (fileName.contains("-")) {
    +  127  20 
                 dependency.getProductEvidence().addEvidence("file", "name",
    +  128   + 
                         fileName, Confidence.HIGHEST);
    +  129  20 
                 dependency.getVendorEvidence().addEvidence("file", "name",
    +  130   + 
                         fileName, Confidence.HIGHEST);
    +  131   + 
             } else {
    +  132  16 
                 dependency.getProductEvidence().addEvidence("file", "name",
     133   + 
                         fileName, Confidence.HIGH);
    +  134  16 
                 dependency.getVendorEvidence().addEvidence("file", "name",
    +  135   + 
                         fileName, Confidence.HIGH);
    +  136   + 
             }
    +  137  36 
         }
    +  138   
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.HintAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.HintAnalyzer.html index 7020d2bfc..7ae41fec9 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.HintAnalyzer.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.HintAnalyzer.html @@ -24,47 +24,47 @@  3   
      *
     4   - 
      * Dependency-check-core is free software: you can redistribute it and/or modify it
    + 
      * Licensed under the Apache License, Version 2.0 (the "License");
     5   - 
      * under the terms of the GNU General Public License as published by the Free
    + 
      * you may not use this file except in compliance with the License.
     6   - 
      * Software Foundation, either version 3 of the License, or (at your option) any
    + 
      * You may obtain a copy of the License at
     7   - 
      * later version.
    + 
      *
     8   - 
      *
    + 
      *     http://www.apache.org/licenses/LICENSE-2.0
     9   - 
      * Dependency-check-core is distributed in the hope that it will be useful, but
    + 
      *
     10   - 
      * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
    + 
      * Unless required by applicable law or agreed to in writing, software
     11   - 
      * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
    + 
      * distributed under the License is distributed on an "AS IS" BASIS,
     12   - 
      * details.
    + 
      * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13   - 
      *
    + 
      * See the License for the specific language governing permissions and
     14   - 
      * You should have received a copy of the GNU General Public License along with
    + 
      * limitations under the License.
     15   - 
      * dependency-check-core. If not, see http://www.gnu.org/licenses/.
    -  16   
      *
    -  17   +  16   
      * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
    -  18   +  17   
      */
    -  19   +  18   
     package org.owasp.dependencycheck.analyzer;
    -  20   +  19   
     
    -  21   +  20   
     import java.util.ArrayList;
    -  22   +  21   
     import java.util.Iterator;
    -  23   +  22   
     import java.util.Set;
    -  24   +  23   
     import org.owasp.dependencycheck.Engine;
    +  24   + 
     import org.owasp.dependencycheck.dependency.Confidence;
     25   
     import org.owasp.dependencycheck.dependency.Dependency;
     26   @@ -79,7 +79,7 @@ 
      * @author Jeremy Long <jeremy.long@owasp.org>
     31   
      */
    -  32  7 
     public class HintAnalyzer extends AbstractAnalyzer implements Analyzer {
    +  32  14 
     public class HintAnalyzer extends AbstractAnalyzer implements Analyzer {
     33   
     
     34   @@ -98,14 +98,14 @@ 
          * The phase that this analyzer is intended to run in.
     41   
          */
    -  42  1 
         private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.PRE_IDENTIFIER_ANALYSIS;
    +  42  2 
         private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.PRE_IDENTIFIER_ANALYSIS;
     43   
         /**
     44   
          * The set of file extensions supported by this analyzer.
     45   
          */
    -  46  1 
         private static final Set<String> EXTENSIONS = null;
    +  46  2 
         private static final Set<String> EXTENSIONS = null;
     47   
     
     48   @@ -120,7 +120,7 @@ 
          */
     53   
         public Set<String> getSupportedExtensions() {
    -  54  132 
             return EXTENSIONS;
    +  54  264 
             return EXTENSIONS;
     55   
         }
     56   @@ -137,7 +137,7 @@ 
          */
     62   
         public String getName() {
    -  63  9 
             return ANALYZER_NAME;
    +  63  18 
             return ANALYZER_NAME;
     64   
         }
     65   @@ -151,128 +151,120 @@  69   
          * @param extension the file extension to test for support.
     70   - 
          * @return whether or not the specified file extension is supported by this
    + 
          * @return whether or not the specified file extension is supported by this analyzer.
     71   - 
          * analyzer.
    + 
          */
     72   - 
          */
    -  73   
         public boolean supportsExtension(String extension) {
    -  74  9 
             return true;
    +  73  18 
             return true;
    +  74   + 
         }
     75   - 
         }
    + 
     
     76   - 
     
    + 
         /**
     77   - 
         /**
    -  78   
          * Returns the phase that the analyzer is intended to run in.
    +  78   + 
          *
     79   - 
          *
    -  80   
          * @return the phase that the analyzer is intended to run in.
    +  80   + 
          */
     81   - 
          */
    -  82   
         public AnalysisPhase getAnalysisPhase() {
    -  83  6 
             return ANALYSIS_PHASE;
    -  84   +  82  12 
             return ANALYSIS_PHASE;
    +  83   
         }
    -  85   +  84   
         //</editor-fold>
    +  85   + 
     
     86   - 
     
    -  87   
         /**
    +  87   + 
          * The HintAnalyzer uses knowledge about a dependency to add additional information to help in identification of
     88   - 
          * The HintAnalyzer uses knowledge about a dependency to add additional
    + 
          * identifiers or vulnerabilities.
     89   - 
          * information to help in identification of identifiers or vulnerabilities.
    -  90   
          *
    -  91   +  90   
          * @param dependency The dependency being analyzed
    -  92   +  91   
          * @param engine The scanning engine
    +  92   + 
          * @throws AnalysisException is thrown if there is an exception analyzing the dependency.
     93   - 
          * @throws AnalysisException is thrown if there is an exception analyzing
    -  94   - 
          * the dependency.
    -  95   
          */
    -  96   +  94   
         @Override
    -  97   +  95   
         public void analyze(Dependency dependency, Engine engine) throws AnalysisException {
    -  98  15 
             final Evidence springTest1 = new Evidence("Manifest",
    -  99   +  96  30 
             final Evidence springTest1 = new Evidence("Manifest",
    +  97   
                     "Implementation-Title",
    -  100   +  98   
                     "Spring Framework",
    -  101   - 
                     Evidence.Confidence.HIGH);
    +  99   + 
                     Confidence.HIGH);
    +  100   + 
     
    +  101  30 
             final Evidence springTest2 = new Evidence("Manifest",
     102   - 
     
    -  103  15 
             final Evidence springTest2 = new Evidence("Manifest",
    -  104   
                     "Implementation-Title",
    -  105   +  103   
                     "org.springframework.core",
    -  106   - 
                     Evidence.Confidence.HIGH);
    +  104   + 
                     Confidence.HIGH);
    +  105   + 
     
    +  106  30 
             final Evidence springTest3 = new Evidence("Manifest",
     107   - 
     
    -  108  15 
             final Evidence springTest3 = new Evidence("Manifest",
    -  109   
                     "Bundle-Vendor",
    -  110   +  108   
                     "SpringSource",
    -  111   - 
                     Evidence.Confidence.HIGH);
    -  112   +  109   + 
                     Confidence.HIGH);
    +  110   
     
    -  113   - 
     
    -  114  15 
             Set<Evidence> evidence = dependency.getProductEvidence().getEvidence();
    -  115  15 
             if (evidence.contains(springTest1) || evidence.contains(springTest2)) {
    -  116  2 
                 dependency.getProductEvidence().addEvidence("hint analyzer", "product", "springsource_spring_framework", Evidence.Confidence.HIGH);
    -  117  2 
                 dependency.getVendorEvidence().addEvidence("hint analyzer", "vendor", "SpringSource", Evidence.Confidence.HIGH);
    -  118  2 
                 dependency.getVendorEvidence().addEvidence("hint analyzer", "vendor", "vmware", Evidence.Confidence.HIGH);
    -  119   +  111  30 
             Set<Evidence> evidence = dependency.getProductEvidence().getEvidence();
    +  112  30 
             if (evidence.contains(springTest1) || evidence.contains(springTest2)) {
    +  113  4 
                 dependency.getProductEvidence().addEvidence("hint analyzer", "product", "springsource_spring_framework", Confidence.HIGH);
    +  114  4 
                 dependency.getVendorEvidence().addEvidence("hint analyzer", "vendor", "SpringSource", Confidence.HIGH);
    +  115  4 
                 dependency.getVendorEvidence().addEvidence("hint analyzer", "vendor", "vmware", Confidence.HIGH);
    +  116   
             }
    -  120   +  117   
     
    -  121  15 
             evidence = dependency.getVendorEvidence().getEvidence();
    -  122  15 
             if (evidence.contains(springTest3)) {
    -  123  2 
                 dependency.getProductEvidence().addEvidence("hint analyzer", "product", "springsource_spring_framework", Evidence.Confidence.HIGH);
    -  124  2 
                 dependency.getVendorEvidence().addEvidence("hint analyzer", "vendor", "vmware", Evidence.Confidence.HIGH);
    -  125   +  118  30 
             evidence = dependency.getVendorEvidence().getEvidence();
    +  119  30 
             if (evidence.contains(springTest3)) {
    +  120  4 
                 dependency.getProductEvidence().addEvidence("hint analyzer", "product", "springsource_spring_framework", Confidence.HIGH);
    +  121  4 
                 dependency.getVendorEvidence().addEvidence("hint analyzer", "vendor", "vmware", Confidence.HIGH);
    +  122   
             }
    -  126  15 
             final Iterator<Evidence> itr = dependency.getVendorEvidence().iterator();
    -  127  15 
             final ArrayList<Evidence> newEntries = new ArrayList<Evidence>();
    -  128  121 
             while (itr.hasNext()) {
    -  129  106 
                 final Evidence e = itr.next();
    -  130  106 
                 if ("sun".equalsIgnoreCase(e.getValue(false))) {
    -  131  2 
                     final Evidence newEvidence = new Evidence(e.getSource() + " (hint)", e.getName(), "oracle", e.getConfidence());
    -  132  2 
                     newEntries.add(newEvidence);
    -  133  2 
                 } else if ("oracle".equalsIgnoreCase(e.getValue(false))) {
    -  134  0 
                     final Evidence newEvidence = new Evidence(e.getSource() + " (hint)", e.getName(), "sun", e.getConfidence());
    -  135  0 
                     newEntries.add(newEvidence);
    -  136   +  123  30 
             final Iterator<Evidence> itr = dependency.getVendorEvidence().iterator();
    +  124  30 
             final ArrayList<Evidence> newEntries = new ArrayList<Evidence>();
    +  125  252 
             while (itr.hasNext()) {
    +  126  222 
                 final Evidence e = itr.next();
    +  127  222 
                 if ("sun".equalsIgnoreCase(e.getValue(false))) {
    +  128  4 
                     final Evidence newEvidence = new Evidence(e.getSource() + " (hint)", e.getName(), "oracle", e.getConfidence());
    +  129  4 
                     newEntries.add(newEvidence);
    +  130  4 
                 } else if ("oracle".equalsIgnoreCase(e.getValue(false))) {
    +  131  0 
                     final Evidence newEvidence = new Evidence(e.getSource() + " (hint)", e.getName(), "sun", e.getConfidence());
    +  132  0 
                     newEntries.add(newEvidence);
    +  133   
                 }
    -  137  106 
             }
    -  138  15 
             for (Evidence e : newEntries) {
    -  139  2 
                 dependency.getVendorEvidence().addEvidence(e);
    -  140  2 
             }
    -  141   +  134  222 
             }
    +  135  30 
             for (Evidence e : newEntries) {
    +  136  4 
                 dependency.getVendorEvidence().addEvidence(e);
    +  137  4 
             }
    +  138   
     
    -  142   - 
     
    -  143  15 
         }
    -  144   +  139  30 
         }
    +  140   
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.JarAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.JarAnalyzer.html index 8ab9b4860..cc34664c6 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.JarAnalyzer.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.JarAnalyzer.html @@ -12,8 +12,8 @@
     
    - - + +
    Classes in this File Line Coverage Branch Coverage Complexity
    JarAnalyzer
    77%
    326/422
    66%
    169/256
    		6.517
    JarAnalyzer$ClassNameInformation
    80%
    17/21
    90%
    9/10
    		6.517
    JarAnalyzer
    59%
    339/573
    48%
    173/356
    		8.188
    JarAnalyzer$ClassNameInformation
    80%
    17/21
    90%
    9/10
    		8.188
     
    @@ -25,89 +25,89 @@  3   
      *
     4   - 
      * Dependency-check-core is free software: you can redistribute it and/or modify it
    + 
      * Licensed under the Apache License, Version 2.0 (the "License");
     5   - 
      * under the terms of the GNU General Public License as published by the Free
    + 
      * you may not use this file except in compliance with the License.
     6   - 
      * Software Foundation, either version 3 of the License, or (at your option) any
    + 
      * You may obtain a copy of the License at
     7   - 
      * later version.
    + 
      *
     8   - 
      *
    + 
      *     http://www.apache.org/licenses/LICENSE-2.0
     9   - 
      * Dependency-check-core is distributed in the hope that it will be useful, but
    + 
      *
     10   - 
      * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
    + 
      * Unless required by applicable law or agreed to in writing, software
     11   - 
      * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
    + 
      * distributed under the License is distributed on an "AS IS" BASIS,
     12   - 
      * details.
    + 
      * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13   - 
      *
    + 
      * See the License for the specific language governing permissions and
     14   - 
      * You should have received a copy of the GNU General Public License along with
    + 
      * limitations under the License.
     15   - 
      * dependency-check-core. If not, see http://www.gnu.org/licenses/.
    -  16   
      *
    -  17   +  16   
      * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
    -  18   +  17   
      */
    -  19   +  18   
     package org.owasp.dependencycheck.analyzer;
    -  20   +  19   
     
    +  20   + 
     import java.io.BufferedOutputStream;
     21   
     import java.io.File;
     22   - 
     import java.util.Enumeration;
    + 
     import java.io.FileInputStream;
     23   - 
     import java.util.logging.Level;
    + 
     import java.io.FileNotFoundException;
     24   - 
     import java.util.logging.Logger;
    + 
     import java.io.FileOutputStream;
     25   - 
     import javax.xml.bind.JAXBException;
    -  26   - 
     import javax.xml.parsers.ParserConfigurationException;
    -  27   - 
     import org.owasp.dependencycheck.Engine;
    -  28   - 
     import org.owasp.dependencycheck.dependency.Dependency;
    -  29   - 
     import org.owasp.dependencycheck.dependency.Evidence;
    -  30   - 
     import org.owasp.dependencycheck.dependency.EvidenceCollection;
    -  31   
     import java.io.IOException;
    -  32   +  26   + 
     import java.io.InputStream;
    +  27   
     import java.io.InputStreamReader;
    -  33   +  28   
     import java.io.Reader;
    -  34   +  29   + 
     import java.io.UnsupportedEncodingException;
    +  30   
     import java.util.ArrayList;
    -  35   +  31   + 
     import java.util.Collections;
    +  32   + 
     import java.util.Enumeration;
    +  33   
     import java.util.HashMap;
    -  36   +  34   
     import java.util.List;
    -  37   +  35   
     import java.util.Map;
    -  38   +  36   
     import java.util.Map.Entry;
    -  39   +  37   
     import java.util.Properties;
    -  40   +  38   
     import java.util.Set;
    -  41   +  39   
     import java.util.StringTokenizer;
    -  42   +  40   
     import java.util.jar.Attributes;
    -  43   +  41   
     import java.util.jar.JarEntry;
    -  44   +  42   
     import java.util.jar.JarFile;
    -  45   +  43   
     import java.util.jar.Manifest;
    +  44   + 
     import java.util.logging.Level;
    +  45   + 
     import java.util.logging.Logger;
     46   
     import java.util.regex.Pattern;
     47   @@ -117,1738 +117,1981 @@  49   
     import javax.xml.bind.JAXBElement;
     50   - 
     import javax.xml.bind.Unmarshaller;
    + 
     import javax.xml.bind.JAXBException;
     51   - 
     import javax.xml.parsers.SAXParser;
    + 
     import javax.xml.bind.Unmarshaller;
     52   - 
     import javax.xml.parsers.SAXParserFactory;
    + 
     import javax.xml.parsers.ParserConfigurationException;
     53   - 
     import javax.xml.transform.sax.SAXSource;
    + 
     import javax.xml.parsers.SAXParser;
     54   - 
     import org.jsoup.Jsoup;
    + 
     import javax.xml.parsers.SAXParserFactory;
     55   - 
     import org.owasp.dependencycheck.jaxb.pom.MavenNamespaceFilter;
    + 
     import javax.xml.transform.sax.SAXSource;
     56   - 
     import org.owasp.dependencycheck.jaxb.pom.generated.License;
    + 
     import org.h2.store.fs.FileUtils;
     57   - 
     import org.owasp.dependencycheck.jaxb.pom.generated.Model;
    + 
     import org.jsoup.Jsoup;
     58   - 
     import org.owasp.dependencycheck.jaxb.pom.generated.Organization;
    + 
     import org.owasp.dependencycheck.Engine;
     59   - 
     import org.owasp.dependencycheck.utils.NonClosingStream;
    + 
     import org.owasp.dependencycheck.dependency.Confidence;
     60   - 
     import org.xml.sax.InputSource;
    + 
     import org.owasp.dependencycheck.dependency.Dependency;
     61   - 
     import org.xml.sax.SAXException;
    + 
     import org.owasp.dependencycheck.dependency.EvidenceCollection;
     62   - 
     import org.xml.sax.XMLFilter;
    + 
     import org.owasp.dependencycheck.jaxb.pom.MavenNamespaceFilter;
     63   - 
     import org.xml.sax.XMLReader;
    + 
     import org.owasp.dependencycheck.jaxb.pom.generated.License;
     64   - 
     
    + 
     import org.owasp.dependencycheck.jaxb.pom.generated.Model;
     65   - 
     /**
    + 
     import org.owasp.dependencycheck.jaxb.pom.generated.Organization;
     66   - 
      *
    + 
     import org.owasp.dependencycheck.jaxb.pom.generated.Parent;
     67   - 
      * Used to load a JAR file and collect information that can be used to determine
    + 
     import org.owasp.dependencycheck.utils.NonClosingStream;
     68   - 
      * the associated CPE.
    + 
     import org.owasp.dependencycheck.utils.Settings;
     69   - 
      *
    + 
     import org.xml.sax.InputSource;
     70   - 
      * @author Jeremy Long <jeremy.long@owasp.org>
    + 
     import org.xml.sax.SAXException;
     71   - 
      */
    + 
     import org.xml.sax.XMLFilter;
     72   - 
     public class JarAnalyzer extends AbstractAnalyzer implements Analyzer {
    + 
     import org.xml.sax.XMLReader;
     73   
     
     74   - 
         //<editor-fold defaultstate="collapsed" desc="Constants and Member Variables">
    + 
     /**
     75   - 
         /**
    + 
      *
     76   - 
          * The system independent newline character.
    + 
      * Used to load a JAR file and collect information that can be used to determine the associated CPE.
     77   - 
          */
    -  78  1 
         private static final String NEWLINE = System.getProperty("line.separator");
    + 
      *
    +  78   + 
      * @author Jeremy Long <jeremy.long@owasp.org>
     79   - 
         /**
    + 
      */
     80   - 
          * A list of values in the manifest to ignore as they only result in false
    + 
     public class JarAnalyzer extends AbstractAnalyzer implements Analyzer {
     81   - 
          * positives.
    + 
     
     82   - 
          */
    -  83  1 
         private static final Set<String> IGNORE_VALUES = newHashSet(
    + 
         //<editor-fold defaultstate="collapsed" desc="Constants and Member Variables">
    +  83   + 
         /**
     84   - 
                 "Sun Java System Application Server");
    + 
          * The buffer size to use when extracting files from the archive.
     85   - 
         /**
    + 
          */
     86   - 
          * A list of elements in the manifest to ignore.
    + 
         private static final int BUFFER_SIZE = 4096;
     87   - 
          */
    -  88  1 
         private static final Set<String> IGNORE_KEYS = newHashSet(
    + 
         /**
    +  88   + 
          * The count of directories created during analysis. This is used for creating temporary directories.
     89   - 
                 "built-by",
    -  90   - 
                 "created-by",
    + 
          */
    +  90  2 
         private static int dirCount = 0;
     91   - 
                 "builtby",
    + 
         /**
     92   - 
                 "createdby",
    + 
          * The system independent newline character.
     93   - 
                 "build-jdk",
    -  94   - 
                 "buildjdk",
    + 
          */
    +  94  2 
         private static final String NEWLINE = System.getProperty("line.separator");
     95   - 
                 "ant-version",
    + 
         /**
     96   - 
                 "antversion",
    + 
          * A list of values in the manifest to ignore as they only result in false positives.
     97   - 
                 "import-package",
    -  98   - 
                 "export-package",
    + 
          */
    +  98  2 
         private static final Set<String> IGNORE_VALUES = newHashSet(
     99   - 
                 "importpackage",
    + 
                 "Sun Java System Application Server");
     100   - 
                 "exportpackage",
    + 
         /**
     101   - 
                 "sealed",
    + 
          * A list of elements in the manifest to ignore.
     102   - 
                 "manifest-version",
    -  103   - 
                 "archiver-version",
    + 
          */
    +  103  2 
         private static final Set<String> IGNORE_KEYS = newHashSet(
     104   - 
                 "manifestversion",
    + 
                 "built-by",
     105   - 
                 "archiverversion",
    + 
                 "created-by",
     106   - 
                 "classpath",
    + 
                 "builtby",
     107   - 
                 "class-path",
    + 
                 "createdby",
     108   - 
                 "tool",
    + 
                 "build-jdk",
     109   - 
                 "bundle-manifestversion",
    + 
                 "buildjdk",
     110   - 
                 "bundlemanifestversion",
    + 
                 "ant-version",
     111   - 
                 "include-resource");
    + 
                 "antversion",
     112   - 
         /**
    + 
                 "import-package",
     113   - 
          * item in some manifest, should be considered medium confidence.
    + 
                 "export-package",
     114   - 
          */
    + 
                 "importpackage",
     115   - 
         private static final String BUNDLE_VERSION = "Bundle-Version"; //: 2.1.2
    + 
                 "exportpackage",
     116   - 
         /**
    + 
                 "sealed",
     117   - 
          * item in some manifest, should be considered medium confidence.
    + 
                 "manifest-version",
     118   - 
          */
    + 
                 "archiver-version",
     119   - 
         private static final String BUNDLE_DESCRIPTION = "Bundle-Description"; //: Apache Struts 2
    + 
                 "manifestversion",
     120   - 
         /**
    + 
                 "archiverversion",
     121   - 
          * item in some manifest, should be considered medium confidence.
    + 
                 "classpath",
     122   - 
          */
    + 
                 "class-path",
     123   - 
         private static final String BUNDLE_NAME = "Bundle-Name"; //: Struts 2 Core
    + 
                 "tool",
     124   - 
         /**
    + 
                 "bundle-manifestversion",
     125   - 
          * item in some manifest, should be considered medium confidence.
    + 
                 "bundlemanifestversion",
     126   - 
          */
    + 
                 "include-resource");
     127   - 
         private static final String BUNDLE_VENDOR = "Bundle-Vendor"; //: Apache Software Foundation
    + 
         /**
     128   - 
         /**
    + 
          * item in some manifest, should be considered medium confidence.
     129   - 
          * A pattern to detect HTML within text.
    + 
          */
     130   - 
          */
    -  131  1 
         private static final Pattern HTML_DETECTION_PATTERN = Pattern.compile("\\<[a-z]+.*/?\\>", Pattern.CASE_INSENSITIVE);
    + 
         private static final String BUNDLE_VERSION = "Bundle-Version"; //: 2.1.2
    +  131   + 
         /**
     132   - 
         /**
    + 
          * item in some manifest, should be considered medium confidence.
     133   - 
          * The unmarshaller used to parse the pom.xml from a JAR file.
    + 
          */
     134   - 
          */
    + 
         private static final String BUNDLE_DESCRIPTION = "Bundle-Description"; //: Apache Struts 2
     135   - 
         private Unmarshaller pomUnmarshaller;
    + 
         /**
     136   - 
         //</editor-fold>
    + 
          * item in some manifest, should be considered medium confidence.
     137   - 
     
    + 
          */
     138   - 
         /**
    + 
         private static final String BUNDLE_NAME = "Bundle-Name"; //: Struts 2 Core
     139   - 
          * Constructs a new JarAnalyzer.
    + 
         /**
     140   + 
          * item in some manifest, should be considered medium confidence.
    +  141   
          */
    -  141  13 
         public JarAnalyzer() {
     142   - 
             try {
    -  143  13 
                 final JAXBContext jaxbContext = JAXBContext.newInstance("org.owasp.dependencycheck.jaxb.pom.generated");
    -  144  13 
                 pomUnmarshaller = jaxbContext.createUnmarshaller();
    -  145  0 
             } catch (JAXBException ex) { //guess we will just have a null pointer exception later...
    -  146  0 
                 Logger.getLogger(JarAnalyzer.class.getName()).log(Level.SEVERE, "Unable to load parser. See the log for more details.");
    -  147  0 
                 Logger.getLogger(JarAnalyzer.class.getName()).log(Level.FINE, null, ex);
    -  148  13 
             }
    -  149  13 
         }
    + 
         private static final String BUNDLE_VENDOR = "Bundle-Vendor"; //: Apache Software Foundation
    +  143   + 
         /**
    +  144   + 
          * A pattern to detect HTML within text.
    +  145   + 
          */
    +  146  2 
         private static final Pattern HTML_DETECTION_PATTERN = Pattern.compile("\\<[a-z]+.*/?\\>", Pattern.CASE_INSENSITIVE);
    +  147   + 
         /**
    +  148   + 
          * The unmarshaller used to parse the pom.xml from a JAR file.
    +  149   + 
          */
     150   - 
         //<editor-fold defaultstate="collapsed" desc="All standard implmentation details of Analyzer">
    + 
         private Unmarshaller pomUnmarshaller;
     151   - 
         /**
    + 
         //</editor-fold>
     152   - 
          * The name of the analyzer.
    -  153   - 
          */
    -  154   - 
         private static final String ANALYZER_NAME = "Jar Analyzer";
    -  155   - 
         /**
    -  156   - 
          * The phase that this analyzer is intended to run in.
    -  157   - 
          */
    -  158  1 
         private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.INFORMATION_COLLECTION;
    -  159   - 
         /**
    -  160   - 
          * The set of file extensions supported by this analyzer.
    -  161   - 
          */
    -  162  1 
         private static final Set<String> EXTENSIONS = newHashSet("jar", "war");
    -  163   
     
    -  164   +  153   
         /**
    +  154   + 
          * Constructs a new JarAnalyzer.
    +  155   + 
          */
    +  156  26 
         public JarAnalyzer() {
    +  157   + 
             try {
    +  158  26 
                 final JAXBContext jaxbContext = JAXBContext.newInstance("org.owasp.dependencycheck.jaxb.pom.generated");
    +  159  26 
                 pomUnmarshaller = jaxbContext.createUnmarshaller();
    +  160  0 
             } catch (JAXBException ex) { //guess we will just have a null pointer exception later...
    +  161  0 
                 Logger.getLogger(JarAnalyzer.class.getName()).log(Level.SEVERE, "Unable to load parser. See the log for more details.");
    +  162  0 
                 Logger.getLogger(JarAnalyzer.class.getName()).log(Level.FINE, null, ex);
    +  163  26 
             }
    +  164  26 
         }
     165   - 
          * Returns a list of file EXTENSIONS supported by this analyzer.
    + 
         //<editor-fold defaultstate="collapsed" desc="All standard implmentation details of Analyzer">
     166   - 
          *
    + 
         /**
     167   - 
          * @return a list of file EXTENSIONS supported by this analyzer.
    + 
          * The name of the analyzer.
     168   
          */
     169   - 
         public Set<String> getSupportedExtensions() {
    -  170  146 
             return EXTENSIONS;
    + 
         private static final String ANALYZER_NAME = "Jar Analyzer";
    +  170   + 
         /**
     171   - 
         }
    + 
          * The phase that this analyzer is intended to run in.
     172   - 
     
    -  173   - 
         /**
    + 
          */
    +  173  2 
         private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.INFORMATION_COLLECTION;
     174   - 
          * Returns the name of the analyzer.
    + 
         /**
     175   - 
          *
    + 
          * The set of file extensions supported by this analyzer.
     176   - 
          * @return the name of the analyzer.
    -  177   
          */
    +  177  2 
         private static final Set<String> EXTENSIONS = newHashSet("jar", "war");
     178   - 
         public String getName() {
    -  179  10 
             return ANALYZER_NAME;
    + 
     
    +  179   + 
         /**
     180   - 
         }
    + 
          * Returns a list of file EXTENSIONS supported by this analyzer.
     181   - 
     
    + 
          *
     182   - 
         /**
    + 
          * @return a list of file EXTENSIONS supported by this analyzer.
     183   - 
          * Returns whether or not this analyzer can process the given extension.
    + 
          */
     184   - 
          *
    -  185   - 
          * @param extension the file extension to test for support.
    + 
         public Set<String> getSupportedExtensions() {
    +  185  310 
             return EXTENSIONS;
     186   - 
          * @return whether or not the specified file extension is supported by this
    + 
         }
     187   - 
          * analyzer.
    + 
     
     188   - 
          */
    + 
         /**
     189   - 
         public boolean supportsExtension(String extension) {
    -  190  142 
             return EXTENSIONS.contains(extension);
    + 
          * Returns the name of the analyzer.
    +  190   + 
          *
     191   - 
         }
    + 
          * @return the name of the analyzer.
     192   - 
     
    -  193   - 
         /**
    -  194   - 
          * Returns the phase that the analyzer is intended to run in.
    -  195   - 
          *
    -  196   - 
          * @return the phase that the analyzer is intended to run in.
    -  197   
          */
    -  198   - 
         public AnalysisPhase getAnalysisPhase() {
    -  199  6 
             return ANALYSIS_PHASE;
    -  200   +  193   + 
         public String getName() {
    +  194  20 
             return ANALYZER_NAME;
    +  195   
         }
    -  201   - 
         //</editor-fold>
    -  202   +  196   
     
    -  203   +  197   
         /**
    -  204   - 
          * Loads a specified JAR file and collects information from the manifest and
    -  205   - 
          * checksums to identify the correct CPE information.
    -  206   +  198   + 
          * Returns whether or not this analyzer can process the given extension.
    +  199   
          *
    +  200   + 
          * @param extension the file extension to test for support.
    +  201   + 
          * @return whether or not the specified file extension is supported by this analyzer.
    +  202   + 
          */
    +  203   + 
         public boolean supportsExtension(String extension) {
    +  204  302 
             return EXTENSIONS.contains(extension);
    +  205   + 
         }
    +  206   + 
     
     207   - 
          * @param dependency the dependency to analyze.
    + 
         /**
     208   - 
          * @param engine the engine that is scanning the dependencies
    + 
          * Returns the phase that the analyzer is intended to run in.
     209   - 
          * @throws AnalysisException is thrown if there is an error reading the JAR
    + 
          *
     210   - 
          * file.
    + 
          * @return the phase that the analyzer is intended to run in.
     211   
          */
     212   - 
         @Override
    -  213   - 
         public void analyze(Dependency dependency, Engine engine) throws AnalysisException {
    + 
         public AnalysisPhase getAnalysisPhase() {
    +  213  12 
             return ANALYSIS_PHASE;
     214   - 
             try {
    -  215  18 
                 final ArrayList<ClassNameInformation> classNames = collectClassNames(dependency);
    -  216  18 
                 final String fileName = dependency.getFileName().toLowerCase();
    -  217  18 
                 if (classNames.isEmpty()
    + 
         }
    +  215   + 
         //</editor-fold>
    +  216   + 
     
    +  217   + 
         /**
     218   - 
                         && (fileName.endsWith("-sources.jar")
    + 
          * Loads a specified JAR file and collects information from the manifest and checksums to identify the correct CPE
     219   - 
                         || fileName.endsWith("-javadoc.jar")
    + 
          * information.
     220   - 
                         || fileName.endsWith("-src.jar")
    + 
          *
     221   - 
                         || fileName.endsWith("-doc.jar"))) {
    -  222  0 
                     engine.getDependencies().remove(dependency);
    + 
          * @param dependency the dependency to analyze.
    +  222   + 
          * @param engine the engine that is scanning the dependencies
     223   - 
                 }
    -  224  18 
                 final boolean hasManifest = parseManifest(dependency, classNames);
    -  225  18 
                 final boolean hasPOM = analyzePOM(dependency, classNames);
    -  226  18 
                 final boolean addPackagesAsEvidence = !(hasManifest && hasPOM);
    -  227  18 
                 analyzePackageNames(classNames, dependency, addPackagesAsEvidence);
    -  228  0 
             } catch (IOException ex) {
    -  229  0 
                 throw new AnalysisException("Exception occurred reading the JAR file.", ex);
    -  230  18 
             }
    -  231  18 
         }
    + 
          * @throws AnalysisException is thrown if there is an error reading the JAR file.
    +  224   + 
          */
    +  225   + 
         @Override
    +  226   + 
         public void analyze(Dependency dependency, Engine engine) throws AnalysisException {
    +  227   + 
             try {
    +  228  36 
                 final ArrayList<ClassNameInformation> classNames = collectClassNames(dependency);
    +  229  36 
                 final String fileName = dependency.getFileName().toLowerCase();
    +  230  36 
                 if (classNames.isEmpty()
    +  231   + 
                         && (fileName.endsWith("-sources.jar")
     232   - 
     
    + 
                         || fileName.endsWith("-javadoc.jar")
     233   - 
         /**
    + 
                         || fileName.endsWith("-src.jar")
     234   - 
          * Attempts to find a pom.xml within the JAR file. If found it extracts
    -  235   - 
          * information and adds it to the evidence. This will attempt to interpolate
    + 
                         || fileName.endsWith("-doc.jar"))) {
    +  235  0 
                     engine.getDependencies().remove(dependency);
     236   - 
          * the strings contained within the pom.properties if one exists.
    -  237   - 
          *
    -  238   - 
          * @param dependency the dependency being analyzed
    -  239   - 
          * @param classes a collection of class name information
    -  240   - 
          * @throws AnalysisException is thrown if there is an exception parsing the
    -  241   - 
          * pom
    -  242   - 
          * @return whether or not evidence was added to the dependency
    -  243   - 
          */
    -  244   - 
         protected boolean analyzePOM(Dependency dependency, ArrayList<ClassNameInformation> classes) throws AnalysisException {
    -  245  18 
             boolean foundSomething = false;
    + 
                 }
    +  237  36 
                 final boolean hasManifest = parseManifest(dependency, classNames);
    +  238  36 
                 final boolean hasPOM = analyzePOM(dependency, classNames, engine);
    +  239  36 
                 final boolean addPackagesAsEvidence = !(hasManifest && hasPOM);
    +  240  36 
                 analyzePackageNames(classNames, dependency, addPackagesAsEvidence);
    +  241  0 
             } catch (IOException ex) {
    +  242  0 
                 throw new AnalysisException("Exception occurred reading the JAR file.", ex);
    +  243  36 
             }
    +  244  36 
         }
    +  245   + 
     
     246   - 
             final JarFile jar;
    + 
         /**
     247   - 
             try {
    -  248  18 
                 jar = new JarFile(dependency.getActualFilePath());
    -  249  0 
             } catch (IOException ex) {
    -  250  0 
                 final String msg = String.format("Unable to read JarFile '%s'.", dependency.getActualFilePath());
    -  251  0 
                 final AnalysisException ax = new AnalysisException(msg, ex);
    -  252  0 
                 dependency.getAnalysisExceptions().add(ax);
    -  253  0 
                 Logger.getLogger(JarAnalyzer.class.getName()).log(Level.WARNING, msg);
    -  254  0 
                 Logger.getLogger(JarAnalyzer.class.getName()).log(Level.FINE, null, ex);
    -  255  0 
                 return false;
    -  256  18 
             }
    -  257   - 
             List<String> pomEntries;
    + 
          * Attempts to find a pom.xml within the JAR file. If found it extracts information and adds it to the evidence.
    +  248   + 
          * This will attempt to interpolate the strings contained within the pom.properties if one exists.
    +  249   + 
          *
    +  250   + 
          * @param dependency the dependency being analyzed
    +  251   + 
          * @param classes a collection of class name information
    +  252   + 
          * @param engine the analysis engine, used to add additional dependencies
    +  253   + 
          * @throws AnalysisException is thrown if there is an exception parsing the pom
    +  254   + 
          * @return whether or not evidence was added to the dependency
    +  255   + 
          */
    +  256   + 
         protected boolean analyzePOM(Dependency dependency, ArrayList<ClassNameInformation> classes, Engine engine) throws AnalysisException {
    +  257  36 
             boolean foundSomething = false;
     258   + 
             final JarFile jar;
    +  259   
             try {
    -  259  18 
                 pomEntries = retrievePomListing(jar);
    -  260  0 
             } catch (IOException ex) {
    -  261  0 
                 final String msg = String.format("Unable to read Jar file entries in '%s'.", dependency.getActualFilePath());
    -  262  0 
                 final AnalysisException ax = new AnalysisException(msg, ex);
    -  263  0 
                 dependency.getAnalysisExceptions().add(ax);
    -  264  0 
                 Logger.getLogger(JarAnalyzer.class.getName()).log(Level.WARNING, msg);
    -  265  0 
                 Logger.getLogger(JarAnalyzer.class.getName()).log(Level.INFO, msg, ex);
    -  266  0 
                 return false;
    -  267  18 
             }
    -  268  18 
             if (pomEntries.isEmpty()) {
    -  269  11 
                 return false;
    +  260  36 
                 jar = new JarFile(dependency.getActualFilePath());
    +  261  0 
             } catch (IOException ex) {
    +  262  0 
                 final String msg = String.format("Unable to read JarFile '%s'.", dependency.getActualFilePath());
    +  263  0 
                 final AnalysisException ax = new AnalysisException(msg, ex);
    +  264  0 
                 dependency.getAnalysisExceptions().add(ax);
    +  265  0 
                 Logger.getLogger(JarAnalyzer.class.getName()).log(Level.WARNING, msg);
    +  266  0 
                 Logger.getLogger(JarAnalyzer.class.getName()).log(Level.FINE, null, ex);
    +  267  0 
                 return false;
    +  268  36 
             }
    +  269   + 
             List<String> pomEntries;
     270   - 
             }
    -  271  7 
             if (pomEntries.size() > 1) { //need to sort out which pom we will use
    -  272  0 
                 pomEntries = filterPomEntries(pomEntries, classes);
    -  273   - 
             }
    -  274  7 
             for (String path : pomEntries) {
    -  275  7 
                 Properties pomProperties = null;
    -  276   - 
                 try {
    -  277  7 
                     pomProperties = retrievePomProperties(path, jar);
    -  278  0 
                 } catch (IOException ex) {
    -  279  0 
                     Logger.getLogger(JarAnalyzer.class.getName()).log(Level.FINEST, "ignore this, failed reading a non-existent pom.properties", ex);
    -  280  7 
                 }
    -  281  7 
                 Model pom = null;
    + 
             try {
    +  271  36 
                 pomEntries = retrievePomListing(jar);
    +  272  0 
             } catch (IOException ex) {
    +  273  0 
                 final String msg = String.format("Unable to read Jar file entries in '%s'.", dependency.getActualFilePath());
    +  274  0 
                 final AnalysisException ax = new AnalysisException(msg, ex);
    +  275  0 
                 dependency.getAnalysisExceptions().add(ax);
    +  276  0 
                 Logger.getLogger(JarAnalyzer.class.getName()).log(Level.WARNING, msg);
    +  277  0 
                 Logger.getLogger(JarAnalyzer.class.getName()).log(Level.INFO, msg, ex);
    +  278  0 
                 return false;
    +  279  36 
             }
    +  280  36 
             if (pomEntries.isEmpty()) {
    +  281  22 
                 return false;
     282   + 
             }
    +  283  14 
             for (String path : pomEntries) {
    +  284  14 
                 Properties pomProperties = null;
    +  285   
                 try {
    -  283  7 
                     pom = retrievePom(path, jar);
    -  284  7 
                     foundSomething = setPomEvidence(dependency, pom, pomProperties, classes) || foundSomething;
    -  285  0 
                 } catch (AnalysisException ex) {
    -  286  0 
                     dependency.addAnalysisException(ex);
    -  287  7 
                 }
    -  288  7 
             }
    -  289  7 
             return foundSomething;
    -  290   - 
         }
    +  286  14 
                     pomProperties = retrievePomProperties(path, jar);
    +  287  0 
                 } catch (IOException ex) {
    +  288  0 
                     Logger.getLogger(JarAnalyzer.class.getName()).log(Level.FINEST, "ignore this, failed reading a non-existent pom.properties", ex);
    +  289  14 
                 }
    +  290  14 
                 Model pom = null;
     291   - 
     
    -  292   - 
         /**
    -  293   - 
          * Given a path to a pom.xml within a JarFile, this method attempts to load
    -  294   - 
          * a sibling pom.properties if one exists.
    -  295   - 
          *
    -  296   - 
          * @param path the path to the pom.xml within the JarFile
    -  297   - 
          * @param jar the JarFile to load the pom.properties from
    -  298   - 
          * @return a Properties object or null if no pom.properties was found
    -  299   - 
          * @throws IOException thrown if there is an exception reading the
    -  300   - 
          * pom.properties
    -  301   - 
          */
    -  302   - 
         @edu.umd.cs.findbugs.annotations.SuppressWarnings(value = "OS_OPEN_STREAM",
    -  303   - 
                 justification = "The reader is closed by closing the zipEntry")
    -  304   - 
         private Properties retrievePomProperties(String path, final JarFile jar) throws IOException {
    -  305  7 
             Properties pomProperties = null;
    -  306  7 
             final String propPath = path.substring(0, path.length() - 7) + "pom.properies";
    -  307  7 
             final ZipEntry propEntry = jar.getEntry(propPath);
    -  308  7 
             if (propEntry != null) {
    -  309  0 
                 final Reader reader = new InputStreamReader(jar.getInputStream(propEntry), "UTF-8");
    -  310  0 
                 pomProperties = new Properties();
    -  311  0 
                 pomProperties.load(reader);
    -  312   - 
             }
    -  313  7 
             return pomProperties;
    -  314   - 
         }
    -  315   - 
     
    -  316   - 
         /**
    -  317   - 
          * Searches a JarFile for pom.xml entries and returns a listing of these
    -  318   - 
          * entries.
    -  319   - 
          *
    -  320   - 
          * @param jar the JarFile to search
    -  321   - 
          * @return a list of pom.xml entries
    -  322   - 
          * @throws IOException thrown if there is an exception reading a JarEntryf
    -  323   - 
          */
    -  324   - 
         private List<String> retrievePomListing(final JarFile jar) throws IOException {
    -  325  18 
             final List<String> pomEntries = new ArrayList<String>();
    -  326  18 
             final Enumeration<JarEntry> entries = jar.entries();
    -  327  7564 
             while (entries.hasMoreElements()) {
    -  328  7546 
                 final JarEntry entry = entries.nextElement();
    -  329  7546 
                 final String entryName = (new File(entry.getName())).getName().toLowerCase();
    -  330  7546 
                 if (!entry.isDirectory() && "pom.xml".equals(entryName)) {
    -  331  7 
                     pomEntries.add(entry.getName());
    -  332   - 
                 }
    -  333  7546 
             }
    -  334  18 
             return pomEntries;
    -  335   - 
         }
    -  336   - 
     
    -  337   - 
         /**
    -  338   - 
          * Retrieves the specified POM from a jar file and converts it to a Model.
    -  339   - 
          *
    -  340   - 
          * @param path the path to the pom.xml file within the jar file
    -  341   - 
          * @param jar the jar file to extract the pom from
    -  342   - 
          * @return returns a
    -  343   - 
          * @throws AnalysisException is thrown if there is an exception extracting
    -  344   - 
          * or parsing the POM
    -  345   - 
          * {@link org.owasp.dependencycheck.jaxb.pom.generated.Model} object
    -  346   - 
          */
    -  347   - 
         private Model retrievePom(String path, JarFile jar) throws AnalysisException {
    -  348  7 
             final ZipEntry entry = jar.getEntry(path);
    -  349  7 
             Model model = null;
    -  350  7 
             if (entry != null) { //should never be null
    -  351   
                 try {
    -  352  7 
                     final XMLFilter filter = new MavenNamespaceFilter();
    -  353  7 
                     final SAXParserFactory spf = SAXParserFactory.newInstance();
    -  354  7 
                     final SAXParser sp = spf.newSAXParser();
    -  355  7 
                     final XMLReader xr = sp.getXMLReader();
    -  356  7 
                     filter.setParent(xr);
    -  357  7 
                     final NonClosingStream stream = new NonClosingStream(jar.getInputStream(entry));
    -  358  7 
                     final InputStreamReader reader = new InputStreamReader(stream, "UTF-8");
    -  359  7 
                     final InputSource xml = new InputSource(reader);
    -  360  7 
                     final SAXSource source = new SAXSource(filter, xml);
    -  361  7 
                     final JAXBElement<Model> el = pomUnmarshaller.unmarshal(source, Model.class);
    -  362  7 
                     model = el.getValue();
    -  363  0 
                 } catch (SecurityException ex) {
    -  364  0 
                     final String msg = String.format("Unable to parse pom '%s' in jar '%s'; invalid signature", path, jar.getName());
    -  365  0 
                     Logger.getLogger(JarAnalyzer.class.getName()).log(Level.WARNING, msg);
    -  366  0 
                     Logger.getLogger(JarAnalyzer.class.getName()).log(Level.FINE, null, ex);
    -  367  0 
                     throw new AnalysisException(ex);
    -  368  0 
                 } catch (ParserConfigurationException ex) {
    -  369  0 
                     final String msg = String.format("Unable to parse pom '%s' in jar '%s' (Parser Configuration Error)", path, jar.getName());
    -  370  0 
                     Logger.getLogger(JarAnalyzer.class.getName()).log(Level.WARNING, msg);
    -  371  0 
                     Logger.getLogger(JarAnalyzer.class.getName()).log(Level.FINE, null, ex);
    -  372  0 
                     throw new AnalysisException(ex);
    -  373  0 
                 } catch (SAXException ex) {
    -  374  0 
                     final String msg = String.format("Unable to parse pom '%s' in jar '%s' (SAX Error)", path, jar.getName());
    -  375  0 
                     Logger.getLogger(JarAnalyzer.class.getName()).log(Level.WARNING, msg);
    -  376  0 
                     Logger.getLogger(JarAnalyzer.class.getName()).log(Level.FINE, null, ex);
    -  377  0 
                     throw new AnalysisException(ex);
    -  378  0 
                 } catch (JAXBException ex) {
    -  379  0 
                     final String msg = String.format("Unable to parse pom '%s' in jar '%s' (JAXB Exception)", path, jar.getName());
    -  380  0 
                     Logger.getLogger(JarAnalyzer.class.getName()).log(Level.WARNING, msg);
    -  381  0 
                     Logger.getLogger(JarAnalyzer.class.getName()).log(Level.FINE, null, ex);
    -  382  0 
                     throw new AnalysisException(ex);
    -  383  0 
                 } catch (IOException ex) {
    -  384  0 
                     final String msg = String.format("Unable to parse pom '%s' in jar '%s' (IO Exception)", path, jar.getName());
    -  385  0 
                     Logger.getLogger(JarAnalyzer.class.getName()).log(Level.WARNING, msg);
    -  386  0 
                     Logger.getLogger(JarAnalyzer.class.getName()).log(Level.FINE, null, ex);
    -  387  0 
                     throw new AnalysisException(ex);
    -  388  0 
                 } catch (Throwable ex) {
    -  389  0 
                     final String msg = String.format("Unexpected error during parsing of the pom '%s' in jar '%s'", path, jar.getName());
    -  390  0 
                     Logger.getLogger(JarAnalyzer.class.getName()).log(Level.WARNING, msg);
    -  391  0 
                     Logger.getLogger(JarAnalyzer.class.getName()).log(Level.FINE, null, ex);
    -  392  0 
                     throw new AnalysisException(ex);
    -  393  7 
                 }
    -  394   - 
             }
    -  395  7 
             return model;
    -  396   - 
         }
    -  397   +  292  14 
                     if (pomEntries.size() > 1) {
    +  293   + 
                         //extract POM to its own directory and add it as its own dependency
    +  294  0 
                         final Dependency newDependency = new Dependency();
    +  295  0 
                         pom = extractPom(path, jar, newDependency);
    +  296   
     
    -  398   +  297  0 
                         final String displayPath = String.format("%s%s%s",
    +  298   + 
                                 dependency.getFilePath(),
    +  299   + 
                                 File.separator,
    +  300   + 
                                 path); //.replaceAll("[\\/]", File.separator));
    +  301  0 
                         final String displayName = String.format("%s%s%s",
    +  302   + 
                                 dependency.getFileName(),
    +  303   + 
                                 File.separator,
    +  304   + 
                                 path); //.replaceAll("[\\/]", File.separator));
    +  305   + 
     
    +  306  0 
                         newDependency.setFileName(displayName);
    +  307  0 
                         newDependency.setFilePath(displayPath);
    +  308  0 
                         addPomEvidence(newDependency, pom, pomProperties);
    +  309  0 
                         engine.getDependencies().add(newDependency);
    +  310  0 
                         Collections.sort(engine.getDependencies());
    +  311  0 
                     } else {
    +  312  14 
                         pom = retrievePom(path, jar);
    +  313  14 
                         foundSomething |= setPomEvidence(dependency, pom, pomProperties, classes);
    +  314   + 
                     }
    +  315  0 
                 } catch (AnalysisException ex) {
    +  316  0 
                     dependency.addAnalysisException(ex);
    +  317  14 
                 }
    +  318  14 
             }
    +  319  14 
             return foundSomething;
    +  320   + 
         }
    +  321   + 
     
    +  322   
         /**
    -  399   - 
          * Sets evidence from the pom on the supplied dependency.
    -  400   +  323   + 
          * Given a path to a pom.xml within a JarFile, this method attempts to load a sibling pom.properties if one exists.
    +  324   
          *
    -  401   - 
          * @param dependency the dependency to set data on
    -  402   - 
          * @param pom the information from the pom
    -  403   - 
          * @param pomProperties the pom properties file (null if none exists)
    -  404   - 
          * @param classes a collection of ClassNameInformation - containing data
    -  405   - 
          * about the fully qualified class names within the JAR file being analyzed
    -  406   - 
          * @return true if there was evidence within the pom that we could use;
    -  407   - 
          * otherwise false
    -  408   +  325   + 
          * @param path the path to the pom.xml within the JarFile
    +  326   + 
          * @param jar the JarFile to load the pom.properties from
    +  327   + 
          * @return a Properties object or null if no pom.properties was found
    +  328   + 
          * @throws IOException thrown if there is an exception reading the pom.properties
    +  329   
          */
    -  409   - 
         private boolean setPomEvidence(Dependency dependency, Model pom, Properties pomProperties, ArrayList<ClassNameInformation> classes) {
    -  410  7 
             boolean foundSomething = false;
    -  411  7 
             if (pom == null) {
    -  412  0 
                 return foundSomething;
    -  413   +  330   + 
         @edu.umd.cs.findbugs.annotations.SuppressWarnings(value = "OS_OPEN_STREAM",
    +  331   + 
                 justification = "The reader is closed by closing the zipEntry")
    +  332   + 
         private Properties retrievePomProperties(String path, final JarFile jar) throws IOException {
    +  333  14 
             Properties pomProperties = null;
    +  334  14 
             final String propPath = path.substring(0, path.length() - 7) + "pom.properies";
    +  335  14 
             final ZipEntry propEntry = jar.getEntry(propPath);
    +  336  14 
             if (propEntry != null) {
    +  337  0 
                 final Reader reader = new InputStreamReader(jar.getInputStream(propEntry), "UTF-8");
    +  338  0 
                 pomProperties = new Properties();
    +  339  0 
                 pomProperties.load(reader);
    +  340   
             }
    -  414  7 
             String groupid = interpolateString(pom.getGroupId(), pomProperties);
    -  415  7 
             if (groupid != null && !groupid.isEmpty()) {
    -  416  4 
                 if (groupid.startsWith("org.") || groupid.startsWith("com.")) {
    -  417  3 
                     groupid = groupid.substring(4);
    -  418   - 
                 }
    -  419  4 
                 foundSomething = true;
    -  420  4 
                 dependency.getVendorEvidence().addEvidence("pom", "groupid", groupid, Evidence.Confidence.HIGH);
    -  421  4 
                 dependency.getProductEvidence().addEvidence("pom", "groupid", groupid, Evidence.Confidence.LOW);
    -  422  4 
                 addMatchingValues(classes, groupid, dependency.getVendorEvidence());
    -  423  4 
                 addMatchingValues(classes, groupid, dependency.getProductEvidence());
    -  424   - 
             }
    -  425  7 
             String artifactid = interpolateString(pom.getArtifactId(), pomProperties);
    -  426  7 
             if (artifactid != null && !artifactid.isEmpty()) {
    -  427  7 
                 if (artifactid.startsWith("org.") || artifactid.startsWith("com.")) {
    -  428  0 
                     artifactid = artifactid.substring(4);
    -  429   - 
                 }
    -  430  7 
                 foundSomething = true;
    -  431  7 
                 dependency.getProductEvidence().addEvidence("pom", "artifactid", artifactid, Evidence.Confidence.HIGH);
    -  432  7 
                 dependency.getVendorEvidence().addEvidence("pom", "artifactid", artifactid, Evidence.Confidence.LOW);
    -  433  7 
                 addMatchingValues(classes, artifactid, dependency.getVendorEvidence());
    -  434  7 
                 addMatchingValues(classes, artifactid, dependency.getProductEvidence());
    -  435   - 
             }
    -  436   - 
             //version
    -  437  7 
             final String version = interpolateString(pom.getVersion(), pomProperties);
    -  438  7 
             if (version != null && !version.isEmpty()) {
    -  439  2 
                 foundSomething = true;
    -  440  2 
                 dependency.getVersionEvidence().addEvidence("pom", "version", version, Evidence.Confidence.HIGHEST);
    -  441   - 
             }
    -  442   - 
             // org name
    -  443  7 
             final Organization org = pom.getOrganization();
    -  444  7 
             if (org != null && org.getName() != null) {
    -  445  0 
                 foundSomething = true;
    -  446  0 
                 final String orgName = interpolateString(org.getName(), pomProperties);
    -  447  0 
                 if (orgName != null && !orgName.isEmpty()) {
    -  448  0 
                     dependency.getVendorEvidence().addEvidence("pom", "organization name", orgName, Evidence.Confidence.HIGH);
    -  449  0 
                     addMatchingValues(classes, orgName, dependency.getVendorEvidence());
    -  450   - 
                 }
    -  451   - 
             }
    -  452   - 
             //pom name
    -  453  7 
             final String pomName = interpolateString(pom.getName(), pomProperties);
    -  454  7 
             if (pomName != null && !pomName.isEmpty()) {
    -  455  7 
                 foundSomething = true;
    -  456  7 
                 dependency.getProductEvidence().addEvidence("pom", "name", pomName, Evidence.Confidence.HIGH);
    -  457  7 
                 dependency.getVendorEvidence().addEvidence("pom", "name", pomName, Evidence.Confidence.HIGH);
    -  458  7 
                 addMatchingValues(classes, pomName, dependency.getVendorEvidence());
    -  459  7 
                 addMatchingValues(classes, pomName, dependency.getProductEvidence());
    -  460   - 
             }
    -  461   - 
     
    -  462   - 
             //Description
    -  463  7 
             if (pom.getDescription() != null) {
    -  464  3 
                 foundSomething = true;
    -  465  3 
                 final String description = interpolateString(pom.getDescription(), pomProperties);
    -  466  3 
                 if (description != null && !description.isEmpty()) {
    -  467  3 
                     addDescription(dependency, description, "pom", "description");
    -  468  3 
                     addMatchingValues(classes, description, dependency.getVendorEvidence());
    -  469  3 
                     addMatchingValues(classes, description, dependency.getProductEvidence());
    -  470   - 
                 }
    -  471   - 
             }
    -  472   - 
     
    -  473   - 
             //license
    -  474  7 
             if (pom.getLicenses() != null) {
    -  475  1 
                 String license = null;
    -  476  1 
                 for (License lic : pom.getLicenses().getLicense()) {
    -  477  1 
                     String tmp = null;
    -  478  1 
                     if (lic.getName() != null) {
    -  479  1 
                         tmp = interpolateString(lic.getName(), pomProperties);
    -  480   - 
                     }
    -  481  1 
                     if (lic.getUrl() != null) {
    -  482  1 
                         if (tmp == null) {
    -  483  0 
                             tmp = interpolateString(lic.getUrl(), pomProperties);
    -  484   - 
                         } else {
    -  485  1 
                             tmp += ": " + interpolateString(lic.getUrl(), pomProperties);
    -  486   - 
                         }
    -  487   - 
                     }
    -  488  1 
                     if (tmp == null) {
    -  489  0 
                         continue;
    -  490   - 
                     }
    -  491  1 
                     if (HTML_DETECTION_PATTERN.matcher(tmp).find()) {
    -  492  0 
                         tmp = Jsoup.parse(tmp).text();
    -  493   - 
                     }
    -  494  1 
                     if (license == null) {
    -  495  1 
                         license = tmp;
    -  496   - 
                     } else {
    -  497  0 
                         license += "\n" + tmp;
    -  498   - 
                     }
    -  499  1 
                 }
    -  500  1 
                 if (license != null) {
    -  501  1 
                     dependency.setLicense(license);
    -  502   - 
                 }
    -  503   - 
             }
    -  504  7 
             return foundSomething;
    -  505   +  341  14 
             return pomProperties;
    +  342   
         }
    -  506   +  343   
     
    -  507   +  344   
         /**
    +  345   + 
          * Searches a JarFile for pom.xml entries and returns a listing of these entries.
    +  346   + 
          *
    +  347   + 
          * @param jar the JarFile to search
    +  348   + 
          * @return a list of pom.xml entries
    +  349   + 
          * @throws IOException thrown if there is an exception reading a JarEntryf
    +  350   + 
          */
    +  351   + 
         private List<String> retrievePomListing(final JarFile jar) throws IOException {
    +  352  36 
             final List<String> pomEntries = new ArrayList<String>();
    +  353  36 
             final Enumeration<JarEntry> entries = jar.entries();
    +  354  15128 
             while (entries.hasMoreElements()) {
    +  355  15092 
                 final JarEntry entry = entries.nextElement();
    +  356  15092 
                 final String entryName = (new File(entry.getName())).getName().toLowerCase();
    +  357  15092 
                 if (!entry.isDirectory() && "pom.xml".equals(entryName)) {
    +  358  14 
                     pomEntries.add(entry.getName());
    +  359   + 
                 }
    +  360  15092 
             }
    +  361  36 
             return pomEntries;
    +  362   + 
         }
    +  363   + 
     
    +  364   + 
         /**
    +  365   + 
          * Retrieves the specified POM from a jar file and converts it to a Model.
    +  366   + 
          *
    +  367   + 
          * @param path the path to the pom.xml file within the jar file
    +  368   + 
          * @param jar the jar file to extract the pom from
    +  369   + 
          * @param dependency the dependency being analyzed
    +  370   + 
          * @return returns the POM object
    +  371   + 
          * @throws AnalysisException is thrown if there is an exception extracting or parsing the POM
    +  372   + 
          * {@link org.owasp.dependencycheck.jaxb.pom.generated.Model} object
    +  373   + 
          */
    +  374   + 
         private Model extractPom(String path, JarFile jar, Dependency dependency) throws AnalysisException {
    +  375  0 
             InputStream input = null;
    +  376  0 
             FileOutputStream fos = null;
    +  377  0 
             BufferedOutputStream bos = null;
    +  378  0 
             final File tmpDir = getNextTempDirectory();
    +  379  0 
             final File file = new File(tmpDir, "pom.xml");
    +  380   + 
             try {
    +  381  0 
                 final ZipEntry entry = jar.getEntry(path);
    +  382  0 
                 input = jar.getInputStream(entry);
    +  383  0 
                 fos = new FileOutputStream(file);
    +  384  0 
                 bos = new BufferedOutputStream(fos, BUFFER_SIZE);
    +  385   + 
                 int count;
    +  386  0 
                 final byte data[] = new byte[BUFFER_SIZE];
    +  387  0 
                 while ((count = input.read(data, 0, BUFFER_SIZE)) != -1) {
    +  388  0 
                     bos.write(data, 0, count);
    +  389   + 
                 }
    +  390  0 
                 bos.flush();
    +  391  0 
                 dependency.setActualFilePath(file.getAbsolutePath());
    +  392  0 
             } catch (IOException ex) {
    +  393  0 
                 Logger.getLogger(JarAnalyzer.class.getName()).log(Level.SEVERE, null, ex);
    +  394   + 
             } finally {
    +  395  0 
                 try {
    +  396  0 
                     input.close();
    +  397  0 
                 } catch (IOException ex) {
    +  398  0 
                     Logger.getLogger(JarAnalyzer.class.getName()).log(Level.SEVERE, null, ex);
    +  399  0 
                 }
    +  400  0 
             }
    +  401  0 
             Model model = null;
    +  402  0 
             FileInputStream fis = null;
    +  403   + 
             try {
    +  404  0 
                 fis = new FileInputStream(file);
    +  405  0 
                 final InputStreamReader reader = new InputStreamReader(fis, "UTF-8");
    +  406  0 
                 final InputSource xml = new InputSource(reader);
    +  407  0 
                 final SAXSource source = new SAXSource(xml);
    +  408  0 
                 model = readPom(source);
    +  409  0 
             } catch (FileNotFoundException ex) {
    +  410  0 
                 final String msg = String.format("Unable to parse pom '%s' in jar '%s' (File Not Found)", path, jar.getName());
    +  411  0 
                 Logger.getLogger(JarAnalyzer.class.getName()).log(Level.WARNING, msg);
    +  412  0 
                 Logger.getLogger(JarAnalyzer.class.getName()).log(Level.FINE, null, ex);
    +  413  0 
                 throw new AnalysisException(ex);
    +  414  0 
             } catch (UnsupportedEncodingException ex) {
    +  415  0 
                 final String msg = String.format("Unable to parse pom '%s' in jar '%s' (IO Exception)", path, jar.getName());
    +  416  0 
                 Logger.getLogger(JarAnalyzer.class.getName()).log(Level.WARNING, msg);
    +  417  0 
                 Logger.getLogger(JarAnalyzer.class.getName()).log(Level.FINE, null, ex);
    +  418  0 
                 throw new AnalysisException(ex);
    +  419  0 
             } catch (AnalysisException ex) {
    +  420  0 
                 final String msg = String.format("Unable to parse pom '%s' in jar '%s'", path, jar.getName());
    +  421  0 
                 Logger.getLogger(JarAnalyzer.class.getName()).log(Level.WARNING, msg);
    +  422  0 
                 Logger.getLogger(JarAnalyzer.class.getName()).log(Level.FINE, null, ex);
    +  423  0 
                 throw ex;
    +  424   + 
             } finally {
    +  425  0 
                 if (fis != null) {
    +  426   + 
                     try {
    +  427  0 
                         fis.close();
    +  428  0 
                     } catch (IOException ex) {
    +  429  0 
                         Logger.getLogger(JarAnalyzer.class.getName()).log(Level.FINEST, null, ex);
    +  430  0 
                     }
    +  431   + 
                 }
    +  432   + 
             }
    +  433  0 
             return model;
    +  434   + 
         }
    +  435   + 
     
    +  436   + 
         /**
    +  437   + 
          * Retrieves the specified POM from a jar file and converts it to a Model.
    +  438   + 
          *
    +  439   + 
          * @param path the path to the pom.xml file within the jar file
    +  440   + 
          * @param jar the jar file to extract the pom from
    +  441   + 
          * @return returns a
    +  442   + 
          * @throws AnalysisException is thrown if there is an exception extracting or parsing the POM
    +  443   + 
          * {@link org.owasp.dependencycheck.jaxb.pom.generated.Model} object
    +  444   + 
          */
    +  445   + 
         private Model retrievePom(String path, JarFile jar) throws AnalysisException {
    +  446  14 
             final ZipEntry entry = jar.getEntry(path);
    +  447  14 
             Model model = null;
    +  448  14 
             if (entry != null) { //should never be null
    +  449   + 
                 try {
    +  450  14 
                     final NonClosingStream stream = new NonClosingStream(jar.getInputStream(entry));
    +  451  14 
                     final InputStreamReader reader = new InputStreamReader(stream, "UTF-8");
    +  452  14 
                     final InputSource xml = new InputSource(reader);
    +  453  14 
                     final SAXSource source = new SAXSource(xml);
    +  454  14 
                     model = readPom(source);
    +  455  0 
                 } catch (SecurityException ex) {
    +  456  0 
                     final String msg = String.format("Unable to parse pom '%s' in jar '%s'; invalid signature", path, jar.getName());
    +  457  0 
                     Logger
    +  458   + 
                             .getLogger(JarAnalyzer.class
    +  459   + 
                                     .getName()).log(Level.WARNING, msg);
    +  460  0 
                     Logger.getLogger(JarAnalyzer.class
    +  461   + 
                             .getName()).log(Level.FINE, null, ex);
    +  462  0 
                     throw new AnalysisException(ex);
    +  463  0 
                 } catch (IOException ex) {
    +  464  0 
                     final String msg = String.format("Unable to parse pom '%s' in jar '%s' (IO Exception)", path, jar.getName());
    +  465  0 
                     Logger.getLogger(JarAnalyzer.class.getName()).log(Level.WARNING, msg);
    +  466  0 
                     Logger.getLogger(JarAnalyzer.class.getName()).log(Level.FINE, null, ex);
    +  467  0 
                     throw new AnalysisException(ex);
    +  468  0 
                 } catch (Throwable ex) {
    +  469  0 
                     final String msg = String.format("Unexpected error during parsing of the pom '%s' in jar '%s'", path, jar.getName());
    +  470  0 
                     Logger.getLogger(JarAnalyzer.class.getName()).log(Level.WARNING, msg);
    +  471  0 
                     Logger.getLogger(JarAnalyzer.class.getName()).log(Level.FINE, null, ex);
    +  472  0 
                     throw new AnalysisException(ex);
    +  473  14 
                 }
    +  474   + 
             }
    +  475  14 
             return model;
    +  476   + 
         }
    +  477   + 
     
    +  478   + 
         /**
    +  479   + 
          * Retrieves the specified POM from a jar file and converts it to a Model.
    +  480   + 
          *
    +  481   + 
          * @param source the SAXSource input stream to read the POM from
    +  482   + 
          * @return returns the POM object
    +  483   + 
          * @throws AnalysisException is thrown if there is an exception extracting or parsing the POM
    +  484   + 
          * {@link org.owasp.dependencycheck.jaxb.pom.generated.Model} object
    +  485   + 
          */
    +  486   + 
         private Model readPom(SAXSource source) throws AnalysisException {
    +  487  14 
             Model model = null;
    +  488   + 
             try {
    +  489  14 
                 final XMLFilter filter = new MavenNamespaceFilter();
    +  490  14 
                 final SAXParserFactory spf = SAXParserFactory.newInstance();
    +  491  14 
                 final SAXParser sp = spf.newSAXParser();
    +  492  14 
                 final XMLReader xr = sp.getXMLReader();
    +  493  14 
                 filter.setParent(xr);
    +  494  14 
                 final JAXBElement<Model> el = pomUnmarshaller.unmarshal(source, Model.class);
    +  495  14 
                 model = el.getValue();
    +  496  0 
             } catch (SecurityException ex) {
    +  497  0 
                 throw new AnalysisException(ex);
    +  498  0 
             } catch (ParserConfigurationException ex) {
    +  499  0 
                 throw new AnalysisException(ex);
    +  500  0 
             } catch (SAXException ex) {
    +  501  0 
                 throw new AnalysisException(ex);
    +  502  0 
             } catch (JAXBException ex) {
    +  503  0 
                 throw new AnalysisException(ex);
    +  504  0 
             } catch (Throwable ex) {
    +  505  0 
                 throw new AnalysisException(ex);
    +  506  14 
             }
    +  507  14 
             return model;
     508   - 
          * Analyzes the path information of the classes contained within the
    + 
         }
     509   - 
          * JarAnalyzer to try and determine possible vendor or product names. If any
    + 
     
     510   - 
          * are found they are stored in the packageVendor and packageProduct
    + 
         /**
     511   - 
          * hashSets.
    + 
          * Sets evidence from the pom on the supplied dependency.
     512   
          *
     513   - 
          * @param classNames a list of class names
    + 
          * @param dependency the dependency to set data on
     514   - 
          * @param dependency a dependency to analyze
    + 
          * @param pom the information from the pom
     515   - 
          * @param addPackagesAsEvidence a flag indicating whether or not package
    + 
          * @param pomProperties the pom properties file (null if none exists)
     516   - 
          * names should be added as evidence.
    + 
          * @param classes a collection of ClassNameInformation - containing data about the fully qualified class names
     517   - 
          */
    + 
          * within the JAR file being analyzed
     518   - 
         protected void analyzePackageNames(ArrayList<ClassNameInformation> classNames,
    + 
          * @return true if there was evidence within the pom that we could use; otherwise false
     519   - 
                 Dependency dependency, boolean addPackagesAsEvidence) {
    -  520  18 
             final HashMap<String, Integer> vendorIdentifiers = new HashMap<String, Integer>();
    -  521  18 
             final HashMap<String, Integer> productIdentifiers = new HashMap<String, Integer>();
    -  522  18 
             analyzeFullyQualifiedClassNames(classNames, vendorIdentifiers, productIdentifiers);
    -  523   - 
     
    -  524  18 
             final int classCount = classNames.size();
    -  525  18 
             final EvidenceCollection vendor = dependency.getVendorEvidence();
    -  526  18 
             final EvidenceCollection product = dependency.getProductEvidence();
    -  527   - 
     
    -  528  18 
             for (Map.Entry<String, Integer> entry : vendorIdentifiers.entrySet()) {
    -  529  182 
                 final float ratio = entry.getValue() / (float) classCount;
    -  530  182 
                 if (ratio > 0.5) {
    -  531   - 
                     //TODO remove weighting
    -  532  36 
                     vendor.addWeighting(entry.getKey());
    -  533  36 
                     if (addPackagesAsEvidence && entry.getKey().length() > 1) {
    -  534  22 
                         vendor.addEvidence("jar", "package", entry.getKey(), Evidence.Confidence.LOW);
    -  535   - 
                     }
    -  536   - 
                 }
    -  537  182 
             }
    -  538  18 
             for (Map.Entry<String, Integer> entry : productIdentifiers.entrySet()) {
    -  539  3772 
                 final float ratio = entry.getValue() / (float) classCount;
    -  540  3772 
                 if (ratio > 0.5) {
    -  541  21 
                     product.addWeighting(entry.getKey());
    -  542  21 
                     if (addPackagesAsEvidence && entry.getKey().length() > 1) {
    -  543  11 
                         product.addEvidence("jar", "package", entry.getKey(), Evidence.Confidence.LOW);
    -  544   - 
                     }
    -  545   - 
                 }
    -  546  3772 
             }
    -  547  18 
         }
    -  548   - 
     
    -  549   - 
         /**
    -  550   - 
          * <p>Reads the manifest from the JAR file and collects the entries. Some
    -  551   - 
          * vendorKey entries are:</p> <ul><li>Implementation Title</li>
    -  552   - 
          * <li>Implementation Version</li> <li>Implementation Vendor</li>
    -  553   - 
          * <li>Implementation VendorId</li> <li>Bundle Name</li> <li>Bundle
    -  554   - 
          * Version</li> <li>Bundle Vendor</li> <li>Bundle Description</li> <li>Main
    -  555   - 
          * Class</li> </ul>
    -  556   - 
          * However, all but a handful of specific entries are read in.
    -  557   - 
          *
    -  558   - 
          * @param dependency A reference to the dependency
    -  559   - 
          * @param classInformation a collection of class information
    -  560   - 
          * @return whether evidence was identified parsing the manifest
    -  561   - 
          * @throws IOException if there is an issue reading the JAR file
    -  562   
          */
    +  520   + 
         private boolean setPomEvidence(Dependency dependency, Model pom, Properties pomProperties, ArrayList<ClassNameInformation> classes) {
    +  521  14 
             boolean foundSomething = false;
    +  522  14 
             if (pom == null) {
    +  523  0 
                 return foundSomething;
    +  524   + 
             }
    +  525  14 
             String groupid = interpolateString(pom.getGroupId(), pomProperties);
    +  526  14 
             if (groupid != null && !groupid.isEmpty()) {
    +  527  8 
                 if (groupid.startsWith("org.") || groupid.startsWith("com.")) {
    +  528  6 
                     groupid = groupid.substring(4);
    +  529   + 
                 }
    +  530  8 
                 foundSomething = true;
    +  531  8 
                 dependency.getVendorEvidence().addEvidence("pom", "groupid", groupid, Confidence.HIGH);
    +  532  8 
                 dependency.getProductEvidence().addEvidence("pom", "groupid", groupid, Confidence.LOW);
    +  533  8 
                 addMatchingValues(classes, groupid, dependency.getVendorEvidence());
    +  534  8 
                 addMatchingValues(classes, groupid, dependency.getProductEvidence());
    +  535   + 
             }
    +  536  14 
             String artifactid = interpolateString(pom.getArtifactId(), pomProperties);
    +  537  14 
             if (artifactid != null && !artifactid.isEmpty()) {
    +  538  14 
                 if (artifactid.startsWith("org.") || artifactid.startsWith("com.")) {
    +  539  0 
                     artifactid = artifactid.substring(4);
    +  540   + 
                 }
    +  541  14 
                 foundSomething = true;
    +  542  14 
                 dependency.getProductEvidence().addEvidence("pom", "artifactid", artifactid, Confidence.HIGH);
    +  543  14 
                 dependency.getVendorEvidence().addEvidence("pom", "artifactid", artifactid, Confidence.LOW);
    +  544  14 
                 addMatchingValues(classes, artifactid, dependency.getVendorEvidence());
    +  545  14 
                 addMatchingValues(classes, artifactid, dependency.getProductEvidence());
    +  546   + 
             }
    +  547   + 
             //version
    +  548  14 
             final String version = interpolateString(pom.getVersion(), pomProperties);
    +  549  14 
             if (version != null && !version.isEmpty()) {
    +  550  4 
                 foundSomething = true;
    +  551  4 
                 dependency.getVersionEvidence().addEvidence("pom", "version", version, Confidence.HIGHEST);
    +  552   + 
             }
    +  553   + 
             // org name
    +  554  14 
             final Organization org = pom.getOrganization();
    +  555  14 
             if (org != null && org.getName() != null) {
    +  556  0 
                 foundSomething = true;
    +  557  0 
                 final String orgName = interpolateString(org.getName(), pomProperties);
    +  558  0 
                 if (orgName != null && !orgName.isEmpty()) {
    +  559  0 
                     dependency.getVendorEvidence().addEvidence("pom", "organization name", orgName, Confidence.HIGH);
    +  560  0 
                     addMatchingValues(classes, orgName, dependency.getVendorEvidence());
    +  561   + 
                 }
    +  562   + 
             }
     563   - 
         protected boolean parseManifest(Dependency dependency, ArrayList<ClassNameInformation> classInformation) throws IOException {
    -  564  18 
             boolean foundSomething = false;
    -  565  18 
             JarFile jar = null;
    -  566   - 
             try {
    -  567  18 
                 jar = new JarFile(dependency.getActualFilePath());
    -  568   - 
     
    -  569  18 
                 final Manifest manifest = jar.getManifest();
    -  570  18 
                 if (manifest == null) {
    + 
             //pom name
    +  564  14 
             final String pomName = interpolateString(pom.getName(), pomProperties);
    +  565  14 
             if (pomName != null && !pomName.isEmpty()) {
    +  566  14 
                 foundSomething = true;
    +  567  14 
                 dependency.getProductEvidence().addEvidence("pom", "name", pomName, Confidence.HIGH);
    +  568  14 
                 dependency.getVendorEvidence().addEvidence("pom", "name", pomName, Confidence.HIGH);
    +  569  14 
                 addMatchingValues(classes, pomName, dependency.getVendorEvidence());
    +  570  14 
                 addMatchingValues(classes, pomName, dependency.getProductEvidence());
     571   - 
                     //don't log this for javadoc or sources jar files
    -  572  0 
                     if (!dependency.getFileName().toLowerCase().endsWith("-sources.jar")
    + 
             }
    +  572   + 
     
     573   - 
                             && !dependency.getFileName().toLowerCase().endsWith("-javadoc.jar")
    -  574   - 
                             && !dependency.getFileName().toLowerCase().endsWith("-src.jar")
    -  575   - 
                             && !dependency.getFileName().toLowerCase().endsWith("-doc.jar")) {
    -  576  0 
                         Logger.getLogger(JarAnalyzer.class.getName()).log(Level.INFO,
    -  577   - 
                                 String.format("Jar file '%s' does not contain a manifest.",
    -  578   - 
                                 dependency.getFileName()));
    -  579   - 
                     }
    -  580  0 
                     return false;
    + 
             //Description
    +  574  14 
             if (pom.getDescription() != null) {
    +  575  6 
                 foundSomething = true;
    +  576  6 
                 final String description = interpolateString(pom.getDescription(), pomProperties);
    +  577  6 
                 if (description != null && !description.isEmpty()) {
    +  578  6 
                     addDescription(dependency, description, "pom", "description");
    +  579  6 
                     addMatchingValues(classes, description, dependency.getVendorEvidence());
    +  580  6 
                     addMatchingValues(classes, description, dependency.getProductEvidence());
     581   
                 }
    -  582  18 
                 final Attributes atts = manifest.getMainAttributes();
    +  582   + 
             }
     583   
     
    -  584  18 
                 final EvidenceCollection vendorEvidence = dependency.getVendorEvidence();
    -  585  18 
                 final EvidenceCollection productEvidence = dependency.getProductEvidence();
    -  586  18 
                 final EvidenceCollection versionEvidence = dependency.getVersionEvidence();
    -  587   - 
     
    -  588  18 
                 final String source = "Manifest";
    -  589   - 
     
    -  590  18 
                 for (Entry<Object, Object> entry : atts.entrySet()) {
    -  591  260 
                     String key = entry.getKey().toString();
    -  592  260 
                     String value = atts.getValue(key);
    -  593  260 
                     if (HTML_DETECTION_PATTERN.matcher(value).find()) {
    -  594  0 
                         value = Jsoup.parse(value).text();
    +  584   + 
             //license
    +  585  14 
             if (pom.getLicenses() != null) {
    +  586  2 
                 String license = null;
    +  587  2 
                 for (License lic : pom.getLicenses().getLicense()) {
    +  588  2 
                     String tmp = null;
    +  589  2 
                     if (lic.getName() != null) {
    +  590  2 
                         tmp = interpolateString(lic.getName(), pomProperties);
    +  591   + 
                     }
    +  592  2 
                     if (lic.getUrl() != null) {
    +  593  2 
                         if (tmp == null) {
    +  594  0 
                             tmp = interpolateString(lic.getUrl(), pomProperties);
     595   - 
                     }
    -  596  260 
                     if (IGNORE_VALUES.contains(value)) {
    -  597  0 
                         continue;
    -  598  260 
                     } else if (key.equalsIgnoreCase(Attributes.Name.IMPLEMENTATION_TITLE.toString())) {
    -  599  9 
                         foundSomething = true;
    -  600  9 
                         productEvidence.addEvidence(source, key, value, Evidence.Confidence.HIGH);
    -  601  9 
                         addMatchingValues(classInformation, value, productEvidence);
    -  602  251 
                     } else if (key.equalsIgnoreCase(Attributes.Name.IMPLEMENTATION_VERSION.toString())) {
    -  603  12 
                         foundSomething = true;
    -  604  12 
                         versionEvidence.addEvidence(source, key, value, Evidence.Confidence.HIGH);
    -  605  239 
                     } else if (key.equalsIgnoreCase(Attributes.Name.IMPLEMENTATION_VENDOR.toString())) {
    -  606  8 
                         foundSomething = true;
    -  607  8 
                         vendorEvidence.addEvidence(source, key, value, Evidence.Confidence.HIGH);
    -  608  8 
                         addMatchingValues(classInformation, value, vendorEvidence);
    -  609  231 
                     } else if (key.equalsIgnoreCase(Attributes.Name.IMPLEMENTATION_VENDOR_ID.toString())) {
    -  610  5 
                         foundSomething = true;
    -  611  5 
                         vendorEvidence.addEvidence(source, key, value, Evidence.Confidence.MEDIUM);
    -  612  5 
                         addMatchingValues(classInformation, value, vendorEvidence);
    -  613  226 
                     } else if (key.equalsIgnoreCase(BUNDLE_DESCRIPTION)) {
    -  614  7 
                         foundSomething = true;
    -  615  7 
                         addDescription(dependency, value, "manifest", key);
    -  616   - 
                         //productEvidence.addEvidence(source, key, value, Evidence.Confidence.MEDIUM);
    -  617  7 
                         addMatchingValues(classInformation, value, productEvidence);
    -  618  219 
                     } else if (key.equalsIgnoreCase(BUNDLE_NAME)) {
    -  619  10 
                         foundSomething = true;
    -  620  10 
                         productEvidence.addEvidence(source, key, value, Evidence.Confidence.MEDIUM);
    -  621  10 
                         addMatchingValues(classInformation, value, productEvidence);
    -  622  209 
                     } else if (key.equalsIgnoreCase(BUNDLE_VENDOR)) {
    -  623  8 
                         foundSomething = true;
    -  624  8 
                         vendorEvidence.addEvidence(source, key, value, Evidence.Confidence.HIGH);
    -  625  8 
                         addMatchingValues(classInformation, value, vendorEvidence);
    -  626  201 
                     } else if (key.equalsIgnoreCase(BUNDLE_VERSION)) {
    -  627  10 
                         foundSomething = true;
    -  628  10 
                         versionEvidence.addEvidence(source, key, value, Evidence.Confidence.HIGH);
    -  629  191 
                     } else if (key.equalsIgnoreCase(Attributes.Name.MAIN_CLASS.toString())) {
    -  630  5 
                         continue;
    -  631   - 
                         //skipping main class as if this has important information to add
    -  632   - 
                         // it will be added during class name analysis...  if other fields
    -  633   - 
                         // have the information from the class name then they will get added...
    -  634   - 
     //                    foundSomething = true;
    -  635   - 
     //                    productEvidence.addEvidence(source, key, value, Evidence.Confidence.MEDIUM);
    -  636   - 
     //                    vendorEvidence.addEvidence(source, key, value, Evidence.Confidence.MEDIUM);
    -  637   - 
     //                    addMatchingValues(classInformation, value, vendorEvidence);
    -  638   - 
     //                    addMatchingValues(classInformation, value, productEvidence);
    -  639   - 
                     } else {
    -  640  186 
                         key = key.toLowerCase();
    -  641   - 
     
    -  642  186 
                         if (!IGNORE_KEYS.contains(key)
    -  643   - 
                                 && !key.endsWith("jdk")
    -  644   - 
                                 && !key.contains("lastmodified")
    -  645   - 
                                 && !key.endsWith("package")
    -  646   - 
                                 && !key.endsWith("classpath")
    -  647   - 
                                 && !key.endsWith("class-path")
    -  648   - 
                                 && !key.endsWith("-scm") //todo change this to a regex?
    -  649   - 
                                 && !key.startsWith("scm-")
    -  650   - 
                                 && !isImportPackage(key, value)
    -  651   - 
                                 && !isPackage(key, value)) {
    -  652   - 
     
    -  653  59 
                             foundSomething = true;
    -  654  59 
                             if (key.contains("version")) {
    -  655  10 
                                 if (key.contains("specification")) {
    -  656  8 
                                     versionEvidence.addEvidence(source, key, value, Evidence.Confidence.LOW);
    -  657   - 
                                 } else {
    -  658  2 
                                     versionEvidence.addEvidence(source, key, value, Evidence.Confidence.MEDIUM);
    -  659   - 
                                 }
    -  660   - 
     
    -  661  49 
                             } else if (key.contains("title")) {
    -  662  8 
                                 productEvidence.addEvidence(source, key, value, Evidence.Confidence.MEDIUM);
    -  663  8 
                                 addMatchingValues(classInformation, value, productEvidence);
    -  664  41 
                             } else if (key.contains("vendor")) {
    -  665  5 
                                 if (key.contains("specification")) {
    -  666  5 
                                     vendorEvidence.addEvidence(source, key, value, Evidence.Confidence.LOW);
    -  667   - 
                                 } else {
    -  668  0 
                                     vendorEvidence.addEvidence(source, key, value, Evidence.Confidence.MEDIUM);
    -  669  0 
                                     addMatchingValues(classInformation, value, vendorEvidence);
    -  670   - 
                                 }
    -  671  36 
                             } else if (key.contains("name")) {
    -  672  13 
                                 productEvidence.addEvidence(source, key, value, Evidence.Confidence.MEDIUM);
    -  673  13 
                                 vendorEvidence.addEvidence(source, key, value, Evidence.Confidence.MEDIUM);
    -  674  13 
                                 addMatchingValues(classInformation, value, vendorEvidence);
    -  675  13 
                                 addMatchingValues(classInformation, value, productEvidence);
    -  676  23 
                             } else if (key.contains("license")) {
    -  677  6 
                                 addLicense(dependency, value);
    -  678   - 
                             } else {
    -  679  17 
                                 if (key.contains("description")) {
    -  680  0 
                                     addDescription(dependency, value, "manifest", key);
    -  681   - 
                                 } else {
    -  682  17 
                                     productEvidence.addEvidence(source, key, value, Evidence.Confidence.LOW);
    -  683  17 
                                     vendorEvidence.addEvidence(source, key, value, Evidence.Confidence.LOW);
    -  684  17 
                                     addMatchingValues(classInformation, value, vendorEvidence);
    -  685  17 
                                     addMatchingValues(classInformation, value, productEvidence);
    -  686  17 
                                     if (value.matches(".*\\d.*")) {
    -  687  6 
                                         final StringTokenizer tokenizer = new StringTokenizer(value, " ");
    -  688  30 
                                         while (tokenizer.hasMoreElements()) {
    -  689  24 
                                             final String s = tokenizer.nextToken();
    -  690  24 
                                             if (s.matches("^[0-9.]+$")) {
    -  691  0 
                                                 versionEvidence.addEvidence(source, key, s, Evidence.Confidence.LOW);
    -  692   - 
                                             }
    -  693  24 
                                         }
    -  694   - 
                                     }
    -  695   - 
                                 }
    -  696   - 
                             }
    -  697   + 
                         } else {
    +  596  2 
                             tmp += ": " + interpolateString(lic.getUrl(), pomProperties);
    +  597   
                         }
    -  698   +  598   
                     }
    -  699  255 
                 }
    -  700   - 
             } finally {
    -  701  18 
                 if (jar != null) {
    -  702  18 
                     jar.close();
    -  703   +  599  2 
                     if (tmp == null) {
    +  600  0 
                         continue;
    +  601   + 
                     }
    +  602  2 
                     if (HTML_DETECTION_PATTERN.matcher(tmp).find()) {
    +  603  0 
                         tmp = Jsoup.parse(tmp).text();
    +  604   + 
                     }
    +  605  2 
                     if (license == null) {
    +  606  2 
                         license = tmp;
    +  607   + 
                     } else {
    +  608  0 
                         license += "\n" + tmp;
    +  609   + 
                     }
    +  610  2 
                 }
    +  611  2 
                 if (license != null) {
    +  612  2 
                     dependency.setLicense(license);
    +  613   
                 }
    -  704   +  614   
             }
    -  705  18 
             return foundSomething;
    -  706   +  615  14 
             return foundSomething;
    +  616   
         }
    -  707   +  617   
     
    -  708   +  618   
         /**
    -  709   - 
          * Adds a description to the given dependency.
    -  710   +  619   + 
          * Analyzes the path information of the classes contained within the JarAnalyzer to try and determine possible
    +  620   + 
          * vendor or product names. If any are found they are stored in the packageVendor and packageProduct hashSets.
    +  621   
          *
    -  711   - 
          * @param dependency a dependency
    -  712   - 
          * @param description the description
    -  713   - 
          * @param source the source of the evidence
    -  714   - 
          * @param key the "name" of the evidence
    -  715   +  622   + 
          * @param classNames a list of class names
    +  623   + 
          * @param dependency a dependency to analyze
    +  624   + 
          * @param addPackagesAsEvidence a flag indicating whether or not package names should be added as evidence.
    +  625   
          */
    -  716   - 
         private void addDescription(Dependency dependency, String description, String source, String key) {
    -  717  10 
             if (dependency.getDescription() == null) {
    -  718  9 
                 dependency.setDescription(description);
    -  719   - 
             }
    -  720   - 
             String desc;
    -  721  10 
             if (HTML_DETECTION_PATTERN.matcher(description).find()) {
    -  722  0 
                 desc = Jsoup.parse(description).text();
    -  723   - 
             } else {
    -  724  10 
                 desc = description;
    -  725   - 
             }
    -  726  10 
             dependency.setDescription(desc);
    -  727  10 
             if (desc.length() > 100) {
    -  728  2 
                 final int posSuchAs = desc.toLowerCase().indexOf("such as ", 100);
    -  729  2 
                 final int posLike = desc.toLowerCase().indexOf("like ", 100);
    -  730  2 
                 int pos = -1;
    -  731  2 
                 if (posLike > 0 && posSuchAs > 0) {
    -  732  0 
                     pos = posLike > posSuchAs ? posLike : posSuchAs;
    -  733  2 
                 } else if (posLike > 0) {
    -  734  2 
                     pos = posLike;
    -  735  0 
                 } else if (posSuchAs > 0) {
    -  736  0 
                     pos = posSuchAs;
    -  737   +  626   + 
         protected void analyzePackageNames(ArrayList<ClassNameInformation> classNames,
    +  627   + 
                 Dependency dependency, boolean addPackagesAsEvidence) {
    +  628  36 
             final HashMap<String, Integer> vendorIdentifiers = new HashMap<String, Integer>();
    +  629  36 
             final HashMap<String, Integer> productIdentifiers = new HashMap<String, Integer>();
    +  630  36 
             analyzeFullyQualifiedClassNames(classNames, vendorIdentifiers, productIdentifiers);
    +  631   + 
     
    +  632  36 
             final int classCount = classNames.size();
    +  633  36 
             final EvidenceCollection vendor = dependency.getVendorEvidence();
    +  634  36 
             final EvidenceCollection product = dependency.getProductEvidence();
    +  635   + 
     
    +  636  36 
             for (Map.Entry<String, Integer> entry : vendorIdentifiers.entrySet()) {
    +  637  364 
                 final float ratio = entry.getValue() / (float) classCount;
    +  638  364 
                 if (ratio > 0.5) {
    +  639   + 
                     //TODO remove weighting
    +  640  72 
                     vendor.addWeighting(entry.getKey());
    +  641  72 
                     if (addPackagesAsEvidence && entry.getKey().length() > 1) {
    +  642  44 
                         vendor.addEvidence("jar", "package", entry.getKey(), Confidence.LOW);
    +  643   + 
                     }
    +  644   
                 }
    -  738  2 
                 String descToUse = desc;
    -  739  2 
                 if (pos > 0) {
    -  740  2 
                     final StringBuilder sb = new StringBuilder(pos + 3);
    -  741  2 
                     sb.append(desc.substring(0, pos));
    -  742  2 
                     sb.append("...");
    -  743  2 
                     descToUse = sb.toString();
    +  645  364 
             }
    +  646  36 
             for (Map.Entry<String, Integer> entry : productIdentifiers.entrySet()) {
    +  647  7544 
                 final float ratio = entry.getValue() / (float) classCount;
    +  648  7544 
                 if (ratio > 0.5) {
    +  649  42 
                     product.addWeighting(entry.getKey());
    +  650  42 
                     if (addPackagesAsEvidence && entry.getKey().length() > 1) {
    +  651  22 
                         product.addEvidence("jar", "package", entry.getKey(), Confidence.LOW);
    +  652   + 
                     }
    +  653   + 
                 }
    +  654  7544 
             }
    +  655  36 
         }
    +  656   + 
     
    +  657   + 
         /**
    +  658   + 
          * <p>
    +  659   + 
          * Reads the manifest from the JAR file and collects the entries. Some vendorKey entries are:</p>
    +  660   + 
          * <ul><li>Implementation Title</li>
    +  661   + 
          * <li>Implementation Version</li> <li>Implementation Vendor</li>
    +  662   + 
          * <li>Implementation VendorId</li> <li>Bundle Name</li> <li>Bundle Version</li> <li>Bundle Vendor</li> <li>Bundle
    +  663   + 
          * Description</li> <li>Main Class</li> </ul>
    +  664   + 
          * However, all but a handful of specific entries are read in.
    +  665   + 
          *
    +  666   + 
          * @param dependency A reference to the dependency
    +  667   + 
          * @param classInformation a collection of class information
    +  668   + 
          * @return whether evidence was identified parsing the manifest
    +  669   + 
          * @throws IOException if there is an issue reading the JAR file
    +  670   + 
          */
    +  671   + 
         protected boolean parseManifest(Dependency dependency, ArrayList<ClassNameInformation> classInformation) throws IOException {
    +  672  36 
             boolean foundSomething = false;
    +  673  36 
             JarFile jar = null;
    +  674   + 
             try {
    +  675  36 
                 jar = new JarFile(dependency.getActualFilePath());
    +  676   + 
     
    +  677  36 
                 final Manifest manifest = jar.getManifest();
    +  678   + 
     
    +  679  36 
                 if (manifest == null) {
    +  680   + 
                     //don't log this for javadoc or sources jar files
    +  681  0 
                     if (!dependency.getFileName().toLowerCase().endsWith("-sources.jar")
    +  682   + 
                             && !dependency.getFileName().toLowerCase().endsWith("-javadoc.jar")
    +  683   + 
                             && !dependency.getFileName().toLowerCase().endsWith("-src.jar")
    +  684   + 
                             && !dependency.getFileName().toLowerCase().endsWith("-doc.jar")) {
    +  685  0 
                         Logger.getLogger(JarAnalyzer.class
    +  686   + 
                                 .getName()).log(Level.INFO,
    +  687   + 
                                         String.format("Jar file '%s' does not contain a manifest.",
    +  688   + 
                                                 dependency.getFileName()));
    +  689   + 
                     }
    +  690  0 
                     return false;
    +  691   + 
                 }
    +  692  36 
                 final Attributes atts = manifest.getMainAttributes();
    +  693   + 
     
    +  694  36 
                 final EvidenceCollection vendorEvidence = dependency.getVendorEvidence();
    +  695  36 
                 final EvidenceCollection productEvidence = dependency.getProductEvidence();
    +  696  36 
                 final EvidenceCollection versionEvidence = dependency.getVersionEvidence();
    +  697   + 
     
    +  698  36 
                 final String source = "Manifest";
    +  699   + 
     
    +  700  36 
                 for (Entry<Object, Object> entry : atts.entrySet()) {
    +  701  520 
                     String key = entry.getKey().toString();
    +  702  520 
                     String value = atts.getValue(key);
    +  703  520 
                     if (HTML_DETECTION_PATTERN.matcher(value).find()) {
    +  704  0 
                         value = Jsoup.parse(value).text();
    +  705   + 
                     }
    +  706  520 
                     if (IGNORE_VALUES.contains(value)) {
    +  707  0 
                         continue;
    +  708  520 
                     } else if (key.equalsIgnoreCase(Attributes.Name.IMPLEMENTATION_TITLE.toString())) {
    +  709  18 
                         foundSomething = true;
    +  710  18 
                         productEvidence.addEvidence(source, key, value, Confidence.HIGH);
    +  711  18 
                         addMatchingValues(classInformation, value, productEvidence);
    +  712  502 
                     } else if (key.equalsIgnoreCase(Attributes.Name.IMPLEMENTATION_VERSION.toString())) {
    +  713  24 
                         foundSomething = true;
    +  714  24 
                         versionEvidence.addEvidence(source, key, value, Confidence.HIGH);
    +  715  478 
                     } else if (key.equalsIgnoreCase(Attributes.Name.IMPLEMENTATION_VENDOR.toString())) {
    +  716  16 
                         foundSomething = true;
    +  717  16 
                         vendorEvidence.addEvidence(source, key, value, Confidence.HIGH);
    +  718  16 
                         addMatchingValues(classInformation, value, vendorEvidence);
    +  719  462 
                     } else if (key.equalsIgnoreCase(Attributes.Name.IMPLEMENTATION_VENDOR_ID.toString())) {
    +  720  10 
                         foundSomething = true;
    +  721  10 
                         vendorEvidence.addEvidence(source, key, value, Confidence.MEDIUM);
    +  722  10 
                         addMatchingValues(classInformation, value, vendorEvidence);
    +  723  452 
                     } else if (key.equalsIgnoreCase(BUNDLE_DESCRIPTION)) {
    +  724  14 
                         foundSomething = true;
    +  725  14 
                         addDescription(dependency, value, "manifest", key);
    +  726   + 
                         //productEvidence.addEvidence(source, key, value, Confidence.MEDIUM);
    +  727  14 
                         addMatchingValues(classInformation, value, productEvidence);
    +  728  438 
                     } else if (key.equalsIgnoreCase(BUNDLE_NAME)) {
    +  729  20 
                         foundSomething = true;
    +  730  20 
                         productEvidence.addEvidence(source, key, value, Confidence.MEDIUM);
    +  731  20 
                         addMatchingValues(classInformation, value, productEvidence);
    +  732  418 
                     } else if (key.equalsIgnoreCase(BUNDLE_VENDOR)) {
    +  733  16 
                         foundSomething = true;
    +  734  16 
                         vendorEvidence.addEvidence(source, key, value, Confidence.HIGH);
    +  735  16 
                         addMatchingValues(classInformation, value, vendorEvidence);
    +  736  402 
                     } else if (key.equalsIgnoreCase(BUNDLE_VERSION)) {
    +  737  20 
                         foundSomething = true;
    +  738  20 
                         versionEvidence.addEvidence(source, key, value, Confidence.HIGH);
    +  739  382 
                     } else if (key.equalsIgnoreCase(Attributes.Name.MAIN_CLASS.toString())) {
    +  740  10 
                         continue;
    +  741   + 
                         //skipping main class as if this has important information to add
    +  742   + 
                         // it will be added during class name analysis...  if other fields
    +  743   + 
                         // have the information from the class name then they will get added...
     744   - 
                 }
    -  745  2 
                 dependency.getProductEvidence().addEvidence(source, key, descToUse, Evidence.Confidence.LOW);
    -  746  2 
                 dependency.getVendorEvidence().addEvidence(source, key, descToUse, Evidence.Confidence.LOW);
    -  747  2 
             } else {
    -  748  8 
                 dependency.getProductEvidence().addEvidence(source, key, desc, Evidence.Confidence.MEDIUM);
    -  749  8 
                 dependency.getVendorEvidence().addEvidence(source, key, desc, Evidence.Confidence.MEDIUM);
    -  750   - 
             }
    -  751  10 
         }
    -  752   + 
     //                    foundSomething = true;
    +  745   + 
     //                    productEvidence.addEvidence(source, key, value, Confidence.MEDIUM);
    +  746   + 
     //                    vendorEvidence.addEvidence(source, key, value, Confidence.MEDIUM);
    +  747   + 
     //                    addMatchingValues(classInformation, value, vendorEvidence);
    +  748   + 
     //                    addMatchingValues(classInformation, value, productEvidence);
    +  749   + 
                     } else {
    +  750  372 
                         key = key.toLowerCase();
    +  751   
     
    +  752  372 
                         if (!IGNORE_KEYS.contains(key)
     753   - 
         /**
    + 
                                 && !key.endsWith("jdk")
     754   - 
          * Adds a license to the given dependency.
    + 
                                 && !key.contains("lastmodified")
     755   - 
          *
    + 
                                 && !key.endsWith("package")
     756   - 
          * @param d a dependency
    + 
                                 && !key.endsWith("classpath")
     757   - 
          * @param license the license
    + 
                                 && !key.endsWith("class-path")
     758   - 
          */
    + 
                                 && !key.endsWith("-scm") //todo change this to a regex?
     759   - 
         private void addLicense(Dependency d, String license) {
    -  760  6 
             if (d.getLicense() == null) {
    -  761  6 
                 d.setLicense(license);
    -  762  0 
             } else if (!d.getLicense().contains(license)) {
    -  763  0 
                 d.setLicense(d.getLicense() + NEWLINE + license);
    -  764   - 
             }
    -  765  6 
         }
    -  766   + 
                                 && !key.startsWith("scm-")
    +  760   + 
                                 && !isImportPackage(key, value)
    +  761   + 
                                 && !isPackage(key, value)) {
    +  762   
     
    +  763  118 
                             foundSomething = true;
    +  764  118 
                             if (key.contains("version")) {
    +  765  20 
                                 if (key.contains("specification")) {
    +  766  16 
                                     versionEvidence.addEvidence(source, key, value, Confidence.LOW);
     767   - 
         /**
    -  768   - 
          * The initialize method does nothing for this Analyzer.
    + 
                                 } else {
    +  768  4 
                                     versionEvidence.addEvidence(source, key, value, Confidence.MEDIUM);
     769   - 
          */
    + 
                                 }
     770   - 
         public void initialize() {
    -  771   - 
             //do nothing
    -  772  3 
         }
    -  773   
     
    -  774   - 
         /**
    -  775   - 
          * The close method does nothing for this Analyzer.
    -  776   - 
          */
    +  771  98 
                             } else if (key.contains("title")) {
    +  772  16 
                                 productEvidence.addEvidence(source, key, value, Confidence.MEDIUM);
    +  773  16 
                                 addMatchingValues(classInformation, value, productEvidence);
    +  774  82 
                             } else if (key.contains("vendor")) {
    +  775  10 
                                 if (key.contains("specification")) {
    +  776  10 
                                     vendorEvidence.addEvidence(source, key, value, Confidence.LOW);
     777   - 
         public void close() {
    -  778   - 
             //do nothing
    -  779  3 
         }
    + 
                                 } else {
    +  778  0 
                                     vendorEvidence.addEvidence(source, key, value, Confidence.MEDIUM);
    +  779  0 
                                     addMatchingValues(classInformation, value, vendorEvidence);
     780   - 
     
    -  781   - 
         /**
    -  782   - 
          * <p>A utility function that will interpolate strings based on values given
    -  783   - 
          * in the properties file. It will also interpolate the strings contained
    -  784   - 
          * within the properties file so that properties can reference other
    -  785   - 
          * properties.</p>
    -  786   - 
          * <p><b>Note:</b> if there is no property found the reference will be
    -  787   - 
          * removed. In other words, if the interpolated string will be replaced with
    + 
                                 }
    +  781  72 
                             } else if (key.contains("name")) {
    +  782  26 
                                 productEvidence.addEvidence(source, key, value, Confidence.MEDIUM);
    +  783  26 
                                 vendorEvidence.addEvidence(source, key, value, Confidence.MEDIUM);
    +  784  26 
                                 addMatchingValues(classInformation, value, vendorEvidence);
    +  785  26 
                                 addMatchingValues(classInformation, value, productEvidence);
    +  786  46 
                             } else if (key.contains("license")) {
    +  787  12 
                                 addLicense(dependency, value);
     788   - 
          * an empty string.
    -  789   - 
          * </p>
    -  790   - 
          * <p>Example:</p>
    + 
                             } else {
    +  789  34 
                                 if (key.contains("description")) {
    +  790  0 
                                     addDescription(dependency, value, "manifest", key);
     791   - 
          * <code>
    -  792   - 
          * Properties p = new Properties();
    -  793   - 
          * p.setProperty("key", "value");
    -  794   - 
          * String s = interpolateString("'${key}' and '${nothing}'", p);
    -  795   - 
          * System.out.println(s);
    -  796   - 
          * </code>
    -  797   - 
          * <p>Will result in:</p>
    -  798   - 
          * <code>
    -  799   - 
          * 'value' and ''
    -  800   - 
          * </code>
    -  801   - 
          *
    + 
                                 } else {
    +  792  34 
                                     productEvidence.addEvidence(source, key, value, Confidence.LOW);
    +  793  34 
                                     vendorEvidence.addEvidence(source, key, value, Confidence.LOW);
    +  794  34 
                                     addMatchingValues(classInformation, value, vendorEvidence);
    +  795  34 
                                     addMatchingValues(classInformation, value, productEvidence);
    +  796  34 
                                     if (value.matches(".*\\d.*")) {
    +  797  12 
                                         final StringTokenizer tokenizer = new StringTokenizer(value, " ");
    +  798  60 
                                         while (tokenizer.hasMoreElements()) {
    +  799  48 
                                             final String s = tokenizer.nextToken();
    +  800  48 
                                             if (s.matches("^[0-9.]+$")) {
    +  801  0 
                                                 versionEvidence.addEvidence(source, key, s, Confidence.LOW);
     802   - 
          * @param text the string that contains references to properties.
    -  803   - 
          * @param properties a collection of properties that may be referenced
    + 
                                             }
    +  803  48 
                                         }
     804   - 
          * within the text.
    + 
                                     }
     805   - 
          * @return the interpolated text.
    + 
                                 }
     806   - 
          */
    + 
                             }
     807   - 
         protected String interpolateString(String text, Properties properties) {
    -  808  40 
             Properties props = properties;
    -  809  40 
             if (text == null) {
    -  810  8 
                 return text;
    -  811   - 
             }
    -  812  32 
             if (props == null) {
    -  813  25 
                 props = new Properties();
    + 
                         }
    +  808   + 
                     }
    +  809  510 
                 }
    +  810   + 
             } finally {
    +  811  36 
                 if (jar != null) {
    +  812  36 
                     jar.close();
    +  813   + 
                 }
     814   
             }
    -  815   +  815  36 
             return foundSomething;
    +  816   + 
         }
    +  817   
     
    -  816  32 
             final int pos = text.indexOf("${");
    -  817  32 
             if (pos < 0) {
    -  818  29 
                 return text;
    +  818   + 
         /**
     819   - 
             }
    -  820  3 
             final int end = text.indexOf("}");
    -  821  3 
             if (end < pos) {
    -  822  0 
                 return text;
    + 
          * Adds a description to the given dependency.
    +  820   + 
          *
    +  821   + 
          * @param dependency a dependency
    +  822   + 
          * @param description the description
     823   - 
             }
    + 
          * @param source the source of the evidence
     824   - 
     
    -  825  3 
             final String propName = text.substring(pos + 2, end);
    -  826  3 
             String propValue = interpolateString(props.getProperty(propName), props);
    -  827  3 
             if (propValue == null) {
    -  828  0 
                 propValue = "";
    + 
          * @param key the "name" of the evidence
    +  825   + 
          */
    +  826   + 
         private void addDescription(Dependency dependency, String description, String source, String key) {
    +  827  20 
             if (dependency.getDescription() == null) {
    +  828  18 
                 dependency.setDescription(description);
     829   
             }
    -  830  3 
             final StringBuilder sb = new StringBuilder(propValue.length() + text.length());
    -  831  3 
             sb.append(text.subSequence(0, pos));
    -  832  3 
             sb.append(propValue);
    -  833  3 
             sb.append(text.substring(end + 1));
    -  834  3 
             return interpolateString(sb.toString(), props); //yes yes, this should be a loop...
    -  835   - 
         }
    -  836   - 
     
    -  837   - 
         /**
    -  838   - 
          * Determines if the key value pair from the manifest is for an "import"
    -  839   - 
          * type entry for package names.
    -  840   - 
          *
    -  841   - 
          * @param key the key from the manifest
    -  842   - 
          * @param value the value from the manifest
    -  843   - 
          * @return true or false depending on if it is believed the entry is an
    -  844   - 
          * "import" entry
    -  845   - 
          */
    -  846   - 
         private boolean isImportPackage(String key, String value) {
    -  847  61 
             final Pattern packageRx = Pattern.compile("^((([a-zA-Z_#\\$0-9]\\.)+)\\s*\\;\\s*)+$");
    -  848  61 
             if (packageRx.matcher(value).matches()) {
    -  849  0 
                 return (key.contains("import") || key.contains("include"));
    -  850   - 
             }
    -  851  61 
             return false;
    -  852   - 
         }
    -  853   - 
     
    -  854   - 
         /**
    -  855   - 
          * Cycles through an enumeration of JarEntries, contained within the
    -  856   - 
          * dependency, and returns a list of the class names. This does not include
    -  857   - 
          * core Java package names (i.e. java.* or javax.*).
    -  858   - 
          *
    -  859   - 
          * @param dependency the dependency being analyzed
    -  860   - 
          * @return an list of fully qualified class names
    -  861   - 
          */
    -  862   - 
         private ArrayList<ClassNameInformation> collectClassNames(Dependency dependency) {
    -  863  18 
             final ArrayList<ClassNameInformation> classNames = new ArrayList<ClassNameInformation>();
    -  864  18 
             JarFile jar = null;
    -  865   - 
             try {
    -  866  18 
                 jar = new JarFile(dependency.getActualFilePath());
    -  867  18 
                 final Enumeration entries = jar.entries();
    -  868  7564 
                 while (entries.hasMoreElements()) {
    -  869  7546 
                     final JarEntry entry = (JarEntry) entries.nextElement();
    -  870  7546 
                     final String name = entry.getName().toLowerCase();
    -  871   - 
                     //no longer stripping "|com\\.sun" - there are some com.sun jar files with CVEs.
    -  872  7546 
                     if (name.endsWith(".class") && !name.matches("^javax?\\..*$")) {
    -  873  6375 
                         final ClassNameInformation className = new ClassNameInformation(name.substring(0, name.length() - 6));
    -  874  6375 
                         classNames.add(className);
    -  875   - 
                     }
    -  876  7546 
                 }
    -  877  0 
             } catch (IOException ex) {
    -  878  0 
                 final String msg = String.format("Unable to open jar file '%s'.", dependency.getFileName());
    -  879  0 
                 Logger.getLogger(JarAnalyzer.class.getName()).log(Level.WARNING, msg);
    -  880  0 
                 Logger.getLogger(JarAnalyzer.class.getName()).log(Level.FINE, null, ex);
    -  881   - 
             } finally {
    -  882  18 
                 if (jar != null) {
    -  883   - 
                     try {
    -  884  18 
                         jar.close();
    -  885  0 
                     } catch (IOException ex) {
    -  886  0 
                         Logger.getLogger(JarAnalyzer.class.getName()).log(Level.FINEST, null, ex);
    -  887  18 
                     }
    -  888   - 
                 }
    -  889   - 
             }
    -  890  18 
             return classNames;
    -  891   - 
         }
    -  892   - 
     
    -  893   - 
         /**
    -  894   - 
          * Cycles through the list of class names and places the package levels 0-3
    -  895   - 
          * into the provided maps for vendor and product. This is helpful when
    -  896   - 
          * analyzing vendor/product as many times this is included in the package
    -  897   - 
          * name.
    -  898   - 
          *
    -  899   - 
          * @param classNames a list of class names
    -  900   - 
          * @param vendor HashMap of possible vendor names from package names (e.g.
    -  901   - 
          * owasp)
    -  902   - 
          * @param product HashMap of possible product names from package names (e.g.
    -  903   - 
          * dependencycheck)
    -  904   - 
          */
    -  905   - 
         private void analyzeFullyQualifiedClassNames(ArrayList<ClassNameInformation> classNames,
    -  906   - 
                 HashMap<String, Integer> vendor, HashMap<String, Integer> product) {
    -  907  18 
             for (ClassNameInformation entry : classNames) {
    -  908  6375 
                 final ArrayList<String> list = entry.getPackageStructure();
    -  909  6375 
                 addEntry(vendor, list.get(0));
    -  910   - 
     
    -  911  6375 
                 if (list.size() == 2) {
    -  912  0 
                     addEntry(product, list.get(1));
    -  913   - 
                 }
    -  914  6375 
                 if (list.size() == 3) {
    -  915  1991 
                     addEntry(vendor, list.get(1));
    -  916  1991 
                     addEntry(product, list.get(1));
    -  917  1991 
                     addEntry(product, list.get(2));
    -  918   - 
                 }
    -  919  6375 
                 if (list.size() >= 4) {
    -  920  4384 
                     addEntry(vendor, list.get(1));
    -  921  4384 
                     addEntry(vendor, list.get(2));
    -  922  4384 
                     addEntry(product, list.get(1));
    -  923  4384 
                     addEntry(product, list.get(2));
    -  924  4384 
                     addEntry(product, list.get(3));
    -  925   - 
                 }
    -  926  6375 
             }
    -  927  18 
         }
    -  928   - 
     
    -  929   - 
         /**
    -  930   - 
          * Adds an entry to the specified collection and sets the Integer (e.g. the
    -  931   - 
          * count) to 1. If the entry already exists in the collection then the
    -  932   - 
          * Integer is incremented by 1.
    -  933   - 
          *
    -  934   - 
          * @param collection a collection of strings and their occurrence count
    -  935   - 
          * @param key the key to add to the collection
    -  936   - 
          */
    -  937   - 
         private void addEntry(HashMap<String, Integer> collection, String key) {
    -  938  34268 
             if (collection.containsKey(key)) {
    -  939  30314 
                 collection.put(key, collection.get(key) + 1);
    -  940   +  830   + 
             String desc;
    +  831  20 
             if (HTML_DETECTION_PATTERN.matcher(description).find()) {
    +  832  0 
                 desc = Jsoup.parse(description).text();
    +  833   
             } else {
    -  941  3954 
                 collection.put(key, 1);
    -  942   +  834  20 
                 desc = description;
    +  835   
             }
    -  943  34268 
         }
    -  944   - 
     
    -  945   - 
         /**
    -  946   - 
          * Cycles through the collection of class name information to see if parts
    -  947   - 
          * of the package names are contained in the provided value. If found, it
    -  948   - 
          * will be added as the HIGHEST confidence evidence because we have more
    -  949   - 
          * then one source corroborating the value.
    -  950   - 
          *
    -  951   - 
          * @param classes a collection of class name information
    -  952   - 
          * @param value the value to check to see if it contains a package name
    -  953   - 
          * @param evidence the evidence collection to add new entries too
    -  954   - 
          */
    -  955   - 
         private void addMatchingValues(ArrayList<ClassNameInformation> classes, String value, EvidenceCollection evidence) {
    -  956  157 
             if (value == null || value.isEmpty()) {
    -  957  0 
                 return;
    -  958   - 
             }
    -  959  157 
             final String text = value.toLowerCase();
    -  960  157 
             for (ClassNameInformation cni : classes) {
    -  961  63174 
                 for (String key : cni.getPackageStructure()) {
    -  962  231862 
                     if (text.contains(key)) { //note, package structure elements are already lowercase.
    -  963  70531 
                         evidence.addEvidence("jar", "package name", key, Evidence.Confidence.HIGHEST);
    -  964   - 
                     }
    -  965  231862 
                 }
    -  966  63174 
             }
    -  967  157 
         }
    -  968   - 
     
    -  969   - 
         /**
    -  970   - 
          * <p><b>This is currently a failed implementation.</b> Part of the issue is
    -  971   - 
          * I was trying to solve the wrong problem. Instead of multiple POMs being
    -  972   - 
          * in the JAR to just add information about dependencies - I didn't realize
    -  973   - 
          * until later that I was looking at an uber-jar (aka fat-jar) that included
    -  974   - 
          * all of its dependencies.</p>
    -  975   - 
          * <p>I'm leaving this method in the source tree, entirely commented out
    -  976   - 
          * until a solution https://github.com/jeremylong/DependencyCheck/issues/11
    -  977   - 
          * has been implemented.</p>
    -  978   - 
          * <p>Takes a list of pom entries from a JAR file and attempts to filter it
    -  979   - 
          * down to the pom related to the jar (rather then the pom entry for a
    -  980   - 
          * dependency).</p>
    -  981   - 
          *
    -  982   - 
          * @param pomEntries a list of pom entries
    -  983   - 
          * @param classes a list of fully qualified classes from the JAR file
    -  984   - 
          * @return the list of pom entries that are associated with the jar being
    -  985   - 
          * analyzed rather then the dependent poms
    -  986   - 
          */
    -  987   - 
         private List<String> filterPomEntries(List<String> pomEntries, ArrayList<ClassNameInformation> classes) {
    -  988  0 
             return pomEntries;
    -  989   - 
     //        final HashMap<String, Integer> usePoms = new HashMap<String, Integer>();
    -  990   - 
     //        final ArrayList<String> possiblePoms = new ArrayList<String>();
    -  991   - 
     //        for (String entry : pomEntries) {
    -  992   - 
     //            //todo validate that the starts with is correct... or does it start with a ./ or /?
    -  993   - 
     //            // is it different on different platforms?
    -  994   - 
     //            if (entry.startsWith("META-INF/maven/")) {
    -  995   - 
     //                //trim the meta-inf/maven and pom.xml...
    -  996   - 
     //                final String pomPath = entry.substring(15, entry.length() - 8).toLowerCase();
    -  997   - 
     //                final String[] parts = pomPath.split("/");
    -  998   - 
     //                if (parts == null || parts.length != 2) { //misplaced pom?
    -  999   - 
     //                    //TODO add logging to FINE
    -  1000   - 
     //                    possiblePoms.add(entry);
    -  1001   - 
     //                }
    -  1002   - 
     //                parts[0] = parts[0].replace('.', '/');
    -  1003   - 
     //                parts[1] = parts[1].replace('.', '/');
    -  1004   - 
     //                for (ClassNameInformation cni : classes) {
    -  1005   - 
     //                    final String name = cni.getName();
    -  1006   - 
     //                    if (StringUtils.containsIgnoreCase(name, parts[0])) {
    -  1007   - 
     //                        addEntry(usePoms, entry);
    -  1008   - 
     //                    }
    -  1009   - 
     //                    if (StringUtils.containsIgnoreCase(name, parts[1])) {
    -  1010   - 
     //                        addEntry(usePoms, entry);
    -  1011   - 
     //                    }
    -  1012   - 
     //                }
    -  1013   - 
     //            } else { // we have a JAR file with an incorrect POM layout...
    -  1014   - 
     //                //TODO add logging to FINE
    -  1015   - 
     //                possiblePoms.add(entry);
    -  1016   - 
     //            }
    -  1017   - 
     //        }
    -  1018   - 
     //        List<String> retValue;
    -  1019   - 
     //        if (usePoms.isEmpty()) {
    -  1020   - 
     //            if (possiblePoms.isEmpty()) {
    -  1021   - 
     //                retValue = pomEntries;
    -  1022   - 
     //            } else {
    -  1023   - 
     //                retValue = possiblePoms;
    -  1024   - 
     //            }
    -  1025   - 
     //        } else {
    -  1026   - 
     //            retValue = new ArrayList<String>();
    -  1027   - 
     //            int maxCount = 0;
    -  1028   - 
     //            for (Map.Entry<String, Integer> entry : usePoms.entrySet()) {
    -  1029   - 
     //                final int current = entry.getValue().intValue();
    -  1030   - 
     //                if (current > maxCount) {
    -  1031   - 
     //                    maxCount = current;
    -  1032   - 
     //                    retValue.clear();
    -  1033   - 
     //                    retValue.add(entry.getKey());
    -  1034   - 
     //                } else if (current == maxCount) {
    -  1035   - 
     //                    retValue.add(entry.getKey());
    -  1036   - 
     //                }
    -  1037   - 
     //            }
    -  1038   - 
     //        }
    -  1039   - 
     //        return retValue;
    -  1040   - 
         }
    -  1041   - 
     
    -  1042   - 
         /**
    -  1043   - 
          * Simple check to see if the attribute from a manifest is just a package
    -  1044   - 
          * name.
    -  1045   - 
          *
    -  1046   - 
          * @param key the key of the value to check
    -  1047   - 
          * @param value the value to check
    -  1048   - 
          * @return true if the value looks like a java package name, otherwise false
    -  1049   - 
          */
    -  1050   - 
         private boolean isPackage(String key, String value) {
    -  1051   - 
     
    -  1052  61 
             return !key.matches(".*(version|title|vendor|name|license|description).*")
    -  1053   - 
                     && value.matches("^([a-zA-Z_][a-zA-Z0-9_\\$]*(\\.[a-zA-Z_][a-zA-Z0-9_\\$]*)*)?$");
    -  1054   - 
         }
    -  1055   - 
     
    -  1056   - 
         /**
    -  1057   - 
          * Stores information about a class name.
    -  1058   - 
          */
    -  1059   - 
         protected static class ClassNameInformation {
    -  1060   - 
     
    -  1061   - 
             /**
    -  1062   - 
              * Stores information about a given class name. This class will keep the
    -  1063   - 
              * fully qualified class name and a list of the important parts of the
    -  1064   - 
              * package structure. Up to the first four levels of the package
    -  1065   - 
              * structure are stored, excluding a leading "org" or "com". Example:
    -  1066   - 
              * <code>ClassNameInformation obj = new ClassNameInformation("org.owasp.dependencycheck.analyzer.JarAnalyzer");
    -  1067   - 
              * System.out.println(obj.getName());
    -  1068   - 
              * for (String p : obj.getPackageStructure())
    -  1069   - 
              *     System.out.println(p);
    -  1070   - 
              * </code> Would result in:
    -  1071   - 
              * <code>org.owasp.dependencycheck.analyzer.JarAnalyzer
    -  1072   - 
              * owasp
    -  1073   - 
              * dependencycheck
    -  1074   - 
              * analyzer
    -  1075   - 
              * jaranalyzer</code>
    -  1076   - 
              *
    -  1077   - 
              * @param className a fully qualified class name
    -  1078   - 
              */
    -  1079  6375 
             ClassNameInformation(String className) {
    -  1080  6375 
                 name = className;
    -  1081  6375 
                 if (name.contains("/")) {
    -  1082  6375 
                     final String[] tmp = className.toLowerCase().split("/");
    -  1083  6375 
                     int start = 0;
    -  1084  6375 
                     int end = 3;
    -  1085  6375 
                     if ("com".equals(tmp[0]) || "org".equals(tmp[0])) {
    -  1086  5948 
                         start = 1;
    -  1087  5948 
                         end = 4;
    -  1088   - 
                     }
    -  1089  6375 
                     if (tmp.length <= end) {
    -  1090  1991 
                         end = tmp.length - 1;
    -  1091   - 
                     }
    -  1092  29884 
                     for (int i = start; i <= end; i++) {
    -  1093  23509 
                         packageStructure.add(tmp[i]);
    -  1094   - 
                     }
    -  1095  6375 
                 } else {
    -  1096  0 
                     packageStructure.add(name);
    -  1097   +  836  20 
             dependency.setDescription(desc);
    +  837  20 
             if (desc.length() > 100) {
    +  838  4 
                 final int posSuchAs = desc.toLowerCase().indexOf("such as ", 100);
    +  839  4 
                 final int posLike = desc.toLowerCase().indexOf("like ", 100);
    +  840  4 
                 int pos = -1;
    +  841  4 
                 if (posLike > 0 && posSuchAs > 0) {
    +  842  0 
                     pos = posLike > posSuchAs ? posLike : posSuchAs;
    +  843  4 
                 } else if (posLike > 0) {
    +  844  4 
                     pos = posLike;
    +  845  0 
                 } else if (posSuchAs > 0) {
    +  846  0 
                     pos = posSuchAs;
    +  847   
                 }
    -  1098  6375 
             }
    -  1099   - 
             /**
    -  1100   - 
              * The fully qualified class name.
    -  1101   - 
              */
    -  1102   - 
             private String name;
    -  1103   - 
     
    -  1104   - 
             /**
    -  1105   - 
              * Get the value of name
    -  1106   - 
              *
    -  1107   - 
              * @return the value of name
    -  1108   - 
              */
    -  1109   - 
             public String getName() {
    -  1110  0 
                 return name;
    -  1111   +  848  4 
                 String descToUse = desc;
    +  849  4 
                 if (pos > 0) {
    +  850  4 
                     final StringBuilder sb = new StringBuilder(pos + 3);
    +  851  4 
                     sb.append(desc.substring(0, pos));
    +  852  4 
                     sb.append("...");
    +  853  4 
                     descToUse = sb.toString();
    +  854   + 
                 }
    +  855  4 
                 dependency.getProductEvidence().addEvidence(source, key, descToUse, Confidence.LOW);
    +  856  4 
                 dependency.getVendorEvidence().addEvidence(source, key, descToUse, Confidence.LOW);
    +  857  4 
             } else {
    +  858  16 
                 dependency.getProductEvidence().addEvidence(source, key, desc, Confidence.MEDIUM);
    +  859  16 
                 dependency.getVendorEvidence().addEvidence(source, key, desc, Confidence.MEDIUM);
    +  860   
             }
    -  1112   +  861  20 
         }
    +  862   
     
    -  1113   - 
             /**
    -  1114   - 
              * Set the value of name
    -  1115   - 
              *
    -  1116   - 
              * @param name new value of name
    -  1117   - 
              */
    -  1118   - 
             public void setName(String name) {
    -  1119  0 
                 this.name = name;
    -  1120  0 
             }
    -  1121   - 
             /**
    -  1122   - 
              * Up to the first four levels of the package structure, excluding a
    -  1123   - 
              * leading "org" or "com".
    -  1124   - 
              */
    -  1125  6375 
             private ArrayList<String> packageStructure = new ArrayList<String>();
    -  1126   - 
     
    -  1127   - 
             /**
    -  1128   - 
              * Get the value of packageStructure
    -  1129   - 
              *
    -  1130   - 
              * @return the value of packageStructure
    -  1131   - 
              */
    -  1132   - 
             public ArrayList<String> getPackageStructure() {
    -  1133  69549 
                 return packageStructure;
    -  1134   +  863   + 
         /**
    +  864   + 
          * Adds a license to the given dependency.
    +  865   + 
          *
    +  866   + 
          * @param d a dependency
    +  867   + 
          * @param license the license
    +  868   + 
          */
    +  869   + 
         private void addLicense(Dependency d, String license) {
    +  870  12 
             if (d.getLicense() == null) {
    +  871  12 
                 d.setLicense(license);
    +  872  0 
             } else if (!d.getLicense().contains(license)) {
    +  873  0 
                 d.setLicense(d.getLicense() + NEWLINE + license);
    +  874   
             }
    -  1135   +  875  12 
         }
    +  876   + 
     
    +  877   + 
         /**
    +  878   + 
          * The parent directory for the individual directories per archive.
    +  879   + 
          */
    +  880  26 
         private File tempFileLocation = null;
    +  881   + 
     
    +  882   + 
         /**
    +  883   + 
          * The initialize method does nothing for this Analyzer.
    +  884   + 
          *
    +  885   + 
          * @throws Exception is thrown if there is an exception creating a temporary directory
    +  886   + 
          */
    +  887   + 
         @Override
    +  888   + 
         public void initialize() throws Exception {
    +  889  6 
             final File baseDir = Settings.getTempDirectory();
    +  890  6 
             if (!baseDir.exists()) {
    +  891  0 
                 if (!baseDir.mkdirs()) {
    +  892  0 
                     final String msg = String.format("Unable to make a temporary folder '%s'", baseDir.getPath());
    +  893  0 
                     throw new AnalysisException(msg);
    +  894   + 
                 }
    +  895   + 
             }
    +  896  6 
             tempFileLocation = File.createTempFile("check", "tmp", baseDir);
    +  897  6 
             if (!tempFileLocation.delete()) {
    +  898  0 
                 final String msg = String.format("Unable to delete temporary file '%s'.", tempFileLocation.getAbsolutePath());
    +  899  0 
                 throw new AnalysisException(msg);
    +  900   + 
             }
    +  901  6 
             if (!tempFileLocation.mkdirs()) {
    +  902  0 
                 final String msg = String.format("Unable to create directory '%s'.", tempFileLocation.getAbsolutePath());
    +  903  0 
                 throw new AnalysisException(msg);
    +  904   + 
             }
    +  905  6 
         }
    +  906   + 
     
    +  907   + 
         /**
    +  908   + 
          * Deletes any files extracted from the JAR during analysis.
    +  909   + 
          */
    +  910   + 
         @Override
    +  911   + 
         public void close() {
    +  912  6 
             if (tempFileLocation != null && tempFileLocation.exists()) {
    +  913  6 
                 FileUtils.deleteRecursive(tempFileLocation.getAbsolutePath(), true);
    +  914   + 
             }
    +  915  6 
         }
    +  916   + 
     
    +  917   + 
         /**
    +  918   + 
          * <p>
    +  919   + 
          * A utility function that will interpolate strings based on values given in the properties file. It will also
    +  920   + 
          * interpolate the strings contained within the properties file so that properties can reference other
    +  921   + 
          * properties.</p>
    +  922   + 
          * <p>
    +  923   + 
          * <b>Note:</b> if there is no property found the reference will be removed. In other words, if the interpolated
    +  924   + 
          * string will be replaced with an empty string.
    +  925   + 
          * </p>
    +  926   + 
          * <p>
    +  927   + 
          * Example:</p>
    +  928   + 
          * <code>
    +  929   + 
          * Properties p = new Properties();
    +  930   + 
          * p.setProperty("key", "value");
    +  931   + 
          * String s = interpolateString("'${key}' and '${nothing}'", p);
    +  932   + 
          * System.out.println(s);
    +  933   + 
          * </code>
    +  934   + 
          * <p>
    +  935   + 
          * Will result in:</p>
    +  936   + 
          * <code>
    +  937   + 
          * 'value' and ''
    +  938   + 
          * </code>
    +  939   + 
          *
    +  940   + 
          * @param text the string that contains references to properties.
    +  941   + 
          * @param properties a collection of properties that may be referenced within the text.
    +  942   + 
          * @return the interpolated text.
    +  943   + 
          */
    +  944   + 
         protected String interpolateString(String text, Properties properties) {
    +  945  80 
             Properties props = properties;
    +  946  80 
             if (text == null) {
    +  947  16 
                 return text;
    +  948   + 
             }
    +  949  64 
             if (props == null) {
    +  950  50 
                 props = new Properties();
    +  951   + 
             }
    +  952   + 
     
    +  953  64 
             final int pos = text.indexOf("${");
    +  954  64 
             if (pos < 0) {
    +  955  58 
                 return text;
    +  956   + 
             }
    +  957  6 
             final int end = text.indexOf("}");
    +  958  6 
             if (end < pos) {
    +  959  0 
                 return text;
    +  960   + 
             }
    +  961   + 
     
    +  962  6 
             final String propName = text.substring(pos + 2, end);
    +  963  6 
             String propValue = interpolateString(props.getProperty(propName), props);
    +  964  6 
             if (propValue == null) {
    +  965  0 
                 propValue = "";
    +  966   + 
             }
    +  967  6 
             final StringBuilder sb = new StringBuilder(propValue.length() + text.length());
    +  968  6 
             sb.append(text.subSequence(0, pos));
    +  969  6 
             sb.append(propValue);
    +  970  6 
             sb.append(text.substring(end + 1));
    +  971  6 
             return interpolateString(sb.toString(), props); //yes yes, this should be a loop...
    +  972   
         }
    -  1136   +  973   + 
     
    +  974   + 
         /**
    +  975   + 
          * Determines if the key value pair from the manifest is for an "import" type entry for package names.
    +  976   + 
          *
    +  977   + 
          * @param key the key from the manifest
    +  978   + 
          * @param value the value from the manifest
    +  979   + 
          * @return true or false depending on if it is believed the entry is an "import" entry
    +  980   + 
          */
    +  981   + 
         private boolean isImportPackage(String key, String value) {
    +  982  122 
             final Pattern packageRx = Pattern.compile("^((([a-zA-Z_#\\$0-9]\\.)+)\\s*\\;\\s*)+$");
    +  983  122 
             if (packageRx.matcher(value).matches()) {
    +  984  0 
                 return (key.contains("import") || key.contains("include"));
    +  985   + 
             }
    +  986  122 
             return false;
    +  987   + 
         }
    +  988   + 
     
    +  989   + 
         /**
    +  990   + 
          * Cycles through an enumeration of JarEntries, contained within the dependency, and returns a list of the class
    +  991   + 
          * names. This does not include core Java package names (i.e. java.* or javax.*).
    +  992   + 
          *
    +  993   + 
          * @param dependency the dependency being analyzed
    +  994   + 
          * @return an list of fully qualified class names
    +  995   + 
          */
    +  996   + 
         private ArrayList<ClassNameInformation> collectClassNames(Dependency dependency) {
    +  997  36 
             final ArrayList<ClassNameInformation> classNames = new ArrayList<ClassNameInformation>();
    +  998  36 
             JarFile jar = null;
    +  999   + 
             try {
    +  1000  36 
                 jar = new JarFile(dependency.getActualFilePath());
    +  1001  36 
                 final Enumeration entries = jar.entries();
    +  1002  15128 
                 while (entries.hasMoreElements()) {
    +  1003  15092 
                     final JarEntry entry = (JarEntry) entries.nextElement();
    +  1004  15092 
                     final String name = entry.getName().toLowerCase();
    +  1005   + 
                     //no longer stripping "|com\\.sun" - there are some com.sun jar files with CVEs.
    +  1006  15092 
                     if (name.endsWith(".class") && !name.matches("^javax?\\..*$")) {
    +  1007  12750 
                         final ClassNameInformation className = new ClassNameInformation(name.substring(0, name.length() - 6));
    +  1008  12750 
                         classNames.add(className);
    +  1009   + 
                     }
    +  1010  15092 
                 }
    +  1011  0 
             } catch (IOException ex) {
    +  1012  0 
                 final String msg = String.format("Unable to open jar file '%s'.", dependency.getFileName());
    +  1013  0 
                 Logger
    +  1014   + 
                         .getLogger(JarAnalyzer.class
    +  1015   + 
                                 .getName()).log(Level.WARNING, msg);
    +  1016  0 
                 Logger.getLogger(JarAnalyzer.class
    +  1017   + 
                         .getName()).log(Level.FINE, null, ex);
    +  1018   + 
             } finally {
    +  1019  36 
                 if (jar != null) {
    +  1020   + 
                     try {
    +  1021  36 
                         jar.close();
    +  1022  0 
                     } catch (IOException ex) {
    +  1023  0 
                         Logger.getLogger(JarAnalyzer.class.getName()).log(Level.FINEST, null, ex);
    +  1024  36 
                     }
    +  1025   + 
                 }
    +  1026   + 
             }
    +  1027  36 
             return classNames;
    +  1028   + 
         }
    +  1029   + 
     
    +  1030   + 
         /**
    +  1031   + 
          * Cycles through the list of class names and places the package levels 0-3 into the provided maps for vendor and
    +  1032   + 
          * product. This is helpful when analyzing vendor/product as many times this is included in the package name.
    +  1033   + 
          *
    +  1034   + 
          * @param classNames a list of class names
    +  1035   + 
          * @param vendor HashMap of possible vendor names from package names (e.g. owasp)
    +  1036   + 
          * @param product HashMap of possible product names from package names (e.g. dependencycheck)
    +  1037   + 
          */
    +  1038   + 
         private void analyzeFullyQualifiedClassNames(ArrayList<ClassNameInformation> classNames,
    +  1039   + 
                 HashMap<String, Integer> vendor, HashMap<String, Integer> product) {
    +  1040  36 
             for (ClassNameInformation entry : classNames) {
    +  1041  12750 
                 final ArrayList<String> list = entry.getPackageStructure();
    +  1042  12750 
                 addEntry(vendor, list.get(0));
    +  1043   + 
     
    +  1044  12750 
                 if (list.size() == 2) {
    +  1045  0 
                     addEntry(product, list.get(1));
    +  1046   + 
                 }
    +  1047  12750 
                 if (list.size() == 3) {
    +  1048  3982 
                     addEntry(vendor, list.get(1));
    +  1049  3982 
                     addEntry(product, list.get(1));
    +  1050  3982 
                     addEntry(product, list.get(2));
    +  1051   + 
                 }
    +  1052  12750 
                 if (list.size() >= 4) {
    +  1053  8768 
                     addEntry(vendor, list.get(1));
    +  1054  8768 
                     addEntry(vendor, list.get(2));
    +  1055  8768 
                     addEntry(product, list.get(1));
    +  1056  8768 
                     addEntry(product, list.get(2));
    +  1057  8768 
                     addEntry(product, list.get(3));
    +  1058   + 
                 }
    +  1059  12750 
             }
    +  1060  36 
         }
    +  1061   + 
     
    +  1062   + 
         /**
    +  1063   + 
          * Adds an entry to the specified collection and sets the Integer (e.g. the count) to 1. If the entry already exists
    +  1064   + 
          * in the collection then the Integer is incremented by 1.
    +  1065   + 
          *
    +  1066   + 
          * @param collection a collection of strings and their occurrence count
    +  1067   + 
          * @param key the key to add to the collection
    +  1068   + 
          */
    +  1069   + 
         private void addEntry(HashMap<String, Integer> collection, String key) {
    +  1070  68536 
             if (collection.containsKey(key)) {
    +  1071  60628 
                 collection.put(key, collection.get(key) + 1);
    +  1072   + 
             } else {
    +  1073  7908 
                 collection.put(key, 1);
    +  1074   + 
             }
    +  1075  68536 
         }
    +  1076   + 
     
    +  1077   + 
         /**
    +  1078   + 
          * Cycles through the collection of class name information to see if parts of the package names are contained in the
    +  1079   + 
          * provided value. If found, it will be added as the HIGHEST confidence evidence because we have more then one
    +  1080   + 
          * source corroborating the value.
    +  1081   + 
          *
    +  1082   + 
          * @param classes a collection of class name information
    +  1083   + 
          * @param value the value to check to see if it contains a package name
    +  1084   + 
          * @param evidence the evidence collection to add new entries too
    +  1085   + 
          */
    +  1086   + 
         private void addMatchingValues(ArrayList<ClassNameInformation> classes, String value, EvidenceCollection evidence) {
    +  1087  314 
             if (value == null || value.isEmpty()) {
    +  1088  0 
                 return;
    +  1089   + 
             }
    +  1090  314 
             final String text = value.toLowerCase();
    +  1091  314 
             for (ClassNameInformation cni : classes) {
    +  1092  126348 
                 for (String key : cni.getPackageStructure()) {
    +  1093  463724 
                     if (text.contains(key)) { //note, package structure elements are already lowercase.
    +  1094  141062 
                         evidence.addEvidence("jar", "package name", key, Confidence.HIGHEST);
    +  1095   + 
                     }
    +  1096  463724 
                 }
    +  1097  126348 
             }
    +  1098  314 
         }
    +  1099   + 
     
    +  1100   + 
         /**
    +  1101   + 
          * Simple check to see if the attribute from a manifest is just a package name.
    +  1102   + 
          *
    +  1103   + 
          * @param key the key of the value to check
    +  1104   + 
          * @param value the value to check
    +  1105   + 
          * @return true if the value looks like a java package name, otherwise false
    +  1106   + 
          */
    +  1107   + 
         private boolean isPackage(String key, String value) {
    +  1108   + 
     
    +  1109  122 
             return !key.matches(".*(version|title|vendor|name|license|description).*")
    +  1110   + 
                     && value.matches("^([a-zA-Z_][a-zA-Z0-9_\\$]*(\\.[a-zA-Z_][a-zA-Z0-9_\\$]*)*)?$");
    +  1111   + 
     
    +  1112   + 
         }
    +  1113   + 
     
    +  1114   + 
         /**
    +  1115   + 
          * Adds evidence from the POM to the dependency. This includes the GAV and in some situations the parent GAV if
    +  1116   + 
          * specified.
    +  1117   + 
          *
    +  1118   + 
          * @param dependency the dependency being analyzed
    +  1119   + 
          * @param pom the POM data
    +  1120   + 
          * @param pomProperties the properties file associated with the pom
    +  1121   + 
          */
    +  1122   + 
         private void addPomEvidence(Dependency dependency, Model pom, Properties pomProperties) {
    +  1123  0 
             if (pom == null) {
    +  1124  0 
                 return;
    +  1125   + 
             }
    +  1126  0 
             String groupid = interpolateString(pom.getGroupId(), pomProperties);
    +  1127  0 
             if (groupid != null && !groupid.isEmpty()) {
    +  1128  0 
                 if (groupid.startsWith("org.") || groupid.startsWith("com.")) {
    +  1129  0 
                     groupid = groupid.substring(4);
    +  1130   + 
                 }
    +  1131  0 
                 dependency.getVendorEvidence().addEvidence("pom", "groupid", groupid, Confidence.HIGH);
    +  1132  0 
                 dependency.getProductEvidence().addEvidence("pom", "groupid", groupid, Confidence.LOW);
    +  1133   + 
             }
    +  1134  0 
             String artifactid = interpolateString(pom.getArtifactId(), pomProperties);
    +  1135  0 
             if (artifactid != null && !artifactid.isEmpty()) {
    +  1136  0 
                 if (artifactid.startsWith("org.") || artifactid.startsWith("com.")) {
    +  1137  0 
                     artifactid = artifactid.substring(4);
    +  1138   + 
                 }
    +  1139  0 
                 dependency.getProductEvidence().addEvidence("pom", "artifactid", artifactid, Confidence.HIGH);
    +  1140  0 
                 dependency.getVendorEvidence().addEvidence("pom", "artifactid", artifactid, Confidence.LOW);
    +  1141   + 
             }
    +  1142  0 
             final String version = interpolateString(pom.getVersion(), pomProperties);
    +  1143  0 
             if (version != null && !version.isEmpty()) {
    +  1144  0 
                 dependency.getVersionEvidence().addEvidence("pom", "version", version, Confidence.HIGHEST);
    +  1145   + 
             }
    +  1146   + 
     
    +  1147  0 
             final Parent parent = pom.getParent(); //grab parent GAV
    +  1148  0 
             if (parent != null) {
    +  1149  0 
                 final String parentGroupId = interpolateString(parent.getGroupId(), pomProperties);
    +  1150  0 
                 if (parentGroupId != null && !parentGroupId.isEmpty()) {
    +  1151  0 
                     if (groupid == null || groupid.isEmpty()) {
    +  1152  0 
                         dependency.getVendorEvidence().addEvidence("pom", "parent.groupid", parentGroupId, Confidence.HIGH);
    +  1153   + 
                     } else {
    +  1154  0 
                         dependency.getVendorEvidence().addEvidence("pom", "parent.groupid", parentGroupId, Confidence.MEDIUM);
    +  1155   + 
                     }
    +  1156  0 
                     dependency.getProductEvidence().addEvidence("pom", "parent.groupid", parentGroupId, Confidence.LOW);
    +  1157   + 
                 }
    +  1158  0 
                 final String parentArtifactId = interpolateString(parent.getArtifactId(), pomProperties);
    +  1159  0 
                 if (parentArtifactId != null && !parentArtifactId.isEmpty()) {
    +  1160  0 
                     if (artifactid == null || artifactid.isEmpty()) {
    +  1161  0 
                         dependency.getProductEvidence().addEvidence("pom", "parent.artifactid", parentArtifactId, Confidence.HIGH);
    +  1162   + 
                     } else {
    +  1163  0 
                         dependency.getProductEvidence().addEvidence("pom", "parent.artifactid", parentArtifactId, Confidence.MEDIUM);
    +  1164   + 
                     }
    +  1165  0 
                     dependency.getVendorEvidence().addEvidence("pom", "parent.artifactid", parentArtifactId, Confidence.LOW);
    +  1166   + 
                 }
    +  1167  0 
                 final String parentVersion = interpolateString(parent.getVersion(), pomProperties);
    +  1168  0 
                 if (parentVersion != null && !parentVersion.isEmpty()) {
    +  1169  0 
                     if (version == null || version.isEmpty()) {
    +  1170  0 
                         dependency.getVersionEvidence().addEvidence("pom", "parent.version", parentVersion, Confidence.HIGH);
    +  1171   + 
                     } else {
    +  1172  0 
                         dependency.getVersionEvidence().addEvidence("pom", "parent.version", parentVersion, Confidence.LOW);
    +  1173   + 
                     }
    +  1174   + 
                 }
    +  1175   + 
             }
    +  1176   + 
             // org name
    +  1177  0 
             final Organization org = pom.getOrganization();
    +  1178  0 
             if (org != null && org.getName() != null) {
    +  1179  0 
                 final String orgName = interpolateString(org.getName(), pomProperties);
    +  1180  0 
                 if (orgName != null && !orgName.isEmpty()) {
    +  1181  0 
                     dependency.getVendorEvidence().addEvidence("pom", "organization name", orgName, Confidence.HIGH);
    +  1182   + 
                 }
    +  1183   + 
             }
    +  1184   + 
             //pom name
    +  1185  0 
             final String pomName = interpolateString(pom.getName(), pomProperties);
    +  1186  0 
             if (pomName != null && !pomName.isEmpty()) {
    +  1187  0 
                 dependency.getProductEvidence().addEvidence("pom", "name", pomName, Confidence.HIGH);
    +  1188  0 
                 dependency.getVendorEvidence().addEvidence("pom", "name", pomName, Confidence.HIGH);
    +  1189   + 
             }
    +  1190   + 
     
    +  1191   + 
             //Description
    +  1192  0 
             if (pom.getDescription() != null) {
    +  1193  0 
                 final String description = interpolateString(pom.getDescription(), pomProperties);
    +  1194  0 
                 if (description != null && !description.isEmpty()) {
    +  1195  0 
                     addDescription(dependency, description, "pom", "description");
    +  1196   + 
                 }
    +  1197   + 
             }
    +  1198   + 
     
    +  1199   + 
             //license
    +  1200  0 
             if (pom.getLicenses() != null) {
    +  1201  0 
                 String license = null;
    +  1202  0 
                 for (License lic : pom.getLicenses().getLicense()) {
    +  1203  0 
                     String tmp = null;
    +  1204  0 
                     if (lic.getName() != null) {
    +  1205  0 
                         tmp = interpolateString(lic.getName(), pomProperties);
    +  1206   + 
                     }
    +  1207  0 
                     if (lic.getUrl() != null) {
    +  1208  0 
                         if (tmp == null) {
    +  1209  0 
                             tmp = interpolateString(lic.getUrl(), pomProperties);
    +  1210   + 
                         } else {
    +  1211  0 
                             tmp += ": " + interpolateString(lic.getUrl(), pomProperties);
    +  1212   + 
                         }
    +  1213   + 
                     }
    +  1214  0 
                     if (tmp == null) {
    +  1215  0 
                         continue;
    +  1216   + 
                     }
    +  1217  0 
                     if (HTML_DETECTION_PATTERN.matcher(tmp).find()) {
    +  1218  0 
                         tmp = Jsoup.parse(tmp).text();
    +  1219   + 
                     }
    +  1220  0 
                     if (license == null) {
    +  1221  0 
                         license = tmp;
    +  1222   + 
                     } else {
    +  1223  0 
                         license += "\n" + tmp;
    +  1224   + 
                     }
    +  1225  0 
                 }
    +  1226  0 
                 if (license != null) {
    +  1227  0 
                     dependency.setLicense(license);
    +  1228   + 
                 }
    +  1229   + 
             }
    +  1230  0 
         }
    +  1231   + 
     
    +  1232   + 
         /**
    +  1233   + 
          * Stores information about a class name.
    +  1234   + 
          */
    +  1235   + 
         protected static class ClassNameInformation {
    +  1236   + 
     
    +  1237   + 
             /**
    +  1238   + 
              * <p>
    +  1239   + 
              * Stores information about a given class name. This class will keep the fully qualified class name and a list
    +  1240   + 
              * of the important parts of the package structure. Up to the first four levels of the package structure are
    +  1241   + 
              * stored, excluding a leading "org" or "com". Example:</p>
    +  1242   + 
              * <code>ClassNameInformation obj = new ClassNameInformation("org.owasp.dependencycheck.analyzer.JarAnalyzer");
    +  1243   + 
              * System.out.println(obj.getName());
    +  1244   + 
              * for (String p : obj.getPackageStructure())
    +  1245   + 
              *     System.out.println(p);
    +  1246   + 
              * </code>
    +  1247   + 
              * <p>
    +  1248   + 
              * Would result in:</p>
    +  1249   + 
              * <code>org.owasp.dependencycheck.analyzer.JarAnalyzer
    +  1250   + 
              * owasp
    +  1251   + 
              * dependencycheck
    +  1252   + 
              * analyzer
    +  1253   + 
              * jaranalyzer</code>
    +  1254   + 
              *
    +  1255   + 
              * @param className a fully qualified class name
    +  1256   + 
              */
    +  1257  12750 
             ClassNameInformation(String className) {
    +  1258  12750 
                 name = className;
    +  1259  12750 
                 if (name.contains("/")) {
    +  1260  12750 
                     final String[] tmp = className.toLowerCase().split("/");
    +  1261  12750 
                     int start = 0;
    +  1262  12750 
                     int end = 3;
    +  1263  12750 
                     if ("com".equals(tmp[0]) || "org".equals(tmp[0])) {
    +  1264  11896 
                         start = 1;
    +  1265  11896 
                         end = 4;
    +  1266   + 
                     }
    +  1267  12750 
                     if (tmp.length <= end) {
    +  1268  3982 
                         end = tmp.length - 1;
    +  1269   + 
                     }
    +  1270  59768 
                     for (int i = start; i <= end; i++) {
    +  1271  47018 
                         packageStructure.add(tmp[i]);
    +  1272   + 
                     }
    +  1273  12750 
                 } else {
    +  1274  0 
                     packageStructure.add(name);
    +  1275   + 
                 }
    +  1276  12750 
             }
    +  1277   + 
             /**
    +  1278   + 
              * The fully qualified class name.
    +  1279   + 
              */
    +  1280   + 
             private String name;
    +  1281   + 
     
    +  1282   + 
             /**
    +  1283   + 
              * Get the value of name
    +  1284   + 
              *
    +  1285   + 
              * @return the value of name
    +  1286   + 
              */
    +  1287   + 
             public String getName() {
    +  1288  0 
                 return name;
    +  1289   + 
             }
    +  1290   + 
     
    +  1291   + 
             /**
    +  1292   + 
              * Set the value of name
    +  1293   + 
              *
    +  1294   + 
              * @param name new value of name
    +  1295   + 
              */
    +  1296   + 
             public void setName(String name) {
    +  1297  0 
                 this.name = name;
    +  1298  0 
             }
    +  1299   + 
             /**
    +  1300   + 
              * Up to the first four levels of the package structure, excluding a leading "org" or "com".
    +  1301   + 
              */
    +  1302  12750 
             private final ArrayList<String> packageStructure = new ArrayList<String>();
    +  1303   + 
     
    +  1304   + 
             /**
    +  1305   + 
              * Get the value of packageStructure
    +  1306   + 
              *
    +  1307   + 
              * @return the value of packageStructure
    +  1308   + 
              */
    +  1309   + 
             public ArrayList<String> getPackageStructure() {
    +  1310  139098 
                 return packageStructure;
    +  1311   + 
             }
    +  1312   + 
         }
    +  1313   + 
     
    +  1314   + 
         /**
    +  1315   + 
          * Retrieves the next temporary directory to extract an archive too.
    +  1316   + 
          *
    +  1317   + 
          * @return a directory
    +  1318   + 
          * @throws AnalysisException thrown if unable to create temporary directory
    +  1319   + 
          */
    +  1320   + 
         private File getNextTempDirectory() throws AnalysisException {
    +  1321  0 
             dirCount += 1;
    +  1322  0 
             final File directory = new File(tempFileLocation, String.valueOf(dirCount));
    +  1323   + 
             //getting an exception for some directories not being able to be created; might be because the directory already exists?
    +  1324  0 
             if (directory.exists()) {
    +  1325  0 
                 return getNextTempDirectory();
    +  1326   + 
             }
    +  1327  0 
             if (!directory.mkdirs()) {
    +  1328  0 
                 final String msg = String.format("Unable to create temp directory '%s'.", directory.getAbsolutePath());
    +  1329  0 
                 throw new AnalysisException(msg);
    +  1330   + 
             }
    +  1331  0 
             return directory;
    +  1332   + 
         }
    +  1333   
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.JavaScriptAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.JavaScriptAnalyzer.html index 7213574be..d06b3b38b 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.JavaScriptAnalyzer.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.JavaScriptAnalyzer.html @@ -24,234 +24,226 @@  3   
      *
     4   - 
      * Dependency-check-core is free software: you can redistribute it and/or modify it
    + 
      * Licensed under the Apache License, Version 2.0 (the "License");
     5   - 
      * under the terms of the GNU General Public License as published by the Free
    + 
      * you may not use this file except in compliance with the License.
     6   - 
      * Software Foundation, either version 3 of the License, or (at your option) any
    + 
      * You may obtain a copy of the License at
     7   - 
      * later version.
    + 
      *
     8   - 
      *
    + 
      *     http://www.apache.org/licenses/LICENSE-2.0
     9   - 
      * Dependency-check-core is distributed in the hope that it will be useful, but
    + 
      *
     10   - 
      * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
    + 
      * Unless required by applicable law or agreed to in writing, software
     11   - 
      * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
    + 
      * distributed under the License is distributed on an "AS IS" BASIS,
     12   - 
      * details.
    + 
      * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13   - 
      *
    + 
      * See the License for the specific language governing permissions and
     14   - 
      * You should have received a copy of the GNU General Public License along with
    + 
      * limitations under the License.
     15   - 
      * dependency-check-core. If not, see http://www.gnu.org/licenses/.
    + 
      *
     16   - 
      *
    -  17   
      * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
    +  17   + 
      */
     18   - 
      */
    -  19   
     package org.owasp.dependencycheck.analyzer;
    +  19   + 
     
     20   - 
     
    -  21   - 
     import org.owasp.dependencycheck.Engine;
    -  22   - 
     import org.owasp.dependencycheck.dependency.Dependency;
    -  23   
     import java.util.Set;
    -  24   +  21   
     import java.util.regex.Pattern;
    +  22   + 
     import org.owasp.dependencycheck.Engine;
    +  23   + 
     import org.owasp.dependencycheck.dependency.Dependency;
    +  24   + 
     
     25   - 
     
    -  26   
     /**
    +  26   + 
      *
     27   - 
      *
    + 
      * Used to load a JAR file and collect information that can be used to determine the associated CPE.
     28   - 
      * Used to load a JAR file and collect information that can be used to determine
    -  29   - 
      * the associated CPE.
    -  30   
      *
    -  31   +  29   
      * @author Jeremy Long <jeremy.long@owasp.org>
    -  32   +  30   
      */
    -  33  0 
     public class JavaScriptAnalyzer extends AbstractAnalyzer implements Analyzer {
    -  34   +  31  0 
     public class JavaScriptAnalyzer extends AbstractAnalyzer implements Analyzer {
    +  32   
     
    -  35   +  33   
         //<editor-fold defaultstate="collapsed" desc="All standard implmentation details of Analyzer">
    -  36   +  34   
         /**
    -  37   +  35   
          * The name of the analyzer.
    -  38   +  36   
          */
    -  39   +  37   
         private static final String ANALYZER_NAME = "JavaScript Analyzer";
    -  40   +  38   
         /**
    -  41   +  39   
          * The phase that this analyzer is intended to run in.
    +  40   + 
          */
    +  41  0 
         private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.INFORMATION_COLLECTION;
     42   - 
          */
    -  43  0 
         private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.INFORMATION_COLLECTION;
    -  44   
         /**
    -  45   +  43   
          * The set of file extensions supported by this analyzer.
    +  44   + 
          */
    +  45  0 
         private static final Set<String> EXTENSIONS = newHashSet("js");
     46   - 
          */
    -  47  0 
         private static final Set<String> EXTENSIONS = newHashSet("js");
    + 
     
    +  47   + 
         /**
     48   - 
     
    -  49   - 
         /**
    -  50   
          * Returns a list of file EXTENSIONS supported by this analyzer.
    -  51   +  49   
          *
    -  52   +  50   
          * @return a list of file EXTENSIONS supported by this analyzer.
    -  53   +  51   
          */
    -  54   +  52   
         public Set<String> getSupportedExtensions() {
    -  55  0 
             return EXTENSIONS;
    +  53  0 
             return EXTENSIONS;
    +  54   + 
         }
    +  55   + 
     
     56   - 
         }
    + 
         /**
     57   - 
     
    -  58   - 
         /**
    -  59   
          * Returns the name of the analyzer.
    -  60   +  58   
          *
    -  61   +  59   
          * @return the name of the analyzer.
    -  62   +  60   
          */
    -  63   +  61   
         public String getName() {
    -  64  0 
             return ANALYZER_NAME;
    +  62  0 
             return ANALYZER_NAME;
    +  63   + 
         }
    +  64   + 
     
     65   - 
         }
    + 
         /**
     66   - 
     
    -  67   - 
         /**
    -  68   
          * Returns whether or not this analyzer can process the given extension.
    -  69   +  67   
          *
    -  70   +  68   
          * @param extension the file extension to test for support.
    +  69   + 
          * @return whether or not the specified file extension is supported by this analyzer.
    +  70   + 
          */
     71   - 
          * @return whether or not the specified file extension is supported by this
    -  72   - 
          * analyzer.
    -  73   - 
          */
    -  74   
         public boolean supportsExtension(String extension) {
    -  75  0 
             return EXTENSIONS.contains(extension);
    +  72  0 
             return EXTENSIONS.contains(extension);
    +  73   + 
         }
    +  74   + 
     
    +  75   + 
         /**
     76   - 
         }
    -  77   - 
     
    -  78   - 
         /**
    -  79   
          * Returns the phase that the analyzer is intended to run in.
    -  80   +  77   
          *
    -  81   +  78   
          * @return the phase that the analyzer is intended to run in.
    -  82   +  79   
          */
    -  83   +  80   
         public AnalysisPhase getAnalysisPhase() {
    -  84  0 
             return ANALYSIS_PHASE;
    -  85   +  81  0 
             return ANALYSIS_PHASE;
    +  82   
         }
    -  86   +  83   
         //</editor-fold>
    +  84   + 
     
    +  85   + 
         /**
    +  86   + 
          * Loads a specified JAR file and collects information from the manifest and checksums to identify the correct CPE
     87   - 
     
    + 
          * information.
     88   - 
         /**
    + 
          *
     89   - 
          * Loads a specified JAR file and collects information from the manifest and
    -  90   - 
          * checksums to identify the correct CPE information.
    -  91   - 
          *
    -  92   
          * @param dependency the dependency to analyze.
    -  93   +  90   
          * @param engine the engine that is scanning the dependencies
    +  91   + 
          * @throws AnalysisException is thrown if there is an error reading the JAR file.
    +  92   + 
          */
    +  93   + 
         @Override
     94   - 
          * @throws AnalysisException is thrown if there is an error reading the JAR
    -  95   - 
          * file.
    -  96   - 
          */
    -  97   - 
         @Override
    -  98   
         public void analyze(Dependency dependency, Engine engine) throws AnalysisException {
    -  99  0 
             final Pattern extractComments = Pattern.compile("(/\\*([^*]|[\\r\\n]|(\\*+([^*/]|[\\r\\n])))*\\*+/)|(//.*)");
    +  95  0 
             final Pattern extractComments = Pattern.compile("(/\\*([^*]|[\\r\\n]|(\\*+([^*/]|[\\r\\n])))*\\*+/)|(//.*)");
    +  96   + 
     
    +  97  0 
         }
    +  98   + 
     
    +  99   + 
         /**
     100   - 
     
    -  101  0 
         }
    -  102   - 
     
    -  103   - 
         /**
    -  104   
          * The initialize method does nothing for this Analyzer.
    +  101   + 
          *
    +  102   + 
          * @throws Exception thrown if there is an exception
    +  103   + 
          */
    +  104   + 
         @Override
     105   - 
          *
    -  106   - 
          * @throws Exception thrown if there is an exception
    -  107   - 
          */
    -  108   - 
         @Override
    -  109   
         public void initialize() throws Exception {
    -  110   +  106   
             //do nothing
    -  111  0 
         }
    -  112   +  107  0 
         }
    +  108   
     
    -  113   +  109   
         /**
    -  114   +  110   
          * The close method does nothing for this Analyzer.
    -  115   +  111   
          *
    -  116   +  112   
          * @throws Exception thrown if there is an exception
    -  117   +  113   
          */
    -  118   +  114   
         @Override
    -  119   +  115   
         public void close() throws Exception {
    -  120   +  116   
             //do nothing
    -  121  0 
         }
    -  122   +  117  0 
         }
    +  118   
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.NexusAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.NexusAnalyzer.html index 6778ba088..76f7b5630 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.NexusAnalyzer.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.NexusAnalyzer.html @@ -12,7 +12,7 @@
     
    - +
    Classes in this File Line Coverage Branch Coverage Complexity
    NexusAnalyzer
    41%
    15/36
    10%
    2/20
    		3.5
    NexusAnalyzer
    73%
    30/41
    50%
    10/20
    		3.5
     
    @@ -24,207 +24,203 @@  3   
      *
     4   - 
      * Dependency-check-core is free software: you can redistribute it and/or modify it
    + 
      * Licensed under the Apache License, Version 2.0 (the "License");
     5   - 
      * under the terms of the GNU General Public License as published by the Free
    + 
      * you may not use this file except in compliance with the License.
     6   - 
      * Software Foundation, either version 3 of the License, or (at your option) any
    + 
      * You may obtain a copy of the License at
     7   - 
      * later version.
    + 
      *
     8   - 
      *
    + 
      *     http://www.apache.org/licenses/LICENSE-2.0
     9   - 
      * Dependency-check-core is distributed in the hope that it will be useful, but
    + 
      *
     10   - 
      * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
    + 
      * Unless required by applicable law or agreed to in writing, software
     11   - 
      * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
    + 
      * distributed under the License is distributed on an "AS IS" BASIS,
     12   - 
      * details.
    + 
      * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13   - 
      *
    + 
      * See the License for the specific language governing permissions and
     14   - 
      * You should have received a copy of the GNU General Public License along with
    + 
      * limitations under the License.
     15   - 
      * dependency-check-core. If not, see http://www.gnu.org/licenses/.
    -  16   
      *
    +  16   + 
      * Copyright (c) 2014 Jeremy Long. All Rights Reserved.
     17   - 
      * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
    -  18   
      */
    -  19   +  18   
     package org.owasp.dependencycheck.analyzer;
    -  20   +  19   
     
    -  21   +  20   
     import java.io.FileNotFoundException;
    -  22   +  21   
     import java.io.IOException;
    -  23   +  22   
     import java.net.MalformedURLException;
    -  24   +  23   
     import java.net.URL;
    -  25   +  24   
     import java.util.Set;
    +  25   + 
     import java.util.logging.Level;
     26   
     import java.util.logging.Logger;
     27   - 
     
    -  28   
     import org.owasp.dependencycheck.Engine;
    -  29   +  28   
     import org.owasp.dependencycheck.data.nexus.MavenArtifact;
    -  30   +  29   
     import org.owasp.dependencycheck.data.nexus.NexusSearch;
    +  30   + 
     import org.owasp.dependencycheck.dependency.Confidence;
     31   
     import org.owasp.dependencycheck.dependency.Dependency;
     32   - 
     import org.owasp.dependencycheck.dependency.Evidence;
    -  33   
     import org.owasp.dependencycheck.utils.Settings;
    -  34   +  33   
     
    -  35   +  34   
     /**
    +  35   + 
      * Analyzer which will attempt to locate a dependency on a Nexus service by SHA-1 digest of the dependency.
     36   - 
      * Analyzer which will attempt to locate a dependency on a Nexus service
    + 
      *
     37   - 
      * by SHA-1 digest of the dependency.
    + 
      * There are two settings which govern this behavior:
     38   
      *
     39   - 
      * There are two settings which govern this behavior:
    -  40   - 
      *
    -  41   
      * <ul>
    +  40   + 
      * <li>{@link org.owasp.dependencycheck.utils.Settings.KEYS#ANALYZER_NEXUS_ENABLED} determines whether this analyzer is
    +  41   + 
      * even enabled. This can be overridden by setting the system property.</li>
     42   - 
      *   <li>{@link org.owasp.dependencycheck.utils.Settings.KEYS#ANALYZER_NEXUS_ENABLED}
    + 
      * <li>{@link org.owasp.dependencycheck.utils.Settings.KEYS#ANALYZER_NEXUS_URL} the URL to a Nexus service to search by
     43   - 
      * determines whether this analyzer is even enabled. This can be overridden by
    + 
      * SHA-1. There is an expected <code>%s</code> in this where the SHA-1 will get entered.</li>
     44   - 
      * setting the system property.</li>
    -  45   - 
      *   <li>{@link org.owasp.dependencycheck.utils.Settings.KEYS#ANALYZER_NEXUS_URL}
    -  46   - 
      * the URL to a Nexus service to search by SHA-1. There is an expected <code>%s</code>
    -  47   - 
      * in this where the SHA-1 will get entered.</li>
    -  48   
      * </ul>
    -  49   +  45   
      *
    -  50   +  46   
      * @author colezlaw
    -  51   +  47   
      */
    -  52  1 
     public class NexusAnalyzer extends AbstractAnalyzer {
    -  53   +  48  2 
     public class NexusAnalyzer extends AbstractAnalyzer {
    +  49   + 
     
    +  50   
         /**
    -  54   +  51   
          * The logger
    +  52   + 
          */
    +  53  2 
         private static final Logger LOGGER = Logger.getLogger(NexusAnalyzer.class.getName());
    +  54   + 
     
     55   - 
          */
    -  56  1 
         private static final Logger LOGGER = Logger.getLogger(NexusAnalyzer.class.getName());
    -  57   - 
     
    -  58   
         /**
    -  59   +  56   
          * The name of the analyzer
    -  60   +  57   
          */
    -  61   +  58   
         private static final String ANALYZER_NAME = "Nexus Analyzer";
    -  62   +  59   
     
    -  63   +  60   
         /**
    -  64   +  61   
          * The phase in which the analyzer runs
    +  62   + 
          */
    +  63  2 
         private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.INFORMATION_COLLECTION;
    +  64   + 
     
     65   - 
          */
    -  66  1 
         private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.INFORMATION_COLLECTION;
    -  67   - 
     
    -  68   
         /**
    -  69   +  66   
          * The types of files on which this will work.
    +  67   + 
          */
    +  68  2 
         private static final Set<String> SUPPORTED_EXTENSIONS = newHashSet("jar");
    +  69   + 
     
     70   - 
          */
    -  71  1 
         private static final Set<String> SUPPORTED_EXTENSIONS = newHashSet("jar");
    + 
         /**
    +  71   + 
          * Whether this is actually enabled. Will get set during initialization.
     72   - 
     
    -  73   - 
         /**
    + 
          */
    +  73  2 
         private boolean enabled = false;
     74   - 
          * Whether this is actually enabled. Will get set during initialization
    + 
     
     75   - 
          */
    -  76  1 
         private boolean enabled = false;
    -  77   - 
     
    -  78   
         /**
    -  79   +  76   
          * The Nexus Search to be set up for this analyzer.
    -  80   +  77   
          */
    -  81   +  78   
         private NexusSearch searcher;
    -  82   +  79   
     
    -  83   +  80   
         /**
    -  84   +  81   
          * Initializes the analyzer once before any analysis is performed.
    +  82   + 
          *
    +  83   + 
          * @throws Exception if there's an error during initialization
    +  84   + 
          */
     85   - 
          *
    + 
         @Override
     86   - 
          * @throws Exception if there's an error during initialization.
    -  87   - 
          */
    -  88   
         public void initialize() throws Exception {
    -  89  3 
             enabled = Settings.getBoolean(Settings.KEYS.ANALYZER_NEXUS_ENABLED);
    -  90   - 
     
    -  91  3 
             final String searchUrl = Settings.getString(Settings.KEYS.ANALYZER_NEXUS_URL);
    -  92   - 
     
    -  93  3 
             if (enabled) {
    -  94   +  87  6 
             enabled = Settings.getBoolean(Settings.KEYS.ANALYZER_NEXUS_ENABLED);
    +  88  6 
             LOGGER.fine("Initializing Nexus Analyzer");
    +  89  6 
             LOGGER.fine(String.format("Nexus Analyzer enabled: %s", enabled));
    +  90  6 
             if (enabled) {
    +  91  6 
                 final String searchUrl = Settings.getString(Settings.KEYS.ANALYZER_NEXUS_URL);
    +  92  6 
                 LOGGER.fine(String.format("Nexus Analyzer URL: %s", searchUrl));
    +  93   
                 try {
    -  95  0 
                     searcher = new NexusSearch(new URL(searchUrl));
    -  96  0 
                 } catch (MalformedURLException mue) {
    -  97   +  94  6 
                     searcher = new NexusSearch(new URL(searchUrl));
    +  95  0 
                 } catch (MalformedURLException mue) {
    +  96   
                     // I know that initialize can throw an exception, but we'll
    -  98   +  97   
                     // just disable the analyzer if the URL isn't valid
    -  99  0 
                     LOGGER.warning(String.format("Property %s not a valid URL. Nexus searching disabled",
    -  100   - 
                                 searchUrl));
    -  101  0 
                 }
    -  102   +  98  0 
                     LOGGER.warning(String.format("Property %s not a valid URL. Nexus Analyzer disabled", searchUrl));
    +  99  0 
                     enabled = false;
    +  100  6 
                 }
    +  101   
             }
    -  103  3 
         }
    -  104   +  102  6 
         }
    +  103   
     
    -  105   +  104   
         /**
    -  106   +  105   
          * Returns the analyzer's name.
    -  107   +  106   
          *
    -  108   +  107   
          * @return the name of the analyzer
    -  109   +  108   
          */
    +  109   + 
         @Override
     110   
         public String getName() {
    -  111  9 
             return ANALYZER_NAME;
    +  111  18 
             return ANALYZER_NAME;
     112   
         }
     113   @@ -240,113 +236,122 @@  118   
          */
     119   + 
         @Override
    +  120   
         public AnalysisPhase getAnalysisPhase() {
    -  120  6 
             return ANALYSIS_PHASE;
    -  121   - 
         }
    +  121  12 
             return ANALYSIS_PHASE;
     122   - 
     
    + 
         }
     123   - 
         /**
    + 
     
     124   - 
          * Returns the extensions for which this Analyzer runs.
    + 
         /**
     125   - 
          *
    + 
          * Returns the extensions for which this Analyzer runs.
     126   - 
          * @return the extensions for which this Analyzer runs
    + 
          *
     127   - 
          */
    + 
          * @return the extensions for which this Analyzer runs
     128   - 
         public Set<String> getSupportedExtensions() {
    -  129  138 
             return SUPPORTED_EXTENSIONS;
    + 
          */
    +  129   + 
         @Override
     130   - 
         }
    -  131   - 
     
    + 
         public Set<String> getSupportedExtensions() {
    +  131  276 
             return SUPPORTED_EXTENSIONS;
     132   - 
         /**
    -  133   - 
          * Determines whether the incoming extension is supported.
    -  134   - 
          *
    -  135   - 
          * @param extension the extension to check for support
    -  136   - 
          * @return whether the extension is supported
    -  137   - 
          */
    -  138   - 
         public boolean supportsExtension(String extension) {
    -  139  134 
             return SUPPORTED_EXTENSIONS.contains(extension);
    -  140   
         }
    -  141   +  133   
     
    -  142   +  134   
         /**
    -  143   - 
          * Performs the analysis.
    -  144   +  135   + 
          * Determines whether the incoming extension is supported.
    +  136   
          *
    -  145   - 
          * @param dependency the dependency to analyze
    -  146   - 
          * @param engine the engine
    -  147   - 
          * @throws AnalysisException when there's an exception during analysis
    -  148   +  137   + 
          * @param extension the extension to check for support
    +  138   + 
          * @return whether the extension is supported
    +  139   
          */
    +  140   + 
         @Override
    +  141   + 
         public boolean supportsExtension(String extension) {
    +  142  268 
             return SUPPORTED_EXTENSIONS.contains(extension);
    +  143   + 
         }
    +  144   + 
     
    +  145   + 
         /**
    +  146   + 
          * Performs the analysis.
    +  147   + 
          *
    +  148   + 
          * @param dependency the dependency to analyze
     149   - 
         public void analyze(Dependency dependency, Engine engine) throws AnalysisException {
    + 
          * @param engine the engine
     150   - 
             // Make a quick exit if this analyzer is disabled
    -  151  5 
             if (!enabled) {
    -  152  5 
                 return;
    + 
          * @throws AnalysisException when there's an exception during analysis
    +  151   + 
          */
    +  152   + 
         @Override
     153   - 
             }
    + 
         public void analyze(Dependency dependency, Engine engine) throws AnalysisException {
     154   + 
             // Make a quick exit if this analyzer is disabled
    +  155  10 
             if (!enabled) {
    +  156  0 
                 return;
    +  157   + 
             }
    +  158   
     
    -  155   - 
             try {
    -  156  0 
                 final MavenArtifact ma = searcher.searchSha1(dependency.getSha1sum());
    -  157  0 
                 if (ma.getGroupId() != null && !"".equals(ma.getGroupId())) {
    -  158  0 
                     dependency.getVendorEvidence().addEvidence("nexus", "groupid", ma.getGroupId(),
     159   - 
                             Evidence.Confidence.HIGH);
    -  160   - 
                 }
    -  161  0 
                 if (ma.getArtifactId() != null && !"".equals(ma.getArtifactId())) {
    -  162  0 
                     dependency.getProductEvidence().addEvidence("nexus", "artifactid", ma.getArtifactId(),
    + 
             try {
    +  160  10 
                 final MavenArtifact ma = searcher.searchSha1(dependency.getSha1sum());
    +  161  10 
                 if (ma.getGroupId() != null && !"".equals(ma.getGroupId())) {
    +  162  10 
                     dependency.getVendorEvidence().addEvidence("nexus", "groupid", ma.getGroupId(), Confidence.HIGH);
     163   - 
                             Evidence.Confidence.HIGH);
    -  164   
                 }
    -  165  0 
                 if (ma.getVersion() != null && !"".equals(ma.getVersion())) {
    -  166  0 
                     dependency.getVersionEvidence().addEvidence("nexus", "version", ma.getVersion(),
    -  167   - 
                             Evidence.Confidence.HIGH);
    -  168   +  164  10 
                 if (ma.getArtifactId() != null && !"".equals(ma.getArtifactId())) {
    +  165  10 
                     dependency.getProductEvidence().addEvidence("nexus", "artifactid", ma.getArtifactId(), Confidence.HIGH);
    +  166   
                 }
    -  169  0 
                 if (ma.getArtifactUrl() != null && !"".equals(ma.getArtifactUrl())) {
    -  170  0 
                     dependency.addIdentifier("maven", ma.toString(), ma.getArtifactUrl());
    -  171   +  167  10 
                 if (ma.getVersion() != null && !"".equals(ma.getVersion())) {
    +  168  10 
                     dependency.getVersionEvidence().addEvidence("nexus", "version", ma.getVersion(), Confidence.HIGH);
    +  169   
                 }
    -  172  0 
             } catch (IllegalArgumentException iae) {
    -  173  0 
                 dependency.addAnalysisException(new AnalysisException("Invalid SHA-1"));
    -  174  0 
             } catch (FileNotFoundException fnfe) {
    -  175  0 
                 dependency.addAnalysisException(new AnalysisException("Artifact not found on repository"));
    -  176  0 
             } catch (IOException ioe) {
    -  177  0 
                 dependency.addAnalysisException(new AnalysisException("Could not connect to repository", ioe));
    -  178  0 
             }
    -  179  0 
         }
    -  180   - 
     }
    +  170  10 
                 if (ma.getArtifactUrl() != null && !"".equals(ma.getArtifactUrl())) {
    +  171  10 
                     dependency.addIdentifier("maven", ma.toString(), ma.getArtifactUrl(), Confidence.HIGHEST);
    +  172   + 
                 }
    +  173  0 
             } catch (IllegalArgumentException iae) {
    +  174   + 
                 //dependency.addAnalysisException(new AnalysisException("Invalid SHA-1"));
    +  175  0 
                 LOGGER.info(String.format("invalid sha-1 hash on %s", dependency.getFileName()));
    +  176  0 
             } catch (FileNotFoundException fnfe) {
    +  177   + 
                 //dependency.addAnalysisException(new AnalysisException("Artifact not found on repository"));
    +  178  0 
                 LOGGER.fine(String.format("Artificat not found in repository '%s'", dependency.getFileName()));
    +  179  0 
                 LOGGER.log(Level.FINE, fnfe.getMessage(), fnfe);
    +  180  0 
             } catch (IOException ioe) {
     181   + 
                 //dependency.addAnalysisException(new AnalysisException("Could not connect to repository", ioe));
    +  182  0 
                 LOGGER.log(Level.FINE, "Could not connect to nexus repository", ioe);
    +  183  10 
             }
    +  184  10 
         }
    +  185   + 
     }
    +  186   
     
    -  182   +  187   
     // vim: cc=120:sw=4:ts=4:sts=4
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.NvdCveAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.NvdCveAnalyzer.html index 4ee691aba..c7f70c49f 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.NvdCveAnalyzer.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.NvdCveAnalyzer.html @@ -12,7 +12,7 @@
     
    - +
    Classes in this File Line Coverage Branch Coverage Complexity
    NvdCveAnalyzer
    75%
    21/28
    37%
    3/8
    		1.5
    NvdCveAnalyzer
    75%
    21/28
    50%
    4/8
    		1.5
     
    @@ -24,297 +24,287 @@  3   
      *
     4   - 
      * Dependency-check-core is free software: you can redistribute it and/or modify it
    + 
      * Licensed under the Apache License, Version 2.0 (the "License");
     5   - 
      * under the terms of the GNU General Public License as published by the Free
    + 
      * you may not use this file except in compliance with the License.
     6   - 
      * Software Foundation, either version 3 of the License, or (at your option) any
    + 
      * You may obtain a copy of the License at
     7   - 
      * later version.
    + 
      *
     8   - 
      *
    + 
      *     http://www.apache.org/licenses/LICENSE-2.0
     9   - 
      * Dependency-check-core is distributed in the hope that it will be useful, but
    + 
      *
     10   - 
      * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
    + 
      * Unless required by applicable law or agreed to in writing, software
     11   - 
      * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
    + 
      * distributed under the License is distributed on an "AS IS" BASIS,
     12   - 
      * details.
    + 
      * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13   - 
      *
    + 
      * See the License for the specific language governing permissions and
     14   - 
      * You should have received a copy of the GNU General Public License along with
    + 
      * limitations under the License.
     15   - 
      * dependency-check-core. If not, see http://www.gnu.org/licenses/.
    -  16   
      *
    -  17   +  16   
      * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
    -  18   +  17   
      */
    -  19   +  18   
     package org.owasp.dependencycheck.analyzer;
    -  20   +  19   
     
    -  21   +  20   
     import java.io.IOException;
    -  22   +  21   
     import java.sql.SQLException;
    -  23   +  22   
     import java.util.List;
    -  24   +  23   
     import java.util.Set;
    -  25   +  24   
     import org.owasp.dependencycheck.Engine;
    +  25   + 
     import org.owasp.dependencycheck.data.nvdcve.CveDB;
     26   - 
     import org.owasp.dependencycheck.dependency.Dependency;
    + 
     import org.owasp.dependencycheck.data.nvdcve.DatabaseException;
     27   - 
     import org.owasp.dependencycheck.dependency.Vulnerability;
    + 
     import org.owasp.dependencycheck.dependency.Dependency;
     28   
     import org.owasp.dependencycheck.dependency.Identifier;
     29   - 
     import org.owasp.dependencycheck.data.nvdcve.CveDB;
    + 
     import org.owasp.dependencycheck.dependency.Vulnerability;
     30   - 
     import org.owasp.dependencycheck.data.nvdcve.DatabaseException;
    + 
     
     31   - 
     
    -  32   
     /**
    +  32   + 
      * NvdCveAnalyzer is a utility class that takes a project dependency and attempts to discern if there is an associated
     33   - 
      * NvdCveAnalyzer is a utility class that takes a project dependency and
    + 
      * CVEs. It uses the the identifiers found by other analyzers to lookup the CVE data.
     34   - 
      * attempts to discern if there is an associated CVEs. It uses the the
    -  35   - 
      * identifiers found by other analyzers to lookup the CVE data.
    -  36   
      *
    -  37   +  35   
      * @author Jeremy Long <jeremy.long@owasp.org>
    -  38   +  36   
      */
    -  39  1 
     public class NvdCveAnalyzer implements Analyzer {
    +  37  2 
     public class NvdCveAnalyzer implements Analyzer {
    +  38   + 
     
    +  39   + 
         /**
     40   - 
     
    -  41   - 
         /**
    -  42   
          * The maximum number of query results to return.
    -  43   +  41   
          */
    -  44   +  42   
         static final int MAX_QUERY_RESULTS = 100;
    -  45   +  43   
         /**
    -  46   +  44   
          * The CVE Index.
    -  47   +  45   
          */
    -  48   +  46   
         private CveDB cveDB;
    +  47   + 
     
    +  48   + 
         /**
     49   - 
     
    -  50   - 
         /**
    -  51   
          * Opens the data source.
    -  52   +  50   
          *
    -  53   +  51   
          * @throws SQLException thrown when there is a SQL Exception
    -  54   +  52   
          * @throws IOException thrown when there is an IO Exception
    -  55   +  53   
          * @throws DatabaseException thrown when there is a database exceptions
    +  54   + 
          * @throws ClassNotFoundException thrown if the h2 database driver cannot be loaded
    +  55   + 
          */
     56   - 
          * @throws ClassNotFoundException thrown if the h2 database driver cannot be
    -  57   - 
          * loaded
    -  58   - 
          */
    -  59   
         public void open() throws SQLException, IOException, DatabaseException, ClassNotFoundException {
    -  60  3 
             cveDB = new CveDB();
    -  61  3 
             cveDB.open();
    -  62  3 
         }
    -  63   +  57  6 
             cveDB = new CveDB();
    +  58  6 
             cveDB.open();
    +  59  6 
         }
    +  60   
     
    -  64   +  61   
         /**
    -  65   +  62   
          * Closes the data source.
    -  66   +  63   
          */
    -  67   +  64   
         public void close() {
    -  68  3 
             cveDB.close();
    -  69  3 
             cveDB = null;
    -  70  3 
         }
    -  71   +  65  6 
             cveDB.close();
    +  66  6 
             cveDB = null;
    +  67  6 
         }
    +  68   
     
    -  72   +  69   
         /**
    -  73   +  70   
          * Returns the status of the data source - is the database open.
    -  74   +  71   
          *
    -  75   +  72   
          * @return true or false.
    -  76   +  73   
          */
    -  77   +  74   
         public boolean isOpen() {
    -  78  0 
             return (cveDB != null);
    +  75  0 
             return (cveDB != null);
    +  76   + 
         }
    +  77   + 
     
    +  78   + 
         /**
     79   - 
         }
    -  80   - 
     
    -  81   - 
         /**
    -  82   
          * Ensures that the CVE Database is closed.
    -  83   +  80   
          *
    -  84   +  81   
          * @throws Throwable when a throwable is thrown.
    -  85   +  82   
          */
    -  86   +  83   
         @Override
    -  87   +  84   
         protected void finalize() throws Throwable {
    -  88  0 
             super.finalize();
    -  89  0 
             if (isOpen()) {
    -  90  0 
                 close();
    -  91   +  85  0 
             super.finalize();
    +  86  0 
             if (isOpen()) {
    +  87  0 
                 close();
    +  88   
             }
    -  92  0 
         }
    +  89  0 
         }
    +  90   + 
     
    +  91   + 
         /**
    +  92   + 
          * Analyzes a dependency and attempts to determine if there are any CPE identifiers for this dependency.
     93   - 
     
    + 
          *
     94   - 
         /**
    -  95   - 
          * Analyzes a dependency and attempts to determine if there are any CPE
    -  96   - 
          * identifiers for this dependency.
    -  97   - 
          *
    -  98   
          * @param dependency The Dependency to analyze
    -  99   +  95   
          * @param engine The analysis engine
    -  100   - 
          * @throws AnalysisException is thrown if there is an issue analyzing the
    -  101   - 
          * dependency
    -  102   +  96   + 
          * @throws AnalysisException is thrown if there is an issue analyzing the dependency
    +  97   
          */
    -  103   +  98   
         public void analyze(Dependency dependency, Engine engine) throws AnalysisException {
    -  104  9 
             for (Identifier id : dependency.getIdentifiers()) {
    -  105  11 
                 if ("cpe".equals(id.getType())) {
    -  106   +  99  18 
             for (Identifier id : dependency.getIdentifiers()) {
    +  100  32 
                 if ("cpe".equals(id.getType())) {
    +  101   
                     try {
    -  107  11 
                         final String value = id.getValue();
    -  108  11 
                         final List<Vulnerability> vulns = cveDB.getVulnerabilities(value);
    -  109  11 
                         dependency.getVulnerabilities().addAll(vulns);
    -  110  0 
                     } catch (DatabaseException ex) {
    -  111  0 
                         throw new AnalysisException(ex);
    -  112  11 
                     }
    -  113   +  102  22 
                         final String value = id.getValue();
    +  103  22 
                         final List<Vulnerability> vulns = cveDB.getVulnerabilities(value);
    +  104  22 
                         dependency.getVulnerabilities().addAll(vulns);
    +  105  0 
                     } catch (DatabaseException ex) {
    +  106  0 
                         throw new AnalysisException(ex);
    +  107  22 
                     }
    +  108   
                 }
    -  114  11 
             }
    -  115  9 
         }
    +  109  32 
             }
    +  110  18 
         }
    +  111   + 
     
    +  112   + 
         /**
    +  113   + 
          * Returns true because this analyzer supports all dependency types.
    +  114   + 
          *
    +  115   + 
          * @return true.
     116   - 
     
    + 
          */
     117   - 
         /**
    -  118   - 
          * Returns true because this analyzer supports all dependency types.
    -  119   - 
          *
    -  120   - 
          * @return true.
    -  121   - 
          */
    -  122   
         public Set<String> getSupportedExtensions() {
    -  123  132 
             return null;
    -  124   +  118  264 
             return null;
    +  119   
         }
    -  125   +  120   
     
    -  126   +  121   
         /**
    -  127   +  122   
          * Returns the name of this analyzer.
    -  128   +  123   
          *
    -  129   +  124   
          * @return the name of this analyzer.
    -  130   +  125   
          */
    -  131   +  126   
         public String getName() {
    -  132  9 
             return "NVD CVE Analyzer";
    -  133   +  127  18 
             return "NVD CVE Analyzer";
    +  128   
         }
    -  134   +  129   
     
    -  135   +  130   
         /**
    -  136   +  131   
          * Returns true because this analyzer supports all dependency types.
    -  137   +  132   
          *
    -  138   +  133   
          * @param extension the file extension of the dependency being analyzed.
    -  139   +  134   
          * @return true.
    -  140   +  135   
          */
    -  141   +  136   
         public boolean supportsExtension(String extension) {
    -  142  9 
             return true;
    -  143   +  137  18 
             return true;
    +  138   
         }
    -  144   +  139   
     
    -  145   +  140   
         /**
    -  146   +  141   
          * Returns the analysis phase that this analyzer should run in.
    -  147   +  142   
          *
    -  148   +  143   
          * @return the analysis phase that this analyzer should run in.
    -  149   +  144   
          */
    -  150   +  145   
         public AnalysisPhase getAnalysisPhase() {
    -  151  6 
             return AnalysisPhase.FINDING_ANALYSIS;
    -  152   +  146  12 
             return AnalysisPhase.FINDING_ANALYSIS;
    +  147   
         }
    -  153   +  148   
     
    -  154   +  149   
         /**
    -  155   +  150   
          * Opens the NVD CVE Lucene Index.
    -  156   +  151   
          *
    -  157   +  152   
          * @throws Exception is thrown if there is an issue opening the index.
    -  158   +  153   
          */
    -  159   +  154   
         public void initialize() throws Exception {
    -  160  3 
             this.open();
    -  161  3 
         }
    -  162   +  155  6 
             this.open();
    +  156  6 
         }
    +  157   
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.VulnerabilitySuppressionAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.VulnerabilitySuppressionAnalyzer.html index 37a1ee721..215d20430 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.VulnerabilitySuppressionAnalyzer.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.analyzer.VulnerabilitySuppressionAnalyzer.html @@ -24,143 +24,139 @@  3   
      *
     4   - 
      * Dependency-check-core is free software: you can redistribute it and/or modify it
    + 
      * Licensed under the Apache License, Version 2.0 (the "License");
     5   - 
      * under the terms of the GNU General Public License as published by the Free
    + 
      * you may not use this file except in compliance with the License.
     6   - 
      * Software Foundation, either version 3 of the License, or (at your option) any
    + 
      * You may obtain a copy of the License at
     7   - 
      * later version.
    + 
      *
     8   - 
      *
    + 
      *     http://www.apache.org/licenses/LICENSE-2.0
     9   - 
      * Dependency-check-core is distributed in the hope that it will be useful, but
    + 
      *
     10   - 
      * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
    + 
      * Unless required by applicable law or agreed to in writing, software
     11   - 
      * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
    + 
      * distributed under the License is distributed on an "AS IS" BASIS,
     12   - 
      * details.
    + 
      * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13   - 
      *
    + 
      * See the License for the specific language governing permissions and
     14   - 
      * You should have received a copy of the GNU General Public License along with
    + 
      * limitations under the License.
     15   - 
      * dependency-check-core. If not, see http://www.gnu.org/licenses/.
    + 
      *
     16   - 
      *
    -  17   
      * Copyright (c) 2013 Jeremy Long. All Rights Reserved.
    +  17   + 
      */
     18   - 
      */
    -  19   
     package org.owasp.dependencycheck.analyzer;
    +  19   + 
     
     20   - 
     
    -  21   
     import org.owasp.dependencycheck.Engine;
    -  22   +  21   
     import org.owasp.dependencycheck.dependency.Dependency;
    -  23   +  22   
     import org.owasp.dependencycheck.suppression.SuppressionRule;
    +  23   + 
     
     24   - 
     
    -  25   
     /**
    +  25   + 
      * The suppression analyzer processes an externally defined XML document that complies with the suppressions.xsd schema.
     26   - 
      * The suppression analyzer processes an externally defined XML document that
    + 
      * Any identified Vulnerability entries within the dependencies that match will be removed.
     27   - 
      * complies with the suppressions.xsd schema. Any identified Vulnerability
    -  28   - 
      * entries within the dependencies that match will be removed.
    -  29   
      *
    -  30   +  28   
      * @author Jeremy Long <jeremy.long@owasp.org>
    -  31   +  29   
      */
    -  32  1 
     public class VulnerabilitySuppressionAnalyzer extends AbstractSuppressionAnalyzer {
    -  33   +  30  2 
     public class VulnerabilitySuppressionAnalyzer extends AbstractSuppressionAnalyzer {
    +  31   
     
    -  34   +  32   
         //<editor-fold defaultstate="collapsed" desc="All standard implementation details of Analyzer">
    -  35   +  33   
         /**
    -  36   +  34   
          * The name of the analyzer.
    -  37   +  35   
          */
    -  38   +  36   
         private static final String ANALYZER_NAME = "Vulnerability Suppression Analyzer";
    -  39   +  37   
         /**
    -  40   +  38   
          * The phase that this analyzer is intended to run in.
    +  39   + 
          */
    +  40  2 
         private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.POST_FINDING_ANALYSIS;
     41   - 
          */
    -  42  1 
         private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.POST_FINDING_ANALYSIS;
    + 
     
    +  42   + 
         /**
     43   - 
     
    -  44   - 
         /**
    -  45   
          * Returns the name of the analyzer.
    -  46   +  44   
          *
    -  47   +  45   
          * @return the name of the analyzer.
    +  46   + 
          */
    +  47   + 
         @Override
     48   - 
          */
    -  49   - 
         @Override
    -  50   
         public String getName() {
    -  51  9 
             return ANALYZER_NAME;
    +  49  18 
             return ANALYZER_NAME;
    +  50   + 
         }
    +  51   + 
     
     52   - 
         }
    -  53   - 
     
    -  54   
         /**
    -  55   +  53   
          * Returns the phase that the analyzer is intended to run in.
    -  56   +  54   
          *
    -  57   +  55   
          * @return the phase that the analyzer is intended to run in.
    -  58   +  56   
          */
    -  59   +  57   
         @Override
    -  60   +  58   
         public AnalysisPhase getAnalysisPhase() {
    -  61  6 
             return ANALYSIS_PHASE;
    -  62   +  59  12 
             return ANALYSIS_PHASE;
    +  60   
         }
    -  63   +  61   
         //</editor-fold>
    -  64   +  62   
     
    -  65   +  63   
         @Override
    -  66   +  64   
         public void analyze(final Dependency dependency, final Engine engine) throws AnalysisException {
    -  67   +  65   
     
    -  68  9 
             if (getRules() == null || getRules().size() <= 0) {
    -  69  9 
                 return;
    -  70   +  66  18 
             if (getRules() == null || getRules().size() <= 0) {
    +  67  18 
                 return;
    +  68   
             }
    -  71   +  69   
     
    -  72  0 
             for (final SuppressionRule rule : getRules()) {
    -  73  0 
                 rule.process(dependency);
    -  74  0 
             }
    -  75  0 
         }
    -  76   +  70  0 
             for (final SuppressionRule rule : getRules()) {
    +  71  0 
                 rule.process(dependency);
    +  72  0 
             }
    +  73  0 
         }
    +  74   
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.cpe.CpeMemoryIndex.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.cpe.CpeMemoryIndex.html index ec902602f..8eba42a9c 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.cpe.CpeMemoryIndex.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.cpe.CpeMemoryIndex.html @@ -24,561 +24,557 @@  3   
      *
     4   - 
      * Dependency-check-core is free software: you can redistribute it and/or modify it
    + 
      * Licensed under the Apache License, Version 2.0 (the "License");
     5   - 
      * under the terms of the GNU General Public License as published by the Free
    + 
      * you may not use this file except in compliance with the License.
     6   - 
      * Software Foundation, either version 3 of the License, or (at your option) any
    + 
      * You may obtain a copy of the License at
     7   - 
      * later version.
    + 
      *
     8   - 
      *
    + 
      *     http://www.apache.org/licenses/LICENSE-2.0
     9   - 
      * Dependency-check-core is distributed in the hope that it will be useful, but
    + 
      *
     10   - 
      * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
    + 
      * Unless required by applicable law or agreed to in writing, software
     11   - 
      * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
    + 
      * distributed under the License is distributed on an "AS IS" BASIS,
     12   - 
      * details.
    + 
      * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13   - 
      *
    + 
      * See the License for the specific language governing permissions and
     14   - 
      * You should have received a copy of the GNU General Public License along with
    + 
      * limitations under the License.
     15   - 
      * dependency-check-core. If not, see http://www.gnu.org/licenses/.
    -  16   
      *
    -  17   +  16   
      * Copyright (c) 2013 Jeremy Long. All Rights Reserved.
    -  18   +  17   
      */
    -  19   +  18   
     package org.owasp.dependencycheck.data.cpe;
    -  20   +  19   
     
    -  21   +  20   
     import java.io.IOException;
    -  22   +  21   
     import java.sql.ResultSet;
    -  23   +  22   
     import java.sql.SQLException;
    -  24   +  23   
     import java.util.HashMap;
    -  25   +  24   
     import java.util.Map;
    -  26   +  25   
     import java.util.logging.Level;
    -  27   +  26   
     import java.util.logging.Logger;
    -  28   +  27   
     import org.apache.lucene.analysis.Analyzer;
    -  29   +  28   
     import org.apache.lucene.analysis.core.KeywordAnalyzer;
    -  30   +  29   
     import org.apache.lucene.analysis.miscellaneous.PerFieldAnalyzerWrapper;
    -  31   +  30   
     import org.apache.lucene.document.Document;
    -  32   +  31   
     import org.apache.lucene.document.Field;
    -  33   +  32   
     import org.apache.lucene.document.TextField;
    -  34   +  33   
     import org.apache.lucene.index.CorruptIndexException;
    -  35   +  34   
     import org.apache.lucene.index.DirectoryReader;
    -  36   +  35   
     import org.apache.lucene.index.IndexReader;
    -  37   +  36   
     import org.apache.lucene.index.IndexWriter;
    -  38   +  37   
     import org.apache.lucene.index.IndexWriterConfig;
    -  39   +  38   
     import org.apache.lucene.queryparser.classic.ParseException;
    -  40   +  39   
     import org.apache.lucene.queryparser.classic.QueryParser;
    -  41   +  40   
     import org.apache.lucene.search.IndexSearcher;
    -  42   +  41   
     import org.apache.lucene.search.Query;
    -  43   +  42   
     import org.apache.lucene.search.TopDocs;
    +  43   + 
     import org.apache.lucene.store.RAMDirectory;
     44   
     import org.owasp.dependencycheck.data.lucene.FieldAnalyzer;
     45   - 
     import org.owasp.dependencycheck.data.nvdcve.CveDB;
    -  46   - 
     import org.apache.lucene.store.RAMDirectory;
    -  47   
     import org.owasp.dependencycheck.data.lucene.LuceneUtils;
    -  48   +  46   
     import org.owasp.dependencycheck.data.lucene.SearchFieldAnalyzer;
    +  47   + 
     import org.owasp.dependencycheck.data.nvdcve.CveDB;
    +  48   + 
     
     49   - 
     
    -  50   
     /**
    +  50   + 
      * An in memory lucene index that contains the vendor/product combinations from the CPE (application) identifiers within
     51   - 
      * An in memory lucene index that contains the vendor/product combinations from
    + 
      * the NVD CVE data.
     52   - 
      * the CPE (application) identifiers within the NVD CVE data.
    -  53   
      *
    -  54   +  53   
      * @author Jeremy Long <jeremy.long@owasp.org>
    -  55   +  54   
      */
    -  56   +  55   
     public final class CpeMemoryIndex {
    +  56   + 
     
     57   - 
     
    + 
         /**
     58   - 
         /**
    -  59   
          * singleton instance.
    -  60   +  59   
          */
    -  61  1 
         private static CpeMemoryIndex instance = new CpeMemoryIndex();
    +  60  2 
         private static CpeMemoryIndex instance = new CpeMemoryIndex();
    +  61   + 
     
     62   - 
     
    + 
         /**
     63   - 
         /**
    -  64   
          * private constructor for singleton.
    -  65   +  64   
          */
    -  66  1 
         private CpeMemoryIndex() {
    -  67  1 
         }
    +  65  2 
         private CpeMemoryIndex() {
    +  66  2 
         }
    +  67   + 
     
     68   - 
     
    + 
         /**
     69   - 
         /**
    -  70   
          * Gets the singleton instance of the CpeMemoryIndex.
    +  70   + 
          *
     71   - 
          *
    -  72   
          * @return the instance of the CpeMemoryIndex
    +  72   + 
          */
     73   - 
          */
    -  74   
         public static CpeMemoryIndex getInstance() {
    -  75  14 
             return instance;
    +  74  28 
             return instance;
    +  75   + 
         }
     76   - 
         }
    + 
         /**
     77   - 
         /**
    -  78   
          * The in memory Lucene index.
    +  78   + 
          */
     79   - 
          */
    -  80   
         private RAMDirectory index;
    +  80   + 
         /**
     81   - 
         /**
    -  82   
          * The Lucene IndexReader.
    +  82   + 
          */
     83   - 
          */
    -  84   
         private IndexReader indexReader;
    +  84   + 
         /**
     85   - 
         /**
    -  86   
          * The Lucene IndexSearcher.
    +  86   + 
          */
     87   - 
          */
    -  88   
         private IndexSearcher indexSearcher;
    +  88   + 
         /**
     89   - 
         /**
    -  90   
          * The Lucene Analyzer used for Searching.
    +  90   + 
          */
     91   - 
          */
    -  92   
         private Analyzer searchingAnalyzer;
    +  92   + 
         /**
     93   - 
         /**
    -  94   
          * The Lucene QueryParser used for Searching.
    +  94   + 
          */
     95   - 
          */
    -  96   
         private QueryParser queryParser;
    +  96   + 
         /**
     97   - 
         /**
    -  98   
          * The search field analyzer for the product field.
    +  98   + 
          */
     99   - 
          */
    -  100   
         private SearchFieldAnalyzer productSearchFieldAnalyzer;
    +  100   + 
         /**
     101   - 
         /**
    -  102   
          * The search field analyzer for the vendor field.
    +  102   + 
          */
     103   - 
          */
    -  104   
         private SearchFieldAnalyzer vendorSearchFieldAnalyzer;
    +  104   + 
     
     105   - 
     
    + 
         /**
     106   - 
         /**
    -  107   
          * Creates and loads data into an in memory index.
    +  107   + 
          *
     108   - 
          *
    -  109   
          * @param cve the data source to retrieve the cpe data
    -  110   +  109   
          * @throws IndexException thrown if there is an error creating the index
    +  110   + 
          */
     111   - 
          */
    -  112   
         public void open(CveDB cve) throws IndexException {
    -  113  14 
             if (!openState) {
    -  114  11 
                 index = new RAMDirectory();
    -  115  11 
                 buildIndex(cve);
    -  116   +  112  28 
             if (!openState) {
    +  113  22 
                 index = new RAMDirectory();
    +  114  22 
                 buildIndex(cve);
    +  115   
                 try {
    -  117  11 
                     indexReader = DirectoryReader.open(index);
    -  118  0 
                 } catch (IOException ex) {
    -  119  0 
                     throw new IndexException(ex);
    -  120  11 
                 }
    -  121  11 
                 indexSearcher = new IndexSearcher(indexReader);
    -  122  11 
                 searchingAnalyzer = createSearchingAnalyzer();
    -  123  11 
                 queryParser = new QueryParser(LuceneUtils.CURRENT_VERSION, Fields.DOCUMENT_KEY, searchingAnalyzer);
    -  124  11 
                 openState = true;
    -  125   +  116  22 
                     indexReader = DirectoryReader.open(index);
    +  117  0 
                 } catch (IOException ex) {
    +  118  0 
                     throw new IndexException(ex);
    +  119  22 
                 }
    +  120  22 
                 indexSearcher = new IndexSearcher(indexReader);
    +  121  22 
                 searchingAnalyzer = createSearchingAnalyzer();
    +  122  22 
                 queryParser = new QueryParser(LuceneUtils.CURRENT_VERSION, Fields.DOCUMENT_KEY, searchingAnalyzer);
    +  123  22 
                 openState = true;
    +  124   
             }
    -  126  14 
         }
    +  125  28 
         }
    +  126   + 
         /**
     127   - 
         /**
    -  128   
          * A flag indicating whether or not the index is open.
    -  129   +  128   
          */
    -  130  1 
         private boolean openState = false;
    +  129  2 
         private boolean openState = false;
    +  130   + 
     
     131   - 
     
    + 
         /**
     132   - 
         /**
    -  133   
          * returns whether or not the index is open.
    +  133   + 
          *
     134   - 
          *
    -  135   
          * @return whether or not the index is open
    +  135   + 
          */
     136   - 
          */
    -  137   
         public boolean isOpen() {
    -  138  0 
             return openState;
    +  137  0 
             return openState;
    +  138   + 
         }
     139   - 
         }
    + 
     
     140   - 
     
    + 
         /**
     141   - 
         /**
    -  142   
          * Creates the indexing analyzer for the CPE Index.
    +  142   + 
          *
     143   - 
          *
    + 
          * @return the CPE Analyzer.
     144   - 
          * @return the CPE Analyzer.
    + 
          */
     145   - 
          */
    + 
         @SuppressWarnings("unchecked")
     146   - 
         @SuppressWarnings("unchecked")
    -  147   
         private Analyzer createIndexingAnalyzer() {
    -  148  11 
             final Map fieldAnalyzers = new HashMap();
    -  149  11 
             fieldAnalyzers.put(Fields.DOCUMENT_KEY, new KeywordAnalyzer());
    -  150  11 
             return new PerFieldAnalyzerWrapper(new FieldAnalyzer(LuceneUtils.CURRENT_VERSION), fieldAnalyzers);
    +  147  22 
             final Map fieldAnalyzers = new HashMap();
    +  148  22 
             fieldAnalyzers.put(Fields.DOCUMENT_KEY, new KeywordAnalyzer());
    +  149  22 
             return new PerFieldAnalyzerWrapper(new FieldAnalyzer(LuceneUtils.CURRENT_VERSION), fieldAnalyzers);
    +  150   + 
         }
     151   - 
         }
    + 
     
     152   - 
     
    + 
         /**
     153   - 
         /**
    -  154   
          * Creates an Analyzer for searching the CPE Index.
    +  154   + 
          *
     155   - 
          *
    -  156   
          * @return the CPE Analyzer.
    +  156   + 
          */
     157   - 
          */
    -  158   
         @SuppressWarnings("unchecked")
    -  159   +  158   
         private Analyzer createSearchingAnalyzer() {
    -  160  11 
             final Map fieldAnalyzers = new HashMap();
    -  161  11 
             fieldAnalyzers.put(Fields.DOCUMENT_KEY, new KeywordAnalyzer());
    -  162  11 
             productSearchFieldAnalyzer = new SearchFieldAnalyzer(LuceneUtils.CURRENT_VERSION);
    -  163  11 
             vendorSearchFieldAnalyzer = new SearchFieldAnalyzer(LuceneUtils.CURRENT_VERSION);
    -  164  11 
             fieldAnalyzers.put(Fields.PRODUCT, productSearchFieldAnalyzer);
    -  165  11 
             fieldAnalyzers.put(Fields.VENDOR, vendorSearchFieldAnalyzer);
    -  166   +  159  22 
             final Map fieldAnalyzers = new HashMap();
    +  160  22 
             fieldAnalyzers.put(Fields.DOCUMENT_KEY, new KeywordAnalyzer());
    +  161  22 
             productSearchFieldAnalyzer = new SearchFieldAnalyzer(LuceneUtils.CURRENT_VERSION);
    +  162  22 
             vendorSearchFieldAnalyzer = new SearchFieldAnalyzer(LuceneUtils.CURRENT_VERSION);
    +  163  22 
             fieldAnalyzers.put(Fields.PRODUCT, productSearchFieldAnalyzer);
    +  164  22 
             fieldAnalyzers.put(Fields.VENDOR, vendorSearchFieldAnalyzer);
    +  165   
     
    -  167  11 
             return new PerFieldAnalyzerWrapper(new FieldAnalyzer(LuceneUtils.CURRENT_VERSION), fieldAnalyzers);
    +  166  22 
             return new PerFieldAnalyzerWrapper(new FieldAnalyzer(LuceneUtils.CURRENT_VERSION), fieldAnalyzers);
    +  167   + 
         }
     168   - 
         }
    + 
     
     169   - 
     
    + 
         /**
     170   - 
         /**
    -  171   
          * Saves a CPE IndexEntry into the Lucene index.
    +  171   + 
          *
     172   - 
          *
    -  173   
          * @param vendor the vendor to index
    -  174   +  173   
          * @param product the product to index
    -  175   +  174   
          * @param indexWriter the index writer to write the entry into
    -  176   +  175   
          * @throws CorruptIndexException is thrown if the index is corrupt
    -  177   +  176   
          * @throws IOException is thrown if an IOException occurs
    +  177   + 
          */
     178   - 
          */
    -  179   
         public void saveEntry(String vendor, String product, IndexWriter indexWriter) throws CorruptIndexException, IOException {
    -  180  236203 
             final Document doc = new Document();
    -  181  236203 
             final Field v = new TextField(Fields.VENDOR, vendor, Field.Store.YES);
    -  182  236203 
             final Field p = new TextField(Fields.PRODUCT, product, Field.Store.YES);
    -  183  236203 
             doc.add(v);
    -  184  236203 
             doc.add(p);
    -  185  236203 
             indexWriter.addDocument(doc);
    -  186  236203 
         }
    +  179  472868 
             final Document doc = new Document();
    +  180  472868 
             final Field v = new TextField(Fields.VENDOR, vendor, Field.Store.YES);
    +  181  472868 
             final Field p = new TextField(Fields.PRODUCT, product, Field.Store.YES);
    +  182  472868 
             doc.add(v);
    +  183  472868 
             doc.add(p);
    +  184  472868 
             indexWriter.addDocument(doc);
    +  185  472868 
         }
    +  186   + 
     
     187   - 
     
    + 
         /**
     188   - 
         /**
    -  189   
          * Closes the CPE Index.
    +  189   + 
          */
     190   - 
          */
    -  191   
         public void close() {
    -  192  11 
             if (searchingAnalyzer != null) {
    -  193  11 
                 searchingAnalyzer.close();
    -  194  11 
                 searchingAnalyzer = null;
    -  195   +  191  22 
             if (searchingAnalyzer != null) {
    +  192  22 
                 searchingAnalyzer.close();
    +  193  22 
                 searchingAnalyzer = null;
    +  194   
             }
    -  196  11 
             if (indexReader != null) {
    -  197   +  195  22 
             if (indexReader != null) {
    +  196   
                 try {
    -  198  11 
                     indexReader.close();
    -  199  0 
                 } catch (IOException ex) {
    -  200  0 
                     Logger.getLogger(CpeMemoryIndex.class.getName()).log(Level.FINEST, null, ex);
    -  201  11 
                 }
    -  202  11 
                 indexReader = null;
    -  203   +  197  22 
                     indexReader.close();
    +  198  0 
                 } catch (IOException ex) {
    +  199  0 
                     Logger.getLogger(CpeMemoryIndex.class.getName()).log(Level.FINEST, null, ex);
    +  200  22 
                 }
    +  201  22 
                 indexReader = null;
    +  202   
             }
    -  204  11 
             queryParser = null;
    -  205  11 
             indexSearcher = null;
    -  206  11 
             if (index != null) {
    -  207  11 
                 index.close();
    -  208  11 
                 index = null;
    -  209   +  203  22 
             queryParser = null;
    +  204  22 
             indexSearcher = null;
    +  205  22 
             if (index != null) {
    +  206  22 
                 index.close();
    +  207  22 
                 index = null;
    +  208   
             }
    -  210  11 
             openState = false;
    -  211  11 
         }
    +  209  22 
             openState = false;
    +  210  22 
         }
    +  211   + 
     
     212   - 
     
    + 
         /**
     213   - 
         /**
    -  214   
          * Builds the lucene index based off of the data within the CveDB.
    +  214   + 
          *
     215   - 
          *
    -  216   
          * @param cve the data base containing the CPE data
    -  217   +  216   
          * @throws IndexException thrown if there is an issue creating the index
    +  217   + 
          */
     218   - 
          */
    -  219   
         private void buildIndex(CveDB cve) throws IndexException {
    -  220  11 
             Analyzer analyzer = null;
    -  221  11 
             IndexWriter indexWriter = null;
    -  222   +  219  22 
             Analyzer analyzer = null;
    +  220  22 
             IndexWriter indexWriter = null;
    +  221   
             try {
    -  223  11 
                 analyzer = createIndexingAnalyzer();
    -  224  11 
                 final IndexWriterConfig conf = new IndexWriterConfig(LuceneUtils.CURRENT_VERSION, analyzer);
    -  225  11 
                 indexWriter = new IndexWriter(index, conf);
    -  226  11 
                 final ResultSet rs = cve.getVendorProductList();
    -  227  11 
                 if (rs == null) {
    -  228  0 
                     throw new IndexException("No data exists");
    +  222  22 
                 analyzer = createIndexingAnalyzer();
    +  223  22 
                 final IndexWriterConfig conf = new IndexWriterConfig(LuceneUtils.CURRENT_VERSION, analyzer);
    +  224  22 
                 indexWriter = new IndexWriter(index, conf);
    +  225  22 
                 final ResultSet rs = cve.getVendorProductList();
    +  226  22 
                 if (rs == null) {
    +  227  0 
                     throw new IndexException("No data exists");
    +  228   + 
                 }
     229   - 
                 }
    -  230   
                 try {
    -  231  236214 
                     while (rs.next()) {
    -  232  236203 
                         saveEntry(rs.getString(1), rs.getString(2), indexWriter);
    -  233   +  230  472890 
                     while (rs.next()) {
    +  231  472868 
                         saveEntry(rs.getString(1), rs.getString(2), indexWriter);
    +  232   
                     }
    -  234  0 
                 } catch (SQLException ex) {
    -  235  0 
                     Logger.getLogger(CpeMemoryIndex.class.getName()).log(Level.FINE, null, ex);
    -  236  0 
                     throw new IndexException("Error reading CPE data", ex);
    -  237  11 
                 }
    -  238  0 
             } catch (CorruptIndexException ex) {
    -  239  0 
                 throw new IndexException("Unable to close an in-memory index", ex);
    -  240  0 
             } catch (IOException ex) {
    -  241  0 
                 throw new IndexException("Unable to close an in-memory index", ex);
    -  242   +  233  0 
                 } catch (SQLException ex) {
    +  234  0 
                     Logger.getLogger(CpeMemoryIndex.class.getName()).log(Level.FINE, null, ex);
    +  235  0 
                     throw new IndexException("Error reading CPE data", ex);
    +  236  22 
                 }
    +  237  0 
             } catch (CorruptIndexException ex) {
    +  238  0 
                 throw new IndexException("Unable to close an in-memory index", ex);
    +  239  0 
             } catch (IOException ex) {
    +  240  0 
                 throw new IndexException("Unable to close an in-memory index", ex);
    +  241   
             } finally {
    -  243  11 
                 if (indexWriter != null) {
    -  244   +  242  22 
                 if (indexWriter != null) {
    +  243   
                     try {
    -  245   +  244   
                         try {
    -  246  11 
                             indexWriter.commit();
    -  247   +  245  22 
                             indexWriter.commit();
    +  246   
                         } finally {
    -  248  11 
                             indexWriter.close(true);
    -  249  11 
                         }
    -  250  0 
                     } catch (CorruptIndexException ex) {
    -  251  0 
                         throw new IndexException("Unable to close an in-memory index", ex);
    -  252  0 
                     } catch (IOException ex) {
    -  253  0 
                         throw new IndexException("Unable to close an in-memory index", ex);
    -  254  11 
                     }
    -  255  11 
                     if (analyzer != null) {
    -  256  11 
                         analyzer.close();
    -  257   +  247  22 
                             indexWriter.close(true);
    +  248  22 
                         }
    +  249  0 
                     } catch (CorruptIndexException ex) {
    +  250  0 
                         throw new IndexException("Unable to close an in-memory index", ex);
    +  251  0 
                     } catch (IOException ex) {
    +  252  0 
                         throw new IndexException("Unable to close an in-memory index", ex);
    +  253  22 
                     }
    +  254  22 
                     if (analyzer != null) {
    +  255  22 
                         analyzer.close();
    +  256   
                     }
    -  258   +  257   
                 }
    -  259   +  258   
             }
    -  260  11 
         }
    +  259  22 
         }
    +  260   + 
     
     261   - 
     
    + 
         /**
     262   - 
         /**
    -  263   
          * Resets the searching analyzers
    +  263   + 
          */
     264   - 
          */
    -  265   
         private void resetSearchingAnalyzer() {
    -  266  0 
             if (productSearchFieldAnalyzer != null) {
    -  267  0 
                 productSearchFieldAnalyzer.clear();
    -  268   +  265  0 
             if (productSearchFieldAnalyzer != null) {
    +  266  0 
                 productSearchFieldAnalyzer.clear();
    +  267   
             }
    -  269  0 
             if (vendorSearchFieldAnalyzer != null) {
    -  270  0 
                 vendorSearchFieldAnalyzer.clear();
    -  271   +  268  0 
             if (vendorSearchFieldAnalyzer != null) {
    +  269  0 
                 vendorSearchFieldAnalyzer.clear();
    +  270   
             }
    -  272  0 
         }
    +  271  0 
         }
    +  272   + 
     
     273   - 
     
    + 
         /**
     274   - 
         /**
    -  275   
          * Searches the index using the given search string.
    +  275   + 
          *
     276   - 
          *
    -  277   
          * @param searchString the query text
    -  278   +  277   
          * @param maxQueryResults the maximum number of documents to return
    -  279   +  278   
          * @return the TopDocs found by the search
    -  280   +  279   
          * @throws ParseException thrown when the searchString is invalid
    +  280   + 
          * @throws IOException is thrown if there is an issue with the underlying Index
     281   - 
          * @throws IOException is thrown if there is an issue with the underlying
    + 
          */
     282   - 
          * Index
    -  283   - 
          */
    -  284   
         public TopDocs search(String searchString, int maxQueryResults) throws ParseException, IOException {
    -  285  73 
             if (searchString == null || searchString.trim().isEmpty()) {
    -  286  0 
                 throw new ParseException("Query is null or empty");
    -  287   +  283  146 
             if (searchString == null || searchString.trim().isEmpty()) {
    +  284  0 
                 throw new ParseException("Query is null or empty");
    +  285   
             }
    -  288  73 
             final Query query = queryParser.parse(searchString);
    -  289  73 
             return indexSearcher.search(query, maxQueryResults);
    +  286  146 
             final Query query = queryParser.parse(searchString);
    +  287  146 
             return indexSearcher.search(query, maxQueryResults);
    +  288   + 
         }
    +  289   + 
     
     290   - 
         }
    + 
         /**
     291   - 
     
    -  292   - 
         /**
    -  293   
          * Searches the index using the given query.
    -  294   +  292   
          *
    -  295   +  293   
          * @param query the query used to search the index
    -  296   +  294   
          * @param maxQueryResults the max number of results to return
    -  297   +  295   
          * @return the TopDocs found be the query
    -  298   +  296   
          * @throws CorruptIndexException thrown if the Index is corrupt
    +  297   + 
          * @throws IOException thrown if there is an IOException
    +  298   + 
          */
     299   - 
          * @throws IOException thrown if there is an IOException
    -  300   - 
          */
    -  301   
         public TopDocs search(Query query, int maxQueryResults) throws CorruptIndexException, IOException {
    -  302  0 
             resetSearchingAnalyzer();
    -  303  0 
             return indexSearcher.search(query, maxQueryResults);
    +  300  0 
             resetSearchingAnalyzer();
    +  301  0 
             return indexSearcher.search(query, maxQueryResults);
    +  302   + 
         }
    +  303   + 
     
     304   - 
         }
    + 
         /**
     305   - 
     
    -  306   - 
         /**
    -  307   
          * Retrieves a document from the Index.
    -  308   +  306   
          *
    -  309   +  307   
          * @param documentId the id of the document to retrieve
    -  310   +  308   
          * @return the Document
    -  311   +  309   
          * @throws IOException thrown if there is an IOException
    -  312   +  310   
          */
    -  313   +  311   
         public Document getDocument(int documentId) throws IOException {
    -  314  750 
             return indexSearcher.doc(documentId);
    -  315   +  312  1500 
             return indexSearcher.doc(documentId);
    +  313   
         }
    -  316   +  314   
     
    -  317   +  315   
         /**
    -  318   +  316   
          * Returns the number of CPE entries stored in the index.
    -  319   +  317   
          *
    -  320   +  318   
          * @return the number of CPE entries stored in the index
    -  321   +  319   
          */
    -  322   +  320   
         public int numDocs() {
    -  323  3 
             if (indexReader == null) {
    -  324  0 
                 return -1;
    -  325   +  321  6 
             if (indexReader == null) {
    +  322  0 
                 return -1;
    +  323   
             }
    -  326  3 
             return indexReader.numDocs();
    -  327   +  324  6 
             return indexReader.numDocs();
    +  325   
         }
    -  328   +  326   
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.cpe.Fields.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.cpe.Fields.html index 1148398b0..422945862 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.cpe.Fields.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.cpe.Fields.html @@ -24,88 +24,84 @@  3   
      *
     4   - 
      * Dependency-check-core is free software: you can redistribute it and/or modify it
    + 
      * Licensed under the Apache License, Version 2.0 (the "License");
     5   - 
      * under the terms of the GNU General Public License as published by the Free
    + 
      * you may not use this file except in compliance with the License.
     6   - 
      * Software Foundation, either version 3 of the License, or (at your option) any
    + 
      * You may obtain a copy of the License at
     7   - 
      * later version.
    + 
      *
     8   - 
      *
    + 
      *     http://www.apache.org/licenses/LICENSE-2.0
     9   - 
      * Dependency-check-core is distributed in the hope that it will be useful, but
    + 
      *
     10   - 
      * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
    + 
      * Unless required by applicable law or agreed to in writing, software
     11   - 
      * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
    + 
      * distributed under the License is distributed on an "AS IS" BASIS,
     12   - 
      * details.
    + 
      * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13   - 
      *
    + 
      * See the License for the specific language governing permissions and
     14   - 
      * You should have received a copy of the GNU General Public License along with
    + 
      * limitations under the License.
     15   - 
      * dependency-check-core. If not, see http://www.gnu.org/licenses/.
    + 
      *
     16   - 
      *
    -  17   
      * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
    +  17   + 
      */
     18   - 
      */
    -  19   
     package org.owasp.dependencycheck.data.cpe;
    +  19   + 
     
     20   - 
     
    -  21   
     /**
    +  21   + 
      * Fields is a collection of field names used within the Lucene index for CPE entries.
     22   - 
      * Fields is a collection of field names used within the Lucene index for CPE
    -  23   - 
      * entries.
    -  24   
      *
    -  25   +  23   
      * @author Jeremy Long <jeremy.long@owasp.org>
    -  26   +  24   
      */
    -  27  0 
     public abstract class Fields {
    -  28   +  25  0 
     public abstract class Fields {
    +  26   
     
    -  29   +  27   
         /**
    -  30   +  28   
          * The key for the name document id.
    -  31   +  29   
          */
    -  32   +  30   
         public static final String DOCUMENT_KEY = "id";
    -  33   +  31   
         /**
    -  34   +  32   
          * The key for the vendor field.
    -  35   +  33   
          */
    -  36   +  34   
         public static final String VENDOR = "vendor";
    -  37   +  35   
         /**
    -  38   +  36   
          * The key for the product field.
    -  39   +  37   
          */
    -  40   +  38   
         public static final String PRODUCT = "product";
    -  41   +  39   
         /**
    -  42   +  40   
          * The key for the version field.
    -  43   +  41   
          */
    -  44   +  42   
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.cpe.IndexEntry.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.cpe.IndexEntry.html index 376931ca8..11c1181d0 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.cpe.IndexEntry.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.cpe.IndexEntry.html @@ -24,343 +24,345 @@  3   
      *
     4   - 
      * Dependency-check-core is free software: you can redistribute it and/or modify it
    + 
      * Licensed under the Apache License, Version 2.0 (the "License");
     5   - 
      * under the terms of the GNU General Public License as published by the Free
    + 
      * you may not use this file except in compliance with the License.
     6   - 
      * Software Foundation, either version 3 of the License, or (at your option) any
    + 
      * You may obtain a copy of the License at
     7   - 
      * later version.
    + 
      *
     8   - 
      *
    + 
      *     http://www.apache.org/licenses/LICENSE-2.0
     9   - 
      * Dependency-check-core is distributed in the hope that it will be useful, but
    + 
      *
     10   - 
      * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
    + 
      * Unless required by applicable law or agreed to in writing, software
     11   - 
      * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
    + 
      * distributed under the License is distributed on an "AS IS" BASIS,
     12   - 
      * details.
    + 
      * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13   - 
      *
    + 
      * See the License for the specific language governing permissions and
     14   - 
      * You should have received a copy of the GNU General Public License along with
    + 
      * limitations under the License.
     15   - 
      * dependency-check-core. If not, see http://www.gnu.org/licenses/.
    + 
      *
     16   - 
      *
    -  17   
      * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
    +  17   + 
      */
     18   - 
      */
    -  19   
     package org.owasp.dependencycheck.data.cpe;
    +  19   + 
     
     20   - 
     
    -  21   
     import java.io.Serializable;
    -  22   +  21   
     import java.io.UnsupportedEncodingException;
    -  23   +  22   
     import java.net.URLDecoder;
    +  23   + 
     
     24   - 
     
    -  25   
     /**
    -  26   +  25   
      * A CPE entry containing the name, vendor, product, and version.
    -  27   +  26   
      *
    -  28   +  27   
      * @author Jeremy Long <jeremy.long@owasp.org>
    -  29   +  28   
      */
    -  30  12041 
     public class IndexEntry implements Serializable {
    +  29  24082 
     public class IndexEntry implements Serializable {
    +  30   + 
     
     31   - 
     
    + 
         /**
     32   - 
         /**
    -  33   
          * the serial version uid.
    +  33   + 
          */
     34   - 
          */
    -  35   
         static final long serialVersionUID = 8011924485946326934L;
    +  35   + 
         /**
     36   - 
         /**
    -  37   
          * The vendor name.
    +  37   + 
          */
     38   - 
          */
    -  39   
         private String vendor;
    +  39   + 
         /**
     40   - 
         /**
    -  41   
          * The documentId.
    +  41   + 
          */
     42   - 
          */
    -  43   
         private String documentId;
    +  43   + 
     
     44   - 
     
    + 
         /**
     45   - 
         /**
    -  46   
          * Get the value of documentId.
    +  46   + 
          *
     47   - 
          *
    -  48   
          * @return the value of documentId
    +  48   + 
          */
     49   - 
          */
    -  50   
         public String getDocumentId() {
    -  51  0 
             if (documentId == null && vendor != null && product != null) {
    -  52  0 
                 documentId = vendor + ":" + product;
    -  53   +  50  0 
             if (documentId == null && vendor != null && product != null) {
    +  51  0 
                 documentId = vendor + ":" + product;
    +  52   
             }
    -  54  0 
             return documentId;
    +  53  0 
             return documentId;
    +  54   + 
         }
     55   - 
         }
    + 
     
     56   - 
     
    + 
         /**
     57   - 
         /**
    -  58   
          * Set the value of documentId.
    +  58   + 
          *
     59   - 
          *
    -  60   
          * @param documentId new value of documentId
    +  60   + 
          */
     61   - 
          */
    -  62   
         public void setDocumentId(String documentId) {
    -  63  0 
             this.documentId = documentId;
    -  64  0 
         }
    +  62  0 
             this.documentId = documentId;
    +  63  0 
         }
    +  64   + 
     
     65   - 
     
    + 
         /**
     66   - 
         /**
    -  67   
          * Get the value of vendor.
    +  67   + 
          *
     68   - 
          *
    -  69   
          * @return the value of vendor
    +  69   + 
          */
     70   - 
          */
    -  71   
         public String getVendor() {
    -  72  3715 
             return vendor;
    +  71  7430 
             return vendor;
    +  72   + 
         }
     73   - 
         }
    + 
     
     74   - 
     
    + 
         /**
     75   - 
         /**
    -  76   
          * Set the value of vendor.
    +  76   + 
          *
     77   - 
          *
    -  78   
          * @param vendor new value of vendor
    +  78   + 
          */
     79   - 
          */
    -  80   
         public void setVendor(String vendor) {
    -  81  12040 
             this.vendor = vendor;
    -  82  12040 
         }
    +  80  24080 
             this.vendor = vendor;
    +  81  24080 
         }
    +  82   + 
         /**
     83   - 
         /**
    -  84   
          * The product name.
    +  84   + 
          */
     85   - 
          */
    -  86   
         private String product;
    +  86   + 
     
     87   - 
     
    + 
         /**
     88   - 
         /**
    -  89   
          * Get the value of product.
    +  89   + 
          *
     90   - 
          *
    -  91   
          * @return the value of product
    +  91   + 
          */
     92   - 
          */
    -  93   
         public String getProduct() {
    -  94  4351 
             return product;
    +  93  8702 
             return product;
    +  94   + 
         }
     95   - 
         }
    + 
     
     96   - 
     
    + 
         /**
     97   - 
         /**
    -  98   
          * Set the value of product.
    +  98   + 
          *
     99   - 
          *
    -  100   
          * @param product new value of product
    +  100   + 
          */
     101   - 
          */
    -  102   
         public void setProduct(String product) {
    -  103  12040 
             this.product = product;
    -  104  12040 
         }
    +  102  24080 
             this.product = product;
    +  103  24080 
         }
    +  104   + 
         /**
     105   - 
         /**
    -  106   
          * The search score.
    +  106   + 
          */
     107   - 
          */
    -  108   
         private float searchScore;
    +  108   + 
     
     109   - 
     
    + 
         /**
     110   - 
         /**
    -  111   
          * Get the value of searchScore.
    +  111   + 
          *
     112   - 
          *
    -  113   
          * @return the value of searchScore
    +  113   + 
          */
     114   - 
          */
    -  115   
         public float getSearchScore() {
    -  116  0 
             return searchScore;
    -  117   +  115  0 
             return searchScore;
    +  116   
         }
    +  117   + 
     
     118   - 
     
    + 
         /**
     119   - 
         /**
    -  120   
          * Set the value of searchScore.
    -  121   +  120   
          *
    -  122   +  121   
          * @param searchScore new value of searchScore
    -  123   +  122   
          */
    -  124   +  123   
         public void setSearchScore(float searchScore) {
    -  125  750 
             this.searchScore = searchScore;
    -  126  750 
         }
    -  127   +  124  1500 
             this.searchScore = searchScore;
    +  125  1500 
         }
    +  126   
     
    -  128   +  127   
         /**
    +  128   + 
          * <p>
     129   - 
          * <p>Parses a name attribute value, from the cpe.xml, into its
    + 
          * Parses a name attribute value, from the cpe.xml, into its corresponding parts: vendor, product.</p>
     130   - 
          * corresponding parts: vendor, product.</p>
    + 
          * <p>
     131   - 
          * <p>Example:</p>
    + 
          * Example:</p>
     132   
          * <code>nbsp;nbsp;nbsp;cpe:/a:apache:struts:1.1:rc2</code>
     133   
          *
     134   - 
          * <p>Results in:</p> <ul> <li>Vendor: apache</li> <li>Product: struts</li>
    + 
          * <p>
     135   - 
          * </ul>
    + 
          * Results in:</p> <ul> <li>Vendor: apache</li> <li>Product: struts</li>
     136   - 
          * <p>If it is necessary to parse the CPE into more parts (i.e. to include
    + 
          * </ul>
     137   - 
          * version and revision) then you should use the
    + 
          * <p>
     138   - 
          * {@link org.owasp.dependencycheck.dependency.VulnerableSoftware#parseName VulnerableSoftware.parseName()}.
    + 
          * If it is necessary to parse the CPE into more parts (i.e. to include version and revision) then you should use
     139   - 
          *
    + 
          * the {@link org.owasp.dependencycheck.dependency.VulnerableSoftware#parseName VulnerableSoftware.parseName()}.
     140   - 
          * @param cpeName the cpe name
    -  141   - 
          * @throws UnsupportedEncodingException should never be thrown...
    -  142   - 
          */
    -  143   - 
         public void parseName(String cpeName) throws UnsupportedEncodingException {
    -  144  1 
             if (cpeName != null && cpeName.length() > 7) {
    -  145  1 
                 final String[] data = cpeName.substring(7).split(":");
    -  146  1 
                 if (data.length >= 1) {
    -  147  1 
                     vendor = URLDecoder.decode(data[0].replace("+", "%2B"), "UTF-8");
    -  148  1 
                     if (data.length >= 2) {
    -  149  1 
                         product = URLDecoder.decode(data[1].replace("+", "%2B"), "UTF-8");
    -  150   - 
                     }
    -  151   - 
                 }
    -  152   - 
             }
    -  153  1 
         }
    -  154   - 
     
    -  155   - 
         @Override
    -  156   - 
         public int hashCode() {
    -  157  0 
             int hash = 7;
    -  158  0 
             hash = 97 * hash + (this.getDocumentId() != null ? this.getDocumentId().hashCode() : 0);
    -  159  0 
             return hash;
    -  160   - 
         }
    -  161   - 
     
    -  162   - 
         @Override
    -  163   - 
         public boolean equals(Object obj) {
    -  164  6397 
             if (obj == null) {
    -  165  0 
                 return false;
    -  166   - 
             }
    -  167  6397 
             if (getClass() != obj.getClass()) {
    -  168  0 
                 return false;
    -  169   - 
             }
    -  170  6397 
             final IndexEntry other = (IndexEntry) obj;
    -  171  6397 
             if ((this.vendor == null) ? (other.vendor != null) : !this.vendor.equals(other.vendor)) {
    -  172  5182 
                 return false;
    -  173   - 
             }
    -  174  1215 
             if ((this.product == null) ? (other.product != null) : !this.product.equals(other.product)) {
    -  175  1215 
                 return false;
    -  176   - 
             }
    -  177  0 
             return true;
    -  178   - 
         }
    -  179   - 
     
    -  180   - 
         /**
    -  181   - 
          * Standard implementation of toString showing vendor and product.
    -  182   
          *
    -  183   - 
          * @return the string representation of the object
    -  184   +  141   + 
          * @param cpeName the cpe name
    +  142   + 
          * @throws UnsupportedEncodingException should never be thrown...
    +  143   
          */
    -  185   +  144   + 
         public void parseName(String cpeName) throws UnsupportedEncodingException {
    +  145  2 
             if (cpeName != null && cpeName.length() > 7) {
    +  146  2 
                 final String[] data = cpeName.substring(7).split(":");
    +  147  2 
                 if (data.length >= 1) {
    +  148  2 
                     vendor = URLDecoder.decode(data[0].replace("+", "%2B"), "UTF-8");
    +  149  2 
                     if (data.length >= 2) {
    +  150  2 
                         product = URLDecoder.decode(data[1].replace("+", "%2B"), "UTF-8");
    +  151   + 
                     }
    +  152   + 
                 }
    +  153   + 
             }
    +  154  2 
         }
    +  155   + 
     
    +  156   
         @Override
    -  186   - 
         public String toString() {
    -  187  0 
             return "IndexEntry{" + "vendor=" + vendor + ", product=" + product + '}';
    -  188   +  157   + 
         public int hashCode() {
    +  158  0 
             int hash = 7;
    +  159  0 
             hash = 97 * hash + (this.getDocumentId() != null ? this.getDocumentId().hashCode() : 0);
    +  160  0 
             return hash;
    +  161   
         }
    +  162   + 
     
    +  163   + 
         @Override
    +  164   + 
         public boolean equals(Object obj) {
    +  165  12794 
             if (obj == null) {
    +  166  0 
                 return false;
    +  167   + 
             }
    +  168  12794 
             if (getClass() != obj.getClass()) {
    +  169  0 
                 return false;
    +  170   + 
             }
    +  171  12794 
             final IndexEntry other = (IndexEntry) obj;
    +  172  12794 
             if ((this.vendor == null) ? (other.vendor != null) : !this.vendor.equals(other.vendor)) {
    +  173  10082 
                 return false;
    +  174   + 
             }
    +  175  2712 
             if ((this.product == null) ? (other.product != null) : !this.product.equals(other.product)) {
    +  176  2712 
                 return false;
    +  177   + 
             }
    +  178  0 
             return true;
    +  179   + 
         }
    +  180   + 
     
    +  181   + 
         /**
    +  182   + 
          * Standard implementation of toString showing vendor and product.
    +  183   + 
          *
    +  184   + 
          * @return the string representation of the object
    +  185   + 
          */
    +  186   + 
         @Override
    +  187   + 
         public String toString() {
    +  188  0 
             return "IndexEntry{" + "vendor=" + vendor + ", product=" + product + '}';
     189   + 
         }
    +  190   
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.cpe.IndexException.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.cpe.IndexException.html index 2cd8c9c9f..85719261a 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.cpe.IndexException.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.cpe.IndexException.html @@ -24,127 +24,125 @@  3   
      *
     4   - 
      * Dependency-check-core is free software: you can redistribute it and/or modify it
    + 
      * Licensed under the Apache License, Version 2.0 (the "License");
     5   - 
      * under the terms of the GNU General Public License as published by the Free
    + 
      * you may not use this file except in compliance with the License.
     6   - 
      * Software Foundation, either version 3 of the License, or (at your option) any
    + 
      * You may obtain a copy of the License at
     7   - 
      * later version.
    + 
      *
     8   - 
      *
    + 
      *     http://www.apache.org/licenses/LICENSE-2.0
     9   - 
      * Dependency-check-core is distributed in the hope that it will be useful, but
    + 
      *
     10   - 
      * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
    + 
      * Unless required by applicable law or agreed to in writing, software
     11   - 
      * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
    + 
      * distributed under the License is distributed on an "AS IS" BASIS,
     12   - 
      * details.
    + 
      * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13   - 
      *
    + 
      * See the License for the specific language governing permissions and
     14   - 
      * You should have received a copy of the GNU General Public License along with
    + 
      * limitations under the License.
     15   - 
      * dependency-check-core. If not, see http://www.gnu.org/licenses/.
    + 
      *
     16   - 
      *
    -  17   
      * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
    +  17   + 
      */
     18   - 
      */
    -  19   
     package org.owasp.dependencycheck.data.cpe;
    +  19   + 
     
     20   - 
     
    -  21   
     /**
    -  22   +  21   
      * An exception thrown when the there is an issue using the in-memory CPE Index.
    -  23   +  22   
      *
    -  24   +  23   
      * @author Jeremy Long <jeremy.long@owasp.org>
    -  25   +  24   
      */
    -  26   +  25   
     public class IndexException extends Exception {
    +  26   + 
     
     27   - 
     
    + 
         /**
     28   - 
         /**
    -  29   
          * The serial version UID for serialization.
    +  29   + 
          */
     30   - 
          */
    -  31   
         private static final long serialVersionUID = 1L;
    +  31   + 
     
     32   - 
     
    + 
         /**
     33   - 
         /**
    + 
          * Creates a new IndexException.
     34   - 
          * Creates a new IndexException.
    + 
          */
     35   - 
          */
    -  36   
         public IndexException() {
    -  37  0 
             super();
    -  38  0 
         }
    +  36  0 
             super();
    +  37  0 
         }
    +  38   + 
     
     39   - 
     
    + 
         /**
     40   - 
         /**
    + 
          * Creates a new IndexException.
     41   - 
          * Creates a new IndexException.
    + 
          *
     42   - 
          *
    + 
          * @param msg a message for the exception.
     43   - 
          * @param msg a message for the exception.
    + 
          */
     44   - 
          */
    -  45   
         public IndexException(String msg) {
    -  46  0 
             super(msg);
    -  47  0 
         }
    +  45  0 
             super(msg);
    +  46  0 
         }
    +  47   + 
     
     48   - 
     
    + 
         /**
     49   - 
         /**
    + 
          * Creates a new IndexException.
     50   - 
          * Creates a new IndexException.
    + 
          *
     51   - 
          *
    + 
          * @param ex the cause of the failure.
     52   - 
          * @param ex the cause of the failure.
    + 
          */
     53   - 
          */
    -  54   
         public IndexException(Throwable ex) {
    -  55  0 
             super(ex);
    -  56  0 
         }
    -  57   +  54  0 
             super(ex);
    +  55  0 
         }
    +  56   
     
    -  58   +  57   
         /**
    -  59   +  58   
          * Creates a new IndexException.
    -  60   +  59   
          *
    -  61   +  60   
          * @param msg a message for the exception.
    -  62   +  61   
          * @param ex the cause of the failure.
    -  63   +  62   
          */
    -  64   +  63   
         public IndexException(String msg, Throwable ex) {
    -  65  0 
             super(msg, ex);
    -  66  0 
         }
    -  67   +  64  0 
             super(msg, ex);
    +  65  0 
         }
    +  66   
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.cwe.CweDB.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.cwe.CweDB.html index 5b47d5399..1ca7d124e 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.cwe.CweDB.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.cwe.CweDB.html @@ -24,131 +24,131 @@  3   
      *
     4   - 
      * Dependency-check-core is free software: you can redistribute it and/or modify it
    + 
      * Licensed under the Apache License, Version 2.0 (the "License");
     5   - 
      * under the terms of the GNU General Public License as published by the Free
    + 
      * you may not use this file except in compliance with the License.
     6   - 
      * Software Foundation, either version 3 of the License, or (at your option) any
    + 
      * You may obtain a copy of the License at
     7   - 
      * later version.
    + 
      *
     8   - 
      *
    + 
      *     http://www.apache.org/licenses/LICENSE-2.0
     9   - 
      * Dependency-check-core is distributed in the hope that it will be useful, but
    + 
      *
     10   - 
      * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
    + 
      * Unless required by applicable law or agreed to in writing, software
     11   - 
      * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
    + 
      * distributed under the License is distributed on an "AS IS" BASIS,
     12   - 
      * details.
    + 
      * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13   - 
      *
    + 
      * See the License for the specific language governing permissions and
     14   - 
      * You should have received a copy of the GNU General Public License along with
    + 
      * limitations under the License.
     15   - 
      * dependency-check-core. If not, see http://www.gnu.org/licenses/.
    + 
      *
     16   - 
      *
    -  17   
      * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
    +  17   + 
      */
     18   - 
      */
    -  19   
     package org.owasp.dependencycheck.data.cwe;
    +  19   + 
     
     20   - 
     
    -  21   
     import java.io.IOException;
    -  22   +  21   
     import java.io.InputStream;
    -  23   +  22   
     import java.io.ObjectInputStream;
    -  24   +  23   
     import java.util.HashMap;
    -  25   +  24   
     import java.util.logging.Level;
    -  26   +  25   
     import java.util.logging.Logger;
    +  26   + 
     
     27   - 
     
    -  28   
     /**
    -  29   +  28   
      *
    -  30   +  29   
      * @author Jeremy Long <jeremy.long@owasp.org>
    -  31   +  30   
      */
    -  32   +  31   
     public final class CweDB {
    +  32   + 
     
     33   - 
     
    + 
         /**
     34   - 
         /**
    -  35   
          * Empty private constructor as this is a utility class.
    -  36   +  35   
          */
    -  37  0 
         private CweDB() {
    -  38   +  36  0 
         private CweDB() {
    +  37   
             //empty
    -  39  0 
         }
    +  38  0 
         }
    +  39   + 
         /**
     40   - 
         /**
    -  41   
          * A HashMap of the CWE data.
    -  42   +  41   
          */
    -  43  1 
         private static final HashMap<String, String> CWE = loadData();
    +  42  2 
         private static final HashMap<String, String> CWE = loadData();
    +  43   + 
     
     44   - 
     
    + 
         /**
     45   - 
         /**
    -  46   
          * Loads a HashMap containing the CWE data from a resource found in the jar.
    -  47   +  46   
          *
    -  48   +  47   
          * @return a HashMap of CWE data
    -  49   +  48   
          */
    -  50   +  49   
         private static HashMap<String, String> loadData() {
    -  51  1 
             ObjectInputStream oin = null;
    -  52   +  50  2 
             ObjectInputStream oin = null;
    +  51   
             try {
    -  53  1 
                 final String filePath = "data/cwe.hashmap.serialized";
    -  54  1 
                 final InputStream input = CweDB.class.getClassLoader().getResourceAsStream(filePath);
    -  55  1 
                 oin = new ObjectInputStream(input);
    -  56  1 
                 return (HashMap<String, String>) oin.readObject();
    -  57  0 
             } catch (ClassNotFoundException ex) {
    -  58  0 
                 Logger.getLogger(CweDB.class.getName()).log(Level.WARNING, "Unable to load CWE data. This should not be an issue.");
    -  59  0 
                 Logger.getLogger(CweDB.class.getName()).log(Level.FINE, null, ex);
    -  60  0 
             } catch (IOException ex) {
    -  61  0 
                 Logger.getLogger(CweDB.class.getName()).log(Level.WARNING, "Unable to load CWE data due to an IO Error. This should not be an issue.");
    -  62  0 
                 Logger.getLogger(CweDB.class.getName()).log(Level.FINE, null, ex);
    -  63   +  52  2 
                 final String filePath = "data/cwe.hashmap.serialized";
    +  53  2 
                 final InputStream input = CweDB.class.getClassLoader().getResourceAsStream(filePath);
    +  54  2 
                 oin = new ObjectInputStream(input);
    +  55  2 
                 return (HashMap<String, String>) oin.readObject();
    +  56  0 
             } catch (ClassNotFoundException ex) {
    +  57  0 
                 Logger.getLogger(CweDB.class.getName()).log(Level.WARNING, "Unable to load CWE data. This should not be an issue.");
    +  58  0 
                 Logger.getLogger(CweDB.class.getName()).log(Level.FINE, null, ex);
    +  59  0 
             } catch (IOException ex) {
    +  60  0 
                 Logger.getLogger(CweDB.class.getName()).log(Level.WARNING, "Unable to load CWE data due to an IO Error. This should not be an issue.");
    +  61  0 
                 Logger.getLogger(CweDB.class.getName()).log(Level.FINE, null, ex);
    +  62   
             } finally {
    -  64  1 
                 if (oin != null) {
    -  65   +  63  2 
                 if (oin != null) {
    +  64   
                     try {
    -  66  1 
                         oin.close();
    -  67  0 
                     } catch (IOException ex) {
    -  68  0 
                         Logger.getLogger(CweDB.class.getName()).log(Level.FINEST, null, ex);
    -  69  2 
                     }
    -  70   +  65  2 
                         oin.close();
    +  66  0 
                     } catch (IOException ex) {
    +  67  0 
                         Logger.getLogger(CweDB.class.getName()).log(Level.FINEST, null, ex);
    +  68  4 
                     }
    +  69   
                 }
    -  71   +  70   
             }
    -  72  0 
             return null;
    -  73   +  71  0 
             return null;
    +  72   
         }
    -  74   +  73   
     
    -  75   +  74   
         /**
    +  75   + 
          * <p>
     76   - 
          * <p>Returns the full CWE name from the CWE ID.</p>
    + 
          * Returns the full CWE name from the CWE ID.</p>
     77   
          *
     78   @@ -159,8 +159,8 @@ 
          */
     81   
         public static String getCweName(String cweId) {
    -  82  51 
             if (cweId != null) {
    -  83  51 
                 return CWE.get(cweId);
    +  82  102 
             if (cweId != null) {
    +  83  102 
                 return CWE.get(cweId);
     84   
             }
     85  0 
             return null;
    @@ -170,6 +170,6 @@ 
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.cwe.CweHandler.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.cwe.CweHandler.html index da05278dc..b7d42473d 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.cwe.CweHandler.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.cwe.CweHandler.html @@ -24,105 +24,103 @@  3   
      *
     4   - 
      * Dependency-check-core is free software: you can redistribute it and/or modify it
    + 
      * Licensed under the Apache License, Version 2.0 (the "License");
     5   - 
      * under the terms of the GNU General Public License as published by the Free
    + 
      * you may not use this file except in compliance with the License.
     6   - 
      * Software Foundation, either version 3 of the License, or (at your option) any
    + 
      * You may obtain a copy of the License at
     7   - 
      * later version.
    + 
      *
     8   - 
      *
    + 
      *     http://www.apache.org/licenses/LICENSE-2.0
     9   - 
      * Dependency-check-core is distributed in the hope that it will be useful, but
    + 
      *
     10   - 
      * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
    + 
      * Unless required by applicable law or agreed to in writing, software
     11   - 
      * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
    + 
      * distributed under the License is distributed on an "AS IS" BASIS,
     12   - 
      * details.
    + 
      * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13   - 
      *
    + 
      * See the License for the specific language governing permissions and
     14   - 
      * You should have received a copy of the GNU General Public License along with
    + 
      * limitations under the License.
     15   - 
      * dependency-check-core. If not, see http://www.gnu.org/licenses/.
    + 
      *
     16   - 
      *
    -  17   
      * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
    +  17   + 
      */
     18   - 
      */
    -  19   
     package org.owasp.dependencycheck.data.cwe;
    +  19   + 
     
     20   - 
     
    -  21   
     import java.util.HashMap;
    -  22   +  21   
     import org.xml.sax.Attributes;
    -  23   +  22   
     import org.xml.sax.SAXException;
    -  24   +  23   
     import org.xml.sax.helpers.DefaultHandler;
    +  24   + 
     
     25   - 
     
    -  26   
     /**
    -  27   +  26   
      * A SAX Handler that will parse the CWE XML.
    -  28   +  27   
      *
    -  29   +  28   
      * @author Jeremy Long <jeremy.long@owasp.org>
    -  30   +  29   
      */
    -  31  0 
     public class CweHandler extends DefaultHandler {
    +  30  0 
     public class CweHandler extends DefaultHandler {
    +  31   + 
     
     32   - 
     
    + 
         /**
     33   - 
         /**
    -  34   
          * a HashMap containing the CWE data.
    -  35   +  34   
          */
    -  36  0 
         private final HashMap<String, String> cwe = new HashMap<String, String>();
    +  35  0 
         private final HashMap<String, String> cwe = new HashMap<String, String>();
    +  36   + 
     
     37   - 
     
    -  38   
         /**
    -  39   +  38   
          * Returns the HashMap of CWE entries (CWE-ID, Full CWE Name).
    -  40   +  39   
          *
    -  41   +  40   
          * @return a HashMap of CWE entries <String, String>
    -  42   +  41   
          */
    -  43   +  42   
         public HashMap<String, String> getCwe() {
    -  44  0 
             return cwe;
    -  45   +  43  0 
             return cwe;
    +  44   
         }
    +  45   + 
     
     46   - 
     
    -  47   
         @Override
    -  48   +  47   
         public void startElement(String uri, String localName, String qName, Attributes attributes) throws SAXException {
    -  49   +  48   
     
    -  50  0 
             if ("Weakness".equals(qName) || "Category".equals(qName)) {
    -  51  0 
                 final String id = "CWE-" + attributes.getValue("ID");
    -  52  0 
                 final String name = attributes.getValue("Name");
    -  53  0 
                 cwe.put(id, name);
    -  54   +  49  0 
             if ("Weakness".equals(qName) || "Category".equals(qName)) {
    +  50  0 
                 final String id = "CWE-" + attributes.getValue("ID");
    +  51  0 
                 final String name = attributes.getValue("Name");
    +  52  0 
                 cwe.put(id, name);
    +  53   
             }
    -  55  0 
         }
    -  56   +  54  0 
         }
    +  55   
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.AbstractTokenizingFilter.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.AbstractTokenizingFilter.html index 058fd45a3..6e7827f91 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.AbstractTokenizingFilter.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.AbstractTokenizingFilter.html @@ -24,159 +24,155 @@  3   
      *
     4   - 
      * Dependency-check-core is free software: you can redistribute it and/or modify it
    + 
      * Licensed under the Apache License, Version 2.0 (the "License");
     5   - 
      * under the terms of the GNU General Public License as published by the Free
    + 
      * you may not use this file except in compliance with the License.
     6   - 
      * Software Foundation, either version 3 of the License, or (at your option) any
    + 
      * You may obtain a copy of the License at
     7   - 
      * later version.
    + 
      *
     8   - 
      *
    + 
      *     http://www.apache.org/licenses/LICENSE-2.0
     9   - 
      * Dependency-check-core is distributed in the hope that it will be useful, but
    + 
      *
     10   - 
      * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
    + 
      * Unless required by applicable law or agreed to in writing, software
     11   - 
      * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
    + 
      * distributed under the License is distributed on an "AS IS" BASIS,
     12   - 
      * details.
    + 
      * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13   - 
      *
    + 
      * See the License for the specific language governing permissions and
     14   - 
      * You should have received a copy of the GNU General Public License along with
    + 
      * limitations under the License.
     15   - 
      * dependency-check-core. If not, see http://www.gnu.org/licenses/.
    + 
      *
     16   - 
      *
    -  17   
      * Copyright (c) 2013 Jeremy Long. All Rights Reserved.
    +  17   + 
      */
     18   - 
      */
    -  19   
     package org.owasp.dependencycheck.data.lucene;
    +  19   + 
     
     20   - 
     
    -  21   
     import java.util.LinkedList;
    -  22   +  21   
     import org.apache.lucene.analysis.TokenFilter;
    -  23   +  22   
     import org.apache.lucene.analysis.TokenStream;
    -  24   +  23   
     import org.apache.lucene.analysis.tokenattributes.CharTermAttribute;
    +  24   + 
     
     25   - 
     
    -  26   
     /**
    +  26   + 
      * An abstract tokenizing filter that can be used as the base for a tokenizing filter.
     27   - 
      * An abstract tokenizing filter that can be used as the base for a tokenizing
    -  28   - 
      * filter.
    -  29   
      *
    -  30   +  28   
      * @author Jeremy Long <jeremy.long@owasp.org>
    -  31   +  29   
      */
    -  32   +  30   
     public abstract class AbstractTokenizingFilter extends TokenFilter {
    +  31   + 
     
    +  32   + 
         /**
     33   - 
     
    -  34   - 
         /**
    -  35   
          * The char term attribute.
    +  34   + 
          */
    +  35  59 
         private final CharTermAttribute termAtt = addAttribute(CharTermAttribute.class);
     36   - 
          */
    -  37  31 
         private final CharTermAttribute termAtt = addAttribute(CharTermAttribute.class);
    + 
     
    +  37   + 
         /**
     38   - 
     
    -  39   - 
         /**
    -  40   
          * Gets the CharTermAttribute.
    -  41   +  39   
          *
    -  42   +  40   
          * @return the CharTermAttribute
    -  43   +  41   
          */
    -  44   +  42   
         protected CharTermAttribute getTermAtt() {
    -  45  38883 
             return termAtt;
    +  43  59792 
             return termAtt;
    +  44   + 
         }
    +  45   + 
         /**
     46   - 
         }
    -  47   - 
         /**
    -  48   
          * A collection of tokens to add to the stream.
    -  49   +  47   
          */
    -  50   +  48   
         private final LinkedList<String> tokens;
    +  49   + 
     
    +  50   + 
         /**
     51   - 
     
    -  52   - 
         /**
    -  53   
          * Gets the list of tokens.
    -  54   +  52   
          *
    -  55   +  53   
          * @return the list of tokens
    -  56   +  54   
          */
    -  57   +  55   
         protected LinkedList<String> getTokens() {
    -  58  38871 
             return tokens;
    +  56  59781 
             return tokens;
    +  57   + 
         }
    +  58   + 
     
     59   - 
         }
    + 
         /**
     60   - 
     
    -  61   - 
         /**
    -  62   
          * Constructs a new AbstractTokenizingFilter.
    -  63   +  61   
          *
    -  64   +  62   
          * @param stream the TokenStream that this filter will process
    -  65   +  63   
          */
    -  66   +  64   
         public AbstractTokenizingFilter(TokenStream stream) {
    -  67  31 
             super(stream);
    -  68  31 
             tokens = new LinkedList<String>();
    -  69  31 
         }
    -  70   +  65  59 
             super(stream);
    +  66  59 
             tokens = new LinkedList<String>();
    +  67  59 
         }
    +  68   
     
    -  71   +  69   
         /**
    -  72   +  70   
          * Adds a term, if one exists, from the tokens collection.
    -  73   +  71   
          *
    -  74   +  72   
          * @return whether or not a new term was added
    -  75   +  73   
          */
    -  76   +  74   
         protected boolean addTerm() {
    -  77  38807 
             final boolean termAdded = tokens.size() > 0;
    -  78  38807 
             if (termAdded) {
    -  79  23383 
                 final String term = tokens.pop();
    -  80  23346 
                 clearAttributes();
    -  81  23375 
                 termAtt.append(term);
    -  82   +  75  59660 
             final boolean termAdded = tokens.size() > 0;
    +  76  59668 
             if (termAdded) {
    +  77  34680 
                 final String term = tokens.pop();
    +  78  34678 
                 clearAttributes();
    +  79  34676 
                 termAtt.append(term);
    +  80   
             }
    -  83  38809 
             return termAdded;
    -  84   +  81  59614 
             return termAdded;
    +  82   
         }
    -  85   +  83   
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.AlphaNumericTokenizer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.AlphaNumericTokenizer.html index 1d5a8bad3..89e577a41 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.AlphaNumericTokenizer.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.AlphaNumericTokenizer.html @@ -24,124 +24,120 @@  3   
      *
     4   - 
      * Dependency-check-core is free software: you can redistribute it and/or modify it
    + 
      * Licensed under the Apache License, Version 2.0 (the "License");
     5   - 
      * under the terms of the GNU General Public License as published by the Free
    + 
      * you may not use this file except in compliance with the License.
     6   - 
      * Software Foundation, either version 3 of the License, or (at your option) any
    + 
      * You may obtain a copy of the License at
     7   - 
      * later version.
    + 
      *
     8   - 
      *
    + 
      *     http://www.apache.org/licenses/LICENSE-2.0
     9   - 
      * Dependency-check-core is distributed in the hope that it will be useful, but
    + 
      *
     10   - 
      * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
    + 
      * Unless required by applicable law or agreed to in writing, software
     11   - 
      * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
    + 
      * distributed under the License is distributed on an "AS IS" BASIS,
     12   - 
      * details.
    + 
      * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13   - 
      *
    + 
      * See the License for the specific language governing permissions and
     14   - 
      * You should have received a copy of the GNU General Public License along with
    + 
      * limitations under the License.
     15   - 
      * dependency-check-core. If not, see http://www.gnu.org/licenses/.
    + 
      *
     16   - 
      *
    -  17   
      * Copyright (c) 2013 Jeremy Long. All Rights Reserved.
    +  17   + 
      */
     18   - 
      */
    -  19   
     package org.owasp.dependencycheck.data.lucene;
    +  19   + 
     
     20   - 
     
    -  21   
     import java.io.Reader;
    -  22   +  21   
     import org.apache.lucene.analysis.util.CharTokenizer;
    -  23   +  22   
     import org.apache.lucene.util.Version;
    +  23   + 
     
     24   - 
     
    -  25   
     /**
    +  25   + 
      * Tokenizes the input breaking it into tokens when non-alpha/numeric characters are found.
     26   - 
      * Tokenizes the input breaking it into tokens when non-alpha/numeric characters
    -  27   - 
      * are found.
    -  28   
      *
    -  29   +  27   
      * @author Jeremy Long <jeremy.long@owasp.org>
    -  30   +  28   
      */
    -  31   +  29   
     public class AlphaNumericTokenizer extends CharTokenizer {
    +  30   + 
     
    +  31   + 
         /**
     32   - 
     
    + 
          * Constructs a new AlphaNumericTokenizer.
     33   - 
         /**
    + 
          *
     34   - 
          * Constructs a new AlphaNumericTokenizer.
    + 
          * @param matchVersion the lucene version
     35   - 
          *
    + 
          * @param in the Reader
     36   - 
          * @param matchVersion the lucene version
    + 
          */
     37   - 
          * @param in the Reader
    -  38   - 
          */
    -  39   
         public AlphaNumericTokenizer(Version matchVersion, Reader in) {
    -  40  47 
             super(matchVersion, in);
    -  41  47 
         }
    +  38  94 
             super(matchVersion, in);
    +  39  94 
         }
    +  40   + 
     
    +  41   + 
         /**
     42   - 
     
    -  43   - 
         /**
    -  44   
          * Constructs a new AlphaNumericTokenizer.
    -  45   +  43   
          *
    -  46   +  44   
          * @param matchVersion the lucene version
    -  47   +  45   
          * @param factory the AttributeFactory
    -  48   +  46   
          * @param in the Reader
    -  49   +  47   
          */
    -  50   +  48   
         public AlphaNumericTokenizer(Version matchVersion, AttributeFactory factory, Reader in) {
    -  51  0 
             super(matchVersion, factory, in);
    -  52  0 
         }
    -  53   +  49  0 
             super(matchVersion, factory, in);
    +  50  0 
         }
    +  51   
     
    -  54   +  52   
         /**
    -  55   +  53   
          * Determines if the char passed in is part of a token.
    -  56   +  54   
          *
    -  57   +  55   
          * @param c the char being analyzed
    -  58   +  56   
          * @return true if the char is a letter or digit, otherwise false
    -  59   +  57   
          */
    -  60   +  58   
         @Override
    -  61   +  59   
         protected boolean isTokenChar(int c) {
    -  62  5500690 
             return Character.isLetter(c) || Character.isDigit(c);
    -  63   +  60  11016450 
             return Character.isLetter(c) || Character.isDigit(c);
    +  61   
         }
    -  64   +  62   
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.DependencySimilarity.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.DependencySimilarity.html index 3545e3bb6..4e71588d2 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.DependencySimilarity.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.DependencySimilarity.html @@ -24,99 +24,93 @@  3   
      *
     4   - 
      * Dependency-check-core is free software: you can redistribute it and/or modify it
    + 
      * Licensed under the Apache License, Version 2.0 (the "License");
     5   - 
      * under the terms of the GNU General Public License as published by the Free
    + 
      * you may not use this file except in compliance with the License.
     6   - 
      * Software Foundation, either version 3 of the License, or (at your option) any
    + 
      * You may obtain a copy of the License at
     7   - 
      * later version.
    + 
      *
     8   - 
      *
    + 
      *     http://www.apache.org/licenses/LICENSE-2.0
     9   - 
      * Dependency-check-core is distributed in the hope that it will be useful, but
    + 
      *
     10   - 
      * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
    + 
      * Unless required by applicable law or agreed to in writing, software
     11   - 
      * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
    + 
      * distributed under the License is distributed on an "AS IS" BASIS,
     12   - 
      * details.
    + 
      * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13   - 
      *
    + 
      * See the License for the specific language governing permissions and
     14   - 
      * You should have received a copy of the GNU General Public License along with
    + 
      * limitations under the License.
     15   - 
      * dependency-check-core. If not, see http://www.gnu.org/licenses/.
    + 
      *
     16   - 
      *
    -  17   
      * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
    +  17   + 
      */
     18   - 
      */
    -  19   
     package org.owasp.dependencycheck.data.lucene;
    +  19   + 
     
     20   - 
     
    -  21   
     import org.apache.lucene.search.similarities.DefaultSimilarity;
    +  21   + 
     
     22   - 
     
    -  23   
     /**
    -  24   +  23   
      *
    -  25   +  24   
      * @author Jeremy Long <jeremy.long@owasp.org>
    -  26   +  25   
      */
    -  27  0 
     public class DependencySimilarity extends DefaultSimilarity {
    +  26  0 
     public class DependencySimilarity extends DefaultSimilarity {
    +  27   + 
     
     28   - 
     
    + 
         /**
     29   - 
         /**
    -  30   
          * the serial version uid.
    +  30   + 
          */
     31   - 
          */
    -  32   
         private static final long serialVersionUID = 1L;
    -  33   +  32   
     
    -  34   +  33   
         /**
    +  34   + 
          * <p>
     35   - 
          * <p>Override the default idf implementation so that frequency within all
    + 
          * Override the default idf implementation so that frequency within all document is ignored.</p>
     36   - 
          * document is ignored.</p>
    + 
          *
     37   - 
          *
    + 
          * See <a href="http://www.lucenetutorial.com/advanced-topics/scoring.html">this article</a> for more details.
     38   - 
          * See <a
    -  39   - 
          * href="http://www.lucenetutorial.com/advanced-topics/scoring.html">this
    -  40   - 
          * article</a> for more details.
    -  41   
          *
    -  42   +  39   
          * @param docFreq - the number of documents which contain the term
    -  43   +  40   
          * @param numDocs - the total number of documents in the collection
    -  44   +  41   
          * @return 1
    -  45   +  42   
          */
    -  46   +  43   
         @Override
    -  47   +  44   
         public float idf(long docFreq, long numDocs) {
    -  48  0 
             return 1;
    -  49   +  45  0 
             return 1;
    +  46   
         }
    -  50   +  47   
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.FieldAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.FieldAnalyzer.html index a858906c4..7af5ce3b1 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.FieldAnalyzer.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.FieldAnalyzer.html @@ -24,154 +24,152 @@  3   
      *
     4   - 
      * Dependency-check-core is free software: you can redistribute it and/or modify it
    + 
      * Licensed under the Apache License, Version 2.0 (the "License");
     5   - 
      * under the terms of the GNU General Public License as published by the Free
    + 
      * you may not use this file except in compliance with the License.
     6   - 
      * Software Foundation, either version 3 of the License, or (at your option) any
    + 
      * You may obtain a copy of the License at
     7   - 
      * later version.
    + 
      *
     8   - 
      *
    + 
      *     http://www.apache.org/licenses/LICENSE-2.0
     9   - 
      * Dependency-check-core is distributed in the hope that it will be useful, but
    + 
      *
     10   - 
      * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
    + 
      * Unless required by applicable law or agreed to in writing, software
     11   - 
      * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
    + 
      * distributed under the License is distributed on an "AS IS" BASIS,
     12   - 
      * details.
    + 
      * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13   - 
      *
    + 
      * See the License for the specific language governing permissions and
     14   - 
      * You should have received a copy of the GNU General Public License along with
    + 
      * limitations under the License.
     15   - 
      * dependency-check-core. If not, see http://www.gnu.org/licenses/.
    + 
      *
     16   - 
      *
    -  17   
      * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
    +  17   + 
      */
     18   - 
      */
    -  19   
     package org.owasp.dependencycheck.data.lucene;
    +  19   + 
     
     20   - 
     
    -  21   
     import java.io.Reader;
    -  22   +  21   
     import org.apache.lucene.analysis.Analyzer;
    -  23   +  22   
     import org.apache.lucene.analysis.TokenStream;
    -  24   +  23   
     import org.apache.lucene.analysis.Tokenizer;
    -  25   +  24   
     import org.apache.lucene.analysis.core.LowerCaseFilter;
    -  26   +  25   
     import org.apache.lucene.analysis.core.StopAnalyzer;
    -  27   +  26   
     import org.apache.lucene.analysis.core.StopFilter;
    -  28   +  27   
     import org.apache.lucene.analysis.miscellaneous.WordDelimiterFilter;
    -  29   +  28   
     import org.apache.lucene.util.Version;
    +  29   + 
     
     30   - 
     
    -  31   
     /**
    +  31   + 
      * <p>
     32   - 
      * <p>A Lucene Analyzer that utilizes the WhitespaceTokenizer,
    + 
      * A Lucene Analyzer that utilizes the WhitespaceTokenizer, WordDelimiterFilter, LowerCaseFilter, and StopFilter. The
     33   - 
      * WordDelimiterFilter, LowerCaseFilter, and StopFilter. The intended purpose of
    + 
      * intended purpose of this Analyzer is to index the CPE fields vendor and product.</p>
     34   - 
      * this Analyzer is to index the CPE fields vendor and product.</p>
    -  35   
      *
    -  36   +  35   
      * @author Jeremy Long <jeremy.long@owasp.org>
    -  37   +  36   
      */
    -  38   +  37   
     public class FieldAnalyzer extends Analyzer {
    +  38   + 
     
     39   - 
     
    + 
         /**
     40   - 
         /**
    -  41   
          * The Lucene Version used.
    +  41   + 
          */
     42   - 
          */
    -  43   
         private final Version version;
    +  43   + 
     
     44   - 
     
    + 
         /**
     45   - 
         /**
    -  46   
          * Creates a new FieldAnalyzer.
    +  46   + 
          *
     47   - 
          *
    -  48   
          * @param version the Lucene version
    -  49   +  48   
          */
    -  50  23 
         public FieldAnalyzer(Version version) {
    -  51  23 
             this.version = version;
    -  52  23 
         }
    +  49  46 
         public FieldAnalyzer(Version version) {
    +  50  46 
             this.version = version;
    +  51  46 
         }
    +  52   + 
     
     53   - 
     
    -  54   
         /**
    -  55   +  54   
          * Creates the TokenStreamComponents
    -  56   +  55   
          *
    -  57   +  56   
          * @param fieldName the field name being analyzed
    -  58   +  57   
          * @param reader the reader containing the input
    -  59   +  58   
          * @return the TokenStreamComponents
    -  60   +  59   
          */
    -  61   +  60   
         @Override
    -  62   +  61   
         protected TokenStreamComponents createComponents(String fieldName, Reader reader) {
    -  63  23 
             final Tokenizer source = new AlphaNumericTokenizer(version, reader);
    -  64   +  62  46 
             final Tokenizer source = new AlphaNumericTokenizer(version, reader);
    +  63   
     
    -  65  23 
             TokenStream stream = source;
    -  66   +  64  46 
             TokenStream stream = source;
    +  65   
     
    -  67  23 
             stream = new WordDelimiterFilter(stream,
    -  68   +  66  46 
             stream = new WordDelimiterFilter(stream,
    +  67   
                     WordDelimiterFilter.CATENATE_WORDS
    -  69   +  68   
                     | WordDelimiterFilter.GENERATE_WORD_PARTS
    -  70   +  69   
                     | WordDelimiterFilter.GENERATE_NUMBER_PARTS
    -  71   +  70   
                     | WordDelimiterFilter.PRESERVE_ORIGINAL
    -  72   +  71   
                     | WordDelimiterFilter.SPLIT_ON_CASE_CHANGE
    -  73   +  72   
                     | WordDelimiterFilter.SPLIT_ON_NUMERICS
    -  74   +  73   
                     | WordDelimiterFilter.STEM_ENGLISH_POSSESSIVE, null);
    -  75   +  74   
     
    -  76  23 
             stream = new LowerCaseFilter(version, stream);
    -  77  23 
             stream = new StopFilter(version, stream, StopAnalyzer.ENGLISH_STOP_WORDS_SET);
    -  78   +  75  46 
             stream = new LowerCaseFilter(version, stream);
    +  76  46 
             stream = new StopFilter(version, stream, StopAnalyzer.ENGLISH_STOP_WORDS_SET);
    +  77   
     
    -  79  23 
             return new TokenStreamComponents(source, stream);
    -  80   +  78  46 
             return new TokenStreamComponents(source, stream);
    +  79   
         }
    -  81   +  80   
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.LuceneUtils.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.LuceneUtils.html index 0c1c8f1b8..ba1efc1be 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.LuceneUtils.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.LuceneUtils.html @@ -24,205 +24,199 @@  3   
      *
     4   - 
      * Dependency-check-core is free software: you can redistribute it and/or modify it
    + 
      * Licensed under the Apache License, Version 2.0 (the "License");
     5   - 
      * under the terms of the GNU General Public License as published by the Free
    + 
      * you may not use this file except in compliance with the License.
     6   - 
      * Software Foundation, either version 3 of the License, or (at your option) any
    + 
      * You may obtain a copy of the License at
     7   - 
      * later version.
    + 
      *
     8   - 
      *
    + 
      *     http://www.apache.org/licenses/LICENSE-2.0
     9   - 
      * Dependency-check-core is distributed in the hope that it will be useful, but
    + 
      *
     10   - 
      * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
    + 
      * Unless required by applicable law or agreed to in writing, software
     11   - 
      * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
    + 
      * distributed under the License is distributed on an "AS IS" BASIS,
     12   - 
      * details.
    + 
      * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13   - 
      *
    + 
      * See the License for the specific language governing permissions and
     14   - 
      * You should have received a copy of the GNU General Public License along with
    + 
      * limitations under the License.
     15   - 
      * dependency-check-core. If not, see http://www.gnu.org/licenses/.
    + 
      *
     16   - 
      *
    -  17   
      * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
    +  17   + 
      */
     18   - 
      */
    -  19   
     package org.owasp.dependencycheck.data.lucene;
    +  19   + 
     
     20   - 
     
    -  21   
     import org.apache.lucene.util.Version;
    +  21   + 
     
     22   - 
     
    -  23   
     /**
    +  23   + 
      * <p>
     24   - 
      * <p>Lucene utils is a set of utilize written to make constructing Lucene
    + 
      * Lucene utils is a set of utilize written to make constructing Lucene queries simpler.</p>
     25   - 
      * queries simpler.</p>
    -  26   
      *
    -  27   +  26   
      * @author Jeremy Long <jeremy.long@owasp.org>
    -  28   +  27   
      */
    -  29   +  28   
     public final class LuceneUtils {
    +  29   + 
     
     30   - 
     
    + 
         /**
     31   - 
         /**
    + 
          * The current version of Lucene being used. Declaring this one place so an upgrade doesn't require hunting through
     32   - 
          * The current version of Lucene being used. Declaring this one place so an
    + 
          * the code base.
     33   - 
          * upgrade doesn't require hunting through the code base.
    -  34   
          */
    -  35  1 
         public static final Version CURRENT_VERSION = Version.LUCENE_45;
    +  34  2 
         public static final Version CURRENT_VERSION = Version.LUCENE_45;
    +  35   + 
     
     36   - 
     
    + 
         /**
     37   - 
         /**
    -  38   
          * Private constructor as this is a utility class.
    -  39   +  38   
          */
    -  40  0 
         private LuceneUtils() {
    -  41  0 
         }
    +  39  0 
         private LuceneUtils() {
    +  40  0 
         }
    +  41   + 
     
     42   - 
     
    + 
         /**
     43   - 
         /**
    + 
          * Appends the text to the supplied StringBuilder escaping Lucene control characters in the process.
     44   - 
          * Appends the text to the supplied StringBuilder escaping Lucene control
    + 
          *
     45   - 
          * characters in the process.
    -  46   - 
          *
    -  47   
          * @param buf a StringBuilder to append the escaped text to
    -  48   +  46   
          * @param text the data to be escaped
    -  49   +  47   
          */
    -  50   +  48   
         @SuppressWarnings("fallthrough")
    -  51   +  49   
         @edu.umd.cs.findbugs.annotations.SuppressWarnings(
    -  52   +  50   
                 value = "SF_SWITCH_NO_DEFAULT",
    -  53   +  51   
                 justification = "The switch below does have a default.")
    -  54   +  52   
         public static void appendEscapedLuceneQuery(StringBuilder buf,
    -  55   +  53   
                 final CharSequence text) {
    -  56   +  54   
     
    -  57  1158 
             if (text == null || buf == null) {
    -  58  1 
                 return;
    -  59   +  55  2328 
             if (text == null || buf == null) {
    +  56  2 
                 return;
    +  57   
             }
    -  60   +  58   
     
    -  61  11488 
             for (int i = 0; i < text.length(); i++) {
    -  62  10331 
                 final char c = text.charAt(i);
    -  63  10331 
                 switch (c) {
    -  64   +  59  23186 
             for (int i = 0; i < text.length(); i++) {
    +  60  20860 
                 final char c = text.charAt(i);
    +  61  20860 
                 switch (c) {
    +  62   
                     case '+':
    -  65   +  63   
                     case '-':
    -  66   +  64   
                     case '&':
    -  67   +  65   
                     case '|':
    -  68   +  66   
                     case '!':
    -  69   +  67   
                     case '(':
    -  70   +  68   
                     case ')':
    -  71   +  69   
                     case '{':
    -  72   +  70   
                     case '}':
    -  73   +  71   
                     case '[':
    -  74   +  72   
                     case ']':
    -  75   +  73   
                     case '^':
    -  76   +  74   
                     case '"':
    -  77   +  75   
                     case '~':
    -  78   +  76   
                     case '*':
    -  79   +  77   
                     case '?':
    -  80   +  78   
                     case ':':
    -  81   +  79   
                     case '\\': //it is supposed to fall through here
    -  82  226 
                         buf.append('\\');
    -  83   +  80  452 
                         buf.append('\\');
    +  81   
                     default:
    -  84  10331 
                         buf.append(c);
    -  85   +  82  20860 
                         buf.append(c);
    +  83   
                         break;
    -  86   +  84   
                 }
    +  85   + 
             }
    +  86  2326 
         }
     87   - 
             }
    -  88  1157 
         }
    -  89   
     
    -  90   +  88   
         /**
    -  91   - 
          * Escapes the text passed in so that it is treated as data instead of
    -  92   - 
          * control characters.
    -  93   +  89   + 
          * Escapes the text passed in so that it is treated as data instead of control characters.
    +  90   
          *
    -  94   +  91   
          * @param text data to be escaped
    -  95   +  92   
          * @return the escaped text.
    -  96   +  93   
          */
    -  97   +  94   
         public static String escapeLuceneQuery(final CharSequence text) {
    +  95   + 
     
    +  96  2246 
             if (text == null) {
    +  97  2 
                 return null;
     98   - 
     
    -  99  1117 
             if (text == null) {
    -  100  1 
                 return null;
    -  101   
             }
    -  102   +  99   
     
    -  103  1116 
             int size = text.length();
    -  104  1116 
             size = size >> 1;
    -  105  1116 
             final StringBuilder buf = new StringBuilder(size);
    -  106   +  100  2244 
             int size = text.length();
    +  101  2244 
             size = size >> 1;
    +  102  2244 
             final StringBuilder buf = new StringBuilder(size);
    +  103   
     
    -  107  1116 
             appendEscapedLuceneQuery(buf, text);
    -  108   +  104  2244 
             appendEscapedLuceneQuery(buf, text);
    +  105   
     
    -  109  1116 
             return buf.toString();
    -  110   +  106  2244 
             return buf.toString();
    +  107   
         }
    -  111   +  108   
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.SearchFieldAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.SearchFieldAnalyzer.html index 4d67e7f04..ddff1214b 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.SearchFieldAnalyzer.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.SearchFieldAnalyzer.html @@ -24,182 +24,182 @@  3   
      *
     4   - 
      * Dependency-check-core is free software: you can redistribute it and/or modify it
    + 
      * Licensed under the Apache License, Version 2.0 (the "License");
     5   - 
      * under the terms of the GNU General Public License as published by the Free
    + 
      * you may not use this file except in compliance with the License.
     6   - 
      * Software Foundation, either version 3 of the License, or (at your option) any
    + 
      * You may obtain a copy of the License at
     7   - 
      * later version.
    + 
      *
     8   - 
      *
    + 
      *     http://www.apache.org/licenses/LICENSE-2.0
     9   - 
      * Dependency-check-core is distributed in the hope that it will be useful, but
    + 
      *
     10   - 
      * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
    + 
      * Unless required by applicable law or agreed to in writing, software
     11   - 
      * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
    + 
      * distributed under the License is distributed on an "AS IS" BASIS,
     12   - 
      * details.
    + 
      * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13   - 
      *
    + 
      * See the License for the specific language governing permissions and
     14   - 
      * You should have received a copy of the GNU General Public License along with
    + 
      * limitations under the License.
     15   - 
      * dependency-check-core. If not, see http://www.gnu.org/licenses/.
    + 
      *
     16   - 
      *
    -  17   
      * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
    +  17   + 
      */
     18   - 
      */
    -  19   
     package org.owasp.dependencycheck.data.lucene;
    +  19   + 
     
     20   - 
     
    -  21   
     import java.io.Reader;
    -  22   +  21   
     import org.apache.lucene.analysis.Analyzer;
    -  23   +  22   
     import org.apache.lucene.analysis.TokenStream;
    -  24   +  23   
     import org.apache.lucene.analysis.Tokenizer;
    -  25   +  24   
     import org.apache.lucene.analysis.core.LowerCaseFilter;
    -  26   +  25   
     import org.apache.lucene.analysis.core.StopAnalyzer;
    -  27   +  26   
     import org.apache.lucene.analysis.core.StopFilter;
    -  28   +  27   
     import org.apache.lucene.analysis.miscellaneous.WordDelimiterFilter;
    -  29   +  28   
     import org.apache.lucene.util.Version;
    +  29   + 
     
     30   - 
     
    -  31   
     /**
    -  32   +  31   
      * A Lucene field analyzer used to analyzer queries against the CPE data.
    -  33   +  32   
      *
    -  34   +  33   
      * @author Jeremy Long <jeremy.long@owasp.org>
    -  35   +  34   
      */
    -  36   +  35   
     public class SearchFieldAnalyzer extends Analyzer {
    +  36   + 
     
     37   - 
     
    + 
         /**
     38   - 
         /**
    -  39   
          * The Lucene Version used.
    +  39   + 
          */
     40   - 
          */
    -  41   
         private final Version version;
    +  41   + 
         /**
     42   - 
         /**
    + 
          * A local reference to the TokenPairConcatenatingFilter so that we can clear any left over state if this analyzer
     43   - 
          * A local reference to the TokenPairConcatenatingFilter so that we can
    + 
          * is re-used.
     44   - 
          * clear any left over state if this analyzer is re-used.
    + 
          */
     45   - 
          */
    -  46   
         private TokenPairConcatenatingFilter concatenatingFilter;
    +  46   + 
     
     47   - 
     
    + 
         /**
     48   - 
         /**
    -  49   
          * Constructs a new SearchFieldAnalyzer.
    +  49   + 
          *
     50   - 
          *
    -  51   
          * @param version the Lucene version
    -  52   +  51   
          */
    -  53  24 
         public SearchFieldAnalyzer(Version version) {
    -  54  24 
             this.version = version;
    -  55  24 
         }
    +  52  48 
         public SearchFieldAnalyzer(Version version) {
    +  53  48 
             this.version = version;
    +  54  48 
         }
    +  55   + 
     
     56   - 
     
    + 
         /**
     57   - 
         /**
    -  58   
          * Creates a the TokenStreamComponents used to analyze the stream.
    -  59   +  58   
          *
    -  60   +  59   
          * @param fieldName the field that this lucene analyzer will process
    -  61   +  60   
          * @param reader a reader containing the tokens
    -  62   +  61   
          * @return the token stream filter chain
    -  63   +  62   
          */
    -  64   +  63   
         @Override
    -  65   +  64   
         protected TokenStreamComponents createComponents(String fieldName, Reader reader) {
    -  66  24 
             final Tokenizer source = new AlphaNumericTokenizer(version, reader);
    -  67   +  65  48 
             final Tokenizer source = new AlphaNumericTokenizer(version, reader);
    +  66   
     
    -  68  24 
             TokenStream stream = source;
    -  69   +  67  48 
             TokenStream stream = source;
    +  68   
     
    -  70  24 
             stream = new WordDelimiterFilter(stream,
    -  71   +  69  48 
             stream = new WordDelimiterFilter(stream,
    +  70   
                     WordDelimiterFilter.GENERATE_WORD_PARTS
    -  72   +  71   
                     | WordDelimiterFilter.GENERATE_NUMBER_PARTS
    -  73   +  72   
                     | WordDelimiterFilter.PRESERVE_ORIGINAL
    -  74   +  73   
                     | WordDelimiterFilter.SPLIT_ON_CASE_CHANGE
    -  75   +  74   
                     | WordDelimiterFilter.SPLIT_ON_NUMERICS
    -  76   +  75   
                     | WordDelimiterFilter.STEM_ENGLISH_POSSESSIVE, null);
    -  77   +  76   
     
    -  78  24 
             stream = new LowerCaseFilter(version, stream);
    -  79  24 
             stream = new UrlTokenizingFilter(stream);
    -  80  24 
             concatenatingFilter = new TokenPairConcatenatingFilter(stream);
    -  81  24 
             stream = concatenatingFilter;
    -  82  24 
             stream = new StopFilter(version, stream, StopAnalyzer.ENGLISH_STOP_WORDS_SET);
    -  83   +  77  48 
             stream = new LowerCaseFilter(version, stream);
    +  78  48 
             stream = new UrlTokenizingFilter(stream);
    +  79  48 
             concatenatingFilter = new TokenPairConcatenatingFilter(stream);
    +  80  48 
             stream = concatenatingFilter;
    +  81  48 
             stream = new StopFilter(version, stream, StopAnalyzer.ENGLISH_STOP_WORDS_SET);
    +  82   
     
    -  84  24 
             return new TokenStreamComponents(source, stream);
    -  85   +  83  48 
             return new TokenStreamComponents(source, stream);
    +  84   
         }
    -  86   +  85   
     
    -  87   +  86   
         /**
    +  87   + 
          * <p>
     88   - 
          * <p>Resets the analyzer and clears any internal state data that may have
    + 
          * Resets the analyzer and clears any internal state data that may have been left-over from previous uses of the
     89   - 
          * been left-over from previous uses of the analyzer.</p>
    + 
          * analyzer.</p>
     90   - 
          * <p><b>If this analyzer is re-used this method must be called between
    + 
          * <p>
     91   - 
          * uses.</b></p>
    + 
          * <b>If this analyzer is re-used this method must be called between uses.</b></p>
     92   
          */
     93   
         public void clear() {
    -  94  2 
             if (concatenatingFilter != null) {
    -  95  2 
                 concatenatingFilter.clear();
    +  94  4 
             if (concatenatingFilter != null) {
    +  95  4 
                 concatenatingFilter.clear();
     96   
             }
    -  97  2 
         }
    +  97  4 
         }
     98   
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.SearchVersionAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.SearchVersionAnalyzer.html index d4697c66e..273439850 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.SearchVersionAnalyzer.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.SearchVersionAnalyzer.html @@ -24,141 +24,137 @@  3   
      *
     4   - 
      * Dependency-check-core is free software: you can redistribute it and/or modify it
    + 
      * Licensed under the Apache License, Version 2.0 (the "License");
     5   - 
      * under the terms of the GNU General Public License as published by the Free
    + 
      * you may not use this file except in compliance with the License.
     6   - 
      * Software Foundation, either version 3 of the License, or (at your option) any
    + 
      * You may obtain a copy of the License at
     7   - 
      * later version.
    + 
      *
     8   - 
      *
    + 
      *     http://www.apache.org/licenses/LICENSE-2.0
     9   - 
      * Dependency-check-core is distributed in the hope that it will be useful, but
    + 
      *
     10   - 
      * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
    + 
      * Unless required by applicable law or agreed to in writing, software
     11   - 
      * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
    + 
      * distributed under the License is distributed on an "AS IS" BASIS,
     12   - 
      * details.
    + 
      * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13   - 
      *
    + 
      * See the License for the specific language governing permissions and
     14   - 
      * You should have received a copy of the GNU General Public License along with
    + 
      * limitations under the License.
     15   - 
      * dependency-check-core. If not, see http://www.gnu.org/licenses/.
    + 
      *
     16   - 
      *
    -  17   
      * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
    +  17   + 
      */
     18   - 
      */
    -  19   
     package org.owasp.dependencycheck.data.lucene;
    +  19   + 
     
     20   - 
     
    -  21   
     import java.io.Reader;
    -  22   +  21   
     import org.apache.lucene.analysis.Analyzer;
    -  23   +  22   
     import org.apache.lucene.analysis.TokenStream;
    -  24   +  23   
     import org.apache.lucene.analysis.Tokenizer;
    -  25   +  24   
     import org.apache.lucene.analysis.core.LowerCaseFilter;
    -  26   +  25   
     import org.apache.lucene.analysis.core.WhitespaceTokenizer;
    -  27   +  26   
     import org.apache.lucene.util.Version;
    +  27   + 
     
     28   - 
     
    -  29   
     /**
    +  29   + 
      * SearchVersionAnalyzer is a Lucene Analyzer used to analyze version information.
     30   - 
      * SearchVersionAnalyzer is a Lucene Analyzer used to analyze version
    -  31   - 
      * information.
    -  32   
      *
    -  33   +  31   
      * @author Jeremy Long <jeremy.long@owasp.org>
    -  34   +  32   
      * @deprecated version information is no longer stored in lucene
    -  35   +  33   
      */
    -  36   +  34   
     @Deprecated
    -  37   +  35   
     public class SearchVersionAnalyzer extends Analyzer {
    -  38   +  36   
         //TODO consider implementing payloads/custom attributes...
    -  39   +  37   
         // use custom attributes for major, minor, x, x, x, rcx
    -  40   +  38   
         // these can then be used to weight the score for searches on the version.
    -  41   +  39   
         // see http://lucene.apache.org/core/3_6_1/api/core/org/apache/lucene/analysis/package-summary.html#package_description
    -  42   +  40   
         // look at this article to implement
    -  43   +  41   
         // http://www.codewrecks.com/blog/index.php/2012/08/25/index-your-blog-using-tags-and-lucene-net/
    +  42   + 
     
    +  43   + 
         /**
     44   - 
     
    -  45   - 
         /**
    -  46   
          * The Lucene Version used.
    -  47   +  45   
          */
    -  48   +  46   
         private final Version version;
    +  47   + 
     
    +  48   + 
         /**
     49   - 
     
    -  50   - 
         /**
    -  51   
          * Creates a new SearchVersionAnalyzer.
    -  52   +  50   
          *
    -  53   +  51   
          * @param version the Lucene version
    -  54   +  52   
          */
    -  55  0 
         public SearchVersionAnalyzer(Version version) {
    -  56  0 
             this.version = version;
    -  57  0 
         }
    -  58   +  53  0 
         public SearchVersionAnalyzer(Version version) {
    +  54  0 
             this.version = version;
    +  55  0 
         }
    +  56   
     
    -  59   +  57   
         /**
    -  60   +  58   
          * Creates the TokenStreamComponents
    -  61   +  59   
          *
    -  62   +  60   
          * @param fieldName the field name being analyzed
    -  63   +  61   
          * @param reader the reader containing the input
    -  64   +  62   
          * @return the TokenStreamComponents
    -  65   +  63   
          */
    -  66   +  64   
         @Override
    -  67   +  65   
         protected TokenStreamComponents createComponents(String fieldName, Reader reader) {
    -  68  0 
             final Tokenizer source = new WhitespaceTokenizer(version, reader);
    -  69  0 
             TokenStream stream = source;
    -  70  0 
             stream = new LowerCaseFilter(version, stream);
    -  71  0 
             stream = new VersionTokenizingFilter(stream);
    -  72  0 
             return new TokenStreamComponents(source, stream);
    -  73   +  66  0 
             final Tokenizer source = new WhitespaceTokenizer(version, reader);
    +  67  0 
             TokenStream stream = source;
    +  68  0 
             stream = new LowerCaseFilter(version, stream);
    +  69  0 
             stream = new VersionTokenizingFilter(stream);
    +  70  0 
             return new TokenStreamComponents(source, stream);
    +  71   
         }
    -  74   +  72   
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.TokenPairConcatenatingFilter.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.TokenPairConcatenatingFilter.html index a2fe29262..51e8ac7b6 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.TokenPairConcatenatingFilter.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.TokenPairConcatenatingFilter.html @@ -24,225 +24,223 @@  3   
      *
     4   - 
      * Dependency-check-core is free software: you can redistribute it and/or modify it
    + 
      * Licensed under the Apache License, Version 2.0 (the "License");
     5   - 
      * under the terms of the GNU General Public License as published by the Free
    + 
      * you may not use this file except in compliance with the License.
     6   - 
      * Software Foundation, either version 3 of the License, or (at your option) any
    + 
      * You may obtain a copy of the License at
     7   - 
      * later version.
    + 
      *
     8   - 
      *
    + 
      *     http://www.apache.org/licenses/LICENSE-2.0
     9   - 
      * Dependency-check-core is distributed in the hope that it will be useful, but
    + 
      *
     10   - 
      * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
    + 
      * Unless required by applicable law or agreed to in writing, software
     11   - 
      * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
    + 
      * distributed under the License is distributed on an "AS IS" BASIS,
     12   - 
      * details.
    + 
      * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13   - 
      *
    + 
      * See the License for the specific language governing permissions and
     14   - 
      * You should have received a copy of the GNU General Public License along with
    + 
      * limitations under the License.
     15   - 
      * dependency-check-core. If not, see http://www.gnu.org/licenses/.
    + 
      *
     16   - 
      *
    -  17   
      * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
    +  17   + 
      */
     18   - 
      */
    -  19   
     package org.owasp.dependencycheck.data.lucene;
    +  19   + 
     
     20   - 
     
    -  21   
     import java.io.IOException;
    -  22   +  21   
     import java.util.LinkedList;
    -  23   +  22   
     import org.apache.lucene.analysis.TokenFilter;
    -  24   +  23   
     import org.apache.lucene.analysis.TokenStream;
    -  25   +  24   
     import org.apache.lucene.analysis.tokenattributes.CharTermAttribute;
    +  25   + 
     
     26   - 
     
    -  27   
     /**
    +  27   + 
      * <p>
     28   - 
      * <p>Takes a TokenStream and adds additional tokens by concatenating pairs of
    + 
      * Takes a TokenStream and adds additional tokens by concatenating pairs of words.</p>
     29   - 
      * words.</p>
    + 
      * <p>
     30   - 
      * <p><b>Example:</b> "Spring Framework Core" -> "Spring SpringFramework
    + 
      * <b>Example:</b> "Spring Framework Core" -> "Spring SpringFramework Framework FrameworkCore Core".</p>
     31   - 
      * Framework FrameworkCore Core".</p>
    -  32   
      *
    -  33   +  32   
      * @author Jeremy Long <jeremy.long@owasp.org>
    -  34   +  33   
      */
    -  35   +  34   
     public final class TokenPairConcatenatingFilter extends TokenFilter {
    +  35   + 
     
     36   - 
     
    + 
         /**
     37   - 
         /**
    -  38   
          * The char term attribute.
    -  39   +  38   
          */
    -  40  26 
         private final CharTermAttribute termAtt = addAttribute(CharTermAttribute.class);
    +  39  52 
         private final CharTermAttribute termAtt = addAttribute(CharTermAttribute.class);
    +  40   + 
         /**
     41   - 
         /**
    -  42   
          * The previous word parsed.
    +  42   + 
          */
     43   - 
          */
    -  44   
         private String previousWord;
    +  44   + 
         /**
     45   - 
         /**
    -  46   
          * A list of words parsed.
    +  46   + 
          */
     47   - 
          */
    -  48   
         private final LinkedList<String> words;
    +  48   + 
     
     49   - 
     
    + 
         /**
     50   - 
         /**
    -  51   
          * Returns the previous word. This is needed in the test cases.
    +  51   + 
          *
     52   - 
          *
    -  53   
          * @return te previous word
    +  53   + 
          */
     54   - 
          */
    -  55   
         protected String getPreviousWord() {
    -  56  2 
             return previousWord;
    +  55  4 
             return previousWord;
    +  56   + 
         }
     57   - 
         }
    + 
     
     58   - 
     
    + 
         /**
     59   - 
         /**
    -  60   
          * Returns the words list. This is needed in the test cases.
    +  60   + 
          *
     61   - 
          *
    -  62   
          * @return the words list
    +  62   + 
          */
     63   - 
          */
    -  64   
         protected LinkedList<String> getWords() {
    -  65  1 
             return words;
    +  64  2 
             return words;
    +  65   + 
         }
     66   - 
         }
    + 
     
     67   - 
     
    + 
         /**
     68   - 
         /**
    -  69   
          * Constructs a new TokenPairConcatenatingFilter.
    +  69   + 
          *
     70   - 
          *
    -  71   
          * @param stream the TokenStream that this filter will process
    +  71   + 
          */
     72   - 
          */
    -  73   
         public TokenPairConcatenatingFilter(TokenStream stream) {
    -  74  26 
             super(stream);
    -  75  26 
             words = new LinkedList<String>();
    -  76  26 
         }
    +  73  52 
             super(stream);
    +  74  52 
             words = new LinkedList<String>();
    +  75  52 
         }
    +  76   + 
     
     77   - 
     
    + 
         /**
     78   - 
         /**
    + 
          * Increments the underlying TokenStream and sets CharTermAttributes to construct an expanded set of tokens by
     79   - 
          * Increments the underlying TokenStream and sets CharTermAttributes to
    + 
          * concatenating tokens with the previous token.
     80   - 
          * construct an expanded set of tokens by concatenating tokens with the
    -  81   - 
          * previous token.
    -  82   
          *
    -  83   +  81   
          * @return whether or not we have hit the end of the TokenStream
    -  84   +  82   
          * @throws IOException is thrown when an IOException occurs
    -  85   +  83   
          */
    -  86   +  84   
         @Override
    -  87   +  85   
         public boolean incrementToken() throws IOException {
    -  88   +  86   
     
    -  89   +  87   
             //collect all the terms into the words collection
    -  90  7578 
             while (input.incrementToken()) {
    -  91  2130 
                 final String word = new String(termAtt.buffer(), 0, termAtt.length());
    -  92  2130 
                 words.add(word);
    -  93  2130 
             }
    -  94   +  88  15312 
             while (input.incrementToken()) {
    +  89  4308 
                 final String word = new String(termAtt.buffer(), 0, termAtt.length());
    +  90  4308 
                 words.add(word);
    +  91  4308 
             }
    +  92   
     
    -  95   +  93   
             //if we have a previousTerm - write it out as its own token concatenated
    -  96   +  94   
             // with the current word (if one is available).
    -  97  5448 
             if (previousWord != null && words.size() > 0) {
    -  98  2102 
                 final String word = words.getFirst();
    -  99  2102 
                 clearAttributes();
    -  100  2102 
                 termAtt.append(previousWord).append(word);
    -  101  2102 
                 previousWord = null;
    -  102  2102 
                 return true;
    -  103   +  95  11004 
             if (previousWord != null && words.size() > 0) {
    +  96  4252 
                 final String word = words.getFirst();
    +  97  4252 
                 clearAttributes();
    +  98  4252 
                 termAtt.append(previousWord).append(word);
    +  99  4252 
                 previousWord = null;
    +  100  4252 
                 return true;
    +  101   
             }
    -  104   +  102   
             //if we have words, write it out as a single token
    -  105  3346 
             if (words.size() > 0) {
    -  106  2130 
                 final String word = words.removeFirst();
    -  107  2130 
                 clearAttributes();
    -  108  2130 
                 termAtt.append(word);
    -  109  2130 
                 previousWord = word;
    -  110  2130 
                 return true;
    -  111   +  103  6752 
             if (words.size() > 0) {
    +  104  4308 
                 final String word = words.removeFirst();
    +  105  4308 
                 clearAttributes();
    +  106  4308 
                 termAtt.append(word);
    +  107  4308 
                 previousWord = word;
    +  108  4308 
                 return true;
    +  109   
             }
    -  112  1216 
             return false;
    -  113   +  110  2444 
             return false;
    +  111   
         }
    -  114   +  112   
     
    -  115   +  113   
         /**
    +  114   + 
          * <p>
    +  115   + 
          * Resets the Filter and clears any internal state data that may have been left-over from previous uses of the
     116   - 
          * <p>Resets the Filter and clears any internal state data that may have
    + 
          * Filter.</p>
     117   - 
          * been left-over from previous uses of the Filter.</p>
    + 
          * <p>
     118   - 
          * <p><b>If this Filter is re-used this method must be called between
    + 
          * <b>If this Filter is re-used this method must be called between uses.</b></p>
     119   - 
          * uses.</b></p>
    -  120   
          */
    -  121   +  120   
         public void clear() {
    -  122  3 
             previousWord = null;
    -  123  3 
             words.clear();
    -  124  3 
         }
    -  125   +  121  6 
             previousWord = null;
    +  122  6 
             words.clear();
    +  123  6 
         }
    +  124   
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.UrlTokenizingFilter.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.UrlTokenizingFilter.html index 5ae40d73d..bbf261e20 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.UrlTokenizingFilter.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.UrlTokenizingFilter.html @@ -24,151 +24,147 @@  3   
      *
     4   - 
      * Dependency-check-core is free software: you can redistribute it and/or modify it
    + 
      * Licensed under the Apache License, Version 2.0 (the "License");
     5   - 
      * under the terms of the GNU General Public License as published by the Free
    + 
      * you may not use this file except in compliance with the License.
     6   - 
      * Software Foundation, either version 3 of the License, or (at your option) any
    + 
      * You may obtain a copy of the License at
     7   - 
      * later version.
    + 
      *
     8   - 
      *
    + 
      *     http://www.apache.org/licenses/LICENSE-2.0
     9   - 
      * Dependency-check-core is distributed in the hope that it will be useful, but
    + 
      *
     10   - 
      * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
    + 
      * Unless required by applicable law or agreed to in writing, software
     11   - 
      * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
    + 
      * distributed under the License is distributed on an "AS IS" BASIS,
     12   - 
      * details.
    + 
      * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13   - 
      *
    + 
      * See the License for the specific language governing permissions and
     14   - 
      * You should have received a copy of the GNU General Public License along with
    + 
      * limitations under the License.
     15   - 
      * dependency-check-core. If not, see http://www.gnu.org/licenses/.
    + 
      *
     16   - 
      *
    -  17   
      * Copyright (c) 2013 Jeremy Long. All Rights Reserved.
    +  17   + 
      */
     18   - 
      */
    -  19   
     package org.owasp.dependencycheck.data.lucene;
    +  19   + 
     
     20   - 
     
    -  21   
     import java.io.IOException;
    -  22   +  21   
     import java.net.MalformedURLException;
    -  23   +  22   
     import java.util.LinkedList;
    -  24   +  23   
     import java.util.List;
    -  25   +  24   
     import java.util.logging.Level;
    -  26   +  25   
     import java.util.logging.Logger;
    -  27   +  26   
     import org.apache.lucene.analysis.TokenStream;
    -  28   +  27   
     import org.apache.lucene.analysis.tokenattributes.CharTermAttribute;
    -  29   +  28   
     import org.owasp.dependencycheck.utils.UrlStringUtils;
    +  29   + 
     
     30   - 
     
    -  31   
     /**
    +  31   + 
      * <p>
     32   - 
      * <p>Takes a TokenStream and splits or adds tokens to correctly index version
    + 
      * Takes a TokenStream and splits or adds tokens to correctly index version numbers.</p>
     33   - 
      * numbers.</p>
    + 
      * <p>
     34   - 
      * <p><b>Example:</b> "3.0.0.RELEASE" -> "3 3.0 3.0.0 RELEASE
    + 
      * <b>Example:</b> "3.0.0.RELEASE" -> "3 3.0 3.0.0 RELEASE 3.0.0.RELEASE".</p>
     35   - 
      * 3.0.0.RELEASE".</p>
    -  36   
      *
    -  37   +  36   
      * @author Jeremy Long <jeremy.long@owasp.org>
    -  38   +  37   
      */
    -  39   +  38   
     public final class UrlTokenizingFilter extends AbstractTokenizingFilter {
    +  39   + 
     
     40   - 
     
    + 
         /**
     41   - 
         /**
    -  42   
          * Constructs a new VersionTokenizingFilter.
    +  42   + 
          *
     43   - 
          *
    -  44   
          * @param stream the TokenStream that this filter will process
    +  44   + 
          */
     45   - 
          */
    -  46   
         public UrlTokenizingFilter(TokenStream stream) {
    -  47  31 
             super(stream);
    -  48  31 
         }
    -  49   +  46  59 
             super(stream);
    +  47  59 
         }
    +  48   
     
    -  50   +  49   
         /**
    +  50   + 
          * Increments the underlying TokenStream and sets CharTermAttributes to construct an expanded set of tokens by
     51   - 
          * Increments the underlying TokenStream and sets CharTermAttributes to
    + 
          * concatenating tokens with the previous token.
     52   - 
          * construct an expanded set of tokens by concatenating tokens with the
    -  53   - 
          * previous token.
    -  54   
          *
    -  55   +  53   
          * @return whether or not we have hit the end of the TokenStream
    -  56   +  54   
          * @throws IOException is thrown when an IOException occurs
    -  57   +  55   
          */
    -  58   +  56   
         @Override
    -  59   +  57   
         public boolean incrementToken() throws IOException {
    -  60  38863 
             final LinkedList<String> tokens = getTokens();
    -  61  38875 
             final CharTermAttribute termAtt = getTermAtt();
    -  62  38892 
             if (tokens.size() == 0 && input.incrementToken()) {
    -  63  23370 
                 final String text = new String(termAtt.buffer(), 0, termAtt.length());
    -  64  23376 
                 if (UrlStringUtils.containsUrl(text)) {
    -  65  2 
                     final String[] parts = text.split("\\s");
    -  66  4 
                     for (String part : parts) {
    -  67  2 
                         if (UrlStringUtils.isUrl(part)) {
    -  68   +  58  59772 
             final LinkedList<String> tokens = getTokens();
    +  59  59769 
             final CharTermAttribute termAtt = getTermAtt();
    +  60  59788 
             if (tokens.size() == 0 && input.incrementToken()) {
    +  61  34694 
                 final String text = new String(termAtt.buffer(), 0, termAtt.length());
    +  62  34696 
                 if (UrlStringUtils.containsUrl(text)) {
    +  63  4 
                     final String[] parts = text.split("\\s");
    +  64  8 
                     for (String part : parts) {
    +  65  4 
                         if (UrlStringUtils.isUrl(part)) {
    +  66   
                             try {
    -  69  2 
                                 final List<String> data = UrlStringUtils.extractImportantUrlData(part);
    -  70  2 
                                 tokens.addAll(data);
    -  71  0 
                             } catch (MalformedURLException ex) {
    -  72  0 
                                 Logger.getLogger(UrlTokenizingFilter.class.getName()).log(Level.INFO, "error parsing " + part, ex);
    -  73  0 
                                 tokens.add(part);
    -  74  2 
                             }
    -  75   +  67  4 
                                 final List<String> data = UrlStringUtils.extractImportantUrlData(part);
    +  68  4 
                                 tokens.addAll(data);
    +  69  0 
                             } catch (MalformedURLException ex) {
    +  70  0 
                                 Logger.getLogger(UrlTokenizingFilter.class.getName()).log(Level.INFO, "error parsing " + part, ex);
    +  71  0 
                                 tokens.add(part);
    +  72  4 
                             }
    +  73   
                         } else {
    -  76  0 
                             tokens.add(part);
    -  77   +  74  0 
                             tokens.add(part);
    +  75   
                         }
    -  78   +  76   
                     }
    -  79  2 
                 } else {
    -  80  23378 
                     tokens.add(text);
    -  81   +  77  4 
                 } else {
    +  78  34706 
                     tokens.add(text);
    +  79   
                 }
    -  82   +  80   
             }
    -  83  38801 
             return addTerm();
    -  84   +  81  59658 
             return addTerm();
    +  82   
         }
    -  85   +  83   
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.VersionAnalyzer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.VersionAnalyzer.html index 9f4a3fa4c..2a7ce0bf6 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.VersionAnalyzer.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.VersionAnalyzer.html @@ -24,138 +24,136 @@  3   
      *
     4   - 
      * Dependency-check-core is free software: you can redistribute it and/or modify it
    + 
      * Licensed under the Apache License, Version 2.0 (the "License");
     5   - 
      * under the terms of the GNU General Public License as published by the Free
    + 
      * you may not use this file except in compliance with the License.
     6   - 
      * Software Foundation, either version 3 of the License, or (at your option) any
    + 
      * You may obtain a copy of the License at
     7   - 
      * later version.
    + 
      *
     8   - 
      *
    + 
      *     http://www.apache.org/licenses/LICENSE-2.0
     9   - 
      * Dependency-check-core is distributed in the hope that it will be useful, but
    + 
      *
     10   - 
      * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
    + 
      * Unless required by applicable law or agreed to in writing, software
     11   - 
      * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
    + 
      * distributed under the License is distributed on an "AS IS" BASIS,
     12   - 
      * details.
    + 
      * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13   - 
      *
    + 
      * See the License for the specific language governing permissions and
     14   - 
      * You should have received a copy of the GNU General Public License along with
    + 
      * limitations under the License.
     15   - 
      * dependency-check-core. If not, see http://www.gnu.org/licenses/.
    + 
      *
     16   - 
      *
    -  17   
      * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
    +  17   + 
      */
     18   - 
      */
    -  19   
     package org.owasp.dependencycheck.data.lucene;
    +  19   + 
     
     20   - 
     
    -  21   
     import java.io.Reader;
    -  22   +  21   
     import org.apache.lucene.analysis.Analyzer;
    -  23   +  22   
     import org.apache.lucene.analysis.TokenStream;
    -  24   +  23   
     import org.apache.lucene.analysis.Tokenizer;
    -  25   +  24   
     import org.apache.lucene.analysis.core.LowerCaseFilter;
    -  26   +  25   
     import org.apache.lucene.analysis.core.WhitespaceTokenizer;
    -  27   +  26   
     import org.apache.lucene.util.Version;
    +  27   + 
     
     28   - 
     
    -  29   
     /**
    -  30   +  29   
      * VersionAnalyzer is a Lucene Analyzer used to analyze version information.
    -  31   +  30   
      *
    -  32   +  31   
      * @author Jeremy Long <jeremy.long@owasp.org>
    -  33   +  32   
      * @deprecated version information is no longer stored in lucene
    -  34   +  33   
      */
    -  35   +  34   
     @Deprecated
    -  36   +  35   
     public class VersionAnalyzer extends Analyzer {
    -  37   +  36   
         //TODO consider implementing payloads/custom attributes...
    -  38   +  37   
         // use custom attributes for major, minor, x, x, x, rcx
    -  39   +  38   
         // these can then be used to weight the score for searches on the version.
    -  40   +  39   
         // see http://lucene.apache.org/core/3_6_1/api/core/org/apache/lucene/analysis/package-summary.html#package_description
    -  41   +  40   
         // look at this article to implement
    -  42   +  41   
         // http://www.codewrecks.com/blog/index.php/2012/08/25/index-your-blog-using-tags-and-lucene-net/
    +  42   + 
     
     43   - 
     
    + 
         /**
     44   - 
         /**
    -  45   
          * The Lucene Version used.
    +  45   + 
          */
     46   - 
          */
    -  47   
         private final Version version;
    +  47   + 
     
     48   - 
     
    + 
         /**
     49   - 
         /**
    -  50   
          * Creates a new VersionAnalyzer.
    +  50   + 
          *
     51   - 
          *
    -  52   
          * @param version the Lucene version
    -  53   +  52   
          */
    -  54  0 
         public VersionAnalyzer(Version version) {
    -  55  0 
             this.version = version;
    -  56  0 
         }
    -  57   +  53  0 
         public VersionAnalyzer(Version version) {
    +  54  0 
             this.version = version;
    +  55  0 
         }
    +  56   
     
    -  58   +  57   
         /**
    -  59   +  58   
          * Creates the TokenStreamComponents
    -  60   +  59   
          *
    -  61   +  60   
          * @param fieldName the field name being analyzed
    -  62   +  61   
          * @param reader the reader containing the input
    -  63   +  62   
          * @return the TokenStreamComponents
    -  64   +  63   
          */
    -  65   +  64   
         @Override
    -  66   +  65   
         protected TokenStreamComponents createComponents(String fieldName, Reader reader) {
    -  67  0 
             final Tokenizer source = new WhitespaceTokenizer(version, reader);
    -  68  0 
             TokenStream stream = source;
    -  69  0 
             stream = new LowerCaseFilter(version, stream);
    -  70  0 
             return new TokenStreamComponents(source, stream);
    -  71   +  66  0 
             final Tokenizer source = new WhitespaceTokenizer(version, reader);
    +  67  0 
             TokenStream stream = source;
    +  68  0 
             stream = new LowerCaseFilter(version, stream);
    +  69  0 
             return new TokenStreamComponents(source, stream);
    +  70   
         }
    -  72   +  71   
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.VersionTokenizingFilter.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.VersionTokenizingFilter.html index 8922353aa..1e465a936 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.VersionTokenizingFilter.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.lucene.VersionTokenizingFilter.html @@ -24,179 +24,175 @@  3   
      *
     4   - 
      * Dependency-check-core is free software: you can redistribute it and/or modify it
    + 
      * Licensed under the Apache License, Version 2.0 (the "License");
     5   - 
      * under the terms of the GNU General Public License as published by the Free
    + 
      * you may not use this file except in compliance with the License.
     6   - 
      * Software Foundation, either version 3 of the License, or (at your option) any
    + 
      * You may obtain a copy of the License at
     7   - 
      * later version.
    + 
      *
     8   - 
      *
    + 
      *     http://www.apache.org/licenses/LICENSE-2.0
     9   - 
      * Dependency-check-core is distributed in the hope that it will be useful, but
    + 
      *
     10   - 
      * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
    + 
      * Unless required by applicable law or agreed to in writing, software
     11   - 
      * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
    + 
      * distributed under the License is distributed on an "AS IS" BASIS,
     12   - 
      * details.
    + 
      * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13   - 
      *
    + 
      * See the License for the specific language governing permissions and
     14   - 
      * You should have received a copy of the GNU General Public License along with
    + 
      * limitations under the License.
     15   - 
      * dependency-check-core. If not, see http://www.gnu.org/licenses/.
    + 
      *
     16   - 
      *
    -  17   
      * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
    +  17   + 
      */
     18   - 
      */
    -  19   
     package org.owasp.dependencycheck.data.lucene;
    +  19   + 
     
     20   - 
     
    -  21   
     import java.io.IOException;
    -  22   +  21   
     import java.util.LinkedList;
    -  23   +  22   
     import org.apache.lucene.analysis.TokenStream;
    -  24   +  23   
     import org.apache.lucene.analysis.tokenattributes.CharTermAttribute;
    +  24   + 
     
     25   - 
     
    -  26   
     /**
    +  26   + 
      * <p>
     27   - 
      * <p>Takes a TokenStream and splits or adds tokens to correctly index version
    + 
      * Takes a TokenStream and splits or adds tokens to correctly index version numbers.</p>
     28   - 
      * numbers.</p>
    + 
      * <p>
     29   - 
      * <p><b>Example:</b> "3.0.0.RELEASE" -> "3 3.0 3.0.0 RELEASE
    + 
      * <b>Example:</b> "3.0.0.RELEASE" -> "3 3.0 3.0.0 RELEASE 3.0.0.RELEASE".</p>
     30   - 
      * 3.0.0.RELEASE".</p>
    -  31   
      *
    -  32   +  31   
      * @author Jeremy Long <jeremy.long@owasp.org>
    -  33   +  32   
      * @deprecated version information is no longer stored in lucene
    -  34   +  33   
      */
    -  35   +  34   
     @Deprecated
    -  36   +  35   
     public final class VersionTokenizingFilter extends AbstractTokenizingFilter {
    +  36   + 
     
     37   - 
     
    + 
         /**
     38   - 
         /**
    -  39   
          * Constructs a new VersionTokenizingFilter.
    +  39   + 
          *
     40   - 
          *
    -  41   
          * @param stream the TokenStream that this filter will process
    +  41   + 
          */
     42   - 
          */
    -  43   
         public VersionTokenizingFilter(TokenStream stream) {
    -  44  0 
             super(stream);
    -  45  0 
         }
    +  43  0 
             super(stream);
    +  44  0 
         }
    +  45   + 
     
     46   - 
     
    + 
         /**
     47   - 
         /**
    + 
          * Increments the underlying TokenStream and sets CharTermAttributes to construct an expanded set of tokens by
     48   - 
          * Increments the underlying TokenStream and sets CharTermAttributes to
    + 
          * concatenating tokens with the previous token.
     49   - 
          * construct an expanded set of tokens by concatenating tokens with the
    -  50   - 
          * previous token.
    -  51   
          *
    -  52   +  50   
          * @return whether or not we have hit the end of the TokenStream
    -  53   +  51   
          * @throws IOException is thrown when an IOException occurs
    -  54   +  52   
          */
    -  55   +  53   
         @Override
    -  56   +  54   
         public boolean incrementToken() throws IOException {
    -  57  0 
             final LinkedList<String> tokens = getTokens();
    -  58  0 
             final CharTermAttribute termAtt = getTermAtt();
    -  59  0 
             if (tokens.size() == 0 && input.incrementToken()) {
    -  60  0 
                 final String version = new String(termAtt.buffer(), 0, termAtt.length());
    -  61  0 
                 final String[] toAnalyze = version.split("[_-]");
    -  62   +  55  0 
             final LinkedList<String> tokens = getTokens();
    +  56  0 
             final CharTermAttribute termAtt = getTermAtt();
    +  57  0 
             if (tokens.size() == 0 && input.incrementToken()) {
    +  58  0 
                 final String version = new String(termAtt.buffer(), 0, termAtt.length());
    +  59  0 
                 final String[] toAnalyze = version.split("[_-]");
    +  60   
                 //ensure we analyze the whole string as one too
    -  63  0 
                 analyzeVersion(version);
    -  64  0 
                 for (String str : toAnalyze) {
    -  65  0 
                     analyzeVersion(str);
    -  66   +  61  0 
                 analyzeVersion(version);
    +  62  0 
                 for (String str : toAnalyze) {
    +  63  0 
                     analyzeVersion(str);
    +  64   
                 }
    -  67   +  65   
             }
    -  68  0 
             return addTerm();
    -  69   +  66  0 
             return addTerm();
    +  67   
         }
    -  70   +  68   
     
    -  71   +  69   
         /**
    +  70   + 
          * <p>
    +  71   + 
          * Analyzes the version and adds several copies of the version as different tokens. For example, the version 1.2.7
     72   - 
          * <p>Analyzes the version and adds several copies of the version as
    + 
          * would create the tokens 1 1.2 1.2.7. This is useful in discovering the correct version - sometimes a maintenance
     73   - 
          * different tokens. For example, the version 1.2.7 would create the tokens
    + 
          * or build number will throw off the version identification.</p>
     74   - 
          * 1 1.2 1.2.7. This is useful in discovering the correct version -
    + 
          *
     75   - 
          * sometimes a maintenance or build number will throw off the version
    + 
          * <p>
     76   - 
          * identification.</p>
    + 
          * expected&nbsp;format:&nbps;major.minor[.maintenance[.build]]</p>
     77   
          *
     78   - 
          * <p>expected&nbsp;format:&nbps;major.minor[.maintenance[.build]]</p>
    -  79   - 
          *
    -  80   
          * @param version the version to analyze
    -  81   +  79   
          */
    -  82   +  80   
         private void analyzeVersion(String version) {
    -  83   +  81   
             //todo should we also be splitting on dash or underscore? we would need
    -  84   +  82   
             //  to incorporate the dash or underscore back in...
    -  85  0 
             final LinkedList<String> tokens = getTokens();
    -  86  0 
             final String[] versionParts = version.split("\\.");
    -  87  0 
             String dottedVersion = null;
    -  88  0 
             for (String current : versionParts) {
    -  89  0 
                 if (!current.matches("^/d+$")) {
    -  90  0 
                     tokens.add(current);
    -  91   +  83  0 
             final LinkedList<String> tokens = getTokens();
    +  84  0 
             final String[] versionParts = version.split("\\.");
    +  85  0 
             String dottedVersion = null;
    +  86  0 
             for (String current : versionParts) {
    +  87  0 
                 if (!current.matches("^/d+$")) {
    +  88  0 
                     tokens.add(current);
    +  89   
                 }
    -  92  0 
                 if (dottedVersion == null) {
    -  93  0 
                     dottedVersion = current;
    -  94   +  90  0 
                 if (dottedVersion == null) {
    +  91  0 
                     dottedVersion = current;
    +  92   
                 } else {
    -  95  0 
                     dottedVersion = dottedVersion + "." + current;
    -  96   +  93  0 
                     dottedVersion = dottedVersion + "." + current;
    +  94   
                 }
    -  97  0 
                 tokens.add(dottedVersion);
    -  98   +  95  0 
                 tokens.add(dottedVersion);
    +  96   
             }
    -  99  0 
         }
    -  100   +  97  0 
         }
    +  98   
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nexus.MavenArtifact.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nexus.MavenArtifact.html index ba3ee1a7e..6f53cdd38 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nexus.MavenArtifact.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nexus.MavenArtifact.html @@ -12,7 +12,7 @@
     
    - +
    Classes in this File Line Coverage Branch Coverage Complexity
    MavenArtifact
    0%
    0/23
    N/A
    N/A
    		1
    MavenArtifact
    73%
    19/26
    N/A
    N/A
    		1
     
    @@ -24,51 +24,51 @@  3   
      *
     4   - 
      * Dependency-check-core is free software: you can redistribute it and/or modify it
    + 
      * Licensed under the Apache License, Version 2.0 (the "License");
     5   - 
      * under the terms of the GNU General Public License as published by the Free
    + 
      * you may not use this file except in compliance with the License.
     6   - 
      * Software Foundation, either version 3 of the License, or (at your option) any
    + 
      * You may obtain a copy of the License at
     7   - 
      * later version.
    + 
      *
     8   - 
      *
    + 
      *     http://www.apache.org/licenses/LICENSE-2.0
     9   - 
      * Dependency-check-core is distributed in the hope that it will be useful, but
    + 
      *
     10   - 
      * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
    + 
      * Unless required by applicable law or agreed to in writing, software
     11   - 
      * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
    + 
      * distributed under the License is distributed on an "AS IS" BASIS,
     12   - 
      * details.
    + 
      * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13   - 
      *
    + 
      * See the License for the specific language governing permissions and
     14   - 
      * You should have received a copy of the GNU General Public License along with
    + 
      * limitations under the License.
     15   - 
      * dependency-check-core. If not, see http://www.gnu.org/licenses/.
    + 
      *
     16   - 
      *
    + 
      * Copyright (c) 2014 Jeremy Long. All Rights Reserved.
     17   - 
      * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
    + 
      */
     18   - 
      */
    -  19   
     package org.owasp.dependencycheck.data.nexus;
    -  20   +  19   
     
    -  21   +  20   
     /**
    -  22   +  21   
      * Simple bean representing a Maven Artifact.
    -  23   +  22   
      *
    -  24   +  23   
      * @author colezlaw
    -  25   +  24   
      */
    -  26   +  25   
     public class MavenArtifact {
    +  26   + 
     
     27   
         /**
     28   @@ -102,102 +102,101 @@  42   
         /**
     43   - 
          * The artifact url. This may change depending on which Nexus
    + 
          * The artifact url. This may change depending on which Nexus server the search took place.
     44   - 
          * server the search took place.
    + 
          */
     45   - 
          */
    -  46   
         private String artifactUrl;
    +  46   + 
     
     47   - 
     
    + 
         /**
     48   - 
     
    -  49   - 
         /**
    -  50   
          * Creates an empty MavenArtifact.
    -  51   +  49   
          */
    -  52  0 
         public MavenArtifact() {
    -  53  0 
         }
    +  50  0 
         public MavenArtifact() {
    +  51  0 
         }
    +  52   + 
     
    +  53   + 
         /**
     54   - 
     
    + 
          * Creates a MavenArtifact with the given attributes.
     55   - 
         /**
    + 
          *
     56   - 
          * Creates a MavenArtifact with the given attributes.
    + 
          * @param groupId the groupId
     57   - 
          *
    + 
          * @param artifactId the artifactId
     58   - 
          * @param groupId the groupId
    + 
          * @param version the version
     59   - 
          * @param artifactId the artifactId
    -  60   - 
          * @param version the version
    -  61   
          */
    -  62  0 
         public MavenArtifact(String groupId, String artifactId, String version) {
    -  63  0 
             setGroupId(groupId);
    -  64  0 
             setArtifactId(artifactId);
    -  65  0 
             setVersion(version);
    -  66  0 
         }
    +  60  0 
         public MavenArtifact(String groupId, String artifactId, String version) {
    +  61  0 
             setGroupId(groupId);
    +  62  0 
             setArtifactId(artifactId);
    +  63  0 
             setVersion(version);
    +  64  0 
         }
    +  65   + 
     
    +  66   + 
         /**
     67   - 
     
    -  68   - 
         /**
    -  69   
          * Creates a MavenArtifact with the given attributes.
    +  68   + 
          *
    +  69   + 
          * @param groupId the groupId
     70   - 
          *
    -  71   - 
          * @param groupId the groupId
    -  72   
          * @param artifactId the artifactId
    -  73   +  71   
          * @param version the version
    -  74   +  72   
          * @param url the artifactLink url
    -  75   +  73   
          */
    -  76  0 
         public MavenArtifact(String groupId, String artifactId, String version, String url) {
    -  77  0 
             setGroupId(groupId);
    -  78  0 
             setArtifactId(artifactId);
    -  79  0 
             setVersion(version);
    -  80  0 
             setArtifactUrl(url);
    -  81  0 
         }
    +  74  10 
         public MavenArtifact(String groupId, String artifactId, String version, String url) {
    +  75  10 
             setGroupId(groupId);
    +  76  10 
             setArtifactId(artifactId);
    +  77  10 
             setVersion(version);
    +  78  10 
             setArtifactUrl(url);
    +  79  10 
         }
    +  80   + 
     
    +  81   + 
         /**
     82   - 
     
    -  83   - 
         /**
    -  84   
          * Returns the Artifact coordinates as a String.
    -  85   +  83   
          *
    -  86   +  84   
          * @return the String representation of the artifact coordinates
    -  87   +  85   
          */
    -  88   +  86   
         @Override
    -  89   +  87   
         public String toString() {
    -  90  0 
             return String.format("%s:%s:%s", groupId, artifactId, version);
    -  91   +  88  10 
             return String.format("%s:%s:%s", groupId, artifactId, version);
    +  89   
         }
    -  92   +  90   
     
    -  93   +  91   
         /**
    -  94   +  92   
          * Sets the groupId.
    -  95   +  93   
          *
    -  96   +  94   
          * @param groupId the groupId
    -  97   +  95   
          */
    -  98  0 
         public void setGroupId(String groupId) { this.groupId = groupId; }
    +  96   + 
         public void setGroupId(String groupId) {
    +  97  10 
             this.groupId = groupId;
    +  98  10 
         }
     99   
     
     100   @@ -210,100 +209,118 @@ 
          * @return the groupId
     104   
          */
    -  105  0 
         public String getGroupId() { return groupId; }
    -  106   - 
     
    +  105   + 
         public String getGroupId() {
    +  106  30 
             return groupId;
     107   - 
         /**
    -  108   - 
          * Sets the artifactId.
    -  109   - 
          *
    -  110   - 
          * @param artifactId the artifactId
    -  111   - 
          */
    -  112  0 
         public void setArtifactId(String artifactId) { this.artifactId = artifactId; }
    -  113   - 
     
    -  114   - 
         /**
    -  115   - 
          * Gets the artifactId.
    -  116   - 
          *
    -  117   - 
          * @return the artifactId
    -  118   - 
          */
    -  119  0 
         public String getArtifactId() { return artifactId; }
    -  120   - 
     
    -  121   - 
         /**
    -  122   - 
          * Sets the version.
    -  123   - 
          *
    -  124   - 
          * @param version the version
    -  125   - 
          */
    -  126  0 
         public void setVersion(String version) { this.version = version; }
    -  127   - 
     
    -  128   - 
         /**
    -  129   - 
          * Gets the version.
    -  130   - 
          *
    -  131   - 
          * @return the version
    -  132   - 
          */
    -  133  0 
         public String getVersion() { return version; }
    -  134   - 
     
    -  135   - 
         /**
    -  136   - 
          * Sets the artifactUrl.
    -  137   - 
          *
    -  138   - 
          * @param artifactUrl the artifactUrl
    -  139   - 
          */
    -  140   - 
         public void setArtifactUrl(String artifactUrl) {
    -  141  0 
             this.artifactUrl = artifactUrl;
    -  142  0 
         }
    -  143   - 
     
    -  144   - 
         /**
    -  145   - 
          * Gets the artifactUrl.
    -  146   - 
          *
    -  147   - 
          * @return the artifactUrl
    -  148   - 
          */
    -  149   - 
         public String getArtifactUrl() {
    -  150  0 
             return artifactUrl;
    -  151   
         }
    -  152   - 
     }
    +  108   + 
     
    +  109   + 
         /**
    +  110   + 
          * Sets the artifactId.
    +  111   + 
          *
    +  112   + 
          * @param artifactId the artifactId
    +  113   + 
          */
    +  114   + 
         public void setArtifactId(String artifactId) {
    +  115  10 
             this.artifactId = artifactId;
    +  116  10 
         }
    +  117   + 
     
    +  118   + 
         /**
    +  119   + 
          * Gets the artifactId.
    +  120   + 
          *
    +  121   + 
          * @return the artifactId
    +  122   + 
          */
    +  123   + 
         public String getArtifactId() {
    +  124  30 
             return artifactId;
    +  125   + 
         }
    +  126   + 
     
    +  127   + 
         /**
    +  128   + 
          * Sets the version.
    +  129   + 
          *
    +  130   + 
          * @param version the version
    +  131   + 
          */
    +  132   + 
         public void setVersion(String version) {
    +  133  10 
             this.version = version;
    +  134  10 
         }
    +  135   + 
     
    +  136   + 
         /**
    +  137   + 
          * Gets the version.
    +  138   + 
          *
    +  139   + 
          * @return the version
    +  140   + 
          */
    +  141   + 
         public String getVersion() {
    +  142  30 
             return version;
    +  143   + 
         }
    +  144   + 
     
    +  145   + 
         /**
    +  146   + 
          * Sets the artifactUrl.
    +  147   + 
          *
    +  148   + 
          * @param artifactUrl the artifactUrl
    +  149   + 
          */
    +  150   + 
         public void setArtifactUrl(String artifactUrl) {
    +  151  10 
             this.artifactUrl = artifactUrl;
    +  152  10 
         }
     153   
     
     154   + 
         /**
    +  155   + 
          * Gets the artifactUrl.
    +  156   + 
          *
    +  157   + 
          * @return the artifactUrl
    +  158   + 
          */
    +  159   + 
         public String getArtifactUrl() {
    +  160  30 
             return artifactUrl;
    +  161   + 
         }
    +  162   + 
     }
    +  163   + 
     
    +  164   
     // vim: cc=120:sw=4:ts=4:sts=4
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nexus.NexusSearch.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nexus.NexusSearch.html index cd32e1674..cb77c2d92 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nexus.NexusSearch.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nexus.NexusSearch.html @@ -12,7 +12,7 @@
     
    - +
    Classes in this File Line Coverage Branch Coverage Complexity
    NexusSearch
    25%
    6/24
    75%
    3/4
    		5
    NexusSearch
    83%
    20/24
    100%
    4/4
    		5
     
    @@ -24,73 +24,73 @@  3   
      *
     4   - 
      * Dependency-check-core is free software: you can redistribute it and/or modify it
    + 
      * Licensed under the Apache License, Version 2.0 (the "License");
     5   - 
      * under the terms of the GNU General Public License as published by the Free
    + 
      * you may not use this file except in compliance with the License.
     6   - 
      * Software Foundation, either version 3 of the License, or (at your option) any
    + 
      * You may obtain a copy of the License at
     7   - 
      * later version.
    + 
      *
     8   - 
      *
    + 
      *     http://www.apache.org/licenses/LICENSE-2.0
     9   - 
      * Dependency-check-core is distributed in the hope that it will be useful, but
    + 
      *
     10   - 
      * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
    + 
      * Unless required by applicable law or agreed to in writing, software
     11   - 
      * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
    + 
      * distributed under the License is distributed on an "AS IS" BASIS,
     12   - 
      * details.
    + 
      * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13   - 
      *
    + 
      * See the License for the specific language governing permissions and
     14   - 
      * You should have received a copy of the GNU General Public License along with
    + 
      * limitations under the License.
     15   - 
      * dependency-check-core. If not, see http://www.gnu.org/licenses/.
    + 
      *
     16   - 
      *
    + 
      * Copyright (c) 2014 Jeremy Long. All Rights Reserved.
     17   - 
      * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
    + 
      */
     18   - 
      */
    -  19   
     package org.owasp.dependencycheck.data.nexus;
    +  19   + 
     
     20   - 
     
    -  21   
     import java.io.FileNotFoundException;
    -  22   +  21   
     import java.io.IOException;
    -  23   +  22   
     import java.net.URL;
    -  24   +  23   
     import java.net.URLConnection;
    -  25   +  24   
     import java.util.logging.Logger;
    -  26   +  25   
     import javax.xml.parsers.DocumentBuilder;
    -  27   +  26   
     import javax.xml.parsers.DocumentBuilderFactory;
    -  28   +  27   
     import javax.xml.xpath.XPath;
    -  29   +  28   
     import javax.xml.xpath.XPathFactory;
    -  30   +  29   
     import org.w3c.dom.Document;
    -  31   +  30   
     
    -  32   +  31   
     /**
    -  33   +  32   
      * Class of methods to search Nexus repositories.
    -  34   +  33   
      *
    -  35   +  34   
      * @author colezlaw
    -  36   +  35   
      */
    -  37   +  36   
     public class NexusSearch {
    +  37   + 
     
     38   
         /**
     39   @@ -107,7 +107,7 @@ 
          * Used for logging.
     45   
          */
    -  46  1 
         private static final Logger LOGGER = Logger.getLogger(NexusSearch.class.getName());
    +  46  2 
         private static final Logger LOGGER = Logger.getLogger(NexusSearch.class.getName());
     47   
     
     48   @@ -117,94 +117,92 @@  50   
          *
     51   - 
          * @param rootURL the root URL of the repository on which searches should execute.
    + 
          * @param rootURL the root URL of the repository on which searches should execute. full URL's are calculated
     52   - 
          *        full URL's are calculated relative to this URL, so it should end with a /
    + 
          * relative to this URL, so it should end with a /
     53   
          */
    -  54  2 
         public NexusSearch(URL rootURL) {
    -  55  2 
             this.rootURL = rootURL;
    -  56  2 
         }
    +  54  10 
         public NexusSearch(URL rootURL) {
    +  55  10 
             this.rootURL = rootURL;
    +  56  10 
         }
     57   
     
     58   
         /**
     59   - 
          * Searches the configured Nexus repository for the given sha1
    + 
          * Searches the configured Nexus repository for the given sha1 hash. If the artifact is found, a
     60   - 
          * hash. If the artifact is found, a <code>MavenArtifact</code> is populated
    + 
          * <code>MavenArtifact</code> is populated with the coordinate information.
     61   - 
          * with the coordinate information.
    -  62   
          *
    -  63   +  62   
          * @param sha1 The SHA-1 hash string for which to search
    -  64   +  63   
          * @return the populated Maven coordinates
    +  64   + 
          * @throws IOException if it's unable to connect to the specified repositor or if the specified artifact is not
     65   - 
          * @throws IOException if it's unable to connect to the specified repositor or
    + 
          * found.
     66   - 
          *         if the specified artifact is not found.
    -  67   
          */
    -  68   +  67   
         public MavenArtifact searchSha1(String sha1) throws IOException {
    -  69  2 
             if (null == sha1 || !sha1.matches("^[0-9A-Fa-f]{40}$")) {
    -  70  2 
                 throw new IllegalArgumentException("Invalid SHA1 format");
    +  68  14 
             if (null == sha1 || !sha1.matches("^[0-9A-Fa-f]{40}$")) {
    +  69  4 
                 throw new IllegalArgumentException("Invalid SHA1 format");
    +  70   + 
             }
     71   - 
             }
    -  72   
     
    -  73  0 
             final URL url = new URL(rootURL, String.format("identify/sha1/%s", sha1.toLowerCase()));
    -  74   +  72  10 
             final URL url = new URL(rootURL, String.format("identify/sha1/%s", sha1.toLowerCase()));
    +  73   
     
    -  75  0 
             LOGGER.fine(String.format("Searching Nexus url %s", url.toString()));
    -  76   +  74  10 
             LOGGER.fine(String.format("Searching Nexus url %s", url.toString()));
    +  75   + 
     
    +  76  10 
             final URLConnection conn = url.openConnection();
    +  77  10 
             conn.setDoOutput(true);
    +  78   
     
    -  77  0 
             final URLConnection conn = url.openConnection();
    -  78  0 
             conn.setDoOutput(true);
     79   - 
     
    -  80   
             // JSON would be more elegant, but there's not currently a dependency
    -  81   +  80   
             // on JSON, so don't want to add one just for this
    -  82  0 
             conn.addRequestProperty("Accept", "application/xml");
    -  83  0 
             conn.connect();
    +  81  10 
             conn.addRequestProperty("Accept", "application/xml");
    +  82  10 
             conn.connect();
    +  83   + 
     
     84   - 
     
    -  85   
             try {
    -  86  0 
                 final DocumentBuilder builder = DocumentBuilderFactory.newInstance().newDocumentBuilder();
    -  87  0 
                 final Document doc = builder.parse(conn.getInputStream());
    -  88  0 
                 final XPath xpath = XPathFactory.newInstance().newXPath();
    -  89  0 
                 final String groupId = xpath.evaluate("/org.sonatype.nexus.rest.model.NexusArtifact/groupId", doc);
    -  90  0 
                 final String artifactId = xpath.evaluate("/org.sonatype.nexus.rest.model.NexusArtifact/artifactId", doc);
    -  91  0 
                 final String version = xpath.evaluate("/org.sonatype.nexus.rest.model.NexusArtifact/version", doc);
    -  92  0 
                 final String link = xpath.evaluate("/org.sonatype.nexus.rest.model.NexusArtifact/artifactLink", doc);
    -  93  0 
                 return new MavenArtifact(groupId, artifactId, version, link);
    -  94  0 
             } catch (FileNotFoundException fnfe) {
    -  95   +  85  10 
                 final DocumentBuilder builder = DocumentBuilderFactory.newInstance().newDocumentBuilder();
    +  86  10 
                 final Document doc = builder.parse(conn.getInputStream());
    +  87  10 
                 final XPath xpath = XPathFactory.newInstance().newXPath();
    +  88  10 
                 final String groupId = xpath.evaluate("/org.sonatype.nexus.rest.model.NexusArtifact/groupId", doc);
    +  89  10 
                 final String artifactId = xpath.evaluate("/org.sonatype.nexus.rest.model.NexusArtifact/artifactId", doc);
    +  90  10 
                 final String version = xpath.evaluate("/org.sonatype.nexus.rest.model.NexusArtifact/version", doc);
    +  91  10 
                 final String link = xpath.evaluate("/org.sonatype.nexus.rest.model.NexusArtifact/artifactLink", doc);
    +  92  10 
                 return new MavenArtifact(groupId, artifactId, version, link);
    +  93  0 
             } catch (FileNotFoundException fnfe) {
    +  94   
                 // This is what we get when the SHA1 they sent doesn't exist in Nexus. This
    -  96   +  95   
                 // is useful upstream for recovery, so we just re-throw it
    -  97  0 
                 throw fnfe;
    -  98  0 
             } catch (Exception e) {
    -  99   +  96  0 
                 throw fnfe;
    +  97  0 
             } catch (Exception e) {
    +  98   
                 // Anything else is jacked-up XML stuff that we really can't recover from well
    -  100  0 
                 throw new IOException(e.getMessage(), e);
    -  101   +  99  0 
                 throw new IOException(e.getMessage(), e);
    +  100   
             }
    -  102   +  101   
         }
    -  103   +  102   
     }
    -  104   +  103   
     
    -  105   +  104   
     // vim: cc=120:sw=4:ts=4:sts=4
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.ConnectionFactory.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.ConnectionFactory.html index d108897f4..ad498c34b 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.ConnectionFactory.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.ConnectionFactory.html @@ -12,7 +12,7 @@
     
    - +
    Classes in this File Line Coverage Branch Coverage Complexity
    ConnectionFactory
    44%
    42/95
    34%
    9/26
    		5.286
    ConnectionFactory
    47%
    48/101
    38%
    10/26
    		5.571
     
    @@ -24,382 +24,390 @@  3   
      *
     4   - 
      * Dependency-check-core is free software: you can redistribute it and/or modify it
    + 
      * Licensed under the Apache License, Version 2.0 (the "License");
     5   - 
      * under the terms of the GNU General Public License as published by the Free
    + 
      * you may not use this file except in compliance with the License.
     6   - 
      * Software Foundation, either version 3 of the License, or (at your option) any
    + 
      * You may obtain a copy of the License at
     7   - 
      * later version.
    + 
      *
     8   - 
      *
    + 
      *     http://www.apache.org/licenses/LICENSE-2.0
     9   - 
      * Dependency-check-core is distributed in the hope that it will be useful, but
    + 
      *
     10   - 
      * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
    + 
      * Unless required by applicable law or agreed to in writing, software
     11   - 
      * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
    + 
      * distributed under the License is distributed on an "AS IS" BASIS,
     12   - 
      * details.
    + 
      * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13   - 
      *
    + 
      * See the License for the specific language governing permissions and
     14   - 
      * You should have received a copy of the GNU General Public License along with
    + 
      * limitations under the License.
     15   - 
      * dependency-check-core. If not, see http://www.gnu.org/licenses/.
    + 
      *
     16   - 
      *
    -  17   
      * Copyright (c) 2014 Jeremy Long. All Rights Reserved.
    +  17   + 
      */
     18   - 
      */
    -  19   
     package org.owasp.dependencycheck.data.nvdcve;
    +  19   + 
     
     20   - 
     
    -  21   
     import java.io.BufferedReader;
    -  22   +  21   
     import java.io.File;
    -  23   +  22   
     import java.io.IOException;
    -  24   +  23   
     import java.io.InputStream;
    -  25   +  24   
     import java.io.InputStreamReader;
    -  26   +  25   
     import java.sql.CallableStatement;
    -  27   +  26   
     import java.sql.Connection;
    -  28   +  27   
     import java.sql.DriverManager;
    -  29   +  28   
     import java.sql.ResultSet;
    -  30   +  29   
     import java.sql.SQLException;
    -  31   +  30   
     import java.sql.Statement;
    -  32   +  31   
     import java.util.logging.Level;
    -  33   +  32   
     import java.util.logging.Logger;
    -  34   +  33   
     import org.owasp.dependencycheck.utils.DBUtils;
    -  35   +  34   
     import org.owasp.dependencycheck.utils.Settings;
    +  35   + 
     
     36   - 
     
    -  37   
     /**
    -  38   +  37   
      * Loads the configured database driver and returns the database connection. If the embedded H2 database is used
    -  39   +  38   
      * obtaining a connection will ensure the database file exists and that the appropriate table structure has been
    -  40   +  39   
      * created.
    -  41   +  40   
      *
    -  42   +  41   
      * @author Jeremy Long <jeremy.long@owasp.org>
    -  43   +  42   
      */
    -  44   +  43   
     public final class ConnectionFactory {
    +  44   + 
     
     45   - 
     
    + 
         /**
     46   - 
         /**
    -  47   
          * The version of the current DB Schema.
    +  47   + 
          */
     48   - 
          */
    + 
         public static final String DB_SCHEMA_VERSION = "2.9";
     49   - 
         public static final String DB_SCHEMA_VERSION = "2.8";
    + 
         /**
     50   - 
         /**
    -  51   
          * Resource location for SQL file used to create the database schema.
    +  51   + 
          */
     52   - 
          */
    -  53   
         public static final String DB_STRUCTURE_RESOURCE = "data/initialize.sql";
    +  53   + 
     
     54   - 
     
    + 
         /**
     55   - 
         /**
    -  56   
          * Private constructor for this factory class; no instance is ever needed.
    -  57   +  56   
          */
    -  58  0 
         private ConnectionFactory() {
    -  59  0 
         }
    +  57  0 
         private ConnectionFactory() {
    +  58  0 
         }
    +  59   + 
     
     60   - 
     
    + 
         /**
     61   - 
         /**
    -  62   
          * Constructs a new database connection object per the database configuration. This will load the appropriate
    -  63   +  62   
          * database driver, via the DriverManager, if configured.
    +  63   + 
          *
     64   - 
          *
    -  65   
          * @return a database connection object
    -  66   +  65   
          * @throws DatabaseException thrown if there is an exception loading the database connection
    +  66   + 
          */
     67   - 
          */
    -  68   
         public static Connection getConnection() throws DatabaseException {
    -  69  48 
             Connection conn = null;
    -  70   +  68  108 
             Connection conn = null;
    +  69   
             try {
    -  71  48 
                 Logger.getLogger(CveDB.class.getName()).log(Level.FINE, "Loading database connection");
    -  72   +  70  108 
                 Logger.getLogger(CveDB.class.getName()).log(Level.FINE, "Loading database connection");
    +  71   
     
    -  73  48 
                 final String connStr = getConnectionString();
    -  74  48 
                 final String user = Settings.getString(Settings.KEYS.DB_USER, "dcuser");
    -  75   +  72  108 
                 final String connStr = getConnectionString();
    +  73  108 
                 final String user = Settings.getString(Settings.KEYS.DB_USER, "dcuser");
    +  74   
                 //yes, yes - hard-coded password - only if there isn't one in the properties file.
    -  76  48 
                 final String pass = Settings.getString(Settings.KEYS.DB_PASSWORD, "DC-Pass1337!");
    -  77  48 
                 Logger.getLogger(CveDB.class.getName()).log(Level.FINE, "Connection String: {0}", connStr);
    -  78  48 
                 Logger.getLogger(CveDB.class.getName()).log(Level.FINE, "Database User: {0}", user);
    -  79  48 
                 boolean createTables = false;
    -  80  48 
                 if (connStr.startsWith("jdbc:h2:file:")) { //H2
    -  81  48 
                     createTables = needToCreateDatabaseStructure();
    -  82  48 
                     Logger.getLogger(CveDB.class.getName()).log(Level.FINE, "Need to create DB Structure: {0}", createTables);
    -  83   +  75  108 
                 final String pass = Settings.getString(Settings.KEYS.DB_PASSWORD, "DC-Pass1337!");
    +  76  108 
                 Logger.getLogger(CveDB.class.getName()).log(Level.FINE, "Connection String: {0}", connStr);
    +  77  108 
                 Logger.getLogger(CveDB.class.getName()).log(Level.FINE, "Database User: {0}", user);
    +  78  108 
                 boolean createTables = false;
    +  79  108 
                 if (connStr.startsWith("jdbc:h2:file:")) { //H2
    +  80  108 
                     createTables = needToCreateDatabaseStructure();
    +  81  108 
                     Logger.getLogger(CveDB.class.getName()).log(Level.FINE, "Need to create DB Structure: {0}", createTables);
    +  82   
                 }
    -  84  48 
                 final String driverName = Settings.getString(Settings.KEYS.DB_DRIVER_NAME, "");
    -  85  48 
                 if (!driverName.isEmpty()) { //likely need to load the correct driver
    -  86  0 
                     Logger.getLogger(CveDB.class.getName()).log(Level.FINE, "Loading driver: {0}", driverName);
    -  87  0 
                     final String driverPath = Settings.getString(Settings.KEYS.DB_DRIVER_PATH, "");
    -  88  0 
                     if (!driverPath.isEmpty()) { //ugh, driver is not on classpath?
    -  89  0 
                         Logger.getLogger(CveDB.class.getName()).log(Level.FINE, "Loading driver from: {0}", driverPath);
    -  90  0 
                         DriverLoader.load(driverName, driverPath);
    -  91   +  83  108 
                 final String driverName = Settings.getString(Settings.KEYS.DB_DRIVER_NAME, "");
    +  84  108 
                 if (!driverName.isEmpty()) { //likely need to load the correct driver
    +  85  108 
                     Logger.getLogger(CveDB.class.getName()).log(Level.FINE, "Loading driver: {0}", driverName);
    +  86  108 
                     final String driverPath = Settings.getString(Settings.KEYS.DB_DRIVER_PATH, "");
    +  87  108 
                     if (!driverPath.isEmpty()) { //ugh, driver is not on classpath?
    +  88  0 
                         Logger.getLogger(CveDB.class.getName()).log(Level.FINE, "Loading driver from: {0}", driverPath);
    +  89  0 
                         DriverLoader.load(driverName, driverPath);
    +  90   
                     } else {
    -  92  0 
                         DriverLoader.load(driverName);
    +  91  108 
                         DriverLoader.load(driverName);
    +  92   + 
                     }
     93   - 
                     }
    + 
                 }
     94   - 
                 }
    + 
     
     95   - 
     
    -  96   
                 //JDBC4 drivers don't need this call.
    -  97   +  96   
                 //Class.forName("org.h2.Driver");
    -  98  48 
                 conn = DriverManager.getConnection(connStr, user, pass);
    -  99  48 
                 if (createTables) {
    -  100  0 
                     createTables(conn);
    -  101   - 
                 } else {
    -  102  48 
                     ensureSchemaVersion(conn);
    -  103   - 
                 }
    -  104  0 
             } catch (IOException ex) {
    -  105  0 
                 Logger.getLogger(ConnectionFactory.class.getName()).log(Level.FINE, null, ex);
    -  106  0 
                 throw new DatabaseException("Unable to load database");
    -  107  0 
             } catch (DriverLoadException ex) {
    -  108  0 
                 Logger.getLogger(ConnectionFactory.class.getName()).log(Level.FINE, null, ex);
    -  109  0 
                 throw new DatabaseException("Unable to load database driver");
    -  110  0 
             } catch (SQLException ex) {
    -  111  0 
                 Logger.getLogger(ConnectionFactory.class.getName()).log(Level.FINE, null, ex);
    -  112  0 
                 throw new DatabaseException("Unable to connect to the database");
    -  113  0 
             } catch (DatabaseException ex) {
    -  114  0 
                 Logger.getLogger(ConnectionFactory.class.getName()).log(Level.FINE, null, ex);
    -  115  0 
                 throw new DatabaseException("Unable to create the database structure");
    -  116  48 
             }
    -  117  48 
             return conn;
    -  118   - 
         }
    -  119   - 
     
    -  120   - 
         /**
    -  121   - 
          * Returns the configured connection string. If using the embedded H2 database this function will also ensure the
    -  122   - 
          * data directory exists and if not create it.
    -  123   - 
          *
    -  124   - 
          * @return the connection string
    -  125   - 
          * @throws IOException thrown the data directory cannot be created
    -  126   - 
          */
    -  127   - 
         private static String getConnectionString() throws IOException {
    -  128  48 
             final String connStr = Settings.getString(Settings.KEYS.DB_CONNECTION_STRING, "jdbc:h2:file:%s;AUTO_SERVER=TRUE");
    -  129  48 
             if (connStr.contains("%s")) {
    -  130  48 
                 final String fileName = getDataDirectory().getCanonicalPath();
    -  131  48 
                 final File file = new File(fileName, "cve." + DB_SCHEMA_VERSION);
    -  132  48 
                 return String.format(connStr, file.getAbsolutePath());
    -  133   - 
             }
    -  134  0 
             return connStr;
    -  135   - 
         }
    -  136   - 
     
    -  137   - 
         /**
    -  138   - 
          * Retrieves the directory that the JAR file exists in so that we can ensure we always use a common data directory
    -  139   - 
          * for the embedded H2 database. This is public solely for some unit tests; otherwise this should be private.
    -  140   - 
          *
    -  141   - 
          * @return the data directory to store data files
    -  142   - 
          * @throws IOException is thrown if an IOException occurs of course...
    -  143   - 
          */
    -  144   - 
         public static File getDataDirectory() throws IOException {
    -  145  96 
             final File path = Settings.getDataFile(Settings.KEYS.DATA_DIRECTORY);
    -  146  96 
             if (!path.exists()) {
    -  147  0 
                 if (!path.mkdirs()) {
    -  148  0 
                     throw new IOException("Unable to create NVD CVE Data directory");
    -  149   - 
                 }
    -  150   - 
             }
    -  151  96 
             return path;
    -  152   - 
         }
    -  153   - 
     
    -  154   - 
         /**
    -  155   - 
          * Determines if the H2 database file exists. If it does not exist then the data structure will need to be created.
    -  156   - 
          *
    -  157   - 
          * @return true if the H2 database file does not exist; otherwise false
    -  158   - 
          * @throws IOException thrown if the data directory does not exist and cannot be created
    -  159   - 
          */
    -  160   - 
         private static boolean needToCreateDatabaseStructure() throws IOException {
    -  161  48 
             final File dir = getDataDirectory();
    -  162  48 
             final String name = String.format("cve.%s.h2.db", DB_SCHEMA_VERSION);
    -  163  48 
             final File file = new File(dir, name);
    -  164  48 
             return !file.exists();
    -  165   - 
         }
    -  166   - 
     
    -  167   - 
         /**
    -  168   - 
          * Creates the database structure (tables and indexes) to store the CVE data.
    -  169   - 
          *
    -  170   - 
          * @param conn the database connection
    -  171   - 
          * @throws DatabaseException thrown if there is a Database Exception
    -  172   - 
          */
    -  173   - 
         private static void createTables(Connection conn) throws DatabaseException {
    -  174  0 
             Logger.getLogger(ConnectionFactory.class.getName()).log(Level.FINE, "Creating database structure");
    -  175   - 
             InputStream is;
    -  176   - 
             InputStreamReader reader;
    -  177  0 
             BufferedReader in = null;
    -  178   - 
             try {
    -  179  0 
                 is = ConnectionFactory.class.getClassLoader().getResourceAsStream(DB_STRUCTURE_RESOURCE);
    -  180  0 
                 reader = new InputStreamReader(is, "UTF-8");
    -  181  0 
                 in = new BufferedReader(reader);
    -  182  0 
                 final StringBuilder sb = new StringBuilder(2110);
    -  183   - 
                 String tmp;
    -  184  0 
                 while ((tmp = in.readLine()) != null) {
    -  185  0 
                     sb.append(tmp);
    -  186   - 
                 }
    -  187  0 
                 Statement statement = null;
    -  188   - 
                 try {
    -  189  0 
                     statement = conn.createStatement();
    -  190  0 
                     statement.execute(sb.toString());
    -  191  0 
                 } catch (SQLException ex) {
    -  192  0 
                     Logger.getLogger(ConnectionFactory.class.getName()).log(Level.FINE, null, ex);
    -  193  0 
                     throw new DatabaseException("Unable to create database statement", ex);
    -  194   - 
                 } finally {
    -  195  0 
                     DBUtils.closeStatement(statement);
    -  196  0 
                 }
    -  197  0 
             } catch (IOException ex) {
    -  198  0 
                 throw new DatabaseException("Unable to create database schema", ex);
    -  199   - 
             } finally {
    -  200  0 
                 if (in != null) {
    -  201   +  97  108 
                 conn = DriverManager.getConnection(connStr, user, pass);
    +  98  108 
                 if (createTables) {
    +  99   
                     try {
    -  202  0 
                         in.close();
    -  203  0 
                     } catch (IOException ex) {
    -  204  0 
                         Logger.getLogger(ConnectionFactory.class.getName()).log(Level.FINEST, null, ex);
    -  205  0 
                     }
    -  206   +  100  0 
                         createTables(conn);
    +  101  0 
                     } catch (DatabaseException ex) {
    +  102  0 
                         Logger.getLogger(ConnectionFactory.class.getName()).log(Level.FINE, null, ex);
    +  103  0 
                         throw new DatabaseException("Unable to create the database structure");
    +  104  0 
                     }
    +  105   + 
                 } else {
    +  106   + 
                     try {
    +  107  108 
                         ensureSchemaVersion(conn);
    +  108  0 
                     } catch (DatabaseException ex) {
    +  109  0 
                         Logger.getLogger(ConnectionFactory.class.getName()).log(Level.FINE, null, ex);
    +  110  0 
                         throw new DatabaseException("Database schema does not match this version of dependency-check");
    +  111  108 
                     }
    +  112   
                 }
    -  207   - 
             }
    -  208  0 
         }
    -  209   +  113  0 
             } catch (IOException ex) {
    +  114  0 
                 Logger.getLogger(ConnectionFactory.class.getName()).log(Level.FINE, null, ex);
    +  115  0 
                 throw new DatabaseException("Unable to load database");
    +  116  0 
             } catch (DriverLoadException ex) {
    +  117  0 
                 Logger.getLogger(ConnectionFactory.class.getName()).log(Level.FINE, null, ex);
    +  118  0 
                 throw new DatabaseException("Unable to load database driver");
    +  119  0 
             } catch (SQLException ex) {
    +  120  0 
                 Logger.getLogger(ConnectionFactory.class.getName()).log(Level.FINE, null, ex);
    +  121  0 
                 throw new DatabaseException("Unable to connect to the database");
    +  122  108 
             }
    +  123  108 
             return conn;
    +  124   + 
         }
    +  125   
     
    -  210   +  126   
         /**
    -  211   - 
          * Uses the provided connection to check the specified schema version within the database.
    -  212   +  127   + 
          * Returns the configured connection string. If using the embedded H2 database this function will also ensure the
    +  128   + 
          * data directory exists and if not create it.
    +  129   
          *
    -  213   - 
          * @param conn the database connection object
    -  214   - 
          * @throws DatabaseException thrown if the schema version is not compatible with this version of dependency-check
    -  215   +  130   + 
          * @return the connection string
    +  131   + 
          * @throws IOException thrown the data directory cannot be created
    +  132   
          */
    -  216   - 
         private static void ensureSchemaVersion(Connection conn) throws DatabaseException {
    -  217  48 
             ResultSet rs = null;
    -  218  48 
             CallableStatement cs = null;
    -  219   - 
             try {
    -  220  48 
                 cs = conn.prepareCall("SELECT value FROM properties WHERE id = 'version'");
    -  221  48 
                 rs = cs.executeQuery();
    -  222  48 
                 if (rs.next()) {
    -  223  48 
                     final boolean isWrongSchema = !DB_SCHEMA_VERSION.equals(rs.getString(1));
    -  224  48 
                     if (isWrongSchema) {
    -  225  0 
                         throw new DatabaseException("Incorrect database schema; unable to continue");
    -  226   - 
                     }
    -  227  48 
                 } else {
    -  228  0 
                     throw new DatabaseException("Database schema is missing");
    -  229   +  133   + 
         private static String getConnectionString() throws IOException {
    +  134  108 
             final String connStr = Settings.getString(Settings.KEYS.DB_CONNECTION_STRING, "jdbc:h2:file:%s;AUTO_SERVER=TRUE");
    +  135  108 
             if (connStr.contains("%s")) {
    +  136  108 
                 final String directory = getDataDirectory().getCanonicalPath();
    +  137  108 
                 final File dataFile = new File(directory, "cve." + DB_SCHEMA_VERSION);
    +  138  108 
                 Logger.getLogger(ConnectionFactory.class.getName()).log(Level.FINE, String.format("File path for H2 file: '%s'", dataFile.toString()));
    +  139  108 
                 return String.format(connStr, dataFile.getAbsolutePath());
    +  140   + 
             }
    +  141  0 
             return connStr;
    +  142   + 
         }
    +  143   + 
     
    +  144   + 
         /**
    +  145   + 
          * Retrieves the directory that the JAR file exists in so that we can ensure we always use a common data directory
    +  146   + 
          * for the embedded H2 database. This is public solely for some unit tests; otherwise this should be private.
    +  147   + 
          *
    +  148   + 
          * @return the data directory to store data files
    +  149   + 
          * @throws IOException is thrown if an IOException occurs of course...
    +  150   + 
          */
    +  151   + 
         public static File getDataDirectory() throws IOException {
    +  152  216 
             final File path = Settings.getDataFile(Settings.KEYS.DATA_DIRECTORY);
    +  153  216 
             if (!path.exists()) {
    +  154  0 
                 if (!path.mkdirs()) {
    +  155  0 
                     throw new IOException("Unable to create NVD CVE Data directory");
    +  156   
                 }
    -  230  0 
             } catch (SQLException ex) {
    -  231  0 
                 Logger.getLogger(ConnectionFactory.class.getName()).log(Level.FINE, null, ex);
    -  232  0 
                 throw new DatabaseException("Unable to check the database schema version");
    -  233   +  157   + 
             }
    +  158  216 
             return path;
    +  159   + 
         }
    +  160   + 
     
    +  161   + 
         /**
    +  162   + 
          * Determines if the H2 database file exists. If it does not exist then the data structure will need to be created.
    +  163   + 
          *
    +  164   + 
          * @return true if the H2 database file does not exist; otherwise false
    +  165   + 
          * @throws IOException thrown if the data directory does not exist and cannot be created
    +  166   + 
          */
    +  167   + 
         private static boolean needToCreateDatabaseStructure() throws IOException {
    +  168  108 
             final File dir = getDataDirectory();
    +  169  108 
             final String name = String.format("cve.%s.h2.db", DB_SCHEMA_VERSION);
    +  170  108 
             final File file = new File(dir, name);
    +  171  108 
             return !file.exists();
    +  172   + 
         }
    +  173   + 
     
    +  174   + 
         /**
    +  175   + 
          * Creates the database structure (tables and indexes) to store the CVE data.
    +  176   + 
          *
    +  177   + 
          * @param conn the database connection
    +  178   + 
          * @throws DatabaseException thrown if there is a Database Exception
    +  179   + 
          */
    +  180   + 
         private static void createTables(Connection conn) throws DatabaseException {
    +  181  0 
             Logger.getLogger(ConnectionFactory.class.getName()).log(Level.FINE, "Creating database structure");
    +  182   + 
             InputStream is;
    +  183   + 
             InputStreamReader reader;
    +  184  0 
             BufferedReader in = null;
    +  185   + 
             try {
    +  186  0 
                 is = ConnectionFactory.class.getClassLoader().getResourceAsStream(DB_STRUCTURE_RESOURCE);
    +  187  0 
                 reader = new InputStreamReader(is, "UTF-8");
    +  188  0 
                 in = new BufferedReader(reader);
    +  189  0 
                 final StringBuilder sb = new StringBuilder(2110);
    +  190   + 
                 String tmp;
    +  191  0 
                 while ((tmp = in.readLine()) != null) {
    +  192  0 
                     sb.append(tmp);
    +  193   + 
                 }
    +  194  0 
                 Statement statement = null;
    +  195   + 
                 try {
    +  196  0 
                     statement = conn.createStatement();
    +  197  0 
                     statement.execute(sb.toString());
    +  198  0 
                 } catch (SQLException ex) {
    +  199  0 
                     Logger.getLogger(ConnectionFactory.class.getName()).log(Level.FINE, null, ex);
    +  200  0 
                     throw new DatabaseException("Unable to create database statement", ex);
    +  201   + 
                 } finally {
    +  202  0 
                     DBUtils.closeStatement(statement);
    +  203  0 
                 }
    +  204  0 
             } catch (IOException ex) {
    +  205  0 
                 throw new DatabaseException("Unable to create database schema", ex);
    +  206   
             } finally {
    -  234  48 
                 DBUtils.closeResultSet(rs);
    -  235  48 
                 DBUtils.closeStatement(cs);
    -  236  48 
             }
    -  237  48 
         }
    -  238   +  207  0 
                 if (in != null) {
    +  208   + 
                     try {
    +  209  0 
                         in.close();
    +  210  0 
                     } catch (IOException ex) {
    +  211  0 
                         Logger.getLogger(ConnectionFactory.class.getName()).log(Level.FINEST, null, ex);
    +  212  0 
                     }
    +  213   + 
                 }
    +  214   + 
             }
    +  215  0 
         }
    +  216   + 
     
    +  217   + 
         /**
    +  218   + 
          * Uses the provided connection to check the specified schema version within the database.
    +  219   + 
          *
    +  220   + 
          * @param conn the database connection object
    +  221   + 
          * @throws DatabaseException thrown if the schema version is not compatible with this version of dependency-check
    +  222   + 
          */
    +  223   + 
         private static void ensureSchemaVersion(Connection conn) throws DatabaseException {
    +  224  108 
             ResultSet rs = null;
    +  225  108 
             CallableStatement cs = null;
    +  226   + 
             try {
    +  227  108 
                 cs = conn.prepareCall("SELECT value FROM properties WHERE id = 'version'");
    +  228  108 
                 rs = cs.executeQuery();
    +  229  108 
                 if (rs.next()) {
    +  230  108 
                     final boolean isWrongSchema = !DB_SCHEMA_VERSION.equals(rs.getString(1));
    +  231  108 
                     if (isWrongSchema) {
    +  232  0 
                         throw new DatabaseException("Incorrect database schema; unable to continue");
    +  233   + 
                     }
    +  234  108 
                 } else {
    +  235  0 
                     throw new DatabaseException("Database schema is missing");
    +  236   + 
                 }
    +  237  0 
             } catch (SQLException ex) {
    +  238  0 
                 Logger.getLogger(ConnectionFactory.class.getName()).log(Level.FINE, null, ex);
    +  239  0 
                 throw new DatabaseException("Unable to check the database schema version");
    +  240   + 
             } finally {
    +  241  108 
                 DBUtils.closeResultSet(rs);
    +  242  108 
                 DBUtils.closeStatement(cs);
    +  243  108 
             }
    +  244  108 
         }
    +  245   
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.CorruptDatabaseException.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.CorruptDatabaseException.html index f3bd83d34..218ce5aac 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.CorruptDatabaseException.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.CorruptDatabaseException.html @@ -24,101 +24,99 @@  3   
      *
     4   - 
      * Dependency-check-core is free software: you can redistribute it and/or modify it
    + 
      * Licensed under the Apache License, Version 2.0 (the "License");
     5   - 
      * under the terms of the GNU General Public License as published by the Free
    + 
      * you may not use this file except in compliance with the License.
     6   - 
      * Software Foundation, either version 3 of the License, or (at your option) any
    + 
      * You may obtain a copy of the License at
     7   - 
      * later version.
    + 
      *
     8   - 
      *
    + 
      *     http://www.apache.org/licenses/LICENSE-2.0
     9   - 
      * Dependency-check-core is distributed in the hope that it will be useful, but
    + 
      *
     10   - 
      * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
    + 
      * Unless required by applicable law or agreed to in writing, software
     11   - 
      * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
    + 
      * distributed under the License is distributed on an "AS IS" BASIS,
     12   - 
      * details.
    + 
      * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13   - 
      *
    + 
      * See the License for the specific language governing permissions and
     14   - 
      * You should have received a copy of the GNU General Public License along with
    + 
      * limitations under the License.
     15   - 
      * dependency-check-core. If not, see http://www.gnu.org/licenses/.
    + 
      *
     16   - 
      *
    -  17   
      * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
    +  17   + 
      */
     18   - 
      */
    -  19   
     package org.owasp.dependencycheck.data.nvdcve;
    +  19   + 
     
     20   - 
     
    -  21   
     /**
    +  21   + 
      * An exception used to indicate the db4o database is corrupt. This could be due to invalid data or a complete failure
     22   - 
      * An exception used to indicate the db4o database is corrupt. This could be due
    + 
      * of the db.
     23   - 
      * to invalid data or a complete failure of the db.
    -  24   
      *
    -  25   +  24   
      * @author Jeremy Long <jeremy.long@owasp.org>
    -  26   +  25   
      */
    -  27   +  26   
     class CorruptDatabaseException extends DatabaseException {
    +  27   + 
     
     28   - 
     
    + 
         /**
     29   - 
         /**
    -  30   
          * the serial version uid.
    +  30   + 
          */
     31   - 
          */
    -  32   
         private static final long serialVersionUID = 1L;
    +  32   + 
     
     33   - 
     
    + 
         /**
     34   - 
         /**
    + 
          * Creates an CorruptDatabaseException
     35   - 
          * Creates an CorruptDatabaseException
    + 
          *
     36   - 
          *
    + 
          * @param msg the exception message
     37   - 
          * @param msg the exception message
    + 
          */
     38   - 
          */
    -  39   
         public CorruptDatabaseException(String msg) {
    -  40  0 
             super(msg);
    -  41  0 
         }
    -  42   +  39  0 
             super(msg);
    +  40  0 
         }
    +  41   
     
    -  43   +  42   
         /**
    -  44   +  43   
          * Creates an CorruptDatabaseException
    -  45   +  44   
          *
    -  46   +  45   
          * @param msg the exception message
    -  47   +  46   
          * @param ex the cause of the exception
    -  48   +  47   
          */
    -  49   +  48   
         public CorruptDatabaseException(String msg, Exception ex) {
    -  50  0 
             super(msg, ex);
    -  51  0 
         }
    -  52   +  49  0 
             super(msg, ex);
    +  50  0 
         }
    +  51   
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.CveDB.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.CveDB.html index 7d154fbf5..fe0c66ae4 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.CveDB.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.CveDB.html @@ -12,7 +12,7 @@
     
    - +
    Classes in this File Line Coverage Branch Coverage Complexity
    CveDB
    47%
    170/360
    61%
    55/90
    		4.5
    CveDB
    46%
    168/358
    60%
    52/86
    		4.4
     
    @@ -24,1191 +24,1197 @@  3   
      *
     4   - 
      * Dependency-check-core is free software: you can redistribute it and/or modify it
    + 
      * Licensed under the Apache License, Version 2.0 (the "License");
     5   - 
      * under the terms of the GNU General Public License as published by the Free
    + 
      * you may not use this file except in compliance with the License.
     6   - 
      * Software Foundation, either version 3 of the License, or (at your option) any
    + 
      * You may obtain a copy of the License at
     7   - 
      * later version.
    + 
      *
     8   - 
      *
    + 
      *     http://www.apache.org/licenses/LICENSE-2.0
     9   - 
      * Dependency-check-core is distributed in the hope that it will be useful, but
    + 
      *
     10   - 
      * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
    + 
      * Unless required by applicable law or agreed to in writing, software
     11   - 
      * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
    + 
      * distributed under the License is distributed on an "AS IS" BASIS,
     12   - 
      * details.
    + 
      * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13   - 
      *
    + 
      * See the License for the specific language governing permissions and
     14   - 
      * You should have received a copy of the GNU General Public License along with
    + 
      * limitations under the License.
     15   - 
      * dependency-check-core. If not, see http://www.gnu.org/licenses/.
    + 
      *
     16   - 
      *
    -  17   
      * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
    +  17   + 
      */
     18   - 
      */
    -  19   
     package org.owasp.dependencycheck.data.nvdcve;
    +  19   + 
     
     20   - 
     
    -  21   
     import java.io.UnsupportedEncodingException;
    -  22   +  21   
     import java.sql.Connection;
    -  23   +  22   
     import java.sql.PreparedStatement;
    -  24   +  23   
     import java.sql.ResultSet;
    -  25   +  24   
     import java.sql.SQLException;
    -  26   +  25   
     import java.sql.Statement;
    -  27   +  26   
     import java.util.ArrayList;
    -  28   +  27   
     import java.util.HashSet;
    -  29   +  28   
     import java.util.List;
    -  30   +  29   
     import java.util.Map.Entry;
    -  31   +  30   
     import java.util.Properties;
    -  32   +  31   
     import java.util.Set;
    -  33   +  32   
     import java.util.logging.Level;
    -  34   +  33   
     import java.util.logging.Logger;
    -  35   +  34   
     import org.owasp.dependencycheck.data.cwe.CweDB;
    -  36   +  35   
     import org.owasp.dependencycheck.dependency.Reference;
    -  37   +  36   
     import org.owasp.dependencycheck.dependency.Vulnerability;
    -  38   +  37   
     import org.owasp.dependencycheck.dependency.VulnerableSoftware;
    -  39   +  38   
     import org.owasp.dependencycheck.utils.DBUtils;
    -  40   +  39   
     import org.owasp.dependencycheck.utils.DependencyVersion;
    -  41   +  40   
     import org.owasp.dependencycheck.utils.DependencyVersionUtil;
    +  41   + 
     
     42   - 
     
    -  43   
     /**
    -  44   +  43   
      * The database holding information about the NVD CVE data.
    -  45   +  44   
      *
    -  46   +  45   
      * @author Jeremy Long <jeremy.long@owasp.org>
    -  47   +  46   
      */
    -  48   +  47   
     public class CveDB {
    +  48   + 
     
     49   - 
     
    + 
         /**
     50   - 
         /**
    -  51   
          * Database connection
    +  51   + 
          */
     52   - 
          */
    -  53   
         private Connection conn;
    +  53   + 
     
     54   - 
     
    + 
         /**
     55   - 
         /**
    -  56   
          * Creates a new CveDB object and opens the database connection. Note, the connection must be closed by the caller
    -  57   +  56   
          * by calling the close method.
    +  57   + 
          *
     58   - 
          *
    -  59   
          * @throws DatabaseException thrown if there is an exception opening the database.
    +  59   + 
          */
     60   - 
          */
    -  61   
         public CveDB() throws DatabaseException {
    -  62  24 
             super();
    -  63   +  61  54 
             super();
    +  62   
             try {
    -  64  24 
                 open();
    -  65  24 
                 databaseProperties = new DatabaseProperties(this);
    -  66  0 
             } catch (DatabaseException ex) {
    -  67  0 
                 throw ex;
    -  68  24 
             }
    -  69  24 
         }
    +  63  54 
                 open();
    +  64  54 
                 databaseProperties = new DatabaseProperties(this);
    +  65  0 
             } catch (DatabaseException ex) {
    +  66  0 
                 throw ex;
    +  67  54 
             }
    +  68  54 
         }
    +  69   + 
     
     70   - 
     
    + 
         /**
     71   - 
         /**
    -  72   
          * Returns the database connection.
    +  72   + 
          *
     73   - 
          *
    -  74   
          * @return the database connection
    +  74   + 
          */
     75   - 
          */
    -  76   
         protected Connection getConnection() {
    -  77  304 
             return conn;
    +  76  614 
             return conn;
    +  77   + 
         }
     78   - 
         }
    + 
     
     79   - 
     
    + 
         /**
     80   - 
         /**
    -  81   
          * Opens the database connection. If the database does not exist, it will create a new one.
    +  81   + 
          *
     82   - 
          *
    -  83   
          * @throws DatabaseException thrown if there is an error opening the database connection
    +  83   + 
          */
     84   - 
          */
    -  85   
         public final void open() throws DatabaseException {
    -  86  48 
             conn = ConnectionFactory.getConnection();
    -  87  48 
         }
    +  85  108 
             conn = ConnectionFactory.getConnection();
    +  86  108 
         }
    +  87   + 
     
     88   - 
     
    + 
         /**
     89   - 
         /**
    -  90   
          * Closes the DB4O database. Close should be called on this object when it is done being used.
    +  90   + 
          */
     91   - 
          */
    -  92   
         public void close() {
    -  93  39 
             if (conn != null) {
    -  94   +  92  93 
             if (conn != null) {
    +  93   
                 try {
    -  95  24 
                     conn.close();
    -  96  0 
                 } catch (SQLException ex) {
    -  97  0 
                     final String msg = "There was an error attempting to close the CveDB, see the log for more details.";
    -  98  0 
                     Logger.getLogger(DBUtils.class.getName()).log(Level.SEVERE, msg);
    -  99  0 
                     Logger.getLogger(DBUtils.class.getName()).log(Level.FINE, null, ex);
    -  100  24 
                 }
    -  101  24 
                 conn = null;
    -  102   +  94  54 
                     conn.close();
    +  95  0 
                 } catch (SQLException ex) {
    +  96  0 
                     final String msg = "There was an error attempting to close the CveDB, see the log for more details.";
    +  97  0 
                     Logger.getLogger(DBUtils.class.getName()).log(Level.SEVERE, msg);
    +  98  0 
                     Logger.getLogger(DBUtils.class.getName()).log(Level.FINE, null, ex);
    +  99  54 
                 }
    +  100  54 
                 conn = null;
    +  101   
             }
    -  103  39 
         }
    +  102  93 
         }
    +  103   + 
     
     104   - 
     
    + 
         /**
     105   - 
         /**
    -  106   
          * Returns whether the database connection is open or closed.
    +  106   + 
          *
     107   - 
          *
    -  108   
          * @return whether the database connection is open or closed
    +  108   + 
          */
     109   - 
          */
    -  110   
         public boolean isOpen() {
    -  111  0 
             return conn != null;
    +  110  0 
             return conn != null;
    +  111   + 
         }
     112   - 
         }
    + 
     
     113   - 
     
    + 
         /**
     114   - 
         /**
    -  115   
          * Commits all completed transactions.
    +  115   + 
          *
     116   - 
          *
    -  117   
          * @throws SQLException thrown if a SQL Exception occurs
    +  117   + 
          */
     118   - 
          */
    -  119   
         public void commit() throws SQLException {
    -  120  1 
             if (conn != null) {
    +  119   + 
             //temporary remove this as autocommit is on.
    +  120   + 
             //if (conn != null) {
     121   - 
                 //temporary remove this as autocommit is on.
    + 
             //    conn.commit();
     122   - 
                 //conn.commit();
    -  123   - 
             }
    -  124  1 
         }
    + 
             //}
    +  123  2 
         }
    +  124   + 
     
     125   - 
     
    + 
         /**
     126   - 
         /**
    -  127   
          * Cleans up the object and ensures that "close" has been called.
    +  127   + 
          *
     128   - 
          *
    -  129   
          * @throws Throwable thrown if there is a problem
    +  129   + 
          */
     130   - 
          */
    -  131   
         @Override
    -  132   +  131   
         protected void finalize() throws Throwable {
    -  133  15 
             close();
    -  134  15 
             super.finalize();
    -  135  15 
         }
    +  132  39 
             close();
    +  133  39 
             super.finalize();
    +  134  39 
         }
    +  135   + 
         /**
     136   - 
         /**
    -  137   
          * Database properties object containing the 'properties' from the database table.
    +  137   + 
          */
     138   - 
          */
    -  139   
         private DatabaseProperties databaseProperties;
    +  139   + 
     
     140   - 
     
    + 
         /**
     141   - 
         /**
    -  142   
          * Get the value of databaseProperties.
    +  142   + 
          *
     143   - 
          *
    -  144   
          * @return the value of databaseProperties
    +  144   + 
          */
     145   - 
          */
    -  146   
         public DatabaseProperties getDatabaseProperties() {
    -  147  4 
             return databaseProperties;
    +  146  14 
             return databaseProperties;
    +  147   + 
         }
     148   - 
         }
    -  149   
         //<editor-fold defaultstate="collapsed" desc="Constants to create, maintain, and retrieve data from the CVE Database">
    +  149   + 
         /**
     150   - 
         /**
    -  151   
          * SQL Statement to delete references by vulnerability ID.
    +  151   + 
          */
     152   - 
          */
    -  153   
         private static final String DELETE_REFERENCE = "DELETE FROM reference WHERE cveid = ?";
    +  153   + 
         /**
     154   - 
         /**
    -  155   
          * SQL Statement to delete software by vulnerability ID.
    +  155   + 
          */
     156   - 
          */
    -  157   
         private static final String DELETE_SOFTWARE = "DELETE FROM software WHERE cveid = ?";
    +  157   + 
         /**
     158   - 
         /**
    -  159   
          * SQL Statement to delete a vulnerability by CVE.
    +  159   + 
          */
     160   - 
          */
    -  161   
         private static final String DELETE_VULNERABILITY = "DELETE FROM vulnerability WHERE id = ?";
    +  161   + 
         /**
     162   - 
         /**
    -  163   
          * SQL Statement to cleanup orphan entries. Yes, the db schema could be a little tighter, but what we have works
    -  164   +  163   
          * well to keep the data file size down a bit.
    +  164   + 
          */
     165   - 
          */
    -  166   
         private static final String CLEANUP_ORPHANS = "DELETE FROM CpeEntry WHERE id not in (SELECT CPEEntryId FROM Software); ";
    +  166   + 
         /**
     167   - 
         /**
    -  168   
          * SQL Statement to insert a new reference.
    +  168   + 
          */
     169   - 
          */
    -  170   
         private static final String INSERT_REFERENCE = "INSERT INTO reference (cveid, name, url, source) VALUES (?, ?, ?, ?)";
    +  170   + 
         /**
     171   - 
         /**
    -  172   
          * SQL Statement to insert a new software.
    +  172   + 
          */
     173   - 
          */
    -  174   
         private static final String INSERT_SOFTWARE = "INSERT INTO software (cveid, cpeEntryId, previousVersion) VALUES (?, ?, ?)";
    +  174   + 
         /**
     175   - 
         /**
    -  176   
          * SQL Statement to insert a new cpe.
    +  176   + 
          */
     177   - 
          */
    -  178   
         private static final String INSERT_CPE = "INSERT INTO cpeEntry (cpe, vendor, product) VALUES (?, ?, ?)";
    +  178   + 
         /**
     179   - 
         /**
    -  180   
          * SQL Statement to get a CPEProductID.
    +  180   + 
          */
     181   - 
          */
    -  182   
         private static final String SELECT_CPE_ID = "SELECT id FROM cpeEntry WHERE cpe = ?";
    +  182   + 
         /**
     183   - 
         /**
    -  184   
          * SQL Statement to insert a new vulnerability.
    +  184   + 
          */
     185   - 
          */
    -  186   
         private static final String INSERT_VULNERABILITY = "INSERT INTO vulnerability (cve, description, cwe, cvssScore, cvssAccessVector, "
    -  187   +  186   
                 + "cvssAccessComplexity, cvssAuthentication, cvssConfidentialityImpact, cvssIntegrityImpact, cvssAvailabilityImpact) "
    -  188   +  187   
                 + "VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)";
    +  188   + 
         /**
     189   - 
         /**
    -  190   
          * SQL Statement to update a vulnerability.
    +  190   + 
          */
     191   - 
          */
    -  192   
         private static final String UPDATE_VULNERABILITY = "UPDATE vulnerability SET description=?, cwe=?, cvssScore=?, cvssAccessVector=?, "
    -  193   +  192   
                 + "cvssAccessComplexity=?, cvssAuthentication=?, cvssConfidentialityImpact=?, cvssIntegrityImpact=?, cvssAvailabilityImpact=? "
    -  194   +  193   
                 + "WHERE id=?";
    +  194   + 
         /**
     195   - 
         /**
    -  196   
          * SQL Statement to find CVE entries based on CPE data.
    +  196   + 
          */
     197   - 
          */
    -  198   
         private static final String SELECT_CVE_FROM_SOFTWARE = "SELECT cve, cpe, previousVersion "
    -  199   +  198   
                 + "FROM software INNER JOIN vulnerability ON vulnerability.id = software.cveId "
    -  200   +  199   
                 + "INNER JOIN cpeEntry ON cpeEntry.id = software.cpeEntryId "
    -  201   +  200   
                 + "WHERE vendor = ? AND product = ?";
    -  202   +  201   
         //unfortunately, the version info is too complicated to do in a select. Need to filter this afterwards
    -  203   +  202   
         //        + " AND (version = '-' OR previousVersion IS NOT NULL OR version=?)";
    -  204   +  203   
         //
    +  204   + 
         /**
     205   - 
         /**
    -  206   
          * SQL Statement to find the CPE entry based on the vendor and product.
    +  206   + 
          */
     207   - 
          */
    -  208   
         private static final String SELECT_CPE_ENTRIES = "SELECT cpe FROM cpeEntry WHERE vendor = ? AND product = ?";
    +  208   + 
         /**
     209   - 
         /**
    -  210   
          * SQL Statement to select references by CVEID.
    +  210   + 
          */
     211   - 
          */
    -  212   
         private static final String SELECT_REFERENCE = "SELECT source, name, url FROM reference WHERE cveid = ?";
    +  212   + 
         /**
     213   - 
         /**
    -  214   
          * SQL Statement to select vendor and product for lucene index.
    +  214   + 
          */
     215   - 
          */
    -  216   
         private static final String SELECT_VENDOR_PRODUCT_LIST = "SELECT vendor, product FROM cpeEntry GROUP BY vendor, product";
    +  216   + 
         /**
     217   - 
         /**
    -  218   
          * SQL Statement to select software by CVEID.
    +  218   + 
          */
     219   - 
          */
    -  220   
         private static final String SELECT_SOFTWARE = "SELECT cpe, previousVersion "
    -  221   +  220   
                 + "FROM software INNER JOIN cpeEntry ON software.cpeEntryId = cpeEntry.id WHERE cveid = ?";
    -  222   +  221   
     //    public static final String SELECT_SOFTWARE = "SELECT part, vendor, product, version, revision, previousVersion "
    -  223   +  222   
     //            + "FROM software INNER JOIN cpeProduct ON cpeProduct.id = software.cpeProductId LEFT JOIN cpeVersion ON "
    -  224   +  223   
     //            + "software.cpeVersionId = cpeVersion.id LEFT JOIN Version ON cpeVersion.versionId = version.id WHERE cveid = ?";
    +  224   + 
         /**
     225   - 
         /**
    -  226   
          * SQL Statement to select a vulnerability by CVEID.
    +  226   + 
          */
     227   - 
          */
    -  228   
         private static final String SELECT_VULNERABILITY = "SELECT id, description, cwe, cvssScore, cvssAccessVector, cvssAccessComplexity, "
    -  229   +  228   
                 + "cvssAuthentication, cvssConfidentialityImpact, cvssIntegrityImpact, cvssAvailabilityImpact FROM vulnerability WHERE cve = ?";
    +  229   + 
         /**
     230   - 
         /**
    -  231   
          * SQL Statement to select a vulnerability's primary key.
    +  231   + 
          */
     232   - 
          */
    -  233   
         private static final String SELECT_VULNERABILITY_ID = "SELECT id FROM vulnerability WHERE cve = ?";
    +  233   + 
         /**
     234   - 
         /**
    -  235   
          * SQL Statement to retrieve the properties from the database.
    +  235   + 
          */
     236   - 
          */
    -  237   
         private static final String SELECT_PROPERTIES = "SELECT id, value FROM properties";
    +  237   + 
         /**
     238   - 
         /**
    -  239   
          * SQL Statement to retrieve a property from the database.
    +  239   + 
          */
     240   - 
          */
    -  241   
         private static final String SELECT_PROPERTY = "SELECT id, value FROM properties WHERE id = ?";
    +  241   + 
         /**
     242   - 
         /**
    -  243   
          * SQL Statement to insert a new property.
    +  243   + 
          */
     244   - 
          */
    -  245   
         private static final String INSERT_PROPERTY = "INSERT INTO properties (id, value) VALUES (?, ?)";
    +  245   + 
         /**
     246   - 
         /**
    -  247   
          * SQL Statement to update a property.
    +  247   + 
          */
     248   - 
          */
    -  249   
         private static final String UPDATE_PROPERTY = "UPDATE properties SET value = ? WHERE id = ?";
    +  249   + 
         /**
     250   - 
         /**
    -  251   
          * SQL Statement to delete a property.
    +  251   + 
          */
     252   - 
          */
    -  253   
         private static final String DELETE_PROPERTY = "DELETE FROM properties WHERE id = ?";
    +  253   + 
     
     254   - 
     
    -  255   
         //</editor-fold>
    +  255   + 
         /**
     256   - 
         /**
    -  257   
          * Searches the CPE entries in the database and retrieves all entries for a given vendor and product combination.
    -  258   +  257   
          * The returned list will include all versions of the product that are registered in the NVD CVE data.
    +  258   + 
          *
     259   - 
          *
    -  260   
          * @param vendor the identified vendor name of the dependency being analyzed
    -  261   +  260   
          * @param product the identified name of the product of the dependency being analyzed
    -  262   +  261   
          * @return a set of vulnerable software
    +  262   + 
          */
     263   - 
          */
    -  264   
         public Set<VulnerableSoftware> getCPEs(String vendor, String product) {
    -  265  72 
             final Set<VulnerableSoftware> cpe = new HashSet<VulnerableSoftware>();
    -  266  72 
             ResultSet rs = null;
    -  267  72 
             PreparedStatement ps = null;
    -  268   +  264  144 
             final Set<VulnerableSoftware> cpe = new HashSet<VulnerableSoftware>();
    +  265  144 
             ResultSet rs = null;
    +  266  144 
             PreparedStatement ps = null;
    +  267   
             try {
    -  269  72 
                 ps = getConnection().prepareStatement(SELECT_CPE_ENTRIES);
    -  270  72 
                 ps.setString(1, vendor);
    -  271  72 
                 ps.setString(2, product);
    -  272  72 
                 rs = ps.executeQuery();
    -  273   +  268  144 
                 ps = getConnection().prepareStatement(SELECT_CPE_ENTRIES);
    +  269  144 
                 ps.setString(1, vendor);
    +  270  144 
                 ps.setString(2, product);
    +  271  144 
                 rs = ps.executeQuery();
    +  272   
     
    -  274  4462 
                 while (rs.next()) {
    -  275  4390 
                     final VulnerableSoftware vs = new VulnerableSoftware();
    -  276  4390 
                     vs.setCpe(rs.getString(1));
    -  277  4390 
                     cpe.add(vs);
    -  278  4390 
                 }
    -  279  0 
             } catch (SQLException ex) {
    -  280  0 
                 final String msg = "An unexpected SQL Exception occurred; please see the verbose log for more details.";
    -  281  0 
                 Logger.getLogger(CveDB.class.getName()).log(Level.SEVERE, msg);
    -  282  0 
                 Logger.getLogger(CveDB.class.getName()).log(Level.FINE, null, ex);
    -  283   +  273  8924 
                 while (rs.next()) {
    +  274  8780 
                     final VulnerableSoftware vs = new VulnerableSoftware();
    +  275  8780 
                     vs.setCpe(rs.getString(1));
    +  276  8780 
                     cpe.add(vs);
    +  277  8780 
                 }
    +  278  0 
             } catch (SQLException ex) {
    +  279  0 
                 final String msg = "An unexpected SQL Exception occurred; please see the verbose log for more details.";
    +  280  0 
                 Logger.getLogger(CveDB.class.getName()).log(Level.SEVERE, msg);
    +  281  0 
                 Logger.getLogger(CveDB.class.getName()).log(Level.FINE, null, ex);
    +  282   
             } finally {
    -  284  72 
                 DBUtils.closeResultSet(rs);
    -  285  72 
                 DBUtils.closeStatement(ps);
    -  286  72 
             }
    -  287  72 
             return cpe;
    +  283  144 
                 DBUtils.closeResultSet(rs);
    +  284  144 
                 DBUtils.closeStatement(ps);
    +  285  144 
             }
    +  286  144 
             return cpe;
    +  287   + 
         }
     288   - 
         }
    + 
     
     289   - 
     
    + 
         /**
     290   - 
         /**
    -  291   
          * Returns the entire list of vendor/product combinations.
    +  291   + 
          *
     292   - 
          *
    -  293   
          * @return the entire list of vendor/product combinations.
    +  293   + 
          */
     294   - 
          */
    -  295   
         public ResultSet getVendorProductList() {
    -  296  11 
             ResultSet rs = null;
    -  297   +  295  22 
             ResultSet rs = null;
    +  296   
             try {
    -  298  11 
                 final PreparedStatement ps = getConnection().prepareStatement(SELECT_VENDOR_PRODUCT_LIST);
    -  299  11 
                 rs = ps.executeQuery();
    -  300  0 
             } catch (SQLException ex) {
    -  301  0 
                 final String msg = "An unexpected SQL Exception occurred; please see the verbose log for more details.";
    -  302  0 
                 Logger.getLogger(CveDB.class.getName()).log(Level.SEVERE, msg);
    -  303  0 
                 Logger.getLogger(CveDB.class.getName()).log(Level.FINE, null, ex);
    -  304  11 
             } // can't close the statement in the PS as the resultset is returned, closing PS would close the resultset
    -  305  11 
             return rs;
    +  297  22 
                 final PreparedStatement ps = getConnection().prepareStatement(SELECT_VENDOR_PRODUCT_LIST);
    +  298  22 
                 rs = ps.executeQuery();
    +  299  0 
             } catch (SQLException ex) {
    +  300  0 
                 final String msg = "An unexpected SQL Exception occurred; please see the verbose log for more details.";
    +  301  0 
                 Logger.getLogger(CveDB.class.getName()).log(Level.SEVERE, msg);
    +  302  0 
                 Logger.getLogger(CveDB.class.getName()).log(Level.FINE, null, ex);
    +  303  22 
             } // can't close the statement in the PS as the resultset is returned, closing PS would close the resultset
    +  304  22 
             return rs;
    +  305   + 
         }
     306   - 
         }
    + 
     
     307   - 
     
    + 
         /**
     308   - 
         /**
    -  309   
          * Returns a set of properties.
    +  309   + 
          *
     310   - 
          *
    -  311   
          * @return the properties from the database
    +  311   + 
          */
     312   - 
          */
    -  313   
         Properties getProperties() {
    -  314  24 
             final Properties prop = new Properties();
    -  315  24 
             PreparedStatement ps = null;
    -  316  24 
             ResultSet rs = null;
    -  317   +  313  54 
             final Properties prop = new Properties();
    +  314  54 
             PreparedStatement ps = null;
    +  315  54 
             ResultSet rs = null;
    +  316   
             try {
    -  318  24 
                 ps = getConnection().prepareStatement(SELECT_PROPERTIES);
    -  319  24 
                 rs = ps.executeQuery();
    -  320  390 
                 while (rs.next()) {
    -  321  366 
                     prop.setProperty(rs.getString(1), rs.getString(2));
    -  322   +  317  54 
                 ps = getConnection().prepareStatement(SELECT_PROPERTIES);
    +  318  54 
                 rs = ps.executeQuery();
    +  319  882 
                 while (rs.next()) {
    +  320  828 
                     prop.setProperty(rs.getString(1), rs.getString(2));
    +  321   
                 }
    -  323  0 
             } catch (SQLException ex) {
    -  324  0 
                 final String msg = "An unexpected SQL Exception occurred; please see the verbose log for more details.";
    -  325  0 
                 Logger.getLogger(CveDB.class.getName()).log(Level.SEVERE, msg);
    -  326  0 
                 Logger.getLogger(CveDB.class.getName()).log(Level.FINE, null, ex);
    -  327   +  322  0 
             } catch (SQLException ex) {
    +  323  0 
                 final String msg = "An unexpected SQL Exception occurred; please see the verbose log for more details.";
    +  324  0 
                 Logger.getLogger(CveDB.class.getName()).log(Level.SEVERE, msg);
    +  325  0 
                 Logger.getLogger(CveDB.class.getName()).log(Level.FINE, null, ex);
    +  326   
             } finally {
    -  328  24 
                 DBUtils.closeStatement(ps);
    -  329  24 
                 DBUtils.closeResultSet(rs);
    -  330  24 
             }
    -  331  24 
             return prop;
    +  327  54 
                 DBUtils.closeStatement(ps);
    +  328  54 
                 DBUtils.closeResultSet(rs);
    +  329  54 
             }
    +  330  54 
             return prop;
    +  331   + 
         }
     332   - 
         }
    + 
     
     333   - 
     
    + 
         /**
     334   - 
         /**
    -  335   
          * Saves a set of properties to the database.
    +  335   + 
          *
     336   - 
          *
    -  337   
          * @param props a collection of properties
    +  337   + 
          */
     338   - 
          */
    -  339   
         void saveProperties(Properties props) {
    -  340  0 
             PreparedStatement updateProperty = null;
    -  341  0 
             PreparedStatement insertProperty = null;
    +  339  0 
             PreparedStatement updateProperty = null;
    +  340  0 
             PreparedStatement insertProperty = null;
    +  341   + 
             try {
     342   - 
             try {
    -  343   
                 try {
    -  344  0 
                     updateProperty = getConnection().prepareStatement(UPDATE_PROPERTY);
    -  345  0 
                     insertProperty = getConnection().prepareStatement(INSERT_PROPERTY);
    -  346  0 
                 } catch (SQLException ex) {
    -  347  0 
                     Logger.getLogger(CveDB.class.getName()).log(Level.WARNING, "Unable to save properties to the database");
    -  348  0 
                     Logger.getLogger(CveDB.class.getName()).log(Level.FINE, "Unable to save properties to the database", ex);
    -  349   +  343  0 
                     updateProperty = getConnection().prepareStatement(UPDATE_PROPERTY);
    +  344  0 
                     insertProperty = getConnection().prepareStatement(INSERT_PROPERTY);
    +  345  0 
                 } catch (SQLException ex) {
    +  346  0 
                     Logger.getLogger(CveDB.class.getName()).log(Level.WARNING, "Unable to save properties to the database");
    +  347  0 
                     Logger.getLogger(CveDB.class.getName()).log(Level.FINE, "Unable to save properties to the database", ex);
    +  348   
                     return;
    -  350  0 
                 }
    -  351  0 
                 for (Entry<Object, Object> entry : props.entrySet()) {
    -  352  0 
                     final String key = entry.getKey().toString();
    -  353  0 
                     final String value = entry.getValue().toString();
    -  354   +  349  0 
                 }
    +  350  0 
                 for (Entry<Object, Object> entry : props.entrySet()) {
    +  351  0 
                     final String key = entry.getKey().toString();
    +  352  0 
                     final String value = entry.getValue().toString();
    +  353   
                     try {
    -  355  0 
                         updateProperty.setString(1, value);
    -  356  0 
                         updateProperty.setString(2, key);
    -  357  0 
                         if (updateProperty.executeUpdate() == 0) {
    -  358  0 
                             insertProperty.setString(1, key);
    -  359  0 
                             insertProperty.setString(2, value);
    -  360   +  354  0 
                         updateProperty.setString(1, value);
    +  355  0 
                         updateProperty.setString(2, key);
    +  356  0 
                         if (updateProperty.executeUpdate() == 0) {
    +  357  0 
                             insertProperty.setString(1, key);
    +  358  0 
                             insertProperty.setString(2, value);
    +  359   
                         }
    -  361  0 
                     } catch (SQLException ex) {
    -  362  0 
                         final String msg = String.format("Unable to save property '%s' with a value of '%s' to the database", key, value);
    -  363  0 
                         Logger.getLogger(CveDB.class.getName()).log(Level.WARNING, msg);
    -  364  0 
                         Logger.getLogger(CveDB.class.getName()).log(Level.FINE, null, ex);
    -  365  0 
                     }
    -  366  0 
                 }
    -  367   +  360  0 
                     } catch (SQLException ex) {
    +  361  0 
                         final String msg = String.format("Unable to save property '%s' with a value of '%s' to the database", key, value);
    +  362  0 
                         Logger.getLogger(CveDB.class.getName()).log(Level.WARNING, msg);
    +  363  0 
                         Logger.getLogger(CveDB.class.getName()).log(Level.FINE, null, ex);
    +  364  0 
                     }
    +  365  0 
                 }
    +  366   
             } finally {
    -  368  0 
                 DBUtils.closeStatement(updateProperty);
    -  369  0 
                 DBUtils.closeStatement(insertProperty);
    -  370  0 
             }
    -  371  0 
         }
    +  367  0 
                 DBUtils.closeStatement(updateProperty);
    +  368  0 
                 DBUtils.closeStatement(insertProperty);
    +  369  0 
             }
    +  370  0 
         }
    +  371   + 
     
     372   - 
     
    + 
         /**
     373   - 
         /**
    -  374   
          * Saves a property to the database.
    +  374   + 
          *
     375   - 
          *
    -  376   
          * @param key the property key
    -  377   +  376   
          * @param value the property value
    +  377   + 
          */
     378   - 
          */
    -  379   
         void saveProperty(String key, String value) {
    -  380  1 
             PreparedStatement updateProperty = null;
    -  381  1 
             PreparedStatement insertProperty = null;
    +  379  2 
             PreparedStatement updateProperty = null;
    +  380  2 
             PreparedStatement insertProperty = null;
    +  381   + 
             try {
     382   - 
             try {
    -  383   
                 try {
    -  384  1 
                     updateProperty = getConnection().prepareStatement(UPDATE_PROPERTY);
    -  385  0 
                 } catch (SQLException ex) {
    -  386  0 
                     Logger.getLogger(CveDB.class.getName()).log(Level.WARNING, "Unable to save properties to the database");
    -  387  0 
                     Logger.getLogger(CveDB.class.getName()).log(Level.FINE, "Unable to save properties to the database", ex);
    -  388   +  383  2 
                     updateProperty = getConnection().prepareStatement(UPDATE_PROPERTY);
    +  384  0 
                 } catch (SQLException ex) {
    +  385  0 
                     Logger.getLogger(CveDB.class.getName()).log(Level.WARNING, "Unable to save properties to the database");
    +  386  0 
                     Logger.getLogger(CveDB.class.getName()).log(Level.FINE, "Unable to save properties to the database", ex);
    +  387   
                     return;
    -  389  1 
                 }
    -  390   +  388  2 
                 }
    +  389   
                 try {
    -  391  1 
                     updateProperty.setString(1, value);
    -  392  1 
                     updateProperty.setString(2, key);
    -  393  1 
                     if (updateProperty.executeUpdate() == 0) {
    -  394   +  390  2 
                     updateProperty.setString(1, value);
    +  391  2 
                     updateProperty.setString(2, key);
    +  392  2 
                     if (updateProperty.executeUpdate() == 0) {
    +  393   
                         try {
    -  395  1 
                             insertProperty = getConnection().prepareStatement(INSERT_PROPERTY);
    -  396  0 
                         } catch (SQLException ex) {
    -  397  0 
                             Logger.getLogger(CveDB.class.getName()).log(Level.WARNING, "Unable to save properties to the database");
    -  398  0 
                             Logger.getLogger(CveDB.class.getName()).log(Level.FINE, "Unable to save properties to the database", ex);
    -  399   +  394  2 
                             insertProperty = getConnection().prepareStatement(INSERT_PROPERTY);
    +  395  0 
                         } catch (SQLException ex) {
    +  396  0 
                             Logger.getLogger(CveDB.class.getName()).log(Level.WARNING, "Unable to save properties to the database");
    +  397  0 
                             Logger.getLogger(CveDB.class.getName()).log(Level.FINE, "Unable to save properties to the database", ex);
    +  398   
                             return;
    -  400  1 
                         }
    -  401  1 
                         insertProperty.setString(1, key);
    -  402  1 
                         insertProperty.setString(2, value);
    -  403  1 
                         insertProperty.execute();
    -  404   +  399  2 
                         }
    +  400  2 
                         insertProperty.setString(1, key);
    +  401  2 
                         insertProperty.setString(2, value);
    +  402  2 
                         insertProperty.execute();
    +  403   
                     }
    -  405  0 
                 } catch (SQLException ex) {
    -  406  0 
                     final String msg = String.format("Unable to save property '%s' with a value of '%s' to the database", key, value);
    -  407  0 
                     Logger.getLogger(CveDB.class.getName()).log(Level.WARNING, msg);
    -  408  0 
                     Logger.getLogger(CveDB.class.getName()).log(Level.FINE, null, ex);
    -  409  1 
                 }
    -  410   +  404  0 
                 } catch (SQLException ex) {
    +  405  0 
                     final String msg = String.format("Unable to save property '%s' with a value of '%s' to the database", key, value);
    +  406  0 
                     Logger.getLogger(CveDB.class.getName()).log(Level.WARNING, msg);
    +  407  0 
                     Logger.getLogger(CveDB.class.getName()).log(Level.FINE, null, ex);
    +  408  2 
                 }
    +  409   
             } finally {
    -  411  1 
                 DBUtils.closeStatement(updateProperty);
    -  412  1 
                 DBUtils.closeStatement(insertProperty);
    -  413  1 
             }
    -  414  1 
         }
    +  410  2 
                 DBUtils.closeStatement(updateProperty);
    +  411  2 
                 DBUtils.closeStatement(insertProperty);
    +  412  2 
             }
    +  413  2 
         }
    +  414   + 
     
     415   - 
     
    + 
         /**
     416   - 
         /**
    -  417   
          * Retrieves the vulnerabilities associated with the specified CPE.
    +  417   + 
          *
     418   - 
          *
    -  419   
          * @param cpeStr the CPE name
    -  420   +  419   
          * @return a list of Vulnerabilities
    -  421   +  420   
          * @throws DatabaseException thrown if there is an exception retrieving data
    +  421   + 
          */
     422   - 
          */
    -  423   
         public List<Vulnerability> getVulnerabilities(String cpeStr) throws DatabaseException {
    -  424  12 
             ResultSet rs = null;
    -  425  12 
             final VulnerableSoftware cpe = new VulnerableSoftware();
    -  426   +  423  24 
             ResultSet rs = null;
    +  424  24 
             final VulnerableSoftware cpe = new VulnerableSoftware();
    +  425   
             try {
    -  427  12 
                 cpe.parseName(cpeStr);
    -  428  0 
             } catch (UnsupportedEncodingException ex) {
    -  429  0 
                 Logger.getLogger(CveDB.class.getName()).log(Level.FINEST, null, ex);
    -  430  12 
             }
    -  431  12 
             final DependencyVersion detectedVersion = parseDependencyVersion(cpe);
    -  432  12 
             final List<Vulnerability> vulnerabilities = new ArrayList<Vulnerability>();
    +  426  24 
                 cpe.parseName(cpeStr);
    +  427  0 
             } catch (UnsupportedEncodingException ex) {
    +  428  0 
                 Logger.getLogger(CveDB.class.getName()).log(Level.FINEST, null, ex);
    +  429  24 
             }
    +  430  24 
             final DependencyVersion detectedVersion = parseDependencyVersion(cpe);
    +  431  24 
             final List<Vulnerability> vulnerabilities = new ArrayList<Vulnerability>();
    +  432   + 
     
     433   - 
     
    -  434   
             PreparedStatement ps;
    -  435  12 
             final HashSet<String> cveEntries = new HashSet<String>();
    -  436   +  434  24 
             final HashSet<String> cveEntries = new HashSet<String>();
    +  435   
             try {
    -  437  12 
                 ps = getConnection().prepareStatement(SELECT_CVE_FROM_SOFTWARE);
    -  438  12 
                 ps.setString(1, cpe.getVendor());
    -  439  12 
                 ps.setString(2, cpe.getProduct());
    -  440  12 
                 rs = ps.executeQuery();
    -  441  4591 
                 while (rs.next()) {
    -  442  4579 
                     final String cveId = rs.getString(1);
    -  443  4579 
                     final String cpeId = rs.getString(2);
    -  444  4579 
                     final String previous = rs.getString(3);
    -  445  4579 
                     if (!cveEntries.contains(cveId) && isAffected(cpe.getVendor(), cpe.getProduct(), detectedVersion, cpeId, previous)) {
    -  446  61 
                         cveEntries.add(cveId);
    -  447   +  436  24 
                 ps = getConnection().prepareStatement(SELECT_CVE_FROM_SOFTWARE);
    +  437  24 
                 ps.setString(1, cpe.getVendor());
    +  438  24 
                 ps.setString(2, cpe.getProduct());
    +  439  24 
                 rs = ps.executeQuery();
    +  440  9182 
                 while (rs.next()) {
    +  441  9158 
                     final String cveId = rs.getString(1);
    +  442  9158 
                     final String cpeId = rs.getString(2);
    +  443  9158 
                     final String previous = rs.getString(3);
    +  444  9158 
                     if (!cveEntries.contains(cveId) && isAffected(cpe.getVendor(), cpe.getProduct(), detectedVersion, cpeId, previous)) {
    +  445  122 
                         cveEntries.add(cveId);
    +  446  122 
                         final Vulnerability v = getVulnerability(cveId);
    +  447  122 
                         v.setMatchedCPE(cpeId, previous);
    +  448  122 
                         vulnerabilities.add(v);
    +  449   
                     }
    -  448  4579 
                 }
    -  449  12 
                 DBUtils.closeResultSet(rs);
    -  450  12 
                 DBUtils.closeStatement(ps);
    -  451  12 
                 for (String cve : cveEntries) {
    -  452  61 
                     final Vulnerability v = getVulnerability(cve);
    -  453  61 
                     vulnerabilities.add(v);
    -  454  61 
                 }
    +  450  9158 
                 }
    +  451  24 
                 DBUtils.closeResultSet(rs);
    +  452  24 
                 DBUtils.closeStatement(ps);
    +  453   + 
     //            for (String cve : cveEntries) {
    +  454   + 
     //                final Vulnerability v = getVulnerability(cve);
     455   + 
     //                vulnerabilities.add(v);
    +  456   + 
     //            }
    +  457   
     
    -  456  0 
             } catch (SQLException ex) {
    -  457  0 
                 throw new DatabaseException("Exception retrieving vulnerability for " + cpeStr, ex);
    -  458   +  458  0 
             } catch (SQLException ex) {
    +  459  0 
                 throw new DatabaseException("Exception retrieving vulnerability for " + cpeStr, ex);
    +  460   
             } finally {
    -  459  12 
                 DBUtils.closeResultSet(rs);
    -  460  12 
             }
    -  461  12 
             return vulnerabilities;
    -  462   - 
         }
    -  463   - 
     
    +  461  24 
                 DBUtils.closeResultSet(rs);
    +  462  24 
             }
    +  463  24 
             return vulnerabilities;
     464   - 
         /**
    + 
         }
     465   - 
          * Gets a vulnerability for the provided CVE.
    + 
     
     466   - 
          *
    + 
         /**
     467   - 
          * @param cve the CVE to lookup
    + 
          * Gets a vulnerability for the provided CVE.
     468   - 
          * @return a vulnerability object
    + 
          *
     469   - 
          * @throws DatabaseException if an exception occurs
    + 
          * @param cve the CVE to lookup
     470   - 
          */
    + 
          * @return a vulnerability object
     471   + 
          * @throws DatabaseException if an exception occurs
    +  472   + 
          */
    +  473   
         private Vulnerability getVulnerability(String cve) throws DatabaseException {
    -  472  61 
             PreparedStatement psV = null;
    -  473  61 
             PreparedStatement psR = null;
    -  474  61 
             PreparedStatement psS = null;
    -  475  61 
             ResultSet rsV = null;
    -  476  61 
             ResultSet rsR = null;
    -  477  61 
             ResultSet rsS = null;
    -  478  61 
             Vulnerability vuln = null;
    -  479   +  474  122 
             PreparedStatement psV = null;
    +  475  122 
             PreparedStatement psR = null;
    +  476  122 
             PreparedStatement psS = null;
    +  477  122 
             ResultSet rsV = null;
    +  478  122 
             ResultSet rsR = null;
    +  479  122 
             ResultSet rsS = null;
    +  480  122 
             Vulnerability vuln = null;
    +  481   
             try {
    -  480  61 
                 psV = getConnection().prepareStatement(SELECT_VULNERABILITY);
    -  481  61 
                 psV.setString(1, cve);
    -  482  61 
                 rsV = psV.executeQuery();
    -  483  61 
                 if (rsV.next()) {
    -  484  61 
                     vuln = new Vulnerability();
    -  485  61 
                     vuln.setName(cve);
    -  486  61 
                     vuln.setDescription(rsV.getString(2));
    -  487  61 
                     String cwe = rsV.getString(3);
    -  488  61 
                     if (cwe != null) {
    -  489  50 
                         final String name = CweDB.getCweName(cwe);
    -  490  50 
                         if (name != null) {
    -  491  48 
                             cwe += " " + name;
    -  492   +  482  122 
                 psV = getConnection().prepareStatement(SELECT_VULNERABILITY);
    +  483  122 
                 psV.setString(1, cve);
    +  484  122 
                 rsV = psV.executeQuery();
    +  485  122 
                 if (rsV.next()) {
    +  486  122 
                     vuln = new Vulnerability();
    +  487  122 
                     vuln.setName(cve);
    +  488  122 
                     vuln.setDescription(rsV.getString(2));
    +  489  122 
                     String cwe = rsV.getString(3);
    +  490  122 
                     if (cwe != null) {
    +  491  100 
                         final String name = CweDB.getCweName(cwe);
    +  492  100 
                         if (name != null) {
    +  493  96 
                             cwe += " " + name;
    +  494   
                         }
    -  493   +  495   
                     }
    -  494  61 
                     final int cveId = rsV.getInt(1);
    -  495  61 
                     vuln.setCwe(cwe);
    -  496  61 
                     vuln.setCvssScore(rsV.getFloat(4));
    -  497  61 
                     vuln.setCvssAccessVector(rsV.getString(5));
    -  498  61 
                     vuln.setCvssAccessComplexity(rsV.getString(6));
    -  499  61 
                     vuln.setCvssAuthentication(rsV.getString(7));
    -  500  61 
                     vuln.setCvssConfidentialityImpact(rsV.getString(8));
    -  501  61 
                     vuln.setCvssIntegrityImpact(rsV.getString(9));
    -  502  61 
                     vuln.setCvssAvailabilityImpact(rsV.getString(10));
    -  503   +  496  122 
                     final int cveId = rsV.getInt(1);
    +  497  122 
                     vuln.setCwe(cwe);
    +  498  122 
                     vuln.setCvssScore(rsV.getFloat(4));
    +  499  122 
                     vuln.setCvssAccessVector(rsV.getString(5));
    +  500  122 
                     vuln.setCvssAccessComplexity(rsV.getString(6));
    +  501  122 
                     vuln.setCvssAuthentication(rsV.getString(7));
    +  502  122 
                     vuln.setCvssConfidentialityImpact(rsV.getString(8));
    +  503  122 
                     vuln.setCvssIntegrityImpact(rsV.getString(9));
    +  504  122 
                     vuln.setCvssAvailabilityImpact(rsV.getString(10));
    +  505   
     
    -  504  61 
                     psR = getConnection().prepareStatement(SELECT_REFERENCE);
    -  505  61 
                     psR.setInt(1, cveId);
    -  506  61 
                     rsR = psR.executeQuery();
    -  507  477 
                     while (rsR.next()) {
    -  508  416 
                         vuln.addReference(rsR.getString(1), rsR.getString(2), rsR.getString(3));
    -  509   +  506  122 
                     psR = getConnection().prepareStatement(SELECT_REFERENCE);
    +  507  122 
                     psR.setInt(1, cveId);
    +  508  122 
                     rsR = psR.executeQuery();
    +  509  982 
                     while (rsR.next()) {
    +  510  860 
                         vuln.addReference(rsR.getString(1), rsR.getString(2), rsR.getString(3));
    +  511   
                     }
    -  510  61 
                     psS = getConnection().prepareStatement(SELECT_SOFTWARE);
    -  511  61 
                     psS.setInt(1, cveId);
    -  512  61 
                     rsS = psS.executeQuery();
    -  513  2765 
                     while (rsS.next()) {
    -  514  2704 
                         final String cpe = rsS.getString(1);
    -  515  2704 
                         final String prevVersion = rsS.getString(2);
    -  516  2704 
                         if (prevVersion == null) {
    -  517  2662 
                             vuln.addVulnerableSoftware(cpe);
    -  518   - 
                         } else {
    -  519  42 
                             vuln.addVulnerableSoftware(cpe, prevVersion);
    +  512  122 
                     psS = getConnection().prepareStatement(SELECT_SOFTWARE);
    +  513  122 
                     psS.setInt(1, cveId);
    +  514  122 
                     rsS = psS.executeQuery();
    +  515  5530 
                     while (rsS.next()) {
    +  516  5408 
                         final String cpe = rsS.getString(1);
    +  517  5408 
                         final String prevVersion = rsS.getString(2);
    +  518  5408 
                         if (prevVersion == null) {
    +  519  5324 
                             vuln.addVulnerableSoftware(cpe);
     520   - 
                         }
    -  521  2704 
                     }
    + 
                         } else {
    +  521  84 
                             vuln.addVulnerableSoftware(cpe, prevVersion);
     522   - 
                 }
    -  523  0 
             } catch (SQLException ex) {
    -  524  0 
                 throw new DatabaseException("Error retrieving " + cve, ex);
    -  525   - 
             } finally {
    -  526  61 
                 DBUtils.closeResultSet(rsV);
    -  527  61 
                 DBUtils.closeResultSet(rsR);
    -  528  61 
                 DBUtils.closeResultSet(rsS);
    -  529  61 
                 DBUtils.closeStatement(psV);
    -  530  61 
                 DBUtils.closeStatement(psR);
    -  531  61 
                 DBUtils.closeStatement(psS);
    -  532  61 
             }
    -  533  61 
             return vuln;
    -  534   - 
         }
    -  535   - 
     
    -  536   - 
         /**
    -  537   - 
          * Updates the vulnerability within the database. If the vulnerability does not exist it will be added.
    -  538   - 
          *
    -  539   - 
          * @param vuln the vulnerability to add to the database
    -  540   - 
          * @throws DatabaseException is thrown if the database
    -  541   - 
          */
    -  542   - 
         public void updateVulnerability(Vulnerability vuln) throws DatabaseException {
    -  543  0 
             PreparedStatement selectVulnerabilityId = null;
    -  544  0 
             PreparedStatement deleteVulnerability = null;
    -  545  0 
             PreparedStatement deleteReferences = null;
    -  546  0 
             PreparedStatement deleteSoftware = null;
    -  547  0 
             PreparedStatement updateVulnerability = null;
    -  548  0 
             PreparedStatement insertVulnerability = null;
    -  549  0 
             PreparedStatement insertReference = null;
    -  550  0 
             PreparedStatement selectCpeId = null;
    -  551  0 
             PreparedStatement insertCpe = null;
    -  552  0 
             PreparedStatement insertSoftware = null;
    -  553   - 
     
    -  554   - 
             try {
    -  555  0 
                 selectVulnerabilityId = getConnection().prepareStatement(SELECT_VULNERABILITY_ID);
    -  556  0 
                 deleteVulnerability = getConnection().prepareStatement(DELETE_VULNERABILITY);
    -  557  0 
                 deleteReferences = getConnection().prepareStatement(DELETE_REFERENCE);
    -  558  0 
                 deleteSoftware = getConnection().prepareStatement(DELETE_SOFTWARE);
    -  559  0 
                 updateVulnerability = getConnection().prepareStatement(UPDATE_VULNERABILITY);
    -  560  0 
                 insertVulnerability = getConnection().prepareStatement(INSERT_VULNERABILITY, Statement.RETURN_GENERATED_KEYS);
    -  561  0 
                 insertReference = getConnection().prepareStatement(INSERT_REFERENCE);
    -  562  0 
                 selectCpeId = getConnection().prepareStatement(SELECT_CPE_ID);
    -  563  0 
                 insertCpe = getConnection().prepareStatement(INSERT_CPE, Statement.RETURN_GENERATED_KEYS);
    -  564  0 
                 insertSoftware = getConnection().prepareStatement(INSERT_SOFTWARE);
    -  565  0 
                 int vulnerabilityId = 0;
    -  566  0 
                 selectVulnerabilityId.setString(1, vuln.getName());
    -  567  0 
                 ResultSet rs = selectVulnerabilityId.executeQuery();
    -  568  0 
                 if (rs.next()) {
    -  569  0 
                     vulnerabilityId = rs.getInt(1);
    -  570   - 
                     // first delete any existing vulnerability info. We don't know what was updated. yes, slower but atm easier.
    -  571  0 
                     deleteReferences.setInt(1, vulnerabilityId);
    -  572  0 
                     deleteReferences.execute();
    -  573  0 
                     deleteSoftware.setInt(1, vulnerabilityId);
    -  574  0 
                     deleteSoftware.execute();
    -  575   - 
                 }
    -  576  0 
                 DBUtils.closeResultSet(rs);
    -  577  0 
                 rs = null;
    -  578  0 
                 if (vulnerabilityId != 0) {
    -  579  0 
                     if (vuln.getDescription().contains("** REJECT **")) {
    -  580  0 
                         deleteVulnerability.setInt(1, vulnerabilityId);
    -  581  0 
                         deleteVulnerability.executeUpdate();
    -  582   - 
                     } else {
    -  583  0 
                         updateVulnerability.setString(1, vuln.getDescription());
    -  584  0 
                         updateVulnerability.setString(2, vuln.getCwe());
    -  585  0 
                         updateVulnerability.setFloat(3, vuln.getCvssScore());
    -  586  0 
                         updateVulnerability.setString(4, vuln.getCvssAccessVector());
    -  587  0 
                         updateVulnerability.setString(5, vuln.getCvssAccessComplexity());
    -  588  0 
                         updateVulnerability.setString(6, vuln.getCvssAuthentication());
    -  589  0 
                         updateVulnerability.setString(7, vuln.getCvssConfidentialityImpact());
    -  590  0 
                         updateVulnerability.setString(8, vuln.getCvssIntegrityImpact());
    -  591  0 
                         updateVulnerability.setString(9, vuln.getCvssAvailabilityImpact());
    -  592  0 
                         updateVulnerability.setInt(10, vulnerabilityId);
    -  593  0 
                         updateVulnerability.executeUpdate();
    -  594   - 
                     }
    -  595   - 
                 } else {
    -  596  0 
                     insertVulnerability.setString(1, vuln.getName());
    -  597  0 
                     insertVulnerability.setString(2, vuln.getDescription());
    -  598  0 
                     insertVulnerability.setString(3, vuln.getCwe());
    -  599  0 
                     insertVulnerability.setFloat(4, vuln.getCvssScore());
    -  600  0 
                     insertVulnerability.setString(5, vuln.getCvssAccessVector());
    -  601  0 
                     insertVulnerability.setString(6, vuln.getCvssAccessComplexity());
    -  602  0 
                     insertVulnerability.setString(7, vuln.getCvssAuthentication());
    -  603  0 
                     insertVulnerability.setString(8, vuln.getCvssConfidentialityImpact());
    -  604  0 
                     insertVulnerability.setString(9, vuln.getCvssIntegrityImpact());
    -  605  0 
                     insertVulnerability.setString(10, vuln.getCvssAvailabilityImpact());
    -  606  0 
                     insertVulnerability.execute();
    -  607   - 
                     try {
    -  608  0 
                         rs = insertVulnerability.getGeneratedKeys();
    -  609  0 
                         rs.next();
    -  610  0 
                         vulnerabilityId = rs.getInt(1);
    -  611  0 
                     } catch (SQLException ex) {
    -  612  0 
                         final String msg = String.format("Unable to retrieve id for new vulnerability for '%s'", vuln.getName());
    -  613  0 
                         throw new DatabaseException(msg, ex);
    -  614   - 
                     } finally {
    -  615  0 
                         DBUtils.closeResultSet(rs);
    -  616  0 
                         rs = null;
    -  617  0 
                     }
    -  618   - 
                 }
    -  619  0 
                 insertReference.setInt(1, vulnerabilityId);
    -  620  0 
                 for (Reference r : vuln.getReferences()) {
    -  621  0 
                     insertReference.setString(2, r.getName());
    -  622  0 
                     insertReference.setString(3, r.getUrl());
    -  623  0 
                     insertReference.setString(4, r.getSource());
    -  624  0 
                     insertReference.execute();
    -  625  0 
                 }
    -  626  0 
                 for (VulnerableSoftware s : vuln.getVulnerableSoftware()) {
    -  627  0 
                     int cpeProductId = 0;
    -  628  0 
                     selectCpeId.setString(1, s.getName());
    -  629   - 
                     try {
    -  630  0 
                         rs = selectCpeId.executeQuery();
    -  631  0 
                         if (rs.next()) {
    -  632  0 
                             cpeProductId = rs.getInt(1);
    -  633   
                         }
    -  634  0 
                     } catch (SQLException ex) {
    -  635  0 
                         throw new DatabaseException("Unable to get primary key for new cpe: " + s.getName(), ex);
    -  636   - 
                     } finally {
    -  637  0 
                         DBUtils.closeResultSet(rs);
    -  638  0 
                         rs = null;
    -  639  0 
                     }
    -  640   +  523  5408 
                     }
    +  524   + 
                 }
    +  525  0 
             } catch (SQLException ex) {
    +  526  0 
                 throw new DatabaseException("Error retrieving " + cve, ex);
    +  527   + 
             } finally {
    +  528  122 
                 DBUtils.closeResultSet(rsV);
    +  529  122 
                 DBUtils.closeResultSet(rsR);
    +  530  122 
                 DBUtils.closeResultSet(rsS);
    +  531  122 
                 DBUtils.closeStatement(psV);
    +  532  122 
                 DBUtils.closeStatement(psR);
    +  533  122 
                 DBUtils.closeStatement(psS);
    +  534  122 
             }
    +  535  122 
             return vuln;
    +  536   + 
         }
    +  537   
     
    -  641  0 
                     if (cpeProductId == 0) {
    -  642  0 
                         insertCpe.setString(1, s.getName());
    -  643  0 
                         insertCpe.setString(2, s.getVendor());
    -  644  0 
                         insertCpe.setString(3, s.getProduct());
    -  645  0 
                         insertCpe.executeUpdate();
    -  646  0 
                         cpeProductId = DBUtils.getGeneratedKey(insertCpe);
    -  647   - 
                     }
    -  648  0 
                     if (cpeProductId == 0) {
    -  649  0 
                         throw new DatabaseException("Unable to retrieve cpeProductId - no data returned");
    -  650   - 
                     }
    -  651   +  538   + 
         /**
    +  539   + 
          * Updates the vulnerability within the database. If the vulnerability does not exist it will be added.
    +  540   + 
          *
    +  541   + 
          * @param vuln the vulnerability to add to the database
    +  542   + 
          * @throws DatabaseException is thrown if the database
    +  543   + 
          */
    +  544   + 
         public void updateVulnerability(Vulnerability vuln) throws DatabaseException {
    +  545  0 
             PreparedStatement selectVulnerabilityId = null;
    +  546  0 
             PreparedStatement deleteVulnerability = null;
    +  547  0 
             PreparedStatement deleteReferences = null;
    +  548  0 
             PreparedStatement deleteSoftware = null;
    +  549  0 
             PreparedStatement updateVulnerability = null;
    +  550  0 
             PreparedStatement insertVulnerability = null;
    +  551  0 
             PreparedStatement insertReference = null;
    +  552  0 
             PreparedStatement selectCpeId = null;
    +  553  0 
             PreparedStatement insertCpe = null;
    +  554  0 
             PreparedStatement insertSoftware = null;
    +  555   
     
    -  652  0 
                     insertSoftware.setInt(1, vulnerabilityId);
    -  653  0 
                     insertSoftware.setInt(2, cpeProductId);
    -  654  0 
                     if (s.getPreviousVersion() == null) {
    -  655  0 
                         insertSoftware.setNull(3, java.sql.Types.VARCHAR);
    -  656   +  556   + 
             try {
    +  557  0 
                 selectVulnerabilityId = getConnection().prepareStatement(SELECT_VULNERABILITY_ID);
    +  558  0 
                 deleteVulnerability = getConnection().prepareStatement(DELETE_VULNERABILITY);
    +  559  0 
                 deleteReferences = getConnection().prepareStatement(DELETE_REFERENCE);
    +  560  0 
                 deleteSoftware = getConnection().prepareStatement(DELETE_SOFTWARE);
    +  561  0 
                 updateVulnerability = getConnection().prepareStatement(UPDATE_VULNERABILITY);
    +  562  0 
                 insertVulnerability = getConnection().prepareStatement(INSERT_VULNERABILITY, Statement.RETURN_GENERATED_KEYS);
    +  563  0 
                 insertReference = getConnection().prepareStatement(INSERT_REFERENCE);
    +  564  0 
                 selectCpeId = getConnection().prepareStatement(SELECT_CPE_ID);
    +  565  0 
                 insertCpe = getConnection().prepareStatement(INSERT_CPE, Statement.RETURN_GENERATED_KEYS);
    +  566  0 
                 insertSoftware = getConnection().prepareStatement(INSERT_SOFTWARE);
    +  567  0 
                 int vulnerabilityId = 0;
    +  568  0 
                 selectVulnerabilityId.setString(1, vuln.getName());
    +  569  0 
                 ResultSet rs = selectVulnerabilityId.executeQuery();
    +  570  0 
                 if (rs.next()) {
    +  571  0 
                     vulnerabilityId = rs.getInt(1);
    +  572   + 
                     // first delete any existing vulnerability info. We don't know what was updated. yes, slower but atm easier.
    +  573  0 
                     deleteReferences.setInt(1, vulnerabilityId);
    +  574  0 
                     deleteReferences.execute();
    +  575  0 
                     deleteSoftware.setInt(1, vulnerabilityId);
    +  576  0 
                     deleteSoftware.execute();
    +  577   + 
                 }
    +  578  0 
                 DBUtils.closeResultSet(rs);
    +  579  0 
                 rs = null;
    +  580  0 
                 if (vulnerabilityId != 0) {
    +  581  0 
                     if (vuln.getDescription().contains("** REJECT **")) {
    +  582  0 
                         deleteVulnerability.setInt(1, vulnerabilityId);
    +  583  0 
                         deleteVulnerability.executeUpdate();
    +  584   
                     } else {
    -  657  0 
                         insertSoftware.setString(3, s.getPreviousVersion());
    +  585  0 
                         updateVulnerability.setString(1, vuln.getDescription());
    +  586  0 
                         updateVulnerability.setString(2, vuln.getCwe());
    +  587  0 
                         updateVulnerability.setFloat(3, vuln.getCvssScore());
    +  588  0 
                         updateVulnerability.setString(4, vuln.getCvssAccessVector());
    +  589  0 
                         updateVulnerability.setString(5, vuln.getCvssAccessComplexity());
    +  590  0 
                         updateVulnerability.setString(6, vuln.getCvssAuthentication());
    +  591  0 
                         updateVulnerability.setString(7, vuln.getCvssConfidentialityImpact());
    +  592  0 
                         updateVulnerability.setString(8, vuln.getCvssIntegrityImpact());
    +  593  0 
                         updateVulnerability.setString(9, vuln.getCvssAvailabilityImpact());
    +  594  0 
                         updateVulnerability.setInt(10, vulnerabilityId);
    +  595  0 
                         updateVulnerability.executeUpdate();
    +  596   + 
                     }
    +  597   + 
                 } else {
    +  598  0 
                     insertVulnerability.setString(1, vuln.getName());
    +  599  0 
                     insertVulnerability.setString(2, vuln.getDescription());
    +  600  0 
                     insertVulnerability.setString(3, vuln.getCwe());
    +  601  0 
                     insertVulnerability.setFloat(4, vuln.getCvssScore());
    +  602  0 
                     insertVulnerability.setString(5, vuln.getCvssAccessVector());
    +  603  0 
                     insertVulnerability.setString(6, vuln.getCvssAccessComplexity());
    +  604  0 
                     insertVulnerability.setString(7, vuln.getCvssAuthentication());
    +  605  0 
                     insertVulnerability.setString(8, vuln.getCvssConfidentialityImpact());
    +  606  0 
                     insertVulnerability.setString(9, vuln.getCvssIntegrityImpact());
    +  607  0 
                     insertVulnerability.setString(10, vuln.getCvssAvailabilityImpact());
    +  608  0 
                     insertVulnerability.execute();
    +  609   + 
                     try {
    +  610  0 
                         rs = insertVulnerability.getGeneratedKeys();
    +  611  0 
                         rs.next();
    +  612  0 
                         vulnerabilityId = rs.getInt(1);
    +  613  0 
                     } catch (SQLException ex) {
    +  614  0 
                         final String msg = String.format("Unable to retrieve id for new vulnerability for '%s'", vuln.getName());
    +  615  0 
                         throw new DatabaseException(msg, ex);
    +  616   + 
                     } finally {
    +  617  0 
                         DBUtils.closeResultSet(rs);
    +  618  0 
                         rs = null;
    +  619  0 
                     }
    +  620   + 
                 }
    +  621  0 
                 insertReference.setInt(1, vulnerabilityId);
    +  622  0 
                 for (Reference r : vuln.getReferences()) {
    +  623  0 
                     insertReference.setString(2, r.getName());
    +  624  0 
                     insertReference.setString(3, r.getUrl());
    +  625  0 
                     insertReference.setString(4, r.getSource());
    +  626  0 
                     insertReference.execute();
    +  627  0 
                 }
    +  628  0 
                 for (VulnerableSoftware s : vuln.getVulnerableSoftware()) {
    +  629  0 
                     int cpeProductId = 0;
    +  630  0 
                     selectCpeId.setString(1, s.getName());
    +  631   + 
                     try {
    +  632  0 
                         rs = selectCpeId.executeQuery();
    +  633  0 
                         if (rs.next()) {
    +  634  0 
                             cpeProductId = rs.getInt(1);
    +  635   + 
                         }
    +  636  0 
                     } catch (SQLException ex) {
    +  637  0 
                         throw new DatabaseException("Unable to get primary key for new cpe: " + s.getName(), ex);
    +  638   + 
                     } finally {
    +  639  0 
                         DBUtils.closeResultSet(rs);
    +  640  0 
                         rs = null;
    +  641  0 
                     }
    +  642   + 
     
    +  643  0 
                     if (cpeProductId == 0) {
    +  644  0 
                         insertCpe.setString(1, s.getName());
    +  645  0 
                         insertCpe.setString(2, s.getVendor());
    +  646  0 
                         insertCpe.setString(3, s.getProduct());
    +  647  0 
                         insertCpe.executeUpdate();
    +  648  0 
                         cpeProductId = DBUtils.getGeneratedKey(insertCpe);
    +  649   + 
                     }
    +  650  0 
                     if (cpeProductId == 0) {
    +  651  0 
                         throw new DatabaseException("Unable to retrieve cpeProductId - no data returned");
    +  652   + 
                     }
    +  653   + 
     
    +  654  0 
                     insertSoftware.setInt(1, vulnerabilityId);
    +  655  0 
                     insertSoftware.setInt(2, cpeProductId);
    +  656  0 
                     if (s.getPreviousVersion() == null) {
    +  657  0 
                         insertSoftware.setNull(3, java.sql.Types.VARCHAR);
     658   + 
                     } else {
    +  659  0 
                         insertSoftware.setString(3, s.getPreviousVersion());
    +  660   
                     }
    -  659  0 
                     insertSoftware.execute();
    -  660  0 
                 }
    -  661   +  661  0 
                     insertSoftware.execute();
    +  662  0 
                 }
    +  663   
     
    -  662  0 
             } catch (SQLException ex) {
    -  663  0 
                 final String msg = String.format("Error updating '%s'", vuln.getName());
    -  664  0 
                 Logger.getLogger(CveDB.class.getName()).log(Level.FINE, null, ex);
    -  665  0 
                 throw new DatabaseException(msg, ex);
    -  666   +  664  0 
             } catch (SQLException ex) {
    +  665  0 
                 final String msg = String.format("Error updating '%s'", vuln.getName());
    +  666  0 
                 Logger.getLogger(CveDB.class.getName()).log(Level.FINE, null, ex);
    +  667  0 
                 throw new DatabaseException(msg, ex);
    +  668   
             } finally {
    -  667  0 
                 DBUtils.closeStatement(selectVulnerabilityId);
    -  668  0 
                 DBUtils.closeStatement(deleteReferences);
    -  669  0 
                 DBUtils.closeStatement(deleteSoftware);
    -  670  0 
                 DBUtils.closeStatement(updateVulnerability);
    -  671  0 
                 DBUtils.closeStatement(deleteVulnerability);
    -  672  0 
                 DBUtils.closeStatement(insertVulnerability);
    -  673  0 
                 DBUtils.closeStatement(insertReference);
    -  674  0 
                 DBUtils.closeStatement(selectCpeId);
    -  675  0 
                 DBUtils.closeStatement(insertCpe);
    -  676  0 
                 DBUtils.closeStatement(insertSoftware);
    -  677  0 
             }
    -  678  0 
         }
    -  679   - 
     
    -  680   - 
         /**
    +  669  0 
                 DBUtils.closeStatement(selectVulnerabilityId);
    +  670  0 
                 DBUtils.closeStatement(deleteReferences);
    +  671  0 
                 DBUtils.closeStatement(deleteSoftware);
    +  672  0 
                 DBUtils.closeStatement(updateVulnerability);
    +  673  0 
                 DBUtils.closeStatement(deleteVulnerability);
    +  674  0 
                 DBUtils.closeStatement(insertVulnerability);
    +  675  0 
                 DBUtils.closeStatement(insertReference);
    +  676  0 
                 DBUtils.closeStatement(selectCpeId);
    +  677  0 
                 DBUtils.closeStatement(insertCpe);
    +  678  0 
                 DBUtils.closeStatement(insertSoftware);
    +  679  0 
             }
    +  680  0 
         }
     681   - 
          * It is possible that orphaned rows may be generated during database updates. This should be called after all
    + 
     
     682   - 
          * updates have been completed to ensure orphan entries are removed.
    + 
         /**
     683   - 
          */
    + 
          * It is possible that orphaned rows may be generated during database updates. This should be called after all
     684   - 
         public void cleanupDatabase() {
    -  685  0 
             PreparedStatement ps = null;
    + 
          * updates have been completed to ensure orphan entries are removed.
    +  685   + 
          */
     686   + 
         public void cleanupDatabase() {
    +  687  0 
             PreparedStatement ps = null;
    +  688   
             try {
    -  687  0 
                 ps = getConnection().prepareStatement(CLEANUP_ORPHANS);
    -  688  0 
                 if (ps != null) {
    -  689  0 
                     ps.executeUpdate();
    -  690   +  689  0 
                 ps = getConnection().prepareStatement(CLEANUP_ORPHANS);
    +  690  0 
                 if (ps != null) {
    +  691  0 
                     ps.executeUpdate();
    +  692   
                 }
    -  691  0 
             } catch (SQLException ex) {
    -  692  0 
                 final String msg = "An unexpected SQL Exception occurred; please see the verbose log for more details.";
    -  693  0 
                 Logger.getLogger(CveDB.class.getName()).log(Level.SEVERE, msg);
    -  694  0 
                 Logger.getLogger(CveDB.class.getName()).log(Level.FINE, null, ex);
    -  695   +  693  0 
             } catch (SQLException ex) {
    +  694  0 
                 final String msg = "An unexpected SQL Exception occurred; please see the verbose log for more details.";
    +  695  0 
                 Logger.getLogger(CveDB.class.getName()).log(Level.SEVERE, msg);
    +  696  0 
                 Logger.getLogger(CveDB.class.getName()).log(Level.FINE, null, ex);
    +  697   
             } finally {
    -  696  0 
                 DBUtils.closeStatement(ps);
    -  697  0 
             }
    -  698  0 
         }
    -  699   - 
     
    -  700   - 
         /**
    +  698  0 
                 DBUtils.closeStatement(ps);
    +  699  0 
             }
    +  700  0 
         }
     701   - 
          * Determines if the given identifiedVersion is affected by the given cpeId and previous version flag. A non-null,
    + 
     
     702   - 
          * non-empty string passed to the previous version argument indicates that all previous versions are affected.
    + 
         /**
     703   - 
          *
    + 
          * Determines if the given identifiedVersion is affected by the given cpeId and previous version flag. A non-null,
     704   - 
          * @param vendor the vendor of the dependency being analyzed
    + 
          * non-empty string passed to the previous version argument indicates that all previous versions are affected.
     705   - 
          * @param product the product name of the dependency being analyzed
    + 
          *
     706   - 
          * @param identifiedVersion the identified version of the dependency being analyzed
    + 
          * @param vendor the vendor of the dependency being analyzed
     707   - 
          * @param cpeId the cpe identifier of software that has a known vulnerability
    + 
          * @param product the product name of the dependency being analyzed
     708   - 
          * @param previous a flag indicating if previous versions of the product are vulnerable
    + 
          * @param identifiedVersion the identified version of the dependency being analyzed
     709   - 
          * @return true if the identified version is affected, otherwise false
    + 
          * @param cpeId the cpe identifier of software that has a known vulnerability
     710   - 
          */
    + 
          * @param previous a flag indicating if previous versions of the product are vulnerable
     711   + 
          * @return true if the identified version is affected, otherwise false
    +  712   + 
          */
    +  713   
         private boolean isAffected(String vendor, String product, DependencyVersion identifiedVersion, String cpeId, String previous) {
    -  712  3532 
             boolean affected = false;
    -  713  3532 
             final boolean isStruts = "apache".equals(vendor) && "struts".equals(product);
    -  714  3532 
             final DependencyVersion v = parseDependencyVersion(cpeId);
    -  715  3532 
             final boolean prevAffected = previous != null && !previous.isEmpty();
    -  716  3532 
             if (identifiedVersion == null || "-".equals(identifiedVersion.toString())) {
    -  717  96 
                 if (v == null || "-".equals(v.toString())) {
    -  718  0 
                     affected = true;
    -  719   +  714  7064 
             boolean affected = false;
    +  715  7064 
             final boolean isStruts = "apache".equals(vendor) && "struts".equals(product);
    +  716  7064 
             final DependencyVersion v = parseDependencyVersion(cpeId);
    +  717  7064 
             final boolean prevAffected = previous != null && !previous.isEmpty();
    +  718  7064 
             if (identifiedVersion == null || "-".equals(identifiedVersion.toString())) {
    +  719  192 
                 if (v == null || "-".equals(v.toString())) {
    +  720  0 
                     affected = true;
    +  721   
                 }
    -  720  3436 
             } else if (identifiedVersion.equals(v) || (prevAffected && identifiedVersion.compareTo(v) < 0)) {
    -  721  83 
                 if (isStruts) { //struts 2 vulns don't affect struts 1
    -  722  72 
                     if (identifiedVersion.getVersionParts().get(0).equals(v.getVersionParts().get(0))) {
    -  723  50 
                         affected = true;
    -  724   +  722  6872 
             } else if (identifiedVersion.equals(v) || (prevAffected && identifiedVersion.compareTo(v) < 0)) {
    +  723  166 
                 if (isStruts) { //struts 2 vulns don't affect struts 1
    +  724  144 
                     if (identifiedVersion.getVersionParts().get(0).equals(v.getVersionParts().get(0))) {
    +  725  100 
                         affected = true;
    +  726   
                     }
    -  725   - 
                 } else {
    -  726  11 
                     affected = true;
     727   - 
                 }
    -  728   - 
             }
    -  729   - 
             /*
    -  730   - 
              * TODO consider utilizing the matchThreeVersion method to get additional results. However, this
    -  731   - 
              *      might also introduce false positives.
    -  732   - 
              */
    -  733  3532 
             return affected;
    -  734   - 
         }
    -  735   - 
     
    -  736   - 
         /**
    -  737   - 
          * Parses the version (including revision) from a CPE identifier. If no version is identified then a '-' is
    -  738   - 
          * returned.
    -  739   - 
          *
    -  740   - 
          * @param cpeStr a cpe identifier
    -  741   - 
          * @return a dependency version
    -  742   - 
          */
    -  743   - 
         private DependencyVersion parseDependencyVersion(String cpeStr) {
    -  744  3532 
             final VulnerableSoftware cpe = new VulnerableSoftware();
    -  745   - 
             try {
    -  746  3532 
                 cpe.parseName(cpeStr);
    -  747  0 
             } catch (UnsupportedEncodingException ex) {
    -  748   - 
                 //never going to happen.
    -  749  0 
                 Logger.getLogger(CveDB.class.getName()).log(Level.FINEST, null, ex);
    -  750  3532 
             }
    -  751  3532 
             return parseDependencyVersion(cpe);
    -  752   - 
         }
    -  753   - 
     
    -  754   - 
         /**
    -  755   - 
          * Takes a CPE and parses out the version number. If no version is identified then a '-' is returned.
    -  756   - 
          *
    -  757   - 
          * @param cpe a cpe object
    -  758   - 
          * @return a dependency version
    -  759   - 
          */
    -  760   - 
         private DependencyVersion parseDependencyVersion(VulnerableSoftware cpe) {
    -  761   - 
             DependencyVersion cpeVersion;
    -  762  3544 
             if (cpe.getVersion() != null && cpe.getVersion().length() > 0) {
    -  763   - 
                 String versionText;
    -  764  3540 
                 if (cpe.getRevision() != null && cpe.getRevision().length() > 0) {
    -  765  441 
                     versionText = String.format("%s.%s", cpe.getVersion(), cpe.getRevision());
    -  766   
                 } else {
    -  767  3099 
                     versionText = cpe.getVersion();
    -  768   +  728  22 
                     affected = true;
    +  729   
                 }
    -  769  3540 
                 cpeVersion = DependencyVersionUtil.parseVersion(versionText);
    -  770  3540 
             } else {
    -  771  4 
                 cpeVersion = new DependencyVersion("-");
    -  772   +  730   
             }
    -  773  3544 
             return cpeVersion;
    -  774   +  731   + 
             /*
    +  732   + 
              * TODO consider utilizing the matchThreeVersion method to get additional results. However, this
    +  733   + 
              *      might also introduce false positives.
    +  734   + 
              */
    +  735  7064 
             return affected;
    +  736   
         }
    -  775   +  737   + 
     
    +  738   + 
         /**
    +  739   + 
          * Parses the version (including revision) from a CPE identifier. If no version is identified then a '-' is
    +  740   + 
          * returned.
    +  741   + 
          *
    +  742   + 
          * @param cpeStr a cpe identifier
    +  743   + 
          * @return a dependency version
    +  744   + 
          */
    +  745   + 
         private DependencyVersion parseDependencyVersion(String cpeStr) {
    +  746  7064 
             final VulnerableSoftware cpe = new VulnerableSoftware();
    +  747   + 
             try {
    +  748  7064 
                 cpe.parseName(cpeStr);
    +  749  0 
             } catch (UnsupportedEncodingException ex) {
    +  750   + 
                 //never going to happen.
    +  751  0 
                 Logger.getLogger(CveDB.class.getName()).log(Level.FINEST, null, ex);
    +  752  7064 
             }
    +  753  7064 
             return parseDependencyVersion(cpe);
    +  754   + 
         }
    +  755   + 
     
    +  756   + 
         /**
    +  757   + 
          * Takes a CPE and parses out the version number. If no version is identified then a '-' is returned.
    +  758   + 
          *
    +  759   + 
          * @param cpe a cpe object
    +  760   + 
          * @return a dependency version
    +  761   + 
          */
    +  762   + 
         private DependencyVersion parseDependencyVersion(VulnerableSoftware cpe) {
    +  763   + 
             DependencyVersion cpeVersion;
    +  764  7088 
             if (cpe.getVersion() != null && cpe.getVersion().length() > 0) {
    +  765   + 
                 String versionText;
    +  766  7080 
                 if (cpe.getRevision() != null && cpe.getRevision().length() > 0) {
    +  767  882 
                     versionText = String.format("%s.%s", cpe.getVersion(), cpe.getRevision());
    +  768   + 
                 } else {
    +  769  6198 
                     versionText = cpe.getVersion();
    +  770   + 
                 }
    +  771  7080 
                 cpeVersion = DependencyVersionUtil.parseVersion(versionText);
    +  772  7080 
             } else {
    +  773  8 
                 cpeVersion = new DependencyVersion("-");
    +  774   + 
             }
    +  775  7088 
             return cpeVersion;
    +  776   + 
         }
    +  777   
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.DatabaseException.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.DatabaseException.html index 83be5378e..c2388247f 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.DatabaseException.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.DatabaseException.html @@ -24,115 +24,113 @@  3   
      *
     4   - 
      * Dependency-check-core is free software: you can redistribute it and/or modify it
    + 
      * Licensed under the Apache License, Version 2.0 (the "License");
     5   - 
      * under the terms of the GNU General Public License as published by the Free
    + 
      * you may not use this file except in compliance with the License.
     6   - 
      * Software Foundation, either version 3 of the License, or (at your option) any
    + 
      * You may obtain a copy of the License at
     7   - 
      * later version.
    + 
      *
     8   - 
      *
    + 
      *     http://www.apache.org/licenses/LICENSE-2.0
     9   - 
      * Dependency-check-core is distributed in the hope that it will be useful, but
    + 
      *
     10   - 
      * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
    + 
      * Unless required by applicable law or agreed to in writing, software
     11   - 
      * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
    + 
      * distributed under the License is distributed on an "AS IS" BASIS,
     12   - 
      * details.
    + 
      * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13   - 
      *
    + 
      * See the License for the specific language governing permissions and
     14   - 
      * You should have received a copy of the GNU General Public License along with
    + 
      * limitations under the License.
     15   - 
      * dependency-check-core. If not, see http://www.gnu.org/licenses/.
    + 
      *
     16   - 
      *
    -  17   
      * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
    +  17   + 
      */
     18   - 
      */
    -  19   
     package org.owasp.dependencycheck.data.nvdcve;
    +  19   + 
     
     20   - 
     
    -  21   
     /**
    -  22   +  21   
      * An exception thrown if an operation against the database fails.
    -  23   +  22   
      *
    -  24   +  23   
      * @author Jeremy Long <jeremy.long@owasp.org>
    -  25   +  24   
      */
    -  26   +  25   
     public class DatabaseException extends Exception {
    +  26   + 
     
     27   - 
     
    + 
         /**
     28   - 
         /**
    -  29   
          * the serial version uid.
    +  29   + 
          */
     30   - 
          */
    -  31   
         private static final long serialVersionUID = 1L;
    +  31   + 
     
     32   - 
     
    + 
         /**
     33   - 
         /**
    + 
          * Creates an DatabaseException.
     34   - 
          * Creates an DatabaseException.
    + 
          *
     35   - 
          *
    + 
          * @param msg the exception message
     36   - 
          * @param msg the exception message
    + 
          */
     37   - 
          */
    -  38   
         public DatabaseException(String msg) {
    -  39  0 
             super(msg);
    -  40  0 
         }
    +  38  0 
             super(msg);
    +  39  0 
         }
    +  40   + 
     
     41   - 
     
    + 
         /**
     42   - 
         /**
    + 
          * Creates an DatabaseException.
     43   - 
          * Creates an DatabaseException.
    + 
          *
     44   - 
          *
    + 
          * @param ex the cause of the exception
     45   - 
          * @param ex the cause of the exception
    + 
          */
     46   - 
          */
    -  47   
         public DatabaseException(Throwable ex) {
    -  48  0 
             super(ex);
    -  49  0 
         }
    -  50   +  47  0 
             super(ex);
    +  48  0 
         }
    +  49   
     
    -  51   +  50   
         /**
    -  52   +  51   
          * Creates an DatabaseException.
    -  53   +  52   
          *
    -  54   +  53   
          * @param msg the exception message
    -  55   +  54   
          * @param ex the cause of the exception
    -  56   +  55   
          */
    -  57   +  56   
         public DatabaseException(String msg, Throwable ex) {
    -  58  0 
             super(msg, ex);
    -  59  0 
         }
    -  60   +  57  0 
             super(msg, ex);
    +  58  0 
         }
    +  59   
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.DatabaseProperties.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.DatabaseProperties.html index a521134bb..856b81fe1 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.DatabaseProperties.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.DatabaseProperties.html @@ -12,7 +12,7 @@
     
    - +
    Classes in this File Line Coverage Branch Coverage Complexity
    DatabaseProperties
    92%
    13/14
    50%
    3/6
    		1.5
    DatabaseProperties
    84%
    27/32
    66%
    8/12
    		1.875
     
    @@ -24,227 +24,297 @@  3   
      *
     4   - 
      * Dependency-check-core is free software: you can redistribute it and/or modify it
    + 
      * Licensed under the Apache License, Version 2.0 (the "License");
     5   - 
      * under the terms of the GNU General Public License as published by the Free
    + 
      * you may not use this file except in compliance with the License.
     6   - 
      * Software Foundation, either version 3 of the License, or (at your option) any
    + 
      * You may obtain a copy of the License at
     7   - 
      * later version.
    + 
      *
     8   - 
      *
    + 
      *     http://www.apache.org/licenses/LICENSE-2.0
     9   - 
      * Dependency-check-core is distributed in the hope that it will be useful, but
    + 
      *
     10   - 
      * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
    + 
      * Unless required by applicable law or agreed to in writing, software
     11   - 
      * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
    + 
      * distributed under the License is distributed on an "AS IS" BASIS,
     12   - 
      * details.
    + 
      * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13   - 
      *
    + 
      * See the License for the specific language governing permissions and
     14   - 
      * You should have received a copy of the GNU General Public License along with
    + 
      * limitations under the License.
     15   - 
      * dependency-check-core. If not, see http://www.gnu.org/licenses/.
    + 
      *
     16   - 
      *
    -  17   
      * Copyright (c) 2013 Jeremy Long. All Rights Reserved.
    +  17   + 
      */
     18   - 
      */
    -  19   
     package org.owasp.dependencycheck.data.nvdcve;
    +  19   + 
     
     20   - 
     
    + 
     import com.hazelcast.logging.Logger;
     21   - 
     import java.util.Properties;
    + 
     import java.text.DateFormat;
     22   - 
     import org.owasp.dependencycheck.data.update.exception.UpdateException;
    + 
     import java.text.SimpleDateFormat;
     23   - 
     import org.owasp.dependencycheck.data.update.NvdCveInfo;
    + 
     import java.util.Date;
     24   - 
     
    + 
     import java.util.Map;
     25   - 
     /**
    + 
     import java.util.Map.Entry;
     26   - 
      * This is a wrapper around a set of properties that are stored in the database.
    + 
     import java.util.Properties;
     27   - 
      *
    + 
     import java.util.TreeMap;
     28   - 
      * @author Jeremy Long <jeremy.long@owasp.org>
    + 
     import java.util.logging.Level;
     29   - 
      */
    + 
     import org.owasp.dependencycheck.data.update.NvdCveInfo;
     30   - 
     public class DatabaseProperties {
    + 
     import org.owasp.dependencycheck.data.update.exception.UpdateException;
     31   
     
     32   - 
         /**
    + 
     /**
     33   - 
          * Modified key word, used as a key to store information about the modified
    + 
      * This is a wrapper around a set of properties that are stored in the database.
     34   - 
          * file (i.e. the containing the last 8 days of updates)..
    + 
      *
     35   - 
          */
    + 
      * @author Jeremy Long <jeremy.long@owasp.org>
     36   - 
         public static final String MODIFIED = "modified";
    + 
      */
     37   - 
         /**
    + 
     public class DatabaseProperties {
     38   - 
          * The properties file key for the last updated field - used to store the
    + 
     
     39   - 
          * last updated time of the Modified NVD CVE xml file.
    + 
         /**
     40   - 
          */
    + 
          * Modified key word, used as a key to store information about the modified file (i.e. the containing the last 8
     41   - 
         public static final String LAST_UPDATED = "lastupdated.modified";
    + 
          * days of updates)..
     42   - 
         /**
    + 
          */
     43   - 
          * Stores the last updated time for each of the NVD CVE files. These
    + 
         public static final String MODIFIED = "Modified";
     44   - 
          * timestamps should be updated if we process the modified file within 7
    + 
         /**
     45   - 
          * days of the last update.
    + 
          * The properties file key for the last updated field - used to store the last updated time of the Modified NVD CVE
     46   - 
          */
    + 
          * xml file.
     47   - 
         public static final String LAST_UPDATED_BASE = "lastupdated.";
    + 
          */
     48   - 
         /**
    + 
         public static final String LAST_UPDATED = "NVD CVE Modified";
     49   - 
          * A collection of properties about the data.
    + 
         /**
     50   - 
          */
    + 
          * Stores the last updated time for each of the NVD CVE files. These timestamps should be updated if we process the
     51   - 
         private Properties properties;
    + 
          * modified file within 7 days of the last update.
     52   - 
         /**
    + 
          */
     53   - 
          * A reference to the database.
    + 
         public static final String LAST_UPDATED_BASE = "NVD CVE ";
     54   - 
          */
    + 
         /**
     55   - 
         private CveDB cveDB;
    + 
          * A collection of properties about the data.
     56   - 
     
    + 
          */
     57   - 
         /**
    + 
         private Properties properties;
     58   - 
          * Constructs a new data properties object.
    + 
         /**
     59   - 
          *
    + 
          * A reference to the database.
     60   - 
          * @param cveDB the database object holding the properties
    + 
          */
     61   - 
          */
    -  62  24 
         DatabaseProperties(CveDB cveDB) {
    -  63  24 
             this.cveDB = cveDB;
    -  64  24 
             loadProperties();
    -  65  24 
         }
    + 
         private CveDB cveDB;
    +  62   + 
     
    +  63   + 
         /**
    +  64   + 
          * Constructs a new data properties object.
    +  65   + 
          *
     66   - 
     
    + 
          * @param cveDB the database object holding the properties
     67   - 
         /**
    -  68   - 
          * Loads the properties from the database.
    -  69   
          */
    -  70   - 
         private void loadProperties() {
    -  71  24 
             this.properties = cveDB.getProperties();
    -  72  24 
         }
    +  68  54 
         DatabaseProperties(CveDB cveDB) {
    +  69  54 
             this.cveDB = cveDB;
    +  70  54 
             loadProperties();
    +  71  54 
         }
    +  72   + 
     
     73   - 
     
    + 
         /**
     74   - 
         /**
    + 
          * Loads the properties from the database.
     75   - 
          * Returns whether or not any properties are set.
    + 
          */
     76   - 
          *
    -  77   - 
          * @return whether or not any properties are set
    -  78   - 
          */
    + 
         private void loadProperties() {
    +  77  54 
             this.properties = cveDB.getProperties();
    +  78  54 
         }
     79   - 
         public boolean isEmpty() {
    -  80  1 
             return properties == null || properties.isEmpty();
    + 
     
    +  80   + 
         /**
     81   - 
         }
    + 
          * Returns whether or not any properties are set.
     82   - 
     
    + 
          *
     83   - 
         /**
    + 
          * @return whether or not any properties are set
     84   - 
          * Writes a properties file containing the last updated date to the
    + 
          */
     85   - 
          * VULNERABLE_CPE directory.
    -  86   - 
          *
    + 
         public boolean isEmpty() {
    +  86  2 
             return properties == null || properties.isEmpty();
     87   - 
          * @param updatedValue the updated NVD CVE entry
    + 
         }
     88   - 
          * @throws UpdateException is thrown if there is an update exception
    + 
     
     89   - 
          */
    + 
         /**
     90   - 
         public void save(NvdCveInfo updatedValue) throws UpdateException {
    -  91  1 
             if (updatedValue == null) {
    -  92  0 
                 return;
    + 
          * Writes a properties file containing the last updated date to the VULNERABLE_CPE directory.
    +  91   + 
          *
    +  92   + 
          * @param updatedValue the updated NVD CVE entry
     93   - 
             }
    -  94  1 
             properties.put(LAST_UPDATED_BASE + updatedValue.getId(), String.valueOf(updatedValue.getTimestamp()));
    -  95  1 
             cveDB.saveProperty(LAST_UPDATED_BASE + updatedValue.getId(), String.valueOf(updatedValue.getTimestamp()));
    -  96  1 
         }
    -  97   - 
     
    + 
          * @throws UpdateException is thrown if there is an update exception
    +  94   + 
          */
    +  95   + 
         public void save(NvdCveInfo updatedValue) throws UpdateException {
    +  96  2 
             if (updatedValue == null) {
    +  97  0 
                 return;
     98   - 
         /**
    -  99   - 
          * Returns the property value for the given key. If the key is not contained
    -  100   - 
          * in the underlying properties null is returned.
    -  101   - 
          *
    + 
             }
    +  99  2 
             properties.put(LAST_UPDATED_BASE + updatedValue.getId(), String.valueOf(updatedValue.getTimestamp()));
    +  100  2 
             cveDB.saveProperty(LAST_UPDATED_BASE + updatedValue.getId(), String.valueOf(updatedValue.getTimestamp()));
    +  101  2 
         }
     102   - 
          * @param key the property key
    -  103   - 
          * @return the value of the property
    -  104   - 
          */
    -  105   - 
         public String getProperty(String key) {
    -  106  1 
             return properties.getProperty(key);
    -  107   - 
         }
    -  108   
     
    -  109   +  103   
         /**
    -  110   - 
          * Returns the property value for the given key. If the key is not contained
    -  111   - 
          * in the underlying properties the default value is returned.
    -  112   +  104   + 
          * Returns the property value for the given key. If the key is not contained in the underlying properties null is
    +  105   + 
          * returned.
    +  106   
          *
    -  113   +  107   
          * @param key the property key
    -  114   - 
          * @param defaultValue the default value
    -  115   +  108   
          * @return the value of the property
    -  116   +  109   
          */
    -  117   - 
         public String getProperty(String key, String defaultValue) {
    -  118  1 
             return properties.getProperty(key, defaultValue);
    -  119   +  110   + 
         public String getProperty(String key) {
    +  111  4 
             return properties.getProperty(key);
    +  112   
         }
    +  113   + 
     
    +  114   + 
         /**
    +  115   + 
          * Returns the property value for the given key. If the key is not contained in the underlying properties the
    +  116   + 
          * default value is returned.
    +  117   + 
          *
    +  118   + 
          * @param key the property key
    +  119   + 
          * @param defaultValue the default value
     120   + 
          * @return the value of the property
    +  121   + 
          */
    +  122   + 
         public String getProperty(String key, String defaultValue) {
    +  123  2 
             return properties.getProperty(key, defaultValue);
    +  124   + 
         }
    +  125   + 
     
    +  126   + 
         /**
    +  127   + 
          * Returns the collection of Database Properties as a properties collection.
    +  128   + 
          *
    +  129   + 
          * @return the collection of Database Properties
    +  130   + 
          */
    +  131   + 
         public Properties getProperties() {
    +  132  2 
             return properties;
    +  133   + 
         }
    +  134   + 
     
    +  135   + 
         /**
    +  136   + 
          * Returns a map of the meta data from the database properties. This primarily contains timestamps of when the NVD
    +  137   + 
          * CVE information was last updated.
    +  138   + 
          *
    +  139   + 
          * @return a map of the database meta data
    +  140   + 
          */
    +  141   + 
         public Map getMetaData() {
    +  142  2 
             final TreeMap map = new TreeMap();
    +  143  2 
             for (Entry<Object, Object> entry : properties.entrySet()) {
    +  144  32 
                 final String key = (String) entry.getKey();
    +  145  32 
                 if (!"version".equals(key)) {
    +  146  30 
                     if (key.startsWith("NVD CVE ")) {
    +  147   + 
                         try {
    +  148  30 
                             final long epoch = Long.parseLong((String) entry.getValue());
    +  149  30 
                             final Date date = new Date(epoch);
    +  150  30 
                             final DateFormat format = new SimpleDateFormat("dd/MM/yyyy HH:mm:ss");
    +  151  30 
                             final String formatted = format.format(date);
    +  152  30 
                             map.put(key, formatted);
    +  153  0 
                         } catch (Throwable ex) { //deliberatly being broad in this catch clause
    +  154  0 
                             Logger.getLogger(DatabaseProperties.class.getName()).log(Level.FINE, "Unable to parse timestamp from DB", ex);
    +  155  0 
                             map.put(key, entry.getValue());
    +  156  30 
                         }
    +  157   + 
                     } else {
    +  158  0 
                         map.put(key, entry.getValue());
    +  159   + 
                     }
    +  160   + 
                 }
    +  161  32 
             }
    +  162  2 
             return map;
    +  163   + 
         }
    +  164   
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.DriverLoadException.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.DriverLoadException.html index ccd5157f1..5e1892cf7 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.DriverLoadException.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.DriverLoadException.html @@ -24,115 +24,113 @@  3   
      *
     4   - 
      * Dependency-check-core is free software: you can redistribute it and/or modify it
    + 
      * Licensed under the Apache License, Version 2.0 (the "License");
     5   - 
      * under the terms of the GNU General Public License as published by the Free
    + 
      * you may not use this file except in compliance with the License.
     6   - 
      * Software Foundation, either version 3 of the License, or (at your option) any
    + 
      * You may obtain a copy of the License at
     7   - 
      * later version.
    + 
      *
     8   - 
      *
    + 
      *     http://www.apache.org/licenses/LICENSE-2.0
     9   - 
      * Dependency-check-core is distributed in the hope that it will be useful, but
    + 
      *
     10   - 
      * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
    + 
      * Unless required by applicable law or agreed to in writing, software
     11   - 
      * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
    + 
      * distributed under the License is distributed on an "AS IS" BASIS,
     12   - 
      * details.
    + 
      * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13   - 
      *
    + 
      * See the License for the specific language governing permissions and
     14   - 
      * You should have received a copy of the GNU General Public License along with
    + 
      * limitations under the License.
     15   - 
      * dependency-check-core. If not, see http://www.gnu.org/licenses/.
    + 
      *
     16   - 
      *
    -  17   
      * Copyright (c) 2014 Jeremy Long. All Rights Reserved.
    +  17   + 
      */
     18   - 
      */
    -  19   
     package org.owasp.dependencycheck.data.nvdcve;
    +  19   + 
     
     20   - 
     
    -  21   
     /**
    -  22   +  21   
      * An exception thrown the database driver is unable to be loaded.
    -  23   +  22   
      *
    -  24   +  23   
      * @author Jeremy Long <jeremy.long@owasp.org>
    -  25   +  24   
      */
    -  26   +  25   
     public class DriverLoadException extends Exception {
    +  26   + 
     
     27   - 
     
    + 
         /**
     28   - 
         /**
    -  29   
          * the serial version uid.
    +  29   + 
          */
     30   - 
          */
    -  31   
         private static final long serialVersionUID = 1L;
    +  31   + 
     
     32   - 
     
    + 
         /**
     33   - 
         /**
    + 
          * Creates an DriverLoadException.
     34   - 
          * Creates an DriverLoadException.
    + 
          *
     35   - 
          *
    + 
          * @param msg the exception message
     36   - 
          * @param msg the exception message
    + 
          */
     37   - 
          */
    -  38   
         public DriverLoadException(String msg) {
    -  39  0 
             super(msg);
    -  40  0 
         }
    +  38  0 
             super(msg);
    +  39  0 
         }
    +  40   + 
     
     41   - 
     
    + 
         /**
     42   - 
         /**
    + 
          * Creates an DriverLoadException.
     43   - 
          * Creates an DriverLoadException.
    + 
          *
     44   - 
          *
    + 
          * @param ex the cause of the exception
     45   - 
          * @param ex the cause of the exception
    + 
          */
     46   - 
          */
    -  47   
         public DriverLoadException(Throwable ex) {
    -  48  0 
             super(ex);
    -  49  0 
         }
    -  50   +  47  0 
             super(ex);
    +  48  0 
         }
    +  49   
     
    -  51   +  50   
         /**
    -  52   +  51   
          * Creates an DriverLoadException.
    -  53   +  52   
          *
    -  54   +  53   
          * @param msg the exception message
    -  55   +  54   
          * @param ex the cause of the exception
    -  56   +  55   
          */
    -  57   +  56   
         public DriverLoadException(String msg, Throwable ex) {
    -  58  3 
             super(msg, ex);
    -  59  3 
         }
    -  60   +  57  6 
             super(msg, ex);
    +  58  6 
         }
    +  59   
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.DriverLoader.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.DriverLoader.html index 6bb2e5ee5..f9bc968a3 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.DriverLoader.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.DriverLoader.html @@ -25,214 +25,214 @@  3   
      *
     4   - 
      * Dependency-check-core is free software: you can redistribute it and/or modify it
    + 
      * Licensed under the Apache License, Version 2.0 (the "License");
     5   - 
      * under the terms of the GNU General Public License as published by the Free
    + 
      * you may not use this file except in compliance with the License.
     6   - 
      * Software Foundation, either version 3 of the License, or (at your option) any
    + 
      * You may obtain a copy of the License at
     7   - 
      * later version.
    + 
      *
     8   - 
      *
    + 
      *     http://www.apache.org/licenses/LICENSE-2.0
     9   - 
      * Dependency-check-core is distributed in the hope that it will be useful, but
    + 
      *
     10   - 
      * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
    + 
      * Unless required by applicable law or agreed to in writing, software
     11   - 
      * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
    + 
      * distributed under the License is distributed on an "AS IS" BASIS,
     12   - 
      * details.
    + 
      * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13   - 
      *
    + 
      * See the License for the specific language governing permissions and
     14   - 
      * You should have received a copy of the GNU General Public License along with
    + 
      * limitations under the License.
     15   - 
      * dependency-check-core. If not, see http://www.gnu.org/licenses/.
    + 
      *
     16   - 
      *
    -  17   
      * Copyright (c) 2014 Jeremy Long. All Rights Reserved.
    +  17   + 
      */
     18   - 
      */
    -  19   
     package org.owasp.dependencycheck.data.nvdcve;
    +  19   + 
     
     20   - 
     
    -  21   
     import java.io.File;
    -  22   +  21   
     import java.net.MalformedURLException;
    -  23   +  22   
     import java.net.URL;
    -  24   +  23   
     import java.net.URLClassLoader;
    -  25   +  24   
     import java.security.AccessController;
    -  26   +  25   
     import java.security.PrivilegedAction;
    -  27   +  26   
     import java.sql.Driver;
    -  28   +  27   
     import java.sql.DriverManager;
    -  29   +  28   
     import java.sql.SQLException;
    -  30   +  29   
     import java.util.ArrayList;
    -  31   +  30   
     import java.util.logging.Level;
    -  32   +  31   
     import java.util.logging.Logger;
    +  32   + 
     
     33   - 
     
    -  34   
     /**
    -  35   +  34   
      * DriverLoader is a utility class that is used to load database drivers.
    -  36   +  35   
      *
    -  37   +  36   
      * @author Jeremy Long <jeremy.long@owasp.org>
    -  38   +  37   
      */
    -  39   +  38   
     public final class DriverLoader {
    +  39   + 
     
     40   - 
     
    + 
         /**
     41   - 
         /**
    -  42   
          * Private constructor for a utility class.
    -  43   +  42   
          */
    -  44  0 
         private DriverLoader() {
    -  45  0 
         }
    +  43  0 
         private DriverLoader() {
    +  44  0 
         }
    +  45   + 
     
     46   - 
     
    + 
         /**
     47   - 
         /**
    -  48   
          * Loads the specified class using the system class loader and registers the driver with the driver manager.
    +  48   + 
          *
     49   - 
          *
    + 
          * @param className the fully qualified name of the desired class
     50   - 
          * @param className the fully qualified name of the desired class
    + 
          * @throws DriverLoadException thrown if the driver cannot be loaded
     51   - 
          * @throws DriverLoadException thrown if the driver cannot be loaded
    + 
          */
     52   - 
          */
    -  53   
         public static void load(String className) throws DriverLoadException {
    -  54  2 
             final ClassLoader loader = ClassLoader.getSystemClassLoader();
    -  55  2 
             load(className, loader);
    -  56  1 
         }
    +  53  112 
             final ClassLoader loader = DriverLoader.class.getClassLoader(); //ClassLoader.getSystemClassLoader();
    +  54  112 
             load(className, loader);
    +  55  110 
         }
    +  56   + 
     
     57   - 
     
    + 
         /**
     58   - 
         /**
    -  59   
          * Loads the specified class by registering the supplied paths to the class loader and then registers the driver
    -  60   +  59   
          * with the driver manager. The pathToDriver argument is added to the class loader so that an external driver can be
    -  61   +  60   
          * loaded. Note, the pathTodriver can contain a semi-colon separated list of paths so any dependencies can be added
    -  62   +  61   
          * as needed. If a path in the pathToDriver argument is a directory all files in the directory are added to the
    -  63   +  62   
          * class path.
    +  63   + 
          *
     64   - 
          *
    + 
          * @param className the fully qualified name of the desired class
     65   - 
          * @param className the fully qualified name of the desired class
    -  66   
          * @param pathToDriver the path to the JAR file containing the driver; note, this can be a semi-colon separated list
    -  67   +  66   
          * of paths
    +  67   + 
          * @throws DriverLoadException thrown if the driver cannot be loaded
     68   - 
          * @throws DriverLoadException thrown if the driver cannot be loaded
    + 
          */
     69   - 
          */
    -  70   
         public static void load(String className, String pathToDriver) throws DriverLoadException {
    -  71  4 
             final URLClassLoader parent = (URLClassLoader) ClassLoader.getSystemClassLoader();
    -  72  4 
             final ArrayList<URL> urls = new ArrayList<URL>();
    -  73  4 
             final String[] paths = pathToDriver.split(File.pathSeparator);
    -  74  9 
             for (String path : paths) {
    -  75  5 
                 final File file = new File(path);
    -  76  5 
                 if (file.isDirectory()) {
    -  77  2 
                     final File[] files = file.listFiles();
    -  78   +  70  8 
             final URLClassLoader parent = (URLClassLoader) ClassLoader.getSystemClassLoader();
    +  71  8 
             final ArrayList<URL> urls = new ArrayList<URL>();
    +  72  8 
             final String[] paths = pathToDriver.split(File.pathSeparator);
    +  73  18 
             for (String path : paths) {
    +  74  10 
                 final File file = new File(path);
    +  75  10 
                 if (file.isDirectory()) {
    +  76  4 
                     final File[] files = file.listFiles();
    +  77   
     
    -  79  18 
                     for (File f : files) {
    -  80   +  78  40 
                     for (File f : files) {
    +  79   
                         try {
    -  81  16 
                             urls.add(f.toURI().toURL());
    -  82  0 
                         } catch (MalformedURLException ex) {
    -  83  0 
                             final String msg = String.format("Unable to load database driver '%s'; invalid path provided '%s'",
    -  84   +  80  36 
                             urls.add(f.toURI().toURL());
    +  81  0 
                         } catch (MalformedURLException ex) {
    +  82  0 
                             final String msg = String.format("Unable to load database driver '%s'; invalid path provided '%s'",
    +  83   
                                     className, f.getAbsoluteFile());
    -  85  0 
                             Logger.getLogger(DriverLoader.class.getName()).log(Level.FINE, msg, ex);
    -  86  0 
                             throw new DriverLoadException(msg, ex);
    -  87  16 
                         }
    -  88   +  84  0 
                             Logger.getLogger(DriverLoader.class.getName()).log(Level.FINE, msg, ex);
    +  85  0 
                             throw new DriverLoadException(msg, ex);
    +  86  36 
                         }
    +  87   
                     }
    -  89  2 
                 } else if (file.exists()) {
    -  90   +  88  4 
                 } else if (file.exists()) {
    +  89   
                     try {
    -  91  2 
                         urls.add(file.toURI().toURL());
    -  92  0 
                     } catch (MalformedURLException ex) {
    -  93  0 
                         final String msg = String.format("Unable to load database driver '%s'; invalid path provided '%s'",
    -  94   +  90  4 
                         urls.add(file.toURI().toURL());
    +  91  0 
                     } catch (MalformedURLException ex) {
    +  92  0 
                         final String msg = String.format("Unable to load database driver '%s'; invalid path provided '%s'",
    +  93   
                                 className, file.getAbsoluteFile());
    -  95  0 
                         Logger.getLogger(DriverLoader.class.getName()).log(Level.FINE, msg, ex);
    -  96  0 
                         throw new DriverLoadException(msg, ex);
    -  97  2 
                     }
    +  94  0 
                         Logger.getLogger(DriverLoader.class.getName()).log(Level.FINE, msg, ex);
    +  95  0 
                         throw new DriverLoadException(msg, ex);
    +  96  4 
                     }
    +  97   + 
                 }
     98   - 
                 }
    -  99   
             }
    -  100  8 
             final URLClassLoader loader = AccessController.doPrivileged(new PrivilegedAction<URLClassLoader>() {
    -  101   +  99  16 
             final URLClassLoader loader = AccessController.doPrivileged(new PrivilegedAction<URLClassLoader>() {
    +  100   
                 @Override
    -  102   +  101   
                 public URLClassLoader run() {
    -  103  4 
                     return new URLClassLoader(urls.toArray(new URL[urls.size()]), parent);
    -  104   +  102  8 
                     return new URLClassLoader(urls.toArray(new URL[urls.size()]), parent);
    +  103   
                 }
    -  105   +  104   
             });
    -  106   +  105   + 
     
    +  106  8 
             load(className, loader);
    +  107  4 
         }
    +  108   
     
    -  107  4 
             load(className, loader);
    -  108  2 
         }
     109   - 
     
    -  110   
         /**
    -  111   +  110   
          * Loads the specified class using the supplied class loader and registers the driver with the driver manager.
    -  112   +  111   
          *
    -  113   +  112   
          * @param className the fully qualified name of the desired class
    -  114   +  113   
          * @param loader the class loader to use when loading the driver
    -  115   +  114   
          * @throws DriverLoadException thrown if the driver cannot be loaded
    -  116   +  115   
          */
    -  117   +  116   
         private static void load(String className, ClassLoader loader) throws DriverLoadException {
    -  118   +  117   
             try {
    -  119  6 
                 final Class c = loader.loadClass(className);
    -  120  3 
                 final Driver driver = (Driver) c.newInstance();
    +  118  120 
                 final Class c = Class.forName(className, true, loader);
    +  119   + 
                 //final Class c = loader.loadClass(className);
    +  120  114 
                 final Driver driver = (Driver) c.newInstance();
     121   
                 //using the DriverShim to get around the fact that the DriverManager won't register a driver not in the base class path
    -  122  3 
                 DriverManager.registerDriver(new DriverShim(driver));
    -  123  3 
             } catch (ClassNotFoundException ex) {
    -  124  3 
                 final String msg = String.format("Unable to load database driver '%s'", className);
    -  125  3 
                 Logger.getLogger(DriverLoader.class.getName()).log(Level.FINE, msg, ex);
    -  126  3 
                 throw new DriverLoadException(msg, ex);
    +  122  114 
                 DriverManager.registerDriver(new DriverShim(driver));
    +  123  6 
             } catch (ClassNotFoundException ex) {
    +  124  6 
                 final String msg = String.format("Unable to load database driver '%s'", className);
    +  125  6 
                 Logger.getLogger(DriverLoader.class.getName()).log(Level.FINE, msg, ex);
    +  126  6 
                 throw new DriverLoadException(msg, ex);
     127  0 
             } catch (InstantiationException ex) {
     128  0 
                 final String msg = String.format("Unable to load database driver '%s'", className);
     129  0 
                 Logger.getLogger(DriverLoader.class.getName()).log(Level.FINE, msg, ex);
    @@ -245,12 +245,12 @@  136  0 
                 final String msg = String.format("Unable to load database driver '%s'", className);
     137  0 
                 Logger.getLogger(DriverLoader.class.getName()).log(Level.FINE, msg, ex);
     138  0 
                 throw new DriverLoadException(msg, ex);
    -  139  3 
             }
    -  140  3 
         }
    +  139  114 
             }
    +  140  114 
         }
     141   
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.DriverShim.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.DriverShim.html index f4aafee59..15b76ab5d 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.DriverShim.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.nvdcve.DriverShim.html @@ -24,341 +24,339 @@  3   
      *
     4   - 
      * Dependency-check-core is free software: you can redistribute it and/or modify it
    + 
      * Licensed under the Apache License, Version 2.0 (the "License");
     5   - 
      * under the terms of the GNU General Public License as published by the Free
    + 
      * you may not use this file except in compliance with the License.
     6   - 
      * Software Foundation, either version 3 of the License, or (at your option) any
    + 
      * You may obtain a copy of the License at
     7   - 
      * later version.
    + 
      *
     8   - 
      *
    + 
      *     http://www.apache.org/licenses/LICENSE-2.0
     9   - 
      * Dependency-check-core is distributed in the hope that it will be useful, but
    + 
      *
     10   - 
      * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
    + 
      * Unless required by applicable law or agreed to in writing, software
     11   - 
      * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
    + 
      * distributed under the License is distributed on an "AS IS" BASIS,
     12   - 
      * details.
    + 
      * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13   - 
      *
    + 
      * See the License for the specific language governing permissions and
     14   - 
      * You should have received a copy of the GNU General Public License along with
    + 
      * limitations under the License.
     15   - 
      * dependency-check-core. If not, see http://www.gnu.org/licenses/.
    + 
      *
     16   - 
      *
    -  17   
      * Copyright (c) 2014 Jeremy Long. All Rights Reserved.
    +  17   + 
      */
     18   - 
      */
    -  19   
     package org.owasp.dependencycheck.data.nvdcve;
    +  19   + 
     
     20   - 
     
    -  21   
     import java.sql.Connection;
    -  22   +  21   
     import java.sql.Driver;
    -  23   +  22   
     import java.sql.DriverPropertyInfo;
    -  24   +  23   
     import java.sql.SQLException;
    -  25   +  24   
     import java.sql.SQLFeatureNotSupportedException;
    -  26   +  25   
     import java.util.Properties;
    -  27   +  26   
     import java.util.logging.Logger;
    +  27   + 
     
     28   - 
     
    -  29   
     /**
    -  30   +  29   
      * <p>
    -  31   +  30   
      * Driver shim to get around the class loader issue with the DriverManager. The following code is a nearly identical
    -  32   +  31   
      * copy (with more comments and a few more methods implemented) of the DriverShim from:</p>
    -  33   +  32   
      * <blockquote>http://www.kfu.com/~nsayer/Java/dyn-jdbc.html</blockquote>
    -  34   +  33   
      *
    -  35   +  34   
      * @author Jeremy Long <jeremy.long@owasp.org>
    -  36   +  35   
      * @see java.sql.Driver
    -  37   +  36   
      */
    -  38   +  37   
     class DriverShim implements Driver {
    +  38   + 
     
     39   - 
     
    + 
         /**
     40   - 
         /**
    -  41   
          * The database driver being wrapped.
    +  41   + 
          */
     42   - 
          */
    -  43   
         private final Driver driver;
    +  43   + 
     
     44   - 
     
    + 
         /**
     45   - 
         /**
    -  46   
          * Constructs a new wrapper around a Driver.
    +  46   + 
          *
     47   - 
          *
    -  48   
          * @param driver the database driver to wrap
    -  49   +  48   
          */
    -  50  3 
         DriverShim(Driver driver) {
    -  51  3 
             this.driver = driver;
    -  52  3 
         }
    +  49  114 
         DriverShim(Driver driver) {
    +  50  114 
             this.driver = driver;
    +  51  114 
         }
    +  52   + 
     
     53   - 
     
    + 
         /**
     54   - 
         /**
    -  55   
          * Wraps the underlying driver's call to acceptsURL. Returns whether or not the driver can open a connection to the
    -  56   +  55   
          * given URL.
    +  56   + 
          *
     57   - 
          *
    + 
          * @param url the URL of the database
     58   - 
          * @param url the URL of the database
    -  59   
          * @return true if the wrapped driver can connect to the specified URL
    +  59   + 
          * @throws SQLException thrown if there is an error connecting to the database
     60   - 
          * @throws SQLException thrown if there is an error connecting to the database
    -  61   
          * @see java.sql.Driver#acceptsURL(java.lang.String)
    +  61   + 
          */
     62   - 
          */
    + 
         @Override
     63   - 
         @Override
    -  64   
         public boolean acceptsURL(String url) throws SQLException {
    -  65  2 
             return this.driver.acceptsURL(url);
    +  64  96 
             return this.driver.acceptsURL(url);
    +  65   + 
         }
     66   - 
         }
    + 
     
     67   - 
     
    + 
         /**
     68   - 
         /**
    -  69   
          * Returns the wrapped driver's major version number.
    +  69   + 
          *
     70   - 
          *
    -  71   
          * @return the wrapped driver's major version number
    -  72   +  71   
          * @see java.sql.Driver#getMajorVersion()
    +  72   + 
          */
     73   - 
          */
    + 
         @Override
     74   - 
         @Override
    -  75   
         public int getMajorVersion() {
    -  76  0 
             return this.driver.getMajorVersion();
    +  75  0 
             return this.driver.getMajorVersion();
    +  76   + 
         }
     77   - 
         }
    + 
     
     78   - 
     
    + 
         /**
     79   - 
         /**
    -  80   
          * Returns the wrapped driver's minor version number.
    +  80   + 
          *
     81   - 
          *
    -  82   
          * @return the wrapped driver's minor version number
    -  83   +  82   
          * @see java.sql.Driver#getMinorVersion()
    +  83   + 
          */
     84   - 
          */
    + 
         @Override
     85   - 
         @Override
    -  86   
         public int getMinorVersion() {
    -  87  0 
             return this.driver.getMinorVersion();
    +  86  0 
             return this.driver.getMinorVersion();
    +  87   + 
         }
     88   - 
         }
    + 
     
     89   - 
     
    + 
         /**
     90   - 
         /**
    -  91   
          * Returns whether or not the wrapped driver is jdbcCompliant.
    +  91   + 
          *
     92   - 
          *
    -  93   
          * @return true if the wrapped driver is JDBC compliant; otherwise false
    -  94   +  93   
          * @see java.sql.Driver#jdbcCompliant()
    +  94   + 
          */
     95   - 
          */
    + 
         @Override
     96   - 
         @Override
    -  97   
         public boolean jdbcCompliant() {
    -  98  0 
             return this.driver.jdbcCompliant();
    +  97  0 
             return this.driver.jdbcCompliant();
    +  98   + 
         }
     99   - 
         }
    + 
     
     100   - 
     
    + 
         /**
     101   - 
         /**
    -  102   
          * Wraps the call to the underlying driver's connect method.
    +  102   + 
          *
     103   - 
          *
    + 
          * @param url the URL of the database
     104   - 
          * @param url the URL of the database
    + 
          * @param info a collection of string/value pairs
     105   - 
          * @param info a collection of string/value pairs
    -  106   
          * @return a Connection object
    -  107   +  106   
          * @throws SQLException thrown if there is an error connecting to the database
    -  108   +  107   
          * @see java.sql.Driver#connect(java.lang.String, java.util.Properties)
    +  108   + 
          */
     109   - 
          */
    + 
         @Override
     110   - 
         @Override
    -  111   
         public Connection connect(String url, Properties info) throws SQLException {
    -  112  0 
             return this.driver.connect(url, info);
    +  111  0 
             return this.driver.connect(url, info);
    +  112   + 
         }
     113   - 
         }
    + 
     
     114   - 
     
    + 
         /**
     115   - 
         /**
    -  116   
          * Wraps the call to the underlying driver's getPropertyInfo method.
    +  116   + 
          *
     117   - 
          *
    -  118   
          * @param url the URL of the database
    -  119   +  118   
          * @param info a collection of string/value pairs
    -  120   +  119   
          * @return an array of DriverPropertyInfo objects
    -  121   +  120   
          * @throws SQLException thrown if there is an error accessing the database
    -  122   +  121   
          * @see java.sql.Driver#getPropertyInfo(java.lang.String, java.util.Properties)
    +  122   + 
          */
     123   - 
          */
    + 
         @Override
     124   - 
         @Override
    -  125   
         public DriverPropertyInfo[] getPropertyInfo(String url, Properties info) throws SQLException {
    -  126  0 
             return this.driver.getPropertyInfo(url, info);
    +  125  0 
             return this.driver.getPropertyInfo(url, info);
    +  126   + 
         }
     127   - 
         }
    + 
     
     128   - 
     
    + 
         /**
     129   - 
         /**
    -  130   
          * Wraps the call to the underlying driver's getParentLogger method.
    +  130   + 
          *
     131   - 
          *
    -  132   
          * @return the parent's Logger
    -  133   +  132   
          * @throws SQLFeatureNotSupportedException thrown if the feature is not supported
    -  134   +  133   
          * @see java.sql.Driver#getParentLogger()
    +  134   + 
          */
     135   - 
          */
    + 
         @Override
     136   - 
         @Override
    -  137   
         public Logger getParentLogger() throws SQLFeatureNotSupportedException {
    -  138  0 
             return this.driver.getParentLogger();
    +  137  0 
             return this.driver.getParentLogger();
    +  138   + 
         }
     139   - 
         }
    + 
     
     140   - 
     
    + 
         /**
     141   - 
         /**
    -  142   
          * Standard implementation of hashCode.
    +  142   + 
          *
     143   - 
          *
    -  144   
          * @return the hashCode of the object
    +  144   + 
          */
     145   - 
          */
    + 
         @Override
     146   - 
         @Override
    -  147   
         public int hashCode() {
    -  148  0 
             int hash = 7;
    -  149  0 
             hash = 97 * hash + (this.driver != null ? this.driver.hashCode() : 0);
    -  150  0 
             return hash;
    +  147  0 
             int hash = 7;
    +  148  0 
             hash = 97 * hash + (this.driver != null ? this.driver.hashCode() : 0);
    +  149  0 
             return hash;
    +  150   + 
         }
     151   - 
         }
    + 
     
     152   - 
     
    + 
         /**
     153   - 
         /**
    -  154   
          * Standard implementation of equals.
    +  154   + 
          *
     155   - 
          *
    -  156   
          * @param obj the object to compare
    -  157   +  156   
          * @return returns true if the objects are equal; otherwise false
    +  157   + 
          */
     158   - 
          */
    + 
         @Override
     159   - 
         @Override
    -  160   
         public boolean equals(Object obj) {
    -  161  0 
             if (obj == null) {
    -  162  0 
                 return false;
    -  163   +  160  0 
             if (obj == null) {
    +  161  0 
                 return false;
    +  162   
             }
    -  164  0 
             if (getClass() != obj.getClass()) {
    -  165  0 
                 return false;
    -  166   +  163  0 
             if (getClass() != obj.getClass()) {
    +  164  0 
                 return false;
    +  165   
             }
    -  167  0 
             final DriverShim other = (DriverShim) obj;
    -  168  0 
             return this.driver == other.driver || (this.driver != null && this.driver.equals(other.driver));
    +  166  0 
             final DriverShim other = (DriverShim) obj;
    +  167  0 
             return this.driver == other.driver || (this.driver != null && this.driver.equals(other.driver));
    +  168   + 
         }
     169   - 
         }
    -  170   
     
    -  171   +  170   
         /**
    -  172   +  171   
          * Standard implementation of toString().
    -  173   +  172   
          *
    -  174   +  173   
          * @return the String representation of the object
    -  175   +  174   
          */
    -  176   +  175   
         @Override
    -  177   +  176   
         public String toString() {
    -  178  3 
             return "DriverShim{" + "driver=" + driver + '}';
    -  179   +  177  114 
             return "DriverShim{" + "driver=" + driver + '}';
    +  178   
         }
    -  180   +  179   
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.CachedWebDataSource.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.CachedWebDataSource.html index 32252bc45..ecfe57163 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.CachedWebDataSource.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.CachedWebDataSource.html @@ -24,81 +24,75 @@  3   
      *
     4   - 
      * Dependency-check-core is free software: you can redistribute it and/or modify it
    + 
      * Licensed under the Apache License, Version 2.0 (the "License");
     5   - 
      * under the terms of the GNU General Public License as published by the Free
    + 
      * you may not use this file except in compliance with the License.
     6   - 
      * Software Foundation, either version 3 of the License, or (at your option) any
    + 
      * You may obtain a copy of the License at
     7   - 
      * later version.
    + 
      *
     8   - 
      *
    + 
      *     http://www.apache.org/licenses/LICENSE-2.0
     9   - 
      * Dependency-check-core is distributed in the hope that it will be useful, but
    + 
      *
     10   - 
      * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
    + 
      * Unless required by applicable law or agreed to in writing, software
     11   - 
      * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
    + 
      * distributed under the License is distributed on an "AS IS" BASIS,
     12   - 
      * details.
    + 
      * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13   - 
      *
    + 
      * See the License for the specific language governing permissions and
     14   - 
      * You should have received a copy of the GNU General Public License along with
    + 
      * limitations under the License.
     15   - 
      * dependency-check-core. If not, see http://www.gnu.org/licenses/.
    + 
      *
     16   - 
      *
    -  17   
      * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
    +  17   + 
      */
     18   - 
      */
    -  19   
     package org.owasp.dependencycheck.data.update;
    +  19   + 
     
     20   - 
     
    -  21   
     import org.owasp.dependencycheck.data.update.exception.UpdateException;
    +  21   + 
     
     22   - 
     
    -  23   
     /**
    +  23   + 
      * Defines a data source who's data is retrieved from the Internet. This data can be downloaded and the local cache
     24   - 
      * Defines a data source who's data is retrieved from the Internet. This data
    + 
      * updated.
     25   - 
      * can be downloaded and the local cache updated.
    -  26   
      *
    -  27   +  26   
      * @author Jeremy Long <jeremy.long@owasp.org>
    -  28   +  27   
      */
    -  29   +  28   
     public interface CachedWebDataSource {
    -  30   +  29   
     
    -  31   +  30   
         /**
    +  31   + 
          * Determines if an update to the current data store is needed, if it is the new data is downloaded from the
     32   - 
          * Determines if an update to the current data store is needed, if it is the
    + 
          * Internet and imported into the current cached data store.
     33   - 
          * new data is downloaded from the Internet and imported into the current
    -  34   - 
          * cached data store.
    -  35   
          *
    -  36   - 
          * @throws UpdateException is thrown if there is an exception downloading
    -  37   - 
          * the data or updating the data store.
    -  38   +  34   + 
          * @throws UpdateException is thrown if there is an exception downloading the data or updating the data store.
    +  35   
          */
    -  39   +  36   
         void update() throws UpdateException;
    -  40   +  37   
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.NvdCveInfo.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.NvdCveInfo.html index 523770afe..f423eae74 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.NvdCveInfo.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.NvdCveInfo.html @@ -24,260 +24,258 @@  3   
      *
     4   - 
      * Dependency-check-core is free software: you can redistribute it and/or modify it
    + 
      * Licensed under the Apache License, Version 2.0 (the "License");
     5   - 
      * under the terms of the GNU General Public License as published by the Free
    + 
      * you may not use this file except in compliance with the License.
     6   - 
      * Software Foundation, either version 3 of the License, or (at your option) any
    + 
      * You may obtain a copy of the License at
     7   - 
      * later version.
    + 
      *
     8   - 
      *
    + 
      *     http://www.apache.org/licenses/LICENSE-2.0
     9   - 
      * Dependency-check-core is distributed in the hope that it will be useful, but
    + 
      *
     10   - 
      * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
    + 
      * Unless required by applicable law or agreed to in writing, software
     11   - 
      * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
    + 
      * distributed under the License is distributed on an "AS IS" BASIS,
     12   - 
      * details.
    + 
      * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13   - 
      *
    + 
      * See the License for the specific language governing permissions and
     14   - 
      * You should have received a copy of the GNU General Public License along with
    + 
      * limitations under the License.
     15   - 
      * dependency-check-core. If not, see http://www.gnu.org/licenses/.
    + 
      *
     16   - 
      *
    -  17   
      * Copyright (c) 2013 Jeremy Long. All Rights Reserved.
    +  17   + 
      */
     18   - 
      */
    -  19   
     package org.owasp.dependencycheck.data.update;
    +  19   + 
     
     20   - 
     
    -  21   
     /**
    -  22   +  21   
      * A pojo that contains the Url and timestamp of the current NvdCve XML files.
    -  23   +  22   
      *
    -  24   +  23   
      * @author Jeremy Long <jeremy.long@owasp.org>
    -  25   +  24   
      */
    -  26  15 
     public class NvdCveInfo {
    +  25  30 
     public class NvdCveInfo {
    +  26   + 
     
     27   - 
     
    + 
         /**
     28   - 
         /**
    -  29   
          * an id.
    +  29   + 
          */
     30   - 
          */
    -  31   
         private String id;
    +  31   + 
     
     32   - 
     
    + 
         /**
     33   - 
         /**
    -  34   
          * Get the value of id.
    +  34   + 
          *
     35   - 
          *
    -  36   
          * @return the value of id
    +  36   + 
          */
     37   - 
          */
    -  38   
         public String getId() {
    -  39  8 
             return id;
    +  38  16 
             return id;
    +  39   + 
         }
     40   - 
         }
    + 
     
     41   - 
     
    + 
         /**
     42   - 
         /**
    -  43   
          * Set the value of id.
    +  43   + 
          *
     44   - 
          *
    -  45   
          * @param id new value of id
    +  45   + 
          */
     46   - 
          */
    -  47   
         public void setId(String id) {
    -  48  11 
             this.id = id;
    -  49  11 
         }
    +  47  22 
             this.id = id;
    +  48  22 
         }
    +  49   + 
         /**
     50   - 
         /**
    -  51   
          * a url.
    +  51   + 
          */
     52   - 
          */
    -  53   
         private String url;
    +  53   + 
     
     54   - 
     
    + 
         /**
     55   - 
         /**
    -  56   
          * Get the value of url.
    +  56   + 
          *
     57   - 
          *
    -  58   
          * @return the value of url
    +  58   + 
          */
     59   - 
          */
    -  60   
         public String getUrl() {
    -  61  3 
             return url;
    +  60  6 
             return url;
    +  61   + 
         }
     62   - 
         }
    + 
     
     63   - 
     
    + 
         /**
     64   - 
         /**
    -  65   
          * Set the value of url.
    +  65   + 
          *
     66   - 
          *
    -  67   
          * @param url new value of url
    +  67   + 
          */
     68   - 
          */
    -  69   
         public void setUrl(String url) {
    -  70  10 
             this.url = url;
    -  71  10 
         }
    +  69  20 
             this.url = url;
    +  70  20 
         }
    +  71   + 
         /**
     72   - 
         /**
    -  73   
          * The 1.2 schema URL.
    +  73   + 
          */
     74   - 
          */
    -  75   
         private String oldSchemaVersionUrl;
    +  75   + 
     
     76   - 
     
    + 
         /**
     77   - 
         /**
    -  78   
          * Get the value of oldSchemaVersionUrl.
    +  78   + 
          *
     79   - 
          *
    -  80   
          * @return the value of oldSchemaVersionUrl
    +  80   + 
          */
     81   - 
          */
    -  82   
         public String getOldSchemaVersionUrl() {
    -  83  3 
             return oldSchemaVersionUrl;
    +  82  6 
             return oldSchemaVersionUrl;
    +  83   + 
         }
     84   - 
         }
    + 
     
     85   - 
     
    + 
         /**
     86   - 
         /**
    -  87   
          * Set the value of oldSchemaVersionUrl.
    +  87   + 
          *
     88   - 
          *
    -  89   
          * @param oldSchemaVersionUrl new value of oldSchemaVersionUrl
    +  89   + 
          */
     90   - 
          */
    -  91   
         public void setOldSchemaVersionUrl(String oldSchemaVersionUrl) {
    -  92  10 
             this.oldSchemaVersionUrl = oldSchemaVersionUrl;
    -  93  10 
         }
    +  91  20 
             this.oldSchemaVersionUrl = oldSchemaVersionUrl;
    +  92  20 
         }
    +  93   + 
         /**
     94   - 
         /**
    -  95   
          * a timestamp - epoch time.
    +  95   + 
          */
     96   - 
          */
    -  97   
         private long timestamp;
    +  97   + 
     
     98   - 
     
    + 
         /**
     99   - 
         /**
    -  100   
          * Get the value of timestamp - epoch time.
    +  100   + 
          *
     101   - 
          *
    -  102   
          * @return the value of timestamp - epoch time
    +  102   + 
          */
     103   - 
          */
    -  104   
         public long getTimestamp() {
    -  105  3 
             return timestamp;
    +  104  6 
             return timestamp;
    +  105   + 
         }
     106   - 
         }
    + 
     
     107   - 
     
    + 
         /**
     108   - 
         /**
    -  109   
          * Set the value of timestamp - epoch time.
    +  109   + 
          *
     110   - 
          *
    -  111   
          * @param timestamp new value of timestamp - epoch time
    +  111   + 
          */
     112   - 
          */
    -  113   
         public void setTimestamp(long timestamp) {
    -  114  11 
             this.timestamp = timestamp;
    -  115  11 
         }
    +  113  22 
             this.timestamp = timestamp;
    +  114  22 
         }
    +  115   + 
         /**
     116   - 
         /**
    -  117   
          * indicates whether or not this item should be updated.
    -  118   +  117   
          */
    -  119  15 
         private boolean needsUpdate = true;
    +  118  30 
         private boolean needsUpdate = true;
    +  119   + 
     
     120   - 
     
    + 
         /**
     121   - 
         /**
    -  122   
          * Get the value of needsUpdate.
    +  122   + 
          *
     123   - 
          *
    -  124   
          * @return the value of needsUpdate
    +  124   + 
          */
     125   - 
          */
    -  126   
         public boolean getNeedsUpdate() {
    -  127  5 
             return needsUpdate;
    -  128   +  126  10 
             return needsUpdate;
    +  127   
         }
    -  129   +  128   
     
    -  130   +  129   
         /**
    -  131   +  130   
          * Set the value of needsUpdate.
    -  132   +  131   
          *
    -  133   +  132   
          * @param needsUpdate new value of needsUpdate
    -  134   +  133   
          */
    -  135   +  134   
         public void setNeedsUpdate(boolean needsUpdate) {
    -  136  10 
             this.needsUpdate = needsUpdate;
    -  137  10 
         }
    -  138   +  135  20 
             this.needsUpdate = needsUpdate;
    +  136  20 
         }
    +  137   
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.NvdCveUpdater.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.NvdCveUpdater.html index 7a718de55..ec3d38131 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.NvdCveUpdater.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.NvdCveUpdater.html @@ -24,105 +24,101 @@  3   
      *
     4   - 
      * Dependency-check-core is free software: you can redistribute it and/or modify it
    + 
      * Licensed under the Apache License, Version 2.0 (the "License");
     5   - 
      * under the terms of the GNU General Public License as published by the Free
    + 
      * you may not use this file except in compliance with the License.
     6   - 
      * Software Foundation, either version 3 of the License, or (at your option) any
    + 
      * You may obtain a copy of the License at
     7   - 
      * later version.
    + 
      *
     8   - 
      *
    + 
      *     http://www.apache.org/licenses/LICENSE-2.0
     9   - 
      * Dependency-check-core is distributed in the hope that it will be useful, but
    + 
      *
     10   - 
      * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
    + 
      * Unless required by applicable law or agreed to in writing, software
     11   - 
      * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
    + 
      * distributed under the License is distributed on an "AS IS" BASIS,
     12   - 
      * details.
    + 
      * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13   - 
      *
    + 
      * See the License for the specific language governing permissions and
     14   - 
      * You should have received a copy of the GNU General Public License along with
    + 
      * limitations under the License.
     15   - 
      * dependency-check-core. If not, see http://www.gnu.org/licenses/.
    + 
      *
     16   - 
      *
    -  17   
      * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
    +  17   + 
      */
     18   - 
      */
    -  19   
     package org.owasp.dependencycheck.data.update;
    +  19   + 
     
     20   - 
     
    -  21   - 
     import org.owasp.dependencycheck.data.update.exception.UpdateException;
    -  22   
     import java.net.MalformedURLException;
    -  23   +  21   
     import java.util.logging.Level;
    -  24   +  22   
     import java.util.logging.Logger;
    -  25   +  23   + 
     import org.owasp.dependencycheck.data.update.exception.UpdateException;
    +  24   
     import org.owasp.dependencycheck.utils.DownloadFailedException;
    +  25   + 
     
     26   - 
     
    -  27   
     /**
    -  28   +  27   
      * Class responsible for updating the NVD CVE and CPE data stores.
    -  29   +  28   
      *
    -  30   +  29   
      * @author Jeremy Long <jeremy.long@owasp.org>
    -  31   +  30   
      */
    -  32  0 
     public class NvdCveUpdater implements CachedWebDataSource {
    -  33   +  31  0 
     public class NvdCveUpdater implements CachedWebDataSource {
    +  32   
     
    -  34   +  33   
         /**
    +  34   + 
          * <p>
     35   - 
          * <p>Downloads the latest NVD CVE XML file from the web and imports it into
    + 
          * Downloads the latest NVD CVE XML file from the web and imports it into the current CVE Database.</p>
     36   - 
          * the current CVE Database.</p>
    -  37   
          *
    +  37   + 
          * @throws UpdateException is thrown if there is an error updating the database
     38   - 
          * @throws UpdateException is thrown if there is an error updating the
    -  39   - 
          * database
    -  40   
          */
    -  41   +  39   
         @Override
    -  42   +  40   
         public void update() throws UpdateException {
    -  43   +  41   
             try {
    -  44  0 
                 final StandardUpdate task = new StandardUpdate();
    -  45  0 
                 if (task.isUpdateNeeded()) {
    -  46  0 
                     task.update();
    -  47   +  42  0 
                 final StandardUpdate task = new StandardUpdate();
    +  43  0 
                 if (task.isUpdateNeeded()) {
    +  44  0 
                     task.update();
    +  45   
                 }
    -  48  0 
             } catch (MalformedURLException ex) {
    -  49  0 
                 Logger.getLogger(NvdCveUpdater.class.getName()).log(Level.WARNING,
    -  50   +  46  0 
             } catch (MalformedURLException ex) {
    +  47  0 
                 Logger.getLogger(NvdCveUpdater.class.getName()).log(Level.WARNING,
    +  48   
                         "NVD CVE properties files contain an invalid URL, unable to update the data to use the most current data.");
    -  51  0 
                 Logger.getLogger(NvdCveUpdater.class.getName()).log(Level.FINE, null, ex);
    -  52  0 
             } catch (DownloadFailedException ex) {
    -  53  0 
                 Logger.getLogger(NvdCveUpdater.class.getName()).log(Level.WARNING,
    -  54   +  49  0 
                 Logger.getLogger(NvdCveUpdater.class.getName()).log(Level.FINE, null, ex);
    +  50  0 
             } catch (DownloadFailedException ex) {
    +  51  0 
                 Logger.getLogger(NvdCveUpdater.class.getName()).log(Level.WARNING,
    +  52   
                         "Unable to download the NVD CVE data, unable to update the data to use the most current data.");
    -  55  0 
                 Logger.getLogger(NvdCveUpdater.class.getName()).log(Level.FINE, null, ex);
    -  56  0 
             }
    -  57  0 
         }
    -  58   +  53  0 
                 Logger.getLogger(NvdCveUpdater.class.getName()).log(Level.FINE, null, ex);
    +  54  0 
             }
    +  55  0 
         }
    +  56   
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.StandardUpdate.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.StandardUpdate.html index ad7f48ac2..997e07b0c 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.StandardUpdate.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.StandardUpdate.html @@ -24,555 +24,529 @@  3   
      *
     4   - 
      * Dependency-check-core is free software: you can redistribute it and/or modify it
    + 
      * Licensed under the Apache License, Version 2.0 (the "License");
     5   - 
      * under the terms of the GNU General Public License as published by the Free
    + 
      * you may not use this file except in compliance with the License.
     6   - 
      * Software Foundation, either version 3 of the License, or (at your option) any
    + 
      * You may obtain a copy of the License at
     7   - 
      * later version.
    + 
      *
     8   - 
      *
    + 
      *     http://www.apache.org/licenses/LICENSE-2.0
     9   - 
      * Dependency-check-core is distributed in the hope that it will be useful, but
    + 
      *
     10   - 
      * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
    + 
      * Unless required by applicable law or agreed to in writing, software
     11   - 
      * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
    + 
      * distributed under the License is distributed on an "AS IS" BASIS,
     12   - 
      * details.
    + 
      * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13   - 
      *
    + 
      * See the License for the specific language governing permissions and
     14   - 
      * You should have received a copy of the GNU General Public License along with
    + 
      * limitations under the License.
     15   - 
      * dependency-check-core. If not, see http://www.gnu.org/licenses/.
    + 
      *
     16   - 
      *
    -  17   
      * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
    +  17   + 
      */
     18   - 
      */
    -  19   
     package org.owasp.dependencycheck.data.update;
    +  19   + 
     
     20   - 
     
    -  21   - 
     import org.owasp.dependencycheck.data.update.task.ProcessTask;
    -  22   - 
     import org.owasp.dependencycheck.data.update.task.CallableDownloadTask;
    -  23   - 
     import org.owasp.dependencycheck.data.update.exception.UpdateException;
    -  24   - 
     import org.owasp.dependencycheck.data.update.exception.InvalidDataException;
    -  25   - 
     import org.owasp.dependencycheck.data.nvdcve.DatabaseProperties;
    -  26   
     import java.net.MalformedURLException;
    -  27   +  21   
     import java.util.Calendar;
    -  28   +  22   
     import java.util.Date;
    -  29   +  23   
     import java.util.HashSet;
    -  30   +  24   
     import java.util.Set;
    -  31   +  25   
     import java.util.concurrent.ExecutionException;
    -  32   +  26   
     import java.util.concurrent.ExecutorService;
    -  33   +  27   
     import java.util.concurrent.Executors;
    -  34   +  28   
     import java.util.concurrent.Future;
    -  35   +  29   
     import java.util.logging.Level;
    -  36   +  30   
     import java.util.logging.Logger;
    -  37   +  31   
     import org.owasp.dependencycheck.data.nvdcve.CveDB;
    -  38   - 
     import org.owasp.dependencycheck.utils.DownloadFailedException;
    -  39   - 
     import org.owasp.dependencycheck.utils.Settings;
    -  40   +  32   
     import org.owasp.dependencycheck.data.nvdcve.DatabaseException;
    -  41   - 
     import org.owasp.dependencycheck.utils.InvalidSettingException;
    -  42   +  33   + 
     import org.owasp.dependencycheck.data.nvdcve.DatabaseProperties;
    +  34   
     import static org.owasp.dependencycheck.data.nvdcve.DatabaseProperties.MODIFIED;
    +  35   + 
     import org.owasp.dependencycheck.data.update.exception.InvalidDataException;
    +  36   + 
     import org.owasp.dependencycheck.data.update.exception.UpdateException;
    +  37   + 
     import org.owasp.dependencycheck.data.update.task.CallableDownloadTask;
    +  38   + 
     import org.owasp.dependencycheck.data.update.task.ProcessTask;
    +  39   + 
     import org.owasp.dependencycheck.utils.DownloadFailedException;
    +  40   + 
     import org.owasp.dependencycheck.utils.InvalidSettingException;
    +  41   + 
     import org.owasp.dependencycheck.utils.Settings;
    +  42   + 
     
     43   - 
     
    -  44   
     /**
    -  45   +  44   
      * Class responsible for updating the NVDCVE data store.
    -  46   +  45   
      *
    -  47   +  46   
      * @author Jeremy Long <jeremy.long@owasp.org>
    -  48   +  47   
      */
    -  49   +  48   
     public class StandardUpdate {
    +  49   + 
     
     50   - 
     
    + 
         /**
     51   - 
         /**
    -  52   
          * The max thread pool size to use when downloading files.
    -  53   +  52   
          */
    -  54  0 
         public static final int MAX_THREAD_POOL_SIZE = Settings.getInt(Settings.KEYS.MAX_DOWNLOAD_THREAD_POOL_SIZE, 3);
    +  53  0 
         public static final int MAX_THREAD_POOL_SIZE = Settings.getInt(Settings.KEYS.MAX_DOWNLOAD_THREAD_POOL_SIZE, 3);
    +  54   + 
         /**
     55   - 
         /**
    + 
          * Information about the timestamps and URLs for data that needs to be updated.
     56   - 
          * Information about the timestamps and URLs for data that needs to be
    + 
          */
     57   - 
          * updated.
    -  58   - 
          */
    -  59   
         private DatabaseProperties properties;
    -  60   +  58   
         /**
    -  61   +  59   
          * A collection of updateable NVD CVE items.
    -  62   +  60   
          */
    -  63   +  61   
         private UpdateableNvdCve updateable;
    -  64   +  62   
         /**
    -  65   +  63   
          * Reference to the Cve Database.
    +  64   + 
          */
    +  65  0 
         private CveDB cveDB = null;
     66   - 
          */
    -  67  0 
         private CveDB cveDB = null;
    + 
     
    +  67   + 
         /**
     68   - 
     
    -  69   - 
         /**
    -  70   
          * Gets whether or not an update is needed.
    -  71   +  69   
          *
    -  72   +  70   
          * @return true or false depending on whether an update is needed
    -  73   +  71   
          */
    -  74   +  72   
         public boolean isUpdateNeeded() {
    -  75  0 
             return updateable.isUpdateNeeded();
    +  73  0 
             return updateable.isUpdateNeeded();
    +  74   + 
         }
    +  75   + 
     
     76   - 
         }
    + 
         /**
     77   - 
     
    -  78   - 
         /**
    -  79   
          * Constructs a new Standard Update Task.
    -  80   +  78   
          *
    -  81   +  79   
          * @throws MalformedURLException thrown if a configured URL is malformed
    +  80   + 
          * @throws DownloadFailedException thrown if a timestamp cannot be checked on a configured URL
    +  81   + 
          * @throws UpdateException thrown if there is an exception generating the update task
     82   - 
          * @throws DownloadFailedException thrown if a timestamp cannot be checked
    -  83   - 
          * on a configured URL
    -  84   - 
          * @throws UpdateException thrown if there is an exception generating the
    -  85   - 
          * update task
    -  86   
          */
    -  87  0 
         public StandardUpdate() throws MalformedURLException, DownloadFailedException, UpdateException {
    -  88  0 
             openDataStores();
    -  89  0 
             properties = cveDB.getDatabaseProperties();
    -  90  0 
             updateable = updatesNeeded();
    -  91  0 
         }
    +  83  0 
         public StandardUpdate() throws MalformedURLException, DownloadFailedException, UpdateException {
    +  84  0 
             openDataStores();
    +  85  0 
             properties = cveDB.getDatabaseProperties();
    +  86  0 
             updateable = updatesNeeded();
    +  87  0 
         }
    +  88   + 
     
    +  89   + 
         /**
    +  90   + 
          * <p>
    +  91   + 
          * Downloads the latest NVD CVE XML file from the web and imports it into the current CVE Database.</p>
     92   - 
     
    + 
          *
     93   - 
         /**
    + 
          * @throws UpdateException is thrown if there is an error updating the database
     94   - 
          * <p>Downloads the latest NVD CVE XML file from the web and imports it into
    + 
          */
     95   - 
          * the current CVE Database.</p>
    -  96   - 
          *
    -  97   - 
          * @throws UpdateException is thrown if there is an error updating the
    -  98   - 
          * database
    -  99   - 
          */
    -  100   
         public void update() throws UpdateException {
    -  101  0 
             int maxUpdates = 0;
    -  102   +  96  0 
             int maxUpdates = 0;
    +  97   
             try {
    -  103  0 
                 for (NvdCveInfo cve : updateable) {
    -  104  0 
                     if (cve.getNeedsUpdate()) {
    -  105  0 
                         maxUpdates += 1;
    -  106   +  98  0 
                 for (NvdCveInfo cve : updateable) {
    +  99  0 
                     if (cve.getNeedsUpdate()) {
    +  100  0 
                         maxUpdates += 1;
    +  101   
                     }
    -  107  0 
                 }
    -  108  0 
                 if (maxUpdates <= 0) {
    -  109   +  102  0 
                 }
    +  103  0 
                 if (maxUpdates <= 0) {
    +  104   
                     return;
    -  110   +  105   
                 }
    -  111  0 
                 if (maxUpdates > 3) {
    -  112  0 
                     Logger.getLogger(StandardUpdate.class.getName()).log(Level.INFO,
    -  113   +  106  0 
                 if (maxUpdates > 3) {
    +  107  0 
                     Logger.getLogger(StandardUpdate.class.getName()).log(Level.INFO,
    +  108   
                             "NVD CVE requires several updates; this could take a couple of minutes.");
    -  114   +  109   
                 }
    -  115  0 
                 if (maxUpdates > 0) {
    -  116  0 
                     openDataStores();
    -  117   +  110  0 
                 if (maxUpdates > 0) {
    +  111  0 
                     openDataStores();
    +  112   
                 }
    -  118   +  113   
     
    -  119  0 
                 final int poolSize = (MAX_THREAD_POOL_SIZE < maxUpdates) ? MAX_THREAD_POOL_SIZE : maxUpdates;
    -  120   +  114  0 
                 final int poolSize = (MAX_THREAD_POOL_SIZE < maxUpdates) ? MAX_THREAD_POOL_SIZE : maxUpdates;
    +  115   
     
    -  121  0 
                 final ExecutorService downloadExecutors = Executors.newFixedThreadPool(poolSize);
    -  122  0 
                 final ExecutorService processExecutor = Executors.newSingleThreadExecutor();
    -  123  0 
                 final Set<Future<Future<ProcessTask>>> downloadFutures = new HashSet<Future<Future<ProcessTask>>>(maxUpdates);
    -  124  0 
                 for (NvdCveInfo cve : updateable) {
    -  125  0 
                     if (cve.getNeedsUpdate()) {
    -  126  0 
                         final CallableDownloadTask call = new CallableDownloadTask(cve, processExecutor, cveDB);
    -  127  0 
                         downloadFutures.add(downloadExecutors.submit(call));
    -  128   +  116  0 
                 final ExecutorService downloadExecutors = Executors.newFixedThreadPool(poolSize);
    +  117  0 
                 final ExecutorService processExecutor = Executors.newSingleThreadExecutor();
    +  118  0 
                 final Set<Future<Future<ProcessTask>>> downloadFutures = new HashSet<Future<Future<ProcessTask>>>(maxUpdates);
    +  119  0 
                 for (NvdCveInfo cve : updateable) {
    +  120  0 
                     if (cve.getNeedsUpdate()) {
    +  121  0 
                         final CallableDownloadTask call = new CallableDownloadTask(cve, processExecutor, cveDB);
    +  122  0 
                         downloadFutures.add(downloadExecutors.submit(call));
    +  123   
                     }
    -  129  0 
                 }
    -  130  0 
                 downloadExecutors.shutdown();
    -  131   +  124  0 
                 }
    +  125  0 
                 downloadExecutors.shutdown();
    +  126   
     
    -  132   +  127   
                 //next, move the future future processTasks to just future processTasks
    -  133  0 
                 final Set<Future<ProcessTask>> processFutures = new HashSet<Future<ProcessTask>>(maxUpdates);
    -  134  0 
                 for (Future<Future<ProcessTask>> future : downloadFutures) {
    -  135  0 
                     Future<ProcessTask> task = null;
    +  128  0 
                 final Set<Future<ProcessTask>> processFutures = new HashSet<Future<ProcessTask>>(maxUpdates);
    +  129  0 
                 for (Future<Future<ProcessTask>> future : downloadFutures) {
    +  130  0 
                     Future<ProcessTask> task = null;
    +  131   + 
                     try {
    +  132  0 
                         task = future.get();
    +  133  0 
                     } catch (InterruptedException ex) {
    +  134  0 
                         downloadExecutors.shutdownNow();
    +  135  0 
                         processExecutor.shutdownNow();
     136   - 
                     try {
    -  137  0 
                         task = future.get();
    -  138  0 
                     } catch (InterruptedException ex) {
    -  139  0 
                         downloadExecutors.shutdownNow();
    -  140  0 
                         processExecutor.shutdownNow();
    -  141   
     
    -  142  0 
                         Logger.getLogger(StandardUpdate.class.getName()).log(Level.FINE, "Thread was interupted during download", ex);
    -  143  0 
                         throw new UpdateException("The download was interupted", ex);
    -  144  0 
                     } catch (ExecutionException ex) {
    -  145  0 
                         downloadExecutors.shutdownNow();
    -  146  0 
                         processExecutor.shutdownNow();
    -  147   +  137  0 
                         Logger.getLogger(StandardUpdate.class.getName()).log(Level.FINE, "Thread was interupted during download", ex);
    +  138  0 
                         throw new UpdateException("The download was interupted", ex);
    +  139  0 
                     } catch (ExecutionException ex) {
    +  140  0 
                         downloadExecutors.shutdownNow();
    +  141  0 
                         processExecutor.shutdownNow();
    +  142   
     
    -  148  0 
                         Logger.getLogger(StandardUpdate.class.getName()).log(Level.FINE, "Thread was interupted during download execution", ex);
    -  149  0 
                         throw new UpdateException("The execution of the download was interupted", ex);
    -  150  0 
                     }
    -  151  0 
                     if (task == null) {
    -  152  0 
                         downloadExecutors.shutdownNow();
    -  153  0 
                         processExecutor.shutdownNow();
    -  154  0 
                         Logger.getLogger(StandardUpdate.class.getName()).log(Level.FINE, "Thread was interupted during download");
    -  155  0 
                         throw new UpdateException("The download was interupted; unable to complete the update");
    -  156   +  143  0 
                         Logger.getLogger(StandardUpdate.class.getName()).log(Level.FINE, "Thread was interupted during download execution", ex);
    +  144  0 
                         throw new UpdateException("The execution of the download was interupted", ex);
    +  145  0 
                     }
    +  146  0 
                     if (task == null) {
    +  147  0 
                         downloadExecutors.shutdownNow();
    +  148  0 
                         processExecutor.shutdownNow();
    +  149  0 
                         Logger.getLogger(StandardUpdate.class.getName()).log(Level.FINE, "Thread was interupted during download");
    +  150  0 
                         throw new UpdateException("The download was interupted; unable to complete the update");
    +  151   
                     } else {
    -  157  0 
                         processFutures.add(task);
    -  158   +  152  0 
                         processFutures.add(task);
    +  153   
                     }
    -  159  0 
                 }
    -  160   +  154  0 
                 }
    +  155   
     
    -  161  0 
                 for (Future<ProcessTask> future : processFutures) {
    -  162   +  156  0 
                 for (Future<ProcessTask> future : processFutures) {
    +  157   
                     try {
    -  163  0 
                         final ProcessTask task = future.get();
    -  164  0 
                         if (task.getException() != null) {
    -  165  0 
                             throw task.getException();
    -  166   +  158  0 
                         final ProcessTask task = future.get();
    +  159  0 
                         if (task.getException() != null) {
    +  160  0 
                             throw task.getException();
    +  161   
                         }
    -  167  0 
                     } catch (InterruptedException ex) {
    -  168  0 
                         processExecutor.shutdownNow();
    -  169  0 
                         Logger.getLogger(StandardUpdate.class.getName()).log(Level.FINE, "Thread was interupted during processing", ex);
    -  170  0 
                         throw new UpdateException(ex);
    -  171  0 
                     } catch (ExecutionException ex) {
    -  172  0 
                         processExecutor.shutdownNow();
    -  173  0 
                         Logger.getLogger(StandardUpdate.class.getName()).log(Level.FINE, "Execution Exception during process", ex);
    -  174  0 
                         throw new UpdateException(ex);
    -  175   +  162  0 
                     } catch (InterruptedException ex) {
    +  163  0 
                         processExecutor.shutdownNow();
    +  164  0 
                         Logger.getLogger(StandardUpdate.class.getName()).log(Level.FINE, "Thread was interupted during processing", ex);
    +  165  0 
                         throw new UpdateException(ex);
    +  166  0 
                     } catch (ExecutionException ex) {
    +  167  0 
                         processExecutor.shutdownNow();
    +  168  0 
                         Logger.getLogger(StandardUpdate.class.getName()).log(Level.FINE, "Execution Exception during process", ex);
    +  169  0 
                         throw new UpdateException(ex);
    +  170   
                     } finally {
    -  176  0 
                         processExecutor.shutdown();
    -  177  0 
                     }
    -  178  0 
                 }
    -  179   +  171  0 
                         processExecutor.shutdown();
    +  172  0 
                     }
    +  173  0 
                 }
    +  174   
     
    -  180  0 
                 if (maxUpdates >= 1) { //ensure the modified file date gets written (we may not have actually updated it)
    -  181  0 
                     properties.save(updateable.get(MODIFIED));
    -  182  0 
                     cveDB.cleanupDatabase();
    -  183   +  175  0 
                 if (maxUpdates >= 1) { //ensure the modified file date gets written (we may not have actually updated it)
    +  176  0 
                     properties.save(updateable.get(MODIFIED));
    +  177  0 
                     cveDB.cleanupDatabase();
    +  178   
                 }
    -  184   +  179   
             } finally {
    -  185  0 
                 closeDataStores();
    -  186  0 
             }
    -  187  0 
         }
    +  180  0 
                 closeDataStores();
    +  181  0 
             }
    +  182  0 
         }
    +  183   + 
     
    +  184   + 
         /**
    +  185   + 
          * Determines if the index needs to be updated. This is done by fetching the NVD CVE meta data and checking the last
    +  186   + 
          * update date. If the data needs to be refreshed this method will return the NvdCveUrl for the files that need to
    +  187   + 
          * be updated.
     188   - 
     
    + 
          *
     189   - 
         /**
    -  190   - 
          * Determines if the index needs to be updated. This is done by fetching the
    -  191   - 
          * NVD CVE meta data and checking the last update date. If the data needs to
    -  192   - 
          * be refreshed this method will return the NvdCveUrl for the files that
    -  193   - 
          * need to be updated.
    -  194   - 
          *
    -  195   
          * @return the collection of files that need to be updated
    -  196   - 
          * @throws MalformedURLException is thrown if the URL for the NVD CVE Meta
    -  197   - 
          * data is incorrect
    -  198   - 
          * @throws DownloadFailedException is thrown if there is an error.
    -  199   - 
          * downloading the NVD CVE download data file
    -  200   - 
          * @throws UpdateException Is thrown if there is an issue with the last
    -  201   - 
          * updated properties file
    -  202   +  190   + 
          * @throws MalformedURLException is thrown if the URL for the NVD CVE Meta data is incorrect
    +  191   + 
          * @throws DownloadFailedException is thrown if there is an error. downloading the NVD CVE download data file
    +  192   + 
          * @throws UpdateException Is thrown if there is an issue with the last updated properties file
    +  193   
          */
    -  203   +  194   
         protected final UpdateableNvdCve updatesNeeded() throws MalformedURLException, DownloadFailedException, UpdateException {
    -  204  0 
             UpdateableNvdCve updates = null;
    -  205   +  195  0 
             UpdateableNvdCve updates = null;
    +  196   
             try {
    -  206  0 
                 updates = retrieveCurrentTimestampsFromWeb();
    -  207  0 
             } catch (InvalidDataException ex) {
    -  208  0 
                 final String msg = "Unable to retrieve valid timestamp from nvd cve downloads page";
    -  209  0 
                 Logger.getLogger(StandardUpdate.class.getName()).log(Level.FINE, msg, ex);
    -  210  0 
                 throw new DownloadFailedException(msg, ex);
    -  211  0 
             } catch (InvalidSettingException ex) {
    -  212  0 
                 Logger.getLogger(StandardUpdate.class.getName()).log(Level.FINE, "Invalid setting found when retrieving timestamps", ex);
    -  213  0 
                 throw new DownloadFailedException("Invalid settings", ex);
    -  214  0 
             }
    -  215   +  197  0 
                 updates = retrieveCurrentTimestampsFromWeb();
    +  198  0 
             } catch (InvalidDataException ex) {
    +  199  0 
                 final String msg = "Unable to retrieve valid timestamp from nvd cve downloads page";
    +  200  0 
                 Logger.getLogger(StandardUpdate.class.getName()).log(Level.FINE, msg, ex);
    +  201  0 
                 throw new DownloadFailedException(msg, ex);
    +  202  0 
             } catch (InvalidSettingException ex) {
    +  203  0 
                 Logger.getLogger(StandardUpdate.class.getName()).log(Level.FINE, "Invalid setting found when retrieving timestamps", ex);
    +  204  0 
                 throw new DownloadFailedException("Invalid settings", ex);
    +  205  0 
             }
    +  206   
     
    -  216  0 
             if (updates == null) {
    -  217  0 
                 throw new DownloadFailedException("Unable to retrieve the timestamps of the currently published NVD CVE data");
    -  218   +  207  0 
             if (updates == null) {
    +  208  0 
                 throw new DownloadFailedException("Unable to retrieve the timestamps of the currently published NVD CVE data");
    +  209   
             }
    -  219  0 
             if (!properties.isEmpty()) {
    -  220   +  210  0 
             if (!properties.isEmpty()) {
    +  211   
                 try {
    -  221  0 
                     final long lastUpdated = Long.parseLong(properties.getProperty(DatabaseProperties.LAST_UPDATED, "0"));
    -  222  0 
                     final Date now = new Date();
    -  223  0 
                     final int days = Settings.getInt(Settings.KEYS.CVE_MODIFIED_VALID_FOR_DAYS, 7);
    -  224  0 
                     if (lastUpdated == updates.getTimeStamp(MODIFIED)) {
    -  225  0 
                         updates.clear(); //we don't need to update anything.
    -  226  0 
                     } else if (withinRange(lastUpdated, now.getTime(), days)) {
    -  227  0 
                         for (NvdCveInfo entry : updates) {
    -  228  0 
                             if (MODIFIED.equals(entry.getId())) {
    -  229  0 
                                 entry.setNeedsUpdate(true);
    -  230   +  212  0 
                     final long lastUpdated = Long.parseLong(properties.getProperty(DatabaseProperties.LAST_UPDATED, "0"));
    +  213  0 
                     final Date now = new Date();
    +  214  0 
                     final int days = Settings.getInt(Settings.KEYS.CVE_MODIFIED_VALID_FOR_DAYS, 7);
    +  215  0 
                     if (lastUpdated == updates.getTimeStamp(MODIFIED)) {
    +  216  0 
                         updates.clear(); //we don't need to update anything.
    +  217  0 
                     } else if (withinRange(lastUpdated, now.getTime(), days)) {
    +  218  0 
                         for (NvdCveInfo entry : updates) {
    +  219  0 
                             if (MODIFIED.equals(entry.getId())) {
    +  220  0 
                                 entry.setNeedsUpdate(true);
    +  221   
                             } else {
    -  231  0 
                                 entry.setNeedsUpdate(false);
    -  232   +  222  0 
                                 entry.setNeedsUpdate(false);
    +  223   
                             }
    -  233  0 
                         }
    -  234   +  224  0 
                         }
    +  225   
                     } else { //we figure out which of the several XML files need to be downloaded.
    -  235  0 
                         for (NvdCveInfo entry : updates) {
    -  236  0 
                             if (MODIFIED.equals(entry.getId())) {
    -  237  0 
                                 entry.setNeedsUpdate(true);
    -  238   +  226  0 
                         for (NvdCveInfo entry : updates) {
    +  227  0 
                             if (MODIFIED.equals(entry.getId())) {
    +  228  0 
                                 entry.setNeedsUpdate(true);
    +  229   
                             } else {
    -  239  0 
                                 long currentTimestamp = 0;
    -  240   +  230  0 
                                 long currentTimestamp = 0;
    +  231   
                                 try {
    -  241  0 
                                     currentTimestamp = Long.parseLong(properties.getProperty(DatabaseProperties.LAST_UPDATED_BASE + entry.getId(), "0"));
    -  242  0 
                                 } catch (NumberFormatException ex) {
    -  243  0 
                                     final String msg = String.format("Error parsing '%s' '%s' from nvdcve.lastupdated",
    -  244   +  232  0 
                                     currentTimestamp = Long.parseLong(properties.getProperty(DatabaseProperties.LAST_UPDATED_BASE + entry.getId(), "0"));
    +  233  0 
                                 } catch (NumberFormatException ex) {
    +  234  0 
                                     final String msg = String.format("Error parsing '%s' '%s' from nvdcve.lastupdated",
    +  235   
                                             DatabaseProperties.LAST_UPDATED_BASE, entry.getId());
    -  245  0 
                                     Logger
    -  246   +  236  0 
                                     Logger
    +  237   
                                             .getLogger(StandardUpdate.class
    -  247   - 
                                             .getName()).log(Level.FINE, msg, ex);
    -  248  0 
                                 }
    -  249  0 
                                 if (currentTimestamp == entry.getTimestamp()) {
    -  250  0 
                                     entry.setNeedsUpdate(false);
    -  251   +  238   + 
                                                     .getName()).log(Level.FINE, msg, ex);
    +  239  0 
                                 }
    +  240  0 
                                 if (currentTimestamp == entry.getTimestamp()) {
    +  241  0 
                                     entry.setNeedsUpdate(false);
    +  242   
                                 }
    -  252   +  243   
                             }
    -  253  0 
                         }
    -  254   +  244  0 
                         }
    +  245   
                     }
    -  255  0 
                 } catch (NumberFormatException ex) {
    -  256  0 
                     final String msg = "An invalid schema version or timestamp exists in the data.properties file.";
    -  257  0 
                     Logger
    -  258   +  246  0 
                 } catch (NumberFormatException ex) {
    +  247  0 
                     final String msg = "An invalid schema version or timestamp exists in the data.properties file.";
    +  248  0 
                     Logger
    +  249   
                             .getLogger(StandardUpdate.class
    -  259   - 
                             .getName()).log(Level.WARNING, msg);
    -  260  0 
                     Logger.getLogger(StandardUpdate.class
    -  261   +  250   + 
                                     .getName()).log(Level.WARNING, msg);
    +  251  0 
                     Logger.getLogger(StandardUpdate.class
    +  252   
                             .getName()).log(Level.FINE, null, ex);
    -  262  0 
                 }
    -  263   +  253  0 
                 }
    +  254   
             }
    -  264  0 
             return updates;
    -  265   +  255  0 
             return updates;
    +  256   
         }
    -  266   +  257   
     
    -  267   +  258   
         /**
    -  268   +  259   
          * Retrieves the timestamps from the NVD CVE meta data file.
    -  269   +  260   
          *
    -  270   +  261   
          * @return the timestamp from the currently published nvdcve downloads page
    -  271   - 
          * @throws MalformedURLException thrown if the URL for the NVD CCE Meta data
    -  272   - 
          * is incorrect.
    -  273   - 
          * @throws DownloadFailedException thrown if there is an error downloading
    -  274   - 
          * the nvd cve meta data file
    -  275   - 
          * @throws InvalidDataException thrown if there is an exception parsing the
    -  276   - 
          * timestamps
    -  277   +  262   + 
          * @throws MalformedURLException thrown if the URL for the NVD CCE Meta data is incorrect.
    +  263   + 
          * @throws DownloadFailedException thrown if there is an error downloading the nvd cve meta data file
    +  264   + 
          * @throws InvalidDataException thrown if there is an exception parsing the timestamps
    +  265   
          * @throws InvalidSettingException thrown if the settings are invalid
    -  278   +  266   
          */
    -  279   +  267   
         private UpdateableNvdCve retrieveCurrentTimestampsFromWeb()
    -  280   +  268   
                 throws MalformedURLException, DownloadFailedException, InvalidDataException, InvalidSettingException {
    -  281   +  269   
     
    -  282  0 
             final UpdateableNvdCve updates = new UpdateableNvdCve();
    -  283  0 
             updates.add(MODIFIED, Settings.getString(Settings.KEYS.CVE_MODIFIED_20_URL),
    -  284   +  270  0 
             final UpdateableNvdCve updates = new UpdateableNvdCve();
    +  271  0 
             updates.add(MODIFIED, Settings.getString(Settings.KEYS.CVE_MODIFIED_20_URL),
    +  272   
                     Settings.getString(Settings.KEYS.CVE_MODIFIED_12_URL),
    -  285   +  273   
                     false);
    -  286   +  274   
     
    -  287  0 
             final int start = Settings.getInt(Settings.KEYS.CVE_START_YEAR);
    -  288  0 
             final int end = Calendar.getInstance().get(Calendar.YEAR);
    -  289  0 
             final String baseUrl20 = Settings.getString(Settings.KEYS.CVE_SCHEMA_2_0);
    -  290  0 
             final String baseUrl12 = Settings.getString(Settings.KEYS.CVE_SCHEMA_1_2);
    -  291  0 
             for (int i = start; i <= end; i++) {
    -  292  0 
                 updates.add(Integer.toString(i), String.format(baseUrl20, i),
    -  293   +  275  0 
             final int start = Settings.getInt(Settings.KEYS.CVE_START_YEAR);
    +  276  0 
             final int end = Calendar.getInstance().get(Calendar.YEAR);
    +  277  0 
             final String baseUrl20 = Settings.getString(Settings.KEYS.CVE_SCHEMA_2_0);
    +  278  0 
             final String baseUrl12 = Settings.getString(Settings.KEYS.CVE_SCHEMA_1_2);
    +  279  0 
             for (int i = start; i <= end; i++) {
    +  280  0 
                 updates.add(Integer.toString(i), String.format(baseUrl20, i),
    +  281   
                         String.format(baseUrl12, i),
    -  294   +  282   
                         true);
    -  295   +  283   
             }
    -  296   +  284   
     
    -  297  0 
             return updates;
    -  298   +  285  0 
             return updates;
    +  286   
         }
    -  299   +  287   
     
    -  300   +  288   
         /**
    -  301   +  289   
          * Closes the CVE and CPE data stores.
    -  302   +  290   
          */
    -  303   +  291   
         protected void closeDataStores() {
    -  304  0 
             if (cveDB != null) {
    -  305   +  292  0 
             if (cveDB != null) {
    +  293   
                 try {
    -  306  0 
                     cveDB.close();
    -  307  0 
                 } catch (Exception ignore) {
    -  308  0 
                     Logger.getLogger(StandardUpdate.class.getName()).log(Level.FINEST, "Error closing the cveDB", ignore);
    -  309  0 
                 }
    -  310   +  294  0 
                     cveDB.close();
    +  295  0 
                 } catch (Exception ignore) {
    +  296  0 
                     Logger.getLogger(StandardUpdate.class.getName()).log(Level.FINEST, "Error closing the cveDB", ignore);
    +  297  0 
                 }
    +  298   
             }
    -  311  0 
         }
    -  312   +  299  0 
         }
    +  300   
     
    -  313   +  301   
         /**
    -  314   +  302   
          * Opens the CVE and CPE data stores.
    -  315   +  303   
          *
    -  316   +  304   
          * @throws UpdateException thrown if a data store cannot be opened
    -  317   +  305   
          */
    -  318   +  306   
         protected final void openDataStores() throws UpdateException {
    -  319  0 
             if (cveDB != null) {
    -  320  0 
                 return;
    -  321   +  307  0 
             if (cveDB != null) {
    +  308  0 
                 return;
    +  309   
             }
    -  322   +  310   
             try {
    -  323  0 
                 cveDB = new CveDB();
    -  324  0 
                 cveDB.open();
    -  325  0 
             } catch (DatabaseException ex) {
    -  326  0 
                 closeDataStores();
    -  327  0 
                 Logger.getLogger(StandardUpdate.class.getName()).log(Level.FINE, "Database Exception opening databases", ex);
    -  328  0 
                 throw new UpdateException("Error updating the CPE/CVE data, please see the log file for more details.");
    -  329  0 
             }
    -  330  0 
         }
    -  331   +  311  0 
                 cveDB = new CveDB();
    +  312  0 
                 cveDB.open();
    +  313  0 
             } catch (DatabaseException ex) {
    +  314  0 
                 closeDataStores();
    +  315  0 
                 Logger.getLogger(StandardUpdate.class.getName()).log(Level.FINE, "Database Exception opening databases", ex);
    +  316  0 
                 throw new UpdateException("Error updating the CPE/CVE data, please see the log file for more details.");
    +  317  0 
             }
    +  318  0 
         }
    +  319   
     
    -  332   +  320   
         /**
    -  333   - 
          * Determines if the epoch date is within the range specified of the
    -  334   - 
          * compareTo epoch time. This takes the (compareTo-date)/1000/60/60/24 to
    -  335   - 
          * get the number of days. If the calculated days is less then the range the
    -  336   - 
          * date is considered valid.
    -  337   +  321   + 
          * Determines if the epoch date is within the range specified of the compareTo epoch time. This takes the
    +  322   + 
          * (compareTo-date)/1000/60/60/24 to get the number of days. If the calculated days is less then the range the date
    +  323   + 
          * is considered valid.
    +  324   
          *
    -  338   +  325   
          * @param date the date to be checked.
    -  339   +  326   
          * @param compareTo the date to compare to.
    -  340   +  327   
          * @param range the range in days to be considered valid.
    -  341   +  328   
          * @return whether or not the date is within the range.
    -  342   +  329   
          */
    -  343   +  330   
         protected boolean withinRange(long date, long compareTo, int range) {
    -  344  0 
             final double differenceInDays = (compareTo - date) / 1000.0 / 60.0 / 60.0 / 24.0;
    -  345  0 
             return differenceInDays < range;
    -  346   +  331  0 
             final double differenceInDays = (compareTo - date) / 1000.0 / 60.0 / 60.0 / 24.0;
    +  332  0 
             return differenceInDays < range;
    +  333   
         }
    -  347   +  334   
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.UpdateService.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.UpdateService.html index e2b0ab2d6..2b85a2e67 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.UpdateService.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.UpdateService.html @@ -24,128 +24,124 @@  3   
      *
     4   - 
      * Dependency-check-core is free software: you can redistribute it and/or modify it
    + 
      * Licensed under the Apache License, Version 2.0 (the "License");
     5   - 
      * under the terms of the GNU General Public License as published by the Free
    + 
      * you may not use this file except in compliance with the License.
     6   - 
      * Software Foundation, either version 3 of the License, or (at your option) any
    + 
      * You may obtain a copy of the License at
     7   - 
      * later version.
    + 
      *
     8   - 
      *
    + 
      *     http://www.apache.org/licenses/LICENSE-2.0
     9   - 
      * Dependency-check-core is distributed in the hope that it will be useful, but
    + 
      *
     10   - 
      * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
    + 
      * Unless required by applicable law or agreed to in writing, software
     11   - 
      * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
    + 
      * distributed under the License is distributed on an "AS IS" BASIS,
     12   - 
      * details.
    + 
      * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13   - 
      *
    + 
      * See the License for the specific language governing permissions and
     14   - 
      * You should have received a copy of the GNU General Public License along with
    + 
      * limitations under the License.
     15   - 
      * dependency-check-core. If not, see http://www.gnu.org/licenses/.
    + 
      *
     16   - 
      *
    -  17   
      * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
    +  17   + 
      */
     18   - 
      */
    -  19   
     package org.owasp.dependencycheck.data.update;
    +  19   + 
     
     20   - 
     
    -  21   
     import java.util.Iterator;
    -  22   +  21   
     import java.util.ServiceLoader;
    +  22   + 
     
     23   - 
     
    -  24   
     /**
    -  25   +  24   
      *
    -  26   +  25   
      * @author Jeremy Long <jeremy.long@owasp.org>
    -  27   +  26   
      */
    -  28   +  27   
     public final class UpdateService {
    +  28   + 
     
     29   - 
     
    + 
         /**
     30   - 
         /**
    -  31   
          * the singleton reference to the service.
    +  31   + 
          */
     32   - 
          */
    -  33   
         private static UpdateService service;
    +  33   + 
         /**
     34   - 
         /**
    -  35   
          * the service loader for CachedWebDataSource.
    +  35   + 
          */
     36   - 
          */
    -  37   
         private final ServiceLoader<CachedWebDataSource> loader;
    +  37   + 
     
     38   - 
     
    + 
         /**
     39   - 
         /**
    -  40   
          * Creates a new instance of UpdateService
    -  41   +  40   
          */
    -  42  0 
         private UpdateService() {
    -  43  0 
             loader = ServiceLoader.load(CachedWebDataSource.class);
    -  44  0 
         }
    +  41  0 
         private UpdateService() {
    +  42  0 
             loader = ServiceLoader.load(CachedWebDataSource.class);
    +  43  0 
         }
    +  44   + 
     
     45   - 
     
    + 
         /**
     46   - 
         /**
    -  47   
          * Retrieve the singleton instance of UpdateService.
    +  47   + 
          *
     48   - 
          *
    -  49   
          * @return a singleton UpdateService.
    +  49   + 
          */
     50   - 
          */
    -  51   
         public static synchronized UpdateService getInstance() {
    -  52  0 
             if (service == null) {
    -  53  0 
                 service = new UpdateService();
    -  54   +  51  0 
             if (service == null) {
    +  52  0 
                 service = new UpdateService();
    +  53   
             }
    -  55  0 
             return service;
    +  54  0 
             return service;
    +  55   + 
         }
     56   - 
         }
    -  57   
     
    -  58   +  57   
         /**
    +  58   + 
          * Returns an Iterator for all instances of the CachedWebDataSource interface.
     59   - 
          * Returns an Iterator for all instances of the CachedWebDataSource
    -  60   - 
          * interface.
    -  61   
          *
    -  62   +  60   
          * @return an iterator of CachedWebDataSource.
    -  63   +  61   
          */
    -  64   +  62   
         public Iterator<CachedWebDataSource> getDataSources() {
    -  65  0 
             return loader.iterator();
    -  66   +  63  0 
             return loader.iterator();
    +  64   
         }
    -  67   +  65   
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.UpdateableNvdCve.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.UpdateableNvdCve.html index 092e88ccc..28db2acc5 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.UpdateableNvdCve.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.UpdateableNvdCve.html @@ -24,227 +24,227 @@  3   
      *
     4   - 
      * Dependency-check-core is free software: you can redistribute it and/or modify it
    + 
      * Licensed under the Apache License, Version 2.0 (the "License");
     5   - 
      * under the terms of the GNU General Public License as published by the Free
    + 
      * you may not use this file except in compliance with the License.
     6   - 
      * Software Foundation, either version 3 of the License, or (at your option) any
    + 
      * You may obtain a copy of the License at
     7   - 
      * later version.
    + 
      *
     8   - 
      *
    + 
      *     http://www.apache.org/licenses/LICENSE-2.0
     9   - 
      * Dependency-check-core is distributed in the hope that it will be useful, but
    + 
      *
     10   - 
      * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
    + 
      * Unless required by applicable law or agreed to in writing, software
     11   - 
      * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
    + 
      * distributed under the License is distributed on an "AS IS" BASIS,
     12   - 
      * details.
    + 
      * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13   - 
      *
    + 
      * See the License for the specific language governing permissions and
     14   - 
      * You should have received a copy of the GNU General Public License along with
    + 
      * limitations under the License.
     15   - 
      * dependency-check-core. If not, see http://www.gnu.org/licenses/.
    + 
      *
     16   - 
      *
    -  17   
      * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
    +  17   + 
      */
     18   - 
      */
    -  19   
     package org.owasp.dependencycheck.data.update;
    +  19   + 
     
     20   - 
     
    -  21   
     import java.net.MalformedURLException;
    -  22   +  21   
     import java.net.URL;
    -  23   +  22   
     import java.util.Iterator;
    -  24   +  23   
     import java.util.Map;
    -  25   +  24   
     import java.util.Map.Entry;
    -  26   +  25   
     import java.util.TreeMap;
    -  27   +  26   
     import org.owasp.dependencycheck.utils.DownloadFailedException;
    -  28   +  27   
     import org.owasp.dependencycheck.utils.Downloader;
    +  28   + 
     
     29   - 
     
    -  30   
     /**
    +  30   + 
      * Contains a collection of updateable NvdCveInfo objects. This is used to determine which files need to be downloaded
     31   - 
      * Contains a collection of updateable NvdCveInfo objects. This is used to
    + 
      * and processed.
     32   - 
      * determine which files need to be downloaded and processed.
    -  33   
      *
    -  34   +  33   
      * @author Jeremy Long <jeremy.long@owasp.org>
    -  35   +  34   
      */
    -  36  12 
     public class UpdateableNvdCve implements java.lang.Iterable<NvdCveInfo>, Iterator<NvdCveInfo> {
    +  35  24 
     public class UpdateableNvdCve implements java.lang.Iterable<NvdCveInfo>, Iterator<NvdCveInfo> {
    +  36   + 
     
     37   - 
     
    + 
         /**
     38   - 
         /**
    -  39   
          * A collection of sources of data.
    -  40   +  39   
          */
    -  41  5 
         private Map<String, NvdCveInfo> collection = new TreeMap<String, NvdCveInfo>();
    +  40  10 
         private Map<String, NvdCveInfo> collection = new TreeMap<String, NvdCveInfo>();
    +  41   + 
     
     42   - 
     
    + 
         /**
     43   - 
         /**
    + 
          * Returns the collection of NvdCveInfo objects. This method is mainly used for testing.
     44   - 
          * Returns the collection of NvdCveInfo objects. This method is mainly used
    + 
          *
     45   - 
          * for testing.
    -  46   - 
          *
    -  47   
          * @return the collection of NvdCveInfo objects
    -  48   +  46   
          */
    -  49   +  47   
         protected Map<String, NvdCveInfo> getCollection() {
    -  50  3 
             return collection;
    +  48  6 
             return collection;
    +  49   + 
         }
    +  50   + 
     
     51   - 
         }
    + 
         /**
     52   - 
     
    -  53   - 
         /**
    -  54   
          * Gets whether or not an update is needed.
    -  55   +  53   
          *
    -  56   +  54   
          * @return true or false depending on whether an update is needed
    -  57   +  55   
          */
    -  58   +  56   
         public boolean isUpdateNeeded() {
    -  59  3 
             for (NvdCveInfo item : this) {
    -  60  4 
                 if (item.getNeedsUpdate()) {
    -  61  1 
                     return true;
    -  62   +  57  6 
             for (NvdCveInfo item : this) {
    +  58  8 
                 if (item.getNeedsUpdate()) {
    +  59  2 
                     return true;
    +  60   
                 }
    -  63  3 
             }
    -  64  2 
             return false;
    +  61  6 
             }
    +  62  4 
             return false;
    +  63   + 
         }
    +  64   + 
     
     65   - 
         }
    + 
         /**
     66   - 
     
    + 
          * Adds a new entry of updateable information to the contained collection.
     67   - 
         /**
    + 
          *
     68   - 
          * Adds a new entry of updateable information to the contained collection.
    + 
          * @param id the key for the item to be added
     69   - 
          *
    + 
          * @param url the URL to download the item
     70   - 
          * @param id the key for the item to be added
    + 
          * @param oldUrl the URL for the old version of the item (the NVD CVE old schema still contains useful data we
     71   - 
          * @param url the URL to download the item
    + 
          * need).
     72   - 
          * @param oldUrl the URL for the old version of the item (the NVD CVE old
    + 
          * @throws MalformedURLException thrown if the URL provided is invalid
     73   - 
          * schema still contains useful data we need).
    + 
          * @throws DownloadFailedException thrown if the download fails.
     74   - 
          * @throws MalformedURLException thrown if the URL provided is invalid
    + 
          */
     75   - 
          * @throws DownloadFailedException thrown if the download fails.
    -  76   - 
          */
    -  77   
         public void add(String id, String url, String oldUrl) throws MalformedURLException, DownloadFailedException {
    -  78  1 
             add(id, url, oldUrl, false);
    -  79  1 
         }
    +  76  2 
             add(id, url, oldUrl, false);
    +  77  2 
         }
    +  78   + 
     
    +  79   + 
         /**
     80   - 
     
    -  81   - 
         /**
    -  82   
          * Adds a new entry of updateable information to the contained collection.
    -  83   +  81   
          *
    -  84   +  82   
          * @param id the key for the item to be added
    -  85   +  83   
          * @param url the URL to download the item
    +  84   + 
          * @param oldUrl the URL for the old version of the item (the NVD CVE old schema still contains useful data we
    +  85   + 
          * need).
     86   - 
          * @param oldUrl the URL for the old version of the item (the NVD CVE old
    -  87   - 
          * schema still contains useful data we need).
    -  88   
          * @param needsUpdate whether or not the data needs to be updated
    -  89   +  87   
          * @throws MalformedURLException thrown if the URL provided is invalid
    -  90   +  88   
          * @throws DownloadFailedException thrown if the download fails.
    -  91   +  89   
          */
    -  92   +  90   
         public void add(String id, String url, String oldUrl, boolean needsUpdate) throws MalformedURLException, DownloadFailedException {
    -  93  9 
             final NvdCveInfo item = new NvdCveInfo();
    -  94  9 
             item.setNeedsUpdate(needsUpdate); //the others default to true, to make life easier later this should default to false.
    -  95  9 
             item.setId(id);
    -  96  9 
             item.setUrl(url);
    -  97  9 
             item.setOldSchemaVersionUrl(oldUrl);
    -  98  9 
             item.setTimestamp(Downloader.getLastModified(new URL(url)));
    -  99  9 
             collection.put(id, item);
    -  100  9 
         }
    +  91  18 
             final NvdCveInfo item = new NvdCveInfo();
    +  92  18 
             item.setNeedsUpdate(needsUpdate); //the others default to true, to make life easier later this should default to false.
    +  93  18 
             item.setId(id);
    +  94  18 
             item.setUrl(url);
    +  95  18 
             item.setOldSchemaVersionUrl(oldUrl);
    +  96  18 
             item.setTimestamp(Downloader.getLastModified(new URL(url)));
    +  97  18 
             collection.put(id, item);
    +  98  18 
         }
    +  99   + 
     
    +  100   + 
         /**
     101   - 
     
    -  102   - 
         /**
    -  103   
          * Clears the contained collection of NvdCveInfo entries.
    -  104   +  102   
          */
    -  105   +  103   
         public void clear() {
    -  106  1 
             collection.clear();
    -  107  1 
         }
    +  104  2 
             collection.clear();
    +  105  2 
         }
    +  106   + 
     
    +  107   + 
         /**
     108   - 
     
    -  109   - 
         /**
    -  110   
          * Returns the timestamp for the given entry.
    -  111   +  109   
          *
    -  112   +  110   
          * @param key the key to lookup in the collection of NvdCveInfo items
    -  113   +  111   
          * @return the timestamp for the given entry
    -  114   +  112   
          */
    -  115   +  113   
         public long getTimeStamp(String key) {
    -  116  0 
             return collection.get(key).getTimestamp();
    -  117   +  114  0 
             return collection.get(key).getTimestamp();
    +  115   
         }
    -  118   +  116   
         /**
    -  119   +  117   
          * An internal iterator used to implement iterable.
    -  120   +  118   
          */
    -  121  5 
         private Iterator<Entry<String, NvdCveInfo>> iterableContent = null;
    -  122   +  119  10 
         private Iterator<Entry<String, NvdCveInfo>> iterableContent = null;
    +  120   
     
    -  123   +  121   
         /**
    +  122   + 
          * <p>
    +  123   + 
          * Returns an iterator for the NvdCveInfo contained.</p>
     124   - 
          * <p>Returns an iterator for the NvdCveInfo contained.</p>
    + 
          * <p>
     125   - 
          * <p><b>This method is not thread safe.</b></p>
    + 
          * <b>This method is not thread safe.</b></p>
     126   
          *
     127   @@ -255,8 +255,8 @@ 
         @Override
     130   
         public Iterator<NvdCveInfo> iterator() {
    -  131  4 
             iterableContent = collection.entrySet().iterator();
    -  132  4 
             return this;
    +  131  8 
             iterableContent = collection.entrySet().iterator();
    +  132  8 
             return this;
     133   
         }
     134   @@ -264,93 +264,103 @@  135   
         /**
     136   - 
          * <p>Returns whether or not there is another item in the collection.</p>
    + 
          * <p>
     137   - 
          * <p><b>This method is not thread safe.</b></p>
    + 
          * Returns whether or not there is another item in the collection.</p>
     138   - 
          *
    + 
          * <p>
     139   - 
          * @return true or false depending on whether or not another item exists in
    + 
          * <b>This method is not thread safe.</b></p>
     140   - 
          * the collection
    + 
          *
     141   - 
          */
    + 
          * @return true or false depending on whether or not another item exists in the collection
     142   - 
         @Override
    + 
          */
     143   + 
         @Override
    +  144   
         public boolean hasNext() {
    -  144  10 
             return iterableContent.hasNext();
    -  145   - 
         }
    +  145  20 
             return iterableContent.hasNext();
     146   - 
     
    + 
         }
     147   - 
         /**
    + 
     
     148   - 
          * <p>Returns the next item in the collection.</p>
    + 
         /**
     149   - 
          * <p><b>This method is not thread safe.</b></p>
    + 
          * <p>
     150   - 
          *
    + 
          * Returns the next item in the collection.</p>
     151   - 
          * @return the next NvdCveInfo item in the collection
    + 
          * <p>
     152   - 
          */
    + 
          * <b>This method is not thread safe.</b></p>
     153   - 
         @Override
    -  154   - 
         public NvdCveInfo next() {
    -  155  7 
             return iterableContent.next().getValue();
    -  156   - 
         }
    -  157   - 
     
    -  158   - 
         /**
    -  159   - 
          * <p>Removes the current NvdCveInfo object from the collection.</p>
    -  160   - 
          * <p><b>This method is not thread safe.</b></p>
    -  161   - 
          */
    -  162   - 
         @Override
    -  163   - 
         public void remove() {
    -  164  1 
             iterableContent.remove();
    -  165  1 
         }
    -  166   - 
     
    -  167   - 
         /**
    -  168   - 
          * Returns the specified item from the collection.
    -  169   
          *
    -  170   - 
          * @param key the key to lookup the return value
    -  171   - 
          * @return the NvdCveInfo object stored using the specified key
    -  172   +  154   + 
          * @return the next NvdCveInfo item in the collection
    +  155   
          */
    -  173   - 
         NvdCveInfo get(String key) {
    -  174  2 
             return collection.get(key);
    -  175   - 
         }
    -  176   - 
     
    -  177   +  156   
         @Override
    +  157   + 
         public NvdCveInfo next() {
    +  158  14 
             return iterableContent.next().getValue();
    +  159   + 
         }
    +  160   + 
     
    +  161   + 
         /**
    +  162   + 
          * <p>
    +  163   + 
          * Removes the current NvdCveInfo object from the collection.</p>
    +  164   + 
          * <p>
    +  165   + 
          * <b>This method is not thread safe.</b></p>
    +  166   + 
          */
    +  167   + 
         @Override
    +  168   + 
         public void remove() {
    +  169  2 
             iterableContent.remove();
    +  170  2 
         }
    +  171   + 
     
    +  172   + 
         /**
    +  173   + 
          * Returns the specified item from the collection.
    +  174   + 
          *
    +  175   + 
          * @param key the key to lookup the return value
    +  176   + 
          * @return the NvdCveInfo object stored using the specified key
    +  177   + 
          */
     178   - 
         public String toString() {
    -  179  0 
             return "Updateable{" + "size=" + collection.size() + '}';
    + 
         NvdCveInfo get(String key) {
    +  179  4 
             return collection.get(key);
     180   
         }
     181   + 
     
    +  182   + 
         @Override
    +  183   + 
         public String toString() {
    +  184  0 
             return "Updateable{" + "size=" + collection.size() + '}';
    +  185   + 
         }
    +  186   
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.exception.InvalidDataException.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.exception.InvalidDataException.html index bb55798fd..84e556d7f 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.exception.InvalidDataException.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.exception.InvalidDataException.html @@ -24,101 +24,97 @@  3   
      *
     4   - 
      * Dependency-check-core is free software: you can redistribute it and/or modify it
    + 
      * Licensed under the Apache License, Version 2.0 (the "License");
     5   - 
      * under the terms of the GNU General Public License as published by the Free
    + 
      * you may not use this file except in compliance with the License.
     6   - 
      * Software Foundation, either version 3 of the License, or (at your option) any
    + 
      * You may obtain a copy of the License at
     7   - 
      * later version.
    + 
      *
     8   - 
      *
    + 
      *     http://www.apache.org/licenses/LICENSE-2.0
     9   - 
      * Dependency-check-core is distributed in the hope that it will be useful, but
    + 
      *
     10   - 
      * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
    + 
      * Unless required by applicable law or agreed to in writing, software
     11   - 
      * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
    + 
      * distributed under the License is distributed on an "AS IS" BASIS,
     12   - 
      * details.
    + 
      * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13   - 
      *
    + 
      * See the License for the specific language governing permissions and
     14   - 
      * You should have received a copy of the GNU General Public License along with
    + 
      * limitations under the License.
     15   - 
      * dependency-check-core. If not, see http://www.gnu.org/licenses/.
    + 
      *
     16   - 
      *
    -  17   
      * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
    +  17   + 
      */
     18   - 
      */
    -  19   
     package org.owasp.dependencycheck.data.update.exception;
    +  19   + 
     
     20   - 
     
    -  21   
     /**
    +  21   + 
      * An InvalidDataDataException is a generic exception used when trying to load the NVD CVE meta data.
     22   - 
      * An InvalidDataDataException is a generic exception used when trying to load
    -  23   - 
      * the NVD CVE meta data.
    -  24   
      *
    -  25   +  23   
      * @author Jeremy Long <jeremy.long@owasp.org>
    -  26   +  24   
      */
    -  27   +  25   
     public class InvalidDataException extends Exception {
    +  26   + 
     
    +  27   + 
         /**
     28   - 
     
    -  29   - 
         /**
    -  30   
          * The serial version UID.
    -  31   +  29   
          */
    -  32   +  30   
         private static final long serialVersionUID = 1L;
    +  31   + 
     
    +  32   + 
         /**
     33   - 
     
    + 
          * Creates an InvalidDataException.
     34   - 
         /**
    + 
          *
     35   - 
          * Creates an InvalidDataException.
    + 
          * @param msg the exception message
     36   - 
          *
    + 
          */
     37   - 
          * @param msg the exception message
    -  38   - 
          */
    -  39   
         public InvalidDataException(String msg) {
    -  40  0 
             super(msg);
    -  41  0 
         }
    -  42   +  38  0 
             super(msg);
    +  39  0 
         }
    +  40   
     
    -  43   +  41   
         /**
    -  44   +  42   
          * Creates an InvalidDataException.
    -  45   +  43   
          *
    -  46   +  44   
          * @param msg the exception message
    -  47   +  45   
          * @param ex the cause of the exception
    -  48   +  46   
          */
    -  49   +  47   
         public InvalidDataException(String msg, Exception ex) {
    -  50  0 
             super(msg, ex);
    -  51  0 
         }
    -  52   +  48  0 
             super(msg, ex);
    +  49  0 
         }
    +  50   
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.exception.UpdateException.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.exception.UpdateException.html index 3f5c54729..7c2b740ad 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.exception.UpdateException.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.exception.UpdateException.html @@ -24,131 +24,129 @@  3   
      *
     4   - 
      * Dependency-check-core is free software: you can redistribute it and/or modify it
    + 
      * Licensed under the Apache License, Version 2.0 (the "License");
     5   - 
      * under the terms of the GNU General Public License as published by the Free
    + 
      * you may not use this file except in compliance with the License.
     6   - 
      * Software Foundation, either version 3 of the License, or (at your option) any
    + 
      * You may obtain a copy of the License at
     7   - 
      * later version.
    + 
      *
     8   - 
      *
    + 
      *     http://www.apache.org/licenses/LICENSE-2.0
     9   - 
      * Dependency-check-core is distributed in the hope that it will be useful, but
    + 
      *
     10   - 
      * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
    + 
      * Unless required by applicable law or agreed to in writing, software
     11   - 
      * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
    + 
      * distributed under the License is distributed on an "AS IS" BASIS,
     12   - 
      * details.
    + 
      * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13   - 
      *
    + 
      * See the License for the specific language governing permissions and
     14   - 
      * You should have received a copy of the GNU General Public License along with
    + 
      * limitations under the License.
     15   - 
      * dependency-check-core. If not, see http://www.gnu.org/licenses/.
    + 
      *
     16   - 
      *
    -  17   
      * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
    +  17   + 
      */
     18   - 
      */
    -  19   
     package org.owasp.dependencycheck.data.update.exception;
    +  19   + 
     
     20   - 
     
    -  21   
     import java.io.IOException;
    +  21   + 
     
     22   - 
     
    -  23   
     /**
    -  24   +  23   
      * An exception used when an error occurs reading a setting.
    -  25   +  24   
      *
    -  26   +  25   
      * @author Jeremy Long <jeremy.long@owasp.org>
    -  27   +  26   
      */
    -  28   +  27   
     public class UpdateException extends IOException {
    +  28   + 
     
     29   - 
     
    + 
         /**
     30   - 
         /**
    -  31   
          * The serial version uid.
    +  31   + 
          */
     32   - 
          */
    -  33   
         private static final long serialVersionUID = 1L;
    +  33   + 
     
     34   - 
     
    + 
         /**
     35   - 
         /**
    + 
          * Creates a new UpdateException.
     36   - 
          * Creates a new UpdateException.
    + 
          */
     37   - 
          */
    -  38   
         public UpdateException() {
    -  39  0 
             super();
    -  40  0 
         }
    +  38  0 
             super();
    +  39  0 
         }
    +  40   + 
     
     41   - 
     
    + 
         /**
     42   - 
         /**
    + 
          * Creates a new UpdateException.
     43   - 
          * Creates a new UpdateException.
    + 
          *
     44   - 
          *
    + 
          * @param msg a message for the exception.
     45   - 
          * @param msg a message for the exception.
    + 
          */
     46   - 
          */
    -  47   
         public UpdateException(String msg) {
    -  48  0 
             super(msg);
    -  49  0 
         }
    +  47  0 
             super(msg);
    +  48  0 
         }
    +  49   + 
     
     50   - 
     
    + 
         /**
     51   - 
         /**
    + 
          * Creates a new UpdateException.
     52   - 
          * Creates a new UpdateException.
    + 
          *
     53   - 
          *
    + 
          * @param ex the cause of the update exception.
     54   - 
          * @param ex the cause of the update exception.
    + 
          */
     55   - 
          */
    -  56   
         public UpdateException(Throwable ex) {
    -  57  0 
             super(ex);
    -  58  0 
         }
    -  59   +  56  0 
             super(ex);
    +  57  0 
         }
    +  58   
     
    -  60   +  59   
         /**
    -  61   +  60   
          * Creates a new UpdateException.
    -  62   +  61   
          *
    -  63   +  62   
          * @param msg a message for the exception.
    -  64   +  63   
          * @param ex the cause of the update exception.
    -  65   +  64   
          */
    -  66   +  65   
         public UpdateException(String msg, Throwable ex) {
    -  67  0 
             super(msg, ex);
    -  68  0 
         }
    -  69   +  66  0 
             super(msg, ex);
    +  67  0 
         }
    +  68   
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.task.CallableDownloadTask.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.task.CallableDownloadTask.html index 91a96bd8c..a01fed3c4 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.task.CallableDownloadTask.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.task.CallableDownloadTask.html @@ -24,384 +24,380 @@  3   
      *
     4   - 
      * Dependency-check-core is free software: you can redistribute it and/or modify it
    + 
      * Licensed under the Apache License, Version 2.0 (the "License");
     5   - 
      * under the terms of the GNU General Public License as published by the Free
    + 
      * you may not use this file except in compliance with the License.
     6   - 
      * Software Foundation, either version 3 of the License, or (at your option) any
    + 
      * You may obtain a copy of the License at
     7   - 
      * later version.
    + 
      *
     8   - 
      *
    + 
      *     http://www.apache.org/licenses/LICENSE-2.0
     9   - 
      * Dependency-check-core is distributed in the hope that it will be useful, but
    + 
      *
     10   - 
      * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
    + 
      * Unless required by applicable law or agreed to in writing, software
     11   - 
      * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
    + 
      * distributed under the License is distributed on an "AS IS" BASIS,
     12   - 
      * details.
    + 
      * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13   - 
      *
    + 
      * See the License for the specific language governing permissions and
     14   - 
      * You should have received a copy of the GNU General Public License along with
    + 
      * limitations under the License.
     15   - 
      * dependency-check-core. If not, see http://www.gnu.org/licenses/.
    + 
      *
     16   - 
      *
    -  17   
      * Copyright (c) 2013 Jeremy Long. All Rights Reserved.
    +  17   + 
      */
     18   - 
      */
    -  19   
     package org.owasp.dependencycheck.data.update.task;
    +  19   + 
     
     20   - 
     
    -  21   
     import java.io.File;
    -  22   +  21   
     import java.io.IOException;
    -  23   +  22   
     import java.net.URL;
    -  24   +  23   
     import java.util.concurrent.Callable;
    -  25   +  24   
     import java.util.concurrent.ExecutorService;
    -  26   +  25   
     import java.util.concurrent.Future;
    -  27   +  26   
     import java.util.logging.Level;
    -  28   +  27   
     import java.util.logging.Logger;
    -  29   +  28   
     import org.owasp.dependencycheck.data.nvdcve.CveDB;
    -  30   +  29   
     import org.owasp.dependencycheck.data.update.NvdCveInfo;
    -  31   +  30   
     import org.owasp.dependencycheck.utils.DownloadFailedException;
    -  32   +  31   
     import org.owasp.dependencycheck.utils.Downloader;
    +  32   + 
     
     33   - 
     
    -  34   
     /**
    -  35   +  34   
      * A callable object to download two files.
    -  36   +  35   
      *
    -  37   +  36   
      * @author Jeremy Long <jeremy.long@owasp.org>
    -  38   +  37   
      */
    -  39  0 
     public class CallableDownloadTask implements Callable<Future<ProcessTask>> {
    +  38  0 
     public class CallableDownloadTask implements Callable<Future<ProcessTask>> {
    +  39   + 
     
     40   - 
     
    + 
         /**
     41   - 
         /**
    -  42   
          * Simple constructor for the callable download task.
    +  42   + 
          *
     43   - 
          *
    -  44   
          * @param nvdCveInfo the NVD CVE info
    -  45   +  44   
          * @param processor the processor service to submit the downloaded files to
    -  46   +  45   
          * @param cveDB the CVE DB to use to store the vulnerability data
    -  47   +  46   
          */
    -  48  0 
         public CallableDownloadTask(NvdCveInfo nvdCveInfo, ExecutorService processor, CveDB cveDB) {
    -  49  0 
             this.nvdCveInfo = nvdCveInfo;
    -  50  0 
             this.processorService = processor;
    -  51  0 
             this.cveDB = cveDB;
    +  47  0 
         public CallableDownloadTask(NvdCveInfo nvdCveInfo, ExecutorService processor, CveDB cveDB) {
    +  48  0 
             this.nvdCveInfo = nvdCveInfo;
    +  49  0 
             this.processorService = processor;
    +  50  0 
             this.cveDB = cveDB;
    +  51   + 
     
     52   - 
     
    -  53   
             final File file1;
    -  54   +  53   
             final File file2;
    +  54   + 
     
     55   - 
     
    -  56   - 
     
    -  57   
             try {
    -  58  0 
                 file1 = File.createTempFile("cve" + nvdCveInfo.getId() + "_", ".xml");
    -  59  0 
                 file2 = File.createTempFile("cve_1_2_" + nvdCveInfo.getId() + "_", ".xml");
    -  60  0 
             } catch (IOException ex) {
    -  61  0 
                 return;
    -  62  0 
             }
    -  63  0 
             this.first = file1;
    -  64  0 
             this.second = file2;
    +  56  0 
                 file1 = File.createTempFile("cve" + nvdCveInfo.getId() + "_", ".xml");
    +  57  0 
                 file2 = File.createTempFile("cve_1_2_" + nvdCveInfo.getId() + "_", ".xml");
    +  58  0 
             } catch (IOException ex) {
    +  59  0 
                 return;
    +  60  0 
             }
    +  61  0 
             this.first = file1;
    +  62  0 
             this.second = file2;
    +  63   + 
     
    +  64  0 
         }
     65   - 
     
    -  66  0 
         }
    -  67   
         /**
    -  68   +  66   
          * The CVE DB to use when processing the files.
    -  69   +  67   
          */
    -  70   +  68   
         private CveDB cveDB;
    -  71   +  69   
         /**
    -  72   +  70   
          * The processor service to pass the results of the download to.
    -  73   +  71   
          */
    -  74   +  72   
         private ExecutorService processorService;
    -  75   +  73   
         /**
    -  76   +  74   
          * The NVD CVE Meta Data.
    -  77   +  75   
          */
    -  78   +  76   
         private NvdCveInfo nvdCveInfo;
    +  77   + 
     
    +  78   + 
         /**
     79   - 
     
    -  80   - 
         /**
    -  81   
          * Get the value of nvdCveInfo.
    -  82   +  80   
          *
    -  83   +  81   
          * @return the value of nvdCveInfo
    -  84   +  82   
          */
    -  85   +  83   
         public NvdCveInfo getNvdCveInfo() {
    -  86  0 
             return nvdCveInfo;
    +  84  0 
             return nvdCveInfo;
    +  85   + 
         }
    +  86   + 
     
     87   - 
         }
    + 
         /**
     88   - 
     
    -  89   - 
         /**
    -  90   
          * Set the value of nvdCveInfo.
    -  91   +  89   
          *
    -  92   +  90   
          * @param nvdCveInfo new value of nvdCveInfo
    -  93   +  91   
          */
    -  94   +  92   
         public void setNvdCveInfo(NvdCveInfo nvdCveInfo) {
    -  95  0 
             this.nvdCveInfo = nvdCveInfo;
    -  96  0 
         }
    +  93  0 
             this.nvdCveInfo = nvdCveInfo;
    +  94  0 
         }
    +  95   + 
         /**
    +  96   + 
          * a file.
     97   - 
         /**
    + 
          */
     98   - 
          * a file.
    -  99   - 
          */
    -  100   
         private File first;
    +  99   + 
     
    +  100   + 
         /**
     101   - 
     
    -  102   - 
         /**
    -  103   
          * Get the value of first.
    -  104   +  102   
          *
    -  105   +  103   
          * @return the value of first
    -  106   +  104   
          */
    -  107   +  105   
         public File getFirst() {
    -  108  0 
             return first;
    +  106  0 
             return first;
    +  107   + 
         }
    +  108   + 
     
     109   - 
         }
    + 
         /**
     110   - 
     
    -  111   - 
         /**
    -  112   
          * Set the value of first.
    -  113   +  111   
          *
    -  114   +  112   
          * @param first new value of first
    -  115   +  113   
          */
    -  116   +  114   
         public void setFirst(File first) {
    -  117  0 
             this.first = first;
    -  118  0 
         }
    -  119   +  115  0 
             this.first = first;
    +  116  0 
         }
    +  117   
         /**
    -  120   +  118   
          * a file.
    -  121   +  119   
          */
    -  122   +  120   
         private File second;
    +  121   + 
     
    +  122   + 
         /**
     123   - 
     
    -  124   - 
         /**
    -  125   
          * Get the value of second.
    -  126   +  124   
          *
    -  127   +  125   
          * @return the value of second
    -  128   +  126   
          */
    -  129   +  127   
         public File getSecond() {
    -  130  0 
             return second;
    +  128  0 
             return second;
    +  129   + 
         }
    +  130   + 
     
     131   - 
         }
    + 
         /**
     132   - 
     
    -  133   - 
         /**
    -  134   
          * Set the value of second.
    -  135   +  133   
          *
    -  136   +  134   
          * @param second new value of second
    -  137   +  135   
          */
    -  138   +  136   
         public void setSecond(File second) {
    -  139  0 
             this.second = second;
    -  140  0 
         }
    -  141   +  137  0 
             this.second = second;
    +  138  0 
         }
    +  139   
         /**
    -  142   +  140   
          * A placeholder for an exception.
    +  141   + 
          */
    +  142  0 
         private Exception exception = null;
     143   - 
          */
    -  144  0 
         private Exception exception = null;
    + 
     
    +  144   + 
         /**
     145   - 
     
    -  146   - 
         /**
    -  147   
          * Get the value of exception.
    -  148   +  146   
          *
    -  149   +  147   
          * @return the value of exception
    -  150   +  148   
          */
    -  151   +  149   
         public Exception getException() {
    -  152  0 
             return exception;
    +  150  0 
             return exception;
    +  151   + 
         }
    +  152   + 
     
     153   - 
         }
    + 
         /**
     154   - 
     
    -  155   - 
         /**
    -  156   
          * returns whether or not an exception occurred during download.
    -  157   +  155   
          *
    -  158   +  156   
          * @return whether or not an exception occurred during download
    -  159   +  157   
          */
    -  160   +  158   
         public boolean hasException() {
    -  161  0 
             return exception != null;
    +  159  0 
             return exception != null;
    +  160   + 
         }
    +  161   + 
     
     162   - 
         }
    -  163   - 
     
    -  164   
         @Override
    -  165   +  163   
         public Future<ProcessTask> call() throws Exception {
    -  166   +  164   
             try {
    -  167  0 
                 final URL url1 = new URL(nvdCveInfo.getUrl());
    -  168  0 
                 final URL url2 = new URL(nvdCveInfo.getOldSchemaVersionUrl());
    -  169  0 
                 String msg = String.format("Download Started for NVD CVE - %s", nvdCveInfo.getId());
    -  170  0 
                 Logger.getLogger(CallableDownloadTask.class.getName()).log(Level.INFO, msg);
    -  171   +  165  0 
                 final URL url1 = new URL(nvdCveInfo.getUrl());
    +  166  0 
                 final URL url2 = new URL(nvdCveInfo.getOldSchemaVersionUrl());
    +  167  0 
                 String msg = String.format("Download Started for NVD CVE - %s", nvdCveInfo.getId());
    +  168  0 
                 Logger.getLogger(CallableDownloadTask.class.getName()).log(Level.INFO, msg);
    +  169   
                 try {
    -  172  0 
                     Downloader.fetchFile(url1, first);
    -  173  0 
                     Downloader.fetchFile(url2, second);
    -  174  0 
                 } catch (DownloadFailedException ex) {
    -  175  0 
                     msg = String.format("Download Failed for NVD CVE - %s%nSome CVEs may not be reported.", nvdCveInfo.getId());
    -  176  0 
                     Logger.getLogger(CallableDownloadTask.class.getName()).log(Level.WARNING, msg);
    -  177  0 
                     Logger.getLogger(CallableDownloadTask.class.getName()).log(Level.FINE, null, ex);
    -  178  0 
                     return null;
    -  179  0 
                 }
    -  180   +  170  0 
                     Downloader.fetchFile(url1, first);
    +  171  0 
                     Downloader.fetchFile(url2, second);
    +  172  0 
                 } catch (DownloadFailedException ex) {
    +  173  0 
                     msg = String.format("Download Failed for NVD CVE - %s%nSome CVEs may not be reported.", nvdCveInfo.getId());
    +  174  0 
                     Logger.getLogger(CallableDownloadTask.class.getName()).log(Level.WARNING, msg);
    +  175  0 
                     Logger.getLogger(CallableDownloadTask.class.getName()).log(Level.FINE, null, ex);
    +  176  0 
                     return null;
    +  177  0 
                 }
    +  178   
     
    -  181  0 
                 msg = String.format("Download Complete for NVD CVE - %s", nvdCveInfo.getId());
    -  182  0 
                 Logger.getLogger(CallableDownloadTask.class.getName()).log(Level.INFO, msg);
    -  183   +  179  0 
                 msg = String.format("Download Complete for NVD CVE - %s", nvdCveInfo.getId());
    +  180  0 
                 Logger.getLogger(CallableDownloadTask.class.getName()).log(Level.INFO, msg);
    +  181   
     
    -  184  0 
                 final ProcessTask task = new ProcessTask(cveDB, this);
    -  185  0 
                 return this.processorService.submit(task);
    -  186   +  182  0 
                 final ProcessTask task = new ProcessTask(cveDB, this);
    +  183  0 
                 return this.processorService.submit(task);
    +  184   
     
    -  187  0 
             } catch (Throwable ex) {
    -  188  0 
                 final String msg = String.format("An exception occurred downloading NVD CVE - %s%nSome CVEs may not be reported.", nvdCveInfo.getId());
    -  189  0 
                 Logger.getLogger(CallableDownloadTask.class.getName()).log(Level.WARNING, msg);
    -  190  0 
                 Logger.getLogger(CallableDownloadTask.class.getName()).log(Level.FINE, "Download Task Failed", ex);
    +  185  0 
             } catch (Throwable ex) {
    +  186  0 
                 final String msg = String.format("An exception occurred downloading NVD CVE - %s%nSome CVEs may not be reported.", nvdCveInfo.getId());
    +  187  0 
                 Logger.getLogger(CallableDownloadTask.class.getName()).log(Level.WARNING, msg);
    +  188  0 
                 Logger.getLogger(CallableDownloadTask.class.getName()).log(Level.FINE, "Download Task Failed", ex);
    +  189   + 
             }
    +  190  0 
             return null;
     191   - 
             }
    -  192  0 
             return null;
    -  193   
         }
    -  194   +  192   
     
    -  195   +  193   
         /**
    -  196   +  194   
          * Attempts to delete the files that were downloaded.
    -  197   +  195   
          */
    -  198   +  196   
         public void cleanup() {
    -  199  0 
             boolean deleted = false;
    -  200   +  197  0 
             boolean deleted = false;
    +  198   
             try {
    -  201  0 
                 if (first != null && first.exists()) {
    -  202  0 
                     deleted = first.delete();
    -  203   +  199  0 
                 if (first != null && first.exists()) {
    +  200  0 
                     deleted = first.delete();
    +  201   
                 }
    -  204   +  202   
             } finally {
    -  205  0 
                 if (first != null && (first.exists() || !deleted)) {
    -  206  0 
                     first.deleteOnExit();
    +  203  0 
                 if (first != null && (first.exists() || !deleted)) {
    +  204  0 
                     first.deleteOnExit();
    +  205   + 
                 }
    +  206   + 
             }
     207   - 
                 }
    -  208   - 
             }
    -  209   
             try {
    -  210  0 
                 deleted = false;
    -  211  0 
                 if (second != null && second.exists()) {
    -  212  0 
                     deleted = second.delete();
    -  213   +  208  0 
                 deleted = false;
    +  209  0 
                 if (second != null && second.exists()) {
    +  210  0 
                     deleted = second.delete();
    +  211   
                 }
    -  214   +  212   
             } finally {
    -  215  0 
                 if (second != null && (second.exists() || !deleted)) {
    -  216  0 
                     second.deleteOnExit();
    -  217   +  213  0 
                 if (second != null && (second.exists() || !deleted)) {
    +  214  0 
                     second.deleteOnExit();
    +  215   
                 }
    -  218   +  216   
             }
    -  219  0 
         }
    -  220   +  217  0 
         }
    +  218   
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.task.ProcessTask.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.task.ProcessTask.html index 93bcdd5a4..1c4166e9c 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.task.ProcessTask.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.task.ProcessTask.html @@ -24,310 +24,298 @@  3   
      *
     4   - 
      * Dependency-check-core is free software: you can redistribute it and/or modify it
    + 
      * Licensed under the Apache License, Version 2.0 (the "License");
     5   - 
      * under the terms of the GNU General Public License as published by the Free
    + 
      * you may not use this file except in compliance with the License.
     6   - 
      * Software Foundation, either version 3 of the License, or (at your option) any
    + 
      * You may obtain a copy of the License at
     7   - 
      * later version.
    + 
      *
     8   - 
      *
    + 
      *     http://www.apache.org/licenses/LICENSE-2.0
     9   - 
      * Dependency-check-core is distributed in the hope that it will be useful, but
    + 
      *
     10   - 
      * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
    + 
      * Unless required by applicable law or agreed to in writing, software
     11   - 
      * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
    + 
      * distributed under the License is distributed on an "AS IS" BASIS,
     12   - 
      * details.
    + 
      * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13   - 
      *
    + 
      * See the License for the specific language governing permissions and
     14   - 
      * You should have received a copy of the GNU General Public License along with
    + 
      * limitations under the License.
     15   - 
      * dependency-check-core. If not, see http://www.gnu.org/licenses/.
    + 
      *
     16   - 
      *
    -  17   
      * Copyright (c) 2013 Jeremy Long. All Rights Reserved.
    +  17   + 
      */
     18   - 
      */
    -  19   
     package org.owasp.dependencycheck.data.update.task;
    +  19   + 
     
     20   - 
     
    -  21   - 
     import org.owasp.dependencycheck.data.update.xml.NvdCve20Handler;
    -  22   - 
     import org.owasp.dependencycheck.data.update.xml.NvdCve12Handler;
    -  23   - 
     import org.owasp.dependencycheck.data.update.exception.UpdateException;
    -  24   - 
     import org.owasp.dependencycheck.data.nvdcve.DatabaseProperties;
    -  25   
     import java.io.File;
    -  26   +  21   
     import java.io.FileNotFoundException;
    -  27   +  22   
     import java.io.IOException;
    -  28   +  23   
     import java.sql.SQLException;
    -  29   +  24   
     import java.util.List;
    -  30   +  25   
     import java.util.Map;
    -  31   +  26   
     import java.util.concurrent.Callable;
    -  32   +  27   
     import java.util.logging.Level;
    -  33   +  28   
     import java.util.logging.Logger;
    -  34   +  29   
     import javax.xml.parsers.ParserConfigurationException;
    -  35   +  30   
     import javax.xml.parsers.SAXParser;
    -  36   +  31   
     import javax.xml.parsers.SAXParserFactory;
    -  37   +  32   
     import org.owasp.dependencycheck.data.nvdcve.CveDB;
    -  38   +  33   
     import org.owasp.dependencycheck.data.nvdcve.DatabaseException;
    -  39   +  34   + 
     import org.owasp.dependencycheck.data.nvdcve.DatabaseProperties;
    +  35   
     import org.owasp.dependencycheck.data.update.StandardUpdate;
    -  40   +  36   + 
     import org.owasp.dependencycheck.data.update.exception.UpdateException;
    +  37   + 
     import org.owasp.dependencycheck.data.update.xml.NvdCve12Handler;
    +  38   + 
     import org.owasp.dependencycheck.data.update.xml.NvdCve20Handler;
    +  39   
     import org.owasp.dependencycheck.dependency.VulnerableSoftware;
    -  41   +  40   
     import org.xml.sax.SAXException;
    +  41   + 
     
     42   - 
     
    -  43   
     /**
    +  43   + 
      * A callable task that will process a given set of NVD CVE xml files and update the Cve Database accordingly.
     44   - 
      * A callable task that will process a given set of NVD CVE xml files and update
    -  45   - 
      * the Cve Database accordingly.
    -  46   
      *
    -  47   +  45   
      * @author Jeremy Long <jeremy.long@owasp.org>
    -  48   +  46   
      */
    -  49  0 
     public class ProcessTask implements Callable<ProcessTask> {
    +  47  0 
     public class ProcessTask implements Callable<ProcessTask> {
    +  48   + 
     
    +  49   + 
         /**
     50   - 
     
    -  51   - 
         /**
    -  52   
          * A field to store any update exceptions that occur during the "call".
    +  51   + 
          */
    +  52  0 
         private UpdateException exception = null;
     53   - 
          */
    -  54  0 
         private UpdateException exception = null;
    + 
     
    +  54   + 
         /**
     55   - 
     
    -  56   - 
         /**
    -  57   
          * Get the value of exception.
    -  58   +  56   
          *
    -  59   +  57   
          * @return the value of exception
    -  60   +  58   
          */
    -  61   +  59   
         public UpdateException getException() {
    -  62  0 
             return exception;
    +  60  0 
             return exception;
    +  61   + 
         }
    +  62   + 
     
     63   - 
         }
    + 
         /**
     64   - 
     
    -  65   - 
         /**
    -  66   
          * Set the value of exception.
    -  67   +  65   
          *
    -  68   +  66   
          * @param exception new value of exception
    -  69   +  67   
          */
    -  70   +  68   
         public void setException(UpdateException exception) {
    -  71  0 
             this.exception = exception;
    -  72  0 
         }
    -  73   +  69  0 
             this.exception = exception;
    +  70  0 
         }
    +  71   
         /**
    -  74   +  72   
          * A reference to the CveDB.
    -  75   +  73   
          */
    -  76   +  74   
         private final CveDB cveDB;
    -  77   +  75   
         /**
    -  78   +  76   
          * A reference to the callable download task.
    -  79   +  77   
          */
    -  80   +  78   
         private final CallableDownloadTask filePair;
    -  81   +  79   
         /**
    -  82   +  80   
          * A reference to the properties.
    -  83   +  81   
          */
    -  84   +  82   
         private final DatabaseProperties properties;
    +  83   + 
     
    +  84   + 
         /**
     85   - 
     
    -  86   - 
         /**
    -  87   
          * Constructs a new ProcessTask used to process an NVD CVE update.
    -  88   +  86   
          *
    -  89   +  87   
          * @param cveDB the data store object
    -  90   - 
          * @param filePair the download task that contains the URL references to
    -  91   - 
          * download
    -  92   +  88   + 
          * @param filePair the download task that contains the URL references to download
    +  89   
          */
    -  93  0 
         public ProcessTask(final CveDB cveDB, final CallableDownloadTask filePair) {
    -  94  0 
             this.cveDB = cveDB;
    -  95  0 
             this.filePair = filePair;
    -  96  0 
             this.properties = cveDB.getDatabaseProperties();
    -  97  0 
         }
    -  98   +  90  0 
         public ProcessTask(final CveDB cveDB, final CallableDownloadTask filePair) {
    +  91  0 
             this.cveDB = cveDB;
    +  92  0 
             this.filePair = filePair;
    +  93  0 
             this.properties = cveDB.getDatabaseProperties();
    +  94  0 
         }
    +  95   
     
    -  99   +  96   
         /**
    -  100   +  97   
          * Implements the callable interface.
    -  101   +  98   
          *
    -  102   +  99   
          * @return this object
    +  100   + 
          * @throws Exception thrown if there is an exception; note that any UpdateExceptions are simply added to the tasks
    +  101   + 
          * exception collection
    +  102   + 
          */
     103   - 
          * @throws Exception thrown if there is an exception; note that any
    -  104   - 
          * UpdateExceptions are simply added to the tasks exception collection
    -  105   - 
          */
    -  106   
         @Override
    -  107   +  104   
         public ProcessTask call() throws Exception {
    -  108   +  105   
             try {
    -  109  0 
                 processFiles();
    -  110  0 
             } catch (UpdateException ex) {
    -  111  0 
                 this.exception = ex;
    -  112  0 
             }
    -  113  0 
             return this;
    -  114   +  106  0 
                 processFiles();
    +  107  0 
             } catch (UpdateException ex) {
    +  108  0 
                 this.exception = ex;
    +  109  0 
             }
    +  110  0 
             return this;
    +  111   
         }
    -  115   +  112   
     
    -  116   +  113   
         /**
    -  117   +  114   
          * Imports the NVD CVE XML File into the Lucene Index.
    -  118   +  115   
          *
    -  119   +  116   
          * @param file the file containing the NVD CVE XML
    -  120   +  117   
          * @param oldVersion contains the file containing the NVD CVE XML 1.2
    -  121   - 
          * @throws ParserConfigurationException is thrown if there is a parser
    -  122   - 
          * configuration exception
    -  123   +  118   + 
          * @throws ParserConfigurationException is thrown if there is a parser configuration exception
    +  119   
          * @throws SAXException is thrown if there is a SAXException
    -  124   +  120   
          * @throws IOException is thrown if there is a IO Exception
    -  125   +  121   
          * @throws SQLException is thrown if there is a SQL exception
    -  126   +  122   
          * @throws DatabaseException is thrown if there is a database exception
    -  127   - 
          * @throws ClassNotFoundException thrown if the h2 database driver cannot be
    -  128   - 
          * loaded
    -  129   +  123   + 
          * @throws ClassNotFoundException thrown if the h2 database driver cannot be loaded
    +  124   
          */
    -  130   +  125   
         protected void importXML(File file, File oldVersion) throws ParserConfigurationException,
    -  131   +  126   
                 SAXException, IOException, SQLException, DatabaseException, ClassNotFoundException {
    -  132   +  127   
     
    -  133  0 
             final SAXParserFactory factory = SAXParserFactory.newInstance();
    -  134  0 
             final SAXParser saxParser = factory.newSAXParser();
    -  135   +  128  0 
             final SAXParserFactory factory = SAXParserFactory.newInstance();
    +  129  0 
             final SAXParser saxParser = factory.newSAXParser();
    +  130   
     
    -  136  0 
             final NvdCve12Handler cve12Handler = new NvdCve12Handler();
    -  137  0 
             saxParser.parse(oldVersion, cve12Handler);
    -  138  0 
             final Map<String, List<VulnerableSoftware>> prevVersionVulnMap = cve12Handler.getVulnerabilities();
    -  139   +  131  0 
             final NvdCve12Handler cve12Handler = new NvdCve12Handler();
    +  132  0 
             saxParser.parse(oldVersion, cve12Handler);
    +  133  0 
             final Map<String, List<VulnerableSoftware>> prevVersionVulnMap = cve12Handler.getVulnerabilities();
    +  134   
     
    -  140  0 
             final NvdCve20Handler cve20Handler = new NvdCve20Handler();
    -  141  0 
             cve20Handler.setCveDB(cveDB);
    -  142  0 
             cve20Handler.setPrevVersionVulnMap(prevVersionVulnMap);
    -  143  0 
             saxParser.parse(file, cve20Handler);
    -  144  0 
         }
    -  145   +  135  0 
             final NvdCve20Handler cve20Handler = new NvdCve20Handler();
    +  136  0 
             cve20Handler.setCveDB(cveDB);
    +  137  0 
             cve20Handler.setPrevVersionVulnMap(prevVersionVulnMap);
    +  138  0 
             saxParser.parse(file, cve20Handler);
    +  139  0 
         }
    +  140   
     
    -  146   +  141   
         /**
    -  147   +  142   
          * Processes the NVD CVE XML file and imports the data into the DB.
    -  148   +  143   
          *
    -  149   - 
          * @throws UpdateException thrown if there is an error loading the data into
    -  150   - 
          * the database
    -  151   +  144   + 
          * @throws UpdateException thrown if there is an error loading the data into the database
    +  145   
          */
    -  152   +  146   
         private void processFiles() throws UpdateException {
    -  153  0 
             String msg = String.format("Processing Started for NVD CVE - %s", filePair.getNvdCveInfo().getId());
    -  154  0 
             Logger.getLogger(StandardUpdate.class.getName()).log(Level.INFO, msg);
    -  155   +  147  0 
             String msg = String.format("Processing Started for NVD CVE - %s", filePair.getNvdCveInfo().getId());
    +  148  0 
             Logger.getLogger(StandardUpdate.class.getName()).log(Level.INFO, msg);
    +  149   
             try {
    -  156  0 
                 importXML(filePair.getFirst(), filePair.getSecond());
    -  157  0 
                 cveDB.commit();
    -  158  0 
                 properties.save(filePair.getNvdCveInfo());
    -  159  0 
             } catch (FileNotFoundException ex) {
    +  150  0 
                 importXML(filePair.getFirst(), filePair.getSecond());
    +  151  0 
                 cveDB.commit();
    +  152  0 
                 properties.save(filePair.getNvdCveInfo());
    +  153  0 
             } catch (FileNotFoundException ex) {
    +  154  0 
                 throw new UpdateException(ex);
    +  155  0 
             } catch (ParserConfigurationException ex) {
    +  156  0 
                 throw new UpdateException(ex);
    +  157  0 
             } catch (SAXException ex) {
    +  158  0 
                 throw new UpdateException(ex);
    +  159  0 
             } catch (IOException ex) {
     160  0 
                 throw new UpdateException(ex);
    -  161  0 
             } catch (ParserConfigurationException ex) {
    +  161  0 
             } catch (SQLException ex) {
     162  0 
                 throw new UpdateException(ex);
    -  163  0 
             } catch (SAXException ex) {
    +  163  0 
             } catch (DatabaseException ex) {
     164  0 
                 throw new UpdateException(ex);
    -  165  0 
             } catch (IOException ex) {
    +  165  0 
             } catch (ClassNotFoundException ex) {
     166  0 
                 throw new UpdateException(ex);
    -  167  0 
             } catch (SQLException ex) {
    -  168  0 
                 throw new UpdateException(ex);
    -  169  0 
             } catch (DatabaseException ex) {
    -  170  0 
                 throw new UpdateException(ex);
    -  171  0 
             } catch (ClassNotFoundException ex) {
    -  172  0 
                 throw new UpdateException(ex);
    -  173   +  167   
             } finally {
    -  174  0 
                 filePair.cleanup();
    -  175  0 
             }
    -  176  0 
             msg = String.format("Processing Complete for NVD CVE - %s", filePair.getNvdCveInfo().getId());
    -  177  0 
             Logger.getLogger(StandardUpdate.class.getName()).log(Level.INFO, msg);
    -  178  0 
         }
    -  179   +  168  0 
                 filePair.cleanup();
    +  169  0 
             }
    +  170  0 
             msg = String.format("Processing Complete for NVD CVE - %s", filePair.getNvdCveInfo().getId());
    +  171  0 
             Logger.getLogger(StandardUpdate.class.getName()).log(Level.INFO, msg);
    +  172  0 
         }
    +  173   
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.xml.NvdCve12Handler.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.xml.NvdCve12Handler.html index 6d138bf08..f9477c883 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.xml.NvdCve12Handler.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.xml.NvdCve12Handler.html @@ -25,264 +25,264 @@  3   
      *
     4   - 
      * Dependency-check-core is free software: you can redistribute it and/or modify it
    + 
      * Licensed under the Apache License, Version 2.0 (the "License");
     5   - 
      * under the terms of the GNU General Public License as published by the Free
    + 
      * you may not use this file except in compliance with the License.
     6   - 
      * Software Foundation, either version 3 of the License, or (at your option) any
    + 
      * You may obtain a copy of the License at
     7   - 
      * later version.
    + 
      *
     8   - 
      *
    + 
      *     http://www.apache.org/licenses/LICENSE-2.0
     9   - 
      * Dependency-check-core is distributed in the hope that it will be useful, but
    + 
      *
     10   - 
      * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
    + 
      * Unless required by applicable law or agreed to in writing, software
     11   - 
      * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
    + 
      * distributed under the License is distributed on an "AS IS" BASIS,
     12   - 
      * details.
    + 
      * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13   - 
      *
    + 
      * See the License for the specific language governing permissions and
     14   - 
      * You should have received a copy of the GNU General Public License along with
    + 
      * limitations under the License.
     15   - 
      * dependency-check-core. If not, see http://www.gnu.org/licenses/.
    + 
      *
     16   - 
      *
    -  17   
      * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
    +  17   + 
      */
     18   - 
      */
    -  19   
     package org.owasp.dependencycheck.data.update.xml;
    +  19   + 
     
     20   - 
     
    -  21   
     import java.util.ArrayList;
    -  22   +  21   
     import java.util.HashMap;
    -  23   +  22   
     import java.util.List;
    -  24   +  23   
     import java.util.Map;
    -  25   +  24   
     import org.owasp.dependencycheck.dependency.VulnerableSoftware;
    -  26   +  25   
     import org.xml.sax.Attributes;
    -  27   +  26   
     import org.xml.sax.SAXException;
    -  28   +  27   
     import org.xml.sax.SAXNotSupportedException;
    -  29   +  28   
     import org.xml.sax.helpers.DefaultHandler;
    +  29   + 
     
     30   - 
     
    -  31   
     /**
    +  31   + 
      * A SAX Handler that will parse the NVD CVE XML (schema version 1.2). This parses the xml and retrieves a listing of
     32   - 
      * A SAX Handler that will parse the NVD CVE XML (schema version 1.2). This
    + 
      * CPEs that have previous versions specified. The previous version information is not in the 2.0 version of the schema
     33   - 
      * parses the xml and retrieves a listing of CPEs that have previous versions
    + 
      * and is useful to ensure accurate identification (or at least complete).
     34   - 
      * specified. The previous version information is not in the 2.0 version of the
    -  35   - 
      * schema and is useful to ensure accurate identification (or at least
    -  36   - 
      * complete).
    -  37   
      *
    -  38   +  35   
      * @author Jeremy Long <jeremy.long@owasp.org>
    -  39   +  36   
      */
    -  40  1 
     public class NvdCve12Handler extends DefaultHandler {
    -  41   +  37  2 
     public class NvdCve12Handler extends DefaultHandler {
    +  38   
     
    -  42   +  39   
         /**
    -  43   +  40   
          * the supported schema version.
    -  44   +  41   
          */
    -  45   +  42   
         private static final String CURRENT_SCHEMA_VERSION = "1.2";
    -  46   +  43   
         /**
    -  47   +  44   
          * the current vulnerability.
    -  48   +  45   
          */
    -  49   +  46   
         private String vulnerability;
    -  50   +  47   
         /**
    -  51   +  48   
          * a list of vulnerable software.
    -  52   +  49   
          */
    -  53   +  50   
         private List<VulnerableSoftware> software;
    -  54   +  51   
         /**
    -  55   +  52   
          * the vendor name.
    -  56   +  53   
          */
    -  57   +  54   
         private String vendor;
    -  58   +  55   
         /**
    -  59   +  56   
          * the product name.
    -  60   +  57   
          */
    -  61   +  58   
         private String product;
    -  62   +  59   
         /**
    -  63   +  60   
          * if the nvd cve should be skipped because it was rejected.
    +  61   + 
          */
    +  62  2 
         private boolean skip = false;
    +  63   + 
         /**
     64   - 
          */
    -  65  1 
         private boolean skip = false;
    -  66   - 
         /**
    -  67   
          * flag indicating if there is a previous version.
    +  65   + 
          */
    +  66  2 
         private boolean hasPreviousVersion = false;
    +  67   + 
         /**
     68   - 
          */
    -  69  1 
         private boolean hasPreviousVersion = false;
    -  70   - 
         /**
    -  71   
          * The current element.
    +  69   + 
          */
    +  70  2 
         private final Element current = new Element();
    +  71   + 
         /**
     72   - 
          */
    -  73  1 
         private final Element current = new Element();
    -  74   - 
         /**
    -  75   
          * a map of vulnerabilities.
    -  76   +  73   
          */
    -  77   +  74   
         private Map<String, List<VulnerableSoftware>> vulnerabilities;
    -  78   +  75   
     
    -  79   +  76   
         /**
    -  80   +  77   
          * Get the value of vulnerabilities.
    -  81   +  78   
          *
    -  82   +  79   
          * @return the value of vulnerabilities
    -  83   +  80   
          */
    -  84   +  81   
         public Map<String, List<VulnerableSoftware>> getVulnerabilities() {
    -  85  1 
             return vulnerabilities;
    -  86   +  82  2 
             return vulnerabilities;
    +  83   
         }
    -  87   +  84   
     
    -  88   +  85   
         @Override
    -  89   +  86   
         public void startElement(String uri, String localName, String qName, Attributes attributes) throws SAXException {
    -  90  1222 
             current.setNode(qName);
    -  91  1222 
             if (current.isEntryNode()) {
    -  92  27 
                 vendor = null;
    -  93  27 
                 product = null;
    -  94  27 
                 hasPreviousVersion = false;
    -  95  27 
                 final String reject = attributes.getValue("reject");
    -  96  27 
                 skip = "1".equals(reject);
    -  97  27 
                 if (!skip) {
    -  98  26 
                     vulnerability = attributes.getValue("name");
    -  99  26 
                     software = new ArrayList<VulnerableSoftware>();
    -  100   +  87  2444 
             current.setNode(qName);
    +  88  2444 
             if (current.isEntryNode()) {
    +  89  54 
                 vendor = null;
    +  90  54 
                 product = null;
    +  91  54 
                 hasPreviousVersion = false;
    +  92  54 
                 final String reject = attributes.getValue("reject");
    +  93  54 
                 skip = "1".equals(reject);
    +  94  54 
                 if (!skip) {
    +  95  52 
                     vulnerability = attributes.getValue("name");
    +  96  52 
                     software = new ArrayList<VulnerableSoftware>();
    +  97   
                 } else {
    -  101  1 
                     vulnerability = null;
    -  102  1 
                     software = null;
    -  103   +  98  2 
                     vulnerability = null;
    +  99  2 
                     software = null;
    +  100   
                 }
    -  104  27 
             } else if (!skip && current.isProdNode()) {
    -  105   +  101  54 
             } else if (!skip && current.isProdNode()) {
    +  102   
     
    -  106  52 
                 vendor = attributes.getValue("vendor");
    -  107  52 
                 product = attributes.getValue("name");
    -  108  1143 
             } else if (!skip && current.isVersNode()) {
    -  109  761 
                 final String prev = attributes.getValue("prev");
    -  110  761 
                 if (prev != null && "1".equals(prev)) {
    -  111  1 
                     hasPreviousVersion = true;
    -  112  1 
                     final String edition = attributes.getValue("edition");
    -  113  1 
                     final String num = attributes.getValue("num");
    -  114   +  103  104 
                 vendor = attributes.getValue("vendor");
    +  104  104 
                 product = attributes.getValue("name");
    +  105  2286 
             } else if (!skip && current.isVersNode()) {
    +  106  1522 
                 final String prev = attributes.getValue("prev");
    +  107  1522 
                 if (prev != null && "1".equals(prev)) {
    +  108  2 
                     hasPreviousVersion = true;
    +  109  2 
                     final String edition = attributes.getValue("edition");
    +  110  2 
                     final String num = attributes.getValue("num");
    +  111   
     
    -  115   +  112   
                     /*yes yes, this may not actually be an "a" - it could be an OS, etc. but for our
    -  116   +  113   
                      purposes this is good enough as we won't use this if we don't find a corresponding "a"
    -  117   +  114   
                      in the nvd cve 2.0. */
    -  118  1 
                     String cpe = "cpe:/a:" + vendor + ":" + product;
    -  119  1 
                     if (num != null) {
    -  120  1 
                         cpe += ":" + num;
    +  115  2 
                     String cpe = "cpe:/a:" + vendor + ":" + product;
    +  116  2 
                     if (num != null) {
    +  117  2 
                         cpe += ":" + num;
    +  118   + 
                     }
    +  119  2 
                     if (edition != null) {
    +  120  0 
                         cpe += ":" + edition;
     121   
                     }
    -  122  1 
                     if (edition != null) {
    -  123  0 
                         cpe += ":" + edition;
    -  124   - 
                     }
    -  125  1 
                     final VulnerableSoftware vs = new VulnerableSoftware();
    -  126  1 
                     vs.setCpe(cpe);
    -  127  1 
                     vs.setPreviousVersion(prev);
    -  128  1 
                     software.add(vs);
    -  129   +  122  2 
                     final VulnerableSoftware vs = new VulnerableSoftware();
    +  123  2 
                     vs.setCpe(cpe);
    +  124  2 
                     vs.setPreviousVersion(prev);
    +  125  2 
                     software.add(vs);
    +  126   
                 }
    -  130  761 
             } else if (current.isNVDNode()) {
    -  131  1 
                 final String nvdVer = attributes.getValue("nvd_xml_version");
    -  132  1 
                 if (!CURRENT_SCHEMA_VERSION.equals(nvdVer)) {
    -  133  0 
                     throw new SAXNotSupportedException("Schema version " + nvdVer + " is not supported");
    -  134   +  127  1522 
             } else if (current.isNVDNode()) {
    +  128  2 
                 final String nvdVer = attributes.getValue("nvd_xml_version");
    +  129  2 
                 if (!CURRENT_SCHEMA_VERSION.equals(nvdVer)) {
    +  130  0 
                     throw new SAXNotSupportedException("Schema version " + nvdVer + " is not supported");
    +  131   
                 }
    -  135  1 
                 vulnerabilities = new HashMap<String, List<VulnerableSoftware>>();
    +  132  2 
                 vulnerabilities = new HashMap<String, List<VulnerableSoftware>>();
    +  133   + 
             }
    +  134  2444 
         }
    +  135   + 
     
     136   - 
             }
    -  137  1222 
         }
    -  138   - 
     
    -  139   
         @Override
    -  140   +  137   
         public void endElement(String uri, String localName, String qName) throws SAXException {
    -  141  1222 
             current.setNode(qName);
    -  142  1222 
             if (current.isEntryNode()) {
    -  143  27 
                 if (!skip && hasPreviousVersion) {
    -  144  1 
                     vulnerabilities.put(vulnerability, software);
    -  145   +  138  2444 
             current.setNode(qName);
    +  139  2444 
             if (current.isEntryNode()) {
    +  140  54 
                 if (!skip && hasPreviousVersion) {
    +  141  2 
                     vulnerabilities.put(vulnerability, software);
    +  142   
                 }
    -  146  27 
                 vulnerability = null;
    -  147  27 
                 software = null;
    -  148   +  143  54 
                 vulnerability = null;
    +  144  54 
                 software = null;
    +  145   
             }
    -  149  1222 
         }
    -  150   +  146  2444 
         }
    +  147   
     
    -  151   +  148   
         // <editor-fold defaultstate="collapsed" desc="The Element Class that maintains state information about the current node">
    -  152   +  149   
         /**
    -  153   - 
          * A simple class to maintain information about the current element while
    -  154   - 
          * parsing the NVD CVE XML.
    -  155   +  150   + 
          * A simple class to maintain information about the current element while parsing the NVD CVE XML.
    +  151   
          */
    -  156  1 
         protected static class Element {
    -  157   +  152  2 
         protected static class Element {
    +  153   
     
    +  154   + 
             /**
    +  155   + 
              * A node type in the NVD CVE Schema 1.2.
    +  156   + 
              */
    +  157   + 
             public static final String NVD = "nvd";
     158   
             /**
     159   @@ -290,7 +290,7 @@  160   
              */
     161   - 
             public static final String NVD = "nvd";
    + 
             public static final String ENTRY = "entry";
     162   
             /**
     163   @@ -298,7 +298,7 @@  164   
              */
     165   - 
             public static final String ENTRY = "entry";
    + 
             public static final String VULN_SOFTWARE = "vuln_soft";
     166   
             /**
     167   @@ -306,7 +306,7 @@  168   
              */
     169   - 
             public static final String VULN_SOFTWARE = "vuln_soft";
    + 
             public static final String PROD = "prod";
     170   
             /**
     171   @@ -314,149 +314,141 @@  172   
              */
     173   - 
             public static final String PROD = "prod";
    + 
             public static final String VERS = "vers";
     174   
             /**
     175   - 
              * A node type in the NVD CVE Schema 1.2.
    + 
              * The name of the current node.
     176   
              */
     177   - 
             public static final String VERS = "vers";
    -  178   - 
             /**
    -  179   - 
              * The name of the current node.
    -  180   - 
              */
    -  181   
             private String node;
    -  182   +  178   
     
    -  183   +  179   
             /**
    -  184   +  180   
              * Gets the value of node.
    -  185   +  181   
              *
    -  186   +  182   
              * @return the value of node
    -  187   +  183   
              */
    -  188   +  184   
             public String getNode() {
    -  189  0 
                 return this.node;
    -  190   +  185  0 
                 return this.node;
    +  186   
             }
    -  191   +  187   
     
    -  192   +  188   
             /**
    -  193   +  189   
              * Sets the value of node.
    -  194   +  190   
              *
    -  195   +  191   
              * @param node new value of node
    -  196   +  192   
              */
    -  197   +  193   
             public void setNode(String node) {
    -  198  2444 
                 this.node = node;
    -  199  2444 
             }
    -  200   +  194  4888 
                 this.node = node;
    +  195  4888 
             }
    +  196   
     
    -  201   +  197   
             /**
    -  202   +  198   
              * Checks if the handler is at the NVD node.
    -  203   +  199   
              *
    -  204   +  200   
              * @return true or false
    -  205   +  201   
              */
    -  206   +  202   
             public boolean isNVDNode() {
    -  207  382 
                 return NVD.equals(node);
    -  208   +  203  764 
                 return NVD.equals(node);
    +  204   
             }
    -  209   +  205   
     
    -  210   +  206   
             /**
    -  211   +  207   
              * Checks if the handler is at the ENTRY node.
    -  212   +  208   
              *
    -  213   +  209   
              * @return true or false
    -  214   +  210   
              */
    -  215   +  211   
             public boolean isEntryNode() {
    -  216  2444 
                 return ENTRY.equals(node);
    -  217   +  212  4888 
                 return ENTRY.equals(node);
    +  213   
             }
    -  218   +  214   
     
    -  219   +  215   
             /**
    -  220   +  216   
              * Checks if the handler is at the VULN_SOFTWARE node.
    -  221   +  217   
              *
    -  222   +  218   
              * @return true or false
    -  223   +  219   
              */
    -  224   +  220   
             public boolean isVulnSoftwareNode() {
    -  225  0 
                 return VULN_SOFTWARE.equals(node);
    -  226   +  221  0 
                 return VULN_SOFTWARE.equals(node);
    +  222   
             }
    -  227   +  223   
     
    -  228   +  224   
             /**
    -  229   +  225   
              * Checks if the handler is at the PROD node.
    -  230   +  226   
              *
    -  231   +  227   
              * @return true or false
    -  232   +  228   
              */
    -  233   +  229   
             public boolean isProdNode() {
    -  234  1192 
                 return PROD.equals(node);
    -  235   +  230  2384 
                 return PROD.equals(node);
    +  231   
             }
    -  236   +  232   
     
    -  237   +  233   
             /**
    -  238   +  234   
              * Checks if the handler is at the VERS node.
    -  239   +  235   
              *
    -  240   +  236   
              * @return true or false
    -  241   +  237   
              */
    -  242   +  238   
             public boolean isVersNode() {
    -  243  1140 
                 return VERS.equals(node);
    -  244   +  239  2280 
                 return VERS.equals(node);
    +  240   
             }
    -  245   +  241   
         }
    -  246   +  242   
         // </editor-fold>
    -  247   +  243   
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.xml.NvdCve20Handler.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.xml.NvdCve20Handler.html index de691c380..07b0b2267 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.xml.NvdCve20Handler.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.data.update.xml.NvdCve20Handler.html @@ -25,851 +25,841 @@  3   
      *
     4   - 
      * Dependency-check-core is free software: you can redistribute it and/or modify it
    + 
      * Licensed under the Apache License, Version 2.0 (the "License");
     5   - 
      * under the terms of the GNU General Public License as published by the Free
    + 
      * you may not use this file except in compliance with the License.
     6   - 
      * Software Foundation, either version 3 of the License, or (at your option) any
    + 
      * You may obtain a copy of the License at
     7   - 
      * later version.
    + 
      *
     8   - 
      *
    + 
      *     http://www.apache.org/licenses/LICENSE-2.0
     9   - 
      * Dependency-check-core is distributed in the hope that it will be useful, but
    + 
      *
     10   - 
      * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
    + 
      * Unless required by applicable law or agreed to in writing, software
     11   - 
      * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
    + 
      * distributed under the License is distributed on an "AS IS" BASIS,
     12   - 
      * details.
    + 
      * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13   - 
      *
    + 
      * See the License for the specific language governing permissions and
     14   - 
      * You should have received a copy of the GNU General Public License along with
    + 
      * limitations under the License.
     15   - 
      * dependency-check-core. If not, see http://www.gnu.org/licenses/.
    + 
      *
     16   - 
      *
    -  17   
      * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
    +  17   + 
      */
     18   - 
      */
    -  19   
     package org.owasp.dependencycheck.data.update.xml;
    +  19   + 
     
     20   - 
     
    -  21   
     import java.io.IOException;
    -  22   +  21   
     import java.util.List;
    -  23   +  22   
     import java.util.Map;
    -  24   +  23   
     import java.util.logging.Level;
    -  25   +  24   
     import java.util.logging.Logger;
    -  26   +  25   
     import org.apache.lucene.index.CorruptIndexException;
    -  27   +  26   
     import org.owasp.dependencycheck.data.nvdcve.CveDB;
    -  28   +  27   
     import org.owasp.dependencycheck.data.nvdcve.DatabaseException;
    -  29   +  28   
     import org.owasp.dependencycheck.dependency.Reference;
    -  30   +  29   
     import org.owasp.dependencycheck.dependency.Vulnerability;
    -  31   +  30   
     import org.owasp.dependencycheck.dependency.VulnerableSoftware;
    -  32   +  31   
     import org.xml.sax.Attributes;
    -  33   +  32   
     import org.xml.sax.SAXException;
    -  34   +  33   
     import org.xml.sax.SAXNotSupportedException;
    -  35   +  34   
     import org.xml.sax.helpers.DefaultHandler;
    +  35   + 
     
     36   - 
     
    -  37   
     /**
    -  38   +  37   
      * A SAX Handler that will parse the NVD CVE XML (schema version 2.0).
    -  39   +  38   
      *
    -  40   +  39   
      * @author Jeremy Long <jeremy.long@owasp.org>
    -  41   +  40   
      */
    -  42  1 
     public class NvdCve20Handler extends DefaultHandler {
    +  41  2 
     public class NvdCve20Handler extends DefaultHandler {
    +  42   + 
     
     43   - 
     
    + 
         /**
     44   - 
         /**
    -  45   
          * the current supported schema version.
    +  45   + 
          */
     46   - 
          */
    -  47   
         private static final String CURRENT_SCHEMA_VERSION = "2.0";
    +  47   + 
         /**
     48   - 
         /**
    -  49   
          * the current element.
    -  50   +  49   
          */
    -  51  1 
         private final Element current = new Element();
    +  50  2 
         private final Element current = new Element();
    +  51   + 
         /**
     52   - 
         /**
    -  53   
          * the text of the node.
    +  53   + 
          */
     54   - 
          */
    -  55   
         private StringBuilder nodeText;
    +  55   + 
         /**
     56   - 
         /**
    -  57   
          * the vulnerability.
    +  57   + 
          */
     58   - 
          */
    -  59   
         private Vulnerability vulnerability;
    +  59   + 
         /**
     60   - 
         /**
    -  61   
          * a reference for the cve.
    +  61   + 
          */
     62   - 
          */
    -  63   
         private Reference reference;
    +  63   + 
         /**
     64   - 
         /**
    -  65   
          * flag indicating whether the application has a cpe.
    -  66   +  65   
          */
    -  67  1 
         private boolean hasApplicationCpe = false;
    +  66  2 
         private boolean hasApplicationCpe = false;
    +  67   + 
         /**
     68   - 
         /**
    -  69   
          * The total number of entries parsed.
    +  69   + 
          */
     70   - 
          */
    -  71   
         private int totalNumberOfEntries;
    +  71   + 
     
     72   - 
     
    + 
         /**
     73   - 
         /**
    -  74   
          * Get the value of totalNumberOfEntries.
    +  74   + 
          *
     75   - 
          *
    -  76   
          * @return the value of totalNumberOfEntries
    +  76   + 
          */
     77   - 
          */
    -  78   
         public int getTotalNumberOfEntries() {
    -  79  0 
             return totalNumberOfEntries;
    +  78  0 
             return totalNumberOfEntries;
    +  79   + 
         }
     80   - 
         }
    + 
         /**
     81   - 
         /**
    -  82   
          * The total number of application entries parsed.
    +  82   + 
          */
     83   - 
          */
    -  84   
         private int totalNumberOfApplicationEntries;
    +  84   + 
     
     85   - 
     
    + 
         /**
     86   - 
         /**
    -  87   
          * Get the value of totalNumberOfApplicationEntries.
    +  87   + 
          *
     88   - 
          *
    -  89   
          * @return the value of totalNumberOfApplicationEntries
    +  89   + 
          */
     90   - 
          */
    -  91   
         public int getTotalNumberOfApplicationEntries() {
    -  92  0 
             return totalNumberOfApplicationEntries;
    -  93   +  91  0 
             return totalNumberOfApplicationEntries;
    +  92   
         }
    +  93   + 
     
     94   - 
     
    + 
         @Override
     95   - 
         @Override
    -  96   
         public void startElement(String uri, String localName, String qName, Attributes attributes) throws SAXException {
    -  97  2412 
             current.setNode(qName);
    -  98  2412 
             if (current.isEntryNode()) {
    -  99  27 
                 hasApplicationCpe = false;
    -  100  27 
                 vulnerability = new Vulnerability();
    -  101  27 
                 vulnerability.setName(attributes.getValue("id"));
    -  102  2385 
             } else if (current.isVulnProductNode()) {
    -  103  727 
                 nodeText = new StringBuilder(100);
    -  104  1658 
             } else if (current.isVulnReferencesNode()) {
    -  105  90 
                 final String lang = attributes.getValue("xml:lang");
    -  106  90 
                 if ("en".equals(lang)) {
    -  107  90 
                     reference = new Reference();
    -  108   +  96  4824 
             current.setNode(qName);
    +  97  4824 
             if (current.isEntryNode()) {
    +  98  54 
                 hasApplicationCpe = false;
    +  99  54 
                 vulnerability = new Vulnerability();
    +  100  54 
                 vulnerability.setName(attributes.getValue("id"));
    +  101  4770 
             } else if (current.isVulnProductNode()) {
    +  102  1454 
                 nodeText = new StringBuilder(100);
    +  103  3316 
             } else if (current.isVulnReferencesNode()) {
    +  104  180 
                 final String lang = attributes.getValue("xml:lang");
    +  105  180 
                 if ("en".equals(lang)) {
    +  106  180 
                     reference = new Reference();
    +  107   
                 } else {
    -  109  0 
                     reference = null;
    -  110   +  108  0 
                     reference = null;
    +  109   
                 }
    -  111  90 
             } else if (reference != null && current.isVulnReferenceNode()) {
    -  112  90 
                 reference.setUrl(attributes.getValue("href"));
    -  113  90 
                 nodeText = new StringBuilder(130);
    -  114  1478 
             } else if (reference != null && current.isVulnSourceNode()) {
    -  115  90 
                 nodeText = new StringBuilder(30);
    -  116  1388 
             } else if (current.isVulnSummaryNode()) {
    -  117  27 
                 nodeText = new StringBuilder(500);
    -  118  1361 
             } else if (current.isNVDNode()) {
    -  119  1 
                 final String nvdVer = attributes.getValue("nvd_xml_version");
    -  120  1 
                 if (!CURRENT_SCHEMA_VERSION.equals(nvdVer)) {
    -  121  0 
                     throw new SAXNotSupportedException("Schema version " + nvdVer + " is not supported");
    -  122   +  110  180 
             } else if (reference != null && current.isVulnReferenceNode()) {
    +  111  180 
                 reference.setUrl(attributes.getValue("href"));
    +  112  180 
                 nodeText = new StringBuilder(130);
    +  113  2956 
             } else if (reference != null && current.isVulnSourceNode()) {
    +  114  180 
                 nodeText = new StringBuilder(30);
    +  115  2776 
             } else if (current.isVulnSummaryNode()) {
    +  116  54 
                 nodeText = new StringBuilder(500);
    +  117  2722 
             } else if (current.isNVDNode()) {
    +  118  2 
                 final String nvdVer = attributes.getValue("nvd_xml_version");
    +  119  2 
                 if (!CURRENT_SCHEMA_VERSION.equals(nvdVer)) {
    +  120  0 
                     throw new SAXNotSupportedException("Schema version " + nvdVer + " is not supported");
    +  121   
                 }
    -  123  1 
             } else if (current.isVulnCWENode()) {
    -  124  19 
                 vulnerability.setCwe(attributes.getValue("id"));
    -  125  1341 
             } else if (current.isCVSSScoreNode()) {
    -  126  26 
                 nodeText = new StringBuilder(5);
    -  127  1315 
             } else if (current.isCVSSAccessVectorNode()) {
    -  128  26 
                 nodeText = new StringBuilder(20);
    -  129  1289 
             } else if (current.isCVSSAccessComplexityNode()) {
    -  130  26 
                 nodeText = new StringBuilder(20);
    -  131  1263 
             } else if (current.isCVSSAuthenticationNode()) {
    -  132  26 
                 nodeText = new StringBuilder(20);
    -  133  1237 
             } else if (current.isCVSSAvailabilityImpactNode()) {
    -  134  26 
                 nodeText = new StringBuilder(20);
    -  135  1211 
             } else if (current.isCVSSConfidentialityImpactNode()) {
    -  136  26 
                 nodeText = new StringBuilder(20);
    -  137  1185 
             } else if (current.isCVSSIntegrityImpactNode()) {
    -  138  26 
                 nodeText = new StringBuilder(20);
    -  139   +  122  2 
             } else if (current.isVulnCWENode()) {
    +  123  38 
                 vulnerability.setCwe(attributes.getValue("id"));
    +  124  2682 
             } else if (current.isCVSSScoreNode()) {
    +  125  52 
                 nodeText = new StringBuilder(5);
    +  126  2630 
             } else if (current.isCVSSAccessVectorNode()) {
    +  127  52 
                 nodeText = new StringBuilder(20);
    +  128  2578 
             } else if (current.isCVSSAccessComplexityNode()) {
    +  129  52 
                 nodeText = new StringBuilder(20);
    +  130  2526 
             } else if (current.isCVSSAuthenticationNode()) {
    +  131  52 
                 nodeText = new StringBuilder(20);
    +  132  2474 
             } else if (current.isCVSSAvailabilityImpactNode()) {
    +  133  52 
                 nodeText = new StringBuilder(20);
    +  134  2422 
             } else if (current.isCVSSConfidentialityImpactNode()) {
    +  135  52 
                 nodeText = new StringBuilder(20);
    +  136  2370 
             } else if (current.isCVSSIntegrityImpactNode()) {
    +  137  52 
                 nodeText = new StringBuilder(20);
    +  138   
             }
    -  140  2412 
         }
    +  139  4824 
         }
    +  140   + 
     
     141   - 
     
    + 
         @Override
     142   - 
         @Override
    -  143   
         public void characters(char[] ch, int start, int length) throws SAXException {
    -  144  3987 
             if (nodeText != null) {
    -  145  1142 
                 nodeText.append(ch, start, length);
    -  146   +  143  7974 
             if (nodeText != null) {
    +  144  2284 
                 nodeText.append(ch, start, length);
    +  145   
             }
    -  147  3987 
         }
    +  146  7974 
         }
    +  147   + 
     
     148   - 
     
    -  149   
         @Override
    -  150   +  149   
         public void endElement(String uri, String localName, String qName) throws SAXException {
    -  151  2412 
             current.setNode(qName);
    -  152  2412 
             if (current.isEntryNode()) {
    -  153  27 
                 totalNumberOfEntries += 1;
    -  154  27 
                 if (hasApplicationCpe) {
    -  155  19 
                     totalNumberOfApplicationEntries += 1;
    -  156   +  150  4824 
             current.setNode(qName);
    +  151  4824 
             if (current.isEntryNode()) {
    +  152  54 
                 totalNumberOfEntries += 1;
    +  153  54 
                 if (hasApplicationCpe) {
    +  154  38 
                     totalNumberOfApplicationEntries += 1;
    +  155   
                     try {
    -  157  19 
                         saveEntry(vulnerability);
    -  158  0 
                     } catch (DatabaseException ex) {
    -  159  0 
                         throw new SAXException(ex);
    -  160  0 
                     } catch (CorruptIndexException ex) {
    -  161  0 
                         throw new SAXException(ex);
    -  162  0 
                     } catch (IOException ex) {
    -  163  0 
                         throw new SAXException(ex);
    -  164  19 
                     }
    -  165   +  156  38 
                         saveEntry(vulnerability);
    +  157  0 
                     } catch (DatabaseException ex) {
    +  158  0 
                         throw new SAXException(ex);
    +  159  0 
                     } catch (CorruptIndexException ex) {
    +  160  0 
                         throw new SAXException(ex);
    +  161  0 
                     } catch (IOException ex) {
    +  162  0 
                         throw new SAXException(ex);
    +  163  38 
                     }
    +  164   
                 }
    -  166  27 
                 vulnerability = null;
    -  167  2385 
             } else if (current.isCVSSScoreNode()) {
    -  168   +  165  54 
                 vulnerability = null;
    +  166  4770 
             } else if (current.isCVSSScoreNode()) {
    +  167   
                 try {
    -  169  26 
                     final float score = Float.parseFloat(nodeText.toString());
    -  170  26 
                     vulnerability.setCvssScore(score);
    -  171  0 
                 } catch (NumberFormatException ex) {
    -  172  0 
                     Logger.getLogger(NvdCve20Handler.class.getName()).log(Level.SEVERE, "Error parsing CVSS Score.");
    -  173  0 
                     Logger.getLogger(NvdCve20Handler.class.getName()).log(Level.FINE, null, ex);
    -  174  26 
                 }
    -  175  26 
                 nodeText = null;
    -  176  2359 
             } else if (current.isCVSSAccessVectorNode()) {
    -  177  26 
                 vulnerability.setCvssAccessVector(nodeText.toString());
    -  178  26 
                 nodeText = null;
    -  179  2333 
             } else if (current.isCVSSAccessComplexityNode()) {
    -  180  26 
                 vulnerability.setCvssAccessComplexity(nodeText.toString());
    -  181  26 
                 nodeText = null;
    -  182  2307 
             } else if (current.isCVSSAuthenticationNode()) {
    -  183  26 
                 vulnerability.setCvssAuthentication(nodeText.toString());
    -  184  26 
                 nodeText = null;
    -  185  2281 
             } else if (current.isCVSSAvailabilityImpactNode()) {
    -  186  26 
                 vulnerability.setCvssAvailabilityImpact(nodeText.toString());
    -  187  26 
                 nodeText = null;
    -  188  2255 
             } else if (current.isCVSSConfidentialityImpactNode()) {
    -  189  26 
                 vulnerability.setCvssConfidentialityImpact(nodeText.toString());
    -  190  26 
                 nodeText = null;
    -  191  2229 
             } else if (current.isCVSSIntegrityImpactNode()) {
    -  192  26 
                 vulnerability.setCvssIntegrityImpact(nodeText.toString());
    -  193  26 
                 nodeText = null;
    -  194  2203 
             } else if (current.isVulnProductNode()) {
    -  195  727 
                 final String cpe = nodeText.toString();
    -  196  727 
                 if (cpe.startsWith("cpe:/a:")) {
    -  197  614 
                     hasApplicationCpe = true;
    -  198  614 
                     vulnerability.addVulnerableSoftware(cpe);
    -  199   +  168  52 
                     final float score = Float.parseFloat(nodeText.toString());
    +  169  52 
                     vulnerability.setCvssScore(score);
    +  170  0 
                 } catch (NumberFormatException ex) {
    +  171  0 
                     Logger.getLogger(NvdCve20Handler.class.getName()).log(Level.SEVERE, "Error parsing CVSS Score.");
    +  172  0 
                     Logger.getLogger(NvdCve20Handler.class.getName()).log(Level.FINE, null, ex);
    +  173  52 
                 }
    +  174  52 
                 nodeText = null;
    +  175  4718 
             } else if (current.isCVSSAccessVectorNode()) {
    +  176  52 
                 vulnerability.setCvssAccessVector(nodeText.toString());
    +  177  52 
                 nodeText = null;
    +  178  4666 
             } else if (current.isCVSSAccessComplexityNode()) {
    +  179  52 
                 vulnerability.setCvssAccessComplexity(nodeText.toString());
    +  180  52 
                 nodeText = null;
    +  181  4614 
             } else if (current.isCVSSAuthenticationNode()) {
    +  182  52 
                 vulnerability.setCvssAuthentication(nodeText.toString());
    +  183  52 
                 nodeText = null;
    +  184  4562 
             } else if (current.isCVSSAvailabilityImpactNode()) {
    +  185  52 
                 vulnerability.setCvssAvailabilityImpact(nodeText.toString());
    +  186  52 
                 nodeText = null;
    +  187  4510 
             } else if (current.isCVSSConfidentialityImpactNode()) {
    +  188  52 
                 vulnerability.setCvssConfidentialityImpact(nodeText.toString());
    +  189  52 
                 nodeText = null;
    +  190  4458 
             } else if (current.isCVSSIntegrityImpactNode()) {
    +  191  52 
                 vulnerability.setCvssIntegrityImpact(nodeText.toString());
    +  192  52 
                 nodeText = null;
    +  193  4406 
             } else if (current.isVulnProductNode()) {
    +  194  1454 
                 final String cpe = nodeText.toString();
    +  195  1454 
                 if (cpe.startsWith("cpe:/a:")) {
    +  196  1228 
                     hasApplicationCpe = true;
    +  197  1228 
                     vulnerability.addVulnerableSoftware(cpe);
    +  198   
                 }
    -  200  727 
                 nodeText = null;
    -  201  727 
             } else if (reference != null && current.isVulnReferencesNode()) {
    -  202  90 
                 vulnerability.addReference(reference);
    -  203  90 
                 reference = null;
    -  204  1386 
             } else if (reference != null && current.isVulnReferenceNode()) {
    -  205  90 
                 reference.setName(nodeText.toString());
    -  206  90 
                 nodeText = null;
    -  207  1296 
             } else if (reference != null && current.isVulnSourceNode()) {
    -  208  90 
                 reference.setSource(nodeText.toString());
    -  209  90 
                 nodeText = null;
    -  210  1206 
             } else if (current.isVulnSummaryNode()) {
    -  211  27 
                 vulnerability.setDescription(nodeText.toString());
    -  212  27 
                 if (nodeText.indexOf("** REJECT **") >= 0) {
    -  213  1 
                     hasApplicationCpe = true; //ensure we process this to delete the vuln
    -  214   +  199  1454 
                 nodeText = null;
    +  200  1454 
             } else if (reference != null && current.isVulnReferencesNode()) {
    +  201  180 
                 vulnerability.addReference(reference);
    +  202  180 
                 reference = null;
    +  203  2772 
             } else if (reference != null && current.isVulnReferenceNode()) {
    +  204  180 
                 reference.setName(nodeText.toString());
    +  205  180 
                 nodeText = null;
    +  206  2592 
             } else if (reference != null && current.isVulnSourceNode()) {
    +  207  180 
                 reference.setSource(nodeText.toString());
    +  208  180 
                 nodeText = null;
    +  209  2412 
             } else if (current.isVulnSummaryNode()) {
    +  210  54 
                 vulnerability.setDescription(nodeText.toString());
    +  211  54 
                 if (nodeText.indexOf("** REJECT **") >= 0) {
    +  212  2 
                     hasApplicationCpe = true; //ensure we process this to delete the vuln
    +  213   
                 }
    -  215  27 
                 nodeText = null;
    -  216   +  214  54 
                 nodeText = null;
    +  215   
             }
    -  217  2412 
         }
    +  216  4824 
         }
    +  217   + 
         /**
     218   - 
         /**
    -  219   
          * the cve database.
    +  219   + 
          */
     220   - 
          */
    -  221   
         private CveDB cveDB;
    +  221   + 
     
     222   - 
     
    + 
         /**
     223   - 
         /**
    -  224   
          * Sets the cveDB.
    +  224   + 
          *
     225   - 
          *
    -  226   
          * @param db a reference to the CveDB
    +  226   + 
          */
     227   - 
          */
    -  228   
         public void setCveDB(CveDB db) {
    -  229  0 
             cveDB = db;
    -  230  0 
         }
    +  228  0 
             cveDB = db;
    +  229  0 
         }
    +  230   + 
         /**
     231   - 
         /**
    + 
          * A list of CVE entries and associated VulnerableSoftware entries that contain previous entries.
     232   - 
          * A list of CVE entries and associated VulnerableSoftware entries that
    + 
          */
     233   - 
          * contain previous entries.
    -  234   - 
          */
    -  235   
         private Map<String, List<VulnerableSoftware>> prevVersionVulnMap;
    +  234   + 
     
    +  235   + 
         /**
     236   - 
     
    -  237   - 
         /**
    -  238   
          * Sets the prevVersionVulnMap.
    +  237   + 
          *
    +  238   + 
          * @param map the map of vulnerable software with previous versions being vulnerable
     239   - 
          *
    + 
          */
     240   - 
          * @param map the map of vulnerable software with previous versions being
    -  241   - 
          * vulnerable
    -  242   - 
          */
    -  243   
         public void setPrevVersionVulnMap(Map<String, List<VulnerableSoftware>> map) {
    -  244  0 
             prevVersionVulnMap = map;
    -  245  0 
         }
    -  246   +  241  0 
             prevVersionVulnMap = map;
    +  242  0 
         }
    +  243   
     
    -  247   +  244   
         /**
    -  248   +  245   
          * Saves a vulnerability to the CVE Database.
    -  249   +  246   
          *
    -  250   +  247   
          * @param vuln the vulnerability to store in the database
    -  251   - 
          * @throws DatabaseException thrown if there is an error writing to the
    -  252   - 
          * database
    -  253   +  248   + 
          * @throws DatabaseException thrown if there is an error writing to the database
    +  249   
          * @throws CorruptIndexException is thrown if the CPE Index is corrupt
    -  254   +  250   
          * @throws IOException thrown if there is an IOException with the CPE Index
    -  255   +  251   
          */
    -  256   +  252   
         private void saveEntry(Vulnerability vuln) throws DatabaseException, CorruptIndexException, IOException {
    -  257  19 
             if (cveDB == null) {
    -  258  19 
                 return;
    -  259   +  253  38 
             if (cveDB == null) {
    +  254  38 
                 return;
    +  255   
             }
    -  260  0 
             final String cveName = vuln.getName();
    -  261  0 
             if (prevVersionVulnMap.containsKey(cveName)) {
    -  262  0 
                 final List<VulnerableSoftware> vulnSoftware = prevVersionVulnMap.get(cveName);
    -  263  0 
                 for (VulnerableSoftware vs : vulnSoftware) {
    -  264  0 
                     vuln.updateVulnerableSoftware(vs);
    -  265  0 
                 }
    +  256  0 
             final String cveName = vuln.getName();
    +  257  0 
             if (prevVersionVulnMap.containsKey(cveName)) {
    +  258  0 
                 final List<VulnerableSoftware> vulnSoftware = prevVersionVulnMap.get(cveName);
    +  259  0 
                 for (VulnerableSoftware vs : vulnSoftware) {
    +  260  0 
                     vuln.updateVulnerableSoftware(vs);
    +  261  0 
                 }
    +  262   + 
             }
    +  263  0 
             cveDB.updateVulnerability(vuln);
    +  264  0 
         }
    +  265   + 
     
     266   - 
             }
    -  267  0 
             cveDB.updateVulnerability(vuln);
    -  268  0 
         }
    -  269   - 
     
    -  270   
         // <editor-fold defaultstate="collapsed" desc="The Element Class that maintains state information about the current node">
    -  271   +  267   
         /**
    -  272   - 
          * A simple class to maintain information about the current element while
    -  273   - 
          * parsing the NVD CVE XML.
    -  274   +  268   + 
          * A simple class to maintain information about the current element while parsing the NVD CVE XML.
    +  269   
          */
    -  275  1 
         protected static class Element {
    -  276   +  270  2 
         protected static class Element {
    +  271   
     
    -  277   +  272   
             /**
    -  278   +  273   
              * A node type in the NVD CVE Schema 2.0
    -  279   +  274   
              */
    -  280   +  275   
             public static final String NVD = "nvd";
    -  281   +  276   
             /**
    -  282   +  277   
              * A node type in the NVD CVE Schema 2.0
    -  283   +  278   
              */
    -  284   +  279   
             public static final String ENTRY = "entry";
    -  285   +  280   
             /**
    -  286   +  281   
              * A node type in the NVD CVE Schema 2.0
    -  287   +  282   
              */
    -  288   +  283   
             public static final String VULN_PRODUCT = "vuln:product";
    -  289   +  284   
             /**
    -  290   +  285   
              * A node type in the NVD CVE Schema 2.0
    -  291   +  286   
              */
    -  292   +  287   
             public static final String VULN_REFERENCES = "vuln:references";
    -  293   +  288   
             /**
    -  294   +  289   
              * A node type in the NVD CVE Schema 2.0
    -  295   +  290   
              */
    -  296   +  291   
             public static final String VULN_SOURCE = "vuln:source";
    -  297   +  292   
             /**
    -  298   +  293   
              * A node type in the NVD CVE Schema 2.0
    -  299   +  294   
              */
    -  300   +  295   
             public static final String VULN_REFERENCE = "vuln:reference";
    -  301   +  296   
             /**
    -  302   +  297   
              * A node type in the NVD CVE Schema 2.0
    -  303   +  298   
              */
    -  304   +  299   
             public static final String VULN_SUMMARY = "vuln:summary";
    -  305   +  300   
             /**
    -  306   +  301   
              * A node type in the NVD CVE Schema 2.0
    -  307   +  302   
              */
    -  308   +  303   
             public static final String VULN_CWE = "vuln:cwe";
    -  309   +  304   
             /**
    -  310   +  305   
              * A node type in the NVD CVE Schema 2.0
    -  311   +  306   
              */
    -  312   +  307   
             public static final String CVSS_SCORE = "cvss:score";
    -  313   +  308   
             /**
    -  314   +  309   
              * A node type in the NVD CVE Schema 2.0
    -  315   +  310   
              */
    -  316   +  311   
             public static final String CVSS_ACCESS_VECTOR = "cvss:access-vector";
    -  317   +  312   
             /**
    -  318   +  313   
              * A node type in the NVD CVE Schema 2.0
    -  319   +  314   
              */
    -  320   +  315   
             public static final String CVSS_ACCESS_COMPLEXITY = "cvss:access-complexity";
    -  321   +  316   
             /**
    -  322   +  317   
              * A node type in the NVD CVE Schema 2.0
    -  323   +  318   
              */
    -  324   +  319   
             public static final String CVSS_AUTHENTICATION = "cvss:authentication";
    -  325   +  320   
             /**
    -  326   +  321   
              * A node type in the NVD CVE Schema 2.0
    -  327   +  322   
              */
    -  328   +  323   
             public static final String CVSS_CONFIDENTIALITY_IMPACT = "cvss:confidentiality-impact";
    -  329   +  324   
             /**
    -  330   +  325   
              * A node type in the NVD CVE Schema 2.0
    -  331   +  326   
              */
    -  332   +  327   
             public static final String CVSS_INTEGRITY_IMPACT = "cvss:integrity-impact";
    -  333   +  328   
             /**
    -  334   +  329   
              * A node type in the NVD CVE Schema 2.0
    -  335   +  330   
              */
    -  336   +  331   
             public static final String CVSS_AVAILABILITY_IMPACT = "cvss:availability-impact";
    +  332   + 
             /**
    +  333   + 
              * The current node.
    +  334   + 
              */
    +  335   + 
             private String node;
    +  336   + 
     
     337   
             /**
     338   - 
              * The current node.
    -  339   - 
              */
    -  340   - 
             private String node;
    -  341   - 
     
    -  342   - 
             /**
    -  343   
              * Gets the value of node.
    -  344   +  339   
              *
    -  345   +  340   
              * @return the value of node
    -  346   +  341   
              */
    -  347   +  342   
             public String getNode() {
    -  348  0 
                 return this.node;
    -  349   +  343  0 
                 return this.node;
    +  344   
             }
    -  350   +  345   
     
    -  351   +  346   
             /**
    -  352   +  347   
              * Sets the value of node.
    -  353   +  348   
              *
    -  354   +  349   
              * @param node new value of node
    -  355   +  350   
              */
    -  356   +  351   
             public void setNode(String node) {
    -  357  4824 
                 this.node = node;
    -  358  4824 
             }
    -  359   +  352  9648 
                 this.node = node;
    +  353  9648 
             }
    +  354   
     
    -  360   +  355   
             /**
    -  361   +  356   
              * Checks if the handler is at the NVD node.
    -  362   +  357   
              *
    -  363   +  358   
              * @return true or false
    -  364   +  359   
              */
    -  365   +  360   
             public boolean isNVDNode() {
    -  366  1361 
                 return NVD.equals(node);
    -  367   +  361  2722 
                 return NVD.equals(node);
    +  362   
             }
    -  368   +  363   
     
    -  369   +  364   
             /**
    -  370   +  365   
              * Checks if the handler is at the ENTRY node.
    -  371   +  366   
              *
    -  372   +  367   
              * @return true or false
    -  373   +  368   
              */
    -  374   +  369   
             public boolean isEntryNode() {
    -  375  4824 
                 return ENTRY.equals(node);
    -  376   +  370  9648 
                 return ENTRY.equals(node);
    +  371   
             }
    -  377   +  372   
     
    -  378   +  373   
             /**
    -  379   +  374   
              * Checks if the handler is at the VULN_PRODUCT node.
    -  380   +  375   
              *
    -  381   +  376   
              * @return true or false
    -  382   +  377   
              */
    -  383   +  378   
             public boolean isVulnProductNode() {
    -  384  4588 
                 return VULN_PRODUCT.equals(node);
    -  385   +  379  9176 
                 return VULN_PRODUCT.equals(node);
    +  380   
             }
    -  386   +  381   
     
    -  387   +  382   
             /**
    -  388   +  383   
              * Checks if the handler is at the REFERENCES node.
    -  389   +  384   
              *
    -  390   +  385   
              * @return true or false
    -  391   +  386   
              */
    -  392   +  387   
             public boolean isVulnReferencesNode() {
    -  393  1928 
                 return VULN_REFERENCES.equals(node);
    -  394   +  388  3856 
                 return VULN_REFERENCES.equals(node);
    +  389   
             }
    -  395   +  390   
     
    -  396   +  391   
             /**
    -  397   +  392   
              * Checks if the handler is at the REFERENCE node.
    -  398   +  393   
              *
    -  399   +  394   
              * @return true or false
    -  400   +  395   
              */
    -  401   +  396   
             public boolean isVulnReferenceNode() {
    -  402  360 
                 return VULN_REFERENCE.equals(node);
    -  403   +  397  720 
                 return VULN_REFERENCE.equals(node);
    +  398   
             }
    -  404   +  399   
     
    -  405   +  400   
             /**
    -  406   +  401   
              * Checks if the handler is at the VULN_SOURCE node.
    -  407   +  402   
              *
    -  408   +  403   
              * @return true or false
    -  409   +  404   
              */
    -  410   +  405   
             public boolean isVulnSourceNode() {
    -  411  180 
                 return VULN_SOURCE.equals(node);
    -  412   +  406  360 
                 return VULN_SOURCE.equals(node);
    +  407   
             }
    -  413   +  408   
     
    -  414   +  409   
             /**
    -  415   +  410   
              * Checks if the handler is at the VULN_SUMMARY node.
    -  416   +  411   
              *
    -  417   +  412   
              * @return true or false
    -  418   +  413   
              */
    -  419   +  414   
             public boolean isVulnSummaryNode() {
    -  420  2594 
                 return VULN_SUMMARY.equals(node);
    -  421   +  415  5188 
                 return VULN_SUMMARY.equals(node);
    +  416   
             }
    -  422   +  417   
     
    -  423   +  418   
             /**
    -  424   +  419   
              * Checks if the handler is at the VULN_CWE node.
    -  425   +  420   
              *
    -  426   +  421   
              * @return true or false
    -  427   +  422   
              */
    -  428   +  423   
             public boolean isVulnCWENode() {
    -  429  1360 
                 return VULN_CWE.equals(node);
    -  430   +  424  2720 
                 return VULN_CWE.equals(node);
    +  425   
             }
    -  431   +  426   
     
    -  432   +  427   
             /**
    -  433   +  428   
              * Checks if the handler is at the CVSS_SCORE node.
    -  434   +  429   
              *
    -  435   +  430   
              * @return true or false
    -  436   +  431   
              */
    -  437   +  432   
             public boolean isCVSSScoreNode() {
    -  438  3726 
                 return CVSS_SCORE.equals(node);
    -  439   +  433  7452 
                 return CVSS_SCORE.equals(node);
    +  434   
             }
    -  440   +  435   
     
    -  441   +  436   
             /**
    -  442   +  437   
              * Checks if the handler is at the CVSS_ACCESS_VECTOR node.
    -  443   +  438   
              *
    -  444   +  439   
              * @return true or false
    -  445   +  440   
              */
    -  446   +  441   
             public boolean isCVSSAccessVectorNode() {
    -  447  3674 
                 return CVSS_ACCESS_VECTOR.equals(node);
    -  448   +  442  7348 
                 return CVSS_ACCESS_VECTOR.equals(node);
    +  443   
             }
    -  449   +  444   
     
    -  450   +  445   
             /**
    -  451   +  446   
              * Checks if the handler is at the CVSS_ACCESS_COMPLEXITY node.
    -  452   +  447   
              *
    -  453   +  448   
              * @return true or false
    -  454   +  449   
              */
    -  455   +  450   
             public boolean isCVSSAccessComplexityNode() {
    -  456  3622 
                 return CVSS_ACCESS_COMPLEXITY.equals(node);
    -  457   +  451  7244 
                 return CVSS_ACCESS_COMPLEXITY.equals(node);
    +  452   
             }
    -  458   +  453   
     
    -  459   +  454   
             /**
    -  460   +  455   
              * Checks if the handler is at the CVSS_AUTHENTICATION node.
    -  461   +  456   
              *
    -  462   +  457   
              * @return true or false
    -  463   +  458   
              */
    -  464   +  459   
             public boolean isCVSSAuthenticationNode() {
    -  465  3570 
                 return CVSS_AUTHENTICATION.equals(node);
    -  466   +  460  7140 
                 return CVSS_AUTHENTICATION.equals(node);
    +  461   
             }
    -  467   +  462   
     
    -  468   +  463   
             /**
    -  469   +  464   
              * Checks if the handler is at the CVSS_CONFIDENTIALITY_IMPACT node.
    -  470   +  465   
              *
    -  471   +  466   
              * @return true or false
    -  472   +  467   
              */
    -  473   +  468   
             public boolean isCVSSConfidentialityImpactNode() {
    -  474  3466 
                 return CVSS_CONFIDENTIALITY_IMPACT.equals(node);
    -  475   +  469  6932 
                 return CVSS_CONFIDENTIALITY_IMPACT.equals(node);
    +  470   
             }
    -  476   +  471   
     
    -  477   +  472   
             /**
    -  478   +  473   
              * Checks if the handler is at the CVSS_INTEGRITY_IMPACT node.
    -  479   +  474   
              *
    -  480   +  475   
              * @return true or false
    -  481   +  476   
              */
    -  482   +  477   
             public boolean isCVSSIntegrityImpactNode() {
    -  483  3414 
                 return CVSS_INTEGRITY_IMPACT.equals(node);
    -  484   +  478  6828 
                 return CVSS_INTEGRITY_IMPACT.equals(node);
    +  479   
             }
    -  485   +  480   
     
    -  486   +  481   
             /**
    -  487   +  482   
              * Checks if the handler is at the CVSS_AVAILABILITY_IMPACT node.
    -  488   +  483   
              *
    -  489   +  484   
              * @return true or false
    -  490   +  485   
              */
    -  491   +  486   
             public boolean isCVSSAvailabilityImpactNode() {
    -  492  3518 
                 return CVSS_AVAILABILITY_IMPACT.equals(node);
    -  493   +  487  7036 
                 return CVSS_AVAILABILITY_IMPACT.equals(node);
    +  488   
             }
    -  494   +  489   
         }
    -  495   +  490   
         // </editor-fold>
    -  496   +  491   
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.Confidence.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.Confidence.html new file mode 100644 index 000000000..0fd9ee741 --- /dev/null +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.Confidence.html @@ -0,0 +1,105 @@ + + + + +Coverage Report + + + + +
    Coverage Report - org.owasp.dependencycheck.dependency.Confidence
    +
     
    + + + + +
    Classes in this File Line Coverage Branch Coverage Complexity
    Confidence
    100%
    5/5
    N/A
    N/A
    		0
    +
     
    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
     1  
     /*
     2  
      * This file is part of dependency-check-core.
     3  
      *
     4  
      * Licensed under the Apache License, Version 2.0 (the "License");
     5  
      * you may not use this file except in compliance with the License.
     6  
      * You may obtain a copy of the License at
     7  
      *
     8  
      *     http://www.apache.org/licenses/LICENSE-2.0
     9  
      *
     10  
      * Unless required by applicable law or agreed to in writing, software
     11  
      * distributed under the License is distributed on an "AS IS" BASIS,
     12  
      * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13  
      * See the License for the specific language governing permissions and
     14  
      * limitations under the License.
     15  
      *
     16  
      * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
     17  
      */
     18  
     package org.owasp.dependencycheck.dependency;
     19  
     
     20  
     /**
     21  
      * A confidence enumeration.
     22  
      *
     23  
      * @author Jeremy Long <jeremy.long@owasp.org>
     24  
      */
     25  152 
     public enum Confidence {
     26  
     
     27  
         /**
     28  
          * High confidence evidence.
     29  
          */
     30  2 
         HIGHEST,
     31  
         /**
     32  
          * High confidence evidence.
     33  
          */
     34  2 
         HIGH,
     35  
         /**
     36  
          * Medium confidence evidence.
     37  
          */
     38  2 
         MEDIUM,
     39  
         /**
     40  
          * Low confidence evidence.
     41  
          */
     42  2 
         LOW
     43  
     }
    + +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    + + diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.Dependency.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.Dependency.html index 07228317a..530537b07 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.Dependency.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.Dependency.html @@ -12,7 +12,7 @@
     
    - +
    Classes in this File Line Coverage Branch Coverage Complexity
    Dependency
    60%
    85/140
    13%
    17/124
    		2.78
    Dependency
    64%
    95/147
    14%
    18/126
    		2.762
     
    @@ -24,1019 +24,1040 @@  3   
      *
     4   - 
      * Dependency-check-core is free software: you can redistribute it and/or modify it
    + 
      * Licensed under the Apache License, Version 2.0 (the "License");
     5   - 
      * under the terms of the GNU General Public License as published by the Free
    + 
      * you may not use this file except in compliance with the License.
     6   - 
      * Software Foundation, either version 3 of the License, or (at your option) any
    + 
      * You may obtain a copy of the License at
     7   - 
      * later version.
    + 
      *
     8   - 
      *
    + 
      *     http://www.apache.org/licenses/LICENSE-2.0
     9   - 
      * Dependency-check-core is distributed in the hope that it will be useful, but
    + 
      *
     10   - 
      * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
    + 
      * Unless required by applicable law or agreed to in writing, software
     11   - 
      * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
    + 
      * distributed under the License is distributed on an "AS IS" BASIS,
     12   - 
      * details.
    + 
      * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13   - 
      *
    + 
      * See the License for the specific language governing permissions and
     14   - 
      * You should have received a copy of the GNU General Public License along with
    + 
      * limitations under the License.
     15   - 
      * dependency-check-core. If not, see http://www.gnu.org/licenses/.
    + 
      *
     16   - 
      *
    -  17   
      * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
    +  17   + 
      */
     18   - 
      */
    -  19   
     package org.owasp.dependencycheck.dependency;
    +  19   + 
     
     20   - 
     
    -  21   
     import java.io.File;
    -  22   +  21   
     import java.io.IOException;
    -  23   +  22   
     import java.security.NoSuchAlgorithmException;
    -  24   +  23   
     import java.util.ArrayList;
    -  25   +  24   
     import java.util.List;
    -  26   +  25   
     import java.util.Set;
    -  27   +  26   
     import java.util.SortedSet;
    -  28   +  27   
     import java.util.TreeSet;
    -  29   +  28   
     import java.util.logging.Level;
    -  30   +  29   
     import java.util.logging.Logger;
    -  31   +  30   
     import org.owasp.dependencycheck.utils.Checksum;
    -  32   +  31   
     import org.owasp.dependencycheck.utils.FileUtils;
    +  32   + 
     
     33   - 
     
    -  34   
     /**
    +  34   + 
      * A program dependency. This object is one of the core components within DependencyCheck. It is used to collect
     35   - 
      * A program dependency. This object is one of the core components within
    + 
      * information about the dependency in the form of evidence. The Evidence is then used to determine if there are any
     36   - 
      * DependencyCheck. It is used to collect information about the dependency in
    -  37   - 
      * the form of evidence. The Evidence is then used to determine if there are any
    -  38   
      * known, published, vulnerabilities associated with the program dependency.
    -  39   +  37   
      *
    -  40   +  38   
      * @author Jeremy Long <jeremy.long@owasp.org>
    -  41   +  39   
      */
    -  42  23 
     public class Dependency implements Comparable<Dependency> {
    +  40  58 
     public class Dependency implements Comparable<Dependency> {
    +  41   + 
     
    +  42   + 
         /**
     43   - 
     
    -  44   - 
         /**
    -  45   
          * The actual file path of the dependency on disk.
    -  46   +  44   
          */
    -  47   +  45   
         private String actualFilePath;
    -  48   +  46   
         /**
    -  49   +  47   
          * The file path to display.
    -  50   +  48   
          */
    -  51   +  49   
         private String filePath;
    -  52   +  50   
         /**
    -  53   +  51   
          * The file name of the dependency.
    -  54   +  52   
          */
    -  55   +  53   
         private String fileName;
    -  56   +  54   
         /**
    -  57   +  55   
          * The file extension of the dependency.
    -  58   +  56   
          */
    -  59   +  57   
         private String fileExtension;
    -  60   +  58   
         /**
    -  61   +  59   
          * The md5 hash of the dependency.
    -  62   +  60   
          */
    -  63   +  61   
         private String md5sum;
    -  64   +  62   
         /**
    -  65   +  63   
          * The SHA1 hash of the dependency.
    -  66   +  64   
          */
    -  67   +  65   
         private String sha1sum;
    -  68   +  66   
         /**
    -  69   +  67   
          * A list of Identifiers.
    -  70   +  68   
          */
    -  71   +  69   
         private Set<Identifier> identifiers;
    -  72   +  70   
         /**
    -  73   +  71   
          * A collection of vendor evidence.
    -  74   +  72   
          */
    -  75   +  73   
         private final EvidenceCollection vendorEvidence;
    -  76   +  74   
         /**
    -  77   +  75   
          * A collection of product evidence.
    -  78   +  76   
          */
    -  79   +  77   
         private final EvidenceCollection productEvidence;
    -  80   +  78   
         /**
    -  81   +  79   
          * A collection of version evidence.
    -  82   +  80   
          */
    -  83   +  81   
         private final EvidenceCollection versionEvidence;
    +  82   + 
     
    +  83   + 
         /**
     84   - 
     
    + 
          * Constructs a new Dependency object.
     85   - 
         /**
    -  86   - 
          * Constructs a new Dependency object.
    -  87   
          */
    -  88  54 
         public Dependency() {
    -  89  54 
             vendorEvidence = new EvidenceCollection();
    -  90  54 
             productEvidence = new EvidenceCollection();
    -  91  54 
             versionEvidence = new EvidenceCollection();
    -  92  54 
             identifiers = new TreeSet<Identifier>();
    -  93  54 
             vulnerabilities = new TreeSet<Vulnerability>(new VulnerabilityComparator());
    -  94  54 
         }
    +  86  132 
         public Dependency() {
    +  87  132 
             vendorEvidence = new EvidenceCollection();
    +  88  132 
             productEvidence = new EvidenceCollection();
    +  89  132 
             versionEvidence = new EvidenceCollection();
    +  90  132 
             identifiers = new TreeSet<Identifier>();
    +  91  132 
             vulnerabilities = new TreeSet<Vulnerability>(new VulnerabilityComparator());
    +  92  132 
         }
    +  93   + 
     
    +  94   + 
         /**
     95   - 
     
    -  96   - 
         /**
    -  97   
          * Constructs a new Dependency object.
    -  98   +  96   
          *
    -  99   +  97   
          * @param file the File to create the dependency object from.
    -  100   +  98   
          */
    -  101   +  99   
         public Dependency(File file) {
    -  102  36 
             this();
    -  103  36 
             this.actualFilePath = file.getPath();
    -  104  36 
             this.filePath = this.actualFilePath;
    -  105  36 
             this.fileName = file.getName();
    -  106  36 
             this.fileExtension = FileUtils.getFileExtension(fileName);
    -  107  36 
             determineHashes(file);
    -  108  36 
         }
    +  100  90 
             this();
    +  101  90 
             this.actualFilePath = file.getPath();
    +  102  90 
             this.filePath = this.actualFilePath;
    +  103  90 
             this.fileName = file.getName();
    +  104  90 
             this.fileExtension = FileUtils.getFileExtension(fileName);
    +  105  90 
             determineHashes(file);
    +  106  90 
         }
    +  107   + 
     
    +  108   + 
         /**
     109   - 
     
    -  110   - 
         /**
    -  111   
          * Returns the file name of the dependency.
    -  112   +  110   
          *
    -  113   +  111   
          * @return the file name of the dependency.
    -  114   +  112   
          */
    -  115   +  113   
         public String getFileName() {
    -  116  154 
             return this.fileName;
    +  114  414 
             return this.fileName;
    +  115   + 
         }
    +  116   + 
     
     117   - 
         }
    + 
         /**
     118   - 
     
    + 
          * Sets the file name of the dependency.
     119   - 
         /**
    + 
          *
     120   - 
          * Sets the file name of the dependency.
    -  121   - 
          *
    -  122   
          * @param fileName the file name of the dependency.
    -  123   +  121   
          */
    -  124   +  122   
         public void setFileName(String fileName) {
    -  125  12 
             this.fileName = fileName;
    -  126  12 
         }
    +  123  52 
             this.fileName = fileName;
    +  124  52 
         }
    +  125   + 
     
    +  126   + 
         /**
     127   - 
     
    -  128   - 
         /**
    -  129   
          * Sets the actual file path of the dependency on disk.
    -  130   +  128   
          *
    -  131   +  129   
          * @param actualFilePath the file path of the dependency.
    -  132   +  130   
          */
    -  133   +  131   
         public void setActualFilePath(String actualFilePath) {
    -  134  2 
             this.actualFilePath = actualFilePath;
    -  135  2 
         }
    +  132  4 
             this.actualFilePath = actualFilePath;
    +  133  4 
             if (this.sha1sum == null) {
    +  134  4 
                 final File file = new File(this.actualFilePath);
    +  135  4 
                 determineHashes(file);
     136   - 
     
    -  137   - 
         /**
    + 
             }
    +  137  4 
         }
     138   - 
          * Gets the file path of the dependency.
    + 
     
     139   - 
          *
    + 
         /**
     140   - 
          * @return the file path of the dependency.
    + 
          * Gets the file path of the dependency.
     141   - 
          */
    + 
          *
     142   - 
         public String getActualFilePath() {
    -  143  158 
             return this.actualFilePath;
    -  144   - 
         }
    -  145   - 
     
    -  146   - 
         /**
    -  147   - 
          * Sets the file path of the dependency.
    -  148   - 
          *
    -  149   - 
          * @param filePath the file path of the dependency.
    -  150   - 
          */
    -  151   - 
         public void setFilePath(String filePath) {
    -  152  12 
             this.filePath = filePath;
    -  153  12 
         }
    -  154   - 
     
    -  155   - 
         /**
    -  156   - 
          * <p>Gets the file path of the dependency.</p> <p><b>NOTE:</b> This may not
    -  157   - 
          * be the actual path of the file on disk. The actual path of the file on
    -  158   - 
          * disk can be obtained via the getActualFilePath().</p>
    -  159   - 
          *
    -  160   
          * @return the file path of the dependency.
    +  143   + 
          */
    +  144   + 
         public String getActualFilePath() {
    +  145  334 
             return this.actualFilePath;
    +  146   + 
         }
    +  147   + 
     
    +  148   + 
         /**
    +  149   + 
          * Sets the file path of the dependency.
    +  150   + 
          *
    +  151   + 
          * @param filePath the file path of the dependency.
    +  152   + 
          */
    +  153   + 
         public void setFilePath(String filePath) {
    +  154  42 
             this.filePath = filePath;
    +  155  42 
         }
    +  156   + 
     
    +  157   + 
         /**
    +  158   + 
          * <p>
    +  159   + 
          * Gets the file path of the dependency.</p>
    +  160   + 
          * <p>
     161   - 
          */
    + 
          * <b>NOTE:</b> This may not be the actual path of the file on disk. The actual path of the file on disk can be
     162   - 
         public String getFilePath() {
    -  163  19 
             return this.filePath;
    + 
          * obtained via the getActualFilePath().</p>
    +  163   + 
          *
     164   - 
         }
    + 
          * @return the file path of the dependency.
     165   - 
     
    + 
          */
     166   - 
         /**
    -  167   - 
          * Sets the file name of the dependency.
    + 
         public String getFilePath() {
    +  167  56 
             return this.filePath;
     168   - 
          *
    + 
         }
     169   - 
          * @param fileExtension the file name of the dependency.
    + 
     
     170   - 
          */
    + 
         /**
     171   - 
         public void setFileExtension(String fileExtension) {
    -  172  2 
             this.fileExtension = fileExtension;
    -  173  2 
         }
    + 
          * Sets the file name of the dependency.
    +  172   + 
          *
    +  173   + 
          * @param fileExtension the file name of the dependency.
     174   - 
     
    + 
          */
     175   - 
         /**
    -  176   - 
          * Gets the file extension of the dependency.
    -  177   - 
          *
    + 
         public void setFileExtension(String fileExtension) {
    +  176  4 
             this.fileExtension = fileExtension;
    +  177  4 
         }
     178   - 
          * @return the file extension of the dependency.
    + 
     
     179   - 
          */
    + 
         /**
     180   - 
         public String getFileExtension() {
    -  181  107 
             return this.fileExtension;
    + 
          * Gets the file extension of the dependency.
    +  181   + 
          *
     182   - 
         }
    + 
          * @return the file extension of the dependency.
     183   - 
     
    + 
          */
     184   - 
         /**
    -  185   - 
          * Returns the MD5 Checksum of the dependency file.
    + 
         public String getFileExtension() {
    +  185  232 
             return this.fileExtension;
     186   - 
          *
    + 
         }
     187   - 
          * @return the MD5 Checksum
    + 
     
     188   - 
          */
    + 
         /**
     189   - 
         public String getMd5sum() {
    -  190  5 
             return this.md5sum;
    + 
          * Returns the MD5 Checksum of the dependency file.
    +  190   + 
          *
     191   - 
         }
    + 
          * @return the MD5 Checksum
     192   - 
     
    + 
          */
     193   - 
         /**
    -  194   - 
          * Sets the MD5 Checksum of the dependency.
    + 
         public String getMd5sum() {
    +  194  10 
             return this.md5sum;
     195   - 
          *
    + 
         }
     196   - 
          * @param md5sum the MD5 Checksum
    + 
     
     197   - 
          */
    + 
         /**
     198   - 
         public void setMd5sum(String md5sum) {
    -  199  37 
             this.md5sum = md5sum;
    -  200  37 
         }
    + 
          * Sets the MD5 Checksum of the dependency.
    +  199   + 
          *
    +  200   + 
          * @param md5sum the MD5 Checksum
     201   - 
     
    + 
          */
     202   - 
         /**
    -  203   - 
          * Returns the SHA1 Checksum of the dependency.
    -  204   - 
          *
    + 
         public void setMd5sum(String md5sum) {
    +  203  96 
             this.md5sum = md5sum;
    +  204  96 
         }
     205   - 
          * @return the SHA1 Checksum
    + 
     
     206   - 
          */
    + 
         /**
     207   - 
         public String getSha1sum() {
    -  208  8 
             return this.sha1sum;
    + 
          * Returns the SHA1 Checksum of the dependency.
    +  208   + 
          *
     209   - 
         }
    + 
          * @return the SHA1 Checksum
     210   - 
     
    + 
          */
     211   - 
         /**
    -  212   - 
          * Sets the SHA1 Checksum of the dependency.
    + 
         public String getSha1sum() {
    +  212  50 
             return this.sha1sum;
     213   - 
          *
    + 
         }
     214   - 
          * @param sha1sum the SHA1 Checksum
    + 
     
     215   - 
          */
    + 
         /**
     216   - 
         public void setSha1sum(String sha1sum) {
    -  217  39 
             this.sha1sum = sha1sum;
    -  218  39 
         }
    + 
          * Sets the SHA1 Checksum of the dependency.
    +  217   + 
          *
    +  218   + 
          * @param sha1sum the SHA1 Checksum
     219   - 
     
    + 
          */
     220   - 
         /**
    -  221   - 
          * Returns a List of Identifiers.
    -  222   - 
          *
    + 
         public void setSha1sum(String sha1sum) {
    +  221  100 
             this.sha1sum = sha1sum;
    +  222  100 
         }
     223   - 
          * @return an ArrayList of Identifiers.
    + 
     
     224   - 
          */
    + 
         /**
     225   - 
         public Set<Identifier> getIdentifiers() {
    -  226  132 
             return this.identifiers;
    + 
          * Returns a List of Identifiers.
    +  226   + 
          *
     227   - 
         }
    + 
          * @return an ArrayList of Identifiers.
     228   - 
     
    + 
          */
     229   - 
         /**
    -  230   - 
          * Sets a List of Identifiers.
    + 
         public Set<Identifier> getIdentifiers() {
    +  230  284 
             return this.identifiers;
     231   - 
          *
    + 
         }
     232   - 
          * @param identifiers A list of Identifiers.
    + 
     
     233   - 
          */
    + 
         /**
     234   - 
         public void setIdentifiers(Set<Identifier> identifiers) {
    -  235  1 
             this.identifiers = identifiers;
    -  236  1 
         }
    + 
          * Sets a List of Identifiers.
    +  235   + 
          *
    +  236   + 
          * @param identifiers A list of Identifiers.
     237   - 
     
    + 
          */
     238   - 
         /**
    -  239   - 
          * Adds an entry to the list of detected Identifiers for the dependency
    -  240   - 
          * file.
    + 
         public void setIdentifiers(Set<Identifier> identifiers) {
    +  239  2 
             this.identifiers = identifiers;
    +  240  2 
         }
     241   - 
          *
    + 
     
     242   - 
          * @param type the type of identifier (such as CPE)
    + 
         /**
     243   - 
          * @param value the value of the identifier
    + 
          * Adds an entry to the list of detected Identifiers for the dependency file.
     244   - 
          * @param url the URL of the identifier
    + 
          *
     245   - 
          */
    + 
          * @param type the type of identifier (such as CPE)
     246   + 
          * @param value the value of the identifier
    +  247   + 
          * @param url the URL of the identifier
    +  248   + 
          */
    +  249   
         public void addIdentifier(String type, String value, String url) {
    -  247  5 
             final Identifier i = new Identifier(type, value, url);
    -  248  5 
             this.identifiers.add(i);
    -  249  5 
         }
    -  250   - 
     
    -  251   - 
         /**
    -  252   - 
          * Adds an entry to the list of detected Identifiers for the dependency
    +  250  12 
             final Identifier i = new Identifier(type, value, url);
    +  251  12 
             this.identifiers.add(i);
    +  252  12 
         }
     253   - 
          * file.
    + 
     
     254   - 
          *
    + 
         /**
     255   - 
          * @param identifier the identifier to add
    + 
          * Adds an entry to the list of detected Identifiers for the dependency file.
     256   - 
          */
    + 
          *
     257   - 
         public void addIdentifier(Identifier identifier) {
    -  258  88 
             this.identifiers.add(identifier);
    -  259  88 
         }
    + 
          * @param type the type of identifier (such as CPE)
    +  258   + 
          * @param value the value of the identifier
    +  259   + 
          * @param url the URL of the identifier
     260   - 
     
    + 
          * @param confidence the confidence in the Identifier being accurate
     261   - 
         /**
    + 
          */
     262   - 
          * Returns the evidence used to identify this dependency.
    -  263   - 
          *
    -  264   - 
          * @return an EvidenceCollection.
    -  265   - 
          */
    -  266   - 
         public EvidenceCollection getEvidence() {
    -  267  1 
             return EvidenceCollection.merge(this.productEvidence, this.vendorEvidence, this.versionEvidence);
    + 
         public void addIdentifier(String type, String value, String url, Confidence confidence) {
    +  263  10 
             final Identifier i = new Identifier(type, value, url);
    +  264  10 
             i.setConfidence(confidence);
    +  265  10 
             this.identifiers.add(i);
    +  266  10 
         }
    +  267   + 
     
     268   - 
         }
    + 
         /**
     269   - 
     
    + 
          * Adds an entry to the list of detected Identifiers for the dependency file.
     270   - 
         /**
    + 
          *
     271   - 
          * Returns the evidence used to identify this dependency.
    + 
          * @param identifier the identifier to add
     272   - 
          *
    + 
          */
     273   - 
          * @return an EvidenceCollection.
    -  274   - 
          */
    -  275   - 
         public EvidenceCollection getEvidenceUsed() {
    -  276  4 
             return EvidenceCollection.mergeUsed(this.productEvidence, this.vendorEvidence, this.versionEvidence);
    + 
         public void addIdentifier(Identifier identifier) {
    +  274  216 
             this.identifiers.add(identifier);
    +  275  216 
         }
    +  276   + 
     
     277   - 
         }
    + 
         /**
     278   - 
     
    + 
          * Returns the evidence used to identify this dependency.
     279   - 
         /**
    + 
          *
     280   - 
          * Gets the Vendor Evidence.
    + 
          * @return an EvidenceCollection.
     281   - 
          *
    + 
          */
     282   - 
          * @return an EvidenceCollection.
    -  283   - 
          */
    + 
         public EvidenceCollection getEvidence() {
    +  283  2 
             return EvidenceCollection.merge(this.productEvidence, this.vendorEvidence, this.versionEvidence);
     284   - 
         public EvidenceCollection getVendorEvidence() {
    -  285  451 
             return this.vendorEvidence;
    + 
         }
    +  285   + 
     
     286   - 
         }
    + 
         /**
     287   - 
     
    + 
          * Returns the evidence used to identify this dependency.
     288   - 
         /**
    + 
          *
     289   - 
          * Gets the Product Evidence.
    + 
          * @return an EvidenceCollection.
     290   - 
          *
    + 
          */
     291   - 
          * @return an EvidenceCollection.
    -  292   - 
          */
    + 
         public EvidenceCollection getEvidenceUsed() {
    +  292  8 
             return EvidenceCollection.mergeUsed(this.productEvidence, this.vendorEvidence, this.versionEvidence);
     293   - 
         public EvidenceCollection getProductEvidence() {
    -  294  1087 
             return this.productEvidence;
    + 
         }
    +  294   + 
     
     295   - 
         }
    + 
         /**
     296   - 
     
    + 
          * Gets the Vendor Evidence.
     297   - 
         /**
    + 
          *
     298   - 
          * Gets the Version Evidence.
    -  299   - 
          *
    -  300   
          * @return an EvidenceCollection.
    -  301   +  299   
          */
    +  300   + 
         public EvidenceCollection getVendorEvidence() {
    +  301  912 
             return this.vendorEvidence;
     302   - 
         public EvidenceCollection getVersionEvidence() {
    -  303  460 
             return this.versionEvidence;
    + 
         }
    +  303   + 
     
     304   - 
         }
    + 
         /**
     305   - 
         /**
    + 
          * Gets the Product Evidence.
     306   - 
          * A list of exceptions that occurred during analysis of this dependency.
    + 
          *
     307   + 
          * @return an EvidenceCollection.
    +  308   
          */
    -  308  54 
         private List<Exception> analysisExceptions = new ArrayList<Exception>();
     309   - 
     
    -  310   - 
         /**
    + 
         public EvidenceCollection getProductEvidence() {
    +  310  2184 
             return this.productEvidence;
     311   - 
          * Get the value of analysisExceptions.
    -  312   - 
          *
    -  313   - 
          * @return the value of analysisExceptions
    -  314   - 
          */
    -  315   - 
         public List<Exception> getAnalysisExceptions() {
    -  316  3 
             return analysisExceptions;
    -  317   
         }
    -  318   +  312   
     
    -  319   +  313   
         /**
    -  320   - 
          * Set the value of analysisExceptions.
    -  321   +  314   + 
          * Gets the Version Evidence.
    +  315   
          *
    +  316   + 
          * @return an EvidenceCollection.
    +  317   + 
          */
    +  318   + 
         public EvidenceCollection getVersionEvidence() {
    +  319  930 
             return this.versionEvidence;
    +  320   + 
         }
    +  321   + 
         /**
     322   - 
          * @param analysisExceptions new value of analysisExceptions
    + 
          * A list of exceptions that occurred during analysis of this dependency.
     323   
          */
    -  324   - 
         public void setAnalysisExceptions(List<Exception> analysisExceptions) {
    -  325  0 
             this.analysisExceptions = analysisExceptions;
    -  326  0 
         }
    +  324  132 
         private List<Exception> analysisExceptions = new ArrayList<Exception>();
    +  325   + 
     
    +  326   + 
         /**
     327   - 
     
    + 
          * Get the value of analysisExceptions.
     328   - 
         /**
    + 
          *
     329   - 
          * Adds an exception to the analysis exceptions collection.
    + 
          * @return the value of analysisExceptions
     330   - 
          *
    + 
          */
     331   - 
          * @param ex an exception.
    -  332   - 
          */
    + 
         public List<Exception> getAnalysisExceptions() {
    +  332  0 
             return analysisExceptions;
     333   - 
         public void addAnalysisException(Exception ex) {
    -  334  0 
             this.analysisExceptions.add(ex);
    -  335  0 
         }
    -  336   - 
         /**
    -  337   - 
          * The description of the JAR file.
    -  338   - 
          */
    -  339   - 
         private String description;
    -  340   - 
     
    -  341   - 
         /**
    -  342   - 
          * Get the value of description.
    -  343   - 
          *
    -  344   - 
          * @return the value of description
    -  345   - 
          */
    -  346   - 
         public String getDescription() {
    -  347  15 
             return description;
    -  348   
         }
    -  349   +  334   
     
    -  350   +  335   
         /**
    -  351   - 
          * Set the value of description.
    -  352   +  336   + 
          * Set the value of analysisExceptions.
    +  337   
          *
    +  338   + 
          * @param analysisExceptions new value of analysisExceptions
    +  339   + 
          */
    +  340   + 
         public void setAnalysisExceptions(List<Exception> analysisExceptions) {
    +  341  0 
             this.analysisExceptions = analysisExceptions;
    +  342  0 
         }
    +  343   + 
     
    +  344   + 
         /**
    +  345   + 
          * Adds an exception to the analysis exceptions collection.
    +  346   + 
          *
    +  347   + 
          * @param ex an exception.
    +  348   + 
          */
    +  349   + 
         public void addAnalysisException(Exception ex) {
    +  350  0 
             this.analysisExceptions.add(ex);
    +  351  0 
         }
    +  352   + 
         /**
     353   - 
          * @param description new value of description
    + 
          * The description of the JAR file.
     354   
          */
     355   - 
         public void setDescription(String description) {
    -  356  19 
             this.description = description;
    -  357  19 
         }
    + 
         private String description;
    +  356   + 
     
    +  357   + 
         /**
     358   - 
         /**
    + 
          * Get the value of description.
     359   - 
          * The license that this dependency uses.
    + 
          *
     360   - 
          */
    + 
          * @return the value of description
     361   - 
         private String license;
    -  362   - 
     
    -  363   - 
         /**
    -  364   - 
          * Get the value of license.
    -  365   - 
          *
    -  366   - 
          * @return the value of license
    -  367   
          */
    -  368   - 
         public String getLicense() {
    -  369  11 
             return license;
    -  370   +  362   + 
         public String getDescription() {
    +  363  30 
             return description;
    +  364   
         }
    -  371   +  365   
     
    -  372   +  366   
         /**
    -  373   - 
          * Set the value of license.
    -  374   +  367   + 
          * Set the value of description.
    +  368   
          *
    +  369   + 
          * @param description new value of description
    +  370   + 
          */
    +  371   + 
         public void setDescription(String description) {
    +  372  38 
             this.description = description;
    +  373  38 
         }
    +  374   + 
         /**
     375   - 
          * @param license new value of license
    + 
          * The license that this dependency uses.
     376   
          */
     377   - 
         public void setLicense(String license) {
    -  378  7 
             this.license = license;
    -  379  7 
         }
    + 
         private String license;
    +  378   + 
     
    +  379   + 
         /**
     380   - 
         /**
    + 
          * Get the value of license.
     381   - 
          * A list of vulnerabilities for this dependency.
    + 
          *
     382   - 
          */
    + 
          * @return the value of license
     383   - 
         private SortedSet<Vulnerability> vulnerabilities;
    -  384   - 
     
    -  385   - 
         /**
    -  386   - 
          * Get the list of vulnerabilities.
    -  387   - 
          *
    -  388   - 
          * @return the list of vulnerabilities
    -  389   
          */
    -  390   - 
         public SortedSet<Vulnerability> getVulnerabilities() {
    -  391  28 
             return vulnerabilities;
    -  392   +  384   + 
         public String getLicense() {
    +  385  22 
             return license;
    +  386   
         }
    -  393   +  387   
     
    -  394   +  388   
         /**
    -  395   - 
          * Set the value of vulnerabilities.
    -  396   +  389   + 
          * Set the value of license.
    +  390   
          *
    +  391   + 
          * @param license new value of license
    +  392   + 
          */
    +  393   + 
         public void setLicense(String license) {
    +  394  14 
             this.license = license;
    +  395  14 
         }
    +  396   + 
         /**
     397   - 
          * @param vulnerabilities new value of vulnerabilities
    + 
          * A list of vulnerabilities for this dependency.
     398   
          */
     399   - 
         public void setVulnerabilities(SortedSet<Vulnerability> vulnerabilities) {
    -  400  0 
             this.vulnerabilities = vulnerabilities;
    -  401  0 
         }
    + 
         private SortedSet<Vulnerability> vulnerabilities;
    +  400   + 
     
    +  401   + 
         /**
     402   - 
     
    + 
          * Get the list of vulnerabilities.
     403   - 
         /**
    + 
          *
     404   - 
          * Determines the sha1 and md5 sum for the given file.
    + 
          * @return the list of vulnerabilities
     405   - 
          *
    + 
          */
     406   - 
          * @param file the file to create checksums for
    -  407   - 
          */
    + 
         public SortedSet<Vulnerability> getVulnerabilities() {
    +  407  56 
             return vulnerabilities;
     408   - 
         private void determineHashes(File file) {
    -  409  36 
             String md5 = null;
    -  410  36 
             String sha1 = null;
    -  411   - 
             try {
    -  412  36 
                 md5 = Checksum.getMD5Checksum(file);
    -  413  36 
                 sha1 = Checksum.getSHA1Checksum(file);
    -  414  0 
             } catch (IOException ex) {
    -  415  0 
                 final String msg = String.format("Unable to read '%s' to determine hashes.", file.getName());
    -  416  0 
                 Logger.getLogger(Dependency.class.getName()).log(Level.WARNING, msg);
    -  417  0 
                 Logger.getLogger(Dependency.class.getName()).log(Level.FINE, null, ex);
    -  418  0 
             } catch (NoSuchAlgorithmException ex) {
    -  419  0 
                 final String msg = "Unable to use MD5 of SHA1 checksums.";
    -  420  0 
                 Logger.getLogger(Dependency.class.getName()).log(Level.WARNING, msg);
    -  421  0 
                 Logger.getLogger(Dependency.class.getName()).log(Level.FINE, null, ex);
    -  422  36 
             }
    -  423  36 
             this.setMd5sum(md5);
    -  424  36 
             this.setSha1sum(sha1);
    -  425  36 
         }
    -  426   - 
     
    -  427   - 
         /**
    -  428   - 
          * Adds a vulnerability to the dependency.
    -  429   - 
          *
    -  430   - 
          * @param vulnerability a vulnerability outlining a vulnerability.
    -  431   - 
          */
    -  432   - 
         public void addVulnerability(Vulnerability vulnerability) {
    -  433  3 
             this.vulnerabilities.add(vulnerability);
    -  434  3 
         }
    -  435   - 
         /**
    -  436   - 
          * A collection of related dependencies.
    -  437   - 
          */
    -  438  54 
         private Set<Dependency> relatedDependencies = new TreeSet<Dependency>();
    -  439   - 
     
    -  440   - 
         /**
    -  441   - 
          * Get the value of relatedDependencies.
    -  442   - 
          *
    -  443   - 
          * @return the value of relatedDependencies
    -  444   - 
          */
    -  445   - 
         public Set<Dependency> getRelatedDependencies() {
    -  446  3 
             return relatedDependencies;
    -  447   
         }
    -  448   +  409   
     
    -  449   +  410   
         /**
    -  450   - 
          * Set the value of relatedDependencies.
    -  451   +  411   + 
          * Set the value of vulnerabilities.
    +  412   
          *
    +  413   + 
          * @param vulnerabilities new value of vulnerabilities
    +  414   + 
          */
    +  415   + 
         public void setVulnerabilities(SortedSet<Vulnerability> vulnerabilities) {
    +  416  0 
             this.vulnerabilities = vulnerabilities;
    +  417  0 
         }
    +  418   + 
     
    +  419   + 
         /**
    +  420   + 
          * Determines the sha1 and md5 sum for the given file.
    +  421   + 
          *
    +  422   + 
          * @param file the file to create checksums for
    +  423   + 
          */
    +  424   + 
         private void determineHashes(File file) {
    +  425  94 
             String md5 = null;
    +  426  94 
             String sha1 = null;
    +  427   + 
             try {
    +  428  94 
                 md5 = Checksum.getMD5Checksum(file);
    +  429  90 
                 sha1 = Checksum.getSHA1Checksum(file);
    +  430  4 
             } catch (IOException ex) {
    +  431  4 
                 final String msg = String.format("Unable to read '%s' to determine hashes.", file.getName());
    +  432  4 
                 Logger.getLogger(Dependency.class.getName()).log(Level.WARNING, msg);
    +  433  4 
                 Logger.getLogger(Dependency.class.getName()).log(Level.FINE, null, ex);
    +  434  0 
             } catch (NoSuchAlgorithmException ex) {
    +  435  0 
                 final String msg = "Unable to use MD5 of SHA1 checksums.";
    +  436  0 
                 Logger.getLogger(Dependency.class.getName()).log(Level.WARNING, msg);
    +  437  0 
                 Logger.getLogger(Dependency.class.getName()).log(Level.FINE, null, ex);
    +  438  94 
             }
    +  439  94 
             this.setMd5sum(md5);
    +  440  94 
             this.setSha1sum(sha1);
    +  441  94 
         }
    +  442   + 
     
    +  443   + 
         /**
    +  444   + 
          * Adds a vulnerability to the dependency.
    +  445   + 
          *
    +  446   + 
          * @param vulnerability a vulnerability outlining a vulnerability.
    +  447   + 
          */
    +  448   + 
         public void addVulnerability(Vulnerability vulnerability) {
    +  449  6 
             this.vulnerabilities.add(vulnerability);
    +  450  6 
         }
    +  451   + 
         /**
     452   - 
          * @param relatedDependencies new value of relatedDependencies
    + 
          * A collection of related dependencies.
     453   
          */
    -  454   - 
         public void setRelatedDependencies(Set<Dependency> relatedDependencies) {
    -  455  0 
             this.relatedDependencies = relatedDependencies;
    -  456  0 
         }
    +  454  132 
         private Set<Dependency> relatedDependencies = new TreeSet<Dependency>();
    +  455   + 
     
    +  456   + 
         /**
     457   - 
     
    + 
          * Get the value of relatedDependencies.
     458   - 
         /**
    + 
          *
     459   - 
          * Adds a related dependency.
    + 
          * @return the value of relatedDependencies
     460   - 
          *
    + 
          */
     461   - 
          * @param dependency a reference to the related dependency
    -  462   - 
          */
    + 
         public Set<Dependency> getRelatedDependencies() {
    +  462  8 
             return relatedDependencies;
     463   - 
         public void addRelatedDependency(Dependency dependency) {
    -  464  0 
             relatedDependencies.add(dependency);
    -  465  0 
         }
    -  466   - 
     
    -  467   - 
         /**
    -  468   - 
          * Implementation of the Comparable<Dependency> interface. The comparison is
    -  469   - 
          * solely based on the file name.
    -  470   - 
          *
    -  471   - 
          * @param o a dependency to compare
    -  472   - 
          * @return an integer representing the natural ordering
    -  473   - 
          */
    -  474   - 
         public int compareTo(Dependency o) {
    -  475  23 
             return this.getFileName().compareToIgnoreCase(o.getFileName());
    -  476   
         }
    -  477   +  464   
     
    -  478   +  465   
         /**
    -  479   - 
          * Implementation of the equals method.
    -  480   +  466   + 
          * Set the value of relatedDependencies.
    +  467   
          *
    -  481   - 
          * @param obj the object to compare
    -  482   - 
          * @return true if the objects are equal, otherwise false
    -  483   +  468   + 
          * @param relatedDependencies new value of relatedDependencies
    +  469   
          */
    +  470   + 
         public void setRelatedDependencies(Set<Dependency> relatedDependencies) {
    +  471  0 
             this.relatedDependencies = relatedDependencies;
    +  472  0 
         }
    +  473   + 
     
    +  474   + 
         /**
    +  475   + 
          * Adds a related dependency.
    +  476   + 
          *
    +  477   + 
          * @param dependency a reference to the related dependency
    +  478   + 
          */
    +  479   + 
         public void addRelatedDependency(Dependency dependency) {
    +  480  0 
             relatedDependencies.add(dependency);
    +  481  0 
         }
    +  482   + 
     
    +  483   + 
         /**
     484   - 
         @Override
    + 
          * Implementation of the Comparable<Dependency> interface. The comparison is solely based on the file name.
     485   - 
         public boolean equals(Object obj) {
    -  486  0 
             if (obj == null) {
    -  487  0 
                 return false;
    + 
          *
    +  486   + 
          * @param o a dependency to compare
    +  487   + 
          * @return an integer representing the natural ordering
     488   - 
             }
    -  489  0 
             if (getClass() != obj.getClass()) {
    -  490  0 
                 return false;
    + 
          */
    +  489   + 
         public int compareTo(Dependency o) {
    +  490  58 
             return this.getFileName().compareToIgnoreCase(o.getFileName());
     491   - 
             }
    -  492  0 
             final Dependency other = (Dependency) obj;
    -  493  0 
             if ((this.actualFilePath == null) ? (other.actualFilePath != null) : !this.actualFilePath.equals(other.actualFilePath)) {
    -  494  0 
                 return false;
    + 
         }
    +  492   + 
     
    +  493   + 
         /**
    +  494   + 
          * Implementation of the equals method.
     495   - 
             }
    -  496  0 
             if ((this.filePath == null) ? (other.filePath != null) : !this.filePath.equals(other.filePath)) {
    -  497  0 
                 return false;
    + 
          *
    +  496   + 
          * @param obj the object to compare
    +  497   + 
          * @return true if the objects are equal, otherwise false
     498   + 
          */
    +  499   + 
         @Override
    +  500   + 
         public boolean equals(Object obj) {
    +  501  0 
             if (obj == null) {
    +  502  0 
                 return false;
    +  503   
             }
    -  499  0 
             if ((this.fileName == null) ? (other.fileName != null) : !this.fileName.equals(other.fileName)) {
    -  500  0 
                 return false;
    -  501   +  504  0 
             if (getClass() != obj.getClass()) {
    +  505  0 
                 return false;
    +  506   
             }
    -  502  0 
             if ((this.fileExtension == null) ? (other.fileExtension != null) : !this.fileExtension.equals(other.fileExtension)) {
    -  503  0 
                 return false;
    -  504   - 
             }
    -  505  0 
             if ((this.md5sum == null) ? (other.md5sum != null) : !this.md5sum.equals(other.md5sum)) {
    -  506  0 
                 return false;
    -  507   - 
             }
    -  508  0 
             if ((this.sha1sum == null) ? (other.sha1sum != null) : !this.sha1sum.equals(other.sha1sum)) {
    +  507  0 
             final Dependency other = (Dependency) obj;
    +  508  0 
             if ((this.actualFilePath == null) ? (other.actualFilePath != null) : !this.actualFilePath.equals(other.actualFilePath)) {
     509  0 
                 return false;
     510   
             }
    -  511  0 
             if (this.identifiers != other.identifiers && (this.identifiers == null || !this.identifiers.equals(other.identifiers))) {
    +  511  0 
             if ((this.filePath == null) ? (other.filePath != null) : !this.filePath.equals(other.filePath)) {
     512  0 
                 return false;
     513   
             }
    -  514  0 
             if (this.vendorEvidence != other.vendorEvidence && (this.vendorEvidence == null || !this.vendorEvidence.equals(other.vendorEvidence))) {
    +  514  0 
             if ((this.fileName == null) ? (other.fileName != null) : !this.fileName.equals(other.fileName)) {
     515  0 
                 return false;
     516   
             }
    -  517  0 
             if (this.productEvidence != other.productEvidence && (this.productEvidence == null || !this.productEvidence.equals(other.productEvidence))) {
    +  517  0 
             if ((this.fileExtension == null) ? (other.fileExtension != null) : !this.fileExtension.equals(other.fileExtension)) {
     518  0 
                 return false;
     519   
             }
    -  520  0 
             if (this.versionEvidence != other.versionEvidence && (this.versionEvidence == null || !this.versionEvidence.equals(other.versionEvidence))) {
    +  520  0 
             if ((this.md5sum == null) ? (other.md5sum != null) : !this.md5sum.equals(other.md5sum)) {
     521  0 
                 return false;
     522   
             }
    -  523  0 
             if (this.analysisExceptions != other.analysisExceptions
    -  524   - 
                     && (this.analysisExceptions == null || !this.analysisExceptions.equals(other.analysisExceptions))) {
    -  525  0 
                 return false;
    -  526   +  523  0 
             if ((this.sha1sum == null) ? (other.sha1sum != null) : !this.sha1sum.equals(other.sha1sum)) {
    +  524  0 
                 return false;
    +  525   
             }
    -  527  0 
             if ((this.description == null) ? (other.description != null) : !this.description.equals(other.description)) {
    -  528  0 
                 return false;
    -  529   +  526  0 
             if (this.identifiers != other.identifiers && (this.identifiers == null || !this.identifiers.equals(other.identifiers))) {
    +  527  0 
                 return false;
    +  528   
             }
    -  530  0 
             if ((this.license == null) ? (other.license != null) : !this.license.equals(other.license)) {
    -  531  0 
                 return false;
    -  532   +  529  0 
             if (this.vendorEvidence != other.vendorEvidence && (this.vendorEvidence == null || !this.vendorEvidence.equals(other.vendorEvidence))) {
    +  530  0 
                 return false;
    +  531   
             }
    -  533  0 
             if (this.vulnerabilities != other.vulnerabilities && (this.vulnerabilities == null || !this.vulnerabilities.equals(other.vulnerabilities))) {
    -  534  0 
                 return false;
    -  535   +  532  0 
             if (this.productEvidence != other.productEvidence && (this.productEvidence == null || !this.productEvidence.equals(other.productEvidence))) {
    +  533  0 
                 return false;
    +  534   
             }
    -  536  0 
             if (this.relatedDependencies != other.relatedDependencies
    +  535  0 
             if (this.versionEvidence != other.versionEvidence && (this.versionEvidence == null || !this.versionEvidence.equals(other.versionEvidence))) {
    +  536  0 
                 return false;
     537   - 
                     && (this.relatedDependencies == null || !this.relatedDependencies.equals(other.relatedDependencies))) {
    -  538  0 
                 return false;
    -  539   
             }
    -  540  0 
             return true;
    +  538  0 
             if (this.analysisExceptions != other.analysisExceptions
    +  539   + 
                     && (this.analysisExceptions == null || !this.analysisExceptions.equals(other.analysisExceptions))) {
    +  540  0 
                 return false;
     541   - 
         }
    -  542   - 
     
    -  543   - 
         /**
    + 
             }
    +  542  0 
             if ((this.description == null) ? (other.description != null) : !this.description.equals(other.description)) {
    +  543  0 
                 return false;
     544   - 
          * Generates the HashCode.
    -  545   - 
          *
    -  546   - 
          * @return the HashCode
    + 
             }
    +  545  0 
             if ((this.license == null) ? (other.license != null) : !this.license.equals(other.license)) {
    +  546  0 
                 return false;
     547   - 
          */
    -  548   - 
         @Override
    -  549   - 
         public int hashCode() {
    -  550  117 
             int hash = 3;
    -  551  117 
             hash = 47 * hash + (this.actualFilePath != null ? this.actualFilePath.hashCode() : 0);
    -  552  117 
             hash = 47 * hash + (this.filePath != null ? this.filePath.hashCode() : 0);
    -  553  117 
             hash = 47 * hash + (this.fileName != null ? this.fileName.hashCode() : 0);
    -  554  117 
             hash = 47 * hash + (this.fileExtension != null ? this.fileExtension.hashCode() : 0);
    -  555  117 
             hash = 47 * hash + (this.md5sum != null ? this.md5sum.hashCode() : 0);
    -  556  117 
             hash = 47 * hash + (this.sha1sum != null ? this.sha1sum.hashCode() : 0);
    -  557  117 
             hash = 47 * hash + (this.identifiers != null ? this.identifiers.hashCode() : 0);
    -  558  117 
             hash = 47 * hash + (this.vendorEvidence != null ? this.vendorEvidence.hashCode() : 0);
    -  559  117 
             hash = 47 * hash + (this.productEvidence != null ? this.productEvidence.hashCode() : 0);
    -  560  117 
             hash = 47 * hash + (this.versionEvidence != null ? this.versionEvidence.hashCode() : 0);
    -  561  117 
             hash = 47 * hash + (this.analysisExceptions != null ? this.analysisExceptions.hashCode() : 0);
    -  562  117 
             hash = 47 * hash + (this.description != null ? this.description.hashCode() : 0);
    -  563  117 
             hash = 47 * hash + (this.license != null ? this.license.hashCode() : 0);
    -  564  117 
             hash = 47 * hash + (this.vulnerabilities != null ? this.vulnerabilities.hashCode() : 0);
    -  565  117 
             hash = 47 * hash + (this.relatedDependencies != null ? this.relatedDependencies.hashCode() : 0);
    -  566  117 
             return hash;
    -  567   + 
             }
    +  548  0 
             if (this.vulnerabilities != other.vulnerabilities && (this.vulnerabilities == null || !this.vulnerabilities.equals(other.vulnerabilities))) {
    +  549  0 
                 return false;
    +  550   + 
             }
    +  551  0 
             if (this.relatedDependencies != other.relatedDependencies
    +  552   + 
                     && (this.relatedDependencies == null || !this.relatedDependencies.equals(other.relatedDependencies))) {
    +  553  0 
                 return false;
    +  554   + 
             }
    +  555  0 
             return true;
    +  556   
         }
    -  568   +  557   
     
    -  569   +  558   
         /**
    -  570   - 
          * Standard toString() implementation showing the filename, actualFilePath,
    -  571   - 
          * and filePath.
    -  572   +  559   + 
          * Generates the HashCode.
    +  560   
          *
    -  573   - 
          * @return the string representation of the file
    -  574   +  561   + 
          * @return the HashCode
    +  562   
          */
    -  575   +  563   
         @Override
    -  576   - 
         public String toString() {
    -  577  0 
             return "Dependency{ fileName='" + fileName + "', actualFilePath='" + actualFilePath + "', filePath='" + filePath + "'}";
    -  578   +  564   + 
         public int hashCode() {
    +  565  252 
             int hash = 3;
    +  566  252 
             hash = 47 * hash + (this.actualFilePath != null ? this.actualFilePath.hashCode() : 0);
    +  567  252 
             hash = 47 * hash + (this.filePath != null ? this.filePath.hashCode() : 0);
    +  568  252 
             hash = 47 * hash + (this.fileName != null ? this.fileName.hashCode() : 0);
    +  569  252 
             hash = 47 * hash + (this.fileExtension != null ? this.fileExtension.hashCode() : 0);
    +  570  252 
             hash = 47 * hash + (this.md5sum != null ? this.md5sum.hashCode() : 0);
    +  571  252 
             hash = 47 * hash + (this.sha1sum != null ? this.sha1sum.hashCode() : 0);
    +  572  252 
             hash = 47 * hash + (this.identifiers != null ? this.identifiers.hashCode() : 0);
    +  573  252 
             hash = 47 * hash + (this.vendorEvidence != null ? this.vendorEvidence.hashCode() : 0);
    +  574  252 
             hash = 47 * hash + (this.productEvidence != null ? this.productEvidence.hashCode() : 0);
    +  575  252 
             hash = 47 * hash + (this.versionEvidence != null ? this.versionEvidence.hashCode() : 0);
    +  576  252 
             hash = 47 * hash + (this.analysisExceptions != null ? this.analysisExceptions.hashCode() : 0);
    +  577  252 
             hash = 47 * hash + (this.description != null ? this.description.hashCode() : 0);
    +  578  252 
             hash = 47 * hash + (this.license != null ? this.license.hashCode() : 0);
    +  579  252 
             hash = 47 * hash + (this.vulnerabilities != null ? this.vulnerabilities.hashCode() : 0);
    +  580  252 
             hash = 47 * hash + (this.relatedDependencies != null ? this.relatedDependencies.hashCode() : 0);
    +  581  252 
             return hash;
    +  582   
         }
    -  579   +  583   + 
     
    +  584   + 
         /**
    +  585   + 
          * Standard toString() implementation showing the filename, actualFilePath, and filePath.
    +  586   + 
          *
    +  587   + 
          * @return the string representation of the file
    +  588   + 
          */
    +  589   + 
         @Override
    +  590   + 
         public String toString() {
    +  591  0 
             return "Dependency{ fileName='" + fileName + "', actualFilePath='" + actualFilePath + "', filePath='" + filePath + "'}";
    +  592   + 
         }
    +  593   
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.Evidence.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.Evidence.html index 1a559e74b..fe93d7eb5 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.Evidence.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.Evidence.html @@ -13,7 +13,6 @@ -
    Classes in this File Line Coverage Branch Coverage Complexity
    Evidence
    48%
    24/49
    25%
    10/40
    		2.294
    Evidence$Confidence
    100%
    5/5
    N/A
    N/A
    		2.294
     
    @@ -25,483 +24,434 @@  3   
      *
     4   - 
      * Dependency-check-core is free software: you can redistribute it and/or modify it
    + 
      * Licensed under the Apache License, Version 2.0 (the "License");
     5   - 
      * under the terms of the GNU General Public License as published by the Free
    + 
      * you may not use this file except in compliance with the License.
     6   - 
      * Software Foundation, either version 3 of the License, or (at your option) any
    + 
      * You may obtain a copy of the License at
     7   - 
      * later version.
    + 
      *
     8   - 
      *
    + 
      *     http://www.apache.org/licenses/LICENSE-2.0
     9   - 
      * Dependency-check-core is distributed in the hope that it will be useful, but
    + 
      *
     10   - 
      * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
    + 
      * Unless required by applicable law or agreed to in writing, software
     11   - 
      * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
    + 
      * distributed under the License is distributed on an "AS IS" BASIS,
     12   - 
      * details.
    + 
      * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13   - 
      *
    + 
      * See the License for the specific language governing permissions and
     14   - 
      * You should have received a copy of the GNU General Public License along with
    + 
      * limitations under the License.
     15   - 
      * dependency-check-core. If not, see http://www.gnu.org/licenses/.
    + 
      *
     16   - 
      *
    -  17   
      * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
    +  17   + 
      */
     18   - 
      */
    -  19   
     package org.owasp.dependencycheck.dependency;
    +  19   + 
     
     20   - 
     
    -  21   
     /**
    -  22   +  21   
      * Evidence is a piece of information about a Dependency.
    -  23   +  22   
      *
    -  24   +  23   
      * @author Jeremy Long <jeremy.long@owasp.org>
    -  25   +  24   
      */
    -  26  121449 
     public class Evidence implements Comparable<Evidence> {
    -  27   +  25  243066 
     public class Evidence implements Comparable<Evidence> {
    +  26   
     
    -  28   +  27   
         /**
    +  28   + 
          * Creates a new Evidence object.
     29   - 
          * The confidence that the evidence is "high" quality.
    -  30   
          */
    -  31  76 
         public enum Confidence {
    +  30  0 
         public Evidence() {
    +  31  0 
         }
     32   
     
     33   - 
             /**
    + 
         /**
     34   - 
              * High confidence evidence.
    -  35   - 
              */
    -  36  1 
             HIGHEST,
    -  37   - 
             /**
    -  38   - 
              * High confidence evidence.
    -  39   - 
              */
    -  40  1 
             HIGH,
    -  41   - 
             /**
    -  42   - 
              * Medium confidence evidence.
    -  43   - 
              */
    -  44  1 
             MEDIUM,
    -  45   - 
             /**
    -  46   - 
              * Low confidence evidence.
    -  47   - 
              */
    -  48  1 
             LOW
    -  49   - 
         }
    -  50   - 
     
    -  51   - 
         /**
    -  52   - 
          * Creates a new Evidence object.
    -  53   - 
          */
    -  54  0 
         public Evidence() {
    -  55  0 
         }
    -  56   - 
     
    -  57   - 
         /**
    -  58   
          * Creates a new Evidence objects.
    -  59   +  35   
          *
    -  60   +  36   
          * @param source the source of the evidence.
    -  61   +  37   
          * @param name the name of the evidence.
    -  62   +  38   
          * @param value the value of the evidence.
    -  63   +  39   
          * @param confidence the confidence of the evidence.
    -  64   +  40   
          */
    -  65  70882 
         public Evidence(String source, String name, String value, Confidence confidence) {
    -  66  70882 
             this.source = source;
    -  67  70882 
             this.name = name;
    -  68  70882 
             this.value = value;
    -  69  70882 
             this.confidence = confidence;
    -  70  70882 
         }
    -  71   +  41  141794 
         public Evidence(String source, String name, String value, Confidence confidence) {
    +  42  141794 
             this.source = source;
    +  43  141794 
             this.name = name;
    +  44  141794 
             this.value = value;
    +  45  141794 
             this.confidence = confidence;
    +  46  141794 
         }
    +  47   
         /**
    -  72   +  48   
          * The name of the evidence.
    -  73   +  49   
          */
    -  74   +  50   
         private String name;
    -  75   +  51   
     
    -  76   +  52   
         /**
    -  77   +  53   
          * Get the value of name.
    -  78   +  54   
          *
    -  79   +  55   
          * @return the value of name
    -  80   +  56   
          */
    -  81   +  57   
         public String getName() {
    -  82  52 
             return name;
    -  83   +  58  122 
             return name;
    +  59   
         }
    -  84   +  60   
     
    -  85   +  61   
         /**
    -  86   +  62   
          * Set the value of name.
    -  87   +  63   
          *
    -  88   +  64   
          * @param name new value of name
    -  89   +  65   
          */
    -  90   +  66   
         public void setName(String name) {
    -  91  0 
             this.name = name;
    -  92  0 
         }
    -  93   +  67  0 
             this.name = name;
    +  68  0 
         }
    +  69   
         /**
    -  94   +  70   
          * The source of the evidence.
    -  95   +  71   
          */
    -  96   +  72   
         private String source;
    -  97   +  73   
     
    -  98   +  74   
         /**
    -  99   +  75   
          * Get the value of source.
    -  100   +  76   
          *
    -  101   +  77   
          * @return the value of source
    -  102   +  78   
          */
    -  103   +  79   
         public String getSource() {
    -  104  41 
             return source;
    -  105   +  80  100 
             return source;
    +  81   
         }
    -  106   +  82   
     
    -  107   +  83   
         /**
    -  108   +  84   
          * Set the value of source.
    -  109   +  85   
          *
    -  110   +  86   
          * @param source new value of source
    +  87   + 
          */
    +  88   + 
         public void setSource(String source) {
    +  89  0 
             this.source = source;
    +  90  0 
         }
    +  91   + 
         /**
    +  92   + 
          * The value of the evidence.
    +  93   + 
          */
    +  94   + 
         private String value;
    +  95   + 
     
    +  96   + 
         /**
    +  97   + 
          * Get the value of value.
    +  98   + 
          *
    +  99   + 
          * @return the value of value
    +  100   + 
          */
    +  101   + 
         public String getValue() {
    +  102  14330 
             used = true;
    +  103  14330 
             return value;
    +  104   + 
         }
    +  105   + 
     
    +  106   + 
         /**
    +  107   + 
          * Get the value of value. If setUsed is set to false this call to get will not mark the evidence as used.
    +  108   + 
          *
    +  109   + 
          * @param setUsed whether or not this call to getValue should cause the used flag to be updated
    +  110   + 
          * @return the value of value
     111   
          */
     112   - 
         public void setSource(String source) {
    -  113  0 
             this.source = source;
    -  114  0 
         }
    + 
         public String getValue(Boolean setUsed) {
    +  113  440 
             used = used || setUsed;
    +  114  440 
             return value;
     115   - 
         /**
    -  116   - 
          * The value of the evidence.
    -  117   - 
          */
    -  118   - 
         private String value;
    -  119   - 
     
    -  120   - 
         /**
    -  121   - 
          * Get the value of value.
    -  122   - 
          *
    -  123   - 
          * @return the value of value
    -  124   - 
          */
    -  125   - 
         public String getValue() {
    -  126  6806 
             used = true;
    -  127  6806 
             return value;
    -  128   
         }
    +  116   + 
     
    +  117   + 
         /**
    +  118   + 
          * Set the value of value.
    +  119   + 
          *
    +  120   + 
          * @param value new value of value
    +  121   + 
          */
    +  122   + 
         public void setValue(String value) {
    +  123  0 
             this.value = value;
    +  124  0 
         }
    +  125   + 
         /**
    +  126   + 
          * A value indicating if the Evidence has been "used" (aka read).
    +  127   + 
          */
    +  128   + 
         private boolean used;
     129   
     
     130   
         /**
     131   - 
          * Get the value of value. If setUsed is set to false this call to get will
    -  132   - 
          * not mark the evidence as used.
    -  133   - 
          *
    -  134   - 
          * @param setUsed whether or not this call to getValue should cause the used
    -  135   - 
          * flag to be updated
    -  136   - 
          * @return the value of value
    -  137   - 
          */
    -  138   - 
         public String getValue(Boolean setUsed) {
    -  139  210 
             used = used || setUsed;
    -  140  210 
             return value;
    -  141   - 
         }
    -  142   - 
     
    -  143   - 
         /**
    -  144   - 
          * Set the value of value.
    -  145   - 
          *
    -  146   - 
          * @param value new value of value
    -  147   - 
          */
    -  148   - 
         public void setValue(String value) {
    -  149  0 
             this.value = value;
    -  150  0 
         }
    -  151   - 
         /**
    -  152   - 
          * A value indicating if the Evidence has been "used" (aka read).
    -  153   - 
          */
    -  154   - 
         private boolean used;
    -  155   - 
     
    -  156   - 
         /**
    -  157   
          * Get the value of used.
    -  158   +  132   
          *
    -  159   +  133   
          * @return the value of used
    -  160   +  134   
          */
    -  161   +  135   
         public boolean isUsed() {
    -  162  9313 
             return used;
    -  163   +  136  19384 
             return used;
    +  137   
         }
    -  164   +  138   
     
    -  165   +  139   
         /**
    -  166   +  140   
          * Set the value of used.
    -  167   +  141   
          *
    -  168   +  142   
          * @param used new value of used
    -  169   +  143   
          */
    -  170   +  144   
         public void setUsed(boolean used) {
    -  171  0 
             this.used = used;
    -  172  0 
         }
    -  173   +  145  0 
             this.used = used;
    +  146  0 
         }
    +  147   
         /**
    -  174   +  148   
          * The confidence level for the evidence.
    -  175   +  149   
          */
    -  176   +  150   
         private Confidence confidence;
    -  177   +  151   
     
    -  178   +  152   
         /**
    -  179   +  153   
          * Get the value of confidence.
    -  180   +  154   
          *
    -  181   +  155   
          * @return the value of confidence
    -  182   +  156   
          */
    -  183   +  157   
         public Confidence getConfidence() {
    -  184  2873 
             return confidence;
    -  185   +  158  6152 
             return confidence;
    +  159   
         }
    -  186   +  160   
     
    -  187   +  161   
         /**
    -  188   +  162   
          * Set the value of confidence.
    -  189   +  163   
          *
    -  190   +  164   
          * @param confidence new value of confidence
    -  191   +  165   
          */
    -  192   +  166   
         public void setConfidence(Confidence confidence) {
    -  193  0 
             this.confidence = confidence;
    -  194  0 
         }
    -  195   +  167  0 
             this.confidence = confidence;
    +  168  0 
         }
    +  169   
     
    -  196   +  170   
         /**
    -  197   +  171   
          * Implements the hashCode for Evidence.
    -  198   +  172   
          *
    -  199   +  173   
          * @return hash code.
    -  200   +  174   
          */
    -  201   +  175   
         @Override
    -  202   +  176   
         public int hashCode() {
    -  203  0 
             int hash = 3;
    -  204  0 
             hash = 67 * hash + (this.name != null ? this.name.hashCode() : 0);
    -  205  0 
             hash = 67 * hash + (this.source != null ? this.source.hashCode() : 0);
    -  206  0 
             hash = 67 * hash + (this.value != null ? this.value.hashCode() : 0);
    -  207  0 
             hash = 67 * hash + (this.confidence != null ? this.confidence.hashCode() : 0);
    -  208  0 
             return hash;
    -  209   +  177  0 
             int hash = 3;
    +  178  0 
             hash = 67 * hash + (this.name != null ? this.name.hashCode() : 0);
    +  179  0 
             hash = 67 * hash + (this.source != null ? this.source.hashCode() : 0);
    +  180  0 
             hash = 67 * hash + (this.value != null ? this.value.hashCode() : 0);
    +  181  0 
             hash = 67 * hash + (this.confidence != null ? this.confidence.hashCode() : 0);
    +  182  0 
             return hash;
    +  183   
         }
    -  210   +  184   
     
    -  211   +  185   
         /**
    -  212   +  186   
          * Implements equals for Evidence.
    -  213   +  187   
          *
    -  214   +  188   
          * @param that an object to check the equality of.
    -  215   +  189   
          * @return whether the two objects are equal.
    -  216   +  190   
          */
    -  217   +  191   
         @Override
    -  218   +  192   
         public boolean equals(Object that) {
    -  219  0 
             if (this == that) {
    -  220  0 
                 return true;
    -  221   +  193  0 
             if (this == that) {
    +  194  0 
                 return true;
    +  195   
             }
    -  222  0 
             if (!(that instanceof Evidence)) {
    -  223  0 
                 return false;
    -  224   +  196  0 
             if (!(that instanceof Evidence)) {
    +  197  0 
                 return false;
    +  198   
             }
    -  225  0 
             final Evidence e = (Evidence) that;
    -  226   +  199  0 
             final Evidence e = (Evidence) that;
    +  200   
     
    -  227  0 
             return testEquality(name, e.name) && testEquality(source, e.source) && testEquality(value, e.value)
    -  228   +  201  0 
             return testEquality(name, e.name) && testEquality(source, e.source) && testEquality(value, e.value)
    +  202   
                     && (confidence == null ? e.confidence == null : confidence == e.confidence);
    -  229   +  203   
         }
    -  230   +  204   
     
    -  231   +  205   
         /**
    -  232   - 
          * Simple equality test for use within the equals method. This does a case
    -  233   - 
          * insensitive compare.
    -  234   +  206   + 
          * Simple equality test for use within the equals method. This does a case insensitive compare.
    +  207   
          *
    -  235   +  208   
          * @param l a string to compare.
    -  236   +  209   
          * @param r another string to compare.
    -  237   +  210   
          * @return whether the two strings are the same.
    -  238   +  211   
          */
    -  239   +  212   
         private boolean testEquality(String l, String r) {
    -  240  0 
             return l == null ? r == null : l.equalsIgnoreCase(r);
    -  241   +  213  0 
             return l == null ? r == null : l.equalsIgnoreCase(r);
    +  214   
         }
    -  242   +  215   
     
    -  243   +  216   
         /**
    -  244   +  217   
          * Implementation of the comparable interface.
    -  245   +  218   
          *
    -  246   +  219   
          * @param o the evidence being compared
    -  247   +  220   
          * @return an integer indicating the ordering of the two objects
    -  248   +  221   
          */
    -  249   +  222   
         public int compareTo(Evidence o) {
    -  250  121449 
             if (source.equals(o.source)) {
    -  251  99756 
                 if (name.equals(o.name)) {
    -  252  99453 
                     if (value.equals(o.value)) {
    -  253  70548 
                         if (confidence.equals(o.confidence)) {
    -  254  70543 
                             return 0; //they are equal
    -  255   +  223  243066 
             if (source.equals(o.source)) {
    +  224  199536 
                 if (name.equals(o.name)) {
    +  225  198906 
                     if (value.equals(o.value)) {
    +  226  141096 
                         if (confidence.equals(o.confidence)) {
    +  227  141086 
                             return 0; //they are equal
    +  228   
                         } else {
    -  256  5 
                             return confidence.compareTo(o.confidence);
    -  257   +  229  10 
                             return confidence.compareTo(o.confidence);
    +  230   
                         }
    -  258   +  231   
                     } else {
    -  259  28905 
                         return value.compareToIgnoreCase(o.value);
    -  260   +  232  57810 
                         return value.compareToIgnoreCase(o.value);
    +  233   
                     }
    -  261   +  234   
                 } else {
    -  262  303 
                     return name.compareToIgnoreCase(o.name);
    -  263   +  235  630 
                     return name.compareToIgnoreCase(o.name);
    +  236   
                 }
    -  264   +  237   
             } else {
    -  265  21693 
                 return source.compareToIgnoreCase(o.source);
    -  266   +  238  43530 
                 return source.compareToIgnoreCase(o.source);
    +  239   
             }
    -  267   +  240   
         }
    -  268   +  241   
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.EvidenceCollection.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.EvidenceCollection.html index ce60bb4bd..3269a539e 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.EvidenceCollection.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.EvidenceCollection.html @@ -29,560 +29,555 @@  3   
      *
     4   - 
      * Dependency-check-core is free software: you can redistribute it and/or modify it
    + 
      * Licensed under the Apache License, Version 2.0 (the "License");
     5   - 
      * under the terms of the GNU General Public License as published by the Free
    + 
      * you may not use this file except in compliance with the License.
     6   - 
      * Software Foundation, either version 3 of the License, or (at your option) any
    + 
      * You may obtain a copy of the License at
     7   - 
      * later version.
    + 
      *
     8   - 
      *
    + 
      *     http://www.apache.org/licenses/LICENSE-2.0
     9   - 
      * Dependency-check-core is distributed in the hope that it will be useful, but
    + 
      *
     10   - 
      * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
    + 
      * Unless required by applicable law or agreed to in writing, software
     11   - 
      * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
    + 
      * distributed under the License is distributed on an "AS IS" BASIS,
     12   - 
      * details.
    + 
      * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13   - 
      *
    + 
      * See the License for the specific language governing permissions and
     14   - 
      * You should have received a copy of the GNU General Public License along with
    + 
      * limitations under the License.
     15   - 
      * dependency-check-core. If not, see http://www.gnu.org/licenses/.
    + 
      *
     16   - 
      *
    -  17   
      * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
    +  17   + 
      */
     18   - 
      */
    -  19   
     package org.owasp.dependencycheck.dependency;
    +  19   + 
     
     20   - 
     
    -  21   
     import java.net.MalformedURLException;
    -  22   +  21   
     import java.util.HashSet;
    -  23   +  22   
     import java.util.Iterator;
    -  24   +  23   
     import java.util.List;
    -  25   +  24   
     import java.util.Set;
    -  26   +  25   
     import java.util.TreeSet;
    -  27   +  26   
     import java.util.logging.Level;
    -  28   +  27   
     import java.util.logging.Logger;
    -  29   +  28   
     import org.apache.commons.lang.StringUtils;
    -  30   +  29   
     import org.owasp.dependencycheck.utils.DependencyVersion;
    -  31   +  30   
     import org.owasp.dependencycheck.utils.DependencyVersionUtil;
    -  32   +  31   
     import org.owasp.dependencycheck.utils.Filter;
    -  33   +  32   
     import org.owasp.dependencycheck.utils.UrlStringUtils;
    +  33   + 
     
     34   - 
     
    -  35   
     /**
    -  36   +  35   
      * Used to maintain a collection of Evidence.
    -  37   +  36   
      *
    -  38   +  37   
      * @author Jeremy Long <jeremy.long@owasp.org>
    -  39   +  38   
      */
    -  40   +  39   
     public class EvidenceCollection implements Iterable<Evidence> {
    +  40   + 
     
     41   - 
     
    + 
         /**
     42   - 
         /**
    + 
          * Used to iterate over highest confidence evidence contained in the collection.
     43   - 
          * Used to iterate over highest confidence evidence contained in the
    -  44   - 
          * collection.
    + 
          */
    +  44  1072 
         private static final Filter<Evidence> HIGHEST_CONFIDENCE = new Filter<Evidence>() {
     45   - 
          */
    -  46  489 
         private static final Filter<Evidence> HIGHEST_CONFIDENCE = new Filter<Evidence>() {
    + 
             public boolean passes(Evidence evidence) {
    +  46  1070 
                 return evidence.getConfidence() == Confidence.HIGHEST;
     47   - 
             public boolean passes(Evidence evidence) {
    -  48  488 
                 return evidence.getConfidence() == Evidence.Confidence.HIGHEST;
    + 
             }
    +  48   + 
         };
     49   - 
             }
    + 
         /**
     50   - 
         };
    + 
          * Used to iterate over high confidence evidence contained in the collection.
     51   - 
         /**
    -  52   - 
          * Used to iterate over high confidence evidence contained in the
    + 
          */
    +  52  1060 
         private static final Filter<Evidence> HIGH_CONFIDENCE = new Filter<Evidence>() {
     53   - 
          * collection.
    -  54   - 
          */
    -  55  483 
         private static final Filter<Evidence> HIGH_CONFIDENCE = new Filter<Evidence>() {
    + 
             public boolean passes(Evidence evidence) {
    +  54  1058 
                 return evidence.getConfidence() == Confidence.HIGH;
    +  55   + 
             }
     56   - 
             public boolean passes(Evidence evidence) {
    -  57  482 
                 return evidence.getConfidence() == Evidence.Confidence.HIGH;
    + 
         };
    +  57   + 
         /**
     58   - 
             }
    + 
          * Used to iterate over medium confidence evidence contained in the collection.
     59   - 
         };
    -  60   - 
         /**
    + 
          */
    +  60  2 
         private static final Filter<Evidence> MEDIUM_CONFIDENCE = new Filter<Evidence>() {
     61   - 
          * Used to iterate over medium confidence evidence contained in the
    -  62   - 
          * collection.
    + 
             public boolean passes(Evidence evidence) {
    +  62  990 
                 return evidence.getConfidence() == Confidence.MEDIUM;
     63   - 
          */
    -  64  1 
         private static final Filter<Evidence> MEDIUM_CONFIDENCE = new Filter<Evidence>() {
    + 
             }
    +  64   + 
         };
     65   - 
             public boolean passes(Evidence evidence) {
    -  66  452 
                 return evidence.getConfidence() == Evidence.Confidence.MEDIUM;
    -  67   - 
             }
    -  68   - 
         };
    -  69   
         /**
    -  70   +  66   
          * Used to iterate over low confidence evidence contained in the collection.
    +  67   + 
          */
    +  68  2 
         private static final Filter<Evidence> LOW_CONFIDENCE = new Filter<Evidence>() {
    +  69   + 
             public boolean passes(Evidence evidence) {
    +  70  1612 
                 return evidence.getConfidence() == Confidence.LOW;
     71   - 
          */
    -  72  1 
         private static final Filter<Evidence> LOW_CONFIDENCE = new Filter<Evidence>() {
    + 
             }
    +  72   + 
         };
     73   - 
             public boolean passes(Evidence evidence) {
    -  74  748 
                 return evidence.getConfidence() == Evidence.Confidence.LOW;
    + 
         /**
    +  74   + 
          * Used to iterate over evidence that has was used (aka read) from the collection.
     75   - 
             }
    -  76   - 
         };
    + 
          */
    +  76  2 
         private static final Filter<Evidence> EVIDENCE_USED = new Filter<Evidence>() {
     77   - 
         /**
    -  78   - 
          * Used to iterate over evidence that has was used (aka read) from the
    -  79   - 
          * collection.
    -  80   - 
          */
    -  81  1 
         private static final Filter<Evidence> EVIDENCE_USED = new Filter<Evidence>() {
    -  82   
             public boolean passes(Evidence evidence) {
    -  83  9254 
                 return evidence.isUsed();
    -  84   +  78  19248 
                 return evidence.isUsed();
    +  79   
             }
    -  85   +  80   
         };
    -  86   +  81   
     
    -  87   +  82   
         /**
    -  88   +  83   
          * Used to iterate over evidence of the specified confidence.
    -  89   +  84   
          *
    -  90   - 
          * @param confidence the confidence level for the evidence to be iterated
    -  91   - 
          * over.
    -  92   +  85   + 
          * @param confidence the confidence level for the evidence to be iterated over.
    +  86   
          * @return Iterable<Evidence> an iterable collection of evidence
    -  93   +  87   
          */
    -  94   - 
         public final Iterable<Evidence> iterator(Evidence.Confidence confidence) {
    -  95  504 
             if (confidence == Evidence.Confidence.HIGHEST) {
    -  96  128 
                 return EvidenceCollection.HIGHEST_CONFIDENCE.filter(this.list);
    -  97  376 
             } else if (confidence == Evidence.Confidence.HIGH) {
    -  98  123 
                 return EvidenceCollection.HIGH_CONFIDENCE.filter(this.list);
    -  99  253 
             } else if (confidence == Evidence.Confidence.MEDIUM) {
    -  100  108 
                 return EvidenceCollection.MEDIUM_CONFIDENCE.filter(this.list);
    -  101   +  88   + 
         public final Iterable<Evidence> iterator(Confidence confidence) {
    +  89  1008 
             if (confidence == Confidence.HIGHEST) {
    +  90  256 
                 return EvidenceCollection.HIGHEST_CONFIDENCE.filter(this.list);
    +  91  752 
             } else if (confidence == Confidence.HIGH) {
    +  92  246 
                 return EvidenceCollection.HIGH_CONFIDENCE.filter(this.list);
    +  93  506 
             } else if (confidence == Confidence.MEDIUM) {
    +  94  216 
                 return EvidenceCollection.MEDIUM_CONFIDENCE.filter(this.list);
    +  95   
             } else {
    -  102  145 
                 return EvidenceCollection.LOW_CONFIDENCE.filter(this.list);
    -  103   +  96  290 
                 return EvidenceCollection.LOW_CONFIDENCE.filter(this.list);
    +  97   
             }
    -  104   +  98   
         }
    -  105   +  99   
         /**
    -  106   +  100   
          * A collection of evidence.
    -  107   +  101   
          */
    -  108   +  102   
         private final Set<Evidence> list;
    -  109   +  103   
         /**
    -  110   +  104   
          * A collection of strings used to adjust Lucene's term weighting.
    -  111   +  105   
          */
    -  112   +  106   
         private final Set<String> weightedStrings;
    -  113   +  107   
     
    -  114   +  108   
         /**
    -  115   +  109   
          * Creates a new EvidenceCollection.
    +  110   + 
          */
    +  111  406 
         public EvidenceCollection() {
    +  112  406 
             list = new TreeSet<Evidence>();
    +  113  406 
             weightedStrings = new HashSet<String>();
    +  114  406 
         }
    +  115   + 
     
     116   - 
          */
    -  117  167 
         public EvidenceCollection() {
    -  118  167 
             list = new TreeSet<Evidence>();
    -  119  167 
             weightedStrings = new HashSet<String>();
    -  120  167 
         }
    -  121   - 
     
    -  122   
         /**
    -  123   +  117   
          * Adds evidence to the collection.
    -  124   +  118   
          *
    -  125   +  119   
          * @param e Evidence.
    -  126   +  120   
          */
    -  127   +  121   
         public void addEvidence(Evidence e) {
    -  128  70895 
             list.add(e);
    -  129  70895 
         }
    -  130   +  122  141838 
             list.add(e);
    +  123  141838 
         }
    +  124   
     
    -  131   +  125   
         /**
    -  132   - 
          * Creates an Evidence object from the parameters and adds the resulting
    -  133   - 
          * object to the collection.
    -  134   +  126   + 
          * Creates an Evidence object from the parameters and adds the resulting object to the collection.
    +  127   
          *
    -  135   +  128   
          * @param source the source of the Evidence.
    -  136   +  129   
          * @param name the name of the Evidence.
    -  137   +  130   
          * @param value the value of the Evidence.
    -  138   +  131   
          * @param confidence the confidence of the Evidence.
    +  132   + 
          */
    +  133   + 
         public void addEvidence(String source, String name, String value, Confidence confidence) {
    +  134  141700 
             final Evidence e = new Evidence(source, name, value, confidence);
    +  135  141700 
             addEvidence(e);
    +  136  141700 
         }
    +  137   + 
     
    +  138   + 
         /**
     139   - 
          */
    + 
          * Adds term to the weighting collection. The terms added here are used later to boost the score of other terms.
     140   - 
         public void addEvidence(String source, String name, String value, Evidence.Confidence confidence) {
    -  141  70835 
             final Evidence e = new Evidence(source, name, value, confidence);
    -  142  70835 
             addEvidence(e);
    -  143  70835 
         }
    + 
          * This is a way of combining evidence from multiple sources to boost the confidence of the given evidence.
    +  141   + 
          *
    +  142   + 
          * Example: The term 'Apache' is found in the manifest of a JAR and is added to the Collection. When we parse the
    +  143   + 
          * package names within the JAR file we may add these package names to the "weighted" strings collection to boost
     144   - 
     
    + 
          * the score in the Lucene query. That way when we construct the Lucene query we find the term Apache in the
     145   - 
         /**
    + 
          * collection AND in the weighted strings; as such, we will boost the confidence of the term Apache.
     146   - 
          * Adds term to the weighting collection. The terms added here are used
    + 
          *
     147   - 
          * later to boost the score of other terms. This is a way of combining
    -  148   - 
          * evidence from multiple sources to boost the confidence of the given
    -  149   - 
          * evidence.
    -  150   - 
          *
    -  151   - 
          * Example: The term 'Apache' is found in the manifest of a JAR and is added
    -  152   - 
          * to the Collection. When we parse the package names within the JAR file we
    -  153   - 
          * may add these package names to the "weighted" strings collection to boost
    -  154   - 
          * the score in the Lucene query. That way when we construct the Lucene
    -  155   - 
          * query we find the term Apache in the collection AND in the weighted
    -  156   - 
          * strings; as such, we will boost the confidence of the term Apache.
    -  157   - 
          *
    -  158   
          * @param str to add to the weighting collection.
    -  159   +  148   
          */
    -  160   +  149   
         public void addWeighting(String str) {
    -  161  57 
             weightedStrings.add(str);
    -  162  57 
         }
    -  163   +  150  114 
             weightedStrings.add(str);
    +  151  114 
         }
    +  152   
     
    -  164   +  153   
         /**
    -  165   - 
          * Returns a set of Weightings - a list of terms that are believed to be of
    -  166   - 
          * higher confidence when also found in another location.
    -  167   +  154   + 
          * Returns a set of Weightings - a list of terms that are believed to be of higher confidence when also found in
    +  155   + 
          * another location.
    +  156   
          *
    -  168   +  157   
          * @return Set<String>
    -  169   +  158   
          */
    -  170   +  159   
         public Set<String> getWeighting() {
    -  171  145 
             return weightedStrings;
    -  172   +  160  290 
             return weightedStrings;
    +  161   
         }
    -  173   +  162   
     
    -  174   +  163   
         /**
    -  175   +  164   
          * Returns the set of evidence.
    -  176   +  165   
          *
    -  177   +  166   
          * @return the set of evidence.
    -  178   +  167   
          */
    -  179   +  168   
         public Set<Evidence> getEvidence() {
    -  180  30 
             return list;
    -  181   +  169  60 
             return list;
    +  170   
         }
    -  182   +  171   
     
    -  183   +  172   
         /**
    -  184   +  173   
          * Returns the set of evidence from a given source.
    -  185   +  174   
          *
    -  186   +  175   
          * @param source the source of the evidence
    -  187   +  176   
          * @return the set of evidence.
    -  188   +  177   
          */
    -  189   +  178   
         public Set<Evidence> getEvidence(String source) {
    -  190  0 
             if (source == null) {
    -  191  0 
                 return null;
    +  179  0 
             if (source == null) {
    +  180  0 
                 return null;
    +  181   + 
             }
    +  182  0 
             final Set<Evidence> ret = new HashSet<Evidence>();
    +  183  0 
             for (Evidence e : list) {
    +  184  0 
                 if (source.equals(e.getSource())) {
    +  185  0 
                     ret.add(e);
    +  186   + 
                 }
    +  187  0 
             }
    +  188  0 
             return ret;
    +  189   + 
         }
    +  190   + 
     
    +  191   + 
         /**
     192   - 
             }
    -  193  0 
             final Set<Evidence> ret = new HashSet<Evidence>();
    -  194  0 
             for (Evidence e : list) {
    -  195  0 
                 if (source.equals(e.getSource())) {
    -  196  0 
                     ret.add(e);
    -  197   - 
                 }
    -  198  0 
             }
    -  199  0 
             return ret;
    -  200   - 
         }
    -  201   - 
     
    -  202   - 
         /**
    -  203   
          * Returns the set of evidence from a given source and name.
    -  204   +  193   
          *
    -  205   +  194   
          * @param source the source of the evidence
    -  206   +  195   
          * @param name the name of the evidence to return
    -  207   +  196   
          * @return the set of evidence.
    -  208   +  197   
          */
    -  209   +  198   
         public Set<Evidence> getEvidence(String source, String name) {
    -  210  0 
             if (source == null || name == null) {
    -  211  0 
                 return null;
    +  199  0 
             if (source == null || name == null) {
    +  200  0 
                 return null;
    +  201   + 
             }
    +  202  0 
             final Set<Evidence> ret = new HashSet<Evidence>();
    +  203  0 
             for (Evidence e : list) {
    +  204  0 
                 if (source.equals(e.getSource()) && name.equals(e.getName())) {
    +  205  0 
                     ret.add(e);
    +  206   + 
                 }
    +  207  0 
             }
    +  208  0 
             return ret;
    +  209   + 
         }
    +  210   + 
     
    +  211   + 
         /**
     212   - 
             }
    -  213  0 
             final Set<Evidence> ret = new HashSet<Evidence>();
    -  214  0 
             for (Evidence e : list) {
    -  215  0 
                 if (source.equals(e.getSource()) && name.equals(e.getName())) {
    -  216  0 
                     ret.add(e);
    -  217   - 
                 }
    -  218  0 
             }
    -  219  0 
             return ret;
    -  220   - 
         }
    -  221   - 
     
    -  222   - 
         /**
    -  223   
          * Implements the iterator interface for the Evidence Collection.
    -  224   +  213   
          *
    -  225   +  214   
          * @return an Iterator<Evidence>.
    -  226   +  215   
          */
    -  227   +  216   
         public Iterator<Evidence> iterator() {
    -  228  1465 
             return list.iterator();
    -  229   +  217  2946 
             return list.iterator();
    +  218   
         }
    -  230   +  219   
     
    -  231   +  220   
         /**
    -  232   +  221   
          * Used to determine if a given string was used (aka read).
    -  233   +  222   
          *
    -  234   +  223   
          * @param text the string to search for.
    -  235   +  224   
          * @return whether or not the string was used.
    -  236   +  225   
          */
    -  237   +  226   
         public boolean containsUsedString(String text) {
    -  238  1444 
             if (text == null) {
    -  239  0 
                 return false;
    -  240   +  227  2904 
             if (text == null) {
    +  228  0 
                 return false;
    +  229   
             }
    -  241  1444 
             final String textToTest = text.toLowerCase();
    -  242   +  230  2904 
             final String textToTest = text.toLowerCase();
    +  231   
     
    -  243  1444 
             for (Evidence e : EvidenceCollection.EVIDENCE_USED.filter(this)) {
    -  244   +  232  2904 
             for (Evidence e : EvidenceCollection.EVIDENCE_USED.filter(this)) {
    +  233   
                 //TODO consider changing the regex to only compare alpha-numeric (i.e. strip everything else)
    -  245  6183 
                 final String value = urlCorrection(e.getValue().toLowerCase()).replaceAll("[\\s_-]", "");
    -  246  6183 
                 if (value.contains(textToTest)) {
    -  247  510 
                     return true;
    -  248   +  234  12972 
                 final String value = urlCorrection(e.getValue().toLowerCase()).replaceAll("[\\s_-]", "");
    +  235  12972 
                 if (value.contains(textToTest)) {
    +  236  1016 
                     return true;
    +  237   
                 }
    -  249  5673 
             }
    -  250  934 
             return false;
    -  251   +  238  11956 
             }
    +  239  1888 
             return false;
    +  240   
         }
    +  241   + 
     
    +  242   + 
         /**
    +  243   + 
          * Used to determine if a given version was used (aka read) from the EvidenceCollection.
    +  244   + 
          *
    +  245   + 
          * @param version the version to search for within the collected evidence.
    +  246   + 
          * @return whether or not the string was used.
    +  247   + 
          */
    +  248   + 
         public boolean containsUsedVersion(DependencyVersion version) {
    +  249  0 
             if (version == null) {
    +  250  0 
                 return false;
    +  251   + 
             }
     252   
     
    -  253   - 
         /**
    -  254   - 
          * Used to determine if a given version was used (aka read) from the
    -  255   - 
          * EvidenceCollection.
    -  256   - 
          *
    +  253  0 
             for (Evidence e : EvidenceCollection.EVIDENCE_USED.filter(this)) {
    +  254  0 
                 final DependencyVersion value = DependencyVersionUtil.parseVersion(e.getValue());
    +  255  0 
                 if (value != null && value.matchesAtLeastThreeLevels(version)) {
    +  256  0 
                     return true;
     257   - 
          * @param version the version to search for within the collected evidence.
    -  258   - 
          * @return whether or not the string was used.
    -  259   - 
          */
    + 
                 }
    +  258  0 
             }
    +  259  0 
             return false;
     260   - 
         public boolean containsUsedVersion(DependencyVersion version) {
    -  261  0 
             if (version == null) {
    -  262  0 
                 return false;
    + 
         }
    +  261   + 
     
    +  262   + 
         /**
     263   - 
             }
    + 
          * Returns whether or not the collection contains evidence of a specified Confidence.
     264   - 
     
    -  265  0 
             for (Evidence e : EvidenceCollection.EVIDENCE_USED.filter(this)) {
    -  266  0 
                 final DependencyVersion value = DependencyVersionUtil.parseVersion(e.getValue());
    -  267  0 
                 if (value != null && value.matchesAtLeastThreeLevels(version)) {
    -  268  0 
                     return true;
    -  269   - 
                 }
    -  270  0 
             }
    -  271  0 
             return false;
    -  272   - 
         }
    -  273   - 
     
    -  274   - 
         /**
    -  275   - 
          * Returns whether or not the collection contains evidence of a specified
    -  276   - 
          * Confidence.
    -  277   
          *
    -  278   +  265   
          * @param confidence A Confidence value.
    -  279   +  266   
          * @return boolean.
    -  280   +  267   
          */
    -  281   - 
         public boolean contains(Evidence.Confidence confidence) {
    -  282  228 
             for (Evidence e : list) {
    -  283  701 
                 if (e.getConfidence().equals(confidence)) {
    -  284  162 
                     return true;
    -  285   +  268   + 
         public boolean contains(Confidence confidence) {
    +  269  456 
             for (Evidence e : list) {
    +  270  1418 
                 if (e.getConfidence().equals(confidence)) {
    +  271  324 
                     return true;
    +  272   
                 }
    -  286  539 
             }
    -  287  66 
             return false;
    -  288   +  273  1094 
             }
    +  274  132 
             return false;
    +  275   
         }
    -  289   +  276   
     
    -  290   +  277   
         /**
    -  291   - 
          * Merges multiple EvidenceCollections together, only merging evidence that
    -  292   - 
          * was used, into a new EvidenceCollection.
    -  293   +  278   + 
          * Merges multiple EvidenceCollections together, only merging evidence that was used, into a new EvidenceCollection.
    +  279   
          *
    -  294   +  280   
          * @param ec One or more EvidenceCollections.
    -  295   +  281   
          * @return a new EvidenceCollection containing the used evidence.
    -  296   +  282   
          */
    -  297   +  283   
         public static EvidenceCollection mergeUsed(EvidenceCollection... ec) {
    -  298  4 
             final EvidenceCollection ret = new EvidenceCollection();
    -  299  16 
             for (EvidenceCollection col : ec) {
    -  300  12 
                 for (Evidence e : col.list) {
    -  301  59 
                     if (e.isUsed()) {
    -  302  58 
                         ret.addEvidence(e);
    -  303   +  284  8 
             final EvidenceCollection ret = new EvidenceCollection();
    +  285  32 
             for (EvidenceCollection col : ec) {
    +  286  24 
                 for (Evidence e : col.list) {
    +  287  136 
                     if (e.isUsed()) {
    +  288  134 
                         ret.addEvidence(e);
    +  289   
                     }
    -  304  59 
                 }
    -  305   +  290  136 
                 }
    +  291   
             }
    -  306  4 
             return ret;
    -  307   +  292  8 
             return ret;
    +  293   
         }
    -  308   +  294   
     
    -  309   +  295   
         /**
    -  310   +  296   
          * Merges multiple EvidenceCollections together.
    -  311   +  297   
          *
    -  312   +  298   
          * @param ec One or more EvidenceCollections.
    -  313   +  299   
          * @return a new EvidenceCollection.
    +  300   + 
          */
    +  301   + 
         public static EvidenceCollection merge(EvidenceCollection... ec) {
    +  302  2 
             final EvidenceCollection ret = new EvidenceCollection();
    +  303  8 
             for (EvidenceCollection col : ec) {
    +  304  6 
                 ret.list.addAll(col.list);
    +  305  6 
                 ret.weightedStrings.addAll(col.weightedStrings);
    +  306   + 
             }
    +  307  2 
             return ret;
    +  308   + 
         }
    +  309   + 
     
    +  310   + 
         /**
    +  311   + 
          * Returns a string of evidence 'values'.
    +  312   + 
          *
    +  313   + 
          * @return a string containing the evidence.
     314   
          */
     315   - 
         public static EvidenceCollection merge(EvidenceCollection... ec) {
    -  316  1 
             final EvidenceCollection ret = new EvidenceCollection();
    -  317  4 
             for (EvidenceCollection col : ec) {
    -  318  3 
                 ret.list.addAll(col.list);
    -  319  3 
                 ret.weightedStrings.addAll(col.weightedStrings);
    -  320   - 
             }
    -  321  1 
             return ret;
    + 
         @Override
    +  316   + 
         public String toString() {
    +  317  6 
             final StringBuilder sb = new StringBuilder();
    +  318  6 
             for (Evidence e : this.list) {
    +  319  22 
                 sb.append(e.getValue()).append(' ');
    +  320  22 
             }
    +  321  6 
             return sb.toString();
     322   
         }
     323   @@ -590,107 +585,88 @@  324   
         /**
     325   - 
          * Returns a string of evidence 'values'.
    + 
          * Returns the number of elements in the EvidenceCollection.
     326   
          *
     327   - 
          * @return a string containing the evidence.
    + 
          * @return the number of elements in the collection.
     328   
          */
     329   - 
         @Override
    -  330   - 
         public String toString() {
    -  331  3 
             final StringBuilder sb = new StringBuilder();
    -  332  3 
             for (Evidence e : this.list) {
    -  333  11 
                 sb.append(e.getValue()).append(' ');
    -  334  11 
             }
    -  335  3 
             return sb.toString();
    -  336   + 
         public int size() {
    +  330  442 
             return list.size();
    +  331   
         }
    -  337   +  332   
     
    -  338   +  333   
         /**
    +  334   + 
          * <p>
    +  335   + 
          * Takes a string that may contain a fully qualified domain and it will return the string having removed the query
    +  336   + 
          * string, the protocol, the sub-domain of 'www', and the file extension of the path.</p>
    +  337   + 
          * <p>
    +  338   + 
          * This is useful for checking if the evidence contains a specific string. The presence of the protocol, file
     339   - 
          * Returns the number of elements in the EvidenceCollection.
    + 
          * extension, etc. may produce false positives.
     340   
          *
     341   - 
          * @return the number of elements in the collection.
    + 
          * <p>
     342   - 
          */
    + 
          * Example, given the following input:</p>
     343   - 
         public int size() {
    -  344  221 
             return list.size();
    -  345   - 
         }
    -  346   - 
     
    -  347   - 
         /**
    -  348   - 
          * <p>Takes a string that may contain a fully qualified domain and it will
    -  349   - 
          * return the string having removed the query string, the protocol, the
    -  350   - 
          * sub-domain of 'www', and the file extension of the path.</p>
    -  351   - 
          * <p>This is useful for checking if the evidence contains a specific
    -  352   - 
          * string. The presence of the protocol, file extension, etc. may produce
    -  353   - 
          * false positives.
    -  354   - 
          *
    -  355   - 
          * <p>Example, given the following input:</p>
    -  356   
          * <code>'Please visit https://www.somedomain.com/path1/path2/file.php?id=439'</code>
    -  357   - 
          * <p>The function would return:</p>
    -  358   +  344   + 
          * <p>
    +  345   + 
          * The function would return:</p>
    +  346   
          * <code>'Please visit somedomain path1 path2 file'</code>
    -  359   +  347   
          *
    -  360   +  348   
          * @param value the value that may contain a url
    -  361   +  349   
          * @return the modified string
    -  362   +  350   
          */
    -  363   +  351   
         private String urlCorrection(String value) {
    -  364  6183 
             if (value == null || !UrlStringUtils.containsUrl(value)) {
    -  365  6050 
                 return value;
    -  366   +  352  12972 
             if (value == null || !UrlStringUtils.containsUrl(value)) {
    +  353  12684 
                 return value;
    +  354   
             }
    -  367  133 
             final StringBuilder sb = new StringBuilder(value.length());
    -  368  133 
             final String[] parts = value.split("\\s");
    -  369  266 
             for (String part : parts) {
    -  370  133 
                 if (UrlStringUtils.isUrl(part)) {
    -  371   +  355  288 
             final StringBuilder sb = new StringBuilder(value.length());
    +  356  288 
             final String[] parts = value.split("\\s");
    +  357  576 
             for (String part : parts) {
    +  358  288 
                 if (UrlStringUtils.isUrl(part)) {
    +  359   
                     try {
    -  372  133 
                         final List<String> data = UrlStringUtils.extractImportantUrlData(part);
    -  373  133 
                         sb.append(' ').append(StringUtils.join(data, ' '));
    -  374  0 
                     } catch (MalformedURLException ex) {
    -  375  0 
                         Logger.getLogger(EvidenceCollection.class.getName()).log(Level.INFO, "error parsing " + part, ex);
    -  376  0 
                         sb.append(' ').append(part);
    -  377  133 
                     }
    -  378   +  360  288 
                         final List<String> data = UrlStringUtils.extractImportantUrlData(part);
    +  361  288 
                         sb.append(' ').append(StringUtils.join(data, ' '));
    +  362  0 
                     } catch (MalformedURLException ex) {
    +  363  0 
                         Logger.getLogger(EvidenceCollection.class.getName()).log(Level.INFO, "error parsing " + part, ex);
    +  364  0 
                         sb.append(' ').append(part);
    +  365  288 
                     }
    +  366   
                 } else {
    -  379  0 
                     sb.append(' ').append(part);
    -  380   +  367  0 
                     sb.append(' ').append(part);
    +  368   
                 }
    -  381   +  369   
             }
    -  382  133 
             return sb.toString().trim();
    -  383   +  370  288 
             return sb.toString().trim();
    +  371   
         }
    -  384   +  372   
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.Identifier.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.Identifier.html index 17ed8af50..54c56d3c8 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.Identifier.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.Identifier.html @@ -12,7 +12,7 @@
     
    - +
    Classes in this File Line Coverage Branch Coverage Complexity
    Identifier
    41%
    16/39
    13%
    3/22
    		2
    Identifier
    45%
    19/42
    13%
    3/22
    		1.875
     
    @@ -24,115 +24,115 @@  3   
      *
     4   - 
      * Dependency-check-core is free software: you can redistribute it and/or modify it
    + 
      * Licensed under the Apache License, Version 2.0 (the "License");
     5   - 
      * under the terms of the GNU General Public License as published by the Free
    + 
      * you may not use this file except in compliance with the License.
     6   - 
      * Software Foundation, either version 3 of the License, or (at your option) any
    + 
      * You may obtain a copy of the License at
     7   - 
      * later version.
    + 
      *
     8   - 
      *
    + 
      *     http://www.apache.org/licenses/LICENSE-2.0
     9   - 
      * Dependency-check-core is distributed in the hope that it will be useful, but
    + 
      *
     10   - 
      * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
    + 
      * Unless required by applicable law or agreed to in writing, software
     11   - 
      * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
    + 
      * distributed under the License is distributed on an "AS IS" BASIS,
     12   - 
      * details.
    + 
      * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13   - 
      *
    + 
      * See the License for the specific language governing permissions and
     14   - 
      * You should have received a copy of the GNU General Public License along with
    + 
      * limitations under the License.
     15   - 
      * dependency-check-core. If not, see http://www.gnu.org/licenses/.
    + 
      *
     16   - 
      *
    -  17   
      * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
    +  17   + 
      */
     18   - 
      */
    -  19   
     package org.owasp.dependencycheck.dependency;
    +  19   + 
     
     20   - 
     
    -  21   
     /**
    -  22   +  21   
      *
    -  23   +  22   
      * @author Jeremy Long <jeremy.long@owasp.org>
    -  24   +  23   
      */
    -  25  148 
     public class Identifier implements Comparable<Identifier> {
    +  24  408 
     public class Identifier implements Comparable<Identifier> {
    +  25   + 
     
     26   - 
     
    + 
         /**
     27   - 
         /**
    + 
          * Constructs a new Identifier with the specified data.
     28   - 
          * Constructs a new Identifier with the specified data.
    + 
          *
     29   - 
          *
    + 
          * @param type the identifier type.
     30   - 
          * @param type the identifier type.
    + 
          * @param value the identifier value.
     31   - 
          * @param value the identifier value.
    + 
          * @param url the identifier url.
     32   - 
          * @param url the identifier url.
    -  33   
          */
    -  34  251 
         public Identifier(String type, String value, String url) {
    -  35  251 
             this.type = type;
    -  36  251 
             this.value = value;
    -  37  251 
             this.url = url;
    -  38  251 
         }
    -  39   +  33  578 
         public Identifier(String type, String value, String url) {
    +  34  578 
             this.type = type;
    +  35  578 
             this.value = value;
    +  36  578 
             this.url = url;
    +  37  578 
         }
    +  38   
     
    -  40   +  39   
         /**
    -  41   +  40   
          * Constructs a new Identifier with the specified data.
    -  42   +  41   
          *
    -  43   +  42   
          * @param type the identifier type.
    -  44   +  43   
          * @param value the identifier value.
    -  45   +  44   
          * @param url the identifier url.
    -  46   +  45   
          * @param description the description of the identifier.
    -  47   +  46   
          */
    -  48   +  47   
         public Identifier(String type, String value, String url, String description) {
    -  49  0 
             this(type, value, url);
    -  50  0 
             this.description = description;
    -  51  0 
         }
    +  48  0 
             this(type, value, url);
    +  49  0 
             this.description = description;
    +  50  0 
         }
    +  51   + 
     
     52   
         /**
     53   - 
          * The value of the identifier
    + 
          * The confidence that this is the correct identifier.
     54   
          */
     55   - 
         private String value;
    + 
         private Confidence confidence;
     56   
     
     57   
         /**
     58   - 
          * Get the value of value.
    + 
          * Get the value of confidence.
     59   
          *
     60   - 
          * @return the value of value
    + 
          * @return the value of confidence
     61   
          */
     62   - 
         public String getValue() {
    -  63  384 
             return value;
    + 
         public Confidence getConfidence() {
    +  63  32 
             return confidence;
     64   
         }
     65   @@ -140,226 +140,271 @@  66   
         /**
     67   - 
          * Set the value of value.
    + 
          * Set the value of confidence.
     68   
          *
     69   - 
          * @param value new value of value
    + 
          * @param confidence new value of confidence
     70   
          */
     71   - 
         public void setValue(String value) {
    -  72  0 
             this.value = value;
    -  73  0 
         }
    + 
         public void setConfidence(Confidence confidence) {
    +  72  226 
             this.confidence = confidence;
    +  73  226 
         }
     74   - 
         /**
    + 
     
     75   - 
          * The url for the identifier.
    + 
         /**
     76   - 
          */
    + 
          * The value of the identifier
     77   - 
         private String url;
    + 
          */
     78   - 
     
    + 
         private String value;
     79   - 
         /**
    + 
     
     80   - 
          * Get the value of url.
    + 
         /**
     81   - 
          *
    + 
          * Get the value of value.
     82   - 
          * @return the value of url
    + 
          *
     83   - 
          */
    + 
          * @return the value of value
     84   - 
         public String getUrl() {
    -  85  9 
             return url;
    -  86   - 
         }
    + 
          */
    +  85   + 
         public String getValue() {
    +  86  826 
             return value;
     87   - 
     
    + 
         }
     88   - 
         /**
    + 
     
     89   - 
          * Set the value of url.
    + 
         /**
     90   - 
          *
    + 
          * Set the value of value.
     91   - 
          * @param url new value of url
    + 
          *
     92   - 
          */
    + 
          * @param value new value of value
     93   - 
         public void setUrl(String url) {
    -  94  0 
             this.url = url;
    -  95  0 
         }
    -  96   - 
         /**
    + 
          */
    +  94   + 
         public void setValue(String value) {
    +  95  0 
             this.value = value;
    +  96  0 
         }
     97   - 
          * The type of the identifier.
    + 
         /**
     98   - 
          */
    + 
          * The url for the identifier.
     99   - 
         private String type;
    + 
          */
     100   - 
     
    + 
         private String url;
     101   - 
         /**
    + 
     
     102   - 
          * Get the value of type.
    + 
         /**
     103   - 
          *
    + 
          * Get the value of url.
     104   - 
          * @return the value of type
    + 
          *
     105   - 
          */
    + 
          * @return the value of url
     106   - 
         public String getType() {
    -  107  90 
             return type;
    -  108   - 
         }
    + 
          */
    +  107   + 
         public String getUrl() {
    +  108  30 
             return url;
     109   - 
     
    + 
         }
     110   - 
         /**
    + 
     
     111   - 
          * <p>Set the value of type.</p><p>Example would be "CPE".</p>
    + 
         /**
     112   - 
          *
    + 
          * Set the value of url.
     113   - 
          * @param type new value of type
    + 
          *
     114   - 
          */
    + 
          * @param url new value of url
     115   - 
         public void setType(String type) {
    -  116  0 
             this.type = type;
    -  117  0 
         }
    -  118   - 
         /**
    + 
          */
    +  116   + 
         public void setUrl(String url) {
    +  117  0 
             this.url = url;
    +  118  0 
         }
     119   - 
          * A description of the identifier.
    + 
         /**
     120   - 
          */
    + 
          * The type of the identifier.
     121   - 
         private String description;
    + 
          */
     122   - 
     
    + 
         private String type;
     123   - 
         /**
    + 
     
     124   - 
          * Get the value of description.
    + 
         /**
     125   - 
          *
    + 
          * Get the value of type.
     126   - 
          * @return the value of description
    + 
          *
     127   - 
          */
    + 
          * @return the value of type
     128   - 
         public String getDescription() {
    -  129  5 
             return description;
    -  130   - 
         }
    + 
          */
    +  129   + 
         public String getType() {
    +  130  266 
             return type;
     131   - 
     
    + 
         }
     132   - 
         /**
    + 
     
     133   - 
          * Set the value of description.
    + 
         /**
     134   - 
          *
    + 
          * <p>
     135   - 
          * @param description new value of description
    + 
          * Set the value of type.</p><p>
     136   - 
          */
    + 
          * Example would be "CPE".</p>
     137   - 
         public void setDescription(String description) {
    -  138  0 
             this.description = description;
    -  139  0 
         }
    + 
          *
    +  138   + 
          * @param type new value of type
    +  139   + 
          */
     140   - 
     
    -  141   - 
         @Override
    -  142   - 
         public boolean equals(Object obj) {
    -  143  0 
             if (obj == null) {
    -  144  0 
                 return false;
    + 
         public void setType(String type) {
    +  141  0 
             this.type = type;
    +  142  0 
         }
    +  143   + 
         /**
    +  144   + 
          * A description of the identifier.
     145   - 
             }
    -  146  0 
             if (getClass() != obj.getClass()) {
    -  147  0 
                 return false;
    + 
          */
    +  146   + 
         private String description;
    +  147   + 
     
     148   - 
             }
    -  149  0 
             final Identifier other = (Identifier) obj;
    -  150  0 
             if ((this.value == null) ? (other.value != null) : !this.value.equals(other.value)) {
    -  151  0 
                 return false;
    + 
         /**
    +  149   + 
          * Get the value of description.
    +  150   + 
          *
    +  151   + 
          * @return the value of description
     152   - 
             }
    -  153  0 
             if ((this.type == null) ? (other.type != null) : !this.type.equals(other.type)) {
    -  154  0 
                 return false;
    + 
          */
    +  153   + 
         public String getDescription() {
    +  154  16 
             return description;
     155   - 
             }
    -  156  0 
             return true;
    + 
         }
    +  156   + 
     
     157   - 
         }
    + 
         /**
     158   - 
     
    + 
          * Set the value of description.
     159   - 
         @Override
    + 
          *
     160   - 
         public int hashCode() {
    -  161  59 
             int hash = 5;
    -  162  59 
             hash = 53 * hash + (this.value != null ? this.value.hashCode() : 0);
    -  163  59 
             hash = 53 * hash + (this.type != null ? this.type.hashCode() : 0);
    -  164  59 
             return hash;
    + 
          * @param description new value of description
    +  161   + 
          */
    +  162   + 
         public void setDescription(String description) {
    +  163  0 
             this.description = description;
    +  164  0 
         }
     165   - 
         }
    + 
     
     166   - 
     
    -  167   - 
         /**
    -  168   - 
          * Standard implementation of toString; displays identifier value and type.
    -  169   - 
          *
    -  170   - 
          * @return a String representation of the object
    -  171   - 
          */
    -  172   
         @Override
    -  173   - 
         public String toString() {
    -  174  0 
             return "Identifier{" + "value=" + value + ", type=" + type + '}';
    -  175   - 
         }
    -  176   - 
     
    -  177   - 
         /**
    -  178   - 
          * Implementation of the comparator interface. This compares the value of
    -  179   - 
          * the identifier only.
    -  180   - 
          *
    -  181   - 
          * @param o the object being compared
    -  182   - 
          * @return an integer indicating the ordering
    -  183   - 
          */
    -  184   - 
         public int compareTo(Identifier o) {
    -  185  231 
             if (o == null) {
    -  186  0 
                 return -1;
    -  187   +  167   + 
         public boolean equals(Object obj) {
    +  168  0 
             if (obj == null) {
    +  169  0 
                 return false;
    +  170   
             }
    -  188  231 
             return this.value.compareTo(o.value);
    -  189   +  171  0 
             if (getClass() != obj.getClass()) {
    +  172  0 
                 return false;
    +  173   + 
             }
    +  174  0 
             final Identifier other = (Identifier) obj;
    +  175  0 
             if ((this.value == null) ? (other.value != null) : !this.value.equals(other.value)) {
    +  176  0 
                 return false;
    +  177   + 
             }
    +  178  0 
             if ((this.type == null) ? (other.type != null) : !this.type.equals(other.type)) {
    +  179  0 
                 return false;
    +  180   + 
             }
    +  181  0 
             return true;
    +  182   
         }
    +  183   + 
     
    +  184   + 
         @Override
    +  185   + 
         public int hashCode() {
    +  186  188 
             int hash = 5;
    +  187  188 
             hash = 53 * hash + (this.value != null ? this.value.hashCode() : 0);
    +  188  188 
             hash = 53 * hash + (this.type != null ? this.type.hashCode() : 0);
    +  189  188 
             return hash;
     190   + 
         }
    +  191   + 
     
    +  192   + 
         /**
    +  193   + 
          * Standard implementation of toString; displays identifier value and type.
    +  194   + 
          *
    +  195   + 
          * @return a String representation of the object
    +  196   + 
          */
    +  197   + 
         @Override
    +  198   + 
         public String toString() {
    +  199  0 
             return "Identifier{" + "value=" + value + ", type=" + type + '}';
    +  200   + 
         }
    +  201   + 
     
    +  202   + 
         /**
    +  203   + 
          * Implementation of the comparator interface. This compares the value of the identifier only.
    +  204   + 
          *
    +  205   + 
          * @param o the object being compared
    +  206   + 
          * @return an integer indicating the ordering
    +  207   + 
          */
    +  208   + 
         public int compareTo(Identifier o) {
    +  209  694 
             if (o == null) {
    +  210  0 
                 return -1;
    +  211   + 
             }
    +  212  694 
             return this.value.compareTo(o.value);
    +  213   + 
         }
    +  214   
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.Reference.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.Reference.html index 583478f64..6cdce479b 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.Reference.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.Reference.html @@ -24,273 +24,269 @@  3   
      *
     4   - 
      * Dependency-check-core is free software: you can redistribute it and/or modify it
    + 
      * Licensed under the Apache License, Version 2.0 (the "License");
     5   - 
      * under the terms of the GNU General Public License as published by the Free
    + 
      * you may not use this file except in compliance with the License.
     6   - 
      * Software Foundation, either version 3 of the License, or (at your option) any
    + 
      * You may obtain a copy of the License at
     7   - 
      * later version.
    + 
      *
     8   - 
      *
    + 
      *     http://www.apache.org/licenses/LICENSE-2.0
     9   - 
      * Dependency-check-core is distributed in the hope that it will be useful, but
    + 
      *
     10   - 
      * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
    + 
      * Unless required by applicable law or agreed to in writing, software
     11   - 
      * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
    + 
      * distributed under the License is distributed on an "AS IS" BASIS,
     12   - 
      * details.
    + 
      * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13   - 
      *
    + 
      * See the License for the specific language governing permissions and
     14   - 
      * You should have received a copy of the GNU General Public License along with
    + 
      * limitations under the License.
     15   - 
      * dependency-check-core. If not, see http://www.gnu.org/licenses/.
    + 
      *
     16   - 
      *
    -  17   
      * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
    +  17   + 
      */
     18   - 
      */
    -  19   
     package org.owasp.dependencycheck.dependency;
    +  19   + 
     
     20   - 
     
    -  21   
     import java.io.Serializable;
    +  21   + 
     
     22   - 
     
    -  23   
     /**
    +  23   + 
      * An external reference for a vulnerability. This contains a name, URL, and a source.
     24   - 
      * An external reference for a vulnerability. This contains a name, URL, and a
    -  25   - 
      * source.
    -  26   
      *
    -  27   +  25   
      * @author Jeremy Long <jeremy.long@owasp.org>
    -  28   +  26   
      */
    -  29  1695 
     public class Reference implements Serializable, Comparable<Reference> {
    +  27  3486 
     public class Reference implements Serializable, Comparable<Reference> {
    +  28   + 
     
    +  29   + 
         /**
     30   - 
     
    -  31   - 
         /**
    -  32   
          * the serial version uid.
    -  33   +  31   
          */
    -  34   +  32   
         private static final long serialVersionUID = -3444464824563008021L;
    -  35   +  33   
         /**
    -  36   +  34   
          * The name of the reference.
    -  37   +  35   
          */
    -  38   +  36   
         private String name;
    +  37   + 
     
    +  38   + 
         /**
     39   - 
     
    -  40   - 
         /**
    -  41   
          * Get the value of name.
    -  42   +  40   
          *
    -  43   +  41   
          * @return the value of name
    -  44   +  42   
          */
    -  45   +  43   
         public String getName() {
    -  46  217 
             return name;
    +  44  448 
             return name;
    +  45   + 
         }
    +  46   + 
     
     47   - 
         }
    + 
         /**
     48   - 
     
    -  49   - 
         /**
    -  50   
          * Set the value of name.
    -  51   +  49   
          *
    -  52   +  50   
          * @param name new value of name
    -  53   +  51   
          */
    -  54   +  52   
         public void setName(String name) {
    -  55  506 
             this.name = name;
    -  56  506 
         }
    -  57   +  53  1040 
             this.name = name;
    +  54  1040 
         }
    +  55   
         /**
    -  58   +  56   
          * the url for the reference.
    -  59   +  57   
          */
    -  60   +  58   
         private String url;
    +  59   + 
     
    +  60   + 
         /**
     61   - 
     
    -  62   - 
         /**
    -  63   
          * Get the value of url.
    -  64   +  62   
          *
    -  65   +  63   
          * @return the value of url
    -  66   +  64   
          */
    -  67   +  65   
         public String getUrl() {
    -  68  217 
             return url;
    +  66  448 
             return url;
    +  67   + 
         }
    +  68   + 
     
     69   - 
         }
    + 
         /**
     70   - 
     
    -  71   - 
         /**
    -  72   
          * Set the value of url.
    -  73   +  71   
          *
    -  74   +  72   
          * @param url new value of url
    -  75   +  73   
          */
    -  76   +  74   
         public void setUrl(String url) {
    -  77  506 
             this.url = url;
    -  78  506 
         }
    -  79   +  75  1040 
             this.url = url;
    +  76  1040 
         }
    +  77   
         /**
    -  80   +  78   
          * the source of the reference.
    -  81   +  79   
          */
    -  82   +  80   
         private String source;
    +  81   + 
     
    +  82   + 
         /**
     83   - 
     
    -  84   - 
         /**
    -  85   
          * Get the value of source.
    -  86   +  84   
          *
    -  87   +  85   
          * @return the value of source
    -  88   +  86   
          */
    -  89   +  87   
         public String getSource() {
    -  90  217 
             return source;
    +  88  448 
             return source;
    +  89   + 
         }
    +  90   + 
     
     91   - 
         }
    + 
         /**
     92   - 
     
    -  93   - 
         /**
    -  94   
          * Set the value of source.
    -  95   +  93   
          *
    -  96   +  94   
          * @param source new value of source
    -  97   +  95   
          */
    -  98   +  96   
         public void setSource(String source) {
    -  99  506 
             this.source = source;
    -  100  506 
         }
    +  97  1040 
             this.source = source;
    +  98  1040 
         }
    +  99   + 
     
    +  100   + 
         @Override
     101   - 
     
    -  102   - 
         @Override
    -  103   
         public boolean equals(Object obj) {
    -  104  0 
             if (obj == null) {
    -  105  0 
                 return false;
    -  106   +  102  0 
             if (obj == null) {
    +  103  0 
                 return false;
    +  104   
             }
    -  107  0 
             if (getClass() != obj.getClass()) {
    -  108  0 
                 return false;
    -  109   +  105  0 
             if (getClass() != obj.getClass()) {
    +  106  0 
                 return false;
    +  107   
             }
    -  110  0 
             final Reference other = (Reference) obj;
    -  111  0 
             if ((this.name == null) ? (other.name != null) : !this.name.equals(other.name)) {
    -  112  0 
                 return false;
    -  113   +  108  0 
             final Reference other = (Reference) obj;
    +  109  0 
             if ((this.name == null) ? (other.name != null) : !this.name.equals(other.name)) {
    +  110  0 
                 return false;
    +  111   
             }
    -  114  0 
             if ((this.url == null) ? (other.url != null) : !this.url.equals(other.url)) {
    -  115  0 
                 return false;
    -  116   +  112  0 
             if ((this.url == null) ? (other.url != null) : !this.url.equals(other.url)) {
    +  113  0 
                 return false;
    +  114   
             }
    -  117  0 
             if ((this.source == null) ? (other.source != null) : !this.source.equals(other.source)) {
    -  118  0 
                 return false;
    +  115  0 
             if ((this.source == null) ? (other.source != null) : !this.source.equals(other.source)) {
    +  116  0 
                 return false;
    +  117   + 
             }
    +  118  0 
             return true;
     119   - 
             }
    -  120  0 
             return true;
    + 
         }
    +  120   + 
     
     121   - 
         }
    -  122   - 
     
    -  123   
         @Override
    -  124   +  122   
         public int hashCode() {
    -  125  0 
             int hash = 5;
    -  126  0 
             hash = 67 * hash + (this.name != null ? this.name.hashCode() : 0);
    -  127  0 
             hash = 67 * hash + (this.url != null ? this.url.hashCode() : 0);
    -  128  0 
             hash = 67 * hash + (this.source != null ? this.source.hashCode() : 0);
    -  129  0 
             return hash;
    -  130   +  123  0 
             int hash = 5;
    +  124  0 
             hash = 67 * hash + (this.name != null ? this.name.hashCode() : 0);
    +  125  0 
             hash = 67 * hash + (this.url != null ? this.url.hashCode() : 0);
    +  126  0 
             hash = 67 * hash + (this.source != null ? this.source.hashCode() : 0);
    +  127  0 
             return hash;
    +  128   
         }
    -  131   +  129   
     
    -  132   +  130   
         /**
    -  133   +  131   
          * Implementation of the comparable interface.
    -  134   +  132   
          *
    -  135   +  133   
          * @param o the Reference being compared
    -  136   +  134   
          * @return an integer indicating the ordering of the two objects
    -  137   +  135   
          */
    -  138   +  136   
         public int compareTo(Reference o) {
    -  139  1189 
             if (source.equals(o.source)) {
    -  140  263 
                 if (name.equals(o.name)) {
    -  141  87 
                     if (url.equals(o.url)) {
    -  142  87 
                         return 0; //they are equal
    -  143   +  137  2446 
             if (source.equals(o.source)) {
    +  138  530 
                 if (name.equals(o.name)) {
    +  139  174 
                     if (url.equals(o.url)) {
    +  140  174 
                         return 0; //they are equal
    +  141   
                     } else {
    -  144  0 
                         return url.compareTo(o.url);
    -  145   +  142  0 
                         return url.compareTo(o.url);
    +  143   
                     }
    -  146   +  144   
                 } else {
    -  147  176 
                     return name.compareTo(o.name);
    -  148   +  145  356 
                     return name.compareTo(o.name);
    +  146   
                 }
    -  149   +  147   
             } else {
    -  150  926 
                 return source.compareTo(o.source);
    -  151   +  148  1916 
                 return source.compareTo(o.source);
    +  149   
             }
    -  152   +  150   
         }
    -  153   +  151   
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.Vulnerability.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.Vulnerability.html index 48ae2ae45..acdc512fb 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.Vulnerability.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.Vulnerability.html @@ -12,7 +12,7 @@
     
    - +
    Classes in this File Line Coverage Branch Coverage Complexity
    Vulnerability
    70%
    48/68
    25%
    4/16
    		1.312
    Vulnerability
    68%
    51/74
    22%
    4/18
    		1.278
     
    @@ -24,729 +24,815 @@  3   
      *
     4   - 
      * Dependency-check-core is free software: you can redistribute it and/or modify it
    + 
      * Licensed under the Apache License, Version 2.0 (the "License");
     5   - 
      * under the terms of the GNU General Public License as published by the Free
    + 
      * you may not use this file except in compliance with the License.
     6   - 
      * Software Foundation, either version 3 of the License, or (at your option) any
    + 
      * You may obtain a copy of the License at
     7   - 
      * later version.
    + 
      *
     8   - 
      *
    + 
      *     http://www.apache.org/licenses/LICENSE-2.0
     9   - 
      * Dependency-check-core is distributed in the hope that it will be useful, but
    + 
      *
     10   - 
      * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
    + 
      * Unless required by applicable law or agreed to in writing, software
     11   - 
      * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
    + 
      * distributed under the License is distributed on an "AS IS" BASIS,
     12   - 
      * details.
    + 
      * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13   - 
      *
    + 
      * See the License for the specific language governing permissions and
     14   - 
      * You should have received a copy of the GNU General Public License along with
    + 
      * limitations under the License.
     15   - 
      * dependency-check-core. If not, see http://www.gnu.org/licenses/.
    + 
      *
     16   - 
      *
    -  17   
      * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
    +  17   + 
      */
     18   - 
      */
    -  19   
     package org.owasp.dependencycheck.dependency;
    +  19   + 
     
     20   - 
     
    -  21   
     import java.io.Serializable;
    -  22   +  21   
     import java.util.Set;
    -  23   +  22   
     import java.util.SortedSet;
    -  24   +  23   
     import java.util.TreeSet;
    +  24   + 
     
     25   - 
     
    -  26   
     /**
    -  27   +  26   
      * Contains the information about a vulnerability.
    -  28   +  27   
      *
    -  29   +  28   
      * @author Jeremy Long <jeremy.long@owasp.org>
    -  30   +  29   
      */
    -  31  89 
     public class Vulnerability implements Serializable, Comparable<Vulnerability> {
    +  30  178 
     public class Vulnerability implements Serializable, Comparable<Vulnerability> {
    +  31   + 
     
     32   - 
     
    + 
         /**
     33   - 
         /**
    -  34   
          * The serial version uid.
    +  34   + 
          */
     35   - 
          */
    -  36   
         private static final long serialVersionUID = 307319490326651052L;
    +  36   + 
         /**
     37   - 
         /**
    -  38   
          * The name of the vulnerability.
    +  38   + 
          */
     39   - 
          */
    -  40   
         private String name;
    +  40   + 
     
     41   - 
     
    + 
         /**
     42   - 
         /**
    -  43   
          * Get the value of name.
    +  43   + 
          *
     44   - 
          *
    -  45   
          * @return the value of name
    +  45   + 
          */
     46   - 
          */
    -  47   
         public String getName() {
    -  48  248 
             return name;
    +  47  524 
             return name;
    +  48   + 
         }
     49   - 
         }
    + 
     
     50   - 
     
    + 
         /**
     51   - 
         /**
    -  52   
          * Set the value of name.
    +  52   + 
          *
     53   - 
          *
    -  54   
          * @param name new value of name
    +  54   + 
          */
     55   - 
          */
    -  56   
         public void setName(String name) {
    -  57  89 
             this.name = name;
    -  58  89 
         }
    +  56  178 
             this.name = name;
    +  57  178 
         }
    +  58   + 
         /**
     59   - 
         /**
    -  60   
          * the description of the vulnerability.
    +  60   + 
          */
     61   - 
          */
    -  62   
         private String description;
    +  62   + 
     
     63   - 
     
    + 
         /**
     64   - 
         /**
    -  65   
          * Get the value of description.
    +  65   + 
          *
     66   - 
          *
    -  67   
          * @return the value of description
    +  67   + 
          */
     68   - 
          */
    -  69   
         public String getDescription() {
    -  70  31 
             return description;
    +  69  62 
             return description;
    +  70   + 
         }
     71   - 
         }
    + 
     
     72   - 
     
    + 
         /**
     73   - 
         /**
    -  74   
          * Set the value of description.
    +  74   + 
          *
     75   - 
          *
    -  76   
          * @param description new value of description
    +  76   + 
          */
     77   - 
          */
    -  78   
         public void setDescription(String description) {
    -  79  88 
             this.description = description;
    -  80  88 
         }
    +  78  176 
             this.description = description;
    +  79  176 
         }
    +  80   + 
         /**
     81   - 
         /**
    -  82   
          * References for this vulnerability.
    -  83   +  82   
          */
    -  84  89 
         private SortedSet<Reference> references = new TreeSet<Reference>();
    +  83  178 
         private SortedSet<Reference> references = new TreeSet<Reference>();
    +  84   + 
     
     85   - 
     
    + 
         /**
     86   - 
         /**
    -  87   
          * Get the value of references.
    +  87   + 
          *
     88   - 
          *
    -  89   
          * @return the value of references
    +  89   + 
          */
     90   - 
          */
    -  91   
         public Set<Reference> getReferences() {
    -  92  31 
             return references;
    +  91  62 
             return references;
    +  92   + 
         }
     93   - 
         }
    + 
     
     94   - 
     
    + 
         /**
     95   - 
         /**
    -  96   
          * Set the value of references.
    +  96   + 
          *
     97   - 
          *
    -  98   
          * @param references new value of references
    +  98   + 
          */
     99   - 
          */
    -  100   
         public void setReferences(SortedSet<Reference> references) {
    -  101  0 
             this.references = references;
    -  102  0 
         }
    +  100  0 
             this.references = references;
    +  101  0 
         }
    +  102   + 
     
     103   - 
     
    + 
         /**
     104   - 
         /**
    -  105   
          * Adds a reference to the references collection.
    +  105   + 
          *
     106   - 
          *
    -  107   
          * @param ref a reference for the vulnerability
    +  107   + 
          */
     108   - 
          */
    -  109   
         public void addReference(Reference ref) {
    -  110  90 
             this.references.add(ref);
    -  111  90 
         }
    +  109  180 
             this.references.add(ref);
    +  110  180 
         }
    +  111   + 
     
     112   - 
     
    + 
         /**
     113   - 
         /**
    -  114   
          * Adds a reference.
    +  114   + 
          *
     115   - 
          *
    -  116   
          * @param referenceSource the source of the reference
    -  117   +  116   
          * @param referenceName the referenceName of the reference
    -  118   +  117   
          * @param referenceUrl the url of the reference
    +  118   + 
          */
     119   - 
          */
    -  120   
         public void addReference(String referenceSource, String referenceName, String referenceUrl) {
    -  121  416 
             final Reference ref = new Reference();
    -  122  416 
             ref.setSource(referenceSource);
    -  123  416 
             ref.setName(referenceName);
    -  124  416 
             ref.setUrl(referenceUrl);
    -  125  416 
             this.references.add(ref);
    -  126  416 
         }
    +  120  860 
             final Reference ref = new Reference();
    +  121  860 
             ref.setSource(referenceSource);
    +  122  860 
             ref.setName(referenceName);
    +  123  860 
             ref.setUrl(referenceUrl);
    +  124  860 
             this.references.add(ref);
    +  125  860 
         }
    +  126   + 
         /**
     127   - 
         /**
    -  128   
          * A set of vulnerable software.
    -  129   +  128   
          */
    -  130  89 
         private SortedSet<VulnerableSoftware> vulnerableSoftware = new TreeSet<VulnerableSoftware>();
    +  129  178 
         private SortedSet<VulnerableSoftware> vulnerableSoftware = new TreeSet<VulnerableSoftware>();
    +  130   + 
     
     131   - 
     
    + 
         /**
     132   - 
         /**
    -  133   
          * Get the value of vulnerableSoftware.
    +  133   + 
          *
     134   - 
          *
    -  135   
          * @return the value of vulnerableSoftware
    +  135   + 
          */
     136   - 
          */
    -  137   
         public Set<VulnerableSoftware> getVulnerableSoftware() {
    -  138  31 
             return vulnerableSoftware;
    +  137  62 
             return vulnerableSoftware;
    +  138   + 
         }
     139   - 
         }
    + 
     
     140   - 
     
    + 
         /**
     141   - 
         /**
    -  142   
          * Set the value of vulnerableSoftware.
    +  142   + 
          *
     143   - 
          *
    -  144   
          * @param vulnerableSoftware new value of vulnerableSoftware
    +  144   + 
          */
     145   - 
          */
    -  146   
         public void setVulnerableSoftware(SortedSet<VulnerableSoftware> vulnerableSoftware) {
    -  147  0 
             this.vulnerableSoftware = vulnerableSoftware;
    -  148  0 
         }
    +  146  0 
             this.vulnerableSoftware = vulnerableSoftware;
    +  147  0 
         }
    +  148   + 
     
     149   - 
     
    + 
         /**
     150   - 
         /**
    + 
          * Adds an entry for vulnerable software.
     151   - 
          * Adds an entry for vulnerable software.
    + 
          *
     152   - 
          *
    -  153   
          * @param cpe string representation of a CPE entry
    +  153   + 
          * @return if the add succeeded
     154   - 
          * @return if the add succeeded
    + 
          */
     155   - 
          */
    -  156   
         public boolean addVulnerableSoftware(String cpe) {
    -  157  3276 
             return addVulnerableSoftware(cpe, null);
    +  156  6552 
             return addVulnerableSoftware(cpe, null);
    +  157   + 
         }
     158   - 
         }
    + 
     
     159   - 
     
    + 
         /**
     160   - 
         /**
    -  161   
          * Adds an entry for vulnerable software.
    +  161   + 
          *
     162   - 
          *
    -  163   
          * @param cpe string representation of a cpe
    +  163   + 
          * @param previousVersion the previous version (previousVersion - cpe would be considered vulnerable)
     164   - 
          * @param previousVersion the previous version (previousVersion - cpe would
    -  165   - 
          * be considered vulnerable)
    -  166   
          * @return if the add succeeded
    -  167   +  165   
          */
    -  168   +  166   
         public boolean addVulnerableSoftware(String cpe, String previousVersion) {
    -  169  3318 
             final VulnerableSoftware vs = new VulnerableSoftware();
    -  170  3318 
             vs.setCpe(cpe);
    -  171  3318 
             if (previousVersion != null) {
    -  172  42 
                 vs.setPreviousVersion(previousVersion);
    +  167  6636 
             final VulnerableSoftware vs = new VulnerableSoftware();
    +  168  6636 
             vs.setCpe(cpe);
    +  169  6636 
             if (previousVersion != null) {
    +  170  84 
                 vs.setPreviousVersion(previousVersion);
    +  171   + 
             }
    +  172  6636 
             return updateVulnerableSoftware(vs);
     173   - 
             }
    -  174  3318 
             return updateVulnerableSoftware(vs);
    + 
         }
    +  174   + 
     
     175   - 
         }
    + 
         /**
     176   - 
     
    -  177   - 
         /**
    -  178   
          * Adds or updates a vulnerable software entry.
    -  179   +  177   
          *
    -  180   +  178   
          * @param vulnSoftware the vulnerable software
    -  181   +  179   
          * @return if the update succeeded
    -  182   +  180   
          */
    -  183   +  181   
         public boolean updateVulnerableSoftware(VulnerableSoftware vulnSoftware) {
    -  184  3318 
             if (vulnerableSoftware.contains(vulnSoftware)) {
    -  185  0 
                 vulnerableSoftware.remove(vulnSoftware);
    +  182  6636 
             if (vulnerableSoftware.contains(vulnSoftware)) {
    +  183  0 
                 vulnerableSoftware.remove(vulnSoftware);
    +  184   + 
             }
    +  185  6636 
             return vulnerableSoftware.add(vulnSoftware);
     186   - 
             }
    -  187  3318 
             return vulnerableSoftware.add(vulnSoftware);
    + 
         }
    +  187   + 
         /**
     188   - 
         }
    -  189   - 
         /**
    -  190   
          * The CWE for the vulnerability.
    -  191   +  189   
          */
    -  192   +  190   
         private String cwe;
    +  191   + 
     
    +  192   + 
         /**
     193   - 
     
    -  194   - 
         /**
    -  195   
          * Get the value of cwe.
    -  196   +  194   
          *
    -  197   +  195   
          * @return the value of cwe
    -  198   +  196   
          */
    -  199   +  197   
         public String getCwe() {
    -  200  62 
             return cwe;
    +  198  124 
             return cwe;
    +  199   + 
         }
    +  200   + 
     
     201   - 
         }
    + 
         /**
     202   - 
     
    -  203   - 
         /**
    -  204   
          * Set the value of cwe.
    -  205   +  203   
          *
    -  206   +  204   
          * @param cwe new value of cwe
    -  207   +  205   
          */
    -  208   +  206   
         public void setCwe(String cwe) {
    -  209  81 
             this.cwe = cwe;
    -  210  81 
         }
    -  211   +  207  162 
             this.cwe = cwe;
    +  208  162 
         }
    +  209   
         /**
    -  212   +  210   
          * CVSS Score.
    -  213   +  211   
          */
    -  214   +  212   
         private float cvssScore;
    +  213   + 
     
    +  214   + 
         /**
     215   - 
     
    -  216   - 
         /**
    -  217   
          * Get the value of cvssScore.
    -  218   +  216   
          *
    -  219   +  217   
          * @return the value of cvssScore
    -  220   +  218   
          */
    -  221   +  219   
         public float getCvssScore() {
    -  222  95 
             return cvssScore;
    +  220  190 
             return cvssScore;
    +  221   + 
         }
    +  222   + 
     
     223   - 
         }
    + 
         /**
     224   - 
     
    -  225   - 
         /**
    -  226   
          * Set the value of cvssScore.
    -  227   +  225   
          *
    -  228   +  226   
          * @param cvssScore new value of cvssScore
    -  229   +  227   
          */
    -  230   +  228   
         public void setCvssScore(float cvssScore) {
    -  231  88 
             this.cvssScore = cvssScore;
    -  232  88 
         }
    -  233   +  229  176 
             this.cvssScore = cvssScore;
    +  230  176 
         }
    +  231   
         /**
    -  234   +  232   
          * CVSS Access Vector.
    -  235   +  233   
          */
    -  236   +  234   
         private String cvssAccessVector;
    +  235   + 
     
    +  236   + 
         /**
     237   - 
     
    -  238   - 
         /**
    -  239   
          * Get the value of cvssAccessVector.
    -  240   +  238   
          *
    -  241   +  239   
          * @return the value of cvssAccessVector
    -  242   +  240   
          */
    -  243   +  241   
         public String getCvssAccessVector() {
    -  244  0 
             return cvssAccessVector;
    +  242  0 
             return cvssAccessVector;
    +  243   + 
         }
    +  244   + 
     
     245   - 
         }
    + 
         /**
     246   - 
     
    -  247   - 
         /**
    -  248   
          * Set the value of cvssAccessVector.
    -  249   +  247   
          *
    -  250   +  248   
          * @param cvssAccessVector new value of cvssAccessVector
    -  251   +  249   
          */
    -  252   +  250   
         public void setCvssAccessVector(String cvssAccessVector) {
    -  253  87 
             this.cvssAccessVector = cvssAccessVector;
    -  254  87 
         }
    -  255   +  251  174 
             this.cvssAccessVector = cvssAccessVector;
    +  252  174 
         }
    +  253   
         /**
    -  256   +  254   
          * CVSS Access Complexity.
    -  257   +  255   
          */
    -  258   +  256   
         private String cvssAccessComplexity;
    +  257   + 
     
    +  258   + 
         /**
     259   - 
     
    -  260   - 
         /**
    -  261   
          * Get the value of cvssAccessComplexity.
    -  262   +  260   
          *
    -  263   +  261   
          * @return the value of cvssAccessComplexity
    -  264   +  262   
          */
    -  265   +  263   
         public String getCvssAccessComplexity() {
    -  266  0 
             return cvssAccessComplexity;
    +  264  0 
             return cvssAccessComplexity;
    +  265   + 
         }
    +  266   + 
     
     267   - 
         }
    + 
         /**
     268   - 
     
    -  269   - 
         /**
    -  270   
          * Set the value of cvssAccessComplexity.
    -  271   +  269   
          *
    -  272   +  270   
          * @param cvssAccessComplexity new value of cvssAccessComplexity
    -  273   +  271   
          */
    -  274   +  272   
         public void setCvssAccessComplexity(String cvssAccessComplexity) {
    -  275  87 
             this.cvssAccessComplexity = cvssAccessComplexity;
    -  276  87 
         }
    -  277   +  273  174 
             this.cvssAccessComplexity = cvssAccessComplexity;
    +  274  174 
         }
    +  275   
         /**
    -  278   +  276   
          * CVSS Authentication.
    -  279   +  277   
          */
    -  280   +  278   
         private String cvssAuthentication;
    +  279   + 
     
    +  280   + 
         /**
     281   - 
     
    -  282   - 
         /**
    -  283   
          * Get the value of cvssAuthentication.
    -  284   +  282   
          *
    -  285   +  283   
          * @return the value of cvssAuthentication
    -  286   +  284   
          */
    -  287   +  285   
         public String getCvssAuthentication() {
    -  288  0 
             return cvssAuthentication;
    +  286  0 
             return cvssAuthentication;
    +  287   + 
         }
    +  288   + 
     
     289   - 
         }
    + 
         /**
     290   - 
     
    -  291   - 
         /**
    -  292   
          * Set the value of cvssAuthentication.
    -  293   +  291   
          *
    -  294   +  292   
          * @param cvssAuthentication new value of cvssAuthentication
    -  295   +  293   
          */
    -  296   +  294   
         public void setCvssAuthentication(String cvssAuthentication) {
    -  297  87 
             this.cvssAuthentication = cvssAuthentication;
    -  298  87 
         }
    -  299   +  295  174 
             this.cvssAuthentication = cvssAuthentication;
    +  296  174 
         }
    +  297   
         /**
    -  300   +  298   
          * CVSS Confidentiality Impact.
    -  301   +  299   
          */
    -  302   +  300   
         private String cvssConfidentialityImpact;
    +  301   + 
     
    +  302   + 
         /**
     303   - 
     
    -  304   - 
         /**
    -  305   
          * Get the value of cvssConfidentialityImpact.
    -  306   +  304   
          *
    -  307   +  305   
          * @return the value of cvssConfidentialityImpact
    -  308   +  306   
          */
    -  309   +  307   
         public String getCvssConfidentialityImpact() {
    -  310  0 
             return cvssConfidentialityImpact;
    +  308  0 
             return cvssConfidentialityImpact;
    +  309   + 
         }
    +  310   + 
     
     311   - 
         }
    + 
         /**
     312   - 
     
    -  313   - 
         /**
    -  314   
          * Set the value of cvssConfidentialityImpact.
    -  315   +  313   
          *
    -  316   +  314   
          * @param cvssConfidentialityImpact new value of cvssConfidentialityImpact
    -  317   +  315   
          */
    -  318   +  316   
         public void setCvssConfidentialityImpact(String cvssConfidentialityImpact) {
    -  319  87 
             this.cvssConfidentialityImpact = cvssConfidentialityImpact;
    -  320  87 
         }
    -  321   +  317  174 
             this.cvssConfidentialityImpact = cvssConfidentialityImpact;
    +  318  174 
         }
    +  319   
         /**
    -  322   +  320   
          * CVSS Integrity Impact.
    -  323   +  321   
          */
    -  324   +  322   
         private String cvssIntegrityImpact;
    +  323   + 
     
    +  324   + 
         /**
     325   - 
     
    -  326   - 
         /**
    -  327   
          * Get the value of cvssIntegrityImpact.
    -  328   +  326   
          *
    -  329   +  327   
          * @return the value of cvssIntegrityImpact
    -  330   +  328   
          */
    -  331   +  329   
         public String getCvssIntegrityImpact() {
    -  332  0 
             return cvssIntegrityImpact;
    +  330  0 
             return cvssIntegrityImpact;
    +  331   + 
         }
    +  332   + 
     
     333   - 
         }
    + 
         /**
     334   - 
     
    -  335   - 
         /**
    -  336   
          * Set the value of cvssIntegrityImpact.
    -  337   +  335   
          *
    -  338   +  336   
          * @param cvssIntegrityImpact new value of cvssIntegrityImpact
    -  339   +  337   
          */
    -  340   +  338   
         public void setCvssIntegrityImpact(String cvssIntegrityImpact) {
    -  341  87 
             this.cvssIntegrityImpact = cvssIntegrityImpact;
    -  342  87 
         }
    -  343   +  339  174 
             this.cvssIntegrityImpact = cvssIntegrityImpact;
    +  340  174 
         }
    +  341   
         /**
    -  344   +  342   
          * CVSS Availability Impact.
    -  345   +  343   
          */
    -  346   +  344   
         private String cvssAvailabilityImpact;
    +  345   + 
     
    +  346   + 
         /**
     347   - 
     
    -  348   - 
         /**
    -  349   
          * Get the value of cvssAvailabilityImpact.
    -  350   +  348   
          *
    -  351   +  349   
          * @return the value of cvssAvailabilityImpact
    -  352   +  350   
          */
    -  353   +  351   
         public String getCvssAvailabilityImpact() {
    -  354  0 
             return cvssAvailabilityImpact;
    +  352  0 
             return cvssAvailabilityImpact;
    +  353   + 
         }
    +  354   + 
     
     355   - 
         }
    + 
         /**
     356   - 
     
    -  357   - 
         /**
    -  358   
          * Set the value of cvssAvailabilityImpact.
    -  359   +  357   
          *
    -  360   +  358   
          * @param cvssAvailabilityImpact new value of cvssAvailabilityImpact
    -  361   +  359   
          */
    -  362   +  360   
         public void setCvssAvailabilityImpact(String cvssAvailabilityImpact) {
    -  363  87 
             this.cvssAvailabilityImpact = cvssAvailabilityImpact;
    -  364  87 
         }
    +  361  174 
             this.cvssAvailabilityImpact = cvssAvailabilityImpact;
    +  362  174 
         }
    +  363   + 
     
    +  364   + 
         @Override
     365   - 
     
    -  366   - 
         @Override
    -  367   
         public boolean equals(Object obj) {
    -  368  0 
             if (obj == null) {
    -  369  0 
                 return false;
    -  370   +  366  0 
             if (obj == null) {
    +  367  0 
                 return false;
    +  368   
             }
    -  371  0 
             if (getClass() != obj.getClass()) {
    -  372  0 
                 return false;
    -  373   +  369  0 
             if (getClass() != obj.getClass()) {
    +  370  0 
                 return false;
    +  371   
             }
    -  374  0 
             final Vulnerability other = (Vulnerability) obj;
    -  375  0 
             if ((this.name == null) ? (other.name != null) : !this.name.equals(other.name)) {
    -  376  0 
                 return false;
    +  372  0 
             final Vulnerability other = (Vulnerability) obj;
    +  373  0 
             if ((this.name == null) ? (other.name != null) : !this.name.equals(other.name)) {
    +  374  0 
                 return false;
    +  375   + 
             }
    +  376  0 
             return true;
     377   - 
             }
    -  378  0 
             return true;
    + 
         }
    +  378   + 
     
     379   - 
         }
    -  380   - 
     
    -  381   
         @Override
    -  382   +  380   
         public int hashCode() {
    -  383  41 
             int hash = 5;
    -  384  41 
             hash = 41 * hash + (this.name != null ? this.name.hashCode() : 0);
    -  385  41 
             return hash;
    -  386   +  381  82 
             int hash = 5;
    +  382  82 
             hash = 41 * hash + (this.name != null ? this.name.hashCode() : 0);
    +  383  82 
             return hash;
    +  384   
         }
    -  387   +  385   
     
    -  388   +  386   
         /**
    -  389   +  387   
          * Compares two vulnerabilities.
    -  390   +  388   
          *
    -  391   +  389   
          * @param v a vulnerability to be compared
    +  390   + 
          * @return a negative integer, zero, or a positive integer as this object is less than, equal to, or greater than
    +  391   + 
          * the specified vulnerability
     392   - 
          * @return a negative integer, zero, or a positive integer as this object is
    -  393   - 
          * less than, equal to, or greater than the specified vulnerability
    -  394   
          */
    -  395   +  393   
         public int compareTo(Vulnerability v) {
    -  396  0 
             return v.getName().compareTo(this.getName());
    -  397   +  394  0 
             return v.getName().compareTo(this.getName());
    +  395   
         }
    +  396   + 
     
    +  397   + 
         /**
     398   + 
          * The CPE id that caused this vulnerability to be flagged.
    +  399   + 
          */
    +  400   + 
         private String matchedCPE;
    +  401   + 
         /**
    +  402   + 
          * Whether or not all previous versions were affected.
    +  403   + 
          */
    +  404   + 
         private String matchedAllPreviousCPE;
    +  405   + 
     
    +  406   + 
         /**
    +  407   + 
          * Sets the CPE that caused this vulnerability to be flagged.
    +  408   + 
          *
    +  409   + 
          * @param cpeId a CPE identifier
    +  410   + 
          * @param previous a flag indicating whether or not all previous versions were affected (any non-null value is
    +  411   + 
          * considered true)
    +  412   + 
          */
    +  413   + 
         public void setMatchedCPE(String cpeId, String previous) {
    +  414  122 
             matchedCPE = cpeId;
    +  415  122 
             matchedAllPreviousCPE = previous;
    +  416  122 
         }
    +  417   + 
     
    +  418   + 
         /**
    +  419   + 
          * Get the value of matchedCPE.
    +  420   + 
          *
    +  421   + 
          * @return the value of matchedCPE
    +  422   + 
          */
    +  423   + 
         public String getMatchedCPE() {
    +  424  0 
             return matchedCPE;
    +  425   + 
         }
    +  426   + 
     
    +  427   + 
         /**
    +  428   + 
          * Get the value of matchedAllPreviousCPE.
    +  429   + 
          *
    +  430   + 
          * @return the value of matchedAllPreviousCPE
    +  431   + 
          */
    +  432   + 
         public String getMatchedAllPreviousCPE() {
    +  433  0 
             return matchedAllPreviousCPE;
    +  434   + 
         }
    +  435   + 
     
    +  436   + 
         /**
    +  437   + 
          * Determines whether or not matchedAllPreviousCPE has been set.
    +  438   + 
          *
    +  439   + 
          * @return true if matchedAllPreviousCPE is not null; otherwise false
    +  440   + 
          */
    +  441   + 
         public boolean hasMatchedAllPreviousCPE() {
    +  442  0 
             return matchedAllPreviousCPE != null;
    +  443   + 
         }
    +  444   
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.VulnerabilityComparator.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.VulnerabilityComparator.html index dce4ef4ad..12e35c2c3 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.VulnerabilityComparator.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.VulnerabilityComparator.html @@ -24,91 +24,89 @@  3   
      *
     4   - 
      * Dependency-check-core is free software: you can redistribute it and/or modify it
    + 
      * Licensed under the Apache License, Version 2.0 (the "License");
     5   - 
      * under the terms of the GNU General Public License as published by the Free
    + 
      * you may not use this file except in compliance with the License.
     6   - 
      * Software Foundation, either version 3 of the License, or (at your option) any
    + 
      * You may obtain a copy of the License at
     7   - 
      * later version.
    + 
      *
     8   - 
      *
    + 
      *     http://www.apache.org/licenses/LICENSE-2.0
     9   - 
      * Dependency-check-core is distributed in the hope that it will be useful, but
    + 
      *
     10   - 
      * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
    + 
      * Unless required by applicable law or agreed to in writing, software
     11   - 
      * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
    + 
      * distributed under the License is distributed on an "AS IS" BASIS,
     12   - 
      * details.
    + 
      * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13   - 
      *
    + 
      * See the License for the specific language governing permissions and
     14   - 
      * You should have received a copy of the GNU General Public License along with
    + 
      * limitations under the License.
     15   - 
      * dependency-check-core. If not, see http://www.gnu.org/licenses/.
    + 
      *
     16   - 
      *
    -  17   
      * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
    +  17   + 
      */
     18   - 
      */
    -  19   
     package org.owasp.dependencycheck.dependency;
    +  19   + 
     
     20   - 
     
    -  21   
     import java.io.Serializable;
    -  22   +  21   
     import java.util.Comparator;
    +  22   + 
     
     23   - 
     
    -  24   
     /**
    -  25   +  24   
      * Comparator for Vulnerability objects.
    -  26   +  25   
      *
    -  27   +  26   
      * @author Jeremy Long <jeremy.long@owasp.org>
    -  28   +  27   
      */
    -  29  161 
     public class VulnerabilityComparator implements Comparator<Vulnerability>, Serializable {
    +  28  360 
     public class VulnerabilityComparator implements Comparator<Vulnerability>, Serializable {
    +  29   + 
     
     30   - 
     
    + 
         /**
     31   - 
         /**
    -  32   
          * The serial version UID.
    +  32   + 
          */
     33   - 
          */
    -  34   
         private static final long serialVersionUID = 1L;
    -  35   +  34   
     
    -  36   +  35   
         /**
    -  37   +  36   
          * Implements the comparison of vulnerabilities.
    -  38   +  37   
          *
    -  39   +  38   
          * @param o1 a vulnerability
    -  40   +  39   
          * @param o2 a second vulnerability
    -  41   +  40   
          * @return the comparison
    -  42   +  41   
          */
    -  43   +  42   
         public int compare(Vulnerability o1, Vulnerability o2) {
    -  44  107 
             return o2.getName().compareTo(o1.getName());
    -  45   +  43  228 
             return o2.getName().compareTo(o1.getName());
    +  44   
         }
    -  46   +  45   
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.VulnerableSoftware.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.VulnerableSoftware.html index a21d42607..26538275b 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.VulnerableSoftware.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.dependency.VulnerableSoftware.html @@ -24,222 +24,222 @@  3   
      *
     4   - 
      * Dependency-check-core is free software: you can redistribute it and/or modify it
    + 
      * Licensed under the Apache License, Version 2.0 (the "License");
     5   - 
      * under the terms of the GNU General Public License as published by the Free
    + 
      * you may not use this file except in compliance with the License.
     6   - 
      * Software Foundation, either version 3 of the License, or (at your option) any
    + 
      * You may obtain a copy of the License at
     7   - 
      * later version.
    + 
      *
     8   - 
      *
    + 
      *     http://www.apache.org/licenses/LICENSE-2.0
     9   - 
      * Dependency-check-core is distributed in the hope that it will be useful, but
    + 
      *
     10   - 
      * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
    + 
      * Unless required by applicable law or agreed to in writing, software
     11   - 
      * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
    + 
      * distributed under the License is distributed on an "AS IS" BASIS,
     12   - 
      * details.
    + 
      * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13   - 
      *
    + 
      * See the License for the specific language governing permissions and
     14   - 
      * You should have received a copy of the GNU General Public License along with
    + 
      * limitations under the License.
     15   - 
      * dependency-check-core. If not, see http://www.gnu.org/licenses/.
    + 
      *
     16   - 
      *
    -  17   
      * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
    +  17   + 
      */
     18   - 
      */
    -  19   
     package org.owasp.dependencycheck.dependency;
    +  19   + 
     
     20   - 
     
    -  21   
     import java.io.Serializable;
    -  22   +  21   
     import java.io.UnsupportedEncodingException;
    -  23   +  22   
     import java.net.URLDecoder;
    -  24   +  23   
     import java.util.logging.Level;
    -  25   +  24   
     import java.util.logging.Logger;
    -  26   +  25   
     import org.owasp.dependencycheck.data.cpe.IndexEntry;
    +  26   + 
     
     27   - 
     
    -  28   
     /**
    +  28   + 
      * A record containing information about vulnerable software. This is referenced from a vulnerability.
     29   - 
      * A record containing information about vulnerable software. This is referenced
    -  30   - 
      * from a vulnerability.
    -  31   
      *
    -  32   +  30   
      * @author Jeremy Long <jeremy.long@owasp.org>
    -  33   +  31   
      */
    -  34  62311 
     public class VulnerableSoftware extends IndexEntry implements Serializable, Comparable<VulnerableSoftware> {
    +  32  124622 
     public class VulnerableSoftware extends IndexEntry implements Serializable, Comparable<VulnerableSoftware> {
    +  33   + 
     
    +  34   + 
         /**
     35   - 
     
    -  36   - 
         /**
    -  37   
          * The serial version UID.
    -  38   +  36   
          */
    -  39   +  37   
         private static final long serialVersionUID = 307319490326651052L;
    +  38   + 
     
    +  39   + 
         /**
     40   - 
     
    -  41   - 
         /**
    -  42   
          * Parse a CPE entry from the cpe string representation.
    -  43   +  41   
          *
    -  44   +  42   
          * @param cpe a cpe entry (e.g. cpe:/a:vendor:software:version)
    -  45   +  43   
          */
    -  46   +  44   
         public void setCpe(String cpe) {
    -  47   +  45   
             try {
    -  48  7714 
                 parseName(cpe);
    -  49  0 
             } catch (UnsupportedEncodingException ex) {
    -  50  0 
                 final String msg = String.format("Character encoding is unsupported for CPE '%s'.", cpe);
    -  51  0 
                 Logger.getLogger(VulnerableSoftware.class.getName()).log(Level.WARNING, msg);
    -  52  0 
                 Logger.getLogger(VulnerableSoftware.class.getName()).log(Level.FINE, null, ex);
    -  53  0 
                 setName(cpe);
    -  54  7714 
             }
    -  55  7714 
         }
    -  56   +  46  15428 
                 parseName(cpe);
    +  47  0 
             } catch (UnsupportedEncodingException ex) {
    +  48  0 
                 final String msg = String.format("Character encoding is unsupported for CPE '%s'.", cpe);
    +  49  0 
                 Logger.getLogger(VulnerableSoftware.class.getName()).log(Level.WARNING, msg);
    +  50  0 
                 Logger.getLogger(VulnerableSoftware.class.getName()).log(Level.FINE, null, ex);
    +  51  0 
                 setName(cpe);
    +  52  15428 
             }
    +  53  15428 
         }
    +  54   
     
    -  57   +  55   
         /**
    +  56   + 
          * <p>
    +  57   + 
          * Parses a name attribute value, from the cpe.xml, into its corresponding parts: vendor, product, version,
     58   - 
          * <p>Parses a name attribute value, from the cpe.xml, into its
    + 
          * revision.</p>
     59   - 
          * corresponding parts: vendor, product, version, revision.</p>
    + 
          * <p>
     60   - 
          * <p>Example:</p>
    + 
          * Example:</p>
     61   
          * <code>&nbsp;&nbsp;&nbsp;cpe:/a:apache:struts:1.1:rc2</code>
     62   
          *
     63   - 
          * <p>Results in:</p> <ul> <li>Vendor: apache</li> <li>Product: struts</li>
    + 
          * <p>
     64   - 
          * <li>Version: 1.1</li> <li>Revision: rc2</li> </ul>
    + 
          * Results in:</p> <ul> <li>Vendor: apache</li> <li>Product: struts</li>
     65   - 
          *
    + 
          * <li>Version: 1.1</li> <li>Revision: rc2</li> </ul>
     66   - 
          * @param cpeName the cpe name
    + 
          *
     67   - 
          * @throws UnsupportedEncodingException should never be thrown...
    + 
          * @param cpeName the cpe name
     68   - 
          */
    + 
          * @throws UnsupportedEncodingException should never be thrown...
     69   - 
         @Override
    + 
          */
     70   + 
         @Override
    +  71   
         public void parseName(String cpeName) throws UnsupportedEncodingException {
    -  71  11290 
             this.name = cpeName;
    -  72  11290 
             if (cpeName != null && cpeName.length() > 7) {
    -  73  11290 
                 final String[] data = cpeName.substring(7).split(":");
    -  74  11290 
                 if (data.length >= 1) {
    -  75  11290 
                     this.setVendor(URLDecoder.decode(data[0].replace("+", "%2B"), "UTF-8")); //.replaceAll("[_-]", " ")
    -  76  11290 
                     if (data.length >= 2) {
    -  77  11290 
                         this.setProduct(URLDecoder.decode(data[1].replace("+", "%2B"), "UTF-8")); //.replaceAll("[_-]", " ")
    -  78  11290 
                         if (data.length >= 3) {
    -  79  11262 
                             version = URLDecoder.decode(data[2].replace("+", "%2B"), "UTF-8");
    -  80  11262 
                             if (data.length >= 4) {
    -  81  2318 
                                 revision = URLDecoder.decode(data[3].replace("+", "%2B"), "UTF-8");
    -  82  2318 
                                 if (data.length >= 5) {
    -  83  1 
                                     edition = URLDecoder.decode(data[4].replace("+", "%2B"), "UTF-8");
    -  84   - 
                                 }
    -  85   - 
                             }
    -  86   - 
                         }
    -  87   - 
                     }
    -  88   +  72  22580 
             this.name = cpeName;
    +  73  22580 
             if (cpeName != null && cpeName.length() > 7) {
    +  74  22580 
                 final String[] data = cpeName.substring(7).split(":");
    +  75  22580 
                 if (data.length >= 1) {
    +  76  22580 
                     this.setVendor(URLDecoder.decode(data[0].replace("+", "%2B"), "UTF-8"));
    +  77   
                 }
    +  78  22580 
                 if (data.length >= 2) {
    +  79  22580 
                     this.setProduct(URLDecoder.decode(data[1].replace("+", "%2B"), "UTF-8"));
    +  80   + 
                 }
    +  81  22580 
                 if (data.length >= 3) {
    +  82  22524 
                     version = URLDecoder.decode(data[2].replace("+", "%2B"), "UTF-8");
    +  83   + 
                 }
    +  84  22580 
                 if (data.length >= 4) {
    +  85  4636 
                     revision = URLDecoder.decode(data[3].replace("+", "%2B"), "UTF-8");
    +  86   + 
                 }
    +  87  22580 
                 if (data.length >= 5) {
    +  88  2 
                     edition = URLDecoder.decode(data[4].replace("+", "%2B"), "UTF-8");
     89   + 
                 }
    +  90   
             }
    -  90  11290 
         }
    -  91   - 
         /**
    +  91  22580 
         }
     92   - 
          * If present, indicates that previous version are vulnerable.
    + 
         /**
     93   - 
          */
    + 
          * If present, indicates that previous version are vulnerable.
     94   - 
         private String previousVersion;
    + 
          */
     95   - 
     
    + 
         private String previousVersion;
     96   - 
         /**
    + 
     
     97   - 
          * Indicates if previous versions of this software are vulnerable.
    + 
         /**
     98   - 
          *
    + 
          * Indicates if previous versions of this software are vulnerable.
     99   - 
          * @return if previous versions of this software are vulnerable
    + 
          *
     100   - 
          */
    + 
          * @return if previous versions of this software are vulnerable
     101   + 
          */
    +  102   
         public boolean hasPreviousVersion() {
    -  102  1985 
             return previousVersion != null;
    -  103   - 
         }
    +  103  3970 
             return previousVersion != null;
     104   - 
     
    -  105   - 
         /**
    -  106   - 
          * Get the value of previousVersion.
    -  107   - 
          *
    -  108   - 
          * @return the value of previousVersion
    -  109   - 
          */
    -  110   - 
         public String getPreviousVersion() {
    -  111  0 
             return previousVersion;
    -  112   
         }
    -  113   +  105   
     
    -  114   +  106   
         /**
    -  115   - 
          * Set the value of previousVersion.
    -  116   +  107   + 
          * Get the value of previousVersion.
    +  108   
          *
    -  117   - 
          * @param previousVersion new value of previousVersion
    -  118   +  109   + 
          * @return the value of previousVersion
    +  110   
          */
    -  119   - 
         public void setPreviousVersion(String previousVersion) {
    -  120  43 
             this.previousVersion = previousVersion;
    -  121  43 
         }
    -  122   +  111   + 
         public String getPreviousVersion() {
    +  112  0 
             return previousVersion;
    +  113   + 
         }
    +  114   
     
    -  123   +  115   
         /**
    +  116   + 
          * Set the value of previousVersion.
    +  117   + 
          *
    +  118   + 
          * @param previousVersion new value of previousVersion
    +  119   + 
          */
    +  120   + 
         public void setPreviousVersion(String previousVersion) {
    +  121  86 
             this.previousVersion = previousVersion;
    +  122  86 
         }
    +  123   + 
     
     124   - 
          * Standard equals implementation to compare this VulnerableSoftware to
    + 
         /**
     125   - 
          * another object.
    + 
          * Standard equals implementation to compare this VulnerableSoftware to another object.
     126   
          *
     127   @@ -252,17 +252,17 @@ 
         @Override
     131   
         public boolean equals(Object obj) {
    -  132  1 
             if (obj == null) {
    +  132  2 
             if (obj == null) {
     133  0 
                 return false;
     134   
             }
    -  135  1 
             if (getClass() != obj.getClass()) {
    +  135  2 
             if (getClass() != obj.getClass()) {
     136  0 
                 return false;
     137   
             }
    -  138  1 
             final VulnerableSoftware other = (VulnerableSoftware) obj;
    -  139  1 
             if ((this.getName() == null) ? (other.getName() != null) : !this.getName().equals(other.getName())) {
    -  140  1 
                 return false;
    +  138  2 
             final VulnerableSoftware other = (VulnerableSoftware) obj;
    +  139  2 
             if ((this.getName() == null) ? (other.getName() != null) : !this.getName().equals(other.getName())) {
    +  140  2 
                 return false;
     141   
             }
     142  0 
             return true;
    @@ -284,9 +284,9 @@ 
         @Override
     151   
         public int hashCode() {
    -  152  4516 
             int hash = 7;
    -  153  4516 
             hash = 83 * hash + (this.getName() != null ? this.getName().hashCode() : 0);
    -  154  4516 
             return hash;
    +  152  9032 
             int hash = 7;
    +  153  9032 
             hash = 83 * hash + (this.getName() != null ? this.getName().hashCode() : 0);
    +  154  9032 
             return hash;
     155   
         }
     156   @@ -294,306 +294,304 @@  157   
         /**
     158   - 
          * Standard toString() implementation display the name and whether or not
    + 
          * Standard toString() implementation display the name and whether or not previous versions are also affected.
     159   - 
          * previous versions are also affected.
    + 
          *
     160   - 
          *
    -  161   
          * @return a string representation of the object
    +  161   + 
          */
     162   - 
          */
    + 
         @Override
     163   - 
         @Override
    -  164   
         public String toString() {
    -  165  0 
             return "VulnerableSoftware{ name=" + name + ", previousVersion=" + previousVersion + '}';
    +  164  0 
             return "VulnerableSoftware{ name=" + name + ", previousVersion=" + previousVersion + '}';
    +  165   + 
         }
     166   - 
         }
    + 
     
     167   - 
     
    + 
         /**
     168   - 
         /**
    -  169   
          * Implementation of the comparable interface.
    +  169   + 
          *
     170   - 
          *
    -  171   
          * @param vs the VulnerableSoftware to compare
    -  172   +  171   
          * @return an integer indicating the ordering of the two objects
    +  172   + 
          */
     173   - 
          */
    -  174   
         @Override
    -  175   +  174   
         public int compareTo(VulnerableSoftware vs) {
    -  176  51022 
             int result = 0;
    -  177  51022 
             final String[] left = this.getName().split(":");
    -  178  51022 
             final String[] right = vs.getName().split(":");
    -  179  51022 
             final int max = (left.length <= right.length) ? left.length : right.length;
    -  180  51022 
             if (max > 0) {
    -  181  308349 
                 for (int i = 0; result == 0 && i < max; i++) {
    -  182  257327 
                     final String[] subLeft = left[i].split("\\.");
    -  183  257327 
                     final String[] subRight = right[i].split("\\.");
    -  184  257327 
                     final int subMax = (subLeft.length <= subRight.length) ? subLeft.length : subRight.length;
    -  185  257327 
                     if (subMax > 0) {
    -  186  578414 
                         for (int x = 0; result == 0 && x < subMax; x++) {
    -  187  321087 
                             if (isPositiveInteger(subLeft[x]) && isPositiveInteger(subRight[x])) {
    -  188  111831 
                                 final int iLeft = Integer.parseInt(subLeft[x]);
    -  189  111831 
                                 final int iRight = Integer.parseInt(subRight[x]);
    -  190  111831 
                                 if (iLeft != iRight) {
    -  191  43516 
                                     if (iLeft > iRight) {
    -  192  40056 
                                         result = 2;
    -  193   +  175  102044 
             int result = 0;
    +  176  102044 
             final String[] left = this.getName().split(":");
    +  177  102044 
             final String[] right = vs.getName().split(":");
    +  178  102044 
             final int max = (left.length <= right.length) ? left.length : right.length;
    +  179  102044 
             if (max > 0) {
    +  180  616698 
                 for (int i = 0; result == 0 && i < max; i++) {
    +  181  514654 
                     final String[] subLeft = left[i].split("\\.");
    +  182  514654 
                     final String[] subRight = right[i].split("\\.");
    +  183  514654 
                     final int subMax = (subLeft.length <= subRight.length) ? subLeft.length : subRight.length;
    +  184  514654 
                     if (subMax > 0) {
    +  185  1156828 
                         for (int x = 0; result == 0 && x < subMax; x++) {
    +  186  642174 
                             if (isPositiveInteger(subLeft[x]) && isPositiveInteger(subRight[x])) {
    +  187  223662 
                                 final int iLeft = Integer.parseInt(subLeft[x]);
    +  188  223662 
                                 final int iRight = Integer.parseInt(subRight[x]);
    +  189  223662 
                                 if (iLeft != iRight) {
    +  190  87032 
                                     if (iLeft > iRight) {
    +  191  80112 
                                         result = 2;
    +  192   
                                     } else {
    -  194  3460 
                                         result = -2;
    -  195   +  193  6920 
                                         result = -2;
    +  194   
                                     }
    -  196   +  195   
                                 }
    -  197  111831 
                             } else {
    -  198  209256 
                                 result = subLeft[x].compareToIgnoreCase(subRight[x]);
    +  196  223662 
                             } else {
    +  197  418512 
                                 result = subLeft[x].compareToIgnoreCase(subRight[x]);
    +  198   + 
                             }
     199   - 
                             }
    -  200   
                         }
    -  201  257327 
                         if (result == 0) {
    -  202  208457 
                             if (subLeft.length > subRight.length) {
    -  203  1478 
                                 result = 2;
    -  204   +  200  514654 
                         if (result == 0) {
    +  201  416914 
                             if (subLeft.length > subRight.length) {
    +  202  2956 
                                 result = 2;
    +  203   + 
                             }
    +  204  416914 
                             if (subRight.length > subLeft.length) {
    +  205  14 
                                 result = -2;
    +  206   
                             }
    -  205  208457 
                             if (subRight.length > subLeft.length) {
    -  206  7 
                                 result = -2;
     207   - 
                             }
    -  208   
                         }
    -  209   +  208   
                     } else {
    -  210  0 
                         result = left[i].compareToIgnoreCase(right[i]);
    +  209  0 
                         result = left[i].compareToIgnoreCase(right[i]);
    +  210   + 
                     }
     211   - 
                     }
    -  212   
                 }
    -  213  51022 
                 if (result == 0) {
    -  214  667 
                     if (left.length > right.length) {
    -  215  578 
                         result = 2;
    -  216   +  212  102044 
                 if (result == 0) {
    +  213  1334 
                     if (left.length > right.length) {
    +  214  1156 
                         result = 2;
    +  215   + 
                     }
    +  216  1334 
                     if (right.length > left.length) {
    +  217  20 
                         result = -2;
    +  218   
                     }
    -  217  667 
                     if (right.length > left.length) {
    -  218  10 
                         result = -2;
     219   - 
                     }
    + 
                 }
     220   - 
                 }
    -  221   
             } else {
    -  222  0 
                 result = this.getName().compareToIgnoreCase(vs.getName());
    -  223   +  221  0 
                 result = this.getName().compareToIgnoreCase(vs.getName());
    +  222   
             }
    -  224  51022 
             return result;
    +  223  102044 
             return result;
    +  224   + 
         }
     225   - 
         }
    + 
     
     226   - 
     
    + 
         /**
     227   - 
         /**
    -  228   
          * Determines if the string passed in is a positive integer.
    +  228   + 
          *
     229   - 
          *
    -  230   
          * @param str the string to test
    -  231   +  230   
          * @return true if the string only contains 0-9, otherwise false.
    +  231   + 
          */
     232   - 
          */
    -  233   
         private static boolean isPositiveInteger(final String str) {
    -  234  433012 
             if (str == null || str.isEmpty()) {
    -  235  14 
                 return false;
    -  236   +  233  866024 
             if (str == null || str.isEmpty()) {
    +  234  28 
                 return false;
    +  235   
             }
    -  237  674344 
             for (int i = 0; i < str.length(); i++) {
    -  238  450588 
                 final char c = str.charAt(i);
    -  239  450588 
                 if (c < '0' || c > '9') {
    -  240  209242 
                     return false;
    -  241   +  236  1348688 
             for (int i = 0; i < str.length(); i++) {
    +  237  901176 
                 final char c = str.charAt(i);
    +  238  901176 
                 if (c < '0' || c > '9') {
    +  239  418484 
                     return false;
    +  240   
                 }
    -  242   +  241   
             }
    -  243  223756 
             return true;
    +  242  447512 
             return true;
    +  243   + 
         }
     244   - 
         }
    + 
         /**
     245   - 
         /**
    -  246   
          * The name of the cpe.
    +  246   + 
          */
     247   - 
          */
    -  248   
         private String name;
    +  248   + 
     
     249   - 
     
    + 
         /**
     250   - 
         /**
    -  251   
          * Get the value of name.
    +  251   + 
          *
     252   - 
          *
    -  253   
          * @return the value of name
    +  253   + 
          */
     254   - 
          */
    -  255   
         public String getName() {
    -  256  113402 
             return name;
    +  255  226932 
             return name;
    +  256   + 
         }
     257   - 
         }
    + 
     
     258   - 
     
    + 
         /**
     259   - 
         /**
    -  260   
          * Set the value of name.
    +  260   + 
          *
     261   - 
          *
    -  262   
          * @param name new value of name
    +  262   + 
          */
     263   - 
          */
    -  264   
         public void setName(String name) {
    -  265  0 
             this.name = name;
    -  266  0 
         }
    +  264  0 
             this.name = name;
    +  265  0 
         }
    +  266   + 
         /**
     267   - 
         /**
    -  268   
          * The product version number.
    +  268   + 
          */
     269   - 
          */
    -  270   
         private String version;
    +  270   + 
     
     271   - 
     
    + 
         /**
     272   - 
         /**
    -  273   
          * Get the value of version.
    +  273   + 
          *
     274   - 
          *
    -  275   
          * @return the value of version
    +  275   + 
          */
     276   - 
          */
    -  277   
         public String getVersion() {
    -  278  19734 
             return version;
    +  277  43956 
             return version;
    +  278   + 
         }
     279   - 
         }
    + 
     
     280   - 
     
    + 
         /**
     281   - 
         /**
    -  282   
          * Set the value of version.
    +  282   + 
          *
     283   - 
          *
    -  284   
          * @param version new value of version
    +  284   + 
          */
     285   - 
          */
    -  286   
         public void setVersion(String version) {
    -  287  0 
             this.version = version;
    -  288  0 
         }
    +  286  0 
             this.version = version;
    +  287  0 
         }
    +  288   + 
         /**
     289   - 
         /**
    -  290   
          * The product revision version.
    +  290   + 
          */
     291   - 
          */
    -  292   
         private String revision;
    +  292   + 
     
     293   - 
     
    + 
         /**
     294   - 
         /**
    -  295   
          * Get the value of revision.
    +  295   + 
          *
     296   - 
          *
    -  297   
          * @return the value of revision
    +  297   + 
          */
     298   - 
          */
    -  299   
         public String getRevision() {
    -  300  19236 
             return revision;
    +  299  45680 
             return revision;
    +  300   + 
         }
     301   - 
         }
    + 
     
     302   - 
     
    + 
         /**
     303   - 
         /**
    -  304   
          * Set the value of revision.
    +  304   + 
          *
     305   - 
          *
    -  306   
          * @param revision new value of revision
    +  306   + 
          */
     307   - 
          */
    -  308   
         public void setRevision(String revision) {
    -  309  0 
             this.revision = revision;
    -  310  0 
         }
    +  308  0 
             this.revision = revision;
    +  309  0 
         }
    +  310   + 
         /**
     311   - 
         /**
    -  312   
          * The product edition.
    +  312   + 
          */
     313   - 
          */
    -  314   
         private String edition;
    +  314   + 
     
     315   - 
     
    + 
         /**
     316   - 
         /**
    -  317   
          * Get the value of edition.
    +  317   + 
          *
     318   - 
          *
    -  319   
          * @return the value of edition
    +  319   + 
          */
     320   - 
          */
    -  321   
         public String getEdition() {
    -  322  0 
             return edition;
    -  323   +  321  0 
             return edition;
    +  322   
         }
    -  324   +  323   
     
    -  325   +  324   
         /**
    -  326   +  325   
          * Set the value of edition.
    -  327   +  326   
          *
    -  328   +  327   
          * @param edition new value of edition
    -  329   +  328   
          */
    -  330   +  329   
         public void setEdition(String edition) {
    -  331  0 
             this.edition = edition;
    -  332  0 
         }
    -  333   +  330  0 
             this.edition = edition;
    +  331  0 
         }
    +  332   
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.exception.NoDataException.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.exception.NoDataException.html index 4b9dce000..bfe8b6982 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.exception.NoDataException.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.exception.NoDataException.html @@ -24,131 +24,129 @@  3   
      *
     4   - 
      * Dependency-check-core is free software: you can redistribute it and/or modify it
    + 
      * Licensed under the Apache License, Version 2.0 (the "License");
     5   - 
      * under the terms of the GNU General Public License as published by the Free
    + 
      * you may not use this file except in compliance with the License.
     6   - 
      * Software Foundation, either version 3 of the License, or (at your option) any
    + 
      * You may obtain a copy of the License at
     7   - 
      * later version.
    + 
      *
     8   - 
      *
    + 
      *     http://www.apache.org/licenses/LICENSE-2.0
     9   - 
      * Dependency-check-core is distributed in the hope that it will be useful, but
    + 
      *
     10   - 
      * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
    + 
      * Unless required by applicable law or agreed to in writing, software
     11   - 
      * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
    + 
      * distributed under the License is distributed on an "AS IS" BASIS,
     12   - 
      * details.
    + 
      * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13   - 
      *
    + 
      * See the License for the specific language governing permissions and
     14   - 
      * You should have received a copy of the GNU General Public License along with
    + 
      * limitations under the License.
     15   - 
      * dependency-check-core. If not, see http://www.gnu.org/licenses/.
    + 
      *
     16   - 
      *
    -  17   
      * Copyright (c) 2013 Jeremy Long. All Rights Reserved.
    +  17   + 
      */
     18   - 
      */
    -  19   
     package org.owasp.dependencycheck.exception;
    +  19   + 
     
     20   - 
     
    -  21   
     import java.io.IOException;
    +  21   + 
     
     22   - 
     
    -  23   
     /**
    -  24   +  23   
      * An exception used when the data needed does not exist to perform analysis.
    -  25   +  24   
      *
    -  26   +  25   
      * @author Jeremy Long <jeremy.long@owasp.org>
    -  27   +  26   
      */
    -  28   +  27   
     public class NoDataException extends IOException {
    +  28   + 
     
     29   - 
     
    + 
         /**
     30   - 
         /**
    -  31   
          * The serial version uid.
    +  31   + 
          */
     32   - 
          */
    -  33   
         private static final long serialVersionUID = 1L;
    +  33   + 
     
     34   - 
     
    + 
         /**
     35   - 
         /**
    + 
          * Creates a new NoDataException.
     36   - 
          * Creates a new NoDataException.
    + 
          */
     37   - 
          */
    -  38   
         public NoDataException() {
    -  39  0 
             super();
    -  40  0 
         }
    +  38  0 
             super();
    +  39  0 
         }
    +  40   + 
     
     41   - 
     
    + 
         /**
     42   - 
         /**
    + 
          * Creates a new NoDataException.
     43   - 
          * Creates a new NoDataException.
    + 
          *
     44   - 
          *
    + 
          * @param msg a message for the exception.
     45   - 
          * @param msg a message for the exception.
    + 
          */
     46   - 
          */
    -  47   
         public NoDataException(String msg) {
    -  48  0 
             super(msg);
    -  49  0 
         }
    +  47  0 
             super(msg);
    +  48  0 
         }
    +  49   + 
     
     50   - 
     
    + 
         /**
     51   - 
         /**
    + 
          * Creates a new NoDataException.
     52   - 
          * Creates a new NoDataException.
    + 
          *
     53   - 
          *
    + 
          * @param ex the cause of the exception.
     54   - 
          * @param ex the cause of the exception.
    + 
          */
     55   - 
          */
    -  56   
         public NoDataException(Throwable ex) {
    -  57  0 
             super(ex);
    -  58  0 
         }
    -  59   +  56  0 
             super(ex);
    +  57  0 
         }
    +  58   
     
    -  60   +  59   
         /**
    -  61   +  60   
          * Creates a new NoDataException.
    -  62   +  61   
          *
    -  63   +  62   
          * @param msg a message for the exception.
    -  64   +  63   
          * @param ex the cause of the exception.
    -  65   +  64   
          */
    -  66   +  65   
         public NoDataException(String msg, Throwable ex) {
    -  67  0 
             super(msg, ex);
    -  68  0 
         }
    -  69   +  66  0 
             super(msg, ex);
    +  67  0 
         }
    +  68   
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.MavenNamespaceFilter.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.MavenNamespaceFilter.html index 6a4ec380f..5eead6e18 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.MavenNamespaceFilter.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.MavenNamespaceFilter.html @@ -12,7 +12,7 @@
     
    - +
    Classes in this File Line Coverage Branch Coverage Complexity
    MavenNamespaceFilter
    100%
    13/13
    50%
    1/2
    		1.25
    MavenNamespaceFilter
    15%
    2/13
    0%
    0/2
    		1.25
     
    @@ -24,180 +24,178 @@  3   
      *
     4   - 
      * Dependency-check-core is free software: you can redistribute it and/or modify it
    + 
      * Licensed under the Apache License, Version 2.0 (the "License");
     5   - 
      * under the terms of the GNU General Public License as published by the Free
    + 
      * you may not use this file except in compliance with the License.
     6   - 
      * Software Foundation, either version 3 of the License, or (at your option) any
    + 
      * You may obtain a copy of the License at
     7   - 
      * later version.
    + 
      *
     8   - 
      *
    + 
      *     http://www.apache.org/licenses/LICENSE-2.0
     9   - 
      * Dependency-check-core is distributed in the hope that it will be useful, but
    + 
      *
     10   - 
      * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
    + 
      * Unless required by applicable law or agreed to in writing, software
     11   - 
      * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
    + 
      * distributed under the License is distributed on an "AS IS" BASIS,
     12   - 
      * details.
    + 
      * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13   - 
      *
    + 
      * See the License for the specific language governing permissions and
     14   - 
      * You should have received a copy of the GNU General Public License along with
    + 
      * limitations under the License.
     15   - 
      * dependency-check-core. If not, see http://www.gnu.org/licenses/.
    + 
      *
     16   - 
      *
    -  17   
      * Copyright (c) 2013 Jeremy Long. All Rights Reserved.
    +  17   + 
      */
     18   - 
      */
    -  19   
     package org.owasp.dependencycheck.jaxb.pom;
    +  19   + 
     
     20   - 
     
    -  21   
     import org.xml.sax.Attributes;
    -  22   +  21   
     import org.xml.sax.SAXException;
    -  23   +  22   
     import org.xml.sax.helpers.XMLFilterImpl;
    +  23   + 
     
     24   - 
     
    -  25   
     /**
    +  25   + 
      * This filter is used when parsing POM documents. Some POM documents do not specify the
     26   - 
      * This filter is used when parsing POM documents. Some POM documents do not
    + 
      * xmlns="http://maven.apache.org/POM/4.0.0". This filter ensures that the correct namespace is added so that both types
     27   - 
      * specify the xmlns="http://maven.apache.org/POM/4.0.0". This filter ensures
    + 
      * of POMs can be read.
     28   - 
      * that the correct namespace is added so that both types of POMs can be read.
    -  29   
      *
    -  30   +  29   
      * @author Jeremy Long <jeremy.long@owasp.org>
    -  31   +  30   
      */
    -  32  7 
     public class MavenNamespaceFilter extends XMLFilterImpl {
    +  31  14 
     public class MavenNamespaceFilter extends XMLFilterImpl {
    +  32   + 
     
     33   - 
     
    + 
         /**
     34   - 
         /**
    -  35   
          * The namespace to add for Maven POMs.
    +  35   + 
          */
     36   - 
          */
    -  37   
         private static final String NAMESPACE = "http://maven.apache.org/POM/4.0.0";
    +  37   + 
         /**
     38   - 
         /**
    -  39   
          * A flag indicating whether or not the namespace (prefix) has been added.
    -  40   +  39   
          */
    -  41  7 
         private boolean namespaceAdded = false;
    +  40  14 
         private boolean namespaceAdded = false;
    +  41   + 
     
     42   - 
     
    + 
         /**
     43   - 
         /**
    -  44   
          * Called at the start of the document parsing.
    +  44   + 
          *
     45   - 
          *
    + 
          * @throws SAXException thrown if there is a SAXException
     46   - 
          * @throws SAXException thrown if there is a SAXException
    + 
          */
     47   - 
          */
    + 
         @Override
     48   - 
         @Override
    -  49   
         public void startDocument() throws SAXException {
    -  50  7 
             super.startDocument();
    -  51  7 
             startPrefixMapping("", NAMESPACE);
    -  52  7 
         }
    +  49  0 
             super.startDocument();
    +  50  0 
             startPrefixMapping("", NAMESPACE);
    +  51  0 
         }
    +  52   + 
     
     53   - 
     
    + 
         /**
     54   - 
         /**
    -  55   
          * Called when an element is started.
    +  55   + 
          *
     56   - 
          *
    + 
          * @param uri the uri
     57   - 
          * @param uri the uri
    + 
          * @param localName the localName
     58   - 
          * @param localName the localName
    + 
          * @param qName the qualified name
     59   - 
          * @param qName the qualified name
    -  60   
          * @param atts the attributes
    +  60   + 
          * @throws SAXException thrown if there is a SAXException
     61   - 
          * @throws SAXException thrown if there is a SAXException
    + 
          */
     62   - 
          */
    + 
         @Override
     63   - 
         @Override
    -  64   
         public void startElement(String uri, String localName, String qName, Attributes atts) throws SAXException {
    -  65  1545 
             super.startElement(NAMESPACE, localName, qName, atts);
    -  66  1545 
         }
    +  64  0 
             super.startElement(NAMESPACE, localName, qName, atts);
    +  65  0 
         }
    +  66   + 
     
     67   - 
     
    + 
         /**
     68   - 
         /**
    -  69   
          * Indicatees the start of the document.
    +  69   + 
          *
     70   - 
          *
    -  71   
          * @param uri the uri
    -  72   +  71   
          * @param localName the localName
    -  73   +  72   
          * @param qName the qualified name
    +  73   + 
          * @throws SAXException thrown if there is a SAXException
     74   - 
          * @throws SAXException thrown if there is a SAXException
    + 
          */
     75   - 
          */
    + 
         @Override
     76   - 
         @Override
    -  77   
         public void endElement(String uri, String localName, String qName)
    -  78   +  77   
                 throws SAXException {
    -  79  1545 
             super.endElement(NAMESPACE, localName, qName);
    -  80  1545 
         }
    -  81   +  78  0 
             super.endElement(NAMESPACE, localName, qName);
    +  79  0 
         }
    +  80   
     
    -  82   +  81   
         /**
    -  83   +  82   
          * Called when prefix mapping is started.
    -  84   +  83   
          *
    -  85   +  84   
          * @param prefix the prefix
    -  86   +  85   
          * @param url the url
    -  87   +  86   
          * @throws SAXException thrown if there is a SAXException
    -  88   +  87   
          */
    -  89   +  88   
         @Override
    -  90   +  89   
         public void startPrefixMapping(String prefix, String url) throws SAXException {
    -  91  7 
             if (!this.namespaceAdded) {
    -  92  7 
                 namespaceAdded = true;
    -  93  7 
                 super.startPrefixMapping("", NAMESPACE);
    -  94   +  90  0 
             if (!this.namespaceAdded) {
    +  91  0 
                 namespaceAdded = true;
    +  92  0 
                 super.startPrefixMapping("", NAMESPACE);
    +  93   
             }
    -  95  7 
         }
    -  96   +  94  0 
         }
    +  95   
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Activation.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Activation.html index 337b2b355..a96a68e3b 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Activation.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Activation.html @@ -117,7 +117,7 @@ 
     })
     50   
     @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
    -  51  3 
     public class Activation {
    +  51  6 
     public class Activation {
     52   
     
     53   @@ -393,6 +393,6 @@ 
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.ActivationFile.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.ActivationFile.html index 8b542847c..8b6ac2b4d 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.ActivationFile.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.ActivationFile.html @@ -226,6 +226,6 @@ 
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.ActivationOS.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.ActivationOS.html index fe43a9cbd..79330a7c1 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.ActivationOS.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.ActivationOS.html @@ -334,6 +334,6 @@ 
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.ActivationProperty.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.ActivationProperty.html index dff151b3d..9322a7919 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.ActivationProperty.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.ActivationProperty.html @@ -111,7 +111,7 @@ 
     })
     47   
     @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
    -  48  3 
     public class ActivationProperty {
    +  48  6 
     public class ActivationProperty {
     49   
     
     50   @@ -226,6 +226,6 @@ 
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Build.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Build.html index 5240be416..ba62685e6 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Build.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Build.html @@ -236,7 +236,7 @@ 
     })
     107   
     @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
    -  108  7 
     public class Build {
    +  108  14 
     public class Build {
     109   
     
     110   @@ -1153,7 +1153,7 @@ 
         })
     589   
         @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
    -  590  1 
         public static class Filters {
    +  590  2 
         public static class Filters {
     591   
     
     592   @@ -1273,7 +1273,7 @@ 
         })
     651   
         @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
    -  652  7 
         public static class Plugins {
    +  652  14 
         public static class Plugins {
     653   
     
     654   @@ -1393,7 +1393,7 @@ 
         })
     713   
         @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
    -  714  3 
         public static class Resources {
    +  714  6 
         public static class Resources {
     715   
     
     716   @@ -1503,7 +1503,7 @@ 
          *
     770   
          */
    -  771  7 
         @XmlAccessorType(XmlAccessType.FIELD)
    +  771  14 
         @XmlAccessorType(XmlAccessType.FIELD)
     772   
         @XmlType(name = "", propOrder = {
     773   @@ -1512,7 +1512,7 @@ 
         })
     775   
         @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
    -  776  1 
         public static class TestResources {
    +  776  2 
         public static class TestResources {
     777   
     
     778   @@ -1586,6 +1586,6 @@ 
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.BuildBase.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.BuildBase.html index dc682f943..626e21cc3 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.BuildBase.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.BuildBase.html @@ -203,7 +203,7 @@ 
     })
     91   
     @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
    -  92  7 
     public class BuildBase {
    +  92  14 
     public class BuildBase {
     93   
     
     94   @@ -802,7 +802,7 @@ 
         })
     405   
         @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
    -  406  7 
         public static class Plugins {
    +  406  14 
         public static class Plugins {
     407   
     
     408   @@ -1032,7 +1032,7 @@ 
          *
     524   
          */
    -  525  7 
         @XmlAccessorType(XmlAccessType.FIELD)
    +  525  14 
         @XmlAccessorType(XmlAccessType.FIELD)
     526   
         @XmlType(name = "", propOrder = {
     527   @@ -1115,6 +1115,6 @@ 
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.CiManagement.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.CiManagement.html index 990a6f796..7bb86e8fd 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.CiManagement.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.CiManagement.html @@ -417,6 +417,6 @@ 
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Contributor.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Contributor.html index 9072cc07b..3671e2894 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Contributor.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Contributor.html @@ -173,7 +173,7 @@ 
     })
     77   
     @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
    -  78  1 
     public class Contributor {
    +  78  2 
     public class Contributor {
     79   
     
     80   @@ -764,7 +764,7 @@ 
          *
     387   
          */
    -  388  1 
         @XmlAccessorType(XmlAccessType.FIELD)
    +  388  2 
         @XmlAccessorType(XmlAccessType.FIELD)
     389   
         @XmlType(name = "", propOrder = {
     390   @@ -847,6 +847,6 @@ 
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Dependency.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Dependency.html index 7e2edab84..96de792d1 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Dependency.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Dependency.html @@ -144,7 +144,7 @@ 
     })
     63   
     @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
    -  64  91 
     public class Dependency {
    +  64  182 
     public class Dependency {
     65   
     
     66   @@ -670,7 +670,7 @@ 
          *
     340   
          */
    -  341  91 
         @XmlAccessorType(XmlAccessType.FIELD)
    +  341  182 
         @XmlAccessorType(XmlAccessType.FIELD)
     342   
         @XmlType(name = "", propOrder = {
     343   @@ -679,7 +679,7 @@ 
         })
     345   
         @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
    -  346  4 
         public static class Exclusions {
    +  346  8 
         public static class Exclusions {
     347   
     
     348   @@ -753,6 +753,6 @@ 
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.DependencyManagement.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.DependencyManagement.html index 6c744f8c3..baa1a0150 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.DependencyManagement.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.DependencyManagement.html @@ -311,6 +311,6 @@ 
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.DeploymentRepository.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.DeploymentRepository.html index bcd805de7..ec0431c0f 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.DeploymentRepository.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.DeploymentRepository.html @@ -115,7 +115,7 @@ 
     })
     49   
     @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
    -  50  2 
     public class DeploymentRepository {
    +  50  4 
     public class DeploymentRepository {
     51   
     
     52   @@ -393,6 +393,6 @@ 
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Developer.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Developer.html index acbc6ffe2..e61f40ac3 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Developer.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Developer.html @@ -171,7 +171,7 @@ 
     })
     76   
     @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
    -  77  14 
     public class Developer {
    +  77  28 
     public class Developer {
     78   
     
     79   @@ -815,7 +815,7 @@ 
          *
     414   
          */
    -  415  14 
         @XmlAccessorType(XmlAccessType.FIELD)
    +  415  28 
         @XmlAccessorType(XmlAccessType.FIELD)
     416   
         @XmlType(name = "", propOrder = {
     417   @@ -898,6 +898,6 @@ 
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.DistributionManagement.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.DistributionManagement.html index 95f6e8a0c..0eddd7898 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.DistributionManagement.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.DistributionManagement.html @@ -119,7 +119,7 @@ 
     })
     51   
     @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
    -  52  3 
     public class DistributionManagement {
    +  52  6 
     public class DistributionManagement {
     53   
     
     54   @@ -446,6 +446,6 @@ 
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Exclusion.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Exclusion.html index 20028304c..1a8c448a7 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Exclusion.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Exclusion.html @@ -103,7 +103,7 @@ 
     })
     43   
     @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
    -  44  5 
     public class Exclusion {
    +  44  10 
     public class Exclusion {
     45   
     
     46   @@ -218,6 +218,6 @@ 
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Extension.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Extension.html index c505b4dd0..8db0e3802 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Extension.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Extension.html @@ -273,6 +273,6 @@ 
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.IssueManagement.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.IssueManagement.html index c4faeeb9a..6194ac134 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.IssueManagement.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.IssueManagement.html @@ -107,7 +107,7 @@ 
     })
     45   
     @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
    -  46  2 
     public class IssueManagement {
    +  46  4 
     public class IssueManagement {
     47   
     
     48   @@ -222,6 +222,6 @@ 
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.License.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.License.html index 4fdc1edea..b65da0ac3 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.License.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.License.html @@ -115,7 +115,7 @@ 
     })
     49   
     @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
    -  50  1 
     public class License {
    +  50  2 
     public class License {
     51   
     
     52   @@ -156,7 +156,7 @@ 
         @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
     70   
         public String getName() {
    -  71  2 
             return name;
    +  71  4 
             return name;
     72   
         }
     73   @@ -205,7 +205,7 @@ 
         @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
     96   
         public String getUrl() {
    -  97  2 
             return url;
    +  97  4 
             return url;
     98   
         }
     99   @@ -336,6 +336,6 @@ 
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.MailingList.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.MailingList.html index ade334a44..7de21bac0 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.MailingList.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.MailingList.html @@ -588,6 +588,6 @@ 
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Model.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Model.html index f5bceb4d7..dff221c11 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Model.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Model.html @@ -406,7 +406,7 @@ 
     })
     189   
     @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
    -  190  7 
     public class Model {
    +  190  14 
     public class Model {
     191   
     
     192   @@ -651,7 +651,7 @@ 
         @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
     315   
         public String getGroupId() {
    -  316  7 
             return groupId;
    +  316  14 
             return groupId;
     317   
         }
     318   @@ -700,7 +700,7 @@ 
         @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
     341   
         public String getArtifactId() {
    -  342  7 
             return artifactId;
    +  342  14 
             return artifactId;
     343   
         }
     344   @@ -798,7 +798,7 @@ 
         @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
     393   
         public String getName() {
    -  394  7 
             return name;
    +  394  14 
             return name;
     395   
         }
     396   @@ -847,7 +847,7 @@ 
         @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
     419   
         public String getVersion() {
    -  420  7 
             return version;
    +  420  14 
             return version;
     421   
         }
     422   @@ -896,7 +896,7 @@ 
         @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
     445   
         public String getDescription() {
    -  446  10 
             return description;
    +  446  20 
             return description;
     447   
         }
     448   @@ -1337,7 +1337,7 @@ 
         @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
     679   
         public Model.Licenses getLicenses() {
    -  680  8 
             return licenses;
    +  680  16 
             return licenses;
     681   
         }
     682   @@ -1435,7 +1435,7 @@ 
         @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
     731   
         public Organization getOrganization() {
    -  732  7 
             return organization;
    +  732  14 
             return organization;
     733   
         }
     734   @@ -2053,7 +2053,7 @@ 
         })
     1058   
         @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
    -  1059  1 
         public static class Contributors {
    +  1059  2 
         public static class Contributors {
     1060   
     
     1061   @@ -2173,7 +2173,7 @@ 
         })
     1120   
         @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
    -  1121  7 
         public static class Dependencies {
    +  1121  14 
         public static class Dependencies {
     1122   
     
     1123   @@ -2293,7 +2293,7 @@ 
         })
     1182   
         @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
    -  1183  1 
         public static class Developers {
    +  1183  2 
         public static class Developers {
     1184   
     
     1185   @@ -2413,7 +2413,7 @@ 
         })
     1244   
         @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
    -  1245  1 
         public static class Licenses {
    +  1245  2 
         public static class Licenses {
     1246   
     
     1247   @@ -2470,11 +2470,11 @@ 
             @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
     1273   
             public List<License> getLicense() {
    -  1274  1 
                 if (license == null) {
    +  1274  2 
                 if (license == null) {
     1275  0 
                     license = new ArrayList<License>();
     1276   
                 }
    -  1277  1 
                 return this.license;
    +  1277  2 
                 return this.license;
     1278   
             }
     1279   @@ -2773,7 +2773,7 @@ 
         })
     1430   
         @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
    -  1431  1 
         public static class PluginRepositories {
    +  1431  2 
         public static class PluginRepositories {
     1432   
     
     1433   @@ -2893,7 +2893,7 @@ 
         })
     1492   
         @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
    -  1493  6 
         public static class Profiles {
    +  1493  12 
         public static class Profiles {
     1494   
     
     1495   @@ -3013,7 +3013,7 @@ 
         })
     1554   
         @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
    -  1555  3 
         public static class Properties {
    +  1555  6 
         public static class Properties {
     1556   
     
     1557   @@ -3247,7 +3247,7 @@ 
          *
     1675   
          */
    -  1676  7 
         @XmlAccessorType(XmlAccessType.FIELD)
    +  1676  14 
         @XmlAccessorType(XmlAccessType.FIELD)
     1677   
         @XmlType(name = "", propOrder = {
     1678   @@ -3256,7 +3256,7 @@ 
         })
     1680   
         @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
    -  1681  1 
         public static class Repositories {
    +  1681  2 
         public static class Repositories {
     1682   
     
     1683   @@ -3330,6 +3330,6 @@ 
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Notifier.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Notifier.html index 0c4923616..695736dd7 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Notifier.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Notifier.html @@ -659,6 +659,6 @@ 
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.ObjectFactory.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.ObjectFactory.html index 6e1bfd496..c21d1ed85 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.ObjectFactory.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.ObjectFactory.html @@ -1394,6 +1394,6 @@ 
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Organization.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Organization.html index 27f1ca02b..792edae32 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Organization.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Organization.html @@ -218,6 +218,6 @@ 
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Parent.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Parent.html index 1dab2a01a..a6869614b 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Parent.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Parent.html @@ -109,7 +109,7 @@ 
     })
     46   
     @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
    -  47  7 
     public class Parent {
    +  47  14 
     public class Parent {
     48   
     
     49   @@ -332,6 +332,6 @@ 
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Plugin.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Plugin.html index 56ed624eb..37bafe2c2 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Plugin.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Plugin.html @@ -211,7 +211,7 @@ 
     })
     95   
     @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
    -  96  37 
     public class Plugin {
    +  96  74 
     public class Plugin {
     97   
     
     98   @@ -747,7 +747,7 @@ 
         })
     377   
         @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
    -  378  23 
         public static class Configuration {
    +  378  46 
         public static class Configuration {
     379   
     
     380   @@ -989,7 +989,7 @@ 
         })
     502   
         @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
    -  503  25 
         public static class Executions {
    +  503  50 
         public static class Executions {
     504   
     
     505   @@ -1099,7 +1099,7 @@ 
          *
     559   
          */
    -  560  37 
         @XmlAccessorType(XmlAccessType.FIELD)
    +  560  74 
         @XmlAccessorType(XmlAccessType.FIELD)
     561   
         @XmlType(name = "", propOrder = {
     562   @@ -1184,6 +1184,6 @@ 
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.PluginExecution.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.PluginExecution.html index 6afd15c17..05d5e35fa 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.PluginExecution.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.PluginExecution.html @@ -161,7 +161,7 @@ 
     })
     71   
     @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
    -  72  27 
     public class PluginExecution {
    +  72  54 
     public class PluginExecution {
     73   
     
     74   @@ -483,7 +483,7 @@ 
         })
     240   
         @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
    -  241  11 
         public static class Configuration {
    +  241  22 
         public static class Configuration {
     242   
     
     243   @@ -595,7 +595,7 @@ 
          *
     298   
          */
    -  299  27 
         @XmlAccessorType(XmlAccessType.FIELD)
    +  299  54 
         @XmlAccessorType(XmlAccessType.FIELD)
     300   
         @XmlType(name = "", propOrder = {
     301   @@ -604,7 +604,7 @@ 
         })
     303   
         @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
    -  304  27 
         public static class Goals {
    +  304  54 
         public static class Goals {
     305   
     
     306   @@ -678,6 +678,6 @@ 
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.PluginManagement.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.PluginManagement.html index 5484be52f..ceaa1f6b9 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.PluginManagement.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.PluginManagement.html @@ -311,6 +311,6 @@ 
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Prerequisites.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Prerequisites.html index d12dcf28b..e0e99ba0b 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Prerequisites.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Prerequisites.html @@ -167,6 +167,6 @@ 
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Profile.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Profile.html index 753547a4b..eea861127 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Profile.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Profile.html @@ -261,7 +261,7 @@ 
     })
     119   
     @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
    -  120  11 
     public class Profile {
    +  120  22 
     public class Profile {
     121   
     
     122   @@ -952,7 +952,7 @@ 
         })
     483   
         @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
    -  484  3 
         public static class Dependencies {
    +  484  6 
         public static class Dependencies {
     485   
     
     486   @@ -1546,7 +1546,7 @@ 
          *
     790   
          */
    -  791  11 
         @XmlAccessorType(XmlAccessType.FIELD)
    +  791  22 
         @XmlAccessorType(XmlAccessType.FIELD)
     792   
         @XmlType(name = "", propOrder = {
     793   @@ -1629,6 +1629,6 @@ 
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Relocation.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Relocation.html index 1b68eccfc..66759d7b5 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Relocation.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Relocation.html @@ -330,6 +330,6 @@ 
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.ReportPlugin.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.ReportPlugin.html index dbb54d0fd..18df96516 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.ReportPlugin.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.ReportPlugin.html @@ -163,7 +163,7 @@ 
     })
     72   
     @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
    -  73  14 
     public class ReportPlugin {
    +  73  28 
     public class ReportPlugin {
     74   
     
     75   @@ -538,7 +538,7 @@ 
         })
     269   
         @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
    -  270  12 
         public static class Configuration {
    +  270  24 
         public static class Configuration {
     271   
     
     272   @@ -650,7 +650,7 @@ 
          *
     327   
          */
    -  328  14 
         @XmlAccessorType(XmlAccessType.FIELD)
    +  328  28 
         @XmlAccessorType(XmlAccessType.FIELD)
     329   
         @XmlType(name = "", propOrder = {
     330   @@ -659,7 +659,7 @@ 
         })
     332   
         @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
    -  333  3 
         public static class ReportSets {
    +  333  6 
         public static class ReportSets {
     334   
     
     335   @@ -733,6 +733,6 @@ 
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.ReportSet.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.ReportSet.html index e5879d6b4..253f18a49 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.ReportSet.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.ReportSet.html @@ -159,7 +159,7 @@ 
     })
     70   
     @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
    -  71  3 
     public class ReportSet {
    +  71  6 
     public class ReportSet {
     72   
     
     73   @@ -540,7 +540,7 @@ 
          *
     269   
          */
    -  270  3 
         @XmlAccessorType(XmlAccessType.FIELD)
    +  270  6 
         @XmlAccessorType(XmlAccessType.FIELD)
     271   
         @XmlType(name = "", propOrder = {
     272   @@ -549,7 +549,7 @@ 
         })
     274   
         @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
    -  275  3 
         public static class Reports {
    +  275  6 
         public static class Reports {
     276   
     
     277   @@ -623,6 +623,6 @@ 
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Reporting.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Reporting.html index b148e91d1..fce358a81 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Reporting.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Reporting.html @@ -132,7 +132,7 @@ 
     })
     57   
     @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
    -  58  5 
     public class Reporting {
    +  58  10 
     public class Reporting {
     59   
     
     60   @@ -338,7 +338,7 @@ 
          *
     165   
          */
    -  166  5 
         @XmlAccessorType(XmlAccessType.FIELD)
    +  166  10 
         @XmlAccessorType(XmlAccessType.FIELD)
     167   
         @XmlType(name = "", propOrder = {
     168   @@ -347,7 +347,7 @@ 
         })
     170   
         @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
    -  171  5 
         public static class Plugins {
    +  171  10 
         public static class Plugins {
     172   
     
     173   @@ -421,6 +421,6 @@ 
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Repository.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Repository.html index 2a69bb1ff..5d912114c 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Repository.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Repository.html @@ -117,7 +117,7 @@ 
     })
     50   
     @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
    -  51  3 
     public class Repository {
    +  51  6 
     public class Repository {
     52   
     
     53   @@ -446,6 +446,6 @@ 
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.RepositoryPolicy.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.RepositoryPolicy.html index a73311f1f..5b38835f1 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.RepositoryPolicy.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.RepositoryPolicy.html @@ -107,7 +107,7 @@ 
     })
     45   
     @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
    -  46  6 
     public class RepositoryPolicy {
    +  46  12 
     public class RepositoryPolicy {
     47   
     
     48   @@ -277,6 +277,6 @@ 
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Resource.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Resource.html index 9349134f4..adce979be 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Resource.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Resource.html @@ -163,7 +163,7 @@ 
     })
     72   
     @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
    -  73  9 
     public class Resource {
    +  73  18 
     public class Resource {
     74   
     
     75   @@ -485,7 +485,7 @@ 
         })
     241   
         @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
    -  242  2 
         public static class Excludes {
    +  242  4 
         public static class Excludes {
     243   
     
     244   @@ -595,7 +595,7 @@ 
          *
     298   
          */
    -  299  9 
         @XmlAccessorType(XmlAccessType.FIELD)
    +  299  18 
         @XmlAccessorType(XmlAccessType.FIELD)
     300   
         @XmlType(name = "", propOrder = {
     301   @@ -604,7 +604,7 @@ 
         })
     303   
         @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
    -  304  3 
         public static class Includes {
    +  304  6 
         public static class Includes {
     305   
     
     306   @@ -678,6 +678,6 @@ 
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Scm.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Scm.html index 52fb53286..e5b308714 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Scm.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Scm.html @@ -109,7 +109,7 @@ 
     })
     46   
     @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
    -  47  6 
     public class Scm {
    +  47  12 
     public class Scm {
     48   
     
     49   @@ -332,6 +332,6 @@ 
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Site.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Site.html index b68c92fbc..75abde458 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Site.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.Site.html @@ -109,7 +109,7 @@ 
     })
     46   
     @Generated(value = "com.sun.tools.internal.xjc.Driver", date = "2012-11-09T12:33:57-05:00", comments = "JAXB RI vJAXB 2.1.10 in JDK 6")
    -  47  3 
     public class Site {
    +  47  6 
     public class Site {
     48   
     
     49   @@ -277,6 +277,6 @@ 
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.package-info.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.package-info.html index 5ae2c13b9..4f518de41 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.package-info.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.jaxb.pom.generated.package-info.html @@ -37,6 +37,6 @@ 
     package org.owasp.dependencycheck.jaxb.pom.generated;
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.reporting.ReportGenerator.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.reporting.ReportGenerator.html index 531d4e44e..a0714c5bb 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.reporting.ReportGenerator.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.reporting.ReportGenerator.html @@ -12,7 +12,7 @@
     
    - +
    Classes in this File Line Coverage Branch Coverage Complexity
    ReportGenerator
    54%
    45/82
    15%
    6/38
    		5.333
    ReportGenerator
    55%
    47/84
    15%
    6/38
    		5.333
    ReportGenerator$Format
    0%
    0/5
    N/A
    N/A
    		5.333
    @@ -25,318 +25,316 @@  3   
      *
     4   - 
      * Dependency-check-core is free software: you can redistribute it and/or modify it
    + 
      * Licensed under the Apache License, Version 2.0 (the "License");
     5   - 
      * under the terms of the GNU General Public License as published by the Free
    + 
      * you may not use this file except in compliance with the License.
     6   - 
      * Software Foundation, either version 3 of the License, or (at your option) any
    + 
      * You may obtain a copy of the License at
     7   - 
      * later version.
    + 
      *
     8   - 
      *
    + 
      *     http://www.apache.org/licenses/LICENSE-2.0
     9   - 
      * Dependency-check-core is distributed in the hope that it will be useful, but
    + 
      *
     10   - 
      * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
    + 
      * Unless required by applicable law or agreed to in writing, software
     11   - 
      * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
    + 
      * distributed under the License is distributed on an "AS IS" BASIS,
     12   - 
      * details.
    + 
      * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13   - 
      *
    + 
      * See the License for the specific language governing permissions and
     14   - 
      * You should have received a copy of the GNU General Public License along with
    + 
      * limitations under the License.
     15   - 
      * dependency-check-core. If not, see http://www.gnu.org/licenses/.
    -  16   
      *
    -  17   +  16   
      * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
    -  18   +  17   
      */
    -  19   +  18   
     package org.owasp.dependencycheck.reporting;
    -  20   +  19   
     
    +  20   + 
     import java.io.File;
     21   
     import java.io.FileInputStream;
     22   - 
     import java.io.File;
    -  23   
     import java.io.FileNotFoundException;
    -  24   +  23   
     import java.io.FileOutputStream;
    -  25   +  24   
     import java.io.IOException;
    -  26   +  25   
     import java.io.InputStream;
    -  27   +  26   
     import java.io.InputStreamReader;
    -  28   +  27   
     import java.io.OutputStream;
    -  29   +  28   
     import java.io.OutputStreamWriter;
    -  30   +  29   
     import java.util.List;
    -  31   +  30   
     import java.util.logging.Level;
    -  32   +  31   
     import java.util.logging.Logger;
    -  33   +  32   
     import org.apache.velocity.app.VelocityEngine;
    -  34   +  33   
     import org.apache.velocity.context.Context;
    -  35   +  34   
     import org.apache.velocity.runtime.RuntimeConstants;
    -  36   +  35   
     import org.apache.velocity.runtime.resource.loader.ClasspathResourceLoader;
    -  37   +  36   
     import org.apache.velocity.tools.ToolManager;
    -  38   +  37   
     import org.apache.velocity.tools.config.EasyFactoryConfiguration;
    -  39   +  38   
     import org.owasp.dependencycheck.analyzer.Analyzer;
    +  39   + 
     import org.owasp.dependencycheck.data.nvdcve.DatabaseProperties;
     40   
     import org.owasp.dependencycheck.dependency.Dependency;
     41   - 
     
    + 
     import org.owasp.dependencycheck.utils.Settings;
     42   - 
     /**
    + 
     
     43   - 
      * The ReportGenerator is used to, as the name implies, generate reports.
    + 
     /**
     44   - 
      * Internally the generator uses the Velocity Templating Engine. The
    + 
      * The ReportGenerator is used to, as the name implies, generate reports. Internally the generator uses the Velocity
     45   - 
      * ReportGenerator exposes a list of Dependencies to the template when
    + 
      * Templating Engine. The ReportGenerator exposes a list of Dependencies to the template when generating the report.
     46   - 
      * generating the report.
    -  47   
      *
    -  48   +  47   
      * @author Jeremy Long <jeremy.long@owasp.org>
    -  49   +  48   
      */
    -  50   +  49   
     public class ReportGenerator {
    +  50   + 
     
     51   - 
     
    + 
         /**
     52   - 
         /**
    -  53   
          * An enumeration of the report formats.
    -  54   +  53   
          */
    -  55  0 
         public enum Format {
    +  54  0 
         public enum Format {
    +  55   + 
     
     56   - 
     
    + 
             /**
     57   - 
             /**
    -  58   
              * Generate all reports.
    -  59   +  58   
              */
    -  60  0 
             ALL,
    +  59  0 
             ALL,
    +  60   + 
             /**
     61   - 
             /**
    -  62   
              * Generate XML report.
    -  63   +  62   
              */
    -  64  0 
             XML,
    +  63  0 
             XML,
    +  64   + 
             /**
     65   - 
             /**
    -  66   
              * Generate HTML report.
    -  67   +  66   
              */
    -  68  0 
             HTML,
    -  69   +  67  0 
             HTML,
    +  68   
             /**
    -  70   +  69   
              * Generate HTML Vulnerability report.
    -  71   +  70   
              */
    -  72  0 
             VULN
    -  73   +  71  0 
             VULN
    +  72   
         }
    +  73   + 
         /**
     74   - 
         /**
    -  75   
          * The Velocity Engine.
    +  75   + 
          */
     76   - 
          */
    -  77   
         private final VelocityEngine engine;
    +  77   + 
         /**
     78   - 
         /**
    -  79   
          * The Velocity Engine Context.
    -  80   +  79   
          */
    -  81   +  80   
         private final Context context;
    -  82   +  81   
     
    -  83   +  82   
         /**
    -  84   +  83   
          * Constructs a new ReportGenerator.
    -  85   +  84   
          *
    -  86   +  85   
          * @param applicationName the application name being analyzed
    -  87   +  86   
          * @param dependencies the list of dependencies
    +  87   + 
          * @param analyzers the list of analyzers used
     88   - 
          * @param analyzers the list of analyzers used.
    + 
          * @param properties the database properties (containing timestamps of the NVD CVE data)
     89   
          */
    -  90  1 
         public ReportGenerator(String applicationName, List<Dependency> dependencies, List<Analyzer> analyzers) {
    -  91  1 
             engine = createVelocityEngine();
    -  92  1 
             context = createContext();
    +  90  2 
         public ReportGenerator(String applicationName, List<Dependency> dependencies, List<Analyzer> analyzers, DatabaseProperties properties) {
    +  91  2 
             engine = createVelocityEngine();
    +  92  2 
             context = createContext();
     93   
     
    -  94  1 
             engine.init();
    +  94  2 
             engine.init();
     95   
     
    -  96  1 
             context.put("applicationName", applicationName);
    -  97  1 
             context.put("dependencies", dependencies);
    -  98  1 
             context.put("analyzers", analyzers);
    -  99  1 
         }
    -  100   - 
     
    -  101   - 
         /**
    +  96  2 
             context.put("applicationName", applicationName);
    +  97  2 
             context.put("dependencies", dependencies);
    +  98  2 
             context.put("analyzers", analyzers);
    +  99  2 
             context.put("properties", properties);
    +  100  2 
             context.put("version", Settings.getString("application.version", "Unknown"));
    +  101  2 
         }
     102   - 
          * Creates a new Velocity Engine.
    + 
     
     103   - 
          *
    + 
         /**
     104   - 
          * @return a velocity engine.
    + 
          * Creates a new Velocity Engine.
     105   - 
          */
    + 
          *
     106   + 
          * @return a velocity engine.
    +  107   + 
          */
    +  108   
         private VelocityEngine createVelocityEngine() {
    -  107  1 
             final VelocityEngine ve = new VelocityEngine();
    -  108  1 
             ve.setProperty(RuntimeConstants.RUNTIME_LOG_LOGSYSTEM_CLASS, VelocityLoggerRedirect.class.getName());
    -  109  1 
             ve.setProperty(RuntimeConstants.RESOURCE_LOADER, "classpath");
    -  110  1 
             ve.setProperty("classpath.resource.loader.class", ClasspathResourceLoader.class.getName());
    -  111  1 
             return ve;
    -  112   - 
         }
    -  113   - 
     
    +  109  2 
             final VelocityEngine ve = new VelocityEngine();
    +  110  2 
             ve.setProperty(RuntimeConstants.RUNTIME_LOG_LOGSYSTEM_CLASS, VelocityLoggerRedirect.class.getName());
    +  111  2 
             ve.setProperty(RuntimeConstants.RESOURCE_LOADER, "classpath");
    +  112  2 
             ve.setProperty("classpath.resource.loader.class", ClasspathResourceLoader.class.getName());
    +  113  2 
             return ve;
     114   - 
         /**
    -  115   - 
          * Creates a new Velocity Context initialized with escape and date tools.
    -  116   - 
          *
    -  117   - 
          * @return a Velocity Context.
    -  118   - 
          */
    -  119   - 
         @edu.umd.cs.findbugs.annotations.SuppressWarnings(value = "RV_RETURN_VALUE_IGNORED_INFERRED",
    -  120   - 
                 justification = "No plan to fix this style issue")
    -  121   - 
         private Context createContext() {
    -  122  1 
             final ToolManager manager = new ToolManager();
    -  123  1 
             final Context c = manager.createContext();
    -  124  1 
             final EasyFactoryConfiguration config = new EasyFactoryConfiguration();
    -  125  1 
             config.addDefaultTools();
    -  126  1 
             config.toolbox("application").tool("esc", "org.apache.velocity.tools.generic.EscapeTool").tool("org.apache.velocity.tools.generic.DateTool");
    -  127  1 
             manager.configure(config);
    -  128  1 
             return c;
    -  129   
         }
    -  130   +  115   
     
    +  116   + 
         /**
    +  117   + 
          * Creates a new Velocity Context initialized with escape and date tools.
    +  118   + 
          *
    +  119   + 
          * @return a Velocity Context.
    +  120   + 
          */
    +  121   + 
         @edu.umd.cs.findbugs.annotations.SuppressWarnings(value = "RV_RETURN_VALUE_IGNORED_INFERRED",
    +  122   + 
                 justification = "No plan to fix this style issue")
    +  123   + 
         private Context createContext() {
    +  124  2 
             final ToolManager manager = new ToolManager();
    +  125  2 
             final Context c = manager.createContext();
    +  126  2 
             final EasyFactoryConfiguration config = new EasyFactoryConfiguration();
    +  127  2 
             config.addDefaultTools();
    +  128  2 
             config.toolbox("application").tool("esc", "org.apache.velocity.tools.generic.EscapeTool").tool("org.apache.velocity.tools.generic.DateTool");
    +  129  2 
             manager.configure(config);
    +  130  2 
             return c;
     131   - 
         /**
    + 
         }
     132   - 
          * Generates the Dependency Reports for the identified dependencies.
    + 
     
     133   - 
          *
    + 
         /**
     134   - 
          * @param outputDir the path where the reports should be written
    -  135   - 
          * @param format the format the report should be written in
    -  136   - 
          * @throws IOException is thrown when the template file does not exist
    -  137   - 
          * @throws Exception is thrown if there is an error writing out the reports.
    -  138   - 
          */
    -  139   - 
         public void generateReports(String outputDir, Format format) throws IOException, Exception {
    -  140  0 
             if (format == Format.XML || format == Format.ALL) {
    -  141  0 
                 generateReport("XmlReport", outputDir + File.separator + "DependencyCheck-Report.xml");
    -  142   - 
             }
    -  143  0 
             if (format == Format.HTML || format == Format.ALL) {
    -  144  0 
                 generateReport("HtmlReport", outputDir + File.separator + "DependencyCheck-Report.html");
    -  145   - 
             }
    -  146  0 
             if (format == Format.VULN || format == Format.ALL) {
    -  147  0 
                 generateReport("VulnerabilityReport", outputDir + File.separator + "DependencyCheck-Vulnerability.html");
    -  148   - 
             }
    -  149  0 
         }
    -  150   - 
     
    -  151   - 
         /**
    -  152   
          * Generates the Dependency Reports for the identified dependencies.
    -  153   +  135   
          *
    -  154   +  136   
          * @param outputDir the path where the reports should be written
    -  155   - 
          * @param outputFormat the format the report should be written in (XML,
    -  156   - 
          * HTML, ALL)
    -  157   +  137   + 
          * @param format the format the report should be written in
    +  138   
          * @throws IOException is thrown when the template file does not exist
    -  158   +  139   
          * @throws Exception is thrown if there is an error writing out the reports.
    -  159   +  140   
          */
    -  160   - 
         public void generateReports(String outputDir, String outputFormat) throws IOException, Exception {
    -  161  0 
             final String format = outputFormat.toUpperCase();
    -  162  0 
             if (format.matches("^(XML|HTML|VULN|ALL)$")) {
    -  163  0 
                 if ("XML".equalsIgnoreCase(format)) {
    -  164  0 
                     generateReports(outputDir, Format.XML);
    -  165   - 
                 }
    -  166  0 
                 if ("HTML".equalsIgnoreCase(format)) {
    -  167  0 
                     generateReports(outputDir, Format.HTML);
    -  168   - 
                 }
    -  169  0 
                 if ("VULN".equalsIgnoreCase(format)) {
    -  170  0 
                     generateReports(outputDir, Format.VULN);
    -  171   - 
                 }
    -  172  0 
                 if ("ALL".equalsIgnoreCase(format)) {
    -  173  0 
                     generateReports(outputDir, Format.ALL);
    -  174   - 
                 }
    -  175   +  141   + 
         public void generateReports(String outputDir, Format format) throws IOException, Exception {
    +  142  0 
             if (format == Format.XML || format == Format.ALL) {
    +  143  0 
                 generateReport("XmlReport", outputDir + File.separator + "DependencyCheck-Report.xml");
    +  144   
             }
    -  176  0 
         }
    -  177   +  145  0 
             if (format == Format.HTML || format == Format.ALL) {
    +  146  0 
                 generateReport("HtmlReport", outputDir + File.separator + "DependencyCheck-Report.html");
    +  147   + 
             }
    +  148  0 
             if (format == Format.VULN || format == Format.ALL) {
    +  149  0 
                 generateReport("VulnerabilityReport", outputDir + File.separator + "DependencyCheck-Vulnerability.html");
    +  150   + 
             }
    +  151  0 
         }
    +  152   
     
    -  178   +  153   
         /**
    +  154   + 
          * Generates the Dependency Reports for the identified dependencies.
    +  155   + 
          *
    +  156   + 
          * @param outputDir the path where the reports should be written
    +  157   + 
          * @param outputFormat the format the report should be written in (XML, HTML, ALL)
    +  158   + 
          * @throws IOException is thrown when the template file does not exist
    +  159   + 
          * @throws Exception is thrown if there is an error writing out the reports.
    +  160   + 
          */
    +  161   + 
         public void generateReports(String outputDir, String outputFormat) throws IOException, Exception {
    +  162  0 
             final String format = outputFormat.toUpperCase();
    +  163  0 
             if (format.matches("^(XML|HTML|VULN|ALL)$")) {
    +  164  0 
                 if ("XML".equalsIgnoreCase(format)) {
    +  165  0 
                     generateReports(outputDir, Format.XML);
    +  166   + 
                 }
    +  167  0 
                 if ("HTML".equalsIgnoreCase(format)) {
    +  168  0 
                     generateReports(outputDir, Format.HTML);
    +  169   + 
                 }
    +  170  0 
                 if ("VULN".equalsIgnoreCase(format)) {
    +  171  0 
                     generateReports(outputDir, Format.VULN);
    +  172   + 
                 }
    +  173  0 
                 if ("ALL".equalsIgnoreCase(format)) {
    +  174  0 
                     generateReports(outputDir, Format.ALL);
    +  175   + 
                 }
    +  176   + 
             }
    +  177  0 
         }
    +  178   + 
     
     179   - 
          * Generates a report from a given Velocity Template. The template name
    + 
         /**
     180   - 
          * provided can be the name of a template contained in the jar file, such as
    + 
          * Generates a report from a given Velocity Template. The template name provided can be the name of a template
     181   - 
          * 'XmlReport' or 'HtmlReport', or the template name can be the path to a
    + 
          * contained in the jar file, such as 'XmlReport' or 'HtmlReport', or the template name can be the path to a
     182   
          * template file.
     183   @@ -353,10 +351,10 @@ 
          */
     189   
         protected void generateReport(String templateName, String outFileName) throws IOException, Exception {
    -  190  1 
             InputStream input = null;
    -  191  1 
             String templatePath = null;
    -  192  1 
             final File f = new File(templateName);
    -  193  1 
             if (f.exists() && f.isFile()) {
    +  190  2 
             InputStream input = null;
    +  191  2 
             String templatePath = null;
    +  192  2 
             final File f = new File(templateName);
    +  193  2 
             if (f.exists() && f.isFile()) {
     194   
                 try {
     195  0 
                     templatePath = templateName;
    @@ -368,25 +366,25 @@  201  0 
                 }
     202   
             } else {
    -  203  1 
                 templatePath = "templates/" + templateName + ".vsl";
    -  204  1 
                 input = this.getClass().getClassLoader().getResourceAsStream(templatePath);
    +  203  2 
                 templatePath = "templates/" + templateName + ".vsl";
    +  204  2 
                 input = this.getClass().getClassLoader().getResourceAsStream(templatePath);
     205   
             }
    -  206  1 
             if (input == null) {
    +  206  2 
             if (input == null) {
     207  0 
                 throw new IOException("Template file doesn't exist");
     208   
             }
     209   
     
    -  210  1 
             final InputStreamReader reader = new InputStreamReader(input, "UTF-8");
    -  211  1 
             OutputStreamWriter writer = null;
    -  212  1 
             OutputStream outputStream = null;
    +  210  2 
             final InputStreamReader reader = new InputStreamReader(input, "UTF-8");
    +  211  2 
             OutputStreamWriter writer = null;
    +  212  2 
             OutputStream outputStream = null;
     213   
     
     214   
             try {
    -  215  1 
                 final File outDir = new File(outFileName).getParentFile();
    -  216  1 
                 if (!outDir.exists()) {
    +  215  2 
                 final File outDir = new File(outFileName).getParentFile();
    +  216  2 
                 if (!outDir.exists()) {
     217  0 
                     final boolean created = outDir.mkdirs();
     218  0 
                     if (!created) {
     219  0 
                         throw new Exception("Unable to create directory '" + outDir.getAbsolutePath() + "'.");
    @@ -396,47 +394,47 @@ 
                 }
     222   
     
    -  223  1 
                 outputStream = new FileOutputStream(outFileName);
    -  224  1 
                 writer = new OutputStreamWriter(outputStream, "UTF-8");
    +  223  2 
                 outputStream = new FileOutputStream(outFileName);
    +  224  2 
                 writer = new OutputStreamWriter(outputStream, "UTF-8");
     225   
     
    -  226  1 
                 if (!engine.evaluate(context, writer, templatePath, reader)) {
    +  226  2 
                 if (!engine.evaluate(context, writer, templatePath, reader)) {
     227  0 
                     throw new Exception("Failed to convert the template into html.");
     228   
                 }
    -  229  1 
                 writer.flush();
    +  229  2 
                 writer.flush();
     230   
             } finally {
    -  231  1 
                 if (writer != null) {
    +  231  2 
                 if (writer != null) {
     232   
                     try {
    -  233  1 
                         writer.close();
    -  234  0 
                     } catch (Exception ex) {
    +  233  2 
                         writer.close();
    +  234  0 
                     } catch (IOException ex) {
     235  0 
                         Logger.getLogger(ReportGenerator.class.getName()).log(Level.FINEST, null, ex);
    -  236  1 
                     }
    +  236  2 
                     }
     237   
                 }
    -  238  1 
                 if (outputStream != null) {
    +  238  2 
                 if (outputStream != null) {
     239   
                     try {
    -  240  1 
                         outputStream.close();
    -  241  0 
                     } catch (Exception ex) {
    +  240  2 
                         outputStream.close();
    +  241  0 
                     } catch (IOException ex) {
     242  0 
                         Logger.getLogger(ReportGenerator.class.getName()).log(Level.FINEST, null, ex);
    -  243  1 
                     }
    +  243  2 
                     }
     244   
                 }
     245   
                 try {
    -  246  1 
                     reader.close();
    -  247  0 
                 } catch (Exception ex) {
    +  246  2 
                     reader.close();
    +  247  0 
                 } catch (IOException ex) {
     248  0 
                     Logger.getLogger(ReportGenerator.class.getName()).log(Level.FINEST, null, ex);
    -  249  1 
                 }
    +  249  2 
                 }
     250  0 
             }
    -  251  1 
         }
    +  251  2 
         }
     252   
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.reporting.VelocityLoggerRedirect.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.reporting.VelocityLoggerRedirect.html index 1d7cdec78..be52c60e2 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.reporting.VelocityLoggerRedirect.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.reporting.VelocityLoggerRedirect.html @@ -12,7 +12,7 @@
     
    - +
    Classes in this File Line Coverage Branch Coverage Complexity
    VelocityLoggerRedirect
    57%
    8/14
    33%
    2/6
    		3
    VelocityLoggerRedirect
    57%
    8/14
    50%
    3/6
    		3
     
    @@ -24,203 +24,195 @@  3   
      *
     4   - 
      * Dependency-check-core is free software: you can redistribute it and/or modify it
    + 
      * Licensed under the Apache License, Version 2.0 (the "License");
     5   - 
      * under the terms of the GNU General Public License as published by the Free
    + 
      * you may not use this file except in compliance with the License.
     6   - 
      * Software Foundation, either version 3 of the License, or (at your option) any
    + 
      * You may obtain a copy of the License at
     7   - 
      * later version.
    + 
      *
     8   - 
      *
    + 
      *     http://www.apache.org/licenses/LICENSE-2.0
     9   - 
      * Dependency-check-core is distributed in the hope that it will be useful, but
    + 
      *
     10   - 
      * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
    + 
      * Unless required by applicable law or agreed to in writing, software
     11   - 
      * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
    + 
      * distributed under the License is distributed on an "AS IS" BASIS,
     12   - 
      * details.
    + 
      * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13   - 
      *
    + 
      * See the License for the specific language governing permissions and
     14   - 
      * You should have received a copy of the GNU General Public License along with
    + 
      * limitations under the License.
     15   - 
      * dependency-check-core. If not, see http://www.gnu.org/licenses/.
    + 
      *
     16   - 
      *
    -  17   
      * Copyright (c) 2013 Steve Springett. All Rights Reserved.
    +  17   + 
      */
     18   - 
      */
    -  19   
     package org.owasp.dependencycheck.reporting;
    +  19   + 
     
     20   - 
     
    -  21   - 
     import org.apache.velocity.app.Velocity;
    -  22   - 
     import org.apache.velocity.runtime.RuntimeServices;
    -  23   - 
     import org.apache.velocity.runtime.log.LogChute;
    -  24   - 
     
    -  25   
     import java.util.logging.Level;
    -  26   +  21   
     import java.util.logging.Logger;
    -  27   +  22   + 
     import org.apache.velocity.app.Velocity;
    +  23   + 
     import org.apache.velocity.runtime.RuntimeServices;
    +  24   + 
     import org.apache.velocity.runtime.log.LogChute;
    +  25   
     
    -  28   +  26   
     /**
    +  27   + 
      * <p>
    +  28   + 
      * DependencyCheck uses {@link java.util.logging.Logger} as a logging framework, and Apache Velocity uses a custom
     29   - 
      * <p>DependencyCheck uses {@link java.util.logging.Logger} as a logging
    + 
      * logging implementation that outputs to a file named velocity.log by default. This class is an implementation of a
     30   - 
      * framework, and Apache Velocity uses a custom logging implementation that
    + 
      * custom Velocity logger that redirects all velocity logging to the Java Logger class.
     31   - 
      * outputs to a file named velocity.log by default. This class is an
    -  32   - 
      * implementation of a custom Velocity logger that redirects all velocity
    -  33   - 
      * logging to the Java Logger class.
    -  34   
      * </p><p>
    +  32   + 
      * This class was written to address permission issues when using Dependency-Check in a server environment (such as the
    +  33   + 
      * Jenkins plugin). In some circumstances, Velocity would attempt to create velocity.log in an un-writable
    +  34   + 
      * directory.</p>
     35   - 
      * This class was written to address permission issues when using
    -  36   - 
      * Dependency-Check in a server environment (such as the Jenkins plugin). In
    -  37   - 
      * some circumstances, Velocity would attempt to create velocity.log in an
    -  38   - 
      * un-writable directory.</p>
    -  39   
      *
    -  40   - 
      * @author Steve Springett (steve.springett@owasp.org)
    -  41   +  36   + 
      * @author Steve Springett <steve.springett@owasp.org>
    +  37   
      */
    -  42  1 
     public class VelocityLoggerRedirect implements LogChute {
    -  43   +  38  2 
     public class VelocityLoggerRedirect implements LogChute {
    +  39   
     
    -  44   +  40   
         /**
    -  45   +  41   
          * This will be invoked once by the LogManager.
    -  46   +  42   
          *
    -  47   +  43   
          * @param rsvc the RuntimeServices
    -  48   +  44   
          */
    -  49   +  45   
         public void init(RuntimeServices rsvc) {
    -  50   +  46   
             // do nothing
    -  51  1 
         }
    +  47  2 
         }
    +  48   + 
     
    +  49   + 
         /**
    +  50   + 
          * Given a Velocity log level and message, this method will call the appropriate Logger level and log the specified
    +  51   + 
          * values.
     52   - 
     
    + 
          *
     53   - 
         /**
    + 
          * @param level the logging level
     54   - 
          * Given a Velocity log level and message, this method will call the
    + 
          * @param message the message to be logged
     55   - 
          * appropriate Logger level and log the specified values.
    + 
          */
     56   - 
          *
    -  57   - 
          * @param level the logging level
    -  58   - 
          * @param message the message to be logged
    -  59   - 
          */
    -  60   
         public void log(int level, String message) {
    -  61  32 
             Logger.getLogger(Velocity.class.getName()).log(getLevel(level), message);
    -  62  32 
         }
    +  57  64 
             Logger.getLogger(Velocity.class.getName()).log(getLevel(level), message);
    +  58  64 
         }
    +  59   + 
     
    +  60   + 
         /**
    +  61   + 
          * Given a Velocity log level, message and Throwable, this method will call the appropriate Logger level and log the
    +  62   + 
          * specified values.
     63   - 
     
    + 
          *
     64   - 
         /**
    + 
          * @param level the logging level
     65   - 
          * Given a Velocity log level, message and Throwable, this method will call
    -  66   - 
          * the appropriate Logger level and log the specified values.
    -  67   - 
          *
    -  68   - 
          * @param level the logging level
    -  69   
          * @param message the message to be logged
    -  70   +  66   
          * @param t a throwable to log
    -  71   +  67   
          */
    -  72   +  68   
         public void log(int level, String message, Throwable t) {
    -  73  0 
             Logger.getLogger(Velocity.class.getName()).log(getLevel(level), message, t);
    -  74  0 
         }
    -  75   +  69  0 
             Logger.getLogger(Velocity.class.getName()).log(getLevel(level), message, t);
    +  70  0 
         }
    +  71   
     
    -  76   +  72   
         /**
    -  77   +  73   
          * Will always return true. The property file will decide what level to log.
    -  78   +  74   
          *
    -  79   +  75   
          * @param level the logging level
    -  80   +  76   
          * @return true
    -  81   +  77   
          */
    -  82   +  78   
         public boolean isLevelEnabled(int level) {
    -  83  13 
             return true;
    -  84   +  79  24 
             return true;
    +  80   
         }
    -  85   +  81   
     
    -  86   +  82   
         /**
    -  87   +  83   
          * Maps Velocity log levels to {@link Logger} values.
    -  88   +  84   
          *
    -  89   +  85   
          * @param velocityLevel the logging level
    -  90   +  86   
          * @return the logging level
    -  91   +  87   
          */
    -  92   +  88   
         private Level getLevel(int velocityLevel) {
    -  93  32 
             switch (velocityLevel) {
    -  94   +  89  64 
             switch (velocityLevel) {
    +  90   
                 case TRACE_ID:
    -  95  8 
                     return Level.ALL;
    -  96   +  91  16 
                     return Level.ALL;
    +  92   
                 case DEBUG_ID:
    -  97  24 
                     return Level.FINE;
    -  98   +  93  48 
                     return Level.FINE;
    +  94   
                 case INFO_ID:
    -  99  0 
                     return Level.INFO;
    -  100   +  95  0 
                     return Level.INFO;
    +  96   
                 case WARN_ID:
    -  101  0 
                     return Level.WARNING;
    -  102   +  97  0 
                     return Level.WARNING;
    +  98   
                 case ERROR_ID:
    -  103  0 
                     return Level.SEVERE;
    -  104   +  99  0 
                     return Level.SEVERE;
    +  100   
                 default:
    -  105  0 
                     return Level.INFO;
    -  106   +  101  0 
                     return Level.INFO;
    +  102   
             }
    -  107   +  103   
         }
    -  108   +  104   
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.suppression.PropertyType.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.suppression.PropertyType.html index 0eadc4b56..a0a78cf4f 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.suppression.PropertyType.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.suppression.PropertyType.html @@ -24,333 +24,327 @@  3   
      *
     4   - 
      * Dependency-check-core is free software: you can redistribute it and/or modify it
    + 
      * Licensed under the Apache License, Version 2.0 (the "License");
     5   - 
      * under the terms of the GNU General Public License as published by the Free
    + 
      * you may not use this file except in compliance with the License.
     6   - 
      * Software Foundation, either version 3 of the License, or (at your option) any
    + 
      * You may obtain a copy of the License at
     7   - 
      * later version.
    + 
      *
     8   - 
      *
    + 
      *     http://www.apache.org/licenses/LICENSE-2.0
     9   - 
      * Dependency-check-core is distributed in the hope that it will be useful, but
    + 
      *
     10   - 
      * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
    + 
      * Unless required by applicable law or agreed to in writing, software
     11   - 
      * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
    + 
      * distributed under the License is distributed on an "AS IS" BASIS,
     12   - 
      * details.
    + 
      * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13   - 
      *
    + 
      * See the License for the specific language governing permissions and
     14   - 
      * You should have received a copy of the GNU General Public License along with
    + 
      * limitations under the License.
     15   - 
      * dependency-check-core. If not, see http://www.gnu.org/licenses/.
    + 
      *
     16   - 
      *
    -  17   
      * Copyright (c) 2013 Jeremy Long. All Rights Reserved.
    +  17   + 
      */
     18   - 
      */
    -  19   
     package org.owasp.dependencycheck.suppression;
    +  19   + 
     
     20   - 
     
    -  21   
     import java.util.regex.Pattern;
    +  21   + 
     
     22   - 
     
    -  23   
     /**
    +  23   + 
      * A simple PropertyType used to represent a string value that could be used as a regular expression or could be case
     24   - 
      * A simple PropertyType used to represent a string value that could be used as
    + 
      * insensitive. The equals method has been over-ridden so that the object will correctly compare to strings.
     25   - 
      * a regular expression or could be case insensitive. The equals method has been
    -  26   - 
      * over-ridden so that the object will correctly compare to strings.
    -  27   
      *
    -  28   +  26   
      * @author Jeremy Long <jeremy.long@owasp.org>
    -  29   +  27   
      */
    -  30  22 
     public class PropertyType {
    -  31   +  28  44 
     public class PropertyType {
    +  29   
     
    -  32   +  30   
         //<editor-fold defaultstate="collapsed" desc="properties">
    -  33   +  31   
         /**
    -  34   +  32   
          * The value.
    -  35   +  33   
          */
    -  36   +  34   
         private String value;
    -  37   +  35   
     
    -  38   +  36   
         /**
    -  39   +  37   
          * Gets the value of the value property.
    +  38   + 
          *
    +  39   + 
          * @return the value of the value property
     40   
          *
     41   - 
          * @return the value of the value property
    + 
          */
     42   - 
          *
    -  43   - 
          */
    -  44   
         public String getValue() {
    -  45  15 
             return value;
    -  46   +  43  30 
             return value;
    +  44   
         }
    +  45   + 
     
    +  46   + 
         /**
     47   - 
     
    -  48   - 
         /**
    -  49   
          * Sets the value of the value property.
    -  50   +  48   
          *
    -  51   +  49   
          * @param value the value of the value property
    -  52   +  50   
          */
    -  53   +  51   
         public void setValue(String value) {
    -  54  29 
             this.value = value;
    -  55  29 
         }
    -  56   +  52  58 
             this.value = value;
    +  53  58 
         }
    +  54   
         /**
    -  57   +  55   
          * Whether or not the expression is a regex.
    -  58   +  56   
          */
    -  59  22 
         private boolean regex = false;
    -  60   +  57  44 
         private boolean regex = false;
    +  58   
     
    -  61   +  59   
         /**
    -  62   +  60   
          * Returns whether or not the value is a regex.
    +  61   + 
          *
    +  62   + 
          * @return true if the value is a regex, otherwise false
     63   
          *
     64   - 
          * @return true if the value is a regex, otherwise false
    -  65   - 
          *
    -  66   
          */
    -  67   +  65   
         public boolean isRegex() {
    -  68  17 
             return regex;
    -  69   +  66  34 
             return regex;
    +  67   
         }
    -  70   +  68   
     
    -  71   +  69   
         /**
    -  72   +  70   
          * Sets whether the value property is a regex.
    +  71   + 
          *
    +  72   + 
          * @param value true if the value is a regex, otherwise false
     73   
          *
     74   - 
          * @param value true if the value is a regex, otherwise false
    + 
          */
     75   - 
          *
    -  76   - 
          */
    -  77   
         public void setRegex(boolean value) {
    -  78  12 
             this.regex = value;
    -  79  12 
         }
    -  80   +  76  24 
             this.regex = value;
    +  77  24 
         }
    +  78   
         /**
    -  81   +  79   
          * Indicates case sensitivity.
    -  82   +  80   
          */
    -  83  22 
         private boolean caseSensitive = false;
    -  84   +  81  44 
         private boolean caseSensitive = false;
    +  82   
     
    -  85   +  83   
         /**
    -  86   +  84   
          * Gets the value of the caseSensitive property.
    +  85   + 
          *
    +  86   + 
          * @return true if the value is case sensitive
     87   
          *
     88   - 
          * @return true if the value is case sensitive
    -  89   - 
          *
    -  90   
          */
    -  91   +  89   
         public boolean isCaseSensitive() {
    -  92  4 
             return caseSensitive;
    -  93   +  90  8 
             return caseSensitive;
    +  91   
         }
    -  94   +  92   
     
    -  95   +  93   
         /**
    -  96   +  94   
          * Sets the value of the caseSensitive property.
    +  95   + 
          *
    +  96   + 
          * @param value whether the value is case sensitive
     97   
          *
     98   - 
          * @param value whether the value is case sensitive
    + 
          */
     99   - 
          *
    -  100   - 
          */
    -  101   
         public void setCaseSensitive(boolean value) {
    -  102  13 
             this.caseSensitive = value;
    -  103  13 
         }
    -  104   +  100  26 
             this.caseSensitive = value;
    +  101  26 
         }
    +  102   
         //</editor-fold>
    +  103   + 
     
    +  104   + 
         /**
     105   - 
     
    + 
          * Uses the object's properties to determine if the supplied string matches the value of this property.
     106   - 
         /**
    + 
          *
     107   - 
          * Uses the object's properties to determine if the supplied string matches
    -  108   - 
          * the value of this property.
    -  109   - 
          *
    -  110   
          * @param text the String to validate
    -  111   +  108   
          * @return whether the text supplied is matched by the value of the property
    -  112   +  109   
          */
    -  113   +  110   
         public boolean matches(String text) {
    -  114  22 
             if (text == null) {
    -  115  0 
                 return false;
    -  116   +  111  44 
             if (text == null) {
    +  112  0 
                 return false;
    +  113   
             }
    -  117  22 
             if (this.regex) {
    -  118   +  114  44 
             if (this.regex) {
    +  115   
                 Pattern rx;
    -  119  7 
                 if (this.caseSensitive) {
    -  120  2 
                     rx = Pattern.compile(this.value);
    -  121   +  116  14 
                 if (this.caseSensitive) {
    +  117  4 
                     rx = Pattern.compile(this.value);
    +  118   
                 } else {
    -  122  5 
                     rx = Pattern.compile(this.value, Pattern.CASE_INSENSITIVE);
    -  123   +  119  10 
                     rx = Pattern.compile(this.value, Pattern.CASE_INSENSITIVE);
    +  120   
                 }
    -  124  7 
                 return rx.matcher(text).matches();
    -  125   +  121  14 
                 return rx.matcher(text).matches();
    +  122   
             } else {
    -  126  15 
                 if (this.caseSensitive) {
    -  127  2 
                     return value.equals(text);
    -  128   +  123  30 
                 if (this.caseSensitive) {
    +  124  4 
                     return value.equals(text);
    +  125   
                 } else {
    -  129  13 
                     return value.equalsIgnoreCase(text);
    -  130   +  126  26 
                     return value.equalsIgnoreCase(text);
    +  127   
                 }
    -  131   +  128   
             }
    -  132   +  129   
         }
    -  133   +  130   
     
    -  134   +  131   
         //<editor-fold defaultstate="collapsed" desc="standard implementations of hashCode, equals, and toString">
    -  135   +  132   
         /**
    -  136   +  133   
          * Default implementation of hashCode.
    -  137   +  134   
          *
    -  138   +  135   
          * @return the hash code
    -  139   +  136   
          */
    -  140   +  137   
         @Override
    -  141   +  138   
         public int hashCode() {
    -  142  0 
             int hash = 3;
    -  143  0 
             hash = 59 * hash + (this.value != null ? this.value.hashCode() : 0);
    -  144  0 
             hash = 59 * hash + (this.regex ? 1 : 0);
    -  145  0 
             hash = 59 * hash + (this.caseSensitive ? 1 : 0);
    -  146  0 
             return hash;
    -  147   +  139  0 
             int hash = 3;
    +  140  0 
             hash = 59 * hash + (this.value != null ? this.value.hashCode() : 0);
    +  141  0 
             hash = 59 * hash + (this.regex ? 1 : 0);
    +  142  0 
             hash = 59 * hash + (this.caseSensitive ? 1 : 0);
    +  143  0 
             return hash;
    +  144   
         }
    -  148   +  145   
     
    -  149   +  146   
         /**
    -  150   +  147   
          * Default implementation of equals.
    -  151   +  148   
          *
    -  152   +  149   
          * @param obj the object to compare
    -  153   +  150   
          * @return whether the objects are equivalent
    -  154   +  151   
          */
    -  155   +  152   
         @Override
    -  156   +  153   
         public boolean equals(Object obj) {
    -  157  1 
             if (obj == null) {
    +  154  2 
             if (obj == null) {
    +  155  0 
                 return false;
    +  156   + 
             }
    +  157  2 
             if (getClass() != obj.getClass()) {
     158  0 
                 return false;
     159   
             }
    -  160  1 
             if (getClass() != obj.getClass()) {
    -  161  0 
                 return false;
    -  162   +  160  2 
             final PropertyType other = (PropertyType) obj;
    +  161  2 
             if ((this.value == null) ? (other.value != null) : !this.value.equals(other.value)) {
    +  162  0 
                 return false;
    +  163   
             }
    -  163  1 
             final PropertyType other = (PropertyType) obj;
    -  164  1 
             if ((this.value == null) ? (other.value != null) : !this.value.equals(other.value)) {
    +  164  2 
             if (this.regex != other.regex) {
     165  0 
                 return false;
     166   
             }
    -  167  1 
             if (this.regex != other.regex) {
    +  167  2 
             if (this.caseSensitive != other.caseSensitive) {
     168  0 
                 return false;
     169   
             }
    -  170  1 
             if (this.caseSensitive != other.caseSensitive) {
    -  171  0 
                 return false;
    +  170  2 
             return true;
    +  171   + 
         }
     172   - 
             }
    -  173  1 
             return true;
    -  174   - 
         }
    -  175   
     
    -  176   +  173   
         /**
    -  177   +  174   
          * Default implementation of toString().
    -  178   +  175   
          *
    -  179   +  176   
          * @return the string representation of the object
    -  180   +  177   
          */
    -  181   +  178   
         @Override
    -  182   +  179   
         public String toString() {
    -  183  0 
             return "PropertyType{" + "value=" + value + ", regex=" + regex + ", caseSensitive=" + caseSensitive + '}';
    -  184   +  180  0 
             return "PropertyType{" + "value=" + value + ", regex=" + regex + ", caseSensitive=" + caseSensitive + '}';
    +  181   
         }
    -  185   +  182   
         //</editor-fold>
    -  186   +  183   
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.suppression.SuppressionErrorHandler.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.suppression.SuppressionErrorHandler.html index cbd031b9d..d2fbfd316 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.suppression.SuppressionErrorHandler.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.suppression.SuppressionErrorHandler.html @@ -24,171 +24,169 @@  3   
      *
     4   - 
      * Dependency-check-core is free software: you can redistribute it and/or modify it
    + 
      * Licensed under the Apache License, Version 2.0 (the "License");
     5   - 
      * under the terms of the GNU General Public License as published by the Free
    + 
      * you may not use this file except in compliance with the License.
     6   - 
      * Software Foundation, either version 3 of the License, or (at your option) any
    + 
      * You may obtain a copy of the License at
     7   - 
      * later version.
    + 
      *
     8   - 
      *
    + 
      *     http://www.apache.org/licenses/LICENSE-2.0
     9   - 
      * Dependency-check-core is distributed in the hope that it will be useful, but
    + 
      *
     10   - 
      * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
    + 
      * Unless required by applicable law or agreed to in writing, software
     11   - 
      * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
    + 
      * distributed under the License is distributed on an "AS IS" BASIS,
     12   - 
      * details.
    + 
      * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13   - 
      *
    + 
      * See the License for the specific language governing permissions and
     14   - 
      * You should have received a copy of the GNU General Public License along with
    + 
      * limitations under the License.
     15   - 
      * dependency-check-core. If not, see http://www.gnu.org/licenses/.
    + 
      *
     16   - 
      *
    -  17   
      * Copyright (c) 2013 Jeremy Long. All Rights Reserved.
    +  17   + 
      */
     18   - 
      */
    -  19   
     package org.owasp.dependencycheck.suppression;
    +  19   + 
     
     20   - 
     
    -  21   
     import java.util.logging.Level;
    -  22   +  21   
     import java.util.logging.Logger;
    -  23   +  22   
     import org.xml.sax.ErrorHandler;
    -  24   +  23   
     import org.xml.sax.SAXException;
    -  25   +  24   
     import org.xml.sax.SAXParseException;
    +  25   + 
     
     26   - 
     
    -  27   
     /**
    -  28   +  27   
      * An XML parsing error handler.
    -  29   +  28   
      *
    -  30   +  29   
      * @author Jeremy Long <jeremy.long@owasp.org>
    -  31   +  30   
      */
    -  32  2 
     public class SuppressionErrorHandler implements ErrorHandler {
    +  31  4 
     public class SuppressionErrorHandler implements ErrorHandler {
    +  32   + 
     
     33   - 
     
    + 
         /**
     34   - 
         /**
    -  35   
          * Builds a prettier exception message.
    +  35   + 
          *
     36   - 
          *
    -  37   
          * @param ex the SAXParseException
    -  38   +  37   
          * @return an easier to read exception message
    +  38   + 
          */
     39   - 
          */
    -  40   
         private String getPrettyParseExceptionInfo(SAXParseException ex) {
    -  41   +  40   
     
    -  42  0 
             final StringBuilder sb = new StringBuilder();
    -  43   +  41  0 
             final StringBuilder sb = new StringBuilder();
    +  42   
     
    -  44  0 
             if (ex.getSystemId() != null) {
    -  45  0 
                 sb.append("systemId=").append(ex.getSystemId()).append(", ");
    -  46   +  43  0 
             if (ex.getSystemId() != null) {
    +  44  0 
                 sb.append("systemId=").append(ex.getSystemId()).append(", ");
    +  45   
             }
    -  47  0 
             if (ex.getPublicId() != null) {
    -  48  0 
                 sb.append("publicId=").append(ex.getPublicId()).append(", ");
    -  49   +  46  0 
             if (ex.getPublicId() != null) {
    +  47  0 
                 sb.append("publicId=").append(ex.getPublicId()).append(", ");
    +  48   
             }
    -  50  0 
             if (ex.getLineNumber() > 0) {
    -  51  0 
                 sb.append("Line=").append(ex.getLineNumber());
    -  52   +  49  0 
             if (ex.getLineNumber() > 0) {
    +  50  0 
                 sb.append("Line=").append(ex.getLineNumber());
    +  51   
             }
    -  53  0 
             if (ex.getColumnNumber() > 0) {
    -  54  0 
                 sb.append(", Column=").append(ex.getColumnNumber());
    -  55   +  52  0 
             if (ex.getColumnNumber() > 0) {
    +  53  0 
                 sb.append(", Column=").append(ex.getColumnNumber());
    +  54   
             }
    -  56  0 
             sb.append(": ").append(ex.getMessage());
    -  57   +  55  0 
             sb.append(": ").append(ex.getMessage());
    +  56   
     
    -  58  0 
             return sb.toString();
    +  57  0 
             return sb.toString();
    +  58   + 
         }
     59   - 
         }
    + 
     
     60   - 
     
    + 
         /**
     61   - 
         /**
    -  62   
          * Logs warnings.
    +  62   + 
          *
     63   - 
          *
    -  64   
          * @param ex the warning to log
    -  65   +  64   
          * @throws SAXException is never thrown
    +  65   + 
          */
     66   - 
          */
    + 
         @Override
     67   - 
         @Override
    -  68   
         public void warning(SAXParseException ex) throws SAXException {
    -  69  0 
             Logger.getLogger(SuppressionErrorHandler.class.getName()).log(Level.FINE, null, ex);
    -  70  0 
         }
    +  68  0 
             Logger.getLogger(SuppressionErrorHandler.class.getName()).log(Level.FINE, null, ex);
    +  69  0 
         }
    +  70   + 
     
     71   - 
     
    + 
         /**
     72   - 
         /**
    -  73   
          * Handles errors.
    +  73   + 
          *
     74   - 
          *
    -  75   
          * @param ex the error to handle
    -  76   +  75   
          * @throws SAXException is always thrown
    +  76   + 
          */
     77   - 
          */
    + 
         @Override
     78   - 
         @Override
    -  79   
         public void error(SAXParseException ex) throws SAXException {
    -  80  0 
             throw new SAXException(getPrettyParseExceptionInfo(ex));
    +  79  0 
             throw new SAXException(getPrettyParseExceptionInfo(ex));
    +  80   + 
         }
     81   - 
         }
    -  82   
     
    -  83   +  82   
         /**
    -  84   +  83   
          * Handles fatal exceptions.
    -  85   +  84   
          *
    -  86   +  85   
          * @param ex a fatal exception
    -  87   +  86   
          * @throws SAXException is always
    -  88   +  87   
          */
    -  89   +  88   
         @Override
    -  90   +  89   
         public void fatalError(SAXParseException ex) throws SAXException {
    -  91  0 
             throw new SAXException(getPrettyParseExceptionInfo(ex));
    -  92   +  90  0 
             throw new SAXException(getPrettyParseExceptionInfo(ex));
    +  91   
         }
    -  93   +  92   
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.suppression.SuppressionHandler.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.suppression.SuppressionHandler.html index e85e82e32..859fc9f5b 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.suppression.SuppressionHandler.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.suppression.SuppressionHandler.html @@ -24,308 +24,306 @@  3   
      *
     4   - 
      * Dependency-check-core is free software: you can redistribute it and/or modify it
    + 
      * Licensed under the Apache License, Version 2.0 (the "License");
     5   - 
      * under the terms of the GNU General Public License as published by the Free
    + 
      * you may not use this file except in compliance with the License.
     6   - 
      * Software Foundation, either version 3 of the License, or (at your option) any
    + 
      * You may obtain a copy of the License at
     7   - 
      * later version.
    + 
      *
     8   - 
      *
    + 
      *     http://www.apache.org/licenses/LICENSE-2.0
     9   - 
      * Dependency-check-core is distributed in the hope that it will be useful, but
    + 
      *
     10   - 
      * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
    + 
      * Unless required by applicable law or agreed to in writing, software
     11   - 
      * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
    + 
      * distributed under the License is distributed on an "AS IS" BASIS,
     12   - 
      * details.
    + 
      * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13   - 
      *
    + 
      * See the License for the specific language governing permissions and
     14   - 
      * You should have received a copy of the GNU General Public License along with
    + 
      * limitations under the License.
     15   - 
      * dependency-check-core. If not, see http://www.gnu.org/licenses/.
    + 
      *
     16   - 
      *
    -  17   
      * Copyright (c) 2013 Jeremy Long. All Rights Reserved.
    +  17   + 
      */
     18   - 
      */
    -  19   
     package org.owasp.dependencycheck.suppression;
    +  19   + 
     
     20   - 
     
    -  21   
     import java.util.ArrayList;
    -  22   +  21   
     import java.util.List;
    -  23   +  22   
     import org.xml.sax.Attributes;
    -  24   +  23   
     import org.xml.sax.SAXException;
    -  25   +  24   
     import org.xml.sax.helpers.DefaultHandler;
    +  25   + 
     
     26   - 
     
    -  27   
     /**
    -  28   +  27   
      * A handler to load suppression rules.
    -  29   +  28   
      *
    -  30   +  29   
      * @author Jeremy Long <jeremy.long@owasp.org>
    -  31   +  30   
      */
    -  32  2 
     public class SuppressionHandler extends DefaultHandler {
    +  31  4 
     public class SuppressionHandler extends DefaultHandler {
    +  32   + 
     
     33   - 
     
    + 
         /**
     34   - 
         /**
    -  35   
          * The suppress node, indicates the start of a new rule.
    +  35   + 
          */
     36   - 
          */
    -  37   
         public static final String SUPPRESS = "suppress";
    +  37   + 
         /**
     38   - 
         /**
    -  39   
          * The file path element name.
    +  39   + 
          */
     40   - 
          */
    -  41   
         public static final String FILE_PATH = "filePath";
    +  41   + 
         /**
     42   - 
         /**
    -  43   
          * The sha1 hash element name.
    +  43   + 
          */
     44   - 
          */
    -  45   
         public static final String SHA1 = "sha1";
    +  45   + 
         /**
     46   - 
         /**
    -  47   
          * The CVE element name.
    +  47   + 
          */
     48   - 
          */
    -  49   
         public static final String CVE = "cve";
    +  49   + 
         /**
     50   - 
         /**
    -  51   
          * The CPE element name.
    +  51   + 
          */
     52   - 
          */
    -  53   
         public static final String CPE = "cpe";
    +  53   + 
         /**
     54   - 
         /**
    -  55   
          * The CWE element name.
    +  55   + 
          */
     56   - 
          */
    -  57   
         public static final String CWE = "cwe";
    +  57   + 
         /**
     58   - 
         /**
    -  59   
          * The cvssBelow element name.
    +  59   + 
          */
     60   - 
          */
    -  61   
         public static final String CVSS_BELOW = "cvssBelow";
    +  61   + 
         /**
     62   - 
         /**
    -  63   
          * A list of suppression rules.
    -  64   +  63   
          */
    -  65  2 
         private List<SuppressionRule> suppressionRules = new ArrayList<SuppressionRule>();
    +  64  4 
         private List<SuppressionRule> suppressionRules = new ArrayList<SuppressionRule>();
    +  65   + 
     
     66   - 
     
    + 
         /**
     67   - 
         /**
    -  68   
          * Get the value of suppressionRules.
    +  68   + 
          *
     69   - 
          *
    -  70   
          * @return the value of suppressionRules
    +  70   + 
          */
     71   - 
          */
    -  72   
         public List<SuppressionRule> getSuppressionRules() {
    -  73  2 
             return suppressionRules;
    +  72  4 
             return suppressionRules;
    +  73   + 
         }
     74   - 
         }
    + 
         /**
     75   - 
         /**
    -  76   
          * The current rule being read.
    +  76   + 
          */
     77   - 
          */
    -  78   
         private SuppressionRule rule;
    +  78   + 
         /**
     79   - 
         /**
    -  80   
          * The attributes of the node being read.
    +  80   + 
          */
     81   - 
          */
    -  82   
         private Attributes currentAttributes;
    +  82   + 
         /**
     83   - 
         /**
    -  84   
          * The current node text being extracted from the element.
    +  84   + 
          */
     85   - 
          */
    -  86   
         private StringBuffer currentText;
    +  86   + 
     
     87   - 
     
    + 
         /**
     88   - 
         /**
    -  89   
          * Handles the start element event.
    +  89   + 
          *
     90   - 
          *
    -  91   
          * @param uri the uri of the element being processed
    -  92   +  91   
          * @param localName the local name of the element being processed
    -  93   +  92   
          * @param qName the qName of the element being processed
    -  94   +  93   
          * @param attributes the attributes of the element being processed
    +  94   + 
          * @throws SAXException thrown if there is an exception processing
     95   - 
          * @throws SAXException thrown if there is an exception processing
    + 
          */
     96   - 
          */
    + 
         @Override
     97   - 
         @Override
    -  98   
         public void startElement(String uri, String localName, String qName, Attributes attributes) throws SAXException {
    -  99  40 
             currentAttributes = null;
    -  100  40 
             currentText = new StringBuffer();
    -  101   +  98  80 
             currentAttributes = null;
    +  99  80 
             currentText = new StringBuffer();
    +  100   
     
    -  102  40 
             if (SUPPRESS.equals(qName)) {
    -  103  10 
                 rule = new SuppressionRule();
    -  104  30 
             } else if (FILE_PATH.equals(qName)) {
    -  105  6 
                 currentAttributes = attributes;
    -  106   +  101  80 
             if (SUPPRESS.equals(qName)) {
    +  102  20 
                 rule = new SuppressionRule();
    +  103  60 
             } else if (FILE_PATH.equals(qName)) {
    +  104  12 
                 currentAttributes = attributes;
    +  105   
             }
    -  107  40 
         }
    +  106  80 
         }
    +  107   + 
     
     108   - 
     
    + 
         /**
     109   - 
         /**
    -  110   
          * Handles the end element event.
    +  110   + 
          *
     111   - 
          *
    -  112   
          * @param uri the URI of the element
    -  113   +  112   
          * @param localName the local name of the element
    -  114   +  113   
          * @param qName the qName of the element
    -  115   +  114   
          * @throws SAXException thrown if there is an exception processing
    +  115   + 
          */
     116   - 
          */
    + 
         @Override
     117   - 
         @Override
    -  118   
         public void endElement(String uri, String localName, String qName) throws SAXException {
    -  119  40 
             if (SUPPRESS.equals(qName)) {
    -  120  10 
                 suppressionRules.add(rule);
    -  121  10 
                 rule = null;
    -  122  30 
             } else if (FILE_PATH.equals(qName)) {
    -  123  6 
                 final PropertyType pt = processPropertyType();
    -  124  6 
                 rule.setFilePath(pt);
    -  125  6 
             } else if (SHA1.equals(qName)) {
    -  126  2 
                 rule.setSha1(currentText.toString());
    -  127  22 
             } else if (CPE.equals(qName)) {
    -  128  4 
                 final PropertyType pt = processPropertyType();
    -  129  4 
                 rule.addCpe(pt);
    -  130  4 
             } else if (CWE.equals(qName)) {
    -  131  0 
                 rule.addCwe(currentText.toString());
    -  132  18 
             } else if (CVE.equals(qName)) {
    -  133  4 
                 rule.addCve(currentText.toString());
    -  134  14 
             } else if (CVSS_BELOW.equals(qName)) {
    -  135  2 
                 final float cvss = Float.parseFloat(currentText.toString());
    -  136  2 
                 rule.addCvssBelow(cvss);
    -  137   +  118  80 
             if (SUPPRESS.equals(qName)) {
    +  119  20 
                 suppressionRules.add(rule);
    +  120  20 
                 rule = null;
    +  121  60 
             } else if (FILE_PATH.equals(qName)) {
    +  122  12 
                 final PropertyType pt = processPropertyType();
    +  123  12 
                 rule.setFilePath(pt);
    +  124  12 
             } else if (SHA1.equals(qName)) {
    +  125  4 
                 rule.setSha1(currentText.toString());
    +  126  44 
             } else if (CPE.equals(qName)) {
    +  127  8 
                 final PropertyType pt = processPropertyType();
    +  128  8 
                 rule.addCpe(pt);
    +  129  8 
             } else if (CWE.equals(qName)) {
    +  130  0 
                 rule.addCwe(currentText.toString());
    +  131  36 
             } else if (CVE.equals(qName)) {
    +  132  8 
                 rule.addCve(currentText.toString());
    +  133  28 
             } else if (CVSS_BELOW.equals(qName)) {
    +  134  4 
                 final float cvss = Float.parseFloat(currentText.toString());
    +  135  4 
                 rule.addCvssBelow(cvss);
    +  136   
             }
    -  138  40 
         }
    +  137  80 
         }
    +  138   + 
     
     139   - 
     
    + 
         /**
     140   - 
         /**
    -  141   
          * Collects the body text of the node being processed.
    +  141   + 
          *
     142   - 
          *
    -  143   
          * @param ch the char array of text
    -  144   +  143   
          * @param start the start position to copy text from in the char array
    -  145   +  144   
          * @param length the number of characters to copy from the char array
    -  146   +  145   
          * @throws SAXException thrown if there is a parsing exception
    +  146   + 
          */
     147   - 
          */
    -  148   
         @Override
    -  149   +  148   
         public void characters(char[] ch, int start, int length) throws SAXException {
    -  150  88 
             currentText.append(ch, start, length);
    -  151  88 
         }
    -  152   +  149  176 
             currentText.append(ch, start, length);
    +  150  176 
         }
    +  151   
     
    -  153   +  152   
         /**
    -  154   +  153   
          * Processes field members that have been collected during the characters and startElement method to construct a
    -  155   +  154   
          * PropertyType object.
    -  156   +  155   
          *
    -  157   +  156   
          * @return a PropertyType object
    -  158   +  157   
          */
    -  159   +  158   
         private PropertyType processPropertyType() {
    -  160  10 
             final PropertyType pt = new PropertyType();
    -  161  10 
             pt.setValue(currentText.toString());
    -  162  10 
             if (currentAttributes != null && currentAttributes.getLength() > 0) {
    -  163  6 
                 final String regex = currentAttributes.getValue("regex");
    -  164  6 
                 if (regex != null) {
    -  165  6 
                     pt.setRegex(Boolean.parseBoolean(regex));
    -  166   +  159  20 
             final PropertyType pt = new PropertyType();
    +  160  20 
             pt.setValue(currentText.toString());
    +  161  20 
             if (currentAttributes != null && currentAttributes.getLength() > 0) {
    +  162  12 
                 final String regex = currentAttributes.getValue("regex");
    +  163  12 
                 if (regex != null) {
    +  164  12 
                     pt.setRegex(Boolean.parseBoolean(regex));
    +  165   + 
                 }
    +  166  12 
                 final String caseSensitive = currentAttributes.getValue("caseSensitive");
    +  167  12 
                 if (regex != null) {
    +  168  12 
                     pt.setCaseSensitive(Boolean.parseBoolean(caseSensitive));
    +  169   
                 }
    -  167  6 
                 final String caseSensitive = currentAttributes.getValue("caseSensitive");
    -  168  6 
                 if (regex != null) {
    -  169  6 
                     pt.setCaseSensitive(Boolean.parseBoolean(caseSensitive));
     170   - 
                 }
    -  171   
             }
    -  172  10 
             return pt;
    -  173   +  171  20 
             return pt;
    +  172   
         }
    -  174   +  173   
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.suppression.SuppressionParseException.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.suppression.SuppressionParseException.html index 6c418ebd1..e1ea1a967 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.suppression.SuppressionParseException.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.suppression.SuppressionParseException.html @@ -24,131 +24,129 @@  3   
      *
     4   - 
      * Dependency-check-core is free software: you can redistribute it and/or modify it
    + 
      * Licensed under the Apache License, Version 2.0 (the "License");
     5   - 
      * under the terms of the GNU General Public License as published by the Free
    + 
      * you may not use this file except in compliance with the License.
     6   - 
      * Software Foundation, either version 3 of the License, or (at your option) any
    + 
      * You may obtain a copy of the License at
     7   - 
      * later version.
    + 
      *
     8   - 
      *
    + 
      *     http://www.apache.org/licenses/LICENSE-2.0
     9   - 
      * Dependency-check-core is distributed in the hope that it will be useful, but
    + 
      *
     10   - 
      * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
    + 
      * Unless required by applicable law or agreed to in writing, software
     11   - 
      * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
    + 
      * distributed under the License is distributed on an "AS IS" BASIS,
     12   - 
      * details.
    + 
      * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13   - 
      *
    + 
      * See the License for the specific language governing permissions and
     14   - 
      * You should have received a copy of the GNU General Public License along with
    + 
      * limitations under the License.
     15   - 
      * dependency-check-core. If not, see http://www.gnu.org/licenses/.
    + 
      *
     16   - 
      *
    -  17   
      * Copyright (c) 2013 Jeremy Long. All Rights Reserved.
    +  17   + 
      */
     18   - 
      */
    -  19   
     package org.owasp.dependencycheck.suppression;
    +  19   + 
     
     20   - 
     
    -  21   
     import java.io.IOException;
    +  21   + 
     
     22   - 
     
    -  23   
     /**
    -  24   +  23   
      * An exception used when parsing a suppression rule file fails.
    -  25   +  24   
      *
    -  26   +  25   
      * @author Jeremy Long <jeremy.long@owasp.org>
    -  27   +  26   
      */
    -  28   +  27   
     public class SuppressionParseException extends IOException {
    +  28   + 
     
     29   - 
     
    + 
         /**
     30   - 
         /**
    -  31   
          * The serial version UID.
    +  31   + 
          */
     32   - 
          */
    -  33   
         private static final long serialVersionUID = 1L;
    +  33   + 
     
     34   - 
     
    + 
         /**
     35   - 
         /**
    + 
          * Creates a new SuppressionParseException.
     36   - 
          * Creates a new SuppressionParseException.
    + 
          */
     37   - 
          */
    -  38   
         public SuppressionParseException() {
    -  39  0 
             super();
    -  40  0 
         }
    +  38  0 
             super();
    +  39  0 
         }
    +  40   + 
     
     41   - 
     
    + 
         /**
     42   - 
         /**
    + 
          * Creates a new SuppressionParseException.
     43   - 
          * Creates a new SuppressionParseException.
    + 
          *
     44   - 
          *
    + 
          * @param msg a message for the exception.
     45   - 
          * @param msg a message for the exception.
    + 
          */
     46   - 
          */
    -  47   
         public SuppressionParseException(String msg) {
    -  48  0 
             super(msg);
    -  49  0 
         }
    +  47  0 
             super(msg);
    +  48  0 
         }
    +  49   + 
     
     50   - 
     
    + 
         /**
     51   - 
         /**
    + 
          * Creates a new SuppressionParseException.
     52   - 
          * Creates a new SuppressionParseException.
    + 
          *
     53   - 
          *
    + 
          * @param ex the cause of the download failure.
     54   - 
          * @param ex the cause of the download failure.
    + 
          */
     55   - 
          */
    -  56   
         public SuppressionParseException(Throwable ex) {
    -  57  0 
             super(ex);
    -  58  0 
         }
    -  59   +  56  0 
             super(ex);
    +  57  0 
         }
    +  58   
     
    -  60   +  59   
         /**
    -  61   +  60   
          * Creates a new SuppressionParseException.
    -  62   +  61   
          *
    -  63   +  62   
          * @param msg a message for the exception.
    -  64   +  63   
          * @param ex the cause of the download failure.
    -  65   +  64   
          */
    -  66   +  65   
         public SuppressionParseException(String msg, Throwable ex) {
    -  67  0 
             super(msg, ex);
    -  68  0 
         }
    -  69   +  66  0 
             super(msg, ex);
    +  67  0 
         }
    +  68   
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.suppression.SuppressionParser.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.suppression.SuppressionParser.html index 8ec2bdade..63bd8a8af 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.suppression.SuppressionParser.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.suppression.SuppressionParser.html @@ -24,176 +24,174 @@  3   
      *
     4   - 
      * Dependency-check-core is free software: you can redistribute it and/or modify it
    + 
      * Licensed under the Apache License, Version 2.0 (the "License");
     5   - 
      * under the terms of the GNU General Public License as published by the Free
    + 
      * you may not use this file except in compliance with the License.
     6   - 
      * Software Foundation, either version 3 of the License, or (at your option) any
    + 
      * You may obtain a copy of the License at
     7   - 
      * later version.
    + 
      *
     8   - 
      *
    + 
      *     http://www.apache.org/licenses/LICENSE-2.0
     9   - 
      * Dependency-check-core is distributed in the hope that it will be useful, but
    + 
      *
     10   - 
      * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
    + 
      * Unless required by applicable law or agreed to in writing, software
     11   - 
      * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
    + 
      * distributed under the License is distributed on an "AS IS" BASIS,
     12   - 
      * details.
    + 
      * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13   - 
      *
    + 
      * See the License for the specific language governing permissions and
     14   - 
      * You should have received a copy of the GNU General Public License along with
    + 
      * limitations under the License.
     15   - 
      * dependency-check-core. If not, see http://www.gnu.org/licenses/.
    + 
      *
     16   - 
      *
    -  17   
      * Copyright (c) 2013 Jeremy Long. All Rights Reserved.
    +  17   + 
      */
     18   - 
      */
    -  19   
     package org.owasp.dependencycheck.suppression;
    +  19   + 
     
     20   - 
     
    -  21   
     import java.io.File;
    -  22   +  21   
     import java.io.FileInputStream;
    -  23   +  22   
     import java.io.FileNotFoundException;
    -  24   +  23   
     import java.io.IOException;
    -  25   +  24   
     import java.io.InputStream;
    -  26   +  25   
     import java.io.InputStreamReader;
    -  27   +  26   
     import java.io.Reader;
    -  28   +  27   
     import java.util.List;
    -  29   +  28   
     import java.util.logging.Level;
    -  30   +  29   
     import java.util.logging.Logger;
    -  31   +  30   
     import javax.xml.parsers.ParserConfigurationException;
    -  32   +  31   
     import javax.xml.parsers.SAXParser;
    -  33   +  32   
     import javax.xml.parsers.SAXParserFactory;
    -  34   +  33   
     import org.xml.sax.InputSource;
    -  35   +  34   
     import org.xml.sax.SAXException;
    -  36   +  35   
     import org.xml.sax.XMLReader;
    +  36   + 
     
     37   - 
     
    -  38   
     /**
    -  39   +  38   
      * A simple validating parser for XML Suppression Rules.
    -  40   +  39   
      *
    -  41   +  40   
      * @author Jeremy Long <jeremy.long@owasp.org>
    -  42   +  41   
      */
    -  43  1 
     public class SuppressionParser {
    +  42  2 
     public class SuppressionParser {
    +  43   + 
     
     44   - 
     
    + 
         /**
     45   - 
         /**
    -  46   
          * JAXP Schema Language. Source: http://docs.oracle.com/javase/tutorial/jaxp/sax/validation.html
    +  46   + 
          */
     47   - 
          */
    -  48   
         public static final String JAXP_SCHEMA_LANGUAGE = "http://java.sun.com/xml/jaxp/properties/schemaLanguage";
    +  48   + 
         /**
     49   - 
         /**
    -  50   
          * W3C XML Schema. Source: http://docs.oracle.com/javase/tutorial/jaxp/sax/validation.html
    +  50   + 
          */
     51   - 
          */
    -  52   
         public static final String W3C_XML_SCHEMA = "http://www.w3.org/2001/XMLSchema";
    +  52   + 
         /**
     53   - 
         /**
    -  54   
          * JAXP Schema Source. Source: http://docs.oracle.com/javase/tutorial/jaxp/sax/validation.html
    +  54   + 
          */
     55   - 
          */
    -  56   
         public static final String JAXP_SCHEMA_SOURCE = "http://java.sun.com/xml/jaxp/properties/schemaSource";
    +  56   + 
     
     57   - 
     
    -  58   
         /**
    -  59   +  58   
          * Parses the given xml file and returns a list of the suppression rules contained.
    -  60   +  59   
          *
    -  61   +  60   
          * @param file an xml file containing suppression rules
    -  62   +  61   
          * @return a list of suppression rules
    -  63   +  62   
          * @throws SuppressionParseException thrown if the xml file cannot be parsed
    -  64   +  63   
          */
    -  65   +  64   
         public List<SuppressionRule> parseSuppressionRules(File file) throws SuppressionParseException {
    -  66   +  65   
             try {
    -  67  1 
                 final InputStream schemaStream = this.getClass().getClassLoader().getResourceAsStream("schema/suppression.xsd");
    -  68  1 
                 final SuppressionHandler handler = new SuppressionHandler();
    -  69   +  66  2 
                 final InputStream schemaStream = this.getClass().getClassLoader().getResourceAsStream("schema/suppression.xsd");
    +  67  2 
                 final SuppressionHandler handler = new SuppressionHandler();
    +  68   
     
    -  70  1 
                 final SAXParserFactory factory = SAXParserFactory.newInstance();
    -  71  1 
                 factory.setNamespaceAware(true);
    -  72  1 
                 factory.setValidating(true);
    -  73  1 
                 final SAXParser saxParser = factory.newSAXParser();
    -  74  1 
                 saxParser.setProperty(SuppressionParser.JAXP_SCHEMA_LANGUAGE, SuppressionParser.W3C_XML_SCHEMA);
    -  75  1 
                 saxParser.setProperty(SuppressionParser.JAXP_SCHEMA_SOURCE, new InputSource(schemaStream));
    -  76  1 
                 final XMLReader xmlReader = saxParser.getXMLReader();
    -  77  1 
                 xmlReader.setErrorHandler(new SuppressionErrorHandler());
    -  78  1 
                 xmlReader.setContentHandler(handler);
    -  79   +  69  2 
                 final SAXParserFactory factory = SAXParserFactory.newInstance();
    +  70  2 
                 factory.setNamespaceAware(true);
    +  71  2 
                 factory.setValidating(true);
    +  72  2 
                 final SAXParser saxParser = factory.newSAXParser();
    +  73  2 
                 saxParser.setProperty(SuppressionParser.JAXP_SCHEMA_LANGUAGE, SuppressionParser.W3C_XML_SCHEMA);
    +  74  2 
                 saxParser.setProperty(SuppressionParser.JAXP_SCHEMA_SOURCE, new InputSource(schemaStream));
    +  75  2 
                 final XMLReader xmlReader = saxParser.getXMLReader();
    +  76  2 
                 xmlReader.setErrorHandler(new SuppressionErrorHandler());
    +  77  2 
                 xmlReader.setContentHandler(handler);
    +  78   
     
    -  80  1 
                 final InputStream inputStream = new FileInputStream(file);
    -  81  1 
                 final Reader reader = new InputStreamReader(inputStream, "UTF-8");
    -  82  1 
                 final InputSource in = new InputSource(reader);
    -  83   +  79  2 
                 final InputStream inputStream = new FileInputStream(file);
    +  80  2 
                 final Reader reader = new InputStreamReader(inputStream, "UTF-8");
    +  81  2 
                 final InputSource in = new InputSource(reader);
    +  82   
                 //in.setEncoding("UTF-8");
    -  84   +  83   
     
    -  85  1 
                 xmlReader.parse(in);
    -  86   +  84  2 
                 xmlReader.parse(in);
    +  85   
     
    -  87  1 
                 return handler.getSuppressionRules();
    -  88  0 
             } catch (ParserConfigurationException ex) {
    -  89  0 
                 Logger.getLogger(SuppressionParser.class.getName()).log(Level.FINE, null, ex);
    -  90  0 
                 throw new SuppressionParseException(ex);
    -  91  0 
             } catch (SAXException ex) {
    -  92  0 
                 Logger.getLogger(SuppressionParser.class.getName()).log(Level.FINE, null, ex);
    -  93  0 
                 throw new SuppressionParseException(ex);
    -  94  0 
             } catch (FileNotFoundException ex) {
    -  95  0 
                 Logger.getLogger(SuppressionParser.class.getName()).log(Level.FINE, null, ex);
    -  96  0 
                 throw new SuppressionParseException(ex);
    -  97  0 
             } catch (IOException ex) {
    -  98  0 
                 Logger.getLogger(SuppressionParser.class.getName()).log(Level.FINE, null, ex);
    -  99  0 
                 throw new SuppressionParseException(ex);
    -  100   +  86  2 
                 return handler.getSuppressionRules();
    +  87  0 
             } catch (ParserConfigurationException ex) {
    +  88  0 
                 Logger.getLogger(SuppressionParser.class.getName()).log(Level.FINE, null, ex);
    +  89  0 
                 throw new SuppressionParseException(ex);
    +  90  0 
             } catch (SAXException ex) {
    +  91  0 
                 Logger.getLogger(SuppressionParser.class.getName()).log(Level.FINE, null, ex);
    +  92  0 
                 throw new SuppressionParseException(ex);
    +  93  0 
             } catch (FileNotFoundException ex) {
    +  94  0 
                 Logger.getLogger(SuppressionParser.class.getName()).log(Level.FINE, null, ex);
    +  95  0 
                 throw new SuppressionParseException(ex);
    +  96  0 
             } catch (IOException ex) {
    +  97  0 
                 Logger.getLogger(SuppressionParser.class.getName()).log(Level.FINE, null, ex);
    +  98  0 
                 throw new SuppressionParseException(ex);
    +  99   
             }
    -  101   +  100   
         }
    -  102   +  101   
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.suppression.SuppressionRule.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.suppression.SuppressionRule.html index 689c2f34d..15f2fc632 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.suppression.SuppressionRule.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.suppression.SuppressionRule.html @@ -24,631 +24,619 @@  3   
      *
     4   - 
      * Dependency-check-core is free software: you can redistribute it and/or modify it
    + 
      * Licensed under the Apache License, Version 2.0 (the "License");
     5   - 
      * under the terms of the GNU General Public License as published by the Free
    + 
      * you may not use this file except in compliance with the License.
     6   - 
      * Software Foundation, either version 3 of the License, or (at your option) any
    + 
      * You may obtain a copy of the License at
     7   - 
      * later version.
    + 
      *
     8   - 
      *
    + 
      *     http://www.apache.org/licenses/LICENSE-2.0
     9   - 
      * Dependency-check-core is distributed in the hope that it will be useful, but
    + 
      *
     10   - 
      * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
    + 
      * Unless required by applicable law or agreed to in writing, software
     11   - 
      * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
    + 
      * distributed under the License is distributed on an "AS IS" BASIS,
     12   - 
      * details.
    + 
      * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13   - 
      *
    + 
      * See the License for the specific language governing permissions and
     14   - 
      * You should have received a copy of the GNU General Public License along with
    + 
      * limitations under the License.
     15   - 
      * dependency-check-core. If not, see http://www.gnu.org/licenses/.
    + 
      *
     16   - 
      *
    -  17   
      * Copyright (c) 2013 Jeremy Long. All Rights Reserved.
    +  17   + 
      */
     18   - 
      */
    -  19   
     package org.owasp.dependencycheck.suppression;
    +  19   + 
     
     20   - 
     
    -  21   
     import java.util.ArrayList;
    -  22   +  21   
     import java.util.Iterator;
    -  23   +  22   
     import java.util.List;
    -  24   +  23   
     import org.owasp.dependencycheck.dependency.Dependency;
    -  25   +  24   
     import org.owasp.dependencycheck.dependency.Identifier;
    -  26   +  25   
     import org.owasp.dependencycheck.dependency.Vulnerability;
    +  26   + 
     
     27   - 
     
    -  28   
     /**
    -  29   +  28   
      *
    -  30   +  29   
      * @author Jeremy Long <jeremy.long@owasp.org>
    -  31   +  30   
      */
    -  32  23 
     public class SuppressionRule {
    +  31  46 
     public class SuppressionRule {
    +  32   + 
     
     33   - 
     
    + 
         /**
     34   - 
         /**
    -  35   
          * The file path for the suppression.
    +  35   + 
          */
     36   - 
          */
    -  37   
         private PropertyType filePath;
    +  37   + 
     
     38   - 
     
    + 
         /**
     39   - 
         /**
    -  40   
          * Get the value of filePath.
    +  40   + 
          *
     41   - 
          *
    -  42   
          * @return the value of filePath
    +  42   + 
          */
     43   - 
          */
    -  44   
         public PropertyType getFilePath() {
    -  45  1 
             return filePath;
    +  44  2 
             return filePath;
    +  45   + 
         }
     46   - 
         }
    + 
     
     47   - 
     
    + 
         /**
     48   - 
         /**
    -  49   
          * Set the value of filePath.
    +  49   + 
          *
     50   - 
          *
    -  51   
          * @param filePath new value of filePath
    +  51   + 
          */
     52   - 
          */
    -  53   
         public void setFilePath(PropertyType filePath) {
    -  54  8 
             this.filePath = filePath;
    -  55  8 
         }
    +  53  16 
             this.filePath = filePath;
    +  54  16 
         }
    +  55   + 
         /**
     56   - 
         /**
    -  57   
          * The sha1 hash.
    +  57   + 
          */
     58   - 
          */
    -  59   
         private String sha1;
    +  59   + 
     
     60   - 
     
    + 
         /**
     61   - 
         /**
    -  62   
          * Get the value of sha1.
    +  62   + 
          *
     63   - 
          *
    -  64   
          * @return the value of sha1
    +  64   + 
          */
     65   - 
          */
    -  66   
         public String getSha1() {
    -  67  1 
             return sha1;
    +  66  2 
             return sha1;
    +  67   + 
         }
     68   - 
         }
    + 
     
     69   - 
     
    + 
         /**
     70   - 
         /**
    -  71   
          * Set the value of sha1.
    +  71   + 
          *
     72   - 
          *
    -  73   
          * @param sha1 new value of sha1
    +  73   + 
          */
     74   - 
          */
    -  75   
         public void setSha1(String sha1) {
    -  76  4 
             this.sha1 = sha1;
    -  77  4 
         }
    +  75  8 
             this.sha1 = sha1;
    +  76  8 
         }
    +  77   + 
         /**
     78   - 
         /**
    -  79   
          * A list of CPEs to suppression
    -  80   +  79   
          */
    -  81  23 
         private List<PropertyType> cpe = new ArrayList<PropertyType>();
    +  80  46 
         private List<PropertyType> cpe = new ArrayList<PropertyType>();
    +  81   + 
     
     82   - 
     
    + 
         /**
     83   - 
         /**
    -  84   
          * Get the value of cpe.
    +  84   + 
          *
     85   - 
          *
    -  86   
          * @return the value of cpe
    +  86   + 
          */
     87   - 
          */
    -  88   
         public List<PropertyType> getCpe() {
    -  89  1 
             return cpe;
    +  88  2 
             return cpe;
    +  89   + 
         }
     90   - 
         }
    + 
     
     91   - 
     
    + 
         /**
     92   - 
         /**
    -  93   
          * Set the value of cpe.
    +  93   + 
          *
     94   - 
          *
    -  95   
          * @param cpe new value of cpe
    +  95   + 
          */
     96   - 
          */
    -  97   
         public void setCpe(List<PropertyType> cpe) {
    -  98  1 
             this.cpe = cpe;
    -  99  1 
         }
    +  97  2 
             this.cpe = cpe;
    +  98  2 
         }
    +  99   + 
     
     100   - 
     
    + 
         /**
     101   - 
         /**
    -  102   
          * Adds the cpe to the cpe list.
    +  102   + 
          *
     103   - 
          *
    -  104   
          * @param cpe the cpe to add
    +  104   + 
          */
     105   - 
          */
    -  106   
         public void addCpe(PropertyType cpe) {
    -  107  8 
             this.cpe.add(cpe);
    -  108  8 
         }
    +  106  16 
             this.cpe.add(cpe);
    +  107  16 
         }
    +  108   + 
     
     109   - 
     
    + 
         /**
     110   - 
         /**
    -  111   
          * Returns whether or not this suppression rule as CPE entries.
    +  111   + 
          *
     112   - 
          *
    -  113   
          * @return whether or not this suppression rule as CPE entries
    +  113   + 
          */
     114   - 
          */
    -  115   
         public boolean hasCpe() {
    -  116  10 
             return cpe.size() > 0;
    +  115  20 
             return cpe.size() > 0;
    +  116   + 
         }
     117   - 
         }
    + 
         /**
     118   - 
         /**
    -  119   
          * The list of cvssBelow scores.
    -  120   +  119   
          */
    -  121  23 
         private List<Float> cvssBelow = new ArrayList<Float>();
    +  120  46 
         private List<Float> cvssBelow = new ArrayList<Float>();
    +  121   + 
     
     122   - 
     
    + 
         /**
     123   - 
         /**
    -  124   
          * Get the value of cvssBelow.
    +  124   + 
          *
     125   - 
          *
    -  126   
          * @return the value of cvssBelow
    +  126   + 
          */
     127   - 
          */
    -  128   
         public List<Float> getCvssBelow() {
    -  129  1 
             return cvssBelow;
    +  128  2 
             return cvssBelow;
    +  129   + 
         }
     130   - 
         }
    + 
     
     131   - 
     
    + 
         /**
     132   - 
         /**
    -  133   
          * Set the value of cvssBelow.
    +  133   + 
          *
     134   - 
          *
    -  135   
          * @param cvssBelow new value of cvssBelow
    +  135   + 
          */
     136   - 
          */
    -  137   
         public void setCvssBelow(List<Float> cvssBelow) {
    -  138  1 
             this.cvssBelow = cvssBelow;
    -  139  1 
         }
    +  137  2 
             this.cvssBelow = cvssBelow;
    +  138  2 
         }
    +  139   + 
     
     140   - 
     
    + 
         /**
     141   - 
         /**
    -  142   
          * Adds the cvss to the cvssBelow list.
    +  142   + 
          *
     143   - 
          *
    -  144   
          * @param cvss the cvss to add
    +  144   + 
          */
     145   - 
          */
    -  146   
         public void addCvssBelow(Float cvss) {
    -  147  5 
             this.cvssBelow.add(cvss);
    -  148  5 
         }
    +  146  10 
             this.cvssBelow.add(cvss);
    +  147  10 
         }
    +  148   + 
     
     149   - 
     
    + 
         /**
     150   - 
         /**
    -  151   
          * Returns whether or not this suppression rule has cvss suppressions.
    +  151   + 
          *
     152   - 
          *
    -  153   
          * @return whether or not this suppression rule has cvss suppressions
    +  153   + 
          */
     154   - 
          */
    -  155   
         public boolean hasCvssBelow() {
    -  156  7 
             return cvssBelow.size() > 0;
    +  155  14 
             return cvssBelow.size() > 0;
    +  156   + 
         }
     157   - 
         }
    + 
         /**
     158   - 
         /**
    -  159   
          * The list of cwe entries to suppress.
    -  160   +  159   
          */
    -  161  23 
         private List<String> cwe = new ArrayList<String>();
    +  160  46 
         private List<String> cwe = new ArrayList<String>();
    +  161   + 
     
     162   - 
     
    + 
         /**
     163   - 
         /**
    -  164   
          * Get the value of cwe.
    +  164   + 
          *
     165   - 
          *
    -  166   
          * @return the value of cwe
    +  166   + 
          */
     167   - 
          */
    -  168   
         public List<String> getCwe() {
    -  169  1 
             return cwe;
    +  168  2 
             return cwe;
    +  169   + 
         }
     170   - 
         }
    + 
     
     171   - 
     
    + 
         /**
     172   - 
         /**
    -  173   
          * Set the value of cwe.
    +  173   + 
          *
     174   - 
          *
    -  175   
          * @param cwe new value of cwe
    +  175   + 
          */
     176   - 
          */
    -  177   
         public void setCwe(List<String> cwe) {
    -  178  1 
             this.cwe = cwe;
    -  179  1 
         }
    +  177  2 
             this.cwe = cwe;
    +  178  2 
         }
    +  179   + 
     
     180   - 
     
    + 
         /**
     181   - 
         /**
    -  182   
          * Adds the cwe to the cwe list.
    +  182   + 
          *
     183   - 
          *
    -  184   
          * @param cwe the cwe to add
    +  184   + 
          */
     185   - 
          */
    -  186   
         public void addCwe(String cwe) {
    -  187  2 
             this.cwe.add(cwe);
    -  188  2 
         }
    +  186  4 
             this.cwe.add(cwe);
    +  187  4 
         }
    +  188   + 
     
     189   - 
     
    + 
         /**
     190   - 
         /**
    -  191   
          * Returns whether this suppression rule has CWE entries.
    +  191   + 
          *
     192   - 
          *
    -  193   
          * @return whether this suppression rule has CWE entries
    +  193   + 
          */
     194   - 
          */
    -  195   
         public boolean hasCwe() {
    -  196  8 
             return cwe.size() > 0;
    +  195  16 
             return cwe.size() > 0;
    +  196   + 
         }
     197   - 
         }
    + 
         /**
     198   - 
         /**
    -  199   
          * The list of cve entries to suppress.
    -  200   +  199   
          */
    -  201  23 
         private List<String> cve = new ArrayList<String>();
    +  200  46 
         private List<String> cve = new ArrayList<String>();
    +  201   + 
     
     202   - 
     
    + 
         /**
     203   - 
         /**
    -  204   
          * Get the value of cve.
    +  204   + 
          *
     205   - 
          *
    -  206   
          * @return the value of cve
    +  206   + 
          */
     207   - 
          */
    -  208   
         public List<String> getCve() {
    -  209  1 
             return cve;
    +  208  2 
             return cve;
    +  209   + 
         }
     210   - 
         }
    + 
     
     211   - 
     
    + 
         /**
     212   - 
         /**
    -  213   
          * Set the value of cve.
    +  213   + 
          *
     214   - 
          *
    -  215   
          * @param cve new value of cve
    +  215   + 
          */
     216   - 
          */
    -  217   
         public void setCve(List<String> cve) {
    -  218  1 
             this.cve = cve;
    -  219  1 
         }
    +  217  2 
             this.cve = cve;
    +  218  2 
         }
    +  219   + 
     
     220   - 
     
    + 
         /**
     221   - 
         /**
    -  222   
          * Adds the cve to the cve list.
    +  222   + 
          *
     223   - 
          *
    -  224   
          * @param cve the cve to add
    +  224   + 
          */
     225   - 
          */
    -  226   
         public void addCve(String cve) {
    -  227  7 
             this.cve.add(cve);
    -  228  7 
         }
    +  226  14 
             this.cve.add(cve);
    +  227  14 
         }
    +  228   + 
     
     229   - 
     
    + 
         /**
     230   - 
         /**
    -  231   
          * Returns whether this suppression rule has CVE entries.
    +  231   + 
          *
     232   - 
          *
    -  233   
          * @return whether this suppression rule has CVE entries
    +  233   + 
          */
     234   - 
          */
    -  235   
         public boolean hasCve() {
    -  236  10 
             return cve.size() > 0;
    +  235  20 
             return cve.size() > 0;
    +  236   + 
         }
     237   - 
         }
    + 
     
     238   - 
     
    + 
         /**
     239   - 
         /**
    + 
          * Processes a given dependency to determine if any CPE, CVE, CWE, or CVSS scores should be suppressed. If any
     240   - 
          * Processes a given dependency to determine if any CPE, CVE, CWE, or CVSS
    + 
          * should be, they are removed from the dependency.
     241   - 
          * scores should be suppressed. If any should be, they are removed from the
    + 
          *
     242   - 
          * dependency.
    -  243   - 
          *
    -  244   
          * @param dependency a project dependency to analyze
    -  245   +  243   
          */
    -  246   +  244   
         public void process(Dependency dependency) {
    -  247  9 
             if (filePath != null && !filePath.matches(dependency.getFilePath())) {
    -  248  0 
                 return;
    -  249   +  245  18 
             if (filePath != null && !filePath.matches(dependency.getFilePath())) {
    +  246  0 
                 return;
    +  247   
             }
    -  250  9 
             if (sha1 != null && !sha1.equalsIgnoreCase(dependency.getSha1sum())) {
    -  251  1 
                 return;
    -  252   +  248  18 
             if (sha1 != null && !sha1.equalsIgnoreCase(dependency.getSha1sum())) {
    +  249  2 
                 return;
    +  250   
             }
    -  253  8 
             if (this.hasCpe()) {
    -  254  3 
                 final Iterator<Identifier> itr = dependency.getIdentifiers().iterator();
    -  255  8 
                 while (itr.hasNext()) {
    -  256  5 
                     final Identifier i = itr.next();
    -  257  5 
                     for (PropertyType c : this.cpe) {
    -  258  9 
                         if (cpeMatches(c, i)) {
    -  259  4 
                             itr.remove();
    -  260  4 
                             break;
    -  261   +  251  16 
             if (this.hasCpe()) {
    +  252  6 
                 final Iterator<Identifier> itr = dependency.getIdentifiers().iterator();
    +  253  16 
                 while (itr.hasNext()) {
    +  254  10 
                     final Identifier i = itr.next();
    +  255  10 
                     for (PropertyType c : this.cpe) {
    +  256  18 
                         if (cpeMatches(c, i)) {
    +  257  8 
                             itr.remove();
    +  258  8 
                             break;
    +  259   
                         }
    -  262  5 
                     }
    -  263  5 
                 }
    -  264   +  260  10 
                     }
    +  261  10 
                 }
    +  262   
             }
    -  265  8 
             if (hasCve() || hasCwe() || hasCvssBelow()) {
    -  266  5 
                 final Iterator<Vulnerability> itr = dependency.getVulnerabilities().iterator();
    -  267  10 
                 while (itr.hasNext()) {
    -  268  5 
                     boolean remove = false;
    -  269  5 
                     final Vulnerability v = itr.next();
    -  270  5 
                     for (String entry : this.cve) {
    -  271  3 
                         if (entry.equalsIgnoreCase(v.getName())) {
    -  272  1 
                             remove = true;
    -  273  1 
                             break;
    -  274   +  263  16 
             if (hasCve() || hasCwe() || hasCvssBelow()) {
    +  264  10 
                 final Iterator<Vulnerability> itr = dependency.getVulnerabilities().iterator();
    +  265  20 
                 while (itr.hasNext()) {
    +  266  10 
                     boolean remove = false;
    +  267  10 
                     final Vulnerability v = itr.next();
    +  268  10 
                     for (String entry : this.cve) {
    +  269  6 
                         if (entry.equalsIgnoreCase(v.getName())) {
    +  270  2 
                             remove = true;
    +  271  2 
                             break;
    +  272   
                         }
    -  275  2 
                     }
    -  276  5 
                     if (!remove) {
    -  277  4 
                         for (String entry : this.cwe) {
    -  278  1 
                             if (v.getCwe() != null) {
    -  279  1 
                                 final String toMatch = String.format("CWE-%s ", entry);
    -  280  1 
                                 final String toTest = v.getCwe().substring(0, toMatch.length()).toUpperCase();
    -  281  1 
                                 if (toTest.equals(toMatch)) {
    -  282  1 
                                     remove = true;
    -  283  1 
                                     break;
    -  284   +  273  4 
                     }
    +  274  10 
                     if (!remove) {
    +  275  8 
                         for (String entry : this.cwe) {
    +  276  2 
                             if (v.getCwe() != null) {
    +  277  2 
                                 final String toMatch = String.format("CWE-%s ", entry);
    +  278  2 
                                 final String toTest = v.getCwe().substring(0, toMatch.length()).toUpperCase();
    +  279  2 
                                 if (toTest.equals(toMatch)) {
    +  280  2 
                                     remove = true;
    +  281  2 
                                     break;
    +  282   
                                 }
    +  283   + 
                             }
    +  284  0 
                         }
     285   - 
                             }
    -  286  0 
                         }
    -  287   
                     }
    -  288  5 
                     if (!remove) {
    -  289  3 
                         for (float cvss : this.cvssBelow) {
    -  290  3 
                             if (v.getCvssScore() < cvss) {
    -  291  1 
                                 remove = true;
    -  292  1 
                                 break;
    +  286  10 
                     if (!remove) {
    +  287  6 
                         for (float cvss : this.cvssBelow) {
    +  288  6 
                             if (v.getCvssScore() < cvss) {
    +  289  2 
                                 remove = true;
    +  290  2 
                                 break;
    +  291   + 
                             }
    +  292  4 
                         }
     293   - 
                             }
    -  294  2 
                         }
    -  295   
                     }
    -  296  5 
                     if (remove) {
    -  297  3 
                         itr.remove();
    +  294  10 
                     if (remove) {
    +  295  6 
                         itr.remove();
    +  296   + 
                     }
    +  297  10 
                 }
     298   - 
                     }
    -  299  5 
                 }
    + 
             }
    +  299  16 
         }
     300   - 
             }
    -  301  8 
         }
    + 
     
    +  301   + 
         /**
     302   - 
     
    + 
          * Identifies if the cpe specified by the cpe suppression rule does not specify a version.
     303   - 
         /**
    + 
          *
     304   - 
          * Identifies if the cpe specified by the cpe suppression rule does not
    -  305   - 
          * specify a version.
    -  306   - 
          *
    -  307   
          * @param c a suppression rule identifier
    -  308   - 
          * @return true if the property type does not specify a version; otherwise
    -  309   - 
          * false
    -  310   +  305   + 
          * @return true if the property type does not specify a version; otherwise false
    +  306   
          */
    -  311   +  307   
         boolean cpeHasNoVersion(PropertyType c) {
    -  312  14 
             if (c.isRegex()) {
    -  313  2 
                 return false;
    -  314   +  308  28 
             if (c.isRegex()) {
    +  309  4 
                 return false;
    +  310   
             } // cpe:/a:jboss:jboss:1.0.0:
    -  315  12 
             if (countCharacter(c.getValue(), ':') == 3) {
    -  316  3 
                 return true;
    +  311  24 
             if (countCharacter(c.getValue(), ':') == 3) {
    +  312  6 
                 return true;
    +  313   + 
             }
    +  314  18 
             return false;
    +  315   + 
         }
    +  316   + 
     
     317   - 
             }
    -  318  9 
             return false;
    + 
         /**
    +  318   + 
          * Counts the number of occurrences of the character found within the string.
     319   - 
         }
    + 
          *
     320   - 
     
    -  321   - 
         /**
    -  322   - 
          * Counts the number of occurrences of the character found within the
    -  323   - 
          * string.
    -  324   - 
          *
    -  325   
          * @param str the string to check
    -  326   +  321   
          * @param c the character to count
    -  327   +  322   
          * @return the number of times the character is found in the string
    -  328   +  323   
          */
    -  329   +  324   
         int countCharacter(String str, char c) {
    -  330  15 
             int count = 0;
    -  331  15 
             int pos = str.indexOf(c) + 1;
    -  332  66 
             while (pos > 0) {
    -  333  51 
                 count += 1;
    -  334  51 
                 pos = str.indexOf(c, pos) + 1;
    -  335   +  325  30 
             int count = 0;
    +  326  30 
             int pos = str.indexOf(c) + 1;
    +  327  132 
             while (pos > 0) {
    +  328  102 
                 count += 1;
    +  329  102 
                 pos = str.indexOf(c, pos) + 1;
    +  330   
             }
    -  336  15 
             return count;
    -  337   +  331  30 
             return count;
    +  332   
         }
    -  338   +  333   
     
    -  339   +  334   
         /**
    -  340   - 
          * Determines if the cpeEntry specified as a PropertyType matches the given
    -  341   - 
          * Identifier.
    -  342   +  335   + 
          * Determines if the cpeEntry specified as a PropertyType matches the given Identifier.
    +  336   
          *
    -  343   +  337   
          * @param cpeEntry a suppression rule entry
    -  344   +  338   
          * @param identifier a CPE identifier to check
    -  345   +  339   
          * @return true if the entry matches; otherwise false
    -  346   +  340   
          */
    -  347   +  341   
         boolean cpeMatches(PropertyType cpeEntry, Identifier identifier) {
    -  348  16 
             if (cpeEntry.matches(identifier.getValue())) {
    -  349  5 
                 return true;
    -  350  11 
             } else if (cpeHasNoVersion(cpeEntry)) {
    -  351  2 
                 if (cpeEntry.isCaseSensitive()) {
    -  352  0 
                     if (identifier.getValue().startsWith(cpeEntry.getValue())) {
    -  353  0 
                         return true;
    +  342  32 
             if (cpeEntry.matches(identifier.getValue())) {
    +  343  10 
                 return true;
    +  344  22 
             } else if (cpeHasNoVersion(cpeEntry)) {
    +  345  4 
                 if (cpeEntry.isCaseSensitive()) {
    +  346  0 
                     if (identifier.getValue().startsWith(cpeEntry.getValue())) {
    +  347  0 
                         return true;
    +  348   + 
                     }
    +  349   + 
                 } else {
    +  350  4 
                     final String id = identifier.getValue().toLowerCase();
    +  351  4 
                     final String check = cpeEntry.getValue().toLowerCase();
    +  352  4 
                     if (id.startsWith(check)) {
    +  353  4 
                         return true;
     354   
                     }
     355   - 
                 } else {
    -  356  2 
                     final String id = identifier.getValue().toLowerCase();
    -  357  2 
                     final String check = cpeEntry.getValue().toLowerCase();
    -  358  2 
                     if (id.startsWith(check)) {
    -  359  2 
                         return true;
    -  360   - 
                     }
    -  361   
                 }
    -  362   +  356   
             }
    -  363  9 
             return false;
    -  364   +  357  18 
             return false;
    +  358   
         }
    -  365   +  359   
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.Checksum.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.Checksum.html index 8a262e333..a1de603eb 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.Checksum.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.Checksum.html @@ -99,36 +99,36 @@ 
          */
     42   
         public static byte[] getChecksum(String algorithm, File file) throws NoSuchAlgorithmException, IOException {
    -  43  77 
             InputStream fis = null;
    -  44  77 
             byte[] buffer = new byte[1024];
    -  45  77 
             MessageDigest complete = MessageDigest.getInstance(algorithm);
    +  43  194 
             InputStream fis = null;
    +  44  194 
             byte[] buffer = new byte[1024];
    +  45  194 
             MessageDigest complete = MessageDigest.getInstance(algorithm);
     46   
             int numRead;
     47   
             try {
    -  48  76 
                 fis = new FileInputStream(file);
    +  48  192 
                 fis = new FileInputStream(file);
     49   
                 do {
    -  50  40746 
                     numRead = fis.read(buffer);
    -  51  40746 
                     if (numRead > 0) {
    -  52  40671 
                         complete.update(buffer, 0, numRead);
    +  50  134160 
                     numRead = fis.read(buffer);
    +  51  134160 
                     if (numRead > 0) {
    +  52  133974 
                         complete.update(buffer, 0, numRead);
     53   
                     }
    -  54  40746 
                 } while (numRead != -1);
    +  54  134160 
                 } while (numRead != -1);
     55   
             } finally {
    -  56  76 
                 if (fis != null) {
    +  56  192 
                 if (fis != null) {
     57   
                     try {
    -  58  75 
                         fis.close();
    +  58  186 
                         fis.close();
     59  0 
                     } catch (IOException ex) {
     60  0 
                         Logger.getLogger(Checksum.class.getName()).log(Level.FINEST, "Error closing file '" + file.getName() + "'.", ex);
    -  61  76 
                     }
    +  61  192 
                     }
     62   
                 }
     63   
             }
    -  64  75 
             return complete.digest();
    +  64  186 
             return complete.digest();
     65   
         }
     66   @@ -151,8 +151,8 @@ 
          */
     75   
         public static String getMD5Checksum(File file) throws IOException, NoSuchAlgorithmException {
    -  76  37 
             byte[] b = getChecksum("MD5", file);
    -  77  37 
             return getHex(b);
    +  76  96 
             byte[] b = getChecksum("MD5", file);
    +  77  92 
             return getHex(b);
     78   
         }
     79   @@ -175,8 +175,8 @@ 
          */
     88   
         public static String getSHA1Checksum(File file) throws IOException, NoSuchAlgorithmException {
    -  89  37 
             byte[] b = getChecksum("SHA1", file);
    -  90  37 
             return getHex(b);
    +  89  92 
             byte[] b = getChecksum("SHA1", file);
    +  90  92 
             return getHex(b);
     91   
         }
     92   @@ -203,22 +203,22 @@ 
          */
     103   
         public static String getHex(byte[] raw) {
    -  104  75 
             if (raw == null) {
    +  104  186 
             if (raw == null) {
     105  0 
                 return null;
     106   
             }
    -  107  75 
             final StringBuilder hex = new StringBuilder(2 * raw.length);
    -  108  1424 
             for (final byte b : raw) {
    -  109  1349 
                 hex.append(HEXES.charAt((b & 0xF0) >> 4)).append(HEXES.charAt((b & 0x0F)));
    +  107  186 
             final StringBuilder hex = new StringBuilder(2 * raw.length);
    +  108  3532 
             for (final byte b : raw) {
    +  109  3346 
                 hex.append(HEXES.charAt((b & 0xF0) >> 4)).append(HEXES.charAt((b & 0x0F)));
     110   
             }
    -  111  75 
             return hex.toString();
    +  111  186 
             return hex.toString();
     112   
         }
     113   
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.DBUtils.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.DBUtils.html index 7fb903a91..bdd8d0224 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.DBUtils.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.DBUtils.html @@ -24,171 +24,165 @@  3   
      *
     4   - 
      * Dependency-check-core is free software: you can redistribute it and/or modify it
    + 
      * Licensed under the Apache License, Version 2.0 (the "License");
     5   - 
      * under the terms of the GNU General Public License as published by the Free
    + 
      * you may not use this file except in compliance with the License.
     6   - 
      * Software Foundation, either version 3 of the License, or (at your option) any
    + 
      * You may obtain a copy of the License at
     7   - 
      * later version.
    + 
      *
     8   - 
      *
    + 
      *     http://www.apache.org/licenses/LICENSE-2.0
     9   - 
      * Dependency-check-core is distributed in the hope that it will be useful, but
    + 
      *
     10   - 
      * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
    + 
      * Unless required by applicable law or agreed to in writing, software
     11   - 
      * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
    + 
      * distributed under the License is distributed on an "AS IS" BASIS,
     12   - 
      * details.
    + 
      * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13   - 
      *
    + 
      * See the License for the specific language governing permissions and
     14   - 
      * You should have received a copy of the GNU General Public License along with
    + 
      * limitations under the License.
     15   - 
      * dependency-check-core. If not, see http://www.gnu.org/licenses/.
    + 
      *
     16   - 
      *
    -  17   
      * Copyright (c) 2013 Jeremy Long. All Rights Reserved.
    +  17   + 
      */
     18   - 
      */
    -  19   
     package org.owasp.dependencycheck.utils;
    +  19   + 
     
     20   - 
     
    -  21   
     import java.sql.PreparedStatement;
    -  22   +  21   
     import java.sql.ResultSet;
    -  23   +  22   
     import java.sql.SQLException;
    -  24   +  23   
     import java.sql.Statement;
    -  25   +  24   
     import java.util.logging.Level;
    -  26   +  25   
     import java.util.logging.Logger;
    -  27   +  26   
     import org.owasp.dependencycheck.data.nvdcve.CveDB;
    -  28   +  27   
     import org.owasp.dependencycheck.data.nvdcve.DatabaseException;
    +  28   + 
     
     29   - 
     
    -  30   
     /**
    -  31   +  30   
      *
    -  32   +  31   
      * @author Jeremy Long <jeremy.long@owasp.org>
    -  33   +  32   
      */
    -  34   +  33   
     public final class DBUtils {
    +  34   + 
     
     35   - 
     
    + 
         /**
     36   - 
         /**
    -  37   
          * Private constructor for a utility class.
    -  38   +  37   
          */
    -  39  0 
         private DBUtils() {
    -  40  0 
         }
    +  38  0 
         private DBUtils() {
    +  39  0 
         }
    +  40   + 
     
     41   - 
     
    + 
         /**
     42   - 
         /**
    -  43   
          * Returns the generated integer primary key for a newly inserted row.
    +  43   + 
          *
     44   - 
          *
    -  45   
          * @param statement a prepared statement that just executed an insert
    -  46   +  45   
          * @return a primary key
    +  46   + 
          * @throws DatabaseException thrown if there is an exception obtaining the key
     47   - 
          * @throws DatabaseException thrown if there is an exception obtaining the
    + 
          */
     48   - 
          * key
    -  49   - 
          */
    -  50   
         public static int getGeneratedKey(PreparedStatement statement) throws DatabaseException {
    -  51  0 
             ResultSet rs = null;
    -  52  0 
             int id = 0;
    -  53   +  49  0 
             ResultSet rs = null;
    +  50  0 
             int id = 0;
    +  51   
             try {
    -  54  0 
                 rs = statement.getGeneratedKeys();
    -  55  0 
                 rs.next();
    -  56  0 
                 id = rs.getInt(1);
    -  57  0 
             } catch (SQLException ex) {
    -  58  0 
                 throw new DatabaseException("Unable to get primary key for inserted row");
    -  59   +  52  0 
                 rs = statement.getGeneratedKeys();
    +  53  0 
                 rs.next();
    +  54  0 
                 id = rs.getInt(1);
    +  55  0 
             } catch (SQLException ex) {
    +  56  0 
                 throw new DatabaseException("Unable to get primary key for inserted row");
    +  57   
             } finally {
    -  60  0 
                 closeResultSet(rs);
    -  61  0 
             }
    -  62  0 
             return id;
    -  63   +  58  0 
                 closeResultSet(rs);
    +  59  0 
             }
    +  60  0 
             return id;
    +  61   
         }
    +  62   + 
     
    +  63   + 
         /**
     64   - 
     
    -  65   - 
         /**
    -  66   
          * Closes the given statement object ignoring any exceptions that occur.
    -  67   +  65   
          *
    -  68   +  66   
          * @param statement a Statement object
    -  69   +  67   
          */
    -  70   +  68   
         public static void closeStatement(Statement statement) {
    -  71  341 
             if (statement != null) {
    -  72   +  69  700 
             if (statement != null) {
    +  70   
                 try {
    -  73  341 
                     statement.close();
    -  74  0 
                 } catch (SQLException ex) {
    -  75  0 
                     Logger.getLogger(CveDB.class
    -  76   +  71  700 
                     statement.close();
    +  72  0 
                 } catch (SQLException ex) {
    +  73  0 
                     Logger.getLogger(CveDB.class
    +  74   
                             .getName()).log(Level.FINEST, statement.toString(), ex);
    -  77  341 
                 }
    +  75  700 
                 }
    +  76   + 
             }
    +  77  700 
         }
     78   - 
             }
    -  79  341 
         }
    -  80   
     
    -  81   +  79   
         /**
    -  82   - 
          * Closes the result set capturing and ignoring any SQLExceptions that
    -  83   - 
          * occur.
    -  84   +  80   + 
          * Closes the result set capturing and ignoring any SQLExceptions that occur.
    +  81   
          *
    -  85   +  82   
          * @param rs a ResultSet to close
    -  86   +  83   
          */
    -  87   +  84   
         public static void closeResultSet(ResultSet rs) {
    -  88  351 
             if (rs != null) {
    -  89   +  85  720 
             if (rs != null) {
    +  86   
                 try {
    -  90  351 
                     rs.close();
    -  91  0 
                 } catch (SQLException ex) {
    -  92  0 
                     Logger.getLogger(CveDB.class
    -  93   +  87  720 
                     rs.close();
    +  88  0 
                 } catch (SQLException ex) {
    +  89  0 
                     Logger.getLogger(CveDB.class
    +  90   
                             .getName()).log(Level.FINEST, rs.toString(), ex);
    -  94  351 
                 }
    -  95   +  91  720 
                 }
    +  92   
             }
    -  96  351 
         }
    -  97   +  93  720 
         }
    +  94   
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.DependencyVersion.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.DependencyVersion.html index d6f54edc6..6f8f32f64 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.DependencyVersion.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.DependencyVersion.html @@ -24,429 +24,421 @@  3   
      *
     4   - 
      * Dependency-check-core is free software: you can redistribute it and/or modify it
    + 
      * Licensed under the Apache License, Version 2.0 (the "License");
     5   - 
      * under the terms of the GNU General Public License as published by the Free
    + 
      * you may not use this file except in compliance with the License.
     6   - 
      * Software Foundation, either version 3 of the License, or (at your option) any
    + 
      * You may obtain a copy of the License at
     7   - 
      * later version.
    + 
      *
     8   - 
      *
    + 
      *     http://www.apache.org/licenses/LICENSE-2.0
     9   - 
      * Dependency-check-core is distributed in the hope that it will be useful, but
    + 
      *
     10   - 
      * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
    + 
      * Unless required by applicable law or agreed to in writing, software
     11   - 
      * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
    + 
      * distributed under the License is distributed on an "AS IS" BASIS,
     12   - 
      * details.
    + 
      * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13   - 
      *
    + 
      * See the License for the specific language governing permissions and
     14   - 
      * You should have received a copy of the GNU General Public License along with
    + 
      * limitations under the License.
     15   - 
      * dependency-check-core. If not, see http://www.gnu.org/licenses/.
    + 
      *
     16   - 
      *
    -  17   
      * Copyright (c) 2013 Jeremy Long. All Rights Reserved.
    +  17   + 
      */
     18   - 
      */
    -  19   
     package org.owasp.dependencycheck.utils;
    +  19   + 
     
     20   - 
     
    -  21   
     import java.util.ArrayList;
    -  22   +  21   
     import java.util.Iterator;
    -  23   +  22   
     import java.util.List;
    -  24   +  23   
     import java.util.regex.Matcher;
    -  25   +  24   
     import java.util.regex.Pattern;
    -  26   +  25   
     import org.apache.commons.lang.StringUtils;
    +  26   + 
     
     27   - 
     
    -  28   
     /**
    +  28   + 
      * <p>
     29   - 
      * <p>Simple object to track the parts of a version number. The parts are
    + 
      * Simple object to track the parts of a version number. The parts are contained in a List such that version 1.2.3 will
     30   - 
      * contained in a List such that version 1.2.3 will be stored as:
    + 
      * be stored as:  <code>versionParts[0] = 1;
     31   - 
      * <code>versionParts[0] = 1;
    -  32   
      * versionParts[1] = 2;
    -  33   +  32   
      * versionParts[2] = 3;
    -  34   +  33   
      * </code></p>
    +  34   + 
      * <p>
     35   - 
      * <p>Note, the parser contained in this class expects the version numbers to be
    + 
      * Note, the parser contained in this class expects the version numbers to be separated by periods. If a different
     36   - 
      * separated by periods. If a different separator is used the parser will likely
    + 
      * separator is used the parser will likely fail.</p>
     37   - 
      * fail.</p>
    -  38   
      *
    -  39   +  38   
      * @author Jeremy Long <jeremy.long@owasp.org>
    -  40   +  39   
      */
    -  41  14 
     public class DependencyVersion implements Iterable, Comparable<DependencyVersion> {
    +  40  28 
     public class DependencyVersion implements Iterable, Comparable<DependencyVersion> {
    +  41   + 
     
     42   - 
     
    + 
         /**
     43   - 
         /**
    -  44   
          * Constructor for a empty DependencyVersion.
    -  45   +  44   
          */
    -  46  20 
         public DependencyVersion() {
    -  47  20 
         }
    +  45  48 
         public DependencyVersion() {
    +  46  48 
         }
    +  47   + 
     
     48   - 
     
    + 
         /**
     49   - 
         /**
    -  50   
          * Constructor for a DependencyVersion that will parse a version string.
    +  50   + 
          * <b>Note</b>, this should only be used when the version passed in is already known to be a well formated version
     51   - 
          * <b>Note</b>, this should only be used when the version passed in is
    + 
          * number. Otherwise, DependencyVersionUtil.parseVersion() should be used instead.
     52   - 
          * already known to be a well formated version number. Otherwise,
    + 
          *
     53   - 
          * DependencyVersionUtil.parseVersion() should be used instead.
    -  54   - 
          *
    -  55   
          * @param version the well formated version number to parse
    -  56   +  54   
          */
    -  57  12873 
         public DependencyVersion(String version) {
    -  58  12873 
             parseVersion(version);
    -  59  12873 
         }
    -  60   +  55  30266 
         public DependencyVersion(String version) {
    +  56  30266 
             parseVersion(version);
    +  57  30266 
         }
    +  58   
     
    -  61   +  59   
         /**
    +  60   + 
          * Parses a version string into its sub parts: major, minor, revision, build, etc. <b>Note</b>, this should only be
    +  61   + 
          * used to parse something that is already known to be a version number.
     62   - 
          * Parses a version string into its sub parts: major, minor, revision,
    -  63   - 
          * build, etc. <b>Note</b>, this should only be used to parse something that
    -  64   - 
          * is already known to be a version number.
    -  65   
          *
    -  66   +  63   
          * @param version the version string to parse
    -  67   +  64   
          */
    -  68   +  65   
         public final void parseVersion(String version) {
    -  69  12875 
             versionParts = new ArrayList<String>();
    -  70  12875 
             if (version != null) {
    -  71  12875 
                 final Pattern rx = Pattern.compile("(\\d+|[a-z]+\\d+|(release|beta|alpha)$)");
    -  72  12875 
                 final Matcher matcher = rx.matcher(version.toLowerCase());
    -  73  53017 
                 while (matcher.find()) {
    -  74  40142 
                     versionParts.add(matcher.group());
    +  66  30270 
             versionParts = new ArrayList<String>();
    +  67  30270 
             if (version != null) {
    +  68  30270 
                 final Pattern rx = Pattern.compile("(\\d+|[a-z]+\\d+|(release|beta|alpha)$)");
    +  69  30270 
                 final Matcher matcher = rx.matcher(version.toLowerCase());
    +  70  124642 
                 while (matcher.find()) {
    +  71  94372 
                     versionParts.add(matcher.group());
    +  72   + 
                 }
    +  73  30270 
                 if (versionParts.isEmpty()) {
    +  74  154 
                     versionParts.add(version);
     75   
                 }
    -  76  12875 
                 if (versionParts.isEmpty()) {
    -  77  77 
                     versionParts.add(version);
    -  78   - 
                 }
    -  79   +  76   
             }
    -  80  12875 
         }
    -  81   +  77  30270 
         }
    +  78   
         /**
    -  82   +  79   
          * A list of the version parts.
    -  83   +  80   
          */
    -  84   +  81   
         private List<String> versionParts;
    -  85   +  82   
     
    -  86   +  83   
         /**
    -  87   +  84   
          * Get the value of versionParts.
    -  88   +  85   
          *
    -  89   +  86   
          * @return the value of versionParts
    -  90   +  87   
          */
    -  91   +  88   
         public List<String> getVersionParts() {
    -  92  18244 
             return versionParts;
    +  89  45376 
             return versionParts;
    +  90   + 
         }
    +  91   + 
     
    +  92   + 
         /**
     93   - 
         }
    -  94   - 
     
    -  95   - 
         /**
    -  96   
          * Set the value of versionParts.
    -  97   +  94   
          *
    -  98   +  95   
          * @param versionParts new value of versionParts
    -  99   +  96   
          */
    -  100   +  97   
         public void setVersionParts(List<String> versionParts) {
    -  101  19 
             this.versionParts = versionParts;
    -  102  19 
         }
    -  103   +  98  46 
             this.versionParts = versionParts;
    +  99  46 
         }
    +  100   
     
    -  104   +  101   
         /**
    -  105   +  102   
          * Retrieves an iterator for the version parts.
    -  106   +  103   
          *
    -  107   +  104   
          * @return an iterator for the version parts
    -  108   +  105   
          */
    -  109   +  106   
         public Iterator iterator() {
    -  110  1 
             return versionParts.iterator();
    +  107  2 
             return versionParts.iterator();
    +  108   + 
         }
    +  109   + 
     
    +  110   + 
         /**
     111   - 
         }
    -  112   - 
     
    -  113   - 
         /**
    -  114   
          * Reconstructs the version string from the split version parts.
    -  115   +  112   
          *
    -  116   +  113   
          * @return a string representing the version.
    -  117   +  114   
          */
    -  118   +  115   
         @Override
    -  119   +  116   
         public String toString() {
    -  120  3722 
             return StringUtils.join(versionParts.toArray(), ".");
    -  121   +  117  7444 
             return StringUtils.join(versionParts.toArray(), ".");
    +  118   
         }
    -  122   +  119   
     
    -  123   +  120   
         /**
    -  124   +  121   
          * Compares the equality of this object to the one passed in as a parameter.
    -  125   +  122   
          *
    -  126   +  123   
          * @param obj the object to compare equality
    -  127   +  124   
          * @return returns true only if the two objects are equal, otherwise false
    -  128   +  125   
          */
    -  129   +  126   
         @Override
    -  130   +  127   
         public boolean equals(Object obj) {
    -  131  12509 
             if (obj == null) {
    +  128  29482 
             if (obj == null) {
    +  129  0 
                 return false;
    +  130   + 
             }
    +  131  29482 
             if (getClass() != obj.getClass()) {
     132  0 
                 return false;
     133   
             }
    -  134  12509 
             if (getClass() != obj.getClass()) {
    -  135  0 
                 return false;
    +  134  29482 
             final DependencyVersion other = (DependencyVersion) obj;
    +  135  29482 
             final int max = (this.versionParts.size() < other.versionParts.size())
     136   - 
             }
    -  137  12509 
             final DependencyVersion other = (DependencyVersion) obj;
    -  138  12509 
             final int max = (this.versionParts.size() < other.versionParts.size())
    -  139   
                     ? this.versionParts.size() : other.versionParts.size();
    -  140   +  137   
             //TODO steal better version of code from compareTo
    -  141  19001 
             for (int i = 0; i < max; i++) {
    -  142  18310 
                 final String thisPart = this.versionParts.get(i);
    -  143  18310 
                 final String otherPart = other.versionParts.get(i);
    -  144  18310 
                 if (!thisPart.equals(otherPart)) {
    -  145  11818 
                     return false;
    -  146   +  138  44474 
             for (int i = 0; i < max; i++) {
    +  139  42988 
                 final String thisPart = this.versionParts.get(i);
    +  140  42988 
                 final String otherPart = other.versionParts.get(i);
    +  141  42988 
                 if (!thisPart.equals(otherPart)) {
    +  142  27996 
                     return false;
    +  143   
                 }
    -  147   +  144   + 
             }
    +  145  1486 
             if (this.versionParts.size() > max) {
    +  146  228 
                 for (int i = max; i < this.versionParts.size(); i++) {
    +  147  228 
                     if (!"0".equals(this.versionParts.get(i))) {
    +  148  228 
                         return false;
    +  149   + 
                     }
    +  150   + 
                 }
    +  151   
             }
    -  148  691 
             if (this.versionParts.size() > max) {
    -  149  86 
                 for (int i = max; i < this.versionParts.size(); i++) {
    -  150  86 
                     if (!"0".equals(this.versionParts.get(i))) {
    -  151  86 
                         return false;
     152   - 
                     }
    -  153   - 
                 }
    -  154   - 
             }
    -  155   
     
    -  156  605 
             if (other.versionParts.size() > max) {
    -  157  463 
                 for (int i = max; i < other.versionParts.size(); i++) {
    -  158  447 
                     if (!"0".equals(other.versionParts.get(i))) {
    -  159  415 
                         return false;
    +  153  1258 
             if (other.versionParts.size() > max) {
    +  154  934 
                 for (int i = max; i < other.versionParts.size(); i++) {
    +  155  902 
                     if (!"0".equals(other.versionParts.get(i))) {
    +  156  838 
                         return false;
    +  157   + 
                     }
    +  158   + 
                 }
    +  159   + 
             }
     160   - 
                     }
    + 
     
     161   - 
                 }
    -  162   - 
             }
    -  163   - 
     
    -  164   
             /*
    -  165   +  162   
              *  if (this.versionParts != other.versionParts && (this.versionParts == null || !this.versionParts.equals(other.versionParts))) {
    -  166   +  163   
              *      return false;
    -  167   +  164   
              *  }
    -  168   +  165   
              */
    -  169  190 
             return true;
    +  166  420 
             return true;
    +  167   + 
         }
    +  168   + 
     
    +  169   + 
         /**
     170   - 
         }
    -  171   - 
     
    -  172   - 
         /**
    -  173   
          * Calculates the hashCode for this object.
    -  174   +  171   
          *
    -  175   +  172   
          * @return the hashCode
    -  176   +  173   
          */
    -  177   +  174   
         @Override
    -  178   +  175   
         public int hashCode() {
    -  179  1 
             int hash = 5;
    -  180  1 
             hash = 71 * hash + (this.versionParts != null ? this.versionParts.hashCode() : 0);
    -  181  1 
             return hash;
    -  182   +  176  2 
             int hash = 5;
    +  177  2 
             hash = 71 * hash + (this.versionParts != null ? this.versionParts.hashCode() : 0);
    +  178  2 
             return hash;
    +  179   
         }
    -  183   +  180   
     
    -  184   +  181   
         /**
    -  185   - 
          * Determines if the three most major major version parts are identical. For
    -  186   - 
          * instances, if version 1.2.3.4 was compared to 1.2.3 this function would
    -  187   - 
          * return true.
    -  188   +  182   + 
          * Determines if the three most major major version parts are identical. For instances, if version 1.2.3.4 was
    +  183   + 
          * compared to 1.2.3 this function would return true.
    +  184   
          *
    -  189   +  185   
          * @param version the version number to compare
    -  190   +  186   
          * @return true if the first three major parts of the version are identical
    -  191   +  187   
          */
    -  192   +  188   
         public boolean matchesAtLeastThreeLevels(DependencyVersion version) {
    -  193  8359 
             if (version == null) {
    -  194  0 
                 return false;
    -  195   +  189  20638 
             if (version == null) {
    +  190  0 
                 return false;
    +  191   
             }
    +  192   + 
     
    +  193  20638 
             boolean ret = true;
    +  194  20638 
             int max = (this.versionParts.size() < version.versionParts.size())
    +  195   + 
                     ? this.versionParts.size() : version.versionParts.size();
     196   
     
    -  197  8359 
             boolean ret = true;
    -  198  8359 
             int max = (this.versionParts.size() < version.versionParts.size())
    +  197  20638 
             if (max > 3) {
    +  198  4 
                 max = 3;
     199   - 
                     ? this.versionParts.size() : version.versionParts.size();
    + 
             }
     200   
     
    -  201  8359 
             if (max > 3) {
    -  202  2 
                 max = 3;
    -  203   +  201  30924 
             for (int i = 0; i < max; i++) {
    +  202  30088 
                 if (this.versionParts.get(i) == null || !this.versionParts.get(i).equals(version.versionParts.get(i))) {
    +  203  19802 
                     ret = false;
    +  204  19802 
                     break;
    +  205   + 
                 }
    +  206   
             }
    -  204   +  207   
     
    -  205  12674 
             for (int i = 0; i < max; i++) {
    -  206  12260 
                 if (this.versionParts.get(i) == null || !this.versionParts.get(i).equals(version.versionParts.get(i))) {
    -  207  7945 
                     ret = false;
    -  208  7945 
                     break;
    +  208  20638 
             return ret;
     209   - 
                 }
    + 
         }
     210   - 
             }
    + 
     
     211   - 
     
    -  212  8359 
             return ret;
    -  213   - 
         }
    -  214   - 
     
    -  215   
         @Override
    -  216   +  212   
         public int compareTo(DependencyVersion version) {
    -  217  55 
             if (version == null) {
    -  218  0 
                 return 1;
    +  213  110 
             if (version == null) {
    +  214  0 
                 return 1;
    +  215   + 
             }
    +  216  110 
             final List<String> left = this.getVersionParts();
    +  217  110 
             final List<String> right = version.getVersionParts();
    +  218  110 
             final int max = left.size() < right.size() ? left.size() : right.size();
     219   - 
             }
    -  220  55 
             final List<String> left = this.getVersionParts();
    -  221  55 
             final List<String> right = version.getVersionParts();
    -  222  55 
             final int max = left.size() < right.size() ? left.size() : right.size();
    -  223   
     
    -  224  92 
             for (int i = 0; i < max; i++) {
    -  225  85 
                 final String lStr = left.get(i);
    -  226  85 
                 final String rStr = right.get(i);
    -  227  85 
                 if (lStr.equals(rStr)) {
    -  228  37 
                     continue;
    -  229   +  220  184 
             for (int i = 0; i < max; i++) {
    +  221  170 
                 final String lStr = left.get(i);
    +  222  170 
                 final String rStr = right.get(i);
    +  223  170 
                 if (lStr.equals(rStr)) {
    +  224  74 
                     continue;
    +  225   
                 }
    -  230   +  226   
                 try {
    -  231  48 
                     final int l = Integer.parseInt(lStr);
    -  232  43 
                     final int r = Integer.parseInt(rStr);
    -  233  43 
                     if (l < r) {
    -  234  35 
                         return -1;
    -  235  8 
                     } else if (l > r) {
    -  236  8 
                         return 1;
    -  237   +  227  96 
                     final int l = Integer.parseInt(lStr);
    +  228  86 
                     final int r = Integer.parseInt(rStr);
    +  229  86 
                     if (l < r) {
    +  230  70 
                         return -1;
    +  231  16 
                     } else if (l > r) {
    +  232  16 
                         return 1;
    +  233   
                     }
    -  238  5 
                 } catch (NumberFormatException ex) {
    -  239  5 
                     final int comp = left.get(i).compareTo(right.get(i));
    -  240  5 
                     if (comp < 0) {
    -  241  5 
                         return -1;
    -  242  0 
                     } else if (comp > 0) {
    -  243  0 
                         return 1;
    -  244   +  234  10 
                 } catch (NumberFormatException ex) {
    +  235  10 
                     final int comp = left.get(i).compareTo(right.get(i));
    +  236  10 
                     if (comp < 0) {
    +  237  10 
                         return -1;
    +  238  0 
                     } else if (comp > 0) {
    +  239  0 
                         return 1;
    +  240   
                     }
    -  245  0 
                 }
    -  246   +  241  0 
                 }
    +  242   
             }
    -  247  7 
             if (left.size() < right.size()) {
    -  248  3 
                 return -1;
    -  249  4 
             } else if (left.size() > right.size()) {
    -  250  3 
                 return 1;
    -  251   +  243  14 
             if (left.size() < right.size()) {
    +  244  6 
                 return -1;
    +  245  8 
             } else if (left.size() > right.size()) {
    +  246  6 
                 return 1;
    +  247   
             } else {
    -  252  1 
                 return 0;
    -  253   +  248  2 
                 return 0;
    +  249   
             }
    -  254   +  250   
         }
    -  255   +  251   
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.DependencyVersionUtil.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.DependencyVersionUtil.html index f0a6effc2..f0ec10a43 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.DependencyVersionUtil.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.DependencyVersionUtil.html @@ -24,165 +24,161 @@  3   
      *
     4   - 
      * Dependency-check-core is free software: you can redistribute it and/or modify it
    + 
      * Licensed under the Apache License, Version 2.0 (the "License");
     5   - 
      * under the terms of the GNU General Public License as published by the Free
    + 
      * you may not use this file except in compliance with the License.
     6   - 
      * Software Foundation, either version 3 of the License, or (at your option) any
    + 
      * You may obtain a copy of the License at
     7   - 
      * later version.
    + 
      *
     8   - 
      *
    + 
      *     http://www.apache.org/licenses/LICENSE-2.0
     9   - 
      * Dependency-check-core is distributed in the hope that it will be useful, but
    + 
      *
     10   - 
      * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
    + 
      * Unless required by applicable law or agreed to in writing, software
     11   - 
      * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
    + 
      * distributed under the License is distributed on an "AS IS" BASIS,
     12   - 
      * details.
    + 
      * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13   - 
      *
    + 
      * See the License for the specific language governing permissions and
     14   - 
      * You should have received a copy of the GNU General Public License along with
    + 
      * limitations under the License.
     15   - 
      * dependency-check-core. If not, see http://www.gnu.org/licenses/.
    + 
      *
     16   - 
      *
    -  17   
      * Copyright (c) 2013 Jeremy Long. All Rights Reserved.
    +  17   + 
      */
     18   - 
      */
    -  19   
     package org.owasp.dependencycheck.utils;
    +  19   + 
     
     20   - 
     
    -  21   
     import java.util.ArrayList;
    -  22   +  21   
     import java.util.regex.Matcher;
    -  23   +  22   
     import java.util.regex.Pattern;
    +  23   + 
     
     24   - 
     
    -  25   
     /**
    +  25   + 
      * <p>
     26   - 
      * <p>A utility class to extract version numbers from file names (or other
    + 
      * A utility class to extract version numbers from file names (or other strings containing version numbers.</p>
     27   - 
      * strings containing version numbers.</p>
    -  28   
      *
    -  29   +  28   
      * @author Jeremy Long <jeremy.long@owasp.org>
    -  30   +  29   
      */
    -  31   +  30   
     public final class DependencyVersionUtil {
    +  31   + 
     
     32   - 
     
    + 
         /**
     33   - 
         /**
    -  34   
          * Regular expression to extract version numbers from file names.
    -  35   +  34   
          */
    -  36  1 
         private static final Pattern RX_VERSION = Pattern.compile("\\d+(\\.\\d{1,6})+(\\.?([_-](release|beta|alpha)|[a-zA-Z_-]{1,3}\\d{1,8}))?");
    +  35  2 
         private static final Pattern RX_VERSION = Pattern.compile("\\d+(\\.\\d{1,6})+(\\.?([_-](release|beta|alpha)|[a-zA-Z_-]{1,3}\\d{1,8}))?");
    +  36   + 
         /**
     37   - 
         /**
    + 
          * Regular expression to extract a single version number without periods. This is a last ditch effort just to check
     38   - 
          * Regular expression to extract a single version number without periods.
    + 
          * in case we are missing a version number using the previous regex.
     39   - 
          * This is a last ditch effort just to check in case we are missing a
    -  40   - 
          * version number using the previous regex.
    + 
          */
    +  40  2 
         private static final Pattern RX_SINGLE_VERSION = Pattern.compile("\\d+(\\.?([_-](release|beta|alpha)|[a-zA-Z_-]{1,3}\\d{1,8}))?");
     41   - 
          */
    -  42  1 
         private static final Pattern RX_SINGLE_VERSION = Pattern.compile("\\d+(\\.?([_-](release|beta|alpha)|[a-zA-Z_-]{1,3}\\d{1,8}))?");
    + 
     
    +  42   + 
         /**
     43   - 
     
    -  44   - 
         /**
    -  45   
          * Private constructor for utility class.
    -  46   +  44   
          */
    -  47  0 
         private DependencyVersionUtil() {
    -  48  0 
         }
    -  49   +  45  0 
         private DependencyVersionUtil() {
    +  46  0 
         }
    +  47   
     
    -  50   +  48   
         /**
    +  49   + 
          * <p>
    +  50   + 
          * A utility class to extract version numbers from file names (or other strings containing version numbers.<br/>
     51   - 
          * <p>A utility class to extract version numbers from file names (or other
    -  52   - 
          * strings containing version numbers.<br/>
    -  53   
          * Example:<br/>
    -  54   +  52   
          * Give the file name: library-name-1.4.1r2-release.jar<br/>
    -  55   +  53   
          * This function would return: 1.4.1.r2</p>
    -  56   +  54   
          *
    -  57   +  55   
          * @param text the text being analyzed
    -  58   +  56   
          * @return a DependencyVersion containing the version
    -  59   +  57   
          */
    -  60   +  58   
         public static DependencyVersion parseVersion(String text) {
    -  61  12839 
             if (text == null) {
    -  62  40 
                 return null;
    -  63   +  59  30230 
             if (text == null) {
    +  60  104 
                 return null;
    +  61   
             }
    -  64   +  62   
             //'-' is a special case used within the CVE entries, just include it as the version.
    -  65  12799 
             if ("-".equals(text)) {
    -  66  19 
                 final DependencyVersion dv = new DependencyVersion();
    -  67  19 
                 final ArrayList<String> list = new ArrayList<String>();
    -  68  19 
                 list.add(text);
    -  69  19 
                 dv.setVersionParts(list);
    -  70  19 
                 return dv;
    -  71   +  63  30126 
             if ("-".equals(text)) {
    +  64  46 
                 final DependencyVersion dv = new DependencyVersion();
    +  65  46 
                 final ArrayList<String> list = new ArrayList<String>();
    +  66  46 
                 list.add(text);
    +  67  46 
                 dv.setVersionParts(list);
    +  68  46 
                 return dv;
    +  69   
             }
    -  72  12780 
             String version = null;
    -  73  12780 
             Matcher matcher = RX_VERSION.matcher(text);
    -  74  12780 
             if (matcher.find()) {
    -  75  12664 
                 version = matcher.group();
    -  76   +  70  30080 
             String version = null;
    +  71  30080 
             Matcher matcher = RX_VERSION.matcher(text);
    +  72  30080 
             if (matcher.find()) {
    +  73  29784 
                 version = matcher.group();
    +  74   
             }
    -  77   +  75   
             //throw away the results if there are two things that look like version numbers
    -  78  12780 
             if (matcher.find()) {
    -  79  2 
                 return null;
    -  80   +  76  30080 
             if (matcher.find()) {
    +  77  4 
                 return null;
    +  78   
             }
    -  81  12778 
             if (version == null) {
    -  82  116 
                 matcher = RX_SINGLE_VERSION.matcher(text);
    -  83  116 
                 if (matcher.find()) {
    -  84  106 
                     version = matcher.group();
    -  85   +  79  30076 
             if (version == null) {
    +  80  296 
                 matcher = RX_SINGLE_VERSION.matcher(text);
    +  81  296 
                 if (matcher.find()) {
    +  82  276 
                     version = matcher.group();
    +  83   
                 } else {
    -  86  10 
                     return null;
    -  87   +  84  20 
                     return null;
    +  85   
                 }
    -  88   +  86   
                 //throw away the results if there are two things that look like version numbers
    -  89  106 
                 if (matcher.find()) {
    -  90  1 
                     return null;
    -  91   +  87  276 
                 if (matcher.find()) {
    +  88  2 
                     return null;
    +  89   
                 }
    -  92   +  90   
             }
    -  93  12767 
             return new DependencyVersion(version);
    -  94   +  91  30054 
             return new DependencyVersion(version);
    +  92   
         }
    -  95   +  93   
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.DownloadFailedException.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.DownloadFailedException.html index 2b2dc9aba..22b5973d6 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.DownloadFailedException.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.DownloadFailedException.html @@ -24,131 +24,129 @@  3   
      *
     4   - 
      * Dependency-check-core is free software: you can redistribute it and/or modify it
    + 
      * Licensed under the Apache License, Version 2.0 (the "License");
     5   - 
      * under the terms of the GNU General Public License as published by the Free
    + 
      * you may not use this file except in compliance with the License.
     6   - 
      * Software Foundation, either version 3 of the License, or (at your option) any
    + 
      * You may obtain a copy of the License at
     7   - 
      * later version.
    + 
      *
     8   - 
      *
    + 
      *     http://www.apache.org/licenses/LICENSE-2.0
     9   - 
      * Dependency-check-core is distributed in the hope that it will be useful, but
    + 
      *
     10   - 
      * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
    + 
      * Unless required by applicable law or agreed to in writing, software
     11   - 
      * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
    + 
      * distributed under the License is distributed on an "AS IS" BASIS,
     12   - 
      * details.
    + 
      * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13   - 
      *
    + 
      * See the License for the specific language governing permissions and
     14   - 
      * You should have received a copy of the GNU General Public License along with
    + 
      * limitations under the License.
     15   - 
      * dependency-check-core. If not, see http://www.gnu.org/licenses/.
    + 
      *
     16   - 
      *
    -  17   
      * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
    +  17   + 
      */
     18   - 
      */
    -  19   
     package org.owasp.dependencycheck.utils;
    +  19   + 
     
     20   - 
     
    -  21   
     import java.io.IOException;
    +  21   + 
     
     22   - 
     
    -  23   
     /**
    -  24   +  23   
      * An exception used when a download fails.
    -  25   +  24   
      *
    -  26   +  25   
      * @author Jeremy Long <jeremy.long@owasp.org>
    -  27   +  26   
      */
    -  28   +  27   
     public class DownloadFailedException extends IOException {
    +  28   + 
     
     29   - 
     
    + 
         /**
     30   - 
         /**
    -  31   
          * The serial version UID.
    +  31   + 
          */
     32   - 
          */
    -  33   
         private static final long serialVersionUID = 1L;
    +  33   + 
     
     34   - 
     
    + 
         /**
     35   - 
         /**
    + 
          * Creates a new DownloadFailedException.
     36   - 
          * Creates a new DownloadFailedException.
    + 
          */
     37   - 
          */
    -  38   
         public DownloadFailedException() {
    -  39  0 
             super();
    -  40  0 
         }
    +  38  0 
             super();
    +  39  0 
         }
    +  40   + 
     
     41   - 
     
    + 
         /**
     42   - 
         /**
    + 
          * Creates a new DownloadFailedException.
     43   - 
          * Creates a new DownloadFailedException.
    + 
          *
     44   - 
          *
    + 
          * @param msg a message for the exception.
     45   - 
          * @param msg a message for the exception.
    + 
          */
     46   - 
          */
    -  47   
         public DownloadFailedException(String msg) {
    -  48  0 
             super(msg);
    -  49  0 
         }
    +  47  0 
             super(msg);
    +  48  0 
         }
    +  49   + 
     
     50   - 
     
    + 
         /**
     51   - 
         /**
    + 
          * Creates a new DownloadFailedException.
     52   - 
          * Creates a new DownloadFailedException.
    + 
          *
     53   - 
          *
    + 
          * @param ex the cause of the download failure.
     54   - 
          * @param ex the cause of the download failure.
    + 
          */
     55   - 
          */
    -  56   
         public DownloadFailedException(Throwable ex) {
    -  57  0 
             super(ex);
    -  58  0 
         }
    -  59   +  56  0 
             super(ex);
    +  57  0 
         }
    +  58   
     
    -  60   +  59   
         /**
    -  61   +  60   
          * Creates a new DownloadFailedException.
    -  62   +  61   
          *
    -  63   +  62   
          * @param msg a message for the exception.
    -  64   +  63   
          * @param ex the cause of the download failure.
    -  65   +  64   
          */
    -  66   +  65   
         public DownloadFailedException(String msg, Throwable ex) {
    -  67  0 
             super(msg, ex);
    -  68  0 
         }
    -  69   +  66  0 
             super(msg, ex);
    +  67  0 
         }
    +  68   
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.Downloader.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.Downloader.html index 2bd486eca..ef52369e4 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.Downloader.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.Downloader.html @@ -25,364 +25,354 @@  3   
      *
     4   - 
      * Dependency-check-core is free software: you can redistribute it and/or modify it
    + 
      * Licensed under the Apache License, Version 2.0 (the "License");
     5   - 
      * under the terms of the GNU General Public License as published by the Free
    + 
      * you may not use this file except in compliance with the License.
     6   - 
      * Software Foundation, either version 3 of the License, or (at your option) any
    + 
      * You may obtain a copy of the License at
     7   - 
      * later version.
    + 
      *
     8   - 
      *
    + 
      *     http://www.apache.org/licenses/LICENSE-2.0
     9   - 
      * Dependency-check-core is distributed in the hope that it will be useful, but
    + 
      *
     10   - 
      * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
    + 
      * Unless required by applicable law or agreed to in writing, software
     11   - 
      * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
    + 
      * distributed under the License is distributed on an "AS IS" BASIS,
     12   - 
      * details.
    + 
      * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13   - 
      *
    + 
      * See the License for the specific language governing permissions and
     14   - 
      * You should have received a copy of the GNU General Public License along with
    + 
      * limitations under the License.
     15   - 
      * dependency-check-core. If not, see http://www.gnu.org/licenses/.
    + 
      *
     16   - 
      *
    -  17   
      * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
    +  17   + 
      */
     18   - 
      */
    -  19   
     package org.owasp.dependencycheck.utils;
    +  19   + 
     
     20   - 
     
    -  21   
     import java.io.BufferedOutputStream;
    -  22   +  21   
     import java.io.File;
    -  23   +  22   
     import java.io.FileOutputStream;
    -  24   +  23   
     import java.io.IOException;
    -  25   +  24   
     import java.io.InputStream;
    -  26   +  25   
     import java.net.Authenticator;
    -  27   +  26   
     import java.net.HttpURLConnection;
    -  28   +  27   
     import java.net.InetSocketAddress;
    -  29   +  28   
     import java.net.PasswordAuthentication;
    -  30   +  29   
     import java.net.Proxy;
    -  31   +  30   
     import java.net.SocketAddress;
    -  32   +  31   
     import java.net.URISyntaxException;
    -  33   +  32   
     import java.net.URL;
    -  34   +  33   
     import java.util.logging.Level;
    -  35   +  34   
     import java.util.logging.Logger;
    -  36   +  35   
     import java.util.zip.GZIPInputStream;
    -  37   +  36   
     import java.util.zip.InflaterInputStream;
    +  37   + 
     
     38   - 
     
    -  39   
     /**
    -  40   +  39   
      * A utility to download files from the Internet.
    -  41   +  40   
      *
    -  42   +  41   
      * @author Jeremy Long <jeremy.long@owasp.org>
    -  43   +  42   
      */
    -  44   +  43   
     public final class Downloader {
    +  44   + 
     
     45   - 
     
    + 
         /**
     46   - 
         /**
    -  47   
          * Private constructor for utility class.
    -  48   +  47   
          */
    -  49  0 
         private Downloader() {
    -  50  0 
         }
    +  48  0 
         private Downloader() {
    +  49  0 
         }
    +  50   + 
     
     51   - 
     
    + 
         /**
     52   - 
         /**
    -  53   
          * Retrieves a file from a given URL and saves it to the outputPath.
    +  53   + 
          *
     54   - 
          *
    -  55   
          * @param url the URL of the file to download.
    -  56   +  55   
          * @param outputPath the path to the save the file to.
    +  56   + 
          * @throws DownloadFailedException is thrown if there is an error downloading the file.
     57   - 
          * @throws DownloadFailedException is thrown if there is an error
    + 
          */
     58   - 
          * downloading the file.
    -  59   - 
          */
    -  60   
         public static void fetchFile(URL url, File outputPath) throws DownloadFailedException {
    -  61  0 
             HttpURLConnection conn = null;
    -  62   +  59  0 
             HttpURLConnection conn = null;
    +  60   
             try {
    -  63  0 
                 conn = Downloader.getConnection(url);
    -  64  0 
                 conn.setRequestProperty("Accept-Encoding", "gzip, deflate");
    -  65  0 
                 conn.connect();
    -  66  0 
             } catch (IOException ex) {
    -  67   +  61  0 
                 conn = Downloader.getConnection(url);
    +  62  0 
                 conn.setRequestProperty("Accept-Encoding", "gzip, deflate");
    +  63  0 
                 conn.connect();
    +  64  0 
             } catch (IOException ex) {
    +  65   
                 try {
    -  68  0 
                     if (conn != null) {
    -  69  0 
                         conn.disconnect();
    -  70   +  66  0 
                     if (conn != null) {
    +  67  0 
                         conn.disconnect();
    +  68   
                     }
    -  71   +  69   
                 } finally {
    -  72  0 
                     conn = null;
    -  73  0 
                 }
    -  74  0 
                 throw new DownloadFailedException("Error downloading file.", ex);
    -  75  0 
             }
    -  76  0 
             final String encoding = conn.getContentEncoding();
    -  77   +  70  0 
                     conn = null;
    +  71  0 
                 }
    +  72  0 
                 throw new DownloadFailedException("Error downloading file.", ex);
    +  73  0 
             }
    +  74  0 
             final String encoding = conn.getContentEncoding();
    +  75   
     
    -  78  0 
             BufferedOutputStream writer = null;
    -  79  0 
             InputStream reader = null;
    -  80   +  76  0 
             BufferedOutputStream writer = null;
    +  77  0 
             InputStream reader = null;
    +  78   
             try {
    -  81  0 
                 if (encoding != null && "gzip".equalsIgnoreCase(encoding)) {
    -  82  0 
                     reader = new GZIPInputStream(conn.getInputStream());
    -  83  0 
                 } else if (encoding != null && "deflate".equalsIgnoreCase(encoding)) {
    -  84  0 
                     reader = new InflaterInputStream(conn.getInputStream());
    -  85   +  79  0 
                 if (encoding != null && "gzip".equalsIgnoreCase(encoding)) {
    +  80  0 
                     reader = new GZIPInputStream(conn.getInputStream());
    +  81  0 
                 } else if (encoding != null && "deflate".equalsIgnoreCase(encoding)) {
    +  82  0 
                     reader = new InflaterInputStream(conn.getInputStream());
    +  83   
                 } else {
    -  86  0 
                     reader = conn.getInputStream();
    -  87   +  84  0 
                     reader = conn.getInputStream();
    +  85   
                 }
    -  88   +  86   
     
    -  89  0 
                 writer = new BufferedOutputStream(new FileOutputStream(outputPath));
    -  90  0 
                 final byte[] buffer = new byte[4096];
    -  91   +  87  0 
                 writer = new BufferedOutputStream(new FileOutputStream(outputPath));
    +  88  0 
                 final byte[] buffer = new byte[4096];
    +  89   
                 int bytesRead;
    -  92  0 
                 while ((bytesRead = reader.read(buffer)) > 0) {
    -  93  0 
                     writer.write(buffer, 0, bytesRead);
    -  94   +  90  0 
                 while ((bytesRead = reader.read(buffer)) > 0) {
    +  91  0 
                     writer.write(buffer, 0, bytesRead);
    +  92   
                 }
    -  95  0 
             } catch (Exception ex) {
    -  96  0 
                 throw new DownloadFailedException("Error saving downloaded file.", ex);
    -  97   +  93  0 
             } catch (Exception ex) {
    +  94  0 
                 throw new DownloadFailedException("Error saving downloaded file.", ex);
    +  95   
             } finally {
    -  98  0 
                 if (writer != null) {
    -  99   +  96  0 
                 if (writer != null) {
    +  97   
                     try {
    -  100  0 
                         writer.close();
    -  101  0 
                     } catch (Exception ex) {
    -  102  0 
                         Logger.getLogger(Downloader.class.getName()).log(Level.FINEST,
    -  103   +  98  0 
                         writer.close();
    +  99  0 
                     } catch (Exception ex) {
    +  100  0 
                         Logger.getLogger(Downloader.class.getName()).log(Level.FINEST,
    +  101   
                                 "Error closing the writer in Downloader.", ex);
    -  104  0 
                     }
    +  102  0 
                     }
    +  103   + 
                 }
    +  104  0 
                 if (reader != null) {
     105   - 
                 }
    -  106  0 
                 if (reader != null) {
    -  107   
                     try {
    -  108  0 
                         reader.close();
    -  109  0 
                     } catch (Exception ex) {
    -  110  0 
                         Logger.getLogger(Downloader.class.getName()).log(Level.FINEST,
    -  111   +  106  0 
                         reader.close();
    +  107  0 
                     } catch (Exception ex) {
    +  108  0 
                         Logger.getLogger(Downloader.class.getName()).log(Level.FINEST,
    +  109   
                                 "Error closing the reader in Downloader.", ex);
    -  112  0 
                     }
    -  113   +  110  0 
                     }
    +  111   
                 }
    +  112   + 
                 try {
    +  113  0 
                     conn.disconnect();
     114   - 
                 try {
    -  115  0 
                     conn.disconnect();
    -  116   
                 } finally {
    -  117  0 
                     conn = null;
    -  118  0 
                 }
    -  119  0 
             }
    -  120  0 
         }
    +  115  0 
                     conn = null;
    +  116  0 
                 }
    +  117  0 
             }
    +  118  0 
         }
    +  119   + 
     
    +  120   + 
         /**
     121   - 
     
    + 
          * Makes an HTTP Head request to retrieve the last modified date of the given URL. If the file:// protocol is
     122   - 
         /**
    + 
          * specified, then the lastTimestamp of the file is returned.
     123   - 
          * Makes an HTTP Head request to retrieve the last modified date of the
    + 
          *
     124   - 
          * given URL. If the file:// protocol is specified, then the lastTimestamp
    -  125   - 
          * of the file is returned.
    -  126   - 
          *
    -  127   
          * @param url the URL to retrieve the timestamp from
    -  128   +  125   
          * @return an epoch timestamp
    -  129   - 
          * @throws DownloadFailedException is thrown if an exception occurs making
    -  130   - 
          * the HTTP request
    -  131   +  126   + 
          * @throws DownloadFailedException is thrown if an exception occurs making the HTTP request
    +  127   
          */
    -  132   +  128   
         public static long getLastModified(URL url) throws DownloadFailedException {
    -  133  10 
             long timestamp = 0;
    -  134   +  129  20 
             long timestamp = 0;
    +  130   
             //TODO add the FPR protocol?
    -  135  10 
             if ("file".equalsIgnoreCase(url.getProtocol())) {
    -  136   +  131  20 
             if ("file".equalsIgnoreCase(url.getProtocol())) {
    +  132   
                 File lastModifiedFile;
    -  137   +  133   
                 try {
    -  138   +  134   
     //                if (System.getProperty("os.name").toLowerCase().startsWith("windows")) {
    -  139   +  135   
     //                    String filePath = url.toString();
    -  140   +  136   
     //                    if (filePath.matches("file://[a-zA-Z]:.*")) {
    -  141   +  137   
     //                        f = new File(filePath.substring(7));
    -  142   +  138   
     //                    } else {
    -  143   +  139   
     //                        f = new File(url.toURI());
    -  144   +  140   
     //                    }
    -  145   +  141   
     //                } else {
    -  146  10 
                     lastModifiedFile = new File(url.toURI());
    -  147   +  142  20 
                     lastModifiedFile = new File(url.toURI());
    +  143   
     //                }
    -  148  0 
                 } catch (URISyntaxException ex) {
    -  149  0 
                     final String msg = String.format("Unable to locate '%s'; is the cve.url-2.0.modified property set correctly?", url.toString());
    -  150  0 
                     throw new DownloadFailedException(msg);
    -  151  10 
                 }
    -  152  10 
                 timestamp = lastModifiedFile.lastModified();
    -  153  10 
             } else {
    -  154  0 
                 HttpURLConnection conn = null;
    -  155   +  144  0 
                 } catch (URISyntaxException ex) {
    +  145  0 
                     final String msg = String.format("Unable to locate '%s'; is the cve.url-2.0.modified property set correctly?", url.toString());
    +  146  0 
                     throw new DownloadFailedException(msg);
    +  147  20 
                 }
    +  148  20 
                 timestamp = lastModifiedFile.lastModified();
    +  149  20 
             } else {
    +  150  0 
                 HttpURLConnection conn = null;
    +  151   
                 try {
    -  156  0 
                     conn = Downloader.getConnection(url);
    -  157  0 
                     conn.setRequestMethod("HEAD");
    -  158  0 
                     conn.connect();
    -  159  0 
                     timestamp = conn.getLastModified();
    -  160  0 
                 } catch (Exception ex) {
    -  161  0 
                     throw new DownloadFailedException("Error making HTTP HEAD request.", ex);
    -  162   +  152  0 
                     conn = Downloader.getConnection(url);
    +  153  0 
                     conn.setRequestMethod("HEAD");
    +  154  0 
                     conn.connect();
    +  155  0 
                     timestamp = conn.getLastModified();
    +  156  0 
                 } catch (Exception ex) {
    +  157  0 
                     throw new DownloadFailedException("Error making HTTP HEAD request.", ex);
    +  158   
                 } finally {
    -  163  0 
                     if (conn != null) {
    -  164   +  159  0 
                     if (conn != null) {
    +  160   
                         try {
    -  165  0 
                             conn.disconnect();
    -  166   +  161  0 
                             conn.disconnect();
    +  162   
                         } finally {
    -  167  0 
                             conn = null;
    -  168  0 
                         }
    -  169   +  163  0 
                             conn = null;
    +  164  0 
                         }
    +  165   
                     }
    -  170   +  166   
                 }
    -  171   +  167   
             }
    -  172  10 
             return timestamp;
    -  173   +  168  20 
             return timestamp;
    +  169   
         }
    -  174   +  170   
     
    -  175   +  171   
         /**
    -  176   - 
          * Utility method to get an HttpURLConnection. If the app is configured to
    -  177   - 
          * use a proxy this method will retrieve the proxy settings and use them
    -  178   - 
          * when setting up the connection.
    -  179   +  172   + 
          * Utility method to get an HttpURLConnection. If the app is configured to use a proxy this method will retrieve the
    +  173   + 
          * proxy settings and use them when setting up the connection.
    +  174   
          *
    -  180   +  175   
          * @param url the url to connect to
    -  181   +  176   
          * @return an HttpURLConnection
    -  182   +  177   
          * @throws DownloadFailedException thrown if there is an exception
    -  183   +  178   
          */
    -  184   +  179   
         private static HttpURLConnection getConnection(URL url) throws DownloadFailedException {
    -  185  0 
             HttpURLConnection conn = null;
    -  186  0 
             Proxy proxy = null;
    -  187  0 
             final String proxyUrl = Settings.getString(Settings.KEYS.PROXY_URL);
    -  188   +  180  0 
             HttpURLConnection conn = null;
    +  181  0 
             Proxy proxy = null;
    +  182  0 
             final String proxyUrl = Settings.getString(Settings.KEYS.PROXY_URL);
    +  183   
             try {
    -  189  0 
                 if (proxyUrl != null) {
    -  190  0 
                     final int proxyPort = Settings.getInt(Settings.KEYS.PROXY_PORT);
    -  191  0 
                     final SocketAddress addr = new InetSocketAddress(proxyUrl, proxyPort);
    +  184  0 
                 if (proxyUrl != null) {
    +  185  0 
                     final int proxyPort = Settings.getInt(Settings.KEYS.PROXY_PORT);
    +  186  0 
                     final SocketAddress addr = new InetSocketAddress(proxyUrl, proxyPort);
    +  187   + 
     
    +  188  0 
                     final String username = Settings.getString(Settings.KEYS.PROXY_USERNAME);
    +  189  0 
                     final String password = Settings.getString(Settings.KEYS.PROXY_PASSWORD);
    +  190  0 
                     if (username != null && password != null) {
    +  191  0 
                         final Authenticator auth = new Authenticator() {
     192   - 
     
    -  193  0 
                     final String username = Settings.getString(Settings.KEYS.PROXY_USERNAME);
    -  194  0 
                     final String password = Settings.getString(Settings.KEYS.PROXY_PASSWORD);
    -  195  0 
                     if (username != null && password != null) {
    -  196  0 
                         final Authenticator auth = new Authenticator() {
    -  197   
                             @Override
    -  198   +  193   
                             public PasswordAuthentication getPasswordAuthentication() {
    -  199  0 
                                 if (getRequestorType().equals(RequestorType.PROXY)) {
    -  200  0 
                                     return new PasswordAuthentication(username, password.toCharArray());
    -  201   +  194  0 
                                 if (getRequestorType().equals(RequestorType.PROXY)) {
    +  195  0 
                                     return new PasswordAuthentication(username, password.toCharArray());
    +  196   
                                 }
    -  202  0 
                                 return super.getPasswordAuthentication();
    -  203   +  197  0 
                                 return super.getPasswordAuthentication();
    +  198   
                             }
    -  204   +  199   
                         };
    -  205  0 
                         Authenticator.setDefault(auth);
    -  206   +  200  0 
                         Authenticator.setDefault(auth);
    +  201   
                     }
    -  207   +  202   
     
    -  208  0 
                     proxy = new Proxy(Proxy.Type.HTTP, addr);
    -  209  0 
                     conn = (HttpURLConnection) url.openConnection(proxy);
    -  210  0 
                 } else {
    -  211  0 
                     conn = (HttpURLConnection) url.openConnection();
    +  203  0 
                     proxy = new Proxy(Proxy.Type.HTTP, addr);
    +  204  0 
                     conn = (HttpURLConnection) url.openConnection(proxy);
    +  205  0 
                 } else {
    +  206  0 
                     conn = (HttpURLConnection) url.openConnection();
    +  207   + 
                 }
    +  208  0 
                 final int timeout = Settings.getInt(Settings.KEYS.CONNECTION_TIMEOUT, 60000);
    +  209  0 
                 conn.setConnectTimeout(timeout);
    +  210  0 
             } catch (IOException ex) {
    +  211  0 
                 if (conn != null) {
     212   - 
                 }
    -  213  0 
                 final int timeout = Settings.getInt(Settings.KEYS.CONNECTION_TIMEOUT, 60000);
    -  214  0 
                 conn.setConnectTimeout(timeout);
    -  215  0 
             } catch (IOException ex) {
    -  216  0 
                 if (conn != null) {
    -  217   
                     try {
    -  218  0 
                         conn.disconnect();
    -  219   +  213  0 
                         conn.disconnect();
    +  214   
                     } finally {
    -  220  0 
                         conn = null;
    -  221  0 
                     }
    -  222   +  215  0 
                         conn = null;
    +  216  0 
                     }
    +  217   
                 }
    -  223  0 
                 throw new DownloadFailedException("Error getting connection.", ex);
    -  224  0 
             }
    -  225  0 
             return conn;
    -  226   +  218  0 
                 throw new DownloadFailedException("Error getting connection.", ex);
    +  219  0 
             }
    +  220  0 
             return conn;
    +  221   
         }
    -  227   +  222   
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.ExtractionException.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.ExtractionException.html index 9c48df039..eec80e98c 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.ExtractionException.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.ExtractionException.html @@ -24,131 +24,129 @@  3   
      *
     4   - 
      * Dependency-check-core is free software: you can redistribute it and/or modify it
    + 
      * Licensed under the Apache License, Version 2.0 (the "License");
     5   - 
      * under the terms of the GNU General Public License as published by the Free
    + 
      * you may not use this file except in compliance with the License.
     6   - 
      * Software Foundation, either version 3 of the License, or (at your option) any
    + 
      * You may obtain a copy of the License at
     7   - 
      * later version.
    + 
      *
     8   - 
      *
    + 
      *     http://www.apache.org/licenses/LICENSE-2.0
     9   - 
      * Dependency-check-core is distributed in the hope that it will be useful, but
    + 
      *
     10   - 
      * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
    + 
      * Unless required by applicable law or agreed to in writing, software
     11   - 
      * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
    + 
      * distributed under the License is distributed on an "AS IS" BASIS,
     12   - 
      * details.
    + 
      * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13   - 
      *
    + 
      * See the License for the specific language governing permissions and
     14   - 
      * You should have received a copy of the GNU General Public License along with
    + 
      * limitations under the License.
     15   - 
      * dependency-check-core. If not, see http://www.gnu.org/licenses/.
    + 
      *
     16   - 
      *
    -  17   
      * Copyright (c) 2013 Jeremy Long. All Rights Reserved.
    +  17   + 
      */
     18   - 
      */
    -  19   
     package org.owasp.dependencycheck.utils;
    +  19   + 
     
     20   - 
     
    -  21   
     import java.io.IOException;
    +  21   + 
     
     22   - 
     
    -  23   
     /**
    -  24   +  23   
      * An exception used when a file is unable to be un-zipped.
    -  25   +  24   
      *
    -  26   +  25   
      * @author Jeremy Long <jeremy.long@owasp.org>
    -  27   +  26   
      */
    -  28   +  27   
     public class ExtractionException extends IOException {
    +  28   + 
     
     29   - 
     
    + 
         /**
     30   - 
         /**
    -  31   
          * The serial version UID.
    +  31   + 
          */
     32   - 
          */
    -  33   
         private static final long serialVersionUID = 1L;
    +  33   + 
     
     34   - 
     
    + 
         /**
     35   - 
         /**
    + 
          * Creates a new ExtractionException.
     36   - 
          * Creates a new ExtractionException.
    + 
          */
     37   - 
          */
    -  38   
         public ExtractionException() {
    -  39  0 
             super();
    -  40  0 
         }
    +  38  0 
             super();
    +  39  0 
         }
    +  40   + 
     
     41   - 
     
    + 
         /**
     42   - 
         /**
    + 
          * Creates a new ExtractionException.
     43   - 
          * Creates a new ExtractionException.
    + 
          *
     44   - 
          *
    + 
          * @param msg a message for the exception.
     45   - 
          * @param msg a message for the exception.
    + 
          */
     46   - 
          */
    -  47   
         public ExtractionException(String msg) {
    -  48  0 
             super(msg);
    -  49  0 
         }
    +  47  0 
             super(msg);
    +  48  0 
         }
    +  49   + 
     
     50   - 
     
    + 
         /**
     51   - 
         /**
    + 
          * Creates a new ExtractionException.
     52   - 
          * Creates a new ExtractionException.
    + 
          *
     53   - 
          *
    + 
          * @param ex the cause of the download failure.
     54   - 
          * @param ex the cause of the download failure.
    + 
          */
     55   - 
          */
    -  56   
         public ExtractionException(Throwable ex) {
    -  57  0 
             super(ex);
    -  58  0 
         }
    -  59   +  56  0 
             super(ex);
    +  57  0 
         }
    +  58   
     
    -  60   +  59   
         /**
    -  61   +  60   
          * Creates a new ExtractionException.
    -  62   +  61   
          *
    -  63   +  62   
          * @param msg a message for the exception.
    -  64   +  63   
          * @param ex the cause of the download failure.
    -  65   +  64   
          */
    -  66   +  65   
         public ExtractionException(String msg, Throwable ex) {
    -  67  0 
             super(msg, ex);
    -  68  0 
         }
    -  69   +  66  0 
             super(msg, ex);
    +  67  0 
         }
    +  68   
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.FileUtils.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.FileUtils.html index 00155a02c..1cbd3f952 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.FileUtils.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.FileUtils.html @@ -24,391 +24,371 @@  3   
      *
     4   - 
      * Dependency-check-core is free software: you can redistribute it and/or modify it
    + 
      * Licensed under the Apache License, Version 2.0 (the "License");
     5   - 
      * under the terms of the GNU General Public License as published by the Free
    + 
      * you may not use this file except in compliance with the License.
     6   - 
      * Software Foundation, either version 3 of the License, or (at your option) any
    + 
      * You may obtain a copy of the License at
     7   - 
      * later version.
    + 
      *
     8   - 
      *
    + 
      *     http://www.apache.org/licenses/LICENSE-2.0
     9   - 
      * Dependency-check-core is distributed in the hope that it will be useful, but
    + 
      *
     10   - 
      * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
    + 
      * Unless required by applicable law or agreed to in writing, software
     11   - 
      * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
    + 
      * distributed under the License is distributed on an "AS IS" BASIS,
     12   - 
      * details.
    + 
      * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13   - 
      *
    + 
      * See the License for the specific language governing permissions and
     14   - 
      * You should have received a copy of the GNU General Public License along with
    + 
      * limitations under the License.
     15   - 
      * dependency-check-core. If not, see http://www.gnu.org/licenses/.
    + 
      *
     16   - 
      *
    -  17   
      * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
    +  17   + 
      */
     18   - 
      */
    -  19   
     package org.owasp.dependencycheck.utils;
    +  19   + 
     
     20   - 
     
    -  21   
     import java.io.BufferedInputStream;
    -  22   +  21   
     import java.io.BufferedOutputStream;
    -  23   +  22   
     import java.io.File;
    -  24   +  23   
     import java.io.FileInputStream;
    -  25   +  24   
     import java.io.FileNotFoundException;
    -  26   +  25   
     import java.io.FileOutputStream;
    -  27   +  26   
     import java.io.IOException;
    -  28   +  27   
     import java.io.UnsupportedEncodingException;
    -  29   +  28   
     import java.net.URLDecoder;
    -  30   +  29   
     import java.util.logging.Level;
    -  31   +  30   
     import java.util.logging.Logger;
    -  32   +  31   
     import java.util.zip.ZipEntry;
    -  33   +  32   
     import java.util.zip.ZipInputStream;
    -  34   +  33   
     import org.owasp.dependencycheck.Engine;
    +  34   + 
     
     35   - 
     
    -  36   
     /**
    -  37   +  36   
      * A collection of utilities for processing information about files.
    -  38   +  37   
      *
    -  39   +  38   
      * @author Jeremy Long <jeremy.long@owasp.org>
    -  40   +  39   
      */
    -  41   +  40   
     public final class FileUtils {
    +  41   + 
     
     42   - 
     
    + 
         /**
     43   - 
         /**
    -  44   
          * The buffer size to use when extracting files from the archive.
    +  44   + 
          */
     45   - 
          */
    -  46   
         private static final int BUFFER_SIZE = 4096;
    +  46   + 
     
     47   - 
     
    + 
         /**
     48   - 
         /**
    -  49   
          * Private constructor for a utility class.
    -  50   +  49   
          */
    -  51  0 
         private FileUtils() {
    -  52  0 
         }
    +  50  0 
         private FileUtils() {
    +  51  0 
         }
    +  52   + 
     
     53   - 
     
    + 
         /**
     54   - 
         /**
    -  55   
          * Returns the (lowercase) file extension for a specified file.
    +  55   + 
          *
     56   - 
          *
    -  57   
          * @param fileName the file name to retrieve the file extension from.
    -  58   +  57   
          * @return the file extension.
    +  58   + 
          */
     59   - 
          */
    -  60   
         public static String getFileExtension(String fileName) {
    -  61  204 
             String ret = null;
    -  62  204 
             final int pos = fileName.lastIndexOf(".");
    -  63  204 
             if (pos >= 0) {
    -  64  196 
                 ret = fileName.substring(pos + 1, fileName.length()).toLowerCase();
    -  65   +  60  462 
             String ret = null;
    +  61  462 
             final int pos = fileName.lastIndexOf(".");
    +  62  462 
             if (pos >= 0) {
    +  63  446 
                 ret = fileName.substring(pos + 1, fileName.length()).toLowerCase();
    +  64   
             }
    -  66  204 
             return ret;
    +  65  462 
             return ret;
    +  66   + 
         }
     67   - 
         }
    + 
     
     68   - 
     
    + 
         /**
     69   - 
         /**
    + 
          * Deletes a file. If the File is a directory it will recursively delete the contents.
     70   - 
          * Deletes a file. If the File is a directory it will recursively delete the
    + 
          *
     71   - 
          * contents.
    -  72   - 
          *
    -  73   
          * @param file the File to delete
    -  74   +  72   
          * @throws IOException is thrown if the file could not be deleted
    -  75   +  73   
          */
    -  76   +  74   
         public static void delete(File file) throws IOException {
    -  77  1 
             if (file.isDirectory()) {
    -  78  0 
                 for (File c : file.listFiles()) {
    -  79  0 
                     delete(c);
    -  80   +  75  2 
             if (file.isDirectory()) {
    +  76  0 
                 for (File c : file.listFiles()) {
    +  77  0 
                     delete(c);
    +  78   
                 }
    -  81   +  79   
             }
    -  82  1 
             if (!org.apache.commons.io.FileUtils.deleteQuietly(file)) {
    -  83  0 
                 throw new FileNotFoundException("Failed to delete file: " + file);
    -  84   +  80  2 
             if (!org.apache.commons.io.FileUtils.deleteQuietly(file)) {
    +  81  0 
                 throw new FileNotFoundException("Failed to delete file: " + file);
    +  82   
             }
    -  85   +  83   
             /* else {
    -  86   +  84   
              //delete on exit was a bad idea. if for some reason the file can't be deleted
    -  87   +  85   
              // this will cause a newly constructed file to be deleted and a subsequent run may fail.
    -  88   +  86   
              // still not sure why a file fails to be deleted, but can be overwritten... odd.
    -  89   +  87   
              file.deleteOnExit();
    -  90   +  88   
              }*/
    -  91  1 
         }
    +  89  2 
         }
    +  90   + 
     
    +  91   + 
         /**
     92   - 
     
    + 
          * Returns the data directory. If a path was specified in dependencycheck.properties or was specified using the
     93   - 
         /**
    + 
          * Settings object, and the path exists, that path will be returned as a File object. If it does not exist, then a
     94   - 
          * Returns the data directory. If a path was specified in
    + 
          * File object will be created based on the file location of the JAR containing the specified class.
     95   - 
          * dependencycheck.properties or was specified using the Settings object,
    + 
          *
     96   - 
          * and the path exists, that path will be returned as a File object. If it
    -  97   - 
          * does not exist, then a File object will be created based on the file
    -  98   - 
          * location of the JAR containing the specified class.
    -  99   - 
          *
    -  100   
          * @param configuredFilePath the configured relative or absolute path
    -  101   +  97   
          * @param clazz the class to resolve the path
    -  102   +  98   
          * @return a File object
    -  103   +  99   
          * @throws IOException is thrown if the path could not be decoded
    +  100   + 
          * @deprecated This method should no longer be used. See the implementation in dependency-check-cli/App.java to see
    +  101   + 
          * how the data directory should be set.
    +  102   + 
          */
    +  103   + 
         @java.lang.Deprecated
     104   - 
          * @deprecated This method should no longer be used. See the implementation
    -  105   - 
          * in dependency-check-cli/App.java to see how the data directory should be
    -  106   - 
          * set.
    -  107   - 
          */
    -  108   - 
         @java.lang.Deprecated
    -  109   
         public static File getDataDirectory(String configuredFilePath, Class clazz) throws IOException {
    -  110  0 
             final File file = new File(configuredFilePath);
    -  111  0 
             if (file.isDirectory() && file.canWrite()) {
    -  112  0 
                 return new File(file.getCanonicalPath());
    -  113   +  105  0 
             final File file = new File(configuredFilePath);
    +  106  0 
             if (file.isDirectory() && file.canWrite()) {
    +  107  0 
                 return new File(file.getCanonicalPath());
    +  108   
             } else {
    -  114  0 
                 final File exePath = getPathToJar(clazz);
    -  115  0 
                 return new File(exePath, configuredFilePath);
    +  109  0 
                 final File exePath = getPathToJar(clazz);
    +  110  0 
                 return new File(exePath, configuredFilePath);
    +  111   + 
             }
    +  112   + 
         }
    +  113   + 
     
    +  114   + 
         /**
    +  115   + 
          * Retrieves the physical path to the parent directory containing the provided class. For example, if a JAR file
     116   - 
             }
    + 
          * contained a class org.something.clazz this method would return the parent directory of the JAR file.
     117   - 
         }
    + 
          *
     118   - 
     
    -  119   - 
         /**
    -  120   - 
          * Retrieves the physical path to the parent directory containing the
    -  121   - 
          * provided class. For example, if a JAR file contained a class
    -  122   - 
          * org.something.clazz this method would return the parent directory of the
    -  123   - 
          * JAR file.
    -  124   - 
          *
    -  125   
          * @param clazz the class to determine the parent directory of
    -  126   +  119   
          * @return the parent directory of the file containing the specified class.
    -  127   +  120   
          * @throws UnsupportedEncodingException thrown if UTF-8 is not supported.
    -  128   +  121   
          * @deprecated this should no longer be used.
    -  129   +  122   
          */
    -  130   +  123   
         @java.lang.Deprecated
    -  131   +  124   
         public static File getPathToJar(Class clazz) throws UnsupportedEncodingException {
    -  132  0 
             final String filePath = clazz.getProtectionDomain().getCodeSource().getLocation().getPath();
    -  133  0 
             final String decodedPath = URLDecoder.decode(filePath, "UTF-8");
    -  134  0 
             final File jarPath = new File(decodedPath);
    -  135  0 
             return jarPath.getParentFile();
    -  136   +  125  0 
             final String filePath = clazz.getProtectionDomain().getCodeSource().getLocation().getPath();
    +  126  0 
             final String decodedPath = URLDecoder.decode(filePath, "UTF-8");
    +  127  0 
             final File jarPath = new File(decodedPath);
    +  128  0 
             return jarPath.getParentFile();
    +  129   
         }
    -  137   +  130   
     
    -  138   +  131   
         /**
    -  139   +  132   
          * Extracts the contents of an archive into the specified directory.
    -  140   +  133   
          *
    -  141   +  134   
          * @param archive an archive file such as a WAR or EAR
    -  142   +  135   
          * @param extractTo a directory to extract the contents to
    -  143   - 
          * @throws ExtractionException thrown if an exception occurs while
    -  144   - 
          * extracting the files
    -  145   +  136   + 
          * @throws ExtractionException thrown if an exception occurs while extracting the files
    +  137   
          */
    -  146   +  138   
         public static void extractFiles(File archive, File extractTo) throws ExtractionException {
    -  147  0 
             extractFiles(archive, extractTo, null);
    -  148  0 
         }
    -  149   +  139  0 
             extractFiles(archive, extractTo, null);
    +  140  0 
         }
    +  141   
     
    -  150   +  142   
         /**
    -  151   - 
          * Extracts the contents of an archive into the specified directory. The
    -  152   - 
          * files are only extracted if they are supported by the analyzers loaded
    -  153   - 
          * into the specified engine. If the engine is specified as null then all
    -  154   - 
          * files are extracted.
    -  155   +  143   + 
          * Extracts the contents of an archive into the specified directory. The files are only extracted if they are
    +  144   + 
          * supported by the analyzers loaded into the specified engine. If the engine is specified as null then all files
    +  145   + 
          * are extracted.
    +  146   
          *
    -  156   +  147   
          * @param archive an archive file such as a WAR or EAR
    -  157   +  148   
          * @param extractTo a directory to extract the contents to
    -  158   +  149   
          * @param engine the scanning engine
    -  159   - 
          * @throws ExtractionException thrown if there is an error extracting the
    -  160   - 
          * files
    -  161   +  150   + 
          * @throws ExtractionException thrown if there is an error extracting the files
    +  151   
          */
    -  162   +  152   
         public static void extractFiles(File archive, File extractTo, Engine engine) throws ExtractionException {
    -  163  0 
             if (archive == null || extractTo == null) {
    -  164  0 
                 return;
    -  165   +  153  0 
             if (archive == null || extractTo == null) {
    +  154  0 
                 return;
    +  155   
             }
    -  166   +  156   
     
    -  167  0 
             FileInputStream fis = null;
    -  168  0 
             ZipInputStream zis = null;
    -  169   +  157  0 
             FileInputStream fis = null;
    +  158  0 
             ZipInputStream zis = null;
    +  159   
     
    -  170   +  160   
             try {
    -  171  0 
                 fis = new FileInputStream(archive);
    -  172  0 
             } catch (FileNotFoundException ex) {
    -  173  0 
                 Logger.getLogger(FileUtils.class.getName()).log(Level.INFO, null, ex);
    -  174  0 
                 throw new ExtractionException("Archive file was not found.", ex);
    -  175  0 
             }
    -  176  0 
             zis = new ZipInputStream(new BufferedInputStream(fis));
    -  177   +  161  0 
                 fis = new FileInputStream(archive);
    +  162  0 
             } catch (FileNotFoundException ex) {
    +  163  0 
                 Logger.getLogger(FileUtils.class.getName()).log(Level.INFO, null, ex);
    +  164  0 
                 throw new ExtractionException("Archive file was not found.", ex);
    +  165  0 
             }
    +  166  0 
             zis = new ZipInputStream(new BufferedInputStream(fis));
    +  167   
             ZipEntry entry;
    -  178   +  168   
             try {
    -  179  0 
                 while ((entry = zis.getNextEntry()) != null) {
    -  180  0 
                     if (entry.isDirectory()) {
    -  181  0 
                         final File d = new File(extractTo, entry.getName());
    -  182  0 
                         if (!d.exists() && !d.mkdirs()) {
    -  183  0 
                             final String msg = String.format("Unable to create '%s'.", d.getAbsolutePath());
    -  184  0 
                             throw new ExtractionException(msg);
    -  185   +  169  0 
                 while ((entry = zis.getNextEntry()) != null) {
    +  170  0 
                     if (entry.isDirectory()) {
    +  171  0 
                         final File d = new File(extractTo, entry.getName());
    +  172  0 
                         if (!d.exists() && !d.mkdirs()) {
    +  173  0 
                             final String msg = String.format("Unable to create '%s'.", d.getAbsolutePath());
    +  174  0 
                             throw new ExtractionException(msg);
    +  175   
                         }
    -  186  0 
                     } else {
    -  187  0 
                         final File file = new File(extractTo, entry.getName());
    -  188  0 
                         final String ext = getFileExtension(file.getName());
    -  189  0 
                         if (engine == null || engine.supportsExtension(ext)) {
    -  190  0 
                             BufferedOutputStream bos = null;
    -  191   +  176  0 
                     } else {
    +  177  0 
                         final File file = new File(extractTo, entry.getName());
    +  178  0 
                         final String ext = getFileExtension(file.getName());
    +  179  0 
                         if (engine == null || engine.supportsExtension(ext)) {
    +  180  0 
                             BufferedOutputStream bos = null;
    +  181   
                             FileOutputStream fos;
    -  192   +  182   
                             try {
    -  193  0 
                                 fos = new FileOutputStream(file);
    -  194  0 
                                 bos = new BufferedOutputStream(fos, BUFFER_SIZE);
    -  195   +  183  0 
                                 fos = new FileOutputStream(file);
    +  184  0 
                                 bos = new BufferedOutputStream(fos, BUFFER_SIZE);
    +  185   
                                 int count;
    -  196  0 
                                 final byte data[] = new byte[BUFFER_SIZE];
    -  197  0 
                                 while ((count = zis.read(data, 0, BUFFER_SIZE)) != -1) {
    -  198  0 
                                     bos.write(data, 0, count);
    +  186  0 
                                 final byte data[] = new byte[BUFFER_SIZE];
    +  187  0 
                                 while ((count = zis.read(data, 0, BUFFER_SIZE)) != -1) {
    +  188  0 
                                     bos.write(data, 0, count);
    +  189   + 
                                 }
    +  190  0 
                                 bos.flush();
    +  191  0 
                             } catch (FileNotFoundException ex) {
    +  192  0 
                                 Logger.getLogger(FileUtils.class.getName()).log(Level.FINE, null, ex);
    +  193  0 
                                 final String msg = String.format("Unable to find file '%s'.", file.getName());
    +  194  0 
                                 throw new ExtractionException(msg, ex);
    +  195  0 
                             } catch (IOException ex) {
    +  196  0 
                                 Logger.getLogger(FileUtils.class.getName()).log(Level.FINE, null, ex);
    +  197  0 
                                 final String msg = String.format("IO Exception while parsing file '%s'.", file.getName());
    +  198  0 
                                 throw new ExtractionException(msg, ex);
     199   - 
                                 }
    -  200  0 
                                 bos.flush();
    -  201  0 
                             } catch (FileNotFoundException ex) {
    -  202  0 
                                 Logger.getLogger(FileUtils.class.getName()).log(Level.FINE, null, ex);
    -  203  0 
                                 final String msg = String.format("Unable to find file '%s'.", file.getName());
    -  204  0 
                                 throw new ExtractionException(msg, ex);
    -  205  0 
                             } catch (IOException ex) {
    -  206  0 
                                 Logger.getLogger(FileUtils.class.getName()).log(Level.FINE, null, ex);
    -  207  0 
                                 final String msg = String.format("IO Exception while parsing file '%s'.", file.getName());
    -  208  0 
                                 throw new ExtractionException(msg, ex);
    -  209   
                             } finally {
    -  210  0 
                                 if (bos != null) {
    -  211   +  200  0 
                                 if (bos != null) {
    +  201   
                                     try {
    -  212  0 
                                         bos.close();
    -  213  0 
                                     } catch (IOException ex) {
    -  214  0 
                                         Logger.getLogger(FileUtils.class.getName()).log(Level.FINEST, null, ex);
    -  215  0 
                                     }
    -  216   +  202  0 
                                         bos.close();
    +  203  0 
                                     } catch (IOException ex) {
    +  204  0 
                                         Logger.getLogger(FileUtils.class.getName()).log(Level.FINEST, null, ex);
    +  205  0 
                                     }
    +  206   
                                 }
    -  217   +  207   
                             }
    -  218   +  208   
                         }
    -  219  0 
                     }
    -  220   +  209  0 
                     }
    +  210   
                 }
    -  221  0 
             } catch (IOException ex) {
    -  222  0 
                 final String msg = String.format("Exception reading archive '%s'.", archive.getName());
    -  223  0 
                 Logger.getLogger(FileUtils.class.getName()).log(Level.FINE, msg, ex);
    -  224  0 
                 throw new ExtractionException(msg, ex);
    -  225   +  211  0 
             } catch (IOException ex) {
    +  212  0 
                 final String msg = String.format("Exception reading archive '%s'.", archive.getName());
    +  213  0 
                 Logger.getLogger(FileUtils.class.getName()).log(Level.FINE, msg, ex);
    +  214  0 
                 throw new ExtractionException(msg, ex);
    +  215   
             } finally {
    -  226  0 
                 try {
    -  227  0 
                     zis.close();
    -  228  0 
                 } catch (IOException ex) {
    -  229  0 
                     Logger.getLogger(FileUtils.class.getName()).log(Level.FINEST, null, ex);
    -  230  0 
                 }
    -  231  0 
             }
    -  232  0 
         }
    -  233   +  216  0 
                 try {
    +  217  0 
                     zis.close();
    +  218  0 
                 } catch (IOException ex) {
    +  219  0 
                     Logger.getLogger(FileUtils.class.getName()).log(Level.FINEST, null, ex);
    +  220  0 
                 }
    +  221  0 
             }
    +  222  0 
         }
    +  223   
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.Filter.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.Filter.html index 85ac0f775..bdcbeed5c 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.Filter.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.Filter.html @@ -47,7 +47,7 @@ 
      * https://plus.google.com/115403795880834599019/?rel=author
     14   
      */
    -  15  6 
     public abstract class Filter<T> {
    +  15  12 
     public abstract class Filter<T> {
     16   
     
     17   @@ -56,19 +56,19 @@ 
     
     19   
         public Iterator<T> filter(Iterator<T> iterator) {
    -  20  1949 
             return new FilterIterator(iterator);
    +  20  3914 
             return new FilterIterator(iterator);
     21   
         }
     22   
     
     23   
         public Iterable<T> filter(final Iterable<T> iterable) {
    -  24  1949 
             return new Iterable<T>() {
    +  24  3914 
             return new Iterable<T>() {
     25   
     
     26   
                 public Iterator<T> iterator() {
    -  27  1949 
                     return filter(iterable.iterator());
    +  27  3914 
                     return filter(iterable.iterator());
     28   
                 }
     29   @@ -77,7 +77,7 @@ 
         }
     31   
     
    -  32  6 
         private class FilterIterator implements Iterator<T> {
    +  32  12 
         private class FilterIterator implements Iterator<T> {
     33   
     
     34   @@ -86,28 +86,28 @@ 
             private T next;
     36   
     
    -  37  1949 
             private FilterIterator(Iterator<T> iterator) {
    -  38  1949 
                 this.iterator = iterator;
    -  39  1949 
                 toNext();
    -  40  1949 
             }
    +  37  3914 
             private FilterIterator(Iterator<T> iterator) {
    +  38  3914 
                 this.iterator = iterator;
    +  39  3914 
                 toNext();
    +  40  3914 
             }
     41   
     
     42   
             public boolean hasNext() {
    -  43  8194 
                 return next != null;
    +  43  17108 
                 return next != null;
     44   
             }
     45   
     
     46   
             public T next() {
    -  47  6755 
                 if (next == null) {
    +  47  14210 
                 if (next == null) {
     48  0 
                     throw new NoSuchElementException();
     49   
                 }
    -  50  6755 
                 T returnValue = next;
    -  51  6755 
                 toNext();
    -  52  6755 
                 return returnValue;
    +  50  14210 
                 T returnValue = next;
    +  51  14210 
                 toNext();
    +  52  14210 
                 return returnValue;
     53   
             }
     54   @@ -121,22 +121,22 @@ 
     
     59   
             private void toNext() {
    -  60  8704 
                 next = null;
    -  61  12980 
                 while (iterator.hasNext()) {
    -  62  11427 
                     T item = iterator.next();
    -  63  11427 
                     if (item != null && passes(item)) {
    -  64  7151 
                         next = item;
    -  65  7151 
                         break;
    +  60  18124 
                 next = null;
    +  61  27110 
                 while (iterator.hasNext()) {
    +  62  23984 
                     T item = iterator.next();
    +  63  23984 
                     if (item != null && passes(item)) {
    +  64  14998 
                         next = item;
    +  65  14998 
                         break;
     66   
                     }
    -  67  4276 
                 }
    -  68  8704 
             }
    +  67  8986 
                 }
    +  68  18124 
             }
     69   
         }
     70   
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.InvalidSettingException.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.InvalidSettingException.html index 9a90d4607..6df620a96 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.InvalidSettingException.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.InvalidSettingException.html @@ -24,131 +24,129 @@  3   
      *
     4   - 
      * Dependency-check-core is free software: you can redistribute it and/or modify it
    + 
      * Licensed under the Apache License, Version 2.0 (the "License");
     5   - 
      * under the terms of the GNU General Public License as published by the Free
    + 
      * you may not use this file except in compliance with the License.
     6   - 
      * Software Foundation, either version 3 of the License, or (at your option) any
    + 
      * You may obtain a copy of the License at
     7   - 
      * later version.
    + 
      *
     8   - 
      *
    + 
      *     http://www.apache.org/licenses/LICENSE-2.0
     9   - 
      * Dependency-check-core is distributed in the hope that it will be useful, but
    + 
      *
     10   - 
      * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
    + 
      * Unless required by applicable law or agreed to in writing, software
     11   - 
      * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
    + 
      * distributed under the License is distributed on an "AS IS" BASIS,
     12   - 
      * details.
    + 
      * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13   - 
      *
    + 
      * See the License for the specific language governing permissions and
     14   - 
      * You should have received a copy of the GNU General Public License along with
    + 
      * limitations under the License.
     15   - 
      * dependency-check-core. If not, see http://www.gnu.org/licenses/.
    + 
      *
     16   - 
      *
    -  17   
      * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
    +  17   + 
      */
     18   - 
      */
    -  19   
     package org.owasp.dependencycheck.utils;
    +  19   + 
     
     20   - 
     
    -  21   
     import java.io.IOException;
    +  21   + 
     
     22   - 
     
    -  23   
     /**
    -  24   +  23   
      * An exception used when an error occurs reading a setting.
    -  25   +  24   
      *
    -  26   +  25   
      * @author Jeremy Long <jeremy.long@owasp.org>
    -  27   +  26   
      */
    -  28   +  27   
     public class InvalidSettingException extends IOException {
    +  28   + 
     
     29   - 
     
    + 
         /**
     30   - 
         /**
    -  31   
          * The serial version UID.
    +  31   + 
          */
     32   - 
          */
    -  33   
         private static final long serialVersionUID = 1L;
    +  33   + 
     
     34   - 
     
    + 
         /**
     35   - 
         /**
    + 
          * Creates a new InvalidSettingException.
     36   - 
          * Creates a new InvalidSettingException.
    + 
          */
     37   - 
          */
    -  38   
         public InvalidSettingException() {
    -  39  0 
             super();
    -  40  0 
         }
    +  38  0 
             super();
    +  39  0 
         }
    +  40   + 
     
     41   - 
     
    + 
         /**
     42   - 
         /**
    + 
          * Creates a new InvalidSettingException.
     43   - 
          * Creates a new InvalidSettingException.
    + 
          *
     44   - 
          *
    + 
          * @param msg a message for the exception.
     45   - 
          * @param msg a message for the exception.
    + 
          */
     46   - 
          */
    -  47   
         public InvalidSettingException(String msg) {
    -  48  0 
             super(msg);
    -  49  0 
         }
    +  47  0 
             super(msg);
    +  48  0 
         }
    +  49   + 
     
     50   - 
     
    + 
         /**
     51   - 
         /**
    + 
          * Creates a new InvalidSettingException.
     52   - 
          * Creates a new InvalidSettingException.
    + 
          *
     53   - 
          *
    + 
          * @param ex the cause of the setting exception.
     54   - 
          * @param ex the cause of the setting exception.
    + 
          */
     55   - 
          */
    -  56   
         public InvalidSettingException(Throwable ex) {
    -  57  0 
             super(ex);
    -  58  0 
         }
    -  59   +  56  0 
             super(ex);
    +  57  0 
         }
    +  58   
     
    -  60   +  59   
         /**
    -  61   +  60   
          * Creates a new InvalidSettingException.
    -  62   +  61   
          *
    -  63   +  62   
          * @param msg a message for the exception.
    -  64   +  63   
          * @param ex the cause of the setting exception.
    -  65   +  64   
          */
    -  66   +  65   
         public InvalidSettingException(String msg, Throwable ex) {
    -  67  0 
             super(msg, ex);
    -  68  0 
         }
    -  69   +  66  0 
             super(msg, ex);
    +  67  0 
         }
    +  68   
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.LogFilter.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.LogFilter.html index b28db3dba..c8906c6b1 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.LogFilter.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.LogFilter.html @@ -24,86 +24,82 @@  3   
      *
     4   - 
      * Dependency-check-core is free software: you can redistribute it and/or modify it
    + 
      * Licensed under the Apache License, Version 2.0 (the "License");
     5   - 
      * under the terms of the GNU General Public License as published by the Free
    + 
      * you may not use this file except in compliance with the License.
     6   - 
      * Software Foundation, either version 3 of the License, or (at your option) any
    + 
      * You may obtain a copy of the License at
     7   - 
      * later version.
    + 
      *
     8   - 
      *
    + 
      *     http://www.apache.org/licenses/LICENSE-2.0
     9   - 
      * Dependency-check-core is distributed in the hope that it will be useful, but
    + 
      *
     10   - 
      * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
    + 
      * Unless required by applicable law or agreed to in writing, software
     11   - 
      * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
    + 
      * distributed under the License is distributed on an "AS IS" BASIS,
     12   - 
      * details.
    + 
      * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13   - 
      *
    + 
      * See the License for the specific language governing permissions and
     14   - 
      * You should have received a copy of the GNU General Public License along with
    + 
      * limitations under the License.
     15   - 
      * dependency-check-core. If not, see http://www.gnu.org/licenses/.
    + 
      *
     16   - 
      *
    -  17   
      * Copyright (c) 2013 Jeremy Long. All Rights Reserved.
    +  17   + 
      */
     18   - 
      */
    -  19   
     package org.owasp.dependencycheck.utils;
    +  19   + 
     
     20   - 
     
    -  21   
     import java.util.logging.Filter;
    -  22   +  21   
     import java.util.logging.LogRecord;
    +  22   + 
     
     23   - 
     
    -  24   
     /**
    +  24   + 
      * A simple log filter to limit the entries written to the verbose log file. The verbose log file uses the root logger
     25   - 
      * A simple log filter to limit the entries written to the verbose log file. The
    + 
      * as I couldn't get anything else to work; as such, this filter limits the log entries to specific classes.
     26   - 
      * verbose log file uses the root logger as I couldn't get anything else to
    -  27   - 
      * work; as such, this filter limits the log entries to specific classes.
    -  28   
      *
    -  29   +  27   
      * @author Jeremy Long <jeremy.long@owasp.org>
    -  30   +  28   
      */
    -  31  0 
     public class LogFilter implements Filter {
    -  32   +  29  0 
     public class LogFilter implements Filter {
    +  30   
     
    -  33   +  31   
         /**
    -  34   +  32   
          * Determines if the record should be logged.
    -  35   +  33   
          *
    -  36   +  34   
          * @param record a log record to examine
    -  37   +  35   
          * @return true if the record should be logged, otherwise false
    -  38   +  36   
          */
    -  39   +  37   
         @Override
    -  40   +  38   
         public boolean isLoggable(LogRecord record) {
    -  41  0 
             final String name = record.getSourceClassName();
    -  42  0 
             return name.startsWith("org.owasp.dependencycheck") && !name.contains("generated") && !name.contains("VelocityLoggerRedirect");
    -  43   +  39  0 
             final String name = record.getSourceClassName();
    +  40  0 
             return name.startsWith("org.owasp.dependencycheck") && !name.contains("generated") && !name.contains("VelocityLoggerRedirect");
    +  41   
         }
    -  44   +  42   
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.LogUtils.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.LogUtils.html index 6fefb168a..2192ecdd1 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.LogUtils.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.LogUtils.html @@ -24,154 +24,152 @@  3   
      *
     4   - 
      * Dependency-check-core is free software: you can redistribute it and/or modify it
    + 
      * Licensed under the Apache License, Version 2.0 (the "License");
     5   - 
      * under the terms of the GNU General Public License as published by the Free
    + 
      * you may not use this file except in compliance with the License.
     6   - 
      * Software Foundation, either version 3 of the License, or (at your option) any
    + 
      * You may obtain a copy of the License at
     7   - 
      * later version.
    + 
      *
     8   - 
      *
    + 
      *     http://www.apache.org/licenses/LICENSE-2.0
     9   - 
      * Dependency-check-core is distributed in the hope that it will be useful, but
    + 
      *
     10   - 
      * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
    + 
      * Unless required by applicable law or agreed to in writing, software
     11   - 
      * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
    + 
      * distributed under the License is distributed on an "AS IS" BASIS,
     12   - 
      * details.
    + 
      * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13   - 
      *
    + 
      * See the License for the specific language governing permissions and
     14   - 
      * You should have received a copy of the GNU General Public License along with
    + 
      * limitations under the License.
     15   - 
      * dependency-check-core. If not, see http://www.gnu.org/licenses/.
    + 
      *
     16   - 
      *
    -  17   
      * Copyright (c) 2013 Jeremy Long. All Rights Reserved.
    +  17   + 
      */
     18   - 
      */
    -  19   
     package org.owasp.dependencycheck.utils;
    +  19   + 
     
     20   - 
     
    -  21   
     import java.io.IOException;
    -  22   +  21   
     import java.io.InputStream;
    -  23   +  22   
     import java.util.logging.FileHandler;
    -  24   +  23   
     import java.util.logging.Level;
    -  25   +  24   
     import java.util.logging.LogManager;
    -  26   +  25   
     import java.util.logging.Logger;
    -  27   +  26   
     import java.util.logging.SimpleFormatter;
    +  27   + 
     
     28   - 
     
    -  29   
     /**
    -  30   +  29   
      * A utility class to aide in the setup of the logging mechanism.
    -  31   +  30   
      *
    -  32   +  31   
      * @author Jeremy Long <jeremy.long@owasp.org>
    -  33   +  32   
      */
    -  34   +  33   
     public final class LogUtils {
    +  34   + 
     
     35   - 
     
    + 
         /**
     36   - 
         /**
    -  37   
          * Private constructor for a utility class.
    -  38   +  37   
          */
    -  39  0 
         private LogUtils() {
    -  40  0 
         }
    +  38  0 
         private LogUtils() {
    +  39  0 
         }
    +  40   + 
     
     41   - 
     
    + 
         /**
     42   - 
         /**
    -  43   
          * Configures the logger for use by the application.
    +  43   + 
          *
     44   - 
          *
    -  45   
          * @param in the input stream to read the log settings from
    -  46   +  45   
          * @param verboseLogFile the file path for the verbose log
    +  46   + 
          */
     47   - 
          */
    -  48   
         public static void prepareLogger(InputStream in, String verboseLogFile) {
    -  49   +  48   
             try {
    -  50  0 
                 LogManager.getLogManager().reset();
    -  51  0 
                 LogManager.getLogManager().readConfiguration(in);
    -  52  0 
                 if (verboseLogFile != null && !verboseLogFile.isEmpty()) {
    -  53  0 
                     verboseLoggingEnabled = true;
    -  54  0 
                     final Logger logger = Logger.getLogger("");
    -  55  0 
                     final FileHandler handler = new FileHandler(verboseLogFile, true);
    -  56  0 
                     handler.setFormatter(new SimpleFormatter());
    -  57  0 
                     handler.setLevel(Level.FINE);
    -  58  0 
                     handler.setFilter(new LogFilter());
    -  59  0 
                     logger.addHandler(handler);
    -  60  0 
                     logger.setLevel(Level.FINE);
    -  61   +  49  0 
                 LogManager.getLogManager().reset();
    +  50  0 
                 LogManager.getLogManager().readConfiguration(in);
    +  51  0 
                 if (verboseLogFile != null && !verboseLogFile.isEmpty()) {
    +  52  0 
                     verboseLoggingEnabled = true;
    +  53  0 
                     final Logger logger = Logger.getLogger("");
    +  54  0 
                     final FileHandler handler = new FileHandler(verboseLogFile, true);
    +  55  0 
                     handler.setFormatter(new SimpleFormatter());
    +  56  0 
                     handler.setLevel(Level.FINE);
    +  57  0 
                     handler.setFilter(new LogFilter());
    +  58  0 
                     logger.addHandler(handler);
    +  59  0 
                     logger.setLevel(Level.FINE);
    +  60   
                 }
    -  62  0 
             } catch (IOException ex) {
    -  63  0 
                 Logger.getLogger(LogUtils.class.getName()).log(Level.FINE, "IO Error preparing the logger", ex);
    -  64  0 
             } catch (SecurityException ex) {
    -  65  0 
                 Logger.getLogger(LogUtils.class.getName()).log(Level.FINE, "Error preparing the logger", ex);
    -  66   +  61  0 
             } catch (IOException ex) {
    +  62  0 
                 Logger.getLogger(LogUtils.class.getName()).log(Level.FINE, "IO Error preparing the logger", ex);
    +  63  0 
             } catch (SecurityException ex) {
    +  64  0 
                 Logger.getLogger(LogUtils.class.getName()).log(Level.FINE, "Error preparing the logger", ex);
    +  65   
             } finally {
    -  67  0 
                 if (in != null) {
    -  68   +  66  0 
                 if (in != null) {
    +  67   
                     try {
    -  69  0 
                         in.close();
    -  70  0 
                     } catch (Exception ex) {
    -  71  0 
                         Logger.getLogger(LogUtils.class.getName()).log(Level.FINEST, "Error closing resource stream", ex);
    -  72  0 
                     }
    -  73   +  68  0 
                         in.close();
    +  69  0 
                     } catch (Exception ex) {
    +  70  0 
                         Logger.getLogger(LogUtils.class.getName()).log(Level.FINEST, "Error closing resource stream", ex);
    +  71  0 
                     }
    +  72   
                 }
    -  74   +  73   
             }
    -  75  0 
         }
    +  74  0 
         }
    +  75   + 
         /**
     76   - 
         /**
    -  77   
          * Whether or not verbose logging is enabled.
    -  78   +  77   
          */
    -  79  1 
         private static boolean verboseLoggingEnabled = false;
    -  80   +  78  2 
         private static boolean verboseLoggingEnabled = false;
    +  79   
     
    -  81   +  80   
         /**
    -  82   +  81   
          * Get the value of verboseLoggingEnabled.
    -  83   +  82   
          *
    -  84   +  83   
          * @return the value of verboseLoggingEnabled
    -  85   +  84   
          */
    -  86   +  85   
         public static boolean isVerboseLoggingEnabled() {
    -  87  3 
             return verboseLoggingEnabled;
    -  88   +  86  10 
             return verboseLoggingEnabled;
    +  87   
         }
    -  89   +  88   
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.NonClosingStream.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.NonClosingStream.html index bbef291a1..375066a9a 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.NonClosingStream.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.NonClosingStream.html @@ -24,96 +24,92 @@  3   
      *
     4   - 
      * Dependency-check-core is free software: you can redistribute it and/or modify it
    + 
      * Licensed under the Apache License, Version 2.0 (the "License");
     5   - 
      * under the terms of the GNU General Public License as published by the Free
    + 
      * you may not use this file except in compliance with the License.
     6   - 
      * Software Foundation, either version 3 of the License, or (at your option) any
    + 
      * You may obtain a copy of the License at
     7   - 
      * later version.
    + 
      *
     8   - 
      *
    + 
      *     http://www.apache.org/licenses/LICENSE-2.0
     9   - 
      * Dependency-check-core is distributed in the hope that it will be useful, but
    + 
      *
     10   - 
      * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
    + 
      * Unless required by applicable law or agreed to in writing, software
     11   - 
      * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
    + 
      * distributed under the License is distributed on an "AS IS" BASIS,
     12   - 
      * details.
    + 
      * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13   - 
      *
    + 
      * See the License for the specific language governing permissions and
     14   - 
      * You should have received a copy of the GNU General Public License along with
    + 
      * limitations under the License.
     15   - 
      * dependency-check-core. If not, see http://www.gnu.org/licenses/.
    + 
      *
     16   - 
      *
    -  17   
      * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
    +  17   + 
      */
     18   - 
      */
    -  19   
     package org.owasp.dependencycheck.utils;
    +  19   + 
     
     20   - 
     
    -  21   
     import java.io.FilterInputStream;
    -  22   +  21   
     import java.io.InputStream;
    +  22   + 
     
     23   - 
     
    -  24   
     /**
    +  24   + 
      * NonClosingStream is a stream filter which prevents another class that processes the stream from closing it. This is
     25   - 
      * NonClosingStream is a stream filter which prevents another class that
    + 
      * necessary when dealing with things like JAXB and zipInputStreams.
     26   - 
      * processes the stream from closing it. This is necessary when dealing with
    -  27   - 
      * things like JAXB and zipInputStreams.
    -  28   
      *
    -  29   +  27   
      * @author Jeremy Long <jeremy.long@owasp.org>
    -  30   +  28   
      */
    -  31   +  29   
     public class NonClosingStream extends FilterInputStream {
    +  30   + 
     
    +  31   + 
         /**
     32   - 
     
    -  33   - 
         /**
    -  34   
          * Constructs a new NonClosingStream.
    -  35   +  33   
          *
    -  36   +  34   
          * @param in an input stream.
    -  37   +  35   
          */
    -  38   +  36   
         public NonClosingStream(InputStream in) {
    -  39  7 
             super(in);
    -  40  7 
         }
    -  41   +  37  14 
             super(in);
    +  38  14 
         }
    +  39   
     
    -  42   +  40   
         /**
    -  43   +  41   
          * Prevents closing of the stream.
    -  44   +  42   
          */
    -  45   +  43   
         @Override
    -  46   +  44   
         public void close() {
    -  47   +  45   
             // don't close the stream.
    -  48  7 
         }
    -  49   +  46  14 
         }
    +  47   
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.Settings.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.Settings.html index ea0e458b4..09be3880f 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.Settings.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.Settings.html @@ -12,7 +12,7 @@
     
    - +
    Classes in this File Line Coverage Branch Coverage Complexity
    Settings
    61%
    49/80
    41%
    5/12
    		2.111
    Settings
    59%
    50/84
    41%
    5/12
    		2.111
    Settings$KEYS
    0%
    0/2
    N/A
    N/A
    		2.111
    @@ -25,511 +25,507 @@  3   
      *
     4   - 
      * Dependency-check-core is free software: you can redistribute it and/or modify it
    + 
      * Licensed under the Apache License, Version 2.0 (the "License");
     5   - 
      * under the terms of the GNU General Public License as published by the Free
    + 
      * you may not use this file except in compliance with the License.
     6   - 
      * Software Foundation, either version 3 of the License, or (at your option) any
    + 
      * You may obtain a copy of the License at
     7   - 
      * later version.
    + 
      *
     8   - 
      *
    + 
      *     http://www.apache.org/licenses/LICENSE-2.0
     9   - 
      * Dependency-check-core is distributed in the hope that it will be useful, but
    + 
      *
     10   - 
      * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
    + 
      * Unless required by applicable law or agreed to in writing, software
     11   - 
      * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
    + 
      * distributed under the License is distributed on an "AS IS" BASIS,
     12   - 
      * details.
    + 
      * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13   - 
      *
    + 
      * See the License for the specific language governing permissions and
     14   - 
      * You should have received a copy of the GNU General Public License along with
    + 
      * limitations under the License.
     15   - 
      * dependency-check-core. If not, see http://www.gnu.org/licenses/.
    + 
      *
     16   - 
      *
    -  17   
      * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
    +  17   + 
      */
     18   - 
      */
    -  19   
     package org.owasp.dependencycheck.utils;
    +  19   + 
     
     20   - 
     
    -  21   
     import java.io.File;
    -  22   +  21   
     import java.io.FileInputStream;
    -  23   +  22   
     import java.io.FileNotFoundException;
    -  24   +  23   
     import java.io.IOException;
    -  25   +  24   
     import java.io.InputStream;
    -  26   +  25   
     import java.io.UnsupportedEncodingException;
    -  27   +  26   
     import java.net.URLDecoder;
    -  28   +  27   
     import java.util.Properties;
    -  29   +  28   
     import java.util.logging.Level;
    -  30   +  29   
     import java.util.logging.Logger;
    +  30   + 
     
     31   - 
     
    -  32   
     /**
    -  33   +  32   
      * A simple settings container that wraps the dependencycheck.properties file.
    -  34   +  33   
      *
    -  35   +  34   
      * @author Jeremy Long <jeremy.long@owasp.org>
    -  36   +  35   
      */
    -  37   +  36   
     public final class Settings {
    +  37   + 
     
     38   - 
     
    -  39   
         /**
    -  40   +  39   
          * The collection of keys used within the properties file.
    -  41   +  40   
          */
    -  42   +  41   
         public static final class KEYS {
    -  43   +  42   
     
    +  43   + 
             /**
     44   - 
             /**
    + 
              * private constructor because this is a "utility" class containing constants
     45   - 
              * private constructor because this is a "utility" class containing
    -  46   - 
              * constants
    + 
              */
    +  46  0 
             private KEYS() {
     47   - 
              */
    -  48  0 
             private KEYS() {
    -  49   
                 //do nothing
    -  50  0 
             }
    +  48  0 
             }
    +  49   + 
             /**
    +  50   + 
              * The properties key indicating whether or not the cached data sources should be updated.
     51   - 
             /**
    -  52   - 
              * The properties key indicating whether or not the cached data sources
    -  53   - 
              * should be updated.
    -  54   
              */
    -  55   +  52   
             public static final String AUTO_UPDATE = "autoupdate";
    -  56   +  53   
             /**
    +  54   + 
              * The database driver class name. If this is not in the properties file the embedded database is used.
    +  55   + 
              */
    +  56   + 
             public static final String DB_DRIVER_NAME = "data.driver_name";
     57   - 
              * The database driver class name. If this is not in the properties file
    + 
             /**
     58   - 
              * the embedded database is used.
    + 
              * The database driver class name. If this is not in the properties file the embedded database is used.
     59   
              */
     60   - 
             public static final String DB_DRIVER_NAME = "data.driver_name";
    + 
             public static final String DB_DRIVER_PATH = "data.driver_path";
     61   
             /**
     62   - 
              * The database driver class name. If this is not in the properties file
    + 
              * The database connection string. If this is not in the properties file the embedded database is used.
     63   - 
              * the embedded database is used.
    + 
              */
     64   - 
              */
    -  65   - 
             public static final String DB_DRIVER_PATH = "data.driver_path";
    -  66   - 
             /**
    -  67   - 
              * The database connection string. If this is not in the properties file
    -  68   - 
              * the embedded database is used.
    -  69   - 
              */
    -  70   
             public static final String DB_CONNECTION_STRING = "data.connection_string";
    -  71   +  65   
             /**
    -  72   +  66   
              * The username to use when connecting to the database.
    -  73   +  67   
              */
    -  74   +  68   
             public static final String DB_USER = "data.user";
    -  75   +  69   
             /**
    -  76   +  70   
              * The password to authenticate to the database.
    -  77   +  71   
              */
    -  78   +  72   
             public static final String DB_PASSWORD = "data.password";
    -  79   +  73   
             /**
    -  80   +  74   
              * The base path to use for the data directory (for embedded db).
    -  81   +  75   
              */
    -  82   +  76   
             public static final String DATA_DIRECTORY = "data.directory";
    -  83   +  77   
             /**
    -  84   - 
              * The properties key for the URL to retrieve the "meta" data from about
    -  85   - 
              * the CVE entries.
    -  86   +  78   + 
              * The properties key for the URL to retrieve the "meta" data from about the CVE entries.
    +  79   
              */
    -  87   +  80   
             public static final String CVE_META_URL = "cve.url.meta";
    -  88   +  81   
             /**
    -  89   - 
              * The properties key for the URL to retrieve the recently modified and
    -  90   - 
              * added CVE entries (last 8 days) using the 2.0 schema.
    -  91   +  82   + 
              * The properties key for the URL to retrieve the recently modified and added CVE entries (last 8 days) using
    +  83   + 
              * the 2.0 schema.
    +  84   
              */
    -  92   +  85   
             public static final String CVE_MODIFIED_20_URL = "cve.url-2.0.modified";
    -  93   +  86   
             /**
    -  94   - 
              * The properties key for the URL to retrieve the recently modified and
    -  95   - 
              * added CVE entries (last 8 days) using the 1.2 schema.
    -  96   +  87   + 
              * The properties key for the URL to retrieve the recently modified and added CVE entries (last 8 days) using
    +  88   + 
              * the 1.2 schema.
    +  89   
              */
    -  97   +  90   
             public static final String CVE_MODIFIED_12_URL = "cve.url-1.2.modified";
    -  98   +  91   
             /**
    -  99   - 
              * The properties key for the URL to retrieve the recently modified and
    -  100   - 
              * added CVE entries (last 8 days).
    -  101   +  92   + 
              * The properties key for the URL to retrieve the recently modified and added CVE entries (last 8 days).
    +  93   
              */
    -  102   +  94   
             public static final String CVE_MODIFIED_VALID_FOR_DAYS = "cve.url.modified.validfordays";
    -  103   +  95   
             /**
    -  104   - 
              * The properties key for the telling us how many cvr.url.* URLs exists.
    -  105   - 
              * This is used in combination with CVE_BASE_URL to be able to retrieve
    -  106   - 
              * the URLs for all of the files that make up the NVD CVE listing.
    -  107   +  96   + 
              * The properties key for the telling us how many cvr.url.* URLs exists. This is used in combination with
    +  97   + 
              * CVE_BASE_URL to be able to retrieve the URLs for all of the files that make up the NVD CVE listing.
    +  98   
              */
    -  108   +  99   
             public static final String CVE_START_YEAR = "cve.startyear";
    -  109   +  100   
             /**
    -  110   +  101   
              * The properties key for the CVE schema version 1.2.
    -  111   +  102   
              */
    -  112   +  103   
             public static final String CVE_SCHEMA_1_2 = "cve.url-1.2.base";
    -  113   +  104   
             /**
    -  114   +  105   
              * The properties key for the CVE schema version 2.0.
    -  115   +  106   
              */
    -  116   +  107   
             public static final String CVE_SCHEMA_2_0 = "cve.url-2.0.base";
    -  117   +  108   
             /**
    -  118   +  109   
              * The properties key for the proxy url.
    -  119   +  110   
              */
    -  120   +  111   
             public static final String PROXY_URL = "proxy.url";
    -  121   +  112   
             /**
    -  122   - 
              * The properties key for the proxy port - this must be an integer
    -  123   - 
              * value.
    -  124   +  113   + 
              * The properties key for the proxy port - this must be an integer value.
    +  114   
              */
    -  125   +  115   
             public static final String PROXY_PORT = "proxy.port";
    -  126   +  116   
             /**
    -  127   +  117   
              * The properties key for the proxy username.
    -  128   +  118   
              */
    -  129   +  119   
             public static final String PROXY_USERNAME = "proxy.username";
    -  130   +  120   
             /**
    -  131   +  121   
              * The properties key for the proxy password.
    -  132   +  122   
              */
    -  133   +  123   
             public static final String PROXY_PASSWORD = "proxy.password";
    -  134   +  124   
             /**
    -  135   +  125   
              * The properties key for the connection timeout.
    -  136   +  126   
              */
    -  137   +  127   
             public static final String CONNECTION_TIMEOUT = "connection.timeout";
    -  138   +  128   
             /**
    -  139   +  129   
              * The location of the temporary directory.
    -  140   +  130   
              */
    -  141   +  131   
             public static final String TEMP_DIRECTORY = "temp.directory";
    -  142   +  132   
             /**
    -  143   +  133   
              * The maximum number of threads to allocate when downloading files.
    -  144   +  134   
              */
    -  145   +  135   
             public static final String MAX_DOWNLOAD_THREAD_POOL_SIZE = "max.download.threads";
    -  146   +  136   
             /**
    -  147   +  137   
              * The key for a list of suppression files.
    -  148   +  138   
              */
    -  149   +  139   
             public static final String SUPPRESSION_FILE = "suppression.file";
    -  150   +  140   
             /**
    -  151   +  141   
              * The properties key for whether the Nexus analyzer is enabled.
    -  152   +  142   
              */
    -  153   +  143   
             public static final String ANALYZER_NEXUS_ENABLED = "analyzer.nexus.enabled";
    -  154   +  144   
             /**
    -  155   +  145   
              * The properties key for the Nexus search URL.
    -  156   +  146   
              */
    -  157   +  147   
             public static final String ANALYZER_NEXUS_URL = "analyzer.nexus.url";
    -  158   +  148   
         }
    -  159   +  149   
         /**
    -  160   +  150   
          * The properties file location.
    -  161   +  151   
          */
    -  162   +  152   
         private static final String PROPERTIES_FILE = "dependencycheck.properties";
    -  163   +  153   
         /**
    -  164   +  154   
          * The singleton instance variable.
    -  165   +  155   
          */
    -  166  1 
         private static final Settings INSTANCE = new Settings();
    -  167   +  156  2 
         private static final Settings INSTANCE = new Settings();
    +  157   
         /**
    -  168   +  158   
          * The properties.
    -  169   +  159   
          */
    -  170  1 
         private Properties props = null;
    -  171   +  160  2 
         private Properties props = null;
    +  161   
     
    -  172   +  162   
         /**
    -  173   - 
          * Private constructor for the Settings class. This class loads the
    -  174   - 
          * properties files.
    -  175   +  163   + 
          * Private constructor for the Settings class. This class loads the properties files.
    +  164   
          */
    -  176  1 
         private Settings() {
    -  177  1 
             InputStream in = null;
    -  178  1 
             props = new Properties();
    -  179   +  165  2 
         private Settings() {
    +  166  2 
             InputStream in = null;
    +  167  2 
             props = new Properties();
    +  168   
             try {
    -  180  1 
                 in = this.getClass().getClassLoader().getResourceAsStream(PROPERTIES_FILE);
    -  181  1 
                 props.load(in);
    -  182  0 
             } catch (IOException ex) {
    -  183  0 
                 Logger.getLogger(Settings.class.getName()).log(Level.SEVERE, "Unable to load default settings.");
    -  184  0 
                 Logger.getLogger(Settings.class.getName()).log(Level.FINE, null, ex);
    -  185   +  169  2 
                 in = this.getClass().getClassLoader().getResourceAsStream(PROPERTIES_FILE);
    +  170  2 
                 props.load(in);
    +  171  0 
             } catch (IOException ex) {
    +  172  0 
                 Logger.getLogger(Settings.class.getName()).log(Level.SEVERE, "Unable to load default settings.");
    +  173  0 
                 Logger.getLogger(Settings.class.getName()).log(Level.FINE, null, ex);
    +  174   
             } finally {
    -  186  1 
                 if (in != null) {
    -  187   +  175  2 
                 if (in != null) {
    +  176   
                     try {
    -  188  1 
                         in.close();
    -  189  0 
                     } catch (IOException ex) {
    -  190  0 
                         Logger.getLogger(Settings.class.getName()).log(Level.FINEST, null, ex);
    -  191  1 
                     }
    -  192   +  177  2 
                         in.close();
    +  178  0 
                     } catch (IOException ex) {
    +  179  0 
                         Logger.getLogger(Settings.class.getName()).log(Level.FINEST, null, ex);
    +  180  2 
                     }
    +  181   
                 }
    -  193   +  182   
             }
    -  194  1 
         }
    -  195   +  183  2 
         }
    +  184   
     
    -  196   +  185   
         /**
    -  197   +  186   
          * Sets a property value.
    -  198   +  187   
          *
    -  199   +  188   
          * @param key the key for the property
    -  200   +  189   
          * @param value the value for the property
    -  201   +  190   
          */
    -  202   +  191   
         public static void setString(String key, String value) {
    -  203  5 
             INSTANCE.props.setProperty(key, value);
    -  204  5 
         }
    -  205   +  192  10 
             INSTANCE.props.setProperty(key, value);
    +  193  10 
         }
    +  194   
     
    -  206   +  195   
         /**
    -  207   +  196   
          * Sets a property value.
    -  208   +  197   
          *
    -  209   +  198   
          * @param key the key for the property
    -  210   +  199   
          * @param value the value for the property
    -  211   +  200   
          */
    -  212   +  201   
         public static void setBoolean(String key, boolean value) {
    -  213  5 
             if (value) {
    -  214  0 
                 INSTANCE.props.setProperty(key, Boolean.TRUE.toString());
    -  215   +  202  10 
             if (value) {
    +  203  0 
                 INSTANCE.props.setProperty(key, Boolean.TRUE.toString());
    +  204   
             } else {
    -  216  5 
                 INSTANCE.props.setProperty(key, Boolean.FALSE.toString());
    -  217   +  205  10 
                 INSTANCE.props.setProperty(key, Boolean.FALSE.toString());
    +  206   
             }
    -  218  5 
         }
    -  219   +  207  10 
         }
    +  208   
     
    -  220   +  209   
         /**
    -  221   - 
          * Merges a new properties file into the current properties. This method
    -  222   - 
          * allows for the loading of a user provided properties file.<br/><br/>
    -  223   - 
          * Note: even if using this method - system properties will be loaded before
    -  224   - 
          * properties loaded from files.
    -  225   +  210   + 
          * Merges a new properties file into the current properties. This method allows for the loading of a user provided
    +  211   + 
          * properties file.<br/><br/>
    +  212   + 
          * Note: even if using this method - system properties will be loaded before properties loaded from files.
    +  213   
          *
    -  226   +  214   
          * @param filePath the path to the properties file to merge.
    +  215   + 
          * @throws FileNotFoundException is thrown when the filePath points to a non-existent file
    +  216   + 
          * @throws IOException is thrown when there is an exception loading/merging the properties
    +  217   + 
          */
    +  218   + 
         public static void mergeProperties(File filePath) throws FileNotFoundException, IOException {
    +  219  0 
             final FileInputStream fis = new FileInputStream(filePath);
    +  220  0 
             mergeProperties(fis);
    +  221  0 
         }
    +  222   + 
     
    +  223   + 
         /**
    +  224   + 
          * Merges a new properties file into the current properties. This method allows for the loading of a user provided
    +  225   + 
          * properties file.<br/><br/>
    +  226   + 
          * Note: even if using this method - system properties will be loaded before properties loaded from files.
     227   - 
          * @throws FileNotFoundException is thrown when the filePath points to a
    + 
          *
     228   - 
          * non-existent file
    + 
          * @param filePath the path to the properties file to merge.
     229   - 
          * @throws IOException is thrown when there is an exception loading/merging
    + 
          * @throws FileNotFoundException is thrown when the filePath points to a non-existent file
     230   - 
          * the properties
    + 
          * @throws IOException is thrown when there is an exception loading/merging the properties
     231   
          */
     232   - 
         public static void mergeProperties(File filePath) throws FileNotFoundException, IOException {
    -  233  0 
             final FileInputStream fis = new FileInputStream(filePath);
    -  234  0 
             mergeProperties(fis);
    -  235  0 
         }
    + 
         public static void mergeProperties(String filePath) throws FileNotFoundException, IOException {
    +  233  2 
             final FileInputStream fis = new FileInputStream(filePath);
    +  234  2 
             mergeProperties(fis);
    +  235  2 
         }
     236   
     
     237   
         /**
     238   - 
          * Merges a new properties file into the current properties. This method
    + 
          * Merges a new properties file into the current properties. This method allows for the loading of a user provided
     239   - 
          * allows for the loading of a user provided properties file.<br/><br/>
    + 
          * properties file.<br/><br/>
     240   - 
          * Note: even if using this method - system properties will be loaded before
    + 
          * Note: even if using this method - system properties will be loaded before properties loaded from files.
     241   - 
          * properties loaded from files.
    + 
          *
     242   - 
          *
    -  243   - 
          * @param filePath the path to the properties file to merge.
    -  244   - 
          * @throws FileNotFoundException is thrown when the filePath points to a
    -  245   - 
          * non-existent file
    -  246   - 
          * @throws IOException is thrown when there is an exception loading/merging
    -  247   - 
          * the properties
    -  248   - 
          */
    -  249   - 
         public static void mergeProperties(String filePath) throws FileNotFoundException, IOException {
    -  250  1 
             final FileInputStream fis = new FileInputStream(filePath);
    -  251  1 
             mergeProperties(fis);
    -  252  1 
         }
    -  253   - 
     
    -  254   - 
         /**
    -  255   - 
          * Merges a new properties file into the current properties. This method
    -  256   - 
          * allows for the loading of a user provided properties file.<br/><br/>
    -  257   - 
          * Note: even if using this method - system properties will be loaded before
    -  258   - 
          * properties loaded from files.
    -  259   - 
          *
    -  260   
          * @param stream an Input Stream pointing at a properties file to merge
    -  261   - 
          * @throws IOException is thrown when there is an exception loading/merging
    -  262   - 
          * the properties
    -  263   +  243   + 
          * @throws IOException is thrown when there is an exception loading/merging the properties
    +  244   
          */
    -  264   +  245   
         public static void mergeProperties(InputStream stream) throws IOException {
    -  265  1 
             INSTANCE.props.load(stream);
    -  266  1 
         }
    -  267   +  246  2 
             INSTANCE.props.load(stream);
    +  247  2 
         }
    +  248   
     
    -  268   +  249   
         /**
    +  250   + 
          * Returns a value from the properties file as a File object. If the value was specified as a system property or
    +  251   + 
          * passed in via the -Dprop=value argument - this method will return the value from the system properties before the
    +  252   + 
          * values in the contained configuration file.
    +  253   + 
          *
    +  254   + 
          * @param key the key to lookup within the properties file
    +  255   + 
          * @return the property from the properties file converted to a File object
    +  256   + 
          */
    +  257   + 
         public static File getFile(String key) {
    +  258  12 
             final String file = getString(key);
    +  259  12 
             if (file == null) {
    +  260  12 
                 return null;
    +  261   + 
             }
    +  262  0 
             return new File(file);
    +  263   + 
         }
    +  264   + 
     
    +  265   + 
         /**
    +  266   + 
          * Returns a value from the properties file as a File object. If the value was specified as a system property or
    +  267   + 
          * passed in via the -Dprop=value argument - this method will return the value from the system properties before the
    +  268   + 
          * values in the contained configuration file.
     269   - 
          * Returns a value from the properties file as a File object. If the value
    + 
          *
     270   - 
          * was specified as a system property or passed in via the -Dprop=value
    + 
          * This method will check the configured base directory and will use this as the base of the file path.
     271   - 
          * argument - this method will return the value from the system properties
    + 
          * Additionally, if the base directory begins with a leading "[JAR]\" sequence with the path to the folder
     272   - 
          * before the values in the contained configuration file.
    + 
          * containing the JAR file containing this class.
     273   
          *
     274   @@ -539,152 +535,149 @@  276   
          */
     277   - 
         public static File getFile(String key) {
    -  278  6 
             final String file = getString(key);
    -  279  6 
             if (file == null) {
    -  280  6 
                 return null;
    -  281   + 
         public static File getDataFile(String key) {
    +  278  262 
             final String file = getString(key);
    +  279  262 
             Logger.getLogger(Settings.class.getName()).log(Level.FINE, String.format("Settings.getDataFile() - file: '%s'", file));
    +  280  262 
             if (file == null) {
    +  281  0 
                 return null;
    +  282   
             }
    -  282  0 
             return new File(file);
    -  283   - 
         }
    -  284   - 
     
    -  285   - 
         /**
    -  286   - 
          * Returns a value from the properties file as a File object. If the value
    -  287   - 
          * was specified as a system property or passed in via the -Dprop=value
    -  288   - 
          * argument - this method will return the value from the system properties
    -  289   - 
          * before the values in the contained configuration file.
    +  283  262 
             if (file.startsWith("[JAR]")) {
    +  284  0 
                 Logger.getLogger(Settings.class.getName()).log(Level.FINE, "Settings.getDataFile() - transforming filename");
    +  285  0 
                 final File jarPath = getJarPath();
    +  286  0 
                 Logger.getLogger(Settings.class.getName()).log(Level.FINE, String.format("Settings.getDataFile() - jar file: '%s'", jarPath.toString()));
    +  287  0 
                 final File retVal = new File(jarPath, file.substring(6));
    +  288  0 
                 Logger.getLogger(Settings.class.getName()).log(Level.FINE, String.format("Settings.getDataFile() - returning: '%s'", retVal.toString()));
    +  289  0 
                 return retVal;
     290   - 
          *
    -  291   - 
          * This method will check the configured base directory and will use this as
    + 
             }
    +  291  262 
             return new File(file);
     292   - 
          * the base of the file path. Additionally, if the base directory begins
    + 
         }
     293   - 
          * with a leading "[JAR]\" sequence with the path to the folder containing
    + 
     
     294   - 
          * the JAR file containing this class.
    + 
         /**
     295   - 
          *
    + 
          * Attempts to retrieve the folder containing the Jar file containing the Settings class.
     296   - 
          * @param key the key to lookup within the properties file
    + 
          *
     297   - 
          * @return the property from the properties file converted to a File object
    + 
          * @return a File object
     298   
          */
     299   - 
         public static File getDataFile(String key) {
    -  300  114 
             final String file = getString(key);
    -  301  114 
             if (file == null) {
    -  302  0 
                 return null;
    -  303   - 
             }
    -  304  114 
             if (file.startsWith("[JAR]/")) {
    -  305  0 
                 final File jarPath = getJarPath();
    -  306  0 
                 final File newBase = new File(jarPath, file.substring(6));
    -  307  0 
                 return new File(newBase, file);
    -  308   - 
             }
    -  309  114 
             return new File(file);
    -  310   - 
         }
    -  311   - 
     
    -  312   - 
         /**
    -  313   - 
          * Attempts to retrieve the folder containing the Jar file containing the
    -  314   - 
          * Settings class.
    -  315   - 
          *
    -  316   - 
          * @return a File object
    -  317   - 
          */
    -  318   
         private static File getJarPath() {
    -  319  0 
             final String jarPath = Settings.class.getProtectionDomain().getCodeSource().getLocation().getPath();
    -  320  0 
             String decodedPath = ".";
    -  321   +  300  0 
             final String jarPath = Settings.class.getProtectionDomain().getCodeSource().getLocation().getPath();
    +  301  0 
             String decodedPath = ".";
    +  302   
             try {
    -  322  0 
                 decodedPath = URLDecoder.decode(jarPath, "UTF-8");
    -  323  0 
             } catch (UnsupportedEncodingException ex) {
    -  324  0 
                 Logger.getLogger(Settings.class.getName()).log(Level.FINEST, null, ex);
    -  325  0 
             }
    -  326   +  303  0 
                 decodedPath = URLDecoder.decode(jarPath, "UTF-8");
    +  304  0 
             } catch (UnsupportedEncodingException ex) {
    +  305  0 
                 Logger.getLogger(Settings.class.getName()).log(Level.FINEST, null, ex);
    +  306  0 
             }
    +  307   
     
    -  327  0 
             final File path = new File(decodedPath);
    -  328  0 
             if (path.getName().toLowerCase().endsWith(".jar")) {
    -  329  0 
                 return path.getParentFile();
    -  330   +  308  0 
             final File path = new File(decodedPath);
    +  309  0 
             if (path.getName().toLowerCase().endsWith(".jar")) {
    +  310  0 
                 return path.getParentFile();
    +  311   
             } else {
    -  331  0 
                 return new File(".");
    -  332   +  312  0 
                 return new File(".");
    +  313   
             }
    -  333   +  314   
         }
    -  334   +  315   
     
    -  335   +  316   
         /**
    -  336   - 
          * Returns a value from the properties file. If the value was specified as a
    -  337   - 
          * system property or passed in via the -Dprop=value argument - this method
    -  338   - 
          * will return the value from the system properties before the values in the
    -  339   +  317   + 
          * Returns a value from the properties file. If the value was specified as a system property or passed in via the
    +  318   + 
          * -Dprop=value argument - this method will return the value from the system properties before the values in the
    +  319   
          * contained configuration file.
    -  340   +  320   
          *
    -  341   +  321   
          * @param key the key to lookup within the properties file
    -  342   +  322   
          * @param defaultValue the default value for the requested property
    -  343   +  323   
          * @return the property from the properties file
    -  344   +  324   
          */
    -  345   +  325   
         public static String getString(String key, String defaultValue) {
    -  346  203 
             final String str = System.getProperty(key, INSTANCE.props.getProperty(key, defaultValue));
    -  347  203 
             return str;
    -  348   +  326  570 
             final String str = System.getProperty(key, INSTANCE.props.getProperty(key, defaultValue));
    +  327  570 
             return str;
    +  328   
         }
    -  349   +  329   
     
    -  350   +  330   
         /**
    -  351   +  331   
          * Returns the temporary directory.
    -  352   +  332   
          *
    -  353   +  333   
          * @return the temporary directory
    -  354   +  334   
          */
    -  355   +  335   
         public static File getTempDirectory() {
    -  356  9 
             return new File(Settings.getString(Settings.KEYS.TEMP_DIRECTORY, System.getProperty("java.io.tmpdir")));
    -  357   +  336  24 
             return new File(Settings.getString(Settings.KEYS.TEMP_DIRECTORY, System.getProperty("java.io.tmpdir")));
    +  337   
         }
    -  358   +  338   
     
    -  359   +  339   
         /**
    +  340   + 
          * Returns a value from the properties file. If the value was specified as a system property or passed in via the
    +  341   + 
          * -Dprop=value argument - this method will return the value from the system properties before the values in the
    +  342   + 
          * contained configuration file.
    +  343   + 
          *
    +  344   + 
          * @param key the key to lookup within the properties file
    +  345   + 
          * @return the property from the properties file
    +  346   + 
          */
    +  347   + 
         public static String getString(String key) {
    +  348  324 
             return System.getProperty(key, INSTANCE.props.getProperty(key));
    +  349   + 
         }
    +  350   + 
     
    +  351   + 
         /**
    +  352   + 
          * Removes a property from the local properties collection. This is mainly used in test cases.
    +  353   + 
          *
    +  354   + 
          * @param key the property key to remove
    +  355   + 
          */
    +  356   + 
         public static void removeProperty(String key) {
    +  357  2 
             INSTANCE.props.remove(key);
    +  358  2 
         }
    +  359   + 
     
     360   - 
          * Returns a value from the properties file. If the value was specified as a
    + 
         /**
     361   - 
          * system property or passed in via the -Dprop=value argument - this method
    + 
          * Returns an int value from the properties file. If the value was specified as a system property or passed in via
     362   - 
          * will return the value from the system properties before the values in the
    + 
          * the -Dprop=value argument - this method will return the value from the system properties before the values in the
     363   
          * contained configuration file.
     364   @@ -694,186 +687,129 @@  366   
          * @return the property from the properties file
     367   - 
          */
    + 
          * @throws InvalidSettingException is thrown if there is an error retrieving the setting
     368   - 
         public static String getString(String key) {
    -  369  145 
             return System.getProperty(key, INSTANCE.props.getProperty(key));
    -  370   - 
         }
    -  371   - 
     
    -  372   - 
         /**
    -  373   - 
          * Removes a property from the local properties collection. This is mainly
    -  374   - 
          * used in test cases.
    -  375   - 
          *
    -  376   - 
          * @param key the property key to remove
    -  377   
          */
    -  378   - 
         public static void removeProperty(String key) {
    -  379  1 
             INSTANCE.props.remove(key);
    -  380  1 
         }
    -  381   - 
     
    -  382   - 
         /**
    -  383   - 
          * Returns an int value from the properties file. If the value was specified
    -  384   - 
          * as a system property or passed in via the -Dprop=value argument - this
    -  385   - 
          * method will return the value from the system properties before the values
    -  386   - 
          * in the contained configuration file.
    -  387   - 
          *
    -  388   - 
          * @param key the key to lookup within the properties file
    -  389   - 
          * @return the property from the properties file
    -  390   - 
          * @throws InvalidSettingException is thrown if there is an error retrieving
    -  391   - 
          * the setting
    -  392   - 
          */
    -  393   +  369   
         public static int getInt(String key) throws InvalidSettingException {
    -  394   +  370   
             int value;
    -  395   +  371   
             try {
    -  396  1 
                 value = Integer.parseInt(Settings.getString(key));
    -  397  0 
             } catch (NumberFormatException ex) {
    -  398  0 
                 throw new InvalidSettingException("Could not convert property '" + key + "' to an int.", ex);
    -  399  1 
             }
    -  400  1 
             return value;
    -  401   +  372  2 
                 value = Integer.parseInt(Settings.getString(key));
    +  373  0 
             } catch (NumberFormatException ex) {
    +  374  0 
                 throw new InvalidSettingException("Could not convert property '" + key + "' to an int.", ex);
    +  375  2 
             }
    +  376  2 
             return value;
    +  377   
         }
    -  402   +  378   
     
    -  403   +  379   
         /**
    -  404   - 
          * Returns an int value from the properties file. If the value was specified
    -  405   - 
          * as a system property or passed in via the -Dprop=value argument - this
    -  406   - 
          * method will return the value from the system properties before the values
    -  407   - 
          * in the contained configuration file.
    -  408   +  380   + 
          * Returns an int value from the properties file. If the value was specified as a system property or passed in via
    +  381   + 
          * the -Dprop=value argument - this method will return the value from the system properties before the values in the
    +  382   + 
          * contained configuration file.
    +  383   
          *
    -  409   +  384   
          * @param key the key to lookup within the properties file
    -  410   +  385   
          * @param defaultValue the default value to return
    -  411   - 
          * @return the property from the properties file or the defaultValue if the
    -  412   - 
          * property does not exist or cannot be converted to an integer
    -  413   +  386   + 
          * @return the property from the properties file or the defaultValue if the property does not exist or cannot be
    +  387   + 
          * converted to an integer
    +  388   
          */
    -  414   +  389   
         public static int getInt(String key, int defaultValue) {
    -  415   +  390   
             int value;
    -  416   +  391   
             try {
    -  417  1 
                 value = Integer.parseInt(Settings.getString(key));
    -  418  1 
             } catch (NumberFormatException ex) {
    -  419  1 
                 final String msg = String.format("Could not convert property '%s' to an int.", key);
    -  420  1 
                 Logger.getLogger(Settings.class.getName()).log(Level.FINEST, msg, ex);
    -  421  1 
                 value = defaultValue;
    -  422  0 
             }
    -  423  1 
             return value;
    -  424   +  392  2 
                 value = Integer.parseInt(Settings.getString(key));
    +  393  2 
             } catch (NumberFormatException ex) {
    +  394  2 
                 final String msg = String.format("Could not convert property '%s' to an int.", key);
    +  395  2 
                 Logger.getLogger(Settings.class.getName()).log(Level.FINEST, msg, ex);
    +  396  2 
                 value = defaultValue;
    +  397  0 
             }
    +  398  2 
             return value;
    +  399   
         }
    -  425   +  400   
     
    -  426   +  401   
         /**
    -  427   - 
          * Returns a long value from the properties file. If the value was specified
    -  428   - 
          * as a system property or passed in via the -Dprop=value argument - this
    -  429   - 
          * method will return the value from the system properties before the values
    -  430   - 
          * in the contained configuration file.
    -  431   +  402   + 
          * Returns a long value from the properties file. If the value was specified as a system property or passed in via
    +  403   + 
          * the -Dprop=value argument - this method will return the value from the system properties before the values in the
    +  404   + 
          * contained configuration file.
    +  405   
          *
    -  432   +  406   
          * @param key the key to lookup within the properties file
    -  433   +  407   
          * @return the property from the properties file
    -  434   - 
          * @throws InvalidSettingException is thrown if there is an error retrieving
    -  435   - 
          * the setting
    -  436   +  408   + 
          * @throws InvalidSettingException is thrown if there is an error retrieving the setting
    +  409   
          */
    -  437   +  410   
         public static long getLong(String key) throws InvalidSettingException {
    -  438   +  411   
             long value;
    -  439   +  412   
             try {
    -  440  1 
                 value = Long.parseLong(Settings.getString(key));
    -  441  0 
             } catch (NumberFormatException ex) {
    -  442  0 
                 throw new InvalidSettingException("Could not convert property '" + key + "' to an int.", ex);
    -  443  1 
             }
    -  444  1 
             return value;
    -  445   +  413  2 
                 value = Long.parseLong(Settings.getString(key));
    +  414  0 
             } catch (NumberFormatException ex) {
    +  415  0 
                 throw new InvalidSettingException("Could not convert property '" + key + "' to an int.", ex);
    +  416  2 
             }
    +  417  2 
             return value;
    +  418   
         }
    -  446   +  419   
     
    -  447   +  420   
         /**
    -  448   - 
          * Returns a boolean value from the properties file. If the value was
    -  449   - 
          * specified as a system property or passed in via the
    -  450   - 
          * <code>-Dprop=value</code> argument this method will return the value from
    -  451   - 
          * the system properties before the values in the contained configuration
    -  452   - 
          * file.
    -  453   +  421   + 
          * Returns a boolean value from the properties file. If the value was specified as a system property or passed in
    +  422   + 
          * via the <code>-Dprop=value</code> argument this method will return the value from the system properties before
    +  423   + 
          * the values in the contained configuration file.
    +  424   
          *
    -  454   +  425   
          * @param key the key to lookup within the properties file
    -  455   +  426   
          * @return the property from the properties file
    -  456   - 
          * @throws InvalidSettingException is thrown if there is an error retrieving
    -  457   - 
          * the setting
    -  458   +  427   + 
          * @throws InvalidSettingException is thrown if there is an error retrieving the setting
    +  428   
          */
    -  459   +  429   
         public static boolean getBoolean(String key) throws InvalidSettingException {
    -  460   +  430   
             boolean value;
    -  461   +  431   
             try {
    -  462  10 
                 value = Boolean.parseBoolean(Settings.getString(key));
    -  463  0 
             } catch (NumberFormatException ex) {
    -  464  0 
                 throw new InvalidSettingException("Could not convert property '" + key + "' to an int.", ex);
    -  465  10 
             }
    -  466  10 
             return value;
    -  467   +  432  20 
                 value = Boolean.parseBoolean(Settings.getString(key));
    +  433  0 
             } catch (NumberFormatException ex) {
    +  434  0 
                 throw new InvalidSettingException("Could not convert property '" + key + "' to an int.", ex);
    +  435  20 
             }
    +  436  20 
             return value;
    +  437   
         }
    -  468   +  438   
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.UrlStringUtils.html b/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.UrlStringUtils.html index 46e83bb11..a95b17501 100644 --- a/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.UrlStringUtils.html +++ b/dependency-check-core/cobertura/org.owasp.dependencycheck.utils.UrlStringUtils.html @@ -24,154 +24,154 @@  3   
      *
     4   - 
      * Dependency-check-core is free software: you can redistribute it and/or modify it
    + 
      * Licensed under the Apache License, Version 2.0 (the "License");
     5   - 
      * under the terms of the GNU General Public License as published by the Free
    + 
      * you may not use this file except in compliance with the License.
     6   - 
      * Software Foundation, either version 3 of the License, or (at your option) any
    + 
      * You may obtain a copy of the License at
     7   - 
      * later version.
    + 
      *
     8   - 
      *
    + 
      *     http://www.apache.org/licenses/LICENSE-2.0
     9   - 
      * Dependency-check-core is distributed in the hope that it will be useful, but
    + 
      *
     10   - 
      * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
    + 
      * Unless required by applicable law or agreed to in writing, software
     11   - 
      * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
    + 
      * distributed under the License is distributed on an "AS IS" BASIS,
     12   - 
      * details.
    + 
      * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13   - 
      *
    + 
      * See the License for the specific language governing permissions and
     14   - 
      * You should have received a copy of the GNU General Public License along with
    + 
      * limitations under the License.
     15   - 
      * dependency-check-core. If not, see http://www.gnu.org/licenses/.
    + 
      *
     16   - 
      *
    -  17   
      * Copyright (c) 2013 Jeremy Long. All Rights Reserved.
    +  17   + 
      */
     18   - 
      */
    -  19   
     package org.owasp.dependencycheck.utils;
    +  19   + 
     
     20   - 
     
    -  21   
     import java.net.MalformedURLException;
    -  22   +  21   
     import java.net.URL;
    -  23   +  22   
     import java.util.ArrayList;
    -  24   +  23   
     import java.util.Arrays;
    -  25   +  24   
     import java.util.HashSet;
    -  26   +  25   
     import java.util.List;
    -  27   +  26   
     import java.util.regex.Pattern;
    +  27   + 
     
     28   - 
     
    -  29   
     /**
    -  30   +  29   
      *
    -  31   +  30   
      * @author Jeremy Long <jeremy.long@owasp.org>
    -  32   +  31   
      */
    -  33   +  32   
     public final class UrlStringUtils {
    +  33   + 
     
     34   - 
     
    + 
         /**
     35   - 
         /**
    -  36   
          * Private constructor for a utility class.
    -  37   +  36   
          */
    -  38  0 
         private UrlStringUtils() {
    -  39  0 
         }
    +  37  0 
         private UrlStringUtils() {
    +  38  0 
         }
    +  39   + 
         /**
     40   - 
         /**
    -  41   
          * A regular expression to test if a string contains a URL.
    -  42   +  41   
          */
    -  43  1 
         private static final Pattern CONTAINS_URL_TEST = Pattern.compile("^.*(ht|f)tps?://.*$", Pattern.MULTILINE | Pattern.CASE_INSENSITIVE);
    +  42  2 
         private static final Pattern CONTAINS_URL_TEST = Pattern.compile("^.*(ht|f)tps?://.*$", Pattern.MULTILINE | Pattern.CASE_INSENSITIVE);
    +  43   + 
         /**
     44   - 
         /**
    -  45   
          * A regular expression to test if a string is a URL.
    -  46   +  45   
          */
    -  47  1 
         private static final Pattern IS_URL_TEST = Pattern.compile("^(ht|f)tps?://.*", Pattern.CASE_INSENSITIVE);
    +  46  2 
         private static final Pattern IS_URL_TEST = Pattern.compile("^(ht|f)tps?://.*", Pattern.CASE_INSENSITIVE);
    +  47   + 
     
     48   - 
     
    + 
         /**
     49   - 
         /**
    + 
          * Tests if the text provided contains a URL. This is somewhat limited search in that it only looks for
     50   - 
          * Tests if the text provided contains a URL. This is somewhat limited
    + 
          * (ftp|http|https)://
     51   - 
          * search in that it only looks for (ftp|http|https)://
    + 
          *
     52   - 
          *
    -  53   
          * @param text the text to search
    -  54   +  53   
          * @return true if the text contains a url, otherwise false
    +  54   + 
          */
     55   - 
          */
    -  56   
         public static boolean containsUrl(String text) {
    -  57  29560 
             return CONTAINS_URL_TEST.matcher(text).matches();
    +  56  47674 
             return CONTAINS_URL_TEST.matcher(text).matches();
    +  57   + 
         }
     58   - 
         }
    + 
     
     59   - 
     
    + 
         /**
     60   - 
         /**
    -  61   
          * Tests if the given text is url.
    -  62   +  61   
          *
    -  63   +  62   
          * @param text the string to test
    -  64   +  63   
          * @return returns true if the text is a url, otherwise false
    +  64   + 
          */
     65   - 
          */
    -  66   
         public static boolean isUrl(String text) {
    -  67  135 
             return IS_URL_TEST.matcher(text).matches();
    -  68   +  66  292 
             return IS_URL_TEST.matcher(text).matches();
    +  67   
         }
    +  68   + 
         /**
     69   - 
         /**
    + 
          * A listing of domain parts that should not be used as evidence. Yes, this is an incomplete list.
     70   - 
          * A listing of domain parts that should not be used as evidence. Yes, this
    -  71   - 
          * is an incomplete list.
    -  72   
          */
    -  73  1 
         private static final HashSet<String> IGNORE_LIST = new HashSet<String>(
    -  74   +  71  2 
         private static final HashSet<String> IGNORE_LIST = new HashSet<String>(
    +  72   
                 Arrays.asList("www", "com", "org", "gov", "info", "name", "net", "pro", "tel", "mobi", "xxx"));
    -  75   +  73   
     
    -  76   +  74   
         /**
    +  75   + 
          * <p>
    +  76   + 
          * Takes a URL, in String format, and adds the important parts of the URL to a list of strings.</p>
     77   - 
          * <p>Takes a URL, in String format, and adds the important parts of the URL
    + 
          * <p>
     78   - 
          * to a list of strings.</p>
    + 
          * Example, given the following input:</p>
     79   - 
          * <p>Example, given the following input:</p>
    -  80   
          * <code>"https://www.somedomain.com/path1/path2/file.php?id=439"</code>
    +  80   + 
          * <p>
     81   - 
          * <p>The function would return:</p>
    + 
          * The function would return:</p>
     82   
          * <code>{"some.domain", "path1", "path2", "file"}</code>
     83   @@ -186,40 +186,40 @@ 
          */
     88   
         public static List<String> extractImportantUrlData(String text) throws MalformedURLException {
    -  89  135 
             final ArrayList<String> importantParts = new ArrayList<String>();
    -  90  135 
             final URL url = new URL(text);
    -  91  135 
             final String[] domain = url.getHost().split("\\.");
    +  89  292 
             final ArrayList<String> importantParts = new ArrayList<String>();
    +  90  292 
             final URL url = new URL(text);
    +  91  292 
             final String[] domain = url.getHost().split("\\.");
     92   
             //add the domain except www and the tld.
    -  93  404 
             for (int i = 0; i < domain.length - 1; i++) {
    -  94  269 
                 final String sub = domain[i];
    -  95  269 
                 if (!IGNORE_LIST.contains(sub.toLowerCase())) {
    -  96  185 
                     importantParts.add(sub);
    +  93  874 
             for (int i = 0; i < domain.length - 1; i++) {
    +  94  582 
                 final String sub = domain[i];
    +  95  582 
                 if (!IGNORE_LIST.contains(sub.toLowerCase())) {
    +  96  392 
                     importantParts.add(sub);
     97   
                 }
     98   
             }
    -  99  135 
             final String document = url.getPath();
    -  100  135 
             final String[] pathParts = document.split("[\\//]");
    -  101  135 
             for (int i = 0; i < pathParts.length - 2; i++) {
    +  99  292 
             final String document = url.getPath();
    +  100  292 
             final String[] pathParts = document.split("[\\//]");
    +  101  292 
             for (int i = 0; i < pathParts.length - 2; i++) {
     102  0 
                 if (!pathParts[i].isEmpty()) {
     103  0 
                     importantParts.add(pathParts[i]);
     104   
                 }
     105   
             }
    -  106  135 
             if (pathParts.length > 0 && !pathParts[pathParts.length - 1].isEmpty()) {
    -  107  47 
                 final String fileNameNoExt = pathParts[pathParts.length - 1].replaceAll("\\..*{0,5}$", "");
    -  108  47 
                 importantParts.add(fileNameNoExt);
    +  106  292 
             if (pathParts.length > 0 && !pathParts[pathParts.length - 1].isEmpty()) {
    +  107  94 
                 final String fileNameNoExt = pathParts[pathParts.length - 1].replaceAll("\\..*{0,5}$", "");
    +  108  94 
                 importantParts.add(fileNameNoExt);
     109   
             }
    -  110  135 
             return importantParts;
    +  110  292 
             return importantParts;
     111   
         }
     112   
     }
    -
    Report generated by Cobertura 2.0.3 on 1/16/14 7:28 AM.
    +
    Report generated by Cobertura 2.0.3 on 1/26/14 11:11 AM.
    diff --git a/dependency-check-core/cpd.html b/dependency-check-core/cpd.html index 38d0d08d7..e50b33ab1 100644 --- a/dependency-check-core/cpd.html +++ b/dependency-check-core/cpd.html @@ -1,13 +1,13 @@ - + dependency-check-core - CPD Results @@ -54,7 +54,7 @@
  • - +
  • /
    • @@ -67,8 +67,8 @@ -
  • Last Published: 2014-01-16
  • |
    • -
  • Version: 1.0.8
    • +
  • Last Published: 2014-01-26
  • |
    • +
  • Version: 1.1.0
    • @@ -88,7 +88,7 @@ Project Information - +
  • @@ -184,6 +184,13 @@ FindBugs Report
    • + +
  • + + + + JavaNCSS Report +
    • @@ -220,7 +227,92 @@

    The following document contains the results of PMD's CPD 5.0.2.

    Duplications

    -

    CPD found no problems in your source code.

    + + + + + + + + + + +
    FileLine
    org\owasp\dependencycheck\analyzer\JarAnalyzer.java580
    org\owasp\dependencycheck\analyzer\JarAnalyzer.java1195
    +
    +
                    addMatchingValues(classes, description, dependency.getProductEvidence());
+            }
+        }
+
+        //license
+        if (pom.getLicenses() != null) {
+            String license = null;
+            for (License lic : pom.getLicenses().getLicense()) {
+                String tmp = null;
+                if (lic.getName() != null) {
+                    tmp = interpolateString(lic.getName(), pomProperties);
+                }
+                if (lic.getUrl() != null) {
+                    if (tmp == null) {
+                        tmp = interpolateString(lic.getUrl(), pomProperties);
+                    } else {
+                        tmp += ": " + interpolateString(lic.getUrl(), pomProperties);
+                    }
+                }
+                if (tmp == null) {
+                    continue;
+                }
+                if (HTML_DETECTION_PATTERN.matcher(tmp).find()) {
+                    tmp = Jsoup.parse(tmp).text();
+                }
+                if (license == null) {
+                    license = tmp;
+                } else {
+                    license += "\n" + tmp;
+                }
+            }
+            if (license != null) {
+                dependency.setLicense(license);
+            }
+        }
    + + + + + + + + + + +
    FileLine
    org\owasp\dependencycheck\analyzer\ArchiveAnalyzer.java132
    org\owasp\dependencycheck\analyzer\JarAnalyzer.java887
    +
    +
        @Override
+    public void initialize() throws Exception {
+        final File baseDir = Settings.getTempDirectory();
+        if (!baseDir.exists()) {
+            if (!baseDir.mkdirs()) {
+                final String msg = String.format("Unable to make a temporary folder '%s'", baseDir.getPath());
+                throw new AnalysisException(msg);
+            }
+        }
+        tempFileLocation = File.createTempFile("check", "tmp", baseDir);
+        if (!tempFileLocation.delete()) {
+            final String msg = String.format("Unable to delete temporary file '%s'.", tempFileLocation.getAbsolutePath());
+            throw new AnalysisException(msg);
+        }
+        if (!tempFileLocation.mkdirs()) {
+            final String msg = String.format("Unable to create directory '%s'.", tempFileLocation.getAbsolutePath());
+            throw new AnalysisException(msg);
+        }
+    }
+
+    /**
+     * The close method does nothing for this Analyzer.
+     *
+     * @throws Exception thrown if there is an exception deleting temporary files
+     */
+    @Override
+    public void close() throws Exception {
    diff --git a/dependency-check-core/dependency-updates-report.html b/dependency-check-core/dependency-updates-report.html index 9d8bfb15c..9b5a7bdb5 100644 --- a/dependency-check-core/dependency-updates-report.html +++ b/dependency-check-core/dependency-updates-report.html @@ -1,13 +1,13 @@ - + dependency-check-core - Dependency Updates Report @@ -54,7 +54,7 @@
  • - +
  • /
    • @@ -67,8 +67,8 @@ -
  • Last Published: 2014-01-16
  • |
    • -
  • Version: 1.0.8
    • +
  • Last Published: 2014-01-26
  • |
    • +
  • Version: 1.1.0
    • @@ -88,7 +88,7 @@ Project Information - +
  • @@ -184,6 +184,13 @@ FindBugs Report
    • + +
  • + + + + JavaNCSS Report +
    • @@ -625,7 +632,7 @@ jar Newer versions -1.3.173 Next Incremental
    1.3.174 Latest Incremental +1.3.173 Next Incremental
    1.3.174
    1.3.175 Latest Incremental

    com.hazelcast:hazelcast

    @@ -652,7 +659,7 @@ -
    jar
    Newer versions2.5.1 Next Incremental
    2.6 Next Minor
    2.6.1
    2.6.2
    2.6.3
    2.6.4
    2.6.5
    3.0-RC1
    3.0-RC2 Latest Minor
    3.0 Next Major
    3.0.1
    3.0.2
    3.0.3
    3.1
    3.1.1
    3.1.2
    3.1.3
    3.1.4
    3.1.5 Latest Major
    +2.5.1 Next Incremental
    2.6 Next Minor
    2.6.1
    2.6.2
    2.6.3
    2.6.4
    2.6.5
    2.6.6
    3.0-RC1
    3.0-RC2 Latest Minor
    3.0 Next Major
    3.0.1
    3.0.2
    3.0.3
    3.1
    3.1.1
    3.1.2
    3.1.3
    3.1.4
    3.1.5 Latest Major

    commons-cli:commons-cli

    @@ -859,7 +866,7 @@ -
    jar
    Newer versions1.6 Next Minor
    +1.6 Next Minor
    1.7 Latest Minor

    org.apache.geronimo.daytrader:daytrader-ear

    diff --git a/dependency-check-core/failsafe-report.html b/dependency-check-core/failsafe-report.html index 4aa1e5b01..54a6f60d9 100644 --- a/dependency-check-core/failsafe-report.html +++ b/dependency-check-core/failsafe-report.html @@ -1,13 +1,13 @@ - + dependency-check-core - Surefire Report @@ -54,7 +54,7 @@
  • - +
  • /
    • @@ -67,8 +67,8 @@ -
  • Last Published: 2014-01-16
  • |
    • -
  • Version: 1.0.8
    • +
  • Last Published: 2014-01-26
  • |
    • +
  • Version: 1.1.0
    • @@ -88,7 +88,7 @@ Project Information - +
  • @@ -184,6 +184,13 @@ FindBugs Report
    • + +
  • + + + + JavaNCSS Report +
    • @@ -251,7 +258,7 @@ function toggleDisplay(elementId) { -
    0 0 100%28.95

    +30.534

    Note: failures are anticipated and checked for with assertions while errors are unanticipated.


    Package List

    @@ -272,7 +279,7 @@ function toggleDisplay(elementId) { 0 0 100% -15.582 +19.68 org.owasp.dependencycheck.utils 2 @@ -280,7 +287,7 @@ function toggleDisplay(elementId) { 0 0 100% -0.574 +0.745 org.owasp.dependencycheck.data.update 5 @@ -288,7 +295,7 @@ function toggleDisplay(elementId) { 0 0 100% -12.794
    +10.109

    Note: package statistics are not computed recursively, they only sum up all of its testsuites numbers.

    org.owasp.dependencycheck

    @@ -310,7 +317,7 @@ function toggleDisplay(elementId) { 0 0 100% -15.582
    +19.68

    org.owasp.dependencycheck.utils

    @@ -331,7 +338,7 @@ function toggleDisplay(elementId) { -
    0 0 100%0.574
    +0.745

    org.owasp.dependencycheck.data.update

    @@ -352,7 +359,7 @@ function toggleDisplay(elementId) { - + @@ -361,7 +368,7 @@ function toggleDisplay(elementId) { -
    0 0 100%12.366
    9.829
    StandardUpdateIntegrationTest0 0 100%0.428

    +0.28

    Test Cases

    [Summary] [Package List] [Test Cases]

    @@ -371,44 +378,44 @@ function toggleDisplay(elementId) { testUpdate -12.366
    +9.829

    StandardUpdateIntegrationTest

    - + - + - + -
    testOpenDataStores0.087
    0.08
    testUpdatesNeeded0.164
    0.087
    testWithinRange0.077
    0.064
    testUpdate0.1
    +0.049

    EngineIntegrationTest

    -
    testScan15.582
    +19.68

    DownloaderIntegrationTest

    - + -
    testGetLastModified0.056
    0.038
    testFetchFile0.518

    +0.707
    diff --git a/dependency-check-core/findbugs.html b/dependency-check-core/findbugs.html index a11044bcc..cc7e2a595 100644 --- a/dependency-check-core/findbugs.html +++ b/dependency-check-core/findbugs.html @@ -1,13 +1,13 @@ - + dependency-check-core - FindBugs Bug Detector Report @@ -54,7 +54,7 @@
  • - +
  • /
    • @@ -67,8 +67,8 @@ -
  • Last Published: 2014-01-16
  • |
    • -
  • Version: 1.0.8
    • +
  • Last Published: 2014-01-26
  • |
    • +
  • Version: 1.1.0
    • @@ -88,7 +88,7 @@ Project Information - +
  • @@ -184,6 +184,13 @@ FindBugs Report
    • + +
  • + + + + JavaNCSS Report +
    • @@ -230,8 +237,8 @@ Errors Missing Classes -199 -9 +196 +10 0 0
    @@ -244,10 +251,10 @@ org.owasp.dependencycheck.analyzer.FalsePositiveAnalyzer 2 -org.owasp.dependencycheck.analyzer.JavaScriptAnalyzer -1 +org.owasp.dependencycheck.analyzer.JarAnalyzer +2 -org.owasp.dependencycheck.concurrency.DirectorySpinLock +org.owasp.dependencycheck.analyzer.JavaScriptAnalyzer 1 org.owasp.dependencycheck.data.nvdcve.CveDB @@ -274,103 +281,109 @@ Possible null pointer dereference of currentVersion in org.owasp.dependencycheck.analyzer.FalsePositiveAnalyzer.removeSpuriousCPE(Dependency) CORRECTNESS NP_NULL_ON_SOME_PATH -166 +163 Medium Possible null pointer dereference of nextVersion on branch that might be infeasible in org.owasp.dependencycheck.analyzer.FalsePositiveAnalyzer.removeSpuriousCPE(Dependency) STYLE NP_NULL_ON_SOME_PATH_MIGHT_BE_INFEASIBLE -166 +163 +Medium
    +
    +

    org.owasp.dependencycheck.analyzer.JarAnalyzer

    + + + + + + + + + + + + + + + + + +
    BugCategoryDetailsLinePriority
    Possible null pointer dereference of input in org.owasp.dependencycheck.analyzer.JarAnalyzer.extractPom(String, JarFile, Dependency) on exception pathCORRECTNESSNP_NULL_ON_SOME_PATH_EXCEPTION396Medium
    org.owasp.dependencycheck.analyzer.JarAnalyzer.extractPom(String, JarFile, Dependency) may fail to close streamBAD_PRACTICEOS_OPEN_STREAM384 Medium

    org.owasp.dependencycheck.analyzer.JavaScriptAnalyzer

    - + - + - -
    Bug Category Details Line Priority
    Dead store to extractComments in org.owasp.dependencycheck.analyzer.JavaScriptAnalyzer.analyze(Dependency, Engine) STYLE DLS_DEAD_LOCAL_STORE99Medium
    -
    -

    org.owasp.dependencycheck.concurrency.DirectorySpinLock

    - - - - - - - - - - - - +
    BugCategoryDetailsLinePriority
    exceptional return value of java.io.File.delete() ignored in org.owasp.dependencycheck.concurrency.DirectorySpinLock.close()BAD_PRACTICERV_RETURN_VALUE_IGNORED_BAD_PRACTICE24795 Medium

    org.owasp.dependencycheck.data.nvdcve.CveDB

    - + - + - +
    Bug Category Details Line Priority
    org.owasp.dependencycheck.data.nvdcve.CveDB.getVendorProductList() may fail to close PreparedStatement BAD_PRACTICE ODR_OPEN_DATABASE_RESOURCE298297 Medium

    org.owasp.dependencycheck.data.update.task.CallableDownloadTask

    - + - + - +
    Bug Category Details Line Priority
    new org.owasp.dependencycheck.data.update.task.CallableDownloadTask(NvdCveInfo, ExecutorService, CveDB) might ignore java.io.IOException BAD_PRACTICE DE_MIGHT_IGNORE6058 Medium

    org.owasp.dependencycheck.utils.Downloader

    - + - + - +
    Bug Category Details Line Priority
    Redundant nullcheck of conn which is known to be null in org.owasp.dependencycheck.utils.Downloader.getConnection(URL) STYLE RCN_REDUNDANT_NULLCHECK_OF_NULL_VALUE216211 Medium

    org.owasp.dependencycheck.utils.LogUtils

    - + - + - +
    Bug Category Details Line Priority
    Changes to logger could be lost in org.owasp.dependencycheck.utils.LogUtils.prepareLogger(InputStream, String) EXPERIMENTAL LG_LOST_LOGGER_DUE_TO_WEAK_REFERENCE5958 High
    diff --git a/dependency-check-core/index.html b/dependency-check-core/index.html index 01f0732ff..a7066584c 100644 --- a/dependency-check-core/index.html +++ b/dependency-check-core/index.html @@ -1,13 +1,13 @@ - + dependency-check-core - About @@ -54,7 +54,7 @@
  • - +
  • /
    • @@ -67,8 +67,8 @@ -
  • Last Published: 2014-01-16
  • |
    • -
  • Version: 1.0.8
    • +
  • Last Published: 2014-01-26
  • |
    • +
  • Version: 1.1.0
    • @@ -109,7 +109,7 @@ - +
  • diff --git a/dependency-check-core/javancss.html b/dependency-check-core/javancss.html new file mode 100644 index 000000000..c1f6e5cc9 --- /dev/null +++ b/dependency-check-core/javancss.html @@ -0,0 +1,1083 @@ + + + + + + + + + dependency-check-core - JavaNCSS Metric Results + + + + + + + + + + + + + + + + + + + + + Fork me on GitHub + + + + + +
    + + + + + +
    +
    +
    + + + + + + +
    + +
    +
    +
    + + + +
    + + + + +
    +
    + + Built by Maven + +
    +
    +
    + + +
    + +
    +

    JavaNCSS Metric Results

    +

    +

    [ package ] [ object ] [ method ] [ explanation ]

    The following document contains the results of a JavaNCSS metric analysis, using JavaNCSS version 32.53.
    JavaNCSS web site.
    +
    +

    Packages

    +

    [ package ] [ object ] [ method ] [ explanation ]

    +

    Packages sorted by NCSS.

    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    PackageClassesMethodsNCSSJavadocsJavadoc linesSingle lines commentMulti lines comment
    org.owasp.dependencycheck.analyzer2116318201811211148575
    org.owasp.dependencycheck.jaxb.pom.generated86540177162670692280
    org.owasp.dependencycheck.dependency1416273615910073222
    org.owasp.dependencycheck.data.nvdcve9597196639930254
    org.owasp.dependencycheck.utils19836968754617364
    org.owasp.dependencycheck.suppression648326543386145
    org.owasp.dependencycheck.data.update.xml435315342225124
    org.owasp.dependencycheck.data.update635272402675125
    org.owasp.dependencycheck.data.lucene11302644125920228
    org.owasp.dependencycheck.data.cpe43020632218099
    org.owasp.dependencycheck11719718104439
    org.owasp.dependencycheck.data.update.task21715718121054
    org.owasp.dependencycheck.reporting2111381394165
    org.owasp.dependencycheck.data.nexus2147216100753
    org.owasp.dependencycheck.data.cwe2547629150
    org.owasp.dependencycheck.data.update.exception2620840050
    org.owasp.dependencycheck.jaxb.pom1419539030
    org.owasp.dependencycheck.exception1413524030
    + + + + + + + + + + + + + + + + +
    Classes totalMethods totalNCSS totalJavadocsJavadoc linesSingle lines commentMulti lines comment
    193126377881409120874752507
    +
    +

    Objects

    +

    [ package ] [ object ] [ method ] [ explanation ]

    +

    TOP 30 classes containing the most NCSS.

    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    ObjectNCSSMethodsClassesJavadocs
    org.owasp.dependencycheck.analyzer.JarAnalyzer63428134
    org.owasp.dependencycheck.data.nvdcve.CveDB39120021
    org.owasp.dependencycheck.analyzer.CPEAnalyzer26319232
    org.owasp.dependencycheck.jaxb.pom.generated.Model217601183
    org.owasp.dependencycheck.data.update.xml.NvdCve20Handler2088124
    org.owasp.dependencycheck.dependency.Dependency17942043
    org.owasp.dependencycheck.jaxb.pom.generated.ObjectFactory17587088
    org.owasp.dependencycheck.Engine17017018
    org.owasp.dependencycheck.analyzer.ArchiveAnalyzer16211012
    org.owasp.dependencycheck.analyzer.DependencyBundlingAnalyzer16113014
    org.owasp.dependencycheck.data.update.StandardUpdate140809
    org.owasp.dependencycheck.utils.Settings12217120
    org.owasp.dependencycheck.analyzer.FalsePositiveAnalyzer11811012
    org.owasp.dependencycheck.dependency.EvidenceCollection11818519
    org.owasp.dependencycheck.suppression.SuppressionRule11124025
    org.owasp.dependencycheck.dependency.VulnerableSoftware11018019
    org.owasp.dependencycheck.data.nvdcve.ConnectionFactory109708
    org.owasp.dependencycheck.data.cpe.CpeMemoryIndex10814015
    org.owasp.dependencycheck.dependency.Vulnerability10836035
    org.owasp.dependencycheck.jaxb.pom.generated.Build10128539
    org.owasp.dependencycheck.jaxb.pom.generated.Profile9724637
    org.owasp.dependencycheck.utils.Downloader94415
    org.owasp.dependencycheck.utils.DependencyVersion9111011
    org.owasp.dependencycheck.reporting.ReportGenerator86617
    org.owasp.dependencycheck.data.update.xml.NvdCve12Handler803110
    org.owasp.dependencycheck.utils.FileUtils80708
    org.owasp.dependencycheck.jaxb.pom.generated.Plugin7018427
    org.owasp.dependencycheck.data.update.task.CallableDownloadTask6911011
    org.owasp.dependencycheck.dependency.Evidence6617018
    org.owasp.dependencycheck.jaxb.pom.generated.BuildBase6516425
    +

    TOP 30 classes containing the most methods.

    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    ObjectNCSSMethodsClassesJavadocs
    org.owasp.dependencycheck.jaxb.pom.generated.ObjectFactory17587088
    org.owasp.dependencycheck.jaxb.pom.generated.Model217601183
    org.owasp.dependencycheck.dependency.Dependency17942043
    org.owasp.dependencycheck.dependency.Vulnerability10836035
    org.owasp.dependencycheck.analyzer.JarAnalyzer63428134
    org.owasp.dependencycheck.jaxb.pom.generated.Build10128539
    org.owasp.dependencycheck.jaxb.pom.generated.Profile9724637
    org.owasp.dependencycheck.suppression.SuppressionRule11124025
    org.owasp.dependencycheck.data.nvdcve.CveDB39120021
    org.owasp.dependencycheck.analyzer.CPEAnalyzer26319232
    org.owasp.dependencycheck.dependency.EvidenceCollection11818519
    org.owasp.dependencycheck.dependency.VulnerableSoftware11018019
    org.owasp.dependencycheck.jaxb.pom.generated.Dependency5218121
    org.owasp.dependencycheck.jaxb.pom.generated.Developer5818223
    org.owasp.dependencycheck.jaxb.pom.generated.Plugin7018427
    org.owasp.dependencycheck.data.update.xml.NvdCve20Handler.Element5117017
    org.owasp.dependencycheck.dependency.Evidence6617018
    org.owasp.dependencycheck.Engine17017018
    org.owasp.dependencycheck.utils.Settings12217120
    org.owasp.dependencycheck.dependency.Identifier5516015
    org.owasp.dependencycheck.jaxb.pom.generated.BuildBase6516425
    org.owasp.dependencycheck.jaxb.pom.generated.Contributor5316221
    org.owasp.dependencycheck.data.cpe.CpeMemoryIndex10814015
    org.owasp.dependencycheck.jaxb.pom.generated.Notifier4214117
    org.owasp.dependencycheck.analyzer.DependencyBundlingAnalyzer16113014
    org.owasp.dependencycheck.data.cpe.IndexEntry4812011
    org.owasp.dependencycheck.data.nexus.MavenArtifact3312013
    org.owasp.dependencycheck.data.update.UpdateableNvdCve3712012
    org.owasp.dependencycheck.jaxb.pom.generated.DistributionManagement3112013
    org.owasp.dependencycheck.jaxb.pom.generated.MailingList3712115
    +

    Averages.

    + + + + + + + + + + + + +
    NCSS averageProgram NCSSClasses averageMethods averageJavadocs average
    37.487,788.000.346.547.76
    +
    +

    Methods

    +

    [ package ] [ object ] [ method ] [ explanation ]

    +

    TOP 30 Methods containing the most NCSS.

    +

    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    MethodsNCSSCCNJavadocs
    org.owasp.dependencycheck.data.nvdcve.CveDB.updateVulnerability(Vulnerability)116171
    org.owasp.dependencycheck.analyzer.JarAnalyzer.parseManifest(Dependency,ClassNameInformation)109411
    org.owasp.dependencycheck.analyzer.JarAnalyzer.addPomEvidence(Dependency,Model,Properties)74441
    org.owasp.dependencycheck.data.update.xml.NvdCve20Handler.endElement(String,String,String)71270
    org.owasp.dependencycheck.analyzer.JarAnalyzer.setPomEvidence(Dependency,Model,Properties,ClassNameInformation)69311
    org.owasp.dependencycheck.data.update.StandardUpdate.update()60251
    org.owasp.dependencycheck.Engine.analyzeDependencies()59181
    org.owasp.dependencycheck.data.update.xml.NvdCve20Handler.startElement(String,String,String,Attributes)55210
    org.owasp.dependencycheck.data.nvdcve.CveDB.getVulnerability(String)5491
    org.owasp.dependencycheck.utils.FileUtils.extractFiles(File,File,Engine)51231
    org.owasp.dependencycheck.analyzer.JarAnalyzer.extractPom(String,JarFile,Dependency)50121
    org.owasp.dependencycheck.analyzer.ArchiveAnalyzer.extractArchive(ArchiveInputStream,File,Engine)49231
    org.owasp.dependencycheck.analyzer.CPEAnalyzer.determineIdentifiers(Dependency,String,String)47221
    org.owasp.dependencycheck.analyzer.JarAnalyzer.analyzePOM(Dependency,ClassNameInformation,Engine)44111
    org.owasp.dependencycheck.data.nvdcve.ConnectionFactory.getConnection()42151
    org.owasp.dependencycheck.data.update.StandardUpdate.updatesNeeded()42171
    org.owasp.dependencycheck.reporting.ReportGenerator.generateReport(String,String)41161
    org.owasp.dependencycheck.data.update.xml.NvdCve12Handler.startElement(String,String,String,Attributes)40140
    org.owasp.dependencycheck.utils.Downloader.fetchFile(URL,File)40151
    org.owasp.dependencycheck.dependency.Dependency.equals(Object)37571
    org.owasp.dependencycheck.dependency.VulnerableSoftware.compareTo(VulnerableSoftware)37191
    org.owasp.dependencycheck.suppression.SuppressionRule.process(Dependency)37251
    org.owasp.dependencycheck.analyzer.FalsePositiveAnalyzer.removeSpuriousCPE(Dependency)35181
    org.owasp.dependencycheck.analyzer.ArchiveAnalyzer.extractFiles(File,File,Engine)32161
    org.owasp.dependencycheck.analyzer.JarAnalyzer.addDescription(Dependency,String,String,String)32101
    org.owasp.dependencycheck.utils.DependencyVersion.compareTo(DependencyVersion)32190
    org.owasp.dependencycheck.analyzer.DependencyBundlingAnalyzer.analyze(Dependency,Engine)30141
    org.owasp.dependencycheck.data.nvdcve.CveDB.getVulnerabilities(String)3071
    org.owasp.dependencycheck.data.cpe.CpeMemoryIndex.buildIndex(CveDB)29161
    org.owasp.dependencycheck.suppression.SuppressionParser.parseSuppressionRules(File)29101
    +

    Averages.

    +

    + + + + + + + + + + +
    Program NCSSNCSS averageCCN averageJavadocs average
    7,788.004.722.260.97
    +
    +

    Explanations

    +

    [ package ] [ object ] [ method ] [ explanation ]

    +

    Non Commenting Source Statements (NCSS)

    +

    Statements for JavaNCSS are not statements as specified in the Java Language Specification but include all kinds of declarations too. Roughly spoken, NCSS is approximately equivalent to counting ';' and '{' characters in Java source files.

    +

    Not counted are empty statements, empty blocks or semicolons after closing brackets. Of course, comments don't get counted too. Closing brackets also never get counted, the same applies to blocks in general.

    + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    Examples
    Package declarationpackage java.lang;
    Import declarationimport java.awt.*;
    Class declaration +
      +
    • public class Foo {
      • +
    • public class Foo extends Bla {
    Interface declarationpublic interface Able ; {
    Field declaration +
      +
    • int a;
      • +
    • int a, b, c = 5, d = 6;
    Method declaration +
      +
    • public void cry();
      • +
    • public void gib() throws DeadException {
    Constructor declarationpublic Foo() {
    Constructor invocation +
      +
    • this();
      • +
    • super();
    Statement declaration +
      +
    • i = 0;
      • +
    • if (ok)
      • +
    • if (exit) {
      • +
    • if (3 == 4);
      • +
    • if (4 == 4) { ;
      • +
    • } else {
    Label declarationfine :
    +

    In some cases consecutive semicolons are illegal according to the JLS but JavaNCSS still tolerates them (thought JavaNCSS is still more strict as 'javac'). Nevertheless they are never counted as two statements.

    +

    Cyclomatic Complexity Number (CCN)

    +

    CCN is also know as McCabe Metric. There exists a much hyped theory behind it based on graph theory, but it all comes down to simply counting 'if', 'for', 'while' statements etc. in a method. Whenever the control flow of a method splits, the "CCN counter" gets incremented by one.

    +

    Each method has a minimum value of 1 per default. For each of the following Java keywords/statements this value gets incremented by one:

    +
      +
    • if
      • +
    • for
      • +
    • while
      • +
    • case
      • +
    • catch
    +

    Also if the control flow of a method returns abortively the CCNvalue will be incremented by one:

    +
      +
    • if
      • +
    • for
    +

    An ordinary return at the end of method will not be counted.

    +

    Note that 'else', 'default', and 'finally' don't increment the CCN value any further. On the other hand, a simple method with a 'switch' statement and a huge block of 'case' statements can have a surprisingly high CCN value (still it has the same value when converting a 'switch' block to an equivalent sequence of 'if' statements).

    +
    +
    +
    + +
    + +
    +
    +
    Copyright © 2012-2014 + OWASP. + All Rights Reserved. + +
    + + + +
    +
    + + diff --git a/dependency-check-core/license.html b/dependency-check-core/license.html index 7c28e3b95..d9a07e94a 100644 --- a/dependency-check-core/license.html +++ b/dependency-check-core/license.html @@ -1,13 +1,13 @@ - + dependency-check-core - Project License @@ -54,7 +54,7 @@
  • - +
  • /
    • @@ -67,8 +67,8 @@ -
  • Last Published: 2014-01-16
  • |
    • -
  • Version: 1.0.8
    • +
  • Last Published: 2014-01-26
  • |
    • +
  • Version: 1.1.0
    • @@ -109,7 +109,7 @@ - +
  • @@ -150,682 +150,210 @@

    Project License

    -

    GNU General Public License version 3

    +

    The Apache Software License, Version 2.0

    -
                        GNU GENERAL PUBLIC LICENSE 
-                       Version 3, 29 June 2007
-
- Copyright (C) 2007 Free Software Foundation, Inc. <http://fsf.org/>
- Everyone is permitted to copy and distribute verbatim copies
- of this license document, but changing it is not allowed.
-
-                            Preamble
-
-  The GNU General Public License is a free, copyleft license for
-software and other kinds of works.
-
-  The licenses for most software and other practical works are designed
-to take away your freedom to share and change the works.  By contrast,
-the GNU General Public License is intended to guarantee your freedom to
-share and change all versions of a program--to make sure it remains free
-software for all its users.  We, the Free Software Foundation, use the
-GNU General Public License for most of our software; it applies also to
-any other work released this way by its authors.  You can apply it to
-your programs, too.
-
-  When we speak of free software, we are referring to freedom, not
-price.  Our General Public Licenses are designed to make sure that you
-have the freedom to distribute copies of free software (and charge for
-them if you wish), that you receive source code or can get it if you
-want it, that you can change the software or use pieces of it in new
-free programs, and that you know you can do these things.
-
-  To protect your rights, we need to prevent others from denying you
-these rights or asking you to surrender the rights.  Therefore, you have
-certain responsibilities if you distribute copies of the software, or if
-you modify it: responsibilities to respect the freedom of others.
-
-  For example, if you distribute copies of such a program, whether
-gratis or for a fee, you must pass on to the recipients the same
-freedoms that you received.  You must make sure that they, too, receive
-or can get the source code.  And you must show them these terms so they
-know their rights.
-
-  Developers that use the GNU GPL protect your rights with two steps:
-(1) assert copyright on the software, and (2) offer you this License
-giving you legal permission to copy, distribute and/or modify it.
-
-  For the developers' and authors' protection, the GPL clearly explains
-that there is no warranty for this free software.  For both users' and
-authors' sake, the GPL requires that modified versions be marked as
-changed, so that their problems will not be attributed erroneously to
-authors of previous versions.
-
-  Some devices are designed to deny users access to install or run
-modified versions of the software inside them, although the manufacturer
-can do so.  This is fundamentally incompatible with the aim of
-protecting users' freedom to change the software.  The systematic
-pattern of such abuse occurs in the area of products for individuals to
-use, which is precisely where it is most unacceptable.  Therefore, we
-have designed this version of the GPL to prohibit the practice for those
-products.  If such problems arise substantially in other domains, we
-stand ready to extend this provision to those domains in future versions
-of the GPL, as needed to protect the freedom of users.
-
-  Finally, every program is threatened constantly by software patents.
-States should not allow patents to restrict development and use of
-software on general-purpose computers, but in those that do, we wish to
-avoid the special danger that patents applied to a free program could
-make it effectively proprietary.  To prevent this, the GPL assures that
-patents cannot be used to render the program non-free.
-
-  The precise terms and conditions for copying, distribution and
-modification follow.
-
-                       TERMS AND CONDITIONS
-
-  0. Definitions.
-
-  "This License" refers to version 3 of the GNU General Public License.
-
-  "Copyright" also means copyright-like laws that apply to other kinds of
-works, such as semiconductor masks.
-
-  "The Program" refers to any copyrightable work licensed under this
-License.  Each licensee is addressed as "you".  "Licensees" and
-"recipients" may be individuals or organizations.
-
-  To "modify" a work means to copy from or adapt all or part of the work
-in a fashion requiring copyright permission, other than the making of an
-exact copy.  The resulting work is called a "modified version" of the
-earlier work or a work "based on" the earlier work.
-
-  A "covered work" means either the unmodified Program or a work based
-on the Program.
-
-  To "propagate" a work means to do anything with it that, without
-permission, would make you directly or secondarily liable for
-infringement under applicable copyright law, except executing it on a
-computer or modifying a private copy.  Propagation includes copying,
-distribution (with or without modification), making available to the
-public, and in some countries other activities as well.
-
-  To "convey" a work means any kind of propagation that enables other
-parties to make or receive copies.  Mere interaction with a user through
-a computer network, with no transfer of a copy, is not conveying.
-
-  An interactive user interface displays "Appropriate Legal Notices"
-to the extent that it includes a convenient and prominently visible
-feature that (1) displays an appropriate copyright notice, and (2)
-tells the user that there is no warranty for the work (except to the
-extent that warranties are provided), that licensees may convey the
-work under this License, and how to view a copy of this License.  If
-the interface presents a list of user commands or options, such as a
-menu, a prominent item in the list meets this criterion.
-
-  1. Source Code.
-
-  The "source code" for a work means the preferred form of the work
-for making modifications to it.  "Object code" means any non-source
-form of a work.
-
-  A "Standard Interface" means an interface that either is an official
-standard defined by a recognized standards body, or, in the case of
-interfaces specified for a particular programming language, one that
-is widely used among developers working in that language.
-
-  The "System Libraries" of an executable work include anything, other
-than the work as a whole, that (a) is included in the normal form of
-packaging a Major Component, but which is not part of that Major
-Component, and (b) serves only to enable use of the work with that
-Major Component, or to implement a Standard Interface for which an
-implementation is available to the public in source code form.  A
-"Major Component", in this context, means a major essential component
-(kernel, window system, and so on) of the specific operating system
-(if any) on which the executable work runs, or a compiler used to
-produce the work, or an object code interpreter used to run it.
-
-  The "Corresponding Source" for a work in object code form means all
-the source code needed to generate, install, and (for an executable
-work) run the object code and to modify the work, including scripts to
-control those activities.  However, it does not include the work's
-System Libraries, or general-purpose tools or generally available free
-programs which are used unmodified in performing those activities but
-which are not part of the work.  For example, Corresponding Source
-includes interface definition files associated with source files for
-the work, and the source code for shared libraries and dynamically
-linked subprograms that the work is specifically designed to require,
-such as by intimate data communication or control flow between those
-subprograms and other parts of the work.
-
-  The Corresponding Source need not include anything that users
-can regenerate automatically from other parts of the Corresponding
-Source.
-
-  The Corresponding Source for a work in source code form is that
-same work.
-
-  2. Basic Permissions.
-
-  All rights granted under this License are granted for the term of
-copyright on the Program, and are irrevocable provided the stated
-conditions are met.  This License explicitly affirms your unlimited
-permission to run the unmodified Program.  The output from running a
-covered work is covered by this License only if the output, given its
-content, constitutes a covered work.  This License acknowledges your
-rights of fair use or other equivalent, as provided by copyright law.
-
-  You may make, run and propagate covered works that you do not
-convey, without conditions so long as your license otherwise remains
-in force.  You may convey covered works to others for the sole purpose
-of having them make modifications exclusively for you, or provide you
-with facilities for running those works, provided that you comply with
-the terms of this License in conveying all material for which you do
-not control copyright.  Those thus making or running the covered works
-for you must do so exclusively on your behalf, under your direction
-and control, on terms that prohibit them from making any copies of
-your copyrighted material outside their relationship with you.
-
-  Conveying under any other circumstances is permitted solely under
-the conditions stated below.  Sublicensing is not allowed; section 10
-makes it unnecessary.
-
-  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
-
-  No covered work shall be deemed part of an effective technological
-measure under any applicable law fulfilling obligations under article
-11 of the WIPO copyright treaty adopted on 20 December 1996, or
-similar laws prohibiting or restricting circumvention of such
-measures.
-
-  When you convey a covered work, you waive any legal power to forbid
-circumvention of technological measures to the extent such circumvention
-is effected by exercising rights under this License with respect to
-the covered work, and you disclaim any intention to limit operation or
-modification of the work as a means of enforcing, against the work's
-users, your or third parties' legal rights to forbid circumvention of
-technological measures.
-
-  4. Conveying Verbatim Copies.
-
-  You may convey verbatim copies of the Program's source code as you
-receive it, in any medium, provided that you conspicuously and
-appropriately publish on each copy an appropriate copyright notice;
-keep intact all notices stating that this License and any
-non-permissive terms added in accord with section 7 apply to the code;
-keep intact all notices of the absence of any warranty; and give all
-recipients a copy of this License along with the Program.
-
-  You may charge any price or no price for each copy that you convey,
-and you may offer support or warranty protection for a fee.
-
-  5. Conveying Modified Source Versions.
-
-  You may convey a work based on the Program, or the modifications to
-produce it from the Program, in the form of source code under the
-terms of section 4, provided that you also meet all of these conditions:
-
-    a) The work must carry prominent notices stating that you modified
-    it, and giving a relevant date.
-
-    b) The work must carry prominent notices stating that it is
-    released under this License and any conditions added under section
-    7.  This requirement modifies the requirement in section 4 to
-    "keep intact all notices".
-
-    c) You must license the entire work, as a whole, under this
-    License to anyone who comes into possession of a copy.  This
-    License will therefore apply, along with any applicable section 7
-    additional terms, to the whole of the work, and all its parts,
-    regardless of how they are packaged.  This License gives no
-    permission to license the work in any other way, but it does not
-    invalidate such permission if you have separately received it.
-
-    d) If the work has interactive user interfaces, each must display
-    Appropriate Legal Notices; however, if the Program has interactive
-    interfaces that do not display Appropriate Legal Notices, your
-    work need not make them do so.
-
-  A compilation of a covered work with other separate and independent
-works, which are not by their nature extensions of the covered work,
-and which are not combined with it such as to form a larger program,
-in or on a volume of a storage or distribution medium, is called an
-"aggregate" if the compilation and its resulting copyright are not
-used to limit the access or legal rights of the compilation's users
-beyond what the individual works permit.  Inclusion of a covered work
-in an aggregate does not cause this License to apply to the other
-parts of the aggregate.
-
-  6. Conveying Non-Source Forms.
-
-  You may convey a covered work in object code form under the terms
-of sections 4 and 5, provided that you also convey the
-machine-readable Corresponding Source under the terms of this License,
-in one of these ways:
-
-    a) Convey the object code in, or embodied in, a physical product
-    (including a physical distribution medium), accompanied by the
-    Corresponding Source fixed on a durable physical medium
-    customarily used for software interchange.
-
-    b) Convey the object code in, or embodied in, a physical product
-    (including a physical distribution medium), accompanied by a
-    written offer, valid for at least three years and valid for as
-    long as you offer spare parts or customer support for that product
-    model, to give anyone who possesses the object code either (1) a
-    copy of the Corresponding Source for all the software in the
-    product that is covered by this License, on a durable physical
-    medium customarily used for software interchange, for a price no
-    more than your reasonable cost of physically performing this
-    conveying of source, or (2) access to copy the
-    Corresponding Source from a network server at no charge.
-
-    c) Convey individual copies of the object code with a copy of the
-    written offer to provide the Corresponding Source.  This
-    alternative is allowed only occasionally and noncommercially, and
-    only if you received the object code with such an offer, in accord
-    with subsection 6b.
-
-    d) Convey the object code by offering access from a designated
-    place (gratis or for a charge), and offer equivalent access to the
-    Corresponding Source in the same way through the same place at no
-    further charge.  You need not require recipients to copy the
-    Corresponding Source along with the object code.  If the place to
-    copy the object code is a network server, the Corresponding Source
-    may be on a different server (operated by you or a third party)
-    that supports equivalent copying facilities, provided you maintain
-    clear directions next to the object code saying where to find the
-    Corresponding Source.  Regardless of what server hosts the
-    Corresponding Source, you remain obligated to ensure that it is
-    available for as long as needed to satisfy these requirements.
-
-    e) Convey the object code using peer-to-peer transmission, provided
-    you inform other peers where the object code and Corresponding
-    Source of the work are being offered to the general public at no
-    charge under subsection 6d.
-
-  A separable portion of the object code, whose source code is excluded
-from the Corresponding Source as a System Library, need not be
-included in conveying the object code work.
-
-  A "User Product" is either (1) a "consumer product", which means any
-tangible personal property which is normally used for personal, family,
-or household purposes, or (2) anything designed or sold for incorporation
-into a dwelling.  In determining whether a product is a consumer product,
-doubtful cases shall be resolved in favor of coverage.  For a particular
-product received by a particular user, "normally used" refers to a
-typical or common use of that class of product, regardless of the status
-of the particular user or of the way in which the particular user
-actually uses, or expects or is expected to use, the product.  A product
-is a consumer product regardless of whether the product has substantial
-commercial, industrial or non-consumer uses, unless such uses represent
-the only significant mode of use of the product.
-
-  "Installation Information" for a User Product means any methods,
-procedures, authorization keys, or other information required to install
-and execute modified versions of a covered work in that User Product from
-a modified version of its Corresponding Source.  The information must
-suffice to ensure that the continued functioning of the modified object
-code is in no case prevented or interfered with solely because
-modification has been made.
-
-  If you convey an object code work under this section in, or with, or
-specifically for use in, a User Product, and the conveying occurs as
-part of a transaction in which the right of possession and use of the
-User Product is transferred to the recipient in perpetuity or for a
-fixed term (regardless of how the transaction is characterized), the
-Corresponding Source conveyed under this section must be accompanied
-by the Installation Information.  But this requirement does not apply
-if neither you nor any third party retains the ability to install
-modified object code on the User Product (for example, the work has
-been installed in ROM).
-
-  The requirement to provide Installation Information does not include a
-requirement to continue to provide support service, warranty, or updates
-for a work that has been modified or installed by the recipient, or for
-the User Product in which it has been modified or installed.  Access to a
-network may be denied when the modification itself materially and
-adversely affects the operation of the network or violates the rules and
-protocols for communication across the network.
-
-  Corresponding Source conveyed, and Installation Information provided,
-in accord with this section must be in a format that is publicly
-documented (and with an implementation available to the public in
-source code form), and must require no special password or key for
-unpacking, reading or copying.
-
-  7. Additional Terms.
-
-  "Additional permissions" are terms that supplement the terms of this
-License by making exceptions from one or more of its conditions.
-Additional permissions that are applicable to the entire Program shall
-be treated as though they were included in this License, to the extent
-that they are valid under applicable law.  If additional permissions
-apply only to part of the Program, that part may be used separately
-under those permissions, but the entire Program remains governed by
-this License without regard to the additional permissions.
-
-  When you convey a copy of a covered work, you may at your option
-remove any additional permissions from that copy, or from any part of
-it.  (Additional permissions may be written to require their own
-removal in certain cases when you modify the work.)  You may place
-additional permissions on material, added by you to a covered work,
-for which you have or can give appropriate copyright permission.
-
-  Notwithstanding any other provision of this License, for material you
-add to a covered work, you may (if authorized by the copyright holders of
-that material) supplement the terms of this License with terms:
-
-    a) Disclaiming warranty or limiting liability differently from the
-    terms of sections 15 and 16 of this License; or
-
-    b) Requiring preservation of specified reasonable legal notices or
-    author attributions in that material or in the Appropriate Legal
-    Notices displayed by works containing it; or
-
-    c) Prohibiting misrepresentation of the origin of that material, or
-    requiring that modified versions of such material be marked in
-    reasonable ways as different from the original version; or
-
-    d) Limiting the use for publicity purposes of names of licensors or
-    authors of the material; or
-
-    e) Declining to grant rights under trademark law for use of some
-    trade names, trademarks, or service marks; or
-
-    f) Requiring indemnification of licensors and authors of that
-    material by anyone who conveys the material (or modified versions of
-    it) with contractual assumptions of liability to the recipient, for
-    any liability that these contractual assumptions directly impose on
-    those licensors and authors.
-
-  All other non-permissive additional terms are considered "further
-restrictions" within the meaning of section 10.  If the Program as you
-received it, or any part of it, contains a notice stating that it is
-governed by this License along with a term that is a further
-restriction, you may remove that term.  If a license document contains
-a further restriction but permits relicensing or conveying under this
-License, you may add to a covered work material governed by the terms
-of that license document, provided that the further restriction does
-not survive such relicensing or conveying.
-
-  If you add terms to a covered work in accord with this section, you
-must place, in the relevant source files, a statement of the
-additional terms that apply to those files, or a notice indicating
-where to find the applicable terms.
-
-  Additional terms, permissive or non-permissive, may be stated in the
-form of a separately written license, or stated as exceptions;
-the above requirements apply either way.
-
-  8. Termination.
-
-  You may not propagate or modify a covered work except as expressly
-provided under this License.  Any attempt otherwise to propagate or
-modify it is void, and will automatically terminate your rights under
-this License (including any patent licenses granted under the third
-paragraph of section 11).
-
-  However, if you cease all violation of this License, then your
-license from a particular copyright holder is reinstated (a)
-provisionally, unless and until the copyright holder explicitly and
-finally terminates your license, and (b) permanently, if the copyright
-holder fails to notify you of the violation by some reasonable means
-prior to 60 days after the cessation.
-
-  Moreover, your license from a particular copyright holder is
-reinstated permanently if the copyright holder notifies you of the
-violation by some reasonable means, this is the first time you have
-received notice of violation of this License (for any work) from that
-copyright holder, and you cure the violation prior to 30 days after
-your receipt of the notice.
-
-  Termination of your rights under this section does not terminate the
-licenses of parties who have received copies or rights from you under
-this License.  If your rights have been terminated and not permanently
-reinstated, you do not qualify to receive new licenses for the same
-material under section 10.
-
-  9. Acceptance Not Required for Having Copies.
-
-  You are not required to accept this License in order to receive or
-run a copy of the Program.  Ancillary propagation of a covered work
-occurring solely as a consequence of using peer-to-peer transmission
-to receive a copy likewise does not require acceptance.  However,
-nothing other than this License grants you permission to propagate or
-modify any covered work.  These actions infringe copyright if you do
-not accept this License.  Therefore, by modifying or propagating a
-covered work, you indicate your acceptance of this License to do so.
-
-  10. Automatic Licensing of Downstream Recipients.
-
-  Each time you convey a covered work, the recipient automatically
-receives a license from the original licensors, to run, modify and
-propagate that work, subject to this License.  You are not responsible
-for enforcing compliance by third parties with this License.
-
-  An "entity transaction" is a transaction transferring control of an
-organization, or substantially all assets of one, or subdividing an
-organization, or merging organizations.  If propagation of a covered
-work results from an entity transaction, each party to that
-transaction who receives a copy of the work also receives whatever
-licenses to the work the party's predecessor in interest had or could
-give under the previous paragraph, plus a right to possession of the
-Corresponding Source of the work from the predecessor in interest, if
-the predecessor has it or can get it with reasonable efforts.
-
-  You may not impose any further restrictions on the exercise of the
-rights granted or affirmed under this License.  For example, you may
-not impose a license fee, royalty, or other charge for exercise of
-rights granted under this License, and you may not initiate litigation
-(including a cross-claim or counterclaim in a lawsuit) alleging that
-any patent claim is infringed by making, using, selling, offering for
-sale, or importing the Program or any portion of it.
-
-  11. Patents.
-
-  A "contributor" is a copyright holder who authorizes use under this
-License of the Program or a work on which the Program is based.  The
-work thus licensed is called the contributor's "contributor version".
-
-  A contributor's "essential patent claims" are all patent claims
-owned or controlled by the contributor, whether already acquired or
-hereafter acquired, that would be infringed by some manner, permitted
-by this License, of making, using, or selling its contributor version,
-but do not include claims that would be infringed only as a
-consequence of further modification of the contributor version.  For
-purposes of this definition, "control" includes the right to grant
-patent sublicenses in a manner consistent with the requirements of
-this License.
-
-  Each contributor grants you a non-exclusive, worldwide, royalty-free
-patent license under the contributor's essential patent claims, to
-make, use, sell, offer for sale, import and otherwise run, modify and
-propagate the contents of its contributor version.
-
-  In the following three paragraphs, a "patent license" is any express
-agreement or commitment, however denominated, not to enforce a patent
-(such as an express permission to practice a patent or covenant not to
-sue for patent infringement).  To "grant" such a patent license to a
-party means to make such an agreement or commitment not to enforce a
-patent against the party.
-
-  If you convey a covered work, knowingly relying on a patent license,
-and the Corresponding Source of the work is not available for anyone
-to copy, free of charge and under the terms of this License, through a
-publicly available network server or other readily accessible means,
-then you must either (1) cause the Corresponding Source to be so
-available, or (2) arrange to deprive yourself of the benefit of the
-patent license for this particular work, or (3) arrange, in a manner
-consistent with the requirements of this License, to extend the patent
-license to downstream recipients.  "Knowingly relying" means you have
-actual knowledge that, but for the patent license, your conveying the
-covered work in a country, or your recipient's use of the covered work
-in a country, would infringe one or more identifiable patents in that
-country that you have reason to believe are valid.
-
-  If, pursuant to or in connection with a single transaction or
-arrangement, you convey, or propagate by procuring conveyance of, a
-covered work, and grant a patent license to some of the parties
-receiving the covered work authorizing them to use, propagate, modify
-or convey a specific copy of the covered work, then the patent license
-you grant is automatically extended to all recipients of the covered
-work and works based on it.
-
-  A patent license is "discriminatory" if it does not include within
-the scope of its coverage, prohibits the exercise of, or is
-conditioned on the non-exercise of one or more of the rights that are
-specifically granted under this License.  You may not convey a covered
-work if you are a party to an arrangement with a third party that is
-in the business of distributing software, under which you make payment
-to the third party based on the extent of your activity of conveying
-the work, and under which the third party grants, to any of the
-parties who would receive the covered work from you, a discriminatory
-patent license (a) in connection with copies of the covered work
-conveyed by you (or copies made from those copies), or (b) primarily
-for and in connection with specific products or compilations that
-contain the covered work, unless you entered into that arrangement,
-or that patent license was granted, prior to 28 March 2007.
-
-  Nothing in this License shall be construed as excluding or limiting
-any implied license or other defenses to infringement that may
-otherwise be available to you under applicable patent law.
-
-  12. No Surrender of Others' Freedom.
-
-  If conditions are imposed on you (whether by court order, agreement or
-otherwise) that contradict the conditions of this License, they do not
-excuse you from the conditions of this License.  If you cannot convey a
-covered work so as to satisfy simultaneously your obligations under this
-License and any other pertinent obligations, then as a consequence you may
-not convey it at all.  For example, if you agree to terms that obligate you
-to collect a royalty for further conveying from those to whom you convey
-the Program, the only way you could satisfy both those terms and this
-License would be to refrain entirely from conveying the Program.
-
-  13. Use with the GNU Affero General Public License.
-
-  Notwithstanding any other provision of this License, you have
-permission to link or combine any covered work with a work licensed
-under version 3 of the GNU Affero General Public License into a single
-combined work, and to convey the resulting work.  The terms of this
-License will continue to apply to the part which is the covered work,
-but the special requirements of the GNU Affero General Public License,
-section 13, concerning interaction through a network will apply to the
-combination as such.
-
-  14. Revised Versions of this License.
-
-  The Free Software Foundation may publish revised and/or new versions of
-the GNU General Public License from time to time.  Such new versions will
-be similar in spirit to the present version, but may differ in detail to
-address new problems or concerns.
-
-  Each version is given a distinguishing version number.  If the
-Program specifies that a certain numbered version of the GNU General
-Public License "or any later version" applies to it, you have the
-option of following the terms and conditions either of that numbered
-version or of any later version published by the Free Software
-Foundation.  If the Program does not specify a version number of the
-GNU General Public License, you may choose any version ever published
-by the Free Software Foundation.
-
-  If the Program specifies that a proxy can decide which future
-versions of the GNU General Public License can be used, that proxy's
-public statement of acceptance of a version permanently authorizes you
-to choose that version for the Program.
-
-  Later license versions may give you additional or different
-permissions.  However, no additional obligations are imposed on any
-author or copyright holder as a result of your choosing to follow a
-later version.
-
-  15. Disclaimer of Warranty.
-
-  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
-APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
-HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
-OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
-THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
-PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
-IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
-ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
-
-  16. Limitation of Liability.
-
-  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
-WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
-THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
-GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
-USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
-DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
-PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
-EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
-SUCH DAMAGES.
-
-  17. Interpretation of Sections 15 and 16.
-
-  If the disclaimer of warranty and limitation of liability provided
-above cannot be given local legal effect according to their terms,
-reviewing courts shall apply local law that most closely approximates
-an absolute waiver of all civil liability in connection with the
-Program, unless a warranty or assumption of liability accompanies a
-copy of the Program in return for a fee.
-
-                     END OF TERMS AND CONDITIONS
-
-            How to Apply These Terms to Your New Programs
-
-  If you develop a new program, and you want it to be of the greatest
-possible use to the public, the best way to achieve this is to make it
-free software which everyone can redistribute and change under these terms.
-
-  To do so, attach the following notices to the program.  It is safest
-to attach them to the start of each source file to most effectively
-state the exclusion of warranty; and each file should have at least
-the "copyright" line and a pointer to where the full notice is found.
-
-    <one line to give the program's name and a brief idea of what it does.>
-    Copyright (C) <year>  <name of author>
-
-    This program is free software: you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-    the Free Software Foundation, either version 3 of the License, or
-    (at your option) any later version.
-
-    This program is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-    GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-Also add information on how to contact you by electronic and paper mail.
-
-  If the program does terminal interaction, make it output a short
-notice like this when it starts in an interactive mode:
-
-    <program>  Copyright (C) <year>  <name of author>
-    This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
-    This is free software, and you are welcome to redistribute it
-    under certain conditions; type `show c' for details.
-
-The hypothetical commands `show w' and `show c' should show the appropriate
-parts of the General Public License.  Of course, your program's commands
-might be different; for a GUI interface, you would use an "about box".
-
-  You should also get your employer (if you work as a programmer) or school,
-if any, to sign a "copyright disclaimer" for the program, if necessary.
-For more information on this, and how to apply and follow the GNU GPL, see
-<http://www.gnu.org/licenses/>.
-
-  The GNU General Public License does not permit incorporating your program
-into proprietary programs.  If your program is a subroutine library, you
-may consider it more useful to permit linking proprietary applications with
-the library.  If this is what you want to do, use the GNU Lesser General
-Public License instead of this License.  But first, please read
-<http://www.gnu.org/philosophy/why-not-lgpl.html>.
+
    +                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
    diff --git a/dependency-check-core/plugin-updates-report.html b/dependency-check-core/plugin-updates-report.html index b00e96940..9a813d09d 100644 --- a/dependency-check-core/plugin-updates-report.html +++ b/dependency-check-core/plugin-updates-report.html @@ -1,13 +1,13 @@ - + dependency-check-core - Plugin Updates Report @@ -54,7 +54,7 @@
  • - +
  • /
    • @@ -67,8 +67,8 @@ -
  • Last Published: 2014-01-16
  • |
    • -
  • Version: 1.0.8
    • +
  • Last Published: 2014-01-26
  • |
    • +
  • Version: 1.1.0
    • @@ -88,7 +88,7 @@ Project Information - +
  • @@ -184,6 +184,13 @@ FindBugs Report
    • + +
  • + + + + JavaNCSS Report +
    • diff --git a/dependency-check-core/pmd.html b/dependency-check-core/pmd.html index 54226da30..64d7d0b47 100644 --- a/dependency-check-core/pmd.html +++ b/dependency-check-core/pmd.html @@ -1,13 +1,13 @@ - + dependency-check-core - PMD Results @@ -54,7 +54,7 @@
  • - +
  • /
    • @@ -67,8 +67,8 @@ -
  • Last Published: 2014-01-16
  • |
    • -
  • Version: 1.0.8
    • +
  • Last Published: 2014-01-26
  • |
    • +
  • Version: 1.1.0
    • @@ -88,7 +88,7 @@ Project Information - +
  • @@ -184,6 +184,13 @@ FindBugs Report
    • + +
  • + + + + JavaNCSS Report +
    • @@ -228,127 +235,118 @@ Line These nested if statements could be combined -140 - 143 +136 - 139 These nested if statements could be combined -305 - 308 +297 - 300 + +These nested if statements could be combined +311 - 314

    org/owasp/dependencycheck/analyzer/CPEAnalyzer.java

    - + - + - - - - + - + -
    Violation Line
    Useless parentheses.190
    These nested if statements could be combined573 - 578
    182
    These nested if statements could be combined574 - 577
    551 - 556
    These nested if statements could be combined583 - 586
    +552 - 555 + +These nested if statements could be combined +561 - 564

    org/owasp/dependencycheck/analyzer/DependencyBundlingAnalyzer.java

    - + - + -
    Violation Line
    These nested if statements could be combined235 - 237
    +245 - 247

    org/owasp/dependencycheck/analyzer/FalsePositiveAnalyzer.java

    - + - + -
    Violation Line
    These nested if statements could be combined154 - 175
    +151 - 172

    org/owasp/dependencycheck/analyzer/JarAnalyzer.java

    - + - - - - + - -
    Violation Line
    Useless parentheses.329
    Useless parentheses.849
    356
    Avoid unused method parameters such as 'classes'.987
    +These nested if statements could be combined +891 - 894 + +Useless parentheses. +984

    org/owasp/dependencycheck/analyzer/JavaScriptAnalyzer.java

    - + - + -
    Violation Line
    Avoid unused local variables such as 'extractComments'.99
    +95

    org/owasp/dependencycheck/analyzer/NvdCveAnalyzer.java

    - + - + -
    Violation Line
    Useless parentheses.78
    -
    -

    org/owasp/dependencycheck/concurrency/DirectorySpinLock.java

    - - - - - - -
    ViolationLine
    These nested if statements could be combined243 - 248
    +75

    org/owasp/dependencycheck/data/cpe/IndexEntry.java

    - + - - - -
    Violation Line
    Useless parentheses.171
    Useless parentheses.174
    +172 + +Useless parentheses. +175

    org/owasp/dependencycheck/data/nvdcve/ConnectionFactory.java

    - + - + -
    Violation Line
    These nested if statements could be combined147 - 149
    +154 - 156

    org/owasp/dependencycheck/data/nvdcve/CveDB.java

    - + - - - - + - + -
    Violation Line
    Avoid empty if statements120 - 123
    Avoid unused private fields such as 'SELECT_PROPERTY'.241
    240
    Avoid unused private fields such as 'DELETE_PROPERTY'.253
    252
    Useless parentheses.720
    +722

    org/owasp/dependencycheck/data/nvdcve/DriverShim.java

    @@ -357,7 +355,7 @@ -
    Line
    Useless parentheses.168
    +167

    org/owasp/dependencycheck/data/update/StandardUpdate.java

    @@ -366,7 +364,7 @@ -
    Line
    Useless parentheses.119
    +114

    org/owasp/dependencycheck/dependency/Dependency.java

    @@ -375,28 +373,28 @@ - - - - - - - - - - - - - - - - - - -
    Line
    Useless parentheses.493
    Useless parentheses.496
    Useless parentheses.499
    Useless parentheses.502
    Useless parentheses.505
    Useless parentheses. 508
    Useless parentheses.527
    Useless parentheses.530
    +511 + +Useless parentheses. +514 + +Useless parentheses. +517 + +Useless parentheses. +520 + +Useless parentheses. +523 + +Useless parentheses. +542 + +Useless parentheses. +545

    org/owasp/dependencycheck/dependency/Evidence.java

    @@ -405,7 +403,7 @@ -
    Line
    Useless parentheses.228
    +202

    org/owasp/dependencycheck/dependency/Identifier.java

    @@ -414,10 +412,10 @@ - + -
    Line
    Useless parentheses.150
    175
    Useless parentheses.153
    +178

    org/owasp/dependencycheck/dependency/Reference.java

    @@ -426,13 +424,13 @@ - + - + -
    Line
    Useless parentheses.111
    109
    Useless parentheses.114
    112
    Useless parentheses.117
    +115

    org/owasp/dependencycheck/dependency/Vulnerability.java

    @@ -441,7 +439,7 @@ -
    Line
    Useless parentheses.375
    +373

    org/owasp/dependencycheck/dependency/VulnerableSoftware.java

    @@ -453,10 +451,10 @@ - + -
    139
    Useless parentheses.179
    178
    Useless parentheses.184
    +183

    org/owasp/dependencycheck/suppression/PropertyType.java

    @@ -465,7 +463,7 @@ -
    Line
    Useless parentheses.164
    +161

    org/owasp/dependencycheck/utils/Checksum.java

    @@ -483,10 +481,10 @@ - + -
    Line
    Useless parentheses.138
    135
    Useless parentheses.198
    +194 diff --git a/dependency-check-core/project-info.html b/dependency-check-core/project-info.html index fa76c26af..fb4599a12 100644 --- a/dependency-check-core/project-info.html +++ b/dependency-check-core/project-info.html @@ -1,13 +1,13 @@ - + dependency-check-core - Project Information @@ -54,7 +54,7 @@
  • - +
  • /
    • @@ -67,8 +67,8 @@ -
  • Last Published: 2014-01-16
  • |
    • -
  • Version: 1.0.8
    • +
  • Last Published: 2014-01-26
  • |
    • +
  • Version: 1.1.0
    • @@ -109,7 +109,7 @@ - +
  • @@ -156,7 +156,7 @@ Description About -Dependency-check is a utility that attempts to detect publicly disclosed vulnerabilities contained within project dependencies. It does this by determining if there is a Common Platform Enumeration (CPE) identifier for a given dependency. If found, it will generate a report linking to the associated CVE entries. +dependency-check is a utility that identifies project dependencies and checks if there are any known, publicly disclosed, vulnerabilities. This tool can be part of the solution to the OWASP Top 10 2013: A9 - Using Components with Known Vulnerabilities. Project Summary This document lists other related information of this project diff --git a/dependency-check-core/project-reports.html b/dependency-check-core/project-reports.html index c392b7091..b4c161ccd 100644 --- a/dependency-check-core/project-reports.html +++ b/dependency-check-core/project-reports.html @@ -1,13 +1,13 @@ - + dependency-check-core - Generated Reports @@ -54,7 +54,7 @@
  • - +
  • /
    • @@ -67,8 +67,8 @@ -
  • Last Published: 2014-01-16
  • |
    • -
  • Version: 1.0.8
    • +
  • Last Published: 2014-01-26
  • |
    • +
  • Version: 1.1.0
    • @@ -88,7 +88,7 @@ Project Information - +
  • Project Reports @@ -184,6 +184,13 @@ FindBugs Report
    • + +
  • + + + + JavaNCSS Report +
    • @@ -262,7 +269,10 @@ Verification of coding rules. FindBugs Report -Generates a source code report with the FindBugs Library. +Generates a source code report with the FindBugs Library. + +JavaNCSS Report +Code metric analysis. diff --git a/dependency-check-core/project-summary.html b/dependency-check-core/project-summary.html index 569ed372e..a8a32134e 100644 --- a/dependency-check-core/project-summary.html +++ b/dependency-check-core/project-summary.html @@ -1,13 +1,13 @@ - + dependency-check-core - Project Summary @@ -54,7 +54,7 @@
  • - +
  • /
    • @@ -67,8 +67,8 @@ -
  • Last Published: 2014-01-16
  • |
    • -
  • Version: 1.0.8
    • +
  • Last Published: 2014-01-26
  • |
    • +
  • Version: 1.1.0
    • @@ -109,7 +109,7 @@ - +
  • @@ -158,7 +158,7 @@ Dependency-Check Core Description -Dependency-check is a utility that attempts to detect publicly disclosed vulnerabilities contained within project dependencies. It does this by determining if there is a Common Platform Enumeration (CPE) identifier for a given dependency. If found, it will generate a report linking to the associated CVE entries. +dependency-check is a utility that identifies project dependencies and checks if there are any known, publicly disclosed, vulnerabilities. This tool can be part of the solution to the OWASP Top 10 2013: A9 - Using Components with Known Vulnerabilities. Homepage https://github.com/jeremylong/DependencyCheck.git/dependency-check-core @@ -188,7 +188,7 @@ dependency-check-core Version -1.0.8 +1.1.0 Type jar diff --git a/dependency-check-core/surefire-report.html b/dependency-check-core/surefire-report.html index 3e1b7fbfe..926c80385 100644 --- a/dependency-check-core/surefire-report.html +++ b/dependency-check-core/surefire-report.html @@ -1,13 +1,13 @@ - + dependency-check-core - Surefire Report @@ -54,7 +54,7 @@
  • - +
  • /
    • @@ -67,8 +67,8 @@ -
  • Last Published: 2014-01-16
  • |
    • -
  • Version: 1.0.8
    • +
  • Last Published: 2014-01-26
  • |
    • +
  • Version: 1.1.0
    • @@ -88,7 +88,7 @@ Project Information - +
  • @@ -184,6 +184,13 @@ FindBugs Report
    • + +
  • + + + + JavaNCSS Report +
    • @@ -246,12 +253,12 @@ function toggleDisplay(elementId) { Success Rate Time -160 +170 0 0 2 -98.75% -61.49
    +98.824% +51.658

    Note: failures are anticipated and checked for with assertions while errors are unanticipated.


    Package List

    @@ -272,7 +279,7 @@ function toggleDisplay(elementId) { 0 0 100% -2.5 +2.541 org.owasp.dependencycheck.data.cwe 1 @@ -280,7 +287,7 @@ function toggleDisplay(elementId) { 0 0 100% -0 +0.001 org.owasp.dependencycheck.data.nexus 4 @@ -296,7 +303,7 @@ function toggleDisplay(elementId) { 0 0 100% -0.033 +0 org.owasp.dependencycheck.utils 29 @@ -304,7 +311,7 @@ function toggleDisplay(elementId) { 0 0 100% -0.001 +0.057 org.owasp.dependencycheck.data.update.xml 2 @@ -312,24 +319,16 @@ function toggleDisplay(elementId) { 0 0 100% -0.025 +0.084 -org.owasp.dependencycheck.concurrency -3 -0 -0 -0 -100% -9.463 - org.owasp.dependencycheck.analyzer -28 +39 0 0 0 100% -47.94 - +47.497 + org.owasp.dependencycheck.data.update 10 0 @@ -337,31 +336,31 @@ function toggleDisplay(elementId) { 0 100% 0 - + org.owasp.dependencycheck.data.nvdcve -12 +14 0 0 0 100% -0.617 - +0.854 + org.owasp.dependencycheck.suppression 35 0 0 0 100% -0 - +0.018 + org.owasp.dependencycheck.data.lucene 10 0 0 0 100% -0.911 - +0.606 + org.owasp.dependencycheck.data.cpe 1 0 @@ -390,7 +389,7 @@ function toggleDisplay(elementId) { 0 0 100% -2.5
    +2.541

    org.owasp.dependencycheck.data.cwe

    @@ -411,7 +410,7 @@ function toggleDisplay(elementId) { -
    0 0 100%0
    +0.001

    org.owasp.dependencycheck.data.nexus

    @@ -453,7 +452,7 @@ function toggleDisplay(elementId) { - + @@ -483,7 +482,7 @@ function toggleDisplay(elementId) { - + @@ -537,7 +536,7 @@ function toggleDisplay(elementId) { -
    0 0 100%0.033
    0
    VulnerableSoftwareTest0 0 100%0
    0.057
    DependencyVersionTest0 0 100%0.001
    +0

    org.owasp.dependencycheck.data.update.xml

    @@ -558,7 +557,7 @@ function toggleDisplay(elementId) { - + @@ -567,28 +566,7 @@ function toggleDisplay(elementId) { -
    0 0 100%0.001
    0.019
    NvdCve_2_0_HandlerTest0 0 100%0.024
    -
    -

    org.owasp.dependencycheck.concurrency

    - - - - - - - - - - - - - - - - - - -
    ClassTestsErrors FailuresSkippedSuccess RateTime
    DirectorySpinLockTest3000100%9.463
    +0.065

    org.owasp.dependencycheck.analyzer

    @@ -609,7 +587,7 @@ function toggleDisplay(elementId) { - + @@ -618,7 +596,7 @@ function toggleDisplay(elementId) { - + @@ -627,7 +605,7 @@ function toggleDisplay(elementId) { - + @@ -636,7 +614,25 @@ function toggleDisplay(elementId) { - + + + + + + + + + + + + + + + + + + + @@ -645,7 +641,7 @@ function toggleDisplay(elementId) { - + @@ -654,7 +650,7 @@ function toggleDisplay(elementId) { -
    0 0 100%0.046
    0.032
    AnalyzerServiceTest0 0 100%0.804
    0.614
    ArchiveAnalyzerTest0 0 100%37.528
    38.248
    CPEAnalyzerTest0 0 100%8.183
    7.413
    DependencyBundlingAnalyzerTest6000100%0
    FalsePositiveAnalyzerTest5000100%0.001
    FileNameAnalyzerTest0 0 100%0
    0.004
    JarAnalyzerTest0 0 100%1.379
    +1.185

    org.owasp.dependencycheck.data.update

    @@ -705,16 +701,16 @@ function toggleDisplay(elementId) { - + - + - + @@ -723,7 +719,7 @@ function toggleDisplay(elementId) { -
    0 0 100%0.613
    0.763
    DatabasePropertiesTest35 0 0 0 100%0
    0.014
    DriverLoaderTest0 0 100%0.004
    +0.077

    org.owasp.dependencycheck.suppression

    @@ -753,7 +749,7 @@ function toggleDisplay(elementId) { - + @@ -771,7 +767,7 @@ function toggleDisplay(elementId) { -
    0 0 100%0
    0.017
    SuppressionParserTest0 0 100%0
    +0.001

    org.owasp.dependencycheck.data.lucene

    @@ -810,7 +806,7 @@ function toggleDisplay(elementId) { - + @@ -819,7 +815,7 @@ function toggleDisplay(elementId) { -
    0 0 100%0.054
    0
    UrlTokenizingFilterTest0 0 100%0.857
    +0.606

    org.owasp.dependencycheck.data.cpe

    @@ -850,29 +846,83 @@ function toggleDisplay(elementId) { -
    testNewHashSet0.046
    +0.032

    AnalyzerServiceTest

    -
    testGetAnalyzers0.804
    +0.614

    ArchiveAnalyzerTest

    - + - + - + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
    testAnalyzeTar3.83
    3.932
    testAnalyzeTgz31.339
    32.122
    testAnalyze0.4
    0.243
    testGetAnalysisPhase0
    testGetName0.001
    testAnalyze_badZip0.008
    testInitialize0.004
    testAnalyzeTarGz1.937
    testSupportsExtension0.001
    testGetSupportedExtensions0
    +
    +

    CPEAnalyzerTest

    + + + + + + + + + + + + + + + + +
    testSearchCPE0.404
    testDetermineCPE1.481
    testDetermineCPE_full5.528
    testBuildSearch0
    +
    +

    DependencyBundlingAnalyzerTest

    + + + + + @@ -883,50 +933,46 @@ function toggleDisplay(elementId) { - + - - - - - - - - - + -
    testAnalyze0
    testGetAnalysisPhase0
    testAnalyze_badZiptestSupportsExtension 0
    testInitialize0.002
    testAnalyzeTarGz1.956
    testSupportsExtensiontestIsCore 0
    testGetSupportedExtensions0.001
    +0
    -

    CPEAnalyzerTest

    +

    FalsePositiveAnalyzerTest

    - - + + - - + + - - + + - -
    testSearchCPE0.752
    testAnalyze0
    testDetermineCPE1.782
    testGetAnalysisPhase0
    testDetermineCPE_full5.649
    testGetName0
    testBuildSearch0
    +testSupportsExtension +0 + + +testGetSupportedExtensions +0.001

    FileNameAnalyzerTest

    - + @@ -957,38 +1003,23 @@ function toggleDisplay(elementId) { - + - + - + - + -
    testAnalyze0
    0.004
    testClose
    testAnalyze0.545
    0.322
    testGetName0.238
    0.227
    testInterpolateString0.195
    0.241
    testSupportsExtension0.203
    0.196
    testGetSupportedExtensions0.198
    -
    -

    DirectorySpinLockTest

    - - - - - - - - - - - - -
    testObtainSharedLock1.943
    testObtainSharedLock_withContention6.013
    testObtainExclusiveLock1.507
    +0.199

    IndexEntryTest

    @@ -1002,7 +1033,7 @@ function toggleDisplay(elementId) { -
    testGetCweName0
    +0.001

    FieldAnalyzerTest

    @@ -1035,26 +1066,26 @@ function toggleDisplay(elementId) { - + -
    testClear0.045
    0
    testExamples0.009
    +0

    UrlTokenizingFilterTest

    - - + + - - + + -
    testEmptyTerm0.006
    testRandomStrings0.589
    testRandomStrings0.844
    testEmptyTerm0.007
    testExamples0.007
    +0.01

    NexusSearchTest

    @@ -1098,22 +1129,30 @@ function toggleDisplay(elementId) { -
    testGetVulnerabilities0.613
    +0.763

    DatabasePropertiesTest

    - + + + + + + + + + -
    testSave0
    0.005
    testGetProperty_String_String 0
    testGetProperties0.002
    testGetProperty_String0.004
    testIsEmpty0
    +0.003

    DriverLoaderTest

    @@ -1136,11 +1175,11 @@ function toggleDisplay(elementId) { - + -
    testLoad_String_String0
    0.042
    testLoad_String_String_multiple_paths0.004
    +0.035

    NvdCveInfoTest

    @@ -1193,14 +1232,14 @@ function toggleDisplay(elementId) { -
    testParse0.001
    +0.019

    NvdCve_2_0_HandlerTest

    -
    testParse0.024
    +0.065

    DependencyTest

    @@ -1211,7 +1250,7 @@ function toggleDisplay(elementId) { - + @@ -1235,7 +1274,7 @@ function toggleDisplay(elementId) { - + @@ -1247,7 +1286,7 @@ function toggleDisplay(elementId) { - + @@ -1267,7 +1306,7 @@ function toggleDisplay(elementId) { - + @@ -1305,7 +1344,7 @@ function toggleDisplay(elementId) { - + @@ -1335,7 +1374,7 @@ function toggleDisplay(elementId) { -
    testGetSha1sum0.013
    0
    testGetProductEvidence
    testAddIdentifier0.001
    0
    testGetVendorEvidence
    testSetFilePath0.001
    0
    testGetFileName
    testGetMd5sum0.018
    0
    testGetEvidence
    testGenerateXMLReport2.5
    2.541
    testGenerateReport
    testHandler0
    +0.017

    SuppressionParserTest

    @@ -1393,7 +1432,7 @@ function toggleDisplay(elementId) { - + @@ -1468,11 +1507,11 @@ function toggleDisplay(elementId) { - + - + @@ -1566,7 +1605,7 @@ function toggleDisplay(elementId) { - + diff --git a/dependency-check-core/taglist.html b/dependency-check-core/taglist.html index 93bc7c89a..81a164103 100644 --- a/dependency-check-core/taglist.html +++ b/dependency-check-core/taglist.html @@ -1,13 +1,13 @@ - + dependency-check-core - Tag List report @@ -54,7 +54,7 @@
  • - +
  • /
    • @@ -67,8 +67,8 @@ -
  • Last Published: 2014-01-16
  • |
    • -
  • Version: 1.0.8
    • +
  • Last Published: 2014-01-26
  • |
    • +
  • Version: 1.1.0
    • @@ -88,7 +88,7 @@ Project Information - +
  • @@ -184,6 +184,13 @@ FindBugs Report
    • + +
  • + + + + JavaNCSS Report +
    • @@ -225,121 +232,112 @@ - +
    testGetCvssBelow0
    0.001
    testSetFilePath
    testGetChecksum_NoSuchAlgorithm0
    0.056
    testGetChecksum0
    0.001
    testGetMD5Checksum
    testGetDataFile0.001
    0
    testGetLong Tag strings used by tag class
    Todo Work2219 todo, FIXME

    Each tag is detailed below:

    Todo Work

    -

    Number of occurrences found in the code: 22

    +

    Number of occurrences found in the code: 19

    - - + + - + - + - + - + + + + + + + - + - + - + - + - + - - - - - - - - - - - - - - - - - - + + + - - - + + + - - - + + + - - - + + + - - - + + + - - - + + + - - - + + + - + -
    org.owasp.dependencycheck.analyzer.ArchiveAnalyzer Line
    - can we get more evidence from the parent? EAR contains module name, etc.206
    - can we get more evidence from the parent? EAR contains module name, etc. analyze the dependency (i.e. extract files) if it is a supported type.200
    org.owasp.dependencycheck.analyzer.CPEAnalyzer Line
    - likely need to change the split... not sure if this will work for CPE with special chars429
    411
    the following isn't quite right is it? need to think about this guessing game a bit more.570
    548
    org.owasp.dependencycheck.analyzer.CPEAnalyzerTest Line
    - yeah, not a very good test as the results are the same with or without weighting...226
    222
    fix this assert Assert.assertEquals(expResult, result.get(0).getName());234
    230
    org.owasp.dependencycheck.analyzer.DependencyBundlingAnalyzerTestLine
    review the generated test code and remove the default call to fail. fail("The test case is a prototype.");108
    org.owasp.dependencycheck.analyzer.FalsePositiveAnalyzer Line
    fix the version problem below152
    149
    - can we utilize the pom's groupid and artifactId to filter??? most of these are due to low quality data. Other idea would be to say any CPE found based on LOW confidence evidence should have a different CPE type? (this might be a better solution then just removing the URL for "best-guess" matches).264
    258
    move this startswith expression to a configuration file?275
    267
    org.owasp.dependencycheck.analyzer.JarAnalyzer Line
    remove weighting531
    639
    change this to a regex?648
    758
    validate that the starts with is correct... or does it start with a ./ or /? // is it different on different platforms? if (entry.startsWith("META-INF/maven/")) { //trim the meta-inf/maven and pom.xml... final String pomPath = entry.substring(15, entry.length() - 8).toLowerCase(); final String[] parts = pomPath.split("/"); if (parts == null || parts.length != 2) { //misplaced pom? //TODO add logging to FINE possiblePoms.add(entry); } parts[0] = parts[0].replace('.', '/'); parts[1] = parts[1].replace('.', '/'); for (ClassNameInformation cni : classes) { final String name = cni.getName(); if (StringUtils.containsIgnoreCase(name, parts[0])) { addEntry(usePoms, entry); } if (StringUtils.containsIgnoreCase(name, parts[1])) { addEntry(usePoms, entry); } } } else { // we have a JAR file with an incorrect POM layout... //TODO add logging to FINE possiblePoms.add(entry); } } List<String> retValue; if (usePoms.isEmpty()) { if (possiblePoms.isEmpty()) { retValue = pomEntries; } else { retValue = possiblePoms; } } else { retValue = new ArrayList<String>(); int maxCount = 0; for (Map.Entry<String, Integer> entry : usePoms.entrySet()) { final int current = entry.getValue().intValue(); if (current > maxCount) { maxCount = current; retValue.clear(); retValue.add(entry.getKey()); } else if (current == maxCount) { retValue.add(entry.getKey()); } } } return retValue;992
    add logging to FINE possiblePoms.add(entry); } parts[0] = parts[0].replace('.', '/'); parts[1] = parts[1].replace('.', '/'); for (ClassNameInformation cni : classes) { final String name = cni.getName(); if (StringUtils.containsIgnoreCase(name, parts[0])) { addEntry(usePoms, entry); } if (StringUtils.containsIgnoreCase(name, parts[1])) { addEntry(usePoms, entry); } } } else { // we have a JAR file with an incorrect POM layout... //TODO add logging to FINE possiblePoms.add(entry); } } List<String> retValue; if (usePoms.isEmpty()) { if (possiblePoms.isEmpty()) { retValue = pomEntries; } else { retValue = possiblePoms; } } else { retValue = new ArrayList<String>(); int maxCount = 0; for (Map.Entry<String, Integer> entry : usePoms.entrySet()) { final int current = entry.getValue().intValue(); if (current > maxCount) { maxCount = current; retValue.clear(); retValue.add(entry.getKey()); } else if (current == maxCount) { retValue.add(entry.getKey()); } } } return retValue;999
    add logging to FINE possiblePoms.add(entry); } } List<String> retValue; if (usePoms.isEmpty()) { if (possiblePoms.isEmpty()) { retValue = pomEntries; } else { retValue = possiblePoms; } } else { retValue = new ArrayList<String>(); int maxCount = 0; for (Map.Entry<String, Integer> entry : usePoms.entrySet()) { final int current = entry.getValue().intValue(); if (current > maxCount) { maxCount = current; retValue.clear(); retValue.add(entry.getKey()); } else if (current == maxCount) { retValue.add(entry.getKey()); } } } return retValue;1014
    org.owasp.dependencycheck.concurrency.DirectorySpinLockLine
    uncomment this once support for 1.6 is dropped. if (lock != null) { try { lock.close(); } catch (IOException ex) { Logger.getLogger(DirectorySpinLock.class.getName()).log(Level.FINEST, "Unable to close file lock due to IO Exception", ex); } }227
    org.owasp.dependencycheck.data.lucene.SearchVersionAnalyzer Line
    consider implementing payloads/custom attributes... use custom attributes for major, minor, x, x, x, rcx these can then be used to weight the score for searches on the version. see http://lucene.apache.org/core/3_6_1/api/core/org/apache/lucene/analysis/package-summary.html#package_description look at this article to implement http://www.codewrecks.com/blog/index.php/2012/08/25/index-your-blog-using-tags-and-lucene-net/38
    consider implementing payloads/custom attributes... use custom attributes for major, minor, x, x, x, rcx these can then be used to weight the score for searches on the version. see http://lucene.apache.org/core/3_6_1/api/core/org/apache/lucene/analysis/package-summary.html#package_description look at this article to implement http://www.codewrecks.com/blog/index.php/2012/08/25/index-your-blog-using-tags-and-lucene-net/36
    org.owasp.dependencycheck.data.lucene.VersionAnalyzer Line
    consider implementing payloads/custom attributes... use custom attributes for major, minor, x, x, x, rcx these can then be used to weight the score for searches on the version. see http://lucene.apache.org/core/3_6_1/api/core/org/apache/lucene/analysis/package-summary.html#package_description look at this article to implement http://www.codewrecks.com/blog/index.php/2012/08/25/index-your-blog-using-tags-and-lucene-net/37
    consider implementing payloads/custom attributes... use custom attributes for major, minor, x, x, x, rcx these can then be used to weight the score for searches on the version. see http://lucene.apache.org/core/3_6_1/api/core/org/apache/lucene/analysis/package-summary.html#package_description look at this article to implement http://www.codewrecks.com/blog/index.php/2012/08/25/index-your-blog-using-tags-and-lucene-net/36
    org.owasp.dependencycheck.data.lucene.VersionTokenizingFilter Line
    should we also be splitting on dash or underscore? we would need to incorporate the dash or underscore back in...83
    should we also be splitting on dash or underscore? we would need to incorporate the dash or underscore back in...81
    org.owasp.dependencycheck.data.nvdcve.CveDB Line
    consider utilizing the matchThreeVersion method to get additional results. However, this might also introduce false positives.730
    consider utilizing the matchThreeVersion method to get additional results. However, this might also introduce false positives.732
    org.owasp.dependencycheck.data.update.StandardUpdateIntegrationTest Line
    make this an actual test101
    make this an actual test100
    org.owasp.dependencycheck.dependency.EvidenceCollection Line
    consider changing the regex to only compare alpha-numeric (i.e. strip everything else)244
    consider changing the regex to only compare alpha-numeric (i.e. strip everything else)233
    org.owasp.dependencycheck.utils.DependencyVersion Line
    steal better version of code from compareTo140
    steal better version of code from compareTo137
    org.owasp.dependencycheck.utils.Downloader Line
    add the FPR protocol?134
    +130 diff --git a/dependency-check-core/xref-test/allclasses-frame.html b/dependency-check-core/xref-test/allclasses-frame.html index ea437d2c9..aef0025a4 100644 --- a/dependency-check-core/xref-test/allclasses-frame.html +++ b/dependency-check-core/xref-test/allclasses-frame.html @@ -43,6 +43,9 @@
  • DatabasePropertiesTest +
    • +
  • + DependencyBundlingAnalyzerTest
  • DependencyTest @@ -52,9 +55,6 @@
  • DependencyVersionUtilTest -
    • -
  • - DirectorySpinLockTest
  • DownloaderIntegrationTest @@ -67,6 +67,9 @@
  • EngineIntegrationTest +
    • +
  • + FalsePositiveAnalyzerTest
  • FieldAnalyzerTest @@ -112,9 +115,6 @@
  • SettingsTest -
    • -
  • - SpinLockTask
  • StandardUpdateIntegrationTest diff --git a/dependency-check-core/xref-test/index.html b/dependency-check-core/xref-test/index.html index ee1057b2b..a4104d262 100644 --- a/dependency-check-core/xref-test/index.html +++ b/dependency-check-core/xref-test/index.html @@ -4,7 +4,7 @@ - Dependency-Check Core 1.0.8 Reference + Dependency-Check Core 1.1.0 Reference diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/EngineIntegrationTest.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/EngineIntegrationTest.html index ed50360ec..a7d703b14 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/EngineIntegrationTest.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/EngineIntegrationTest.html @@ -9,31 +9,31 @@ 1 /* 2 * This file is part of dependency-check-core. 3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. -18 */ -19 package org.owasp.dependencycheck; -20 -21 import org.owasp.dependencycheck.Engine; -22 import org.owasp.dependencycheck.reporting.ReportGenerator; -23 import org.junit.After; -24 import org.junit.AfterClass; -25 import org.junit.Before; -26 import org.junit.BeforeClass; -27 import org.junit.Test; -28 import static org.junit.Assert.*; +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. +17 */ +18 package org.owasp.dependencycheck; +19 +20 import org.junit.After; +21 import org.junit.AfterClass; +22 import static org.junit.Assert.assertTrue; +23 import org.junit.Before; +24 import org.junit.BeforeClass; +25 import org.junit.Test; +26 import org.owasp.dependencycheck.data.nvdcve.CveDB; +27 import org.owasp.dependencycheck.data.nvdcve.DatabaseProperties; +28 import org.owasp.dependencycheck.reporting.ReportGenerator; 29 30 /** 31 * @@ -70,11 +70,15 @@ 62 instance.scan(testClasses); 63 assertTrue(instance.getDependencies().size() > 0); 64 instance.analyzeDependencies(); -65 ReportGenerator rg = new ReportGenerator("DependencyCheck", -66 instance.getDependencies(), instance.getAnalyzers()); -67 rg.generateReports("./target/", "ALL"); -68 } -69 } +65 CveDB cveDB = new CveDB(); +66 cveDB.open(); +67 DatabaseProperties dbProp = cveDB.getDatabaseProperties(); +68 cveDB.close(); +69 ReportGenerator rg = new ReportGenerator("DependencyCheck", +70 instance.getDependencies(), instance.getAnalyzers(), dbProp); +71 rg.generateReports("./target/", "ALL"); +72 } +73 }
    diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/AbstractAnalyzerTest.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/AbstractAnalyzerTest.html index c7ee10860..84074f184 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/AbstractAnalyzerTest.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/AbstractAnalyzerTest.html @@ -9,68 +9,67 @@ 1 /* 2 * This file is part of dependency-check-core. 3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. -18 */ -19 package org.owasp.dependencycheck.analyzer; -20 -21 import org.owasp.dependencycheck.analyzer.AbstractAnalyzer; -22 import java.util.Set; -23 import org.junit.After; -24 import org.junit.AfterClass; +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. +17 */ +18 package org.owasp.dependencycheck.analyzer; +19 +20 import java.util.Set; +21 import org.junit.After; +22 import org.junit.AfterClass; +23 import static org.junit.Assert.assertEquals; +24 import static org.junit.Assert.assertTrue; 25 import org.junit.Before; 26 import org.junit.BeforeClass; 27 import org.junit.Test; -28 import static org.junit.Assert.*; -29 -30 /** -31 * -32 * @author Jeremy Long <jeremy.long@owasp.org> -33 */ -34 public class AbstractAnalyzerTest { -35 -36 public AbstractAnalyzerTest() { -37 } -38 -39 @BeforeClass -40 public static void setUpClass() throws Exception { -41 } -42 -43 @AfterClass -44 public static void tearDownClass() throws Exception { -45 } -46 -47 @Before -48 public void setUp() { -49 } -50 -51 @After -52 public void tearDown() { -53 } -54 -55 /** -56 * Test of newHashSet method, of class AbstractAnalyzer. -57 */ -58 @Test -59 public void testNewHashSet() { -60 Set result = AbstractAnalyzer.newHashSet("one", "two"); -61 assertEquals(2, result.size()); -62 assertTrue(result.contains("one")); -63 assertTrue(result.contains("two")); -64 } -65 } +28 +29 /** +30 * +31 * @author Jeremy Long <jeremy.long@owasp.org> +32 */ +33 public class AbstractAnalyzerTest { +34 +35 public AbstractAnalyzerTest() { +36 } +37 +38 @BeforeClass +39 public static void setUpClass() throws Exception { +40 } +41 +42 @AfterClass +43 public static void tearDownClass() throws Exception { +44 } +45 +46 @Before +47 public void setUp() { +48 } +49 +50 @After +51 public void tearDown() { +52 } +53 +54 /** +55 * Test of newHashSet method, of class AbstractAnalyzer. +56 */ +57 @Test +58 public void testNewHashSet() { +59 Set result = AbstractAnalyzer.newHashSet("one", "two"); +60 assertEquals(2, result.size()); +61 assertTrue(result.contains("one")); +62 assertTrue(result.contains("two")); +63 } +64 }
    diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/AnalyzerServiceTest.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/AnalyzerServiceTest.html index 690006bbb..b8e64281d 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/AnalyzerServiceTest.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/AnalyzerServiceTest.html @@ -9,78 +9,75 @@ 1 /* 2 * This file is part of dependency-check-core. 3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. -18 */ -19 package org.owasp.dependencycheck.analyzer; -20 -21 import org.owasp.dependencycheck.analyzer.AnalyzerService; -22 import org.owasp.dependencycheck.analyzer.Analyzer; -23 import java.util.Set; -24 import java.util.Iterator; -25 import org.junit.After; -26 import org.junit.AfterClass; -27 import org.junit.Before; -28 import org.junit.BeforeClass; -29 import org.junit.Test; -30 import static org.junit.Assert.*; -31 -32 /** -33 * -34 * @author Jeremy Long <jeremy.long@owasp.org> -35 */ -36 public class AnalyzerServiceTest { +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. +17 */ +18 package org.owasp.dependencycheck.analyzer; +19 +20 import java.util.Iterator; +21 import java.util.Set; +22 import org.junit.After; +23 import org.junit.AfterClass; +24 import static org.junit.Assert.assertTrue; +25 import org.junit.Before; +26 import org.junit.BeforeClass; +27 import org.junit.Test; +28 +29 /** +30 * +31 * @author Jeremy Long <jeremy.long@owasp.org> +32 */ +33 public class AnalyzerServiceTest { +34 +35 public AnalyzerServiceTest() { +36 } 37 -38 public AnalyzerServiceTest() { -39 } -40 -41 @BeforeClass -42 public static void setUpClass() throws Exception { -43 } -44 -45 @AfterClass -46 public static void tearDownClass() throws Exception { -47 } -48 -49 @Before -50 public void setUp() { -51 } -52 -53 @After -54 public void tearDown() { -55 } -56 -57 /** -58 * Test of getAnalyzers method, of class AnalyzerService. -59 */ -60 @Test -61 public void testGetAnalyzers() { -62 AnalyzerService instance = AnalyzerService.getInstance(); -63 Iterator<Analyzer> result = instance.getAnalyzers(); -64 -65 boolean found = false; -66 while (result.hasNext()) { -67 Analyzer a = result.next(); -68 Set<String> e = a.getSupportedExtensions(); -69 if (e != null && e.contains("jar")) { -70 found = true; -71 } -72 } -73 assertTrue("JarAnalyzer loaded", found); -74 } -75 } +38 @BeforeClass +39 public static void setUpClass() throws Exception { +40 } +41 +42 @AfterClass +43 public static void tearDownClass() throws Exception { +44 } +45 +46 @Before +47 public void setUp() { +48 } +49 +50 @After +51 public void tearDown() { +52 } +53 +54 /** +55 * Test of getAnalyzers method, of class AnalyzerService. +56 */ +57 @Test +58 public void testGetAnalyzers() { +59 AnalyzerService instance = AnalyzerService.getInstance(); +60 Iterator<Analyzer> result = instance.getAnalyzers(); +61 +62 boolean found = false; +63 while (result.hasNext()) { +64 Analyzer a = result.next(); +65 Set<String> e = a.getSupportedExtensions(); +66 if (e != null && e.contains("jar")) { +67 found = true; +68 } +69 } +70 assertTrue("JarAnalyzer loaded", found); +71 } +72 }
    diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/ArchiveAnalyzerTest.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/ArchiveAnalyzerTest.html index 933a908df..e5023f18e 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/ArchiveAnalyzerTest.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/ArchiveAnalyzerTest.html @@ -9,270 +9,272 @@ 1 /* 2 * This file is part of dependency-check-core. 3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2013 Jeremy Long. All Rights Reserved. -18 */ -19 package org.owasp.dependencycheck.analyzer; -20 -21 import java.io.File; -22 import java.util.HashSet; -23 import java.util.Set; -24 import org.junit.After; -25 import org.junit.AfterClass; -26 import org.junit.Before; -27 import org.junit.BeforeClass; -28 import org.junit.Test; -29 import org.owasp.dependencycheck.Engine; -30 import org.owasp.dependencycheck.data.cpe.BaseIndexTestCase; -31 import org.owasp.dependencycheck.dependency.Dependency; -32 import org.owasp.dependencycheck.utils.Settings; -33 -34 /** -35 * -36 * @author Jeremy Long <jeremy.long@owasp.org> -37 */ -38 public class ArchiveAnalyzerTest extends BaseIndexTestCase { -39 -40 public ArchiveAnalyzerTest() { -41 } -42 -43 @BeforeClass -44 public static void setUpClass() { -45 } -46 -47 @AfterClass -48 public static void tearDownClass() { -49 } -50 -51 @Before +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2013 Jeremy Long. All Rights Reserved. +17 */ +18 package org.owasp.dependencycheck.analyzer; +19 +20 import java.io.File; +21 import java.util.HashSet; +22 import java.util.Set; +23 import org.junit.After; +24 import org.junit.AfterClass; +25 import org.junit.Before; +26 import org.junit.BeforeClass; +27 import org.junit.Test; +28 import org.owasp.dependencycheck.Engine; +29 import org.owasp.dependencycheck.data.cpe.BaseIndexTestCase; +30 import org.owasp.dependencycheck.dependency.Dependency; +31 import org.owasp.dependencycheck.utils.Settings; +32 +33 /** +34 * +35 * @author Jeremy Long <jeremy.long@owasp.org> +36 */ +37 public class ArchiveAnalyzerTest extends BaseIndexTestCase { +38 +39 public ArchiveAnalyzerTest() { +40 } +41 +42 @BeforeClass +43 public static void setUpClass() { +44 } +45 +46 @AfterClass +47 public static void tearDownClass() { +48 } +49 +50 @Before +51 @Override 52 public void setUp() throws Exception { 53 super.setUp(); 54 } 55 56 @After -57 public void tearDown() throws Exception { -58 super.tearDown(); -59 } -60 -61 /** -62 * Test of getSupportedExtensions method, of class ArchiveAnalyzer. -63 */ -64 @Test -65 public void testGetSupportedExtensions() { -66 ArchiveAnalyzer instance = new ArchiveAnalyzer(); -67 Set expResult = new HashSet<String>(); -68 expResult.add("zip"); -69 expResult.add("war"); -70 expResult.add("ear"); -71 expResult.add("tar"); -72 expResult.add("gz"); -73 expResult.add("tgz"); -74 Set result = instance.getSupportedExtensions(); -75 assertEquals(expResult, result); -76 } -77 -78 /** -79 * Test of getName method, of class ArchiveAnalyzer. -80 */ -81 @Test -82 public void testGetName() { -83 ArchiveAnalyzer instance = new ArchiveAnalyzer(); -84 String expResult = "Archive Analyzer"; -85 String result = instance.getName(); -86 assertEquals(expResult, result); -87 } -88 -89 /** -90 * Test of supportsExtension method, of class ArchiveAnalyzer. -91 */ -92 @Test -93 public void testSupportsExtension() { -94 String extension = "7z"; //not supported -95 ArchiveAnalyzer instance = new ArchiveAnalyzer(); -96 boolean expResult = false; -97 boolean result = instance.supportsExtension(extension); -98 assertEquals(expResult, result); -99 -100 extension = "war"; //supported -101 expResult = true; -102 result = instance.supportsExtension(extension); -103 assertEquals(expResult, result); -104 -105 extension = "ear"; //supported -106 result = instance.supportsExtension(extension); -107 assertEquals(expResult, result); -108 -109 extension = "zip"; //supported -110 result = instance.supportsExtension(extension); -111 assertEquals(expResult, result); -112 } -113 -114 /** -115 * Test of getAnalysisPhase method, of class ArchiveAnalyzer. -116 */ -117 @Test -118 public void testGetAnalysisPhase() { -119 ArchiveAnalyzer instance = new ArchiveAnalyzer(); -120 AnalysisPhase expResult = AnalysisPhase.INITIAL; -121 AnalysisPhase result = instance.getAnalysisPhase(); -122 assertEquals(expResult, result); -123 } -124 -125 /** -126 * Test of initialize and close methods, of class ArchiveAnalyzer. -127 */ -128 @Test -129 public void testInitialize() throws Exception { -130 ArchiveAnalyzer instance = new ArchiveAnalyzer(); -131 instance.initialize(); -132 -133 instance.close(); -134 -135 //no exception means things worked. -136 } -137 -138 /** -139 * Test of analyze method, of class ArchiveAnalyzer. -140 */ -141 @Test -142 public void testAnalyze() throws Exception { -143 ArchiveAnalyzer instance = new ArchiveAnalyzer(); -144 try { -145 instance.initialize(); -146 -147 File file = new File(this.getClass().getClassLoader().getResource("daytrader-ear-2.1.7.ear").getPath()); -148 Dependency dependency = new Dependency(file); -149 Settings.setBoolean(Settings.KEYS.AUTO_UPDATE, false); -150 Engine engine = new Engine(); -151 -152 int initial_size = engine.getDependencies().size(); -153 instance.analyze(dependency, engine); -154 int ending_size = engine.getDependencies().size(); -155 -156 assertTrue(initial_size < ending_size); -157 -158 } finally { -159 instance.close(); -160 } -161 } -162 -163 /** -164 * Test of analyze method, of class ArchiveAnalyzer. -165 */ -166 @Test -167 public void testAnalyzeTar() throws Exception { -168 ArchiveAnalyzer instance = new ArchiveAnalyzer(); -169 try { -170 instance.initialize(); -171 -172 File file = new File(this.getClass().getClassLoader().getResource("file.tar").getPath()); -173 Dependency dependency = new Dependency(file); -174 Settings.setBoolean(Settings.KEYS.AUTO_UPDATE, false); -175 Engine engine = new Engine(); -176 -177 int initial_size = engine.getDependencies().size(); -178 instance.analyze(dependency, engine); -179 int ending_size = engine.getDependencies().size(); -180 -181 assertTrue(initial_size < ending_size); +57 @Override +58 public void tearDown() throws Exception { +59 super.tearDown(); +60 } +61 +62 /** +63 * Test of getSupportedExtensions method, of class ArchiveAnalyzer. +64 */ +65 @Test +66 public void testGetSupportedExtensions() { +67 ArchiveAnalyzer instance = new ArchiveAnalyzer(); +68 Set expResult = new HashSet<String>(); +69 expResult.add("zip"); +70 expResult.add("war"); +71 expResult.add("ear"); +72 expResult.add("tar"); +73 expResult.add("gz"); +74 expResult.add("tgz"); +75 Set result = instance.getSupportedExtensions(); +76 assertEquals(expResult, result); +77 } +78 +79 /** +80 * Test of getName method, of class ArchiveAnalyzer. +81 */ +82 @Test +83 public void testGetName() { +84 ArchiveAnalyzer instance = new ArchiveAnalyzer(); +85 String expResult = "Archive Analyzer"; +86 String result = instance.getName(); +87 assertEquals(expResult, result); +88 } +89 +90 /** +91 * Test of supportsExtension method, of class ArchiveAnalyzer. +92 */ +93 @Test +94 public void testSupportsExtension() { +95 String extension = "7z"; //not supported +96 ArchiveAnalyzer instance = new ArchiveAnalyzer(); +97 boolean expResult = false; +98 boolean result = instance.supportsExtension(extension); +99 assertEquals(expResult, result); +100 +101 extension = "war"; //supported +102 expResult = true; +103 result = instance.supportsExtension(extension); +104 assertEquals(expResult, result); +105 +106 extension = "ear"; //supported +107 result = instance.supportsExtension(extension); +108 assertEquals(expResult, result); +109 +110 extension = "zip"; //supported +111 result = instance.supportsExtension(extension); +112 assertEquals(expResult, result); +113 } +114 +115 /** +116 * Test of getAnalysisPhase method, of class ArchiveAnalyzer. +117 */ +118 @Test +119 public void testGetAnalysisPhase() { +120 ArchiveAnalyzer instance = new ArchiveAnalyzer(); +121 AnalysisPhase expResult = AnalysisPhase.INITIAL; +122 AnalysisPhase result = instance.getAnalysisPhase(); +123 assertEquals(expResult, result); +124 } +125 +126 /** +127 * Test of initialize and close methods, of class ArchiveAnalyzer. +128 */ +129 @Test +130 public void testInitialize() throws Exception { +131 ArchiveAnalyzer instance = new ArchiveAnalyzer(); +132 instance.initialize(); +133 +134 instance.close(); +135 +136 //no exception means things worked. +137 } +138 +139 /** +140 * Test of analyze method, of class ArchiveAnalyzer. +141 */ +142 @Test +143 public void testAnalyze() throws Exception { +144 ArchiveAnalyzer instance = new ArchiveAnalyzer(); +145 try { +146 instance.initialize(); +147 +148 File file = new File(this.getClass().getClassLoader().getResource("daytrader-ear-2.1.7.ear").getPath()); +149 Dependency dependency = new Dependency(file); +150 Settings.setBoolean(Settings.KEYS.AUTO_UPDATE, false); +151 Engine engine = new Engine(); +152 +153 int initial_size = engine.getDependencies().size(); +154 instance.analyze(dependency, engine); +155 int ending_size = engine.getDependencies().size(); +156 +157 assertTrue(initial_size < ending_size); +158 +159 } finally { +160 instance.close(); +161 } +162 } +163 +164 /** +165 * Test of analyze method, of class ArchiveAnalyzer. +166 */ +167 @Test +168 public void testAnalyzeTar() throws Exception { +169 ArchiveAnalyzer instance = new ArchiveAnalyzer(); +170 try { +171 instance.initialize(); +172 +173 //File file = new File(this.getClass().getClassLoader().getResource("file.tar").getPath()); +174 File file = new File(this.getClass().getClassLoader().getResource("stagedhttp-modified.tar").getPath()); +175 Dependency dependency = new Dependency(file); +176 Settings.setBoolean(Settings.KEYS.AUTO_UPDATE, false); +177 Engine engine = new Engine(); +178 +179 int initial_size = engine.getDependencies().size(); +180 instance.analyze(dependency, engine); +181 int ending_size = engine.getDependencies().size(); 182 -183 } finally { -184 instance.close(); -185 } -186 } -187 -188 /** -189 * Test of analyze method, of class ArchiveAnalyzer. -190 */ -191 @Test -192 public void testAnalyzeTarGz() throws Exception { -193 ArchiveAnalyzer instance = new ArchiveAnalyzer(); -194 try { -195 instance.initialize(); -196 -197 File file = new File(this.getClass().getClassLoader().getResource("file.tar.gz").getPath()); -198 //Dependency dependency = new Dependency(file); -199 Settings.setBoolean(Settings.KEYS.AUTO_UPDATE, false); -200 Engine engine = new Engine(); -201 -202 int initial_size = engine.getDependencies().size(); -203 //instance.analyze(dependency, engine); -204 engine.scan(file); -205 engine.analyzeDependencies(); -206 int ending_size = engine.getDependencies().size(); -207 -208 assertTrue(initial_size < ending_size); +183 assertTrue(initial_size < ending_size); +184 +185 } finally { +186 instance.close(); +187 } +188 } +189 +190 /** +191 * Test of analyze method, of class ArchiveAnalyzer. +192 */ +193 @Test +194 public void testAnalyzeTarGz() throws Exception { +195 ArchiveAnalyzer instance = new ArchiveAnalyzer(); +196 try { +197 instance.initialize(); +198 +199 File file = new File(this.getClass().getClassLoader().getResource("file.tar.gz").getPath()); +200 //Dependency dependency = new Dependency(file); +201 Settings.setBoolean(Settings.KEYS.AUTO_UPDATE, false); +202 Engine engine = new Engine(); +203 +204 int initial_size = engine.getDependencies().size(); +205 //instance.analyze(dependency, engine); +206 engine.scan(file); +207 engine.analyzeDependencies(); +208 int ending_size = engine.getDependencies().size(); 209 -210 } finally { -211 instance.close(); -212 } -213 } -214 -215 /** -216 * Test of analyze method, of class ArchiveAnalyzer. -217 */ -218 @Test -219 public void testAnalyzeTgz() throws Exception { -220 ArchiveAnalyzer instance = new ArchiveAnalyzer(); -221 try { -222 instance.initialize(); -223 -224 File file = new File(this.getClass().getClassLoader().getResource("file.tgz").getPath()); -225 Settings.setBoolean(Settings.KEYS.AUTO_UPDATE, false); -226 Engine engine = new Engine(); -227 -228 int initial_size = engine.getDependencies().size(); -229 engine.scan(file); -230 engine.analyzeDependencies(); -231 int ending_size = engine.getDependencies().size(); -232 -233 assertTrue(initial_size < ending_size); +210 assertTrue(initial_size < ending_size); +211 +212 } finally { +213 instance.close(); +214 } +215 } +216 +217 /** +218 * Test of analyze method, of class ArchiveAnalyzer. +219 */ +220 @Test +221 public void testAnalyzeTgz() throws Exception { +222 ArchiveAnalyzer instance = new ArchiveAnalyzer(); +223 try { +224 instance.initialize(); +225 +226 File file = new File(this.getClass().getClassLoader().getResource("file.tgz").getPath()); +227 Settings.setBoolean(Settings.KEYS.AUTO_UPDATE, false); +228 Engine engine = new Engine(); +229 +230 int initial_size = engine.getDependencies().size(); +231 engine.scan(file); +232 engine.analyzeDependencies(); +233 int ending_size = engine.getDependencies().size(); 234 -235 } finally { -236 instance.close(); -237 } -238 } -239 -240 /** -241 * Test of analyze method, of class ArchiveAnalyzer. -242 */ -243 @Test -244 public void testAnalyze_badZip() throws Exception { -245 ArchiveAnalyzer instance = new ArchiveAnalyzer(); -246 try { -247 instance.initialize(); -248 -249 File file = new File(this.getClass().getClassLoader().getResource("test.zip").getPath()); -250 Dependency dependency = new Dependency(file); -251 Settings.setBoolean(Settings.KEYS.AUTO_UPDATE, false); -252 Engine engine = new Engine(); -253 int initial_size = engine.getDependencies().size(); -254 // boolean failed = false; -255 // try { -256 instance.analyze(dependency, engine); -257 // } catch (java.lang.UnsupportedClassVersionError ex) { -258 // failed = true; -259 // } -260 // assertTrue(failed); -261 int ending_size = engine.getDependencies().size(); -262 assertEquals(initial_size, ending_size); -263 } finally { -264 instance.close(); -265 } -266 } -267 } +235 assertTrue(initial_size < ending_size); +236 +237 } finally { +238 instance.close(); +239 } +240 } +241 +242 /** +243 * Test of analyze method, of class ArchiveAnalyzer. +244 */ +245 @Test +246 public void testAnalyze_badZip() throws Exception { +247 ArchiveAnalyzer instance = new ArchiveAnalyzer(); +248 try { +249 instance.initialize(); +250 +251 File file = new File(this.getClass().getClassLoader().getResource("test.zip").getPath()); +252 Dependency dependency = new Dependency(file); +253 Settings.setBoolean(Settings.KEYS.AUTO_UPDATE, false); +254 Engine engine = new Engine(); +255 int initial_size = engine.getDependencies().size(); +256 // boolean failed = false; +257 // try { +258 instance.analyze(dependency, engine); +259 // } catch (java.lang.UnsupportedClassVersionError ex) { +260 // failed = true; +261 // } +262 // assertTrue(failed); +263 int ending_size = engine.getDependencies().size(); +264 assertEquals(initial_size, ending_size); +265 } finally { +266 instance.close(); +267 } +268 } +269 }
    diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/CPEAnalyzerTest.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/CPEAnalyzerTest.html index 14210e804..1629b352f 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/CPEAnalyzerTest.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/CPEAnalyzerTest.html @@ -9,243 +9,238 @@ 1 /* 2 * This file is part of dependency-check-core. 3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. -18 */ -19 package org.owasp.dependencycheck.analyzer; -20 -21 import java.io.File; -22 import java.io.IOException; -23 import java.util.HashSet; -24 import java.util.List; -25 import java.util.Set; -26 import org.apache.lucene.index.CorruptIndexException; -27 import org.apache.lucene.queryparser.classic.ParseException; -28 import org.junit.After; -29 import org.junit.AfterClass; -30 import org.owasp.dependencycheck.dependency.Dependency; -31 import org.junit.Assert; -32 import org.junit.Before; -33 import org.junit.BeforeClass; -34 import org.junit.Test; -35 import org.owasp.dependencycheck.data.cpe.BaseIndexTestCase; -36 import org.owasp.dependencycheck.data.cpe.IndexEntry; -37 import org.owasp.dependencycheck.dependency.Identifier; -38 -39 /** -40 * -41 * @author Jeremy Long <jeremy.long@owasp.org> -42 */ -43 public class CPEAnalyzerTest extends BaseIndexTestCase { -44 -45 @BeforeClass -46 public static void setUpClass() throws Exception { -47 } -48 -49 @AfterClass -50 public static void tearDownClass() throws Exception { -51 } -52 -53 @Before -54 @Override -55 public void setUp() throws Exception { -56 super.setUp(); -57 } -58 -59 @After -60 @Override -61 public void tearDown() throws Exception { -62 super.tearDown(); -63 } -64 -65 /** -66 * Tests of buildSearch of class CPEAnalyzer. -67 * -68 * @throws IOException is thrown when an IO Exception occurs. -69 * @throws CorruptIndexException is thrown when the index is corrupt. -70 * @throws ParseException is thrown when a parse exception occurs -71 */ -72 @Test -73 public void testBuildSearch() throws IOException, CorruptIndexException, ParseException { -74 Set<String> productWeightings = new HashSet<String>(1); -75 productWeightings.add("struts2"); -76 -77 Set<String> vendorWeightings = new HashSet<String>(1); -78 vendorWeightings.add("apache"); -79 -80 String vendor = "apache software foundation"; -81 String product = "struts 2 core"; -82 String version = "2.1.2"; -83 CPEAnalyzer instance = new CPEAnalyzer(); -84 -85 String queryText = instance.buildSearch(vendor, product, null, null); -86 String expResult = " product:( struts 2 core ) AND vendor:( apache software foundation ) "; -87 Assert.assertTrue(expResult.equals(queryText)); -88 -89 queryText = instance.buildSearch(vendor, product, null, productWeightings); -90 expResult = " product:( struts^5 struts2^5 2 core ) AND vendor:( apache software foundation ) "; -91 Assert.assertTrue(expResult.equals(queryText)); -92 -93 queryText = instance.buildSearch(vendor, product, vendorWeightings, null); -94 expResult = " product:( struts 2 core ) AND vendor:( apache^5 software foundation ) "; -95 Assert.assertTrue(expResult.equals(queryText)); -96 -97 queryText = instance.buildSearch(vendor, product, vendorWeightings, productWeightings); -98 expResult = " product:( struts^5 struts2^5 2 core ) AND vendor:( apache^5 software foundation ) "; -99 Assert.assertTrue(expResult.equals(queryText)); -100 } -101 -102 /** -103 * Test of determineCPE method, of class CPEAnalyzer. -104 * -105 * @throws Exception is thrown when an exception occurs -106 */ -107 @Test -108 public void testDetermineCPE_full() throws Exception { -109 callDetermineCPE_full("hazelcast-2.5.jar", null); -110 callDetermineCPE_full("spring-context-support-2.5.5.jar", "cpe:/a:vmware:springsource_spring_framework:2.5.5"); -111 callDetermineCPE_full("spring-core-3.0.0.RELEASE.jar", "cpe:/a:vmware:springsource_spring_framework:3.0.0"); -112 callDetermineCPE_full("org.mortbay.jetty.jar", "cpe:/a:mortbay_jetty:jetty:4.2"); -113 callDetermineCPE_full("jaxb-xercesImpl-1.5.jar", null); -114 callDetermineCPE_full("ehcache-core-2.2.0.jar", null); -115 } -116 -117 /** -118 * Test of determineCPE method, of class CPEAnalyzer. -119 * -120 * @throws Exception is thrown when an exception occurs -121 */ -122 public void callDetermineCPE_full(String depName, String expResult) throws Exception { -123 -124 File file = new File(this.getClass().getClassLoader().getResource(depName).getPath()); -125 -126 Dependency dep = new Dependency(file); -127 -128 FileNameAnalyzer fnAnalyzer = new FileNameAnalyzer(); -129 fnAnalyzer.analyze(dep, null); -130 -131 JarAnalyzer jarAnalyzer = new JarAnalyzer(); -132 jarAnalyzer.analyze(dep, null); -133 HintAnalyzer hAnalyzer = new HintAnalyzer(); -134 hAnalyzer.analyze(dep, null); -135 -136 -137 CPEAnalyzer instance = new CPEAnalyzer(); -138 instance.open(); -139 instance.analyze(dep, null); -140 instance.close(); -141 FalsePositiveAnalyzer fp = new FalsePositiveAnalyzer(); -142 fp.analyze(dep, null); -143 -144 // for (Identifier i : dep.getIdentifiers()) { -145 // System.out.println(i.getValue()); -146 // } -147 if (expResult != null) { -148 Identifier expIdentifier = new Identifier("cpe", expResult, expResult); -149 Assert.assertTrue("Incorrect match: { dep:'" + dep.getFileName() + "' }", dep.getIdentifiers().contains(expIdentifier)); -150 } else if (dep.getIdentifiers().isEmpty()) { -151 Assert.assertTrue("Match found when an Identifier should not have been found: { dep:'" + dep.getFileName() + "' }", dep.getIdentifiers().isEmpty()); -152 } else { -153 Assert.assertTrue("Match found when an Identifier should not have been found: { dep:'" + dep.getFileName() + "', identifier:'" + dep.getIdentifiers().iterator().next().getValue() + "' }", dep.getIdentifiers().isEmpty()); -154 } -155 } -156 -157 /** -158 * Test of determineCPE method, of class CPEAnalyzer. -159 * -160 * @throws Exception is thrown when an exception occurs -161 */ -162 @Test -163 public void testDetermineCPE() throws Exception { -164 File file = new File(this.getClass().getClassLoader().getResource("struts2-core-2.1.2.jar").getPath()); -165 //File file = new File(this.getClass().getClassLoader().getResource("axis2-adb-1.4.1.jar").getPath()); -166 Dependency struts = new Dependency(file); -167 -168 FileNameAnalyzer fnAnalyzer = new FileNameAnalyzer(); -169 fnAnalyzer.analyze(struts, null); -170 -171 JarAnalyzer jarAnalyzer = new JarAnalyzer(); -172 jarAnalyzer.analyze(struts, null); -173 -174 -175 File fileCommonValidator = new File(this.getClass().getClassLoader().getResource("commons-validator-1.4.0.jar").getPath()); -176 Dependency commonValidator = new Dependency(fileCommonValidator); -177 jarAnalyzer.analyze(commonValidator, null); -178 -179 File fileSpring = new File(this.getClass().getClassLoader().getResource("spring-core-2.5.5.jar").getPath()); -180 Dependency spring = new Dependency(fileSpring); -181 jarAnalyzer.analyze(spring, null); -182 -183 File fileSpring3 = new File(this.getClass().getClassLoader().getResource("spring-core-3.0.0.RELEASE.jar").getPath()); -184 Dependency spring3 = new Dependency(fileSpring3); -185 jarAnalyzer.analyze(spring3, null); -186 -187 CPEAnalyzer instance = new CPEAnalyzer(); -188 instance.open(); -189 instance.determineCPE(commonValidator); -190 instance.determineCPE(struts); -191 instance.determineCPE(spring); -192 instance.determineCPE(spring3); -193 instance.close(); -194 -195 String expResult = "cpe:/a:apache:struts:2.1.2"; -196 Identifier expIdentifier = new Identifier("cpe", expResult, expResult); -197 String expResultSpring = "cpe:/a:springsource:spring_framework:2.5.5"; -198 String expResultSpring3 = "cpe:/a:vmware:springsource_spring_framework:3.0.0"; -199 -200 Assert.assertTrue("Apache Common Validator - found an identifier?", commonValidator.getIdentifiers().isEmpty()); -201 Assert.assertTrue("Incorrect match size - struts", struts.getIdentifiers().size() >= 1); -202 Assert.assertTrue("Incorrect match - struts", struts.getIdentifiers().contains(expIdentifier)); -203 Assert.assertTrue("Incorrect match size - spring3 - " + spring3.getIdentifiers().size(), spring3.getIdentifiers().size() >= 1); -204 -205 //the following two only work if the HintAnalyzer is used. -206 //Assert.assertTrue("Incorrect match size - spring", spring.getIdentifiers().size() == 1); -207 //Assert.assertTrue("Incorrect match - spring", spring.getIdentifiers().get(0).getValue().equals(expResultSpring)); -208 -209 } -210 -211 /** -212 * Test of searchCPE method, of class CPEAnalyzer. -213 * -214 * @throws Exception is thrown when an exception occurs -215 */ -216 @Test -217 public void testSearchCPE() throws Exception { -218 String vendor = "apache software foundation"; -219 String product = "struts 2 core"; -220 String version = "2.1.2"; -221 String expResult = "cpe:/a:apache:struts:2.1.2"; -222 -223 CPEAnalyzer instance = new CPEAnalyzer(); -224 instance.open(); +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. +17 */ +18 package org.owasp.dependencycheck.analyzer; +19 +20 import java.io.File; +21 import java.io.IOException; +22 import java.util.HashSet; +23 import java.util.List; +24 import java.util.Set; +25 import org.apache.lucene.index.CorruptIndexException; +26 import org.apache.lucene.queryparser.classic.ParseException; +27 import org.junit.After; +28 import org.junit.AfterClass; +29 import org.junit.Assert; +30 import org.junit.Before; +31 import org.junit.BeforeClass; +32 import org.junit.Test; +33 import org.owasp.dependencycheck.data.cpe.BaseIndexTestCase; +34 import org.owasp.dependencycheck.data.cpe.IndexEntry; +35 import org.owasp.dependencycheck.dependency.Dependency; +36 import org.owasp.dependencycheck.dependency.Identifier; +37 +38 /** +39 * +40 * @author Jeremy Long <jeremy.long@owasp.org> +41 */ +42 public class CPEAnalyzerTest extends BaseIndexTestCase { +43 +44 @BeforeClass +45 public static void setUpClass() throws Exception { +46 } +47 +48 @AfterClass +49 public static void tearDownClass() throws Exception { +50 } +51 +52 @Before +53 @Override +54 public void setUp() throws Exception { +55 super.setUp(); +56 } +57 +58 @After +59 @Override +60 public void tearDown() throws Exception { +61 super.tearDown(); +62 } +63 +64 /** +65 * Tests of buildSearch of class CPEAnalyzer. +66 * +67 * @throws IOException is thrown when an IO Exception occurs. +68 * @throws CorruptIndexException is thrown when the index is corrupt. +69 * @throws ParseException is thrown when a parse exception occurs +70 */ +71 @Test +72 public void testBuildSearch() throws IOException, CorruptIndexException, ParseException { +73 Set<String> productWeightings = new HashSet<String>(1); +74 productWeightings.add("struts2"); +75 +76 Set<String> vendorWeightings = new HashSet<String>(1); +77 vendorWeightings.add("apache"); +78 +79 String vendor = "apache software foundation"; +80 String product = "struts 2 core"; +81 String version = "2.1.2"; +82 CPEAnalyzer instance = new CPEAnalyzer(); +83 +84 String queryText = instance.buildSearch(vendor, product, null, null); +85 String expResult = " product:( struts 2 core ) AND vendor:( apache software foundation ) "; +86 Assert.assertTrue(expResult.equals(queryText)); +87 +88 queryText = instance.buildSearch(vendor, product, null, productWeightings); +89 expResult = " product:( struts^5 struts2^5 2 core ) AND vendor:( apache software foundation ) "; +90 Assert.assertTrue(expResult.equals(queryText)); +91 +92 queryText = instance.buildSearch(vendor, product, vendorWeightings, null); +93 expResult = " product:( struts 2 core ) AND vendor:( apache^5 software foundation ) "; +94 Assert.assertTrue(expResult.equals(queryText)); +95 +96 queryText = instance.buildSearch(vendor, product, vendorWeightings, productWeightings); +97 expResult = " product:( struts^5 struts2^5 2 core ) AND vendor:( apache^5 software foundation ) "; +98 Assert.assertTrue(expResult.equals(queryText)); +99 } +100 +101 /** +102 * Test of determineCPE method, of class CPEAnalyzer. +103 * +104 * @throws Exception is thrown when an exception occurs +105 */ +106 @Test +107 public void testDetermineCPE_full() throws Exception { +108 callDetermineCPE_full("hazelcast-2.5.jar", null); +109 callDetermineCPE_full("spring-context-support-2.5.5.jar", "cpe:/a:vmware:springsource_spring_framework:2.5.5"); +110 callDetermineCPE_full("spring-core-3.0.0.RELEASE.jar", "cpe:/a:vmware:springsource_spring_framework:3.0.0"); +111 callDetermineCPE_full("org.mortbay.jetty.jar", "cpe:/a:mortbay_jetty:jetty:4.2"); +112 callDetermineCPE_full("jaxb-xercesImpl-1.5.jar", null); +113 callDetermineCPE_full("ehcache-core-2.2.0.jar", null); +114 } +115 +116 /** +117 * Test of determineCPE method, of class CPEAnalyzer. +118 * +119 * @throws Exception is thrown when an exception occurs +120 */ +121 public void callDetermineCPE_full(String depName, String expResult) throws Exception { +122 +123 File file = new File(this.getClass().getClassLoader().getResource(depName).getPath()); +124 +125 Dependency dep = new Dependency(file); +126 +127 FileNameAnalyzer fnAnalyzer = new FileNameAnalyzer(); +128 fnAnalyzer.analyze(dep, null); +129 +130 JarAnalyzer jarAnalyzer = new JarAnalyzer(); +131 jarAnalyzer.analyze(dep, null); +132 HintAnalyzer hAnalyzer = new HintAnalyzer(); +133 hAnalyzer.analyze(dep, null); +134 +135 CPEAnalyzer instance = new CPEAnalyzer(); +136 instance.open(); +137 instance.analyze(dep, null); +138 instance.close(); +139 FalsePositiveAnalyzer fp = new FalsePositiveAnalyzer(); +140 fp.analyze(dep, null); +141 +142 // for (Identifier i : dep.getIdentifiers()) { +143 // System.out.println(i.getValue()); +144 // } +145 if (expResult != null) { +146 Identifier expIdentifier = new Identifier("cpe", expResult, expResult); +147 Assert.assertTrue("Incorrect match: { dep:'" + dep.getFileName() + "' }", dep.getIdentifiers().contains(expIdentifier)); +148 } else if (dep.getIdentifiers().isEmpty()) { +149 Assert.assertTrue("Match found when an Identifier should not have been found: { dep:'" + dep.getFileName() + "' }", dep.getIdentifiers().isEmpty()); +150 } else { +151 Assert.assertTrue("Match found when an Identifier should not have been found: { dep:'" + dep.getFileName() + "', identifier:'" + dep.getIdentifiers().iterator().next().getValue() + "' }", dep.getIdentifiers().isEmpty()); +152 } +153 } +154 +155 /** +156 * Test of determineCPE method, of class CPEAnalyzer. +157 * +158 * @throws Exception is thrown when an exception occurs +159 */ +160 @Test +161 public void testDetermineCPE() throws Exception { +162 File file = new File(this.getClass().getClassLoader().getResource("struts2-core-2.1.2.jar").getPath()); +163 //File file = new File(this.getClass().getClassLoader().getResource("axis2-adb-1.4.1.jar").getPath()); +164 Dependency struts = new Dependency(file); +165 +166 FileNameAnalyzer fnAnalyzer = new FileNameAnalyzer(); +167 fnAnalyzer.analyze(struts, null); +168 +169 JarAnalyzer jarAnalyzer = new JarAnalyzer(); +170 jarAnalyzer.analyze(struts, null); +171 +172 File fileCommonValidator = new File(this.getClass().getClassLoader().getResource("commons-validator-1.4.0.jar").getPath()); +173 Dependency commonValidator = new Dependency(fileCommonValidator); +174 jarAnalyzer.analyze(commonValidator, null); +175 +176 File fileSpring = new File(this.getClass().getClassLoader().getResource("spring-core-2.5.5.jar").getPath()); +177 Dependency spring = new Dependency(fileSpring); +178 jarAnalyzer.analyze(spring, null); +179 +180 File fileSpring3 = new File(this.getClass().getClassLoader().getResource("spring-core-3.0.0.RELEASE.jar").getPath()); +181 Dependency spring3 = new Dependency(fileSpring3); +182 jarAnalyzer.analyze(spring3, null); +183 +184 CPEAnalyzer instance = new CPEAnalyzer(); +185 instance.open(); +186 instance.determineCPE(commonValidator); +187 instance.determineCPE(struts); +188 instance.determineCPE(spring); +189 instance.determineCPE(spring3); +190 instance.close(); +191 +192 String expResult = "cpe:/a:apache:struts:2.1.2"; +193 Identifier expIdentifier = new Identifier("cpe", expResult, expResult); +194 String expResultSpring = "cpe:/a:springsource:spring_framework:2.5.5"; +195 String expResultSpring3 = "cpe:/a:vmware:springsource_spring_framework:3.0.0"; +196 +197 Assert.assertTrue("Apache Common Validator - found an identifier?", commonValidator.getIdentifiers().isEmpty()); +198 Assert.assertTrue("Incorrect match size - struts", struts.getIdentifiers().size() >= 1); +199 Assert.assertTrue("Incorrect match - struts", struts.getIdentifiers().contains(expIdentifier)); +200 Assert.assertTrue("Incorrect match size - spring3 - " + spring3.getIdentifiers().size(), spring3.getIdentifiers().size() >= 1); +201 +202 //the following two only work if the HintAnalyzer is used. +203 //Assert.assertTrue("Incorrect match size - spring", spring.getIdentifiers().size() == 1); +204 //Assert.assertTrue("Incorrect match - spring", spring.getIdentifiers().get(0).getValue().equals(expResultSpring)); +205 } +206 +207 /** +208 * Test of searchCPE method, of class CPEAnalyzer. +209 * +210 * @throws Exception is thrown when an exception occurs +211 */ +212 @Test +213 public void testSearchCPE() throws Exception { +214 String vendor = "apache software foundation"; +215 String product = "struts 2 core"; +216 String version = "2.1.2"; +217 String expResult = "cpe:/a:apache:struts:2.1.2"; +218 +219 CPEAnalyzer instance = new CPEAnalyzer(); +220 instance.open(); +221 +222 //TODO - yeah, not a very good test as the results are the same with or without weighting... +223 Set<String> productWeightings = new HashSet<String>(1); +224 productWeightings.add("struts2"); 225 -226 //TODO - yeah, not a very good test as the results are the same with or without weighting... -227 Set<String> productWeightings = new HashSet<String>(1); -228 productWeightings.add("struts2"); -229 -230 Set<String> vendorWeightings = new HashSet<String>(1); -231 vendorWeightings.add("apache"); +226 Set<String> vendorWeightings = new HashSet<String>(1); +227 vendorWeightings.add("apache"); +228 +229 List<IndexEntry> result = instance.searchCPE(vendor, product, productWeightings, vendorWeightings); +230 //TODO fix this assert +231 //Assert.assertEquals(expResult, result.get(0).getName()); 232 -233 List<IndexEntry> result = instance.searchCPE(vendor, product, productWeightings, vendorWeightings); -234 //TODO fix this assert -235 //Assert.assertEquals(expResult, result.get(0).getName()); -236 -237 -238 instance.close(); -239 } -240 } +233 instance.close(); +234 } +235 }
    diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/DependencyBundlingAnalyzerTest.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/DependencyBundlingAnalyzerTest.html new file mode 100644 index 000000000..cee6f927a --- /dev/null +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/DependencyBundlingAnalyzerTest.html @@ -0,0 +1,148 @@ + + + +DependencyBundlingAnalyzerTest xref + + + +
    +1   /*
+2    * This file is part of dependency-check-core.
+3    *
+4    * Licensed under the Apache License, Version 2.0 (the "License");
+5    * you may not use this file except in compliance with the License.
+6    * You may obtain a copy of the License at
+7    *
+8    *     http://www.apache.org/licenses/LICENSE-2.0
+9    *
+10   * Unless required by applicable law or agreed to in writing, software
+11   * distributed under the License is distributed on an "AS IS" BASIS,
+12   * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+13   * See the License for the specific language governing permissions and
+14   * limitations under the License.
+15   *
+16   * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
+17   */
+18  package org.owasp.dependencycheck.analyzer;
+19  
+20  import java.util.Set;
+21  import org.junit.After;
+22  import org.junit.AfterClass;
+23  import static org.junit.Assert.assertEquals;
+24  import static org.junit.Assert.assertNull;
+25  import org.junit.Before;
+26  import org.junit.BeforeClass;
+27  import org.junit.Test;
+28  import org.owasp.dependencycheck.dependency.Dependency;
+29  
+30  /**
+31   *
+32   * @author Jeremy Long <jeremy.long@owasp.org>
+33   */
+34  public class DependencyBundlingAnalyzerTest {
+35  
+36      public DependencyBundlingAnalyzerTest() {
+37      }
+38  
+39      @BeforeClass
+40      public static void setUpClass() {
+41      }
+42  
+43      @AfterClass
+44      public static void tearDownClass() {
+45      }
+46  
+47      @Before
+48      public void setUp() {
+49      }
+50  
+51      @After
+52      public void tearDown() {
+53      }
+54  
+55      /**
+56       * Test of getSupportedExtensions method, of class DependencyBundlingAnalyzer.
+57       */
+58      @Test
+59      public void testGetSupportedExtensions() {
+60          DependencyBundlingAnalyzer instance = new DependencyBundlingAnalyzer();
+61          Set<String> result = instance.getSupportedExtensions();
+62          assertNull(result);
+63      }
+64  
+65      /**
+66       * Test of getName method, of class DependencyBundlingAnalyzer.
+67       */
+68      @Test
+69      public void testGetName() {
+70          DependencyBundlingAnalyzer instance = new DependencyBundlingAnalyzer();
+71          String expResult = "Dependency Bundling Analyzer";
+72          String result = instance.getName();
+73          assertEquals(expResult, result);
+74      }
+75  
+76      /**
+77       * Test of supportsExtension method, of class DependencyBundlingAnalyzer.
+78       */
+79      @Test
+80      public void testSupportsExtension() {
+81          String extension = "jar";
+82          DependencyBundlingAnalyzer instance = new DependencyBundlingAnalyzer();
+83          boolean expResult = true;
+84          boolean result = instance.supportsExtension(extension);
+85          assertEquals(expResult, result);
+86      }
+87  
+88      /**
+89       * Test of getAnalysisPhase method, of class DependencyBundlingAnalyzer.
+90       */
+91      @Test
+92      public void testGetAnalysisPhase() {
+93          DependencyBundlingAnalyzer instance = new DependencyBundlingAnalyzer();
+94          AnalysisPhase expResult = AnalysisPhase.PRE_FINDING_ANALYSIS;
+95          AnalysisPhase result = instance.getAnalysisPhase();
+96          assertEquals(expResult, result);
+97      }
+98  
+99      /**
+100      * Test of analyze method, of class DependencyBundlingAnalyzer.
+101      */
+102     @Test
+103     public void testAnalyze() throws Exception {
+104 //        Dependency ignore = null;
+105 //        Engine engine = null;
+106 //        DependencyBundlingAnalyzer instance = new DependencyBundlingAnalyzer();
+107 //        instance.analyze(ignore, engine);
+108 //        // TODO review the generated test code and remove the default call to fail.
+109 //        fail("The test case is a prototype.");
+110     }
+111 
+112     /**
+113      * Test of isCore method, of class DependencyBundlingAnalyzer.
+114      */
+115     @Test
+116     public void testIsCore() {
+117         Dependency left = new Dependency();
+118         Dependency right = new Dependency();
+119 
+120         left.setFileName("axis2-kernel-1.4.1.jar");
+121         right.setFileName("axis2-adb-1.4.1.jar");
+122         DependencyBundlingAnalyzer instance = new DependencyBundlingAnalyzer();
+123         boolean expResult = true;
+124         boolean result = instance.isCore(left, right);
+125         assertEquals(expResult, result);
+126 
+127         left.setFileName("struts-1.2.7.jar");
+128         right.setFileName("file.tar.gz\\file.tar\\struts.jar");
+129 
+130         expResult = true;
+131         result = instance.isCore(left, right);
+132         assertEquals(expResult, result);
+133     }
+134 
+135 }
+
    +
    + + + diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/FalsePositiveAnalyzerTest.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/FalsePositiveAnalyzerTest.html new file mode 100644 index 000000000..a18be0771 --- /dev/null +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/FalsePositiveAnalyzerTest.html @@ -0,0 +1,129 @@ + + + +FalsePositiveAnalyzerTest xref + + + +
    +1   /*
+2    * Copyright 2014 OWASP.
+3    *
+4    * Licensed under the Apache License, Version 2.0 (the "License");
+5    * you may not use this file except in compliance with the License.
+6    * You may obtain a copy of the License at
+7    *
+8    *      http://www.apache.org/licenses/LICENSE-2.0
+9    *
+10   * Unless required by applicable law or agreed to in writing, software
+11   * distributed under the License is distributed on an "AS IS" BASIS,
+12   * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+13   * See the License for the specific language governing permissions and
+14   * limitations under the License.
+15   */
+16  package org.owasp.dependencycheck.analyzer;
+17  
+18  import java.util.Set;
+19  import org.junit.After;
+20  import org.junit.AfterClass;
+21  import static org.junit.Assert.assertEquals;
+22  import static org.junit.Assert.assertNull;
+23  import static org.junit.Assert.assertTrue;
+24  import org.junit.Before;
+25  import org.junit.BeforeClass;
+26  import org.junit.Test;
+27  import org.owasp.dependencycheck.Engine;
+28  import org.owasp.dependencycheck.dependency.Dependency;
+29  
+30  /**
+31   *
+32   * @author Jeremy Long <jeremy.long@owasp.org>
+33   */
+34  public class FalsePositiveAnalyzerTest {
+35  
+36      public FalsePositiveAnalyzerTest() {
+37      }
+38  
+39      @BeforeClass
+40      public static void setUpClass() {
+41      }
+42  
+43      @AfterClass
+44      public static void tearDownClass() {
+45      }
+46  
+47      @Before
+48      public void setUp() {
+49      }
+50  
+51      @After
+52      public void tearDown() {
+53      }
+54  
+55      /**
+56       * Test of getSupportedExtensions method, of class FalsePositiveAnalyzer.
+57       */
+58      @Test
+59      public void testGetSupportedExtensions() {
+60          FalsePositiveAnalyzer instance = new FalsePositiveAnalyzer();
+61          Set<String> result = instance.getSupportedExtensions();
+62          assertNull(result);
+63  
+64      }
+65  
+66      /**
+67       * Test of getName method, of class FalsePositiveAnalyzer.
+68       */
+69      @Test
+70      public void testGetName() {
+71          FalsePositiveAnalyzer instance = new FalsePositiveAnalyzer();
+72          String expResult = "False Positive Analyzer";
+73          String result = instance.getName();
+74          assertEquals(expResult, result);
+75      }
+76  
+77      /**
+78       * Test of supportsExtension method, of class FalsePositiveAnalyzer.
+79       */
+80      @Test
+81      public void testSupportsExtension() {
+82          String extension = "any";
+83          FalsePositiveAnalyzer instance = new FalsePositiveAnalyzer();
+84          boolean expResult = true;
+85          boolean result = instance.supportsExtension(extension);
+86          assertEquals(expResult, result);
+87      }
+88  
+89      /**
+90       * Test of getAnalysisPhase method, of class FalsePositiveAnalyzer.
+91       */
+92      @Test
+93      public void testGetAnalysisPhase() {
+94          FalsePositiveAnalyzer instance = new FalsePositiveAnalyzer();
+95          AnalysisPhase expResult = AnalysisPhase.POST_IDENTIFIER_ANALYSIS;
+96          AnalysisPhase result = instance.getAnalysisPhase();
+97          assertEquals(expResult, result);
+98      }
+99  
+100     /**
+101      * Test of analyze method, of class FalsePositiveAnalyzer.
+102      */
+103     @Test
+104     public void testAnalyze() throws Exception {
+105         Dependency dependency = new Dependency();
+106         dependency.setFileName("pom.xml");
+107         dependency.addIdentifier("cpe", "cpe:/a:file:file:1.2.1", "http://some.org/url");
+108         Engine engine = null;
+109         FalsePositiveAnalyzer instance = new FalsePositiveAnalyzer();
+110         int before = dependency.getIdentifiers().size();
+111         instance.analyze(dependency, engine);
+112         int after = dependency.getIdentifiers().size();
+113         assertTrue(before > after);
+114     }
+115 
+116 }
+
    +
    + + + diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/FileNameAnalyzerTest.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/FileNameAnalyzerTest.html index 78770c33c..d36042a02 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/FileNameAnalyzerTest.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/FileNameAnalyzerTest.html @@ -9,143 +9,141 @@ 1 /* 2 * This file is part of dependency-check-core. 3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. -18 */ -19 package org.owasp.dependencycheck.analyzer; -20 -21 import org.owasp.dependencycheck.analyzer.AnalysisPhase; -22 import org.owasp.dependencycheck.analyzer.FileNameAnalyzer; -23 import java.io.File; -24 import java.util.Set; -25 import org.owasp.dependencycheck.dependency.Dependency; -26 import org.junit.After; -27 import org.junit.AfterClass; -28 import org.junit.Before; -29 import org.junit.BeforeClass; -30 import org.junit.Test; -31 import static org.junit.Assert.*; -32 -33 /** -34 * -35 * @author Jeremy Long <jeremy.long@owasp.org> -36 */ -37 public class FileNameAnalyzerTest { -38 -39 public FileNameAnalyzerTest() { -40 } -41 -42 @BeforeClass -43 public static void setUpClass() throws Exception { -44 } -45 -46 @AfterClass -47 public static void tearDownClass() throws Exception { -48 } -49 -50 @Before -51 public void setUp() { -52 } -53 -54 @After -55 public void tearDown() { -56 } -57 -58 /** -59 * Test of getSupportedExtensions method, of class FileNameAnalyzer. -60 */ -61 @Test -62 public void testGetSupportedExtensions() { -63 FileNameAnalyzer instance = new FileNameAnalyzer(); -64 Set expResult = null; -65 Set result = instance.getSupportedExtensions(); -66 assertEquals(expResult, result); -67 } -68 -69 /** -70 * Test of getName method, of class FileNameAnalyzer. -71 */ -72 @Test -73 public void testGetName() { -74 FileNameAnalyzer instance = new FileNameAnalyzer(); -75 String expResult = "File Name Analyzer"; -76 String result = instance.getName(); -77 assertEquals(expResult, result); -78 } -79 -80 /** -81 * Test of supportsExtension method, of class FileNameAnalyzer. -82 */ -83 @Test -84 public void testSupportsExtension() { -85 String extension = "any"; -86 FileNameAnalyzer instance = new FileNameAnalyzer(); -87 boolean expResult = true; -88 boolean result = instance.supportsExtension(extension); -89 assertEquals(expResult, result); -90 } -91 -92 /** -93 * Test of getAnalysisPhase method, of class FileNameAnalyzer. -94 */ -95 @Test -96 public void testGetAnalysisPhase() { -97 FileNameAnalyzer instance = new FileNameAnalyzer(); -98 AnalysisPhase expResult = AnalysisPhase.INFORMATION_COLLECTION; -99 AnalysisPhase result = instance.getAnalysisPhase(); -100 assertEquals(expResult, result); -101 } -102 -103 /** -104 * Test of analyze method, of class FileNameAnalyzer. -105 */ -106 @Test -107 public void testAnalyze() throws Exception { -108 File struts = new File(this.getClass().getClassLoader().getResource("struts2-core-2.1.2.jar").getPath()); -109 Dependency resultStruts = new Dependency(struts); -110 File axis = new File(this.getClass().getClassLoader().getResource("axis2-adb-1.4.1.jar").getPath()); -111 Dependency resultAxis = new Dependency(axis); -112 FileNameAnalyzer instance = new FileNameAnalyzer(); -113 instance.analyze(resultStruts, null); -114 assertTrue(resultStruts.getVendorEvidence().toString().toLowerCase().contains("struts")); -115 -116 instance.analyze(resultAxis, null); -117 assertTrue(resultStruts.getVersionEvidence().toString().toLowerCase().contains("2.1.2")); +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. +17 */ +18 package org.owasp.dependencycheck.analyzer; +19 +20 import java.io.File; +21 import java.util.Set; +22 import org.junit.After; +23 import org.junit.AfterClass; +24 import static org.junit.Assert.assertEquals; +25 import static org.junit.Assert.assertTrue; +26 import org.junit.Before; +27 import org.junit.BeforeClass; +28 import org.junit.Test; +29 import org.owasp.dependencycheck.dependency.Dependency; +30 +31 /** +32 * +33 * @author Jeremy Long <jeremy.long@owasp.org> +34 */ +35 public class FileNameAnalyzerTest { +36 +37 public FileNameAnalyzerTest() { +38 } +39 +40 @BeforeClass +41 public static void setUpClass() throws Exception { +42 } +43 +44 @AfterClass +45 public static void tearDownClass() throws Exception { +46 } +47 +48 @Before +49 public void setUp() { +50 } +51 +52 @After +53 public void tearDown() { +54 } +55 +56 /** +57 * Test of getSupportedExtensions method, of class FileNameAnalyzer. +58 */ +59 @Test +60 public void testGetSupportedExtensions() { +61 FileNameAnalyzer instance = new FileNameAnalyzer(); +62 Set expResult = null; +63 Set result = instance.getSupportedExtensions(); +64 assertEquals(expResult, result); +65 } +66 +67 /** +68 * Test of getName method, of class FileNameAnalyzer. +69 */ +70 @Test +71 public void testGetName() { +72 FileNameAnalyzer instance = new FileNameAnalyzer(); +73 String expResult = "File Name Analyzer"; +74 String result = instance.getName(); +75 assertEquals(expResult, result); +76 } +77 +78 /** +79 * Test of supportsExtension method, of class FileNameAnalyzer. +80 */ +81 @Test +82 public void testSupportsExtension() { +83 String extension = "any"; +84 FileNameAnalyzer instance = new FileNameAnalyzer(); +85 boolean expResult = true; +86 boolean result = instance.supportsExtension(extension); +87 assertEquals(expResult, result); +88 } +89 +90 /** +91 * Test of getAnalysisPhase method, of class FileNameAnalyzer. +92 */ +93 @Test +94 public void testGetAnalysisPhase() { +95 FileNameAnalyzer instance = new FileNameAnalyzer(); +96 AnalysisPhase expResult = AnalysisPhase.INFORMATION_COLLECTION; +97 AnalysisPhase result = instance.getAnalysisPhase(); +98 assertEquals(expResult, result); +99 } +100 +101 /** +102 * Test of analyze method, of class FileNameAnalyzer. +103 */ +104 @Test +105 public void testAnalyze() throws Exception { +106 File struts = new File(this.getClass().getClassLoader().getResource("struts2-core-2.1.2.jar").getPath()); +107 Dependency resultStruts = new Dependency(struts); +108 File axis = new File(this.getClass().getClassLoader().getResource("axis2-adb-1.4.1.jar").getPath()); +109 Dependency resultAxis = new Dependency(axis); +110 FileNameAnalyzer instance = new FileNameAnalyzer(); +111 instance.analyze(resultStruts, null); +112 assertTrue(resultStruts.getVendorEvidence().toString().toLowerCase().contains("struts")); +113 +114 instance.analyze(resultAxis, null); +115 assertTrue(resultStruts.getVersionEvidence().toString().toLowerCase().contains("2.1.2")); +116 +117 } 118 -119 } -120 -121 /** -122 * Test of initialize method, of class FileNameAnalyzer. -123 */ -124 @Test -125 public void testInitialize() throws Exception { -126 FileNameAnalyzer instance = new FileNameAnalyzer(); -127 instance.initialize(); -128 assertTrue(true); //initialize does nothing. -129 } -130 -131 /** -132 * Test of close method, of class FileNameAnalyzer. -133 */ -134 @Test -135 public void testClose() throws Exception { -136 FileNameAnalyzer instance = new FileNameAnalyzer(); -137 instance.close(); -138 assertTrue(true); //close does nothing. -139 } -140 } +119 /** +120 * Test of initialize method, of class FileNameAnalyzer. +121 */ +122 @Test +123 public void testInitialize() throws Exception { +124 FileNameAnalyzer instance = new FileNameAnalyzer(); +125 instance.initialize(); +126 assertTrue(true); //initialize does nothing. +127 } +128 +129 /** +130 * Test of close method, of class FileNameAnalyzer. +131 */ +132 @Test +133 public void testClose() throws Exception { +134 FileNameAnalyzer instance = new FileNameAnalyzer(); +135 instance.close(); +136 assertTrue(true); //close does nothing. +137 } +138 }
    diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/JarAnalyzerTest.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/JarAnalyzerTest.html index 31ee55695..472251c72 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/JarAnalyzerTest.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/JarAnalyzerTest.html @@ -9,163 +9,162 @@ 1 /* 2 * This file is part of dependency-check-core. 3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. -18 */ -19 package org.owasp.dependencycheck.analyzer; -20 -21 import java.util.Properties; -22 import org.owasp.dependencycheck.analyzer.JarAnalyzer; -23 import org.owasp.dependencycheck.dependency.Dependency; -24 import org.owasp.dependencycheck.dependency.Evidence; -25 import java.util.HashSet; -26 import java.io.File; -27 import java.util.Set; -28 import org.junit.After; -29 import org.junit.AfterClass; -30 import org.junit.Before; -31 import org.junit.BeforeClass; -32 import org.junit.Test; -33 import static org.junit.Assert.*; -34 -35 /** -36 * -37 * @author Jeremy Long <jeremy.long@owasp.org> -38 */ -39 public class JarAnalyzerTest { -40 -41 public JarAnalyzerTest() { -42 } -43 -44 @BeforeClass -45 public static void setUpClass() throws Exception { -46 } -47 -48 @AfterClass -49 public static void tearDownClass() throws Exception { -50 } -51 -52 @Before -53 public void setUp() { -54 } -55 -56 @After -57 public void tearDown() { -58 } -59 -60 /** -61 * Test of inspect method, of class JarAnalyzer. -62 * -63 * @throws Exception is thrown when an exception occurs. -64 */ -65 @Test -66 public void testAnalyze() throws Exception { -67 File file = new File(this.getClass().getClassLoader().getResource("struts2-core-2.1.2.jar").getPath()); -68 Dependency result = new Dependency(file); -69 JarAnalyzer instance = new JarAnalyzer(); -70 instance.analyze(result, null); -71 assertTrue(result.getVendorEvidence().toString().toLowerCase().contains("apache")); -72 assertTrue(result.getVendorEvidence().getWeighting().contains("apache")); -73 -74 file = new File(this.getClass().getClassLoader().getResource("org.mortbay.jetty.jar").getPath()); -75 result = new Dependency(file); -76 instance.analyze(result, null); -77 boolean found = false; -78 for (Evidence e : result.getProductEvidence()) { -79 if (e.getName().equalsIgnoreCase("package-title") -80 && e.getValue().equalsIgnoreCase("org.mortbay.http")) { -81 found = true; -82 break; -83 } -84 } -85 assertTrue("package-title of org.mortbay.http not found in org.mortbay.jetty.jar", found); -86 -87 found = false; -88 for (Evidence e : result.getVendorEvidence()) { -89 if (e.getName().equalsIgnoreCase("implementation-url") -90 && e.getValue().equalsIgnoreCase("http://jetty.mortbay.org")) { -91 found = true; -92 break; -93 } -94 } -95 assertTrue("implementation-url of http://jetty.mortbay.org not found in org.mortbay.jetty.jar", found); -96 -97 found = false; -98 for (Evidence e : result.getVersionEvidence()) { -99 if (e.getName().equalsIgnoreCase("Implementation-Version") -100 && e.getValue().equalsIgnoreCase("4.2.27")) { -101 found = true; -102 break; -103 } -104 } -105 assertTrue("implementation-version of 4.2.27 not found in org.mortbay.jetty.jar", found); -106 -107 file = new File(this.getClass().getClassLoader().getResource("org.mortbay.jmx.jar").getPath()); -108 result = new Dependency(file); -109 instance.analyze(result, null); -110 assertEquals("org.mortbar,jmx.jar has version evidence?", result.getVersionEvidence().size(), 0); -111 } -112 -113 /** -114 * Test of getSupportedExtensions method, of class JarAnalyzer. -115 */ -116 @Test -117 public void testGetSupportedExtensions() { -118 JarAnalyzer instance = new JarAnalyzer(); -119 Set expResult = new HashSet(); -120 expResult.add("jar"); -121 expResult.add("war"); -122 Set result = instance.getSupportedExtensions(); -123 assertEquals(expResult, result); -124 } -125 -126 /** -127 * Test of getName method, of class JarAnalyzer. -128 */ -129 @Test -130 public void testGetName() { -131 JarAnalyzer instance = new JarAnalyzer(); -132 String expResult = "Jar Analyzer"; -133 String result = instance.getName(); -134 assertEquals(expResult, result); -135 } -136 -137 /** -138 * Test of supportsExtension method, of class JarAnalyzer. -139 */ -140 @Test -141 public void testSupportsExtension() { -142 String extension = "jar"; -143 JarAnalyzer instance = new JarAnalyzer(); -144 boolean expResult = true; -145 boolean result = instance.supportsExtension(extension); -146 assertEquals(expResult, result); -147 } -148 -149 @Test -150 public void testInterpolateString() { -151 Properties prop = new Properties(); -152 prop.setProperty("key", "value"); -153 prop.setProperty("nested", "nested ${key}"); -154 String text = "This is a test of '${key}' '${nested}'"; -155 String expResults = "This is a test of 'value' 'nested value'"; -156 JarAnalyzer instance = new JarAnalyzer(); -157 String results = instance.interpolateString(text, prop); -158 assertEquals(expResults, results); -159 } -160 } +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. +17 */ +18 package org.owasp.dependencycheck.analyzer; +19 +20 import java.io.File; +21 import java.util.HashSet; +22 import java.util.Properties; +23 import java.util.Set; +24 import org.junit.After; +25 import org.junit.AfterClass; +26 import static org.junit.Assert.assertEquals; +27 import static org.junit.Assert.assertTrue; +28 import org.junit.Before; +29 import org.junit.BeforeClass; +30 import org.junit.Test; +31 import org.owasp.dependencycheck.dependency.Dependency; +32 import org.owasp.dependencycheck.dependency.Evidence; +33 +34 /** +35 * +36 * @author Jeremy Long <jeremy.long@owasp.org> +37 */ +38 public class JarAnalyzerTest { +39 +40 public JarAnalyzerTest() { +41 } +42 +43 @BeforeClass +44 public static void setUpClass() throws Exception { +45 } +46 +47 @AfterClass +48 public static void tearDownClass() throws Exception { +49 } +50 +51 @Before +52 public void setUp() { +53 } +54 +55 @After +56 public void tearDown() { +57 } +58 +59 /** +60 * Test of inspect method, of class JarAnalyzer. +61 * +62 * @throws Exception is thrown when an exception occurs. +63 */ +64 @Test +65 public void testAnalyze() throws Exception { +66 File file = new File(this.getClass().getClassLoader().getResource("struts2-core-2.1.2.jar").getPath()); +67 Dependency result = new Dependency(file); +68 JarAnalyzer instance = new JarAnalyzer(); +69 instance.analyze(result, null); +70 assertTrue(result.getVendorEvidence().toString().toLowerCase().contains("apache")); +71 assertTrue(result.getVendorEvidence().getWeighting().contains("apache")); +72 +73 file = new File(this.getClass().getClassLoader().getResource("org.mortbay.jetty.jar").getPath()); +74 result = new Dependency(file); +75 instance.analyze(result, null); +76 boolean found = false; +77 for (Evidence e : result.getProductEvidence()) { +78 if (e.getName().equalsIgnoreCase("package-title") +79 && e.getValue().equalsIgnoreCase("org.mortbay.http")) { +80 found = true; +81 break; +82 } +83 } +84 assertTrue("package-title of org.mortbay.http not found in org.mortbay.jetty.jar", found); +85 +86 found = false; +87 for (Evidence e : result.getVendorEvidence()) { +88 if (e.getName().equalsIgnoreCase("implementation-url") +89 && e.getValue().equalsIgnoreCase("http://jetty.mortbay.org")) { +90 found = true; +91 break; +92 } +93 } +94 assertTrue("implementation-url of http://jetty.mortbay.org not found in org.mortbay.jetty.jar", found); +95 +96 found = false; +97 for (Evidence e : result.getVersionEvidence()) { +98 if (e.getName().equalsIgnoreCase("Implementation-Version") +99 && e.getValue().equalsIgnoreCase("4.2.27")) { +100 found = true; +101 break; +102 } +103 } +104 assertTrue("implementation-version of 4.2.27 not found in org.mortbay.jetty.jar", found); +105 +106 file = new File(this.getClass().getClassLoader().getResource("org.mortbay.jmx.jar").getPath()); +107 result = new Dependency(file); +108 instance.analyze(result, null); +109 assertEquals("org.mortbar,jmx.jar has version evidence?", result.getVersionEvidence().size(), 0); +110 } +111 +112 /** +113 * Test of getSupportedExtensions method, of class JarAnalyzer. +114 */ +115 @Test +116 public void testGetSupportedExtensions() { +117 JarAnalyzer instance = new JarAnalyzer(); +118 Set expResult = new HashSet(); +119 expResult.add("jar"); +120 expResult.add("war"); +121 Set result = instance.getSupportedExtensions(); +122 assertEquals(expResult, result); +123 } +124 +125 /** +126 * Test of getName method, of class JarAnalyzer. +127 */ +128 @Test +129 public void testGetName() { +130 JarAnalyzer instance = new JarAnalyzer(); +131 String expResult = "Jar Analyzer"; +132 String result = instance.getName(); +133 assertEquals(expResult, result); +134 } +135 +136 /** +137 * Test of supportsExtension method, of class JarAnalyzer. +138 */ +139 @Test +140 public void testSupportsExtension() { +141 String extension = "jar"; +142 JarAnalyzer instance = new JarAnalyzer(); +143 boolean expResult = true; +144 boolean result = instance.supportsExtension(extension); +145 assertEquals(expResult, result); +146 } +147 +148 @Test +149 public void testInterpolateString() { +150 Properties prop = new Properties(); +151 prop.setProperty("key", "value"); +152 prop.setProperty("nested", "nested ${key}"); +153 String text = "This is a test of '${key}' '${nested}'"; +154 String expResults = "This is a test of 'value' 'nested value'"; +155 JarAnalyzer instance = new JarAnalyzer(); +156 String results = instance.interpolateString(text, prop); +157 assertEquals(expResults, results); +158 } +159 }
    diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/package-frame.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/package-frame.html index 2fe1bc605..e2425d3fe 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/package-frame.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.0.8 Reference Package org.owasp.dependencycheck.analyzer + Dependency-Check Core 1.1.0 Reference Package org.owasp.dependencycheck.analyzer @@ -26,6 +26,12 @@
  • CPEAnalyzerTest +
    • +
  • + DependencyBundlingAnalyzerTest +
    • +
  • + FalsePositiveAnalyzerTest
  • FileNameAnalyzerTest diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/package-summary.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/package-summary.html index 34011a3fc..5da2d9eda 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/package-summary.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/analyzer/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.0.8 Reference Package org.owasp.dependencycheck.analyzer + Dependency-Check Core 1.1.0 Reference Package org.owasp.dependencycheck.analyzer @@ -54,6 +54,16 @@ CPEAnalyzerTest + + + + DependencyBundlingAnalyzerTest + + + + + FalsePositiveAnalyzerTest + diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/cpe/BaseIndexTestCase.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/cpe/BaseIndexTestCase.html index 6535ccc31..b276e8e1f 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/cpe/BaseIndexTestCase.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/cpe/BaseIndexTestCase.html @@ -9,57 +9,56 @@ 1 /* 2 * This file is part of dependency-check-core. 3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. -18 */ -19 package org.owasp.dependencycheck.data.cpe; -20 -21 import junit.framework.TestCase; -22 import org.junit.After; -23 import org.junit.AfterClass; -24 import org.junit.Before; -25 import org.junit.BeforeClass; -26 import org.owasp.dependencycheck.data.nvdcve.BaseDBTestCase; -27 -28 /** -29 * -30 * @author Jeremy Long <jeremy.long@owasp.org> -31 */ -32 public abstract class BaseIndexTestCase extends TestCase { -33 -34 @BeforeClass -35 public static void setUpClass() throws Exception { -36 } -37 -38 @AfterClass -39 public static void tearDownClass() throws Exception { -40 } -41 -42 @Before -43 @Override -44 public void setUp() throws Exception { -45 BaseDBTestCase.ensureDBExists(); -46 super.setUp(); -47 } -48 -49 @After -50 @Override -51 public void tearDown() throws Exception { -52 super.tearDown(); -53 } -54 } +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. +17 */ +18 package org.owasp.dependencycheck.data.cpe; +19 +20 import junit.framework.TestCase; +21 import org.junit.After; +22 import org.junit.AfterClass; +23 import org.junit.Before; +24 import org.junit.BeforeClass; +25 import org.owasp.dependencycheck.data.nvdcve.BaseDBTestCase; +26 +27 /** +28 * +29 * @author Jeremy Long <jeremy.long@owasp.org> +30 */ +31 public abstract class BaseIndexTestCase extends TestCase { +32 +33 @BeforeClass +34 public static void setUpClass() throws Exception { +35 } +36 +37 @AfterClass +38 public static void tearDownClass() throws Exception { +39 } +40 +41 @Before +42 @Override +43 public void setUp() throws Exception { +44 BaseDBTestCase.ensureDBExists(); +45 super.setUp(); +46 } +47 +48 @After +49 @Override +50 public void tearDown() throws Exception { +51 super.tearDown(); +52 } +53 }
    diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/cpe/IndexEntryTest.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/cpe/IndexEntryTest.html index 3f9656b7a..cf2c4d930 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/cpe/IndexEntryTest.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/cpe/IndexEntryTest.html @@ -9,74 +9,72 @@ 1 /* 2 * This file is part of dependency-check-core. 3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. -18 */ -19 package org.owasp.dependencycheck.data.cpe; -20 -21 import org.owasp.dependencycheck.data.cpe.IndexEntry; -22 import junit.framework.TestCase; -23 import org.junit.After; -24 import org.junit.AfterClass; -25 import org.junit.Before; -26 import org.junit.BeforeClass; -27 import org.junit.Test; -28 import org.junit.Assert; -29 -30 /** -31 * -32 * @author Jeremy Long <jeremy.long@owasp.org> -33 */ -34 public class IndexEntryTest extends TestCase { -35 -36 @BeforeClass -37 public static void setUpClass() throws Exception { -38 } -39 -40 @AfterClass -41 public static void tearDownClass() throws Exception { -42 } -43 -44 @Before -45 @Override -46 public void setUp() throws Exception { -47 super.setUp(); -48 } -49 -50 @After -51 @Override -52 public void tearDown() throws Exception { -53 super.tearDown(); -54 } -55 -56 /** -57 * Test of setName method, of class IndexEntry. -58 * -59 * @throws Exception is thrown when an exception occurs. -60 */ -61 @Test -62 public void testSetName() throws Exception { -63 String name = "cpe:/a:apache:struts:1.1:rc2"; -64 -65 IndexEntry instance = new IndexEntry(); -66 instance.parseName(name); -67 -68 Assert.assertEquals("apache", instance.getVendor()); -69 Assert.assertEquals("struts", instance.getProduct()); -70 } -71 } +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. +17 */ +18 package org.owasp.dependencycheck.data.cpe; +19 +20 import junit.framework.TestCase; +21 import org.junit.After; +22 import org.junit.AfterClass; +23 import org.junit.Assert; +24 import org.junit.Before; +25 import org.junit.BeforeClass; +26 import org.junit.Test; +27 +28 /** +29 * +30 * @author Jeremy Long <jeremy.long@owasp.org> +31 */ +32 public class IndexEntryTest extends TestCase { +33 +34 @BeforeClass +35 public static void setUpClass() throws Exception { +36 } +37 +38 @AfterClass +39 public static void tearDownClass() throws Exception { +40 } +41 +42 @Before +43 @Override +44 public void setUp() throws Exception { +45 super.setUp(); +46 } +47 +48 @After +49 @Override +50 public void tearDown() throws Exception { +51 super.tearDown(); +52 } +53 +54 /** +55 * Test of setName method, of class IndexEntry. +56 * +57 * @throws Exception is thrown when an exception occurs. +58 */ +59 @Test +60 public void testSetName() throws Exception { +61 String name = "cpe:/a:apache:struts:1.1:rc2"; +62 +63 IndexEntry instance = new IndexEntry(); +64 instance.parseName(name); +65 +66 Assert.assertEquals("apache", instance.getVendor()); +67 Assert.assertEquals("struts", instance.getProduct()); +68 } +69 }
    diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/cpe/package-frame.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/cpe/package-frame.html index e3601d1de..a2ccc798a 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/cpe/package-frame.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/cpe/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.0.8 Reference Package org.owasp.dependencycheck.data.cpe + Dependency-Check Core 1.1.0 Reference Package org.owasp.dependencycheck.data.cpe diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/cpe/package-summary.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/cpe/package-summary.html index b71f4ecb3..5e81ba53f 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/cpe/package-summary.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/cpe/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.0.8 Reference Package org.owasp.dependencycheck.data.cpe + Dependency-Check Core 1.1.0 Reference Package org.owasp.dependencycheck.data.cpe diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/cwe/CweDBTest.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/cwe/CweDBTest.html index 73672434b..9f2ddf69d 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/cwe/CweDBTest.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/cwe/CweDBTest.html @@ -9,87 +9,85 @@ 1 /* 2 * This file is part of dependency-check-core. 3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. -18 */ -19 package org.owasp.dependencycheck.data.cwe; -20 -21 import org.owasp.dependencycheck.data.cwe.CweDB; -22 import org.junit.After; -23 import org.junit.AfterClass; -24 import org.junit.Before; -25 import org.junit.BeforeClass; -26 import org.junit.Test; -27 import static org.junit.Assert.*; -28 -29 /** -30 * -31 * @author Jeremy Long <jeremy.long@owasp.org> -32 */ -33 public class CweDBTest { -34 -35 public CweDBTest() { -36 } -37 -38 @BeforeClass -39 public static void setUpClass() throws Exception { -40 } -41 -42 @AfterClass -43 public static void tearDownClass() throws Exception { -44 } -45 -46 @Before -47 public void setUp() { -48 } -49 -50 @After -51 public void tearDown() { -52 } -53 -54 /** -55 * Method to serialize the CWE HashMap. This is not used in production; this -56 * is only used once during dev to create the serialized HashMap. -57 */ -58 // @Test -59 // public void testUpdate() throws Exception { -60 // SAXParserFactory factory = SAXParserFactory.newInstance(); -61 // SAXParser saxParser = factory.newSAXParser(); -62 // -63 // CweHandler handler = new CweHandler(); -64 // File file = new File(this.getClass().getClassLoader().getResource("cwe.2000.xml").getPath()); -65 // -66 // saxParser.parse(file, handler); -67 // System.out.println("Found " + handler.getCwe().size() + " cwe entries."); -68 // Map<String,String> cwe = handler.getCwe(); -69 // FileOutputStream fout = new FileOutputStream("src/main/resources/data/cwe.hashmap.serialized"); -70 // ObjectOutputStream objOut = new ObjectOutputStream(fout); -71 // objOut.writeObject(cwe); -72 // objOut.close(); -73 // } -74 /** -75 * Test of getCweName method, of class CweDB. -76 */ -77 @Test -78 public void testGetCweName() { -79 String cweId = "CWE-16"; -80 String expResult = "Configuration"; -81 String result = CweDB.getCweName(cweId); -82 assertEquals(expResult, result); -83 } -84 } +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. +17 */ +18 package org.owasp.dependencycheck.data.cwe; +19 +20 import org.junit.After; +21 import org.junit.AfterClass; +22 import static org.junit.Assert.assertEquals; +23 import org.junit.Before; +24 import org.junit.BeforeClass; +25 import org.junit.Test; +26 +27 /** +28 * +29 * @author Jeremy Long <jeremy.long@owasp.org> +30 */ +31 public class CweDBTest { +32 +33 public CweDBTest() { +34 } +35 +36 @BeforeClass +37 public static void setUpClass() throws Exception { +38 } +39 +40 @AfterClass +41 public static void tearDownClass() throws Exception { +42 } +43 +44 @Before +45 public void setUp() { +46 } +47 +48 @After +49 public void tearDown() { +50 } +51 +52 /** +53 * Method to serialize the CWE HashMap. This is not used in production; this is only used once during dev to create +54 * the serialized HashMap. +55 */ +56 // @Test +57 // public void testUpdate() throws Exception { +58 // SAXParserFactory factory = SAXParserFactory.newInstance(); +59 // SAXParser saxParser = factory.newSAXParser(); +60 // +61 // CweHandler handler = new CweHandler(); +62 // File file = new File(this.getClass().getClassLoader().getResource("cwe.2000.xml").getPath()); +63 // +64 // saxParser.parse(file, handler); +65 // System.out.println("Found " + handler.getCwe().size() + " cwe entries."); +66 // Map<String,String> cwe = handler.getCwe(); +67 // FileOutputStream fout = new FileOutputStream("src/main/resources/data/cwe.hashmap.serialized"); +68 // ObjectOutputStream objOut = new ObjectOutputStream(fout); +69 // objOut.writeObject(cwe); +70 // objOut.close(); +71 // } +72 /** +73 * Test of getCweName method, of class CweDB. +74 */ +75 @Test +76 public void testGetCweName() { +77 String cweId = "CWE-16"; +78 String expResult = "Configuration"; +79 String result = CweDB.getCweName(cweId); +80 assertEquals(expResult, result); +81 } +82 }
    diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/cwe/package-frame.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/cwe/package-frame.html index ae0433df5..616ba600e 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/cwe/package-frame.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/cwe/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.0.8 Reference Package org.owasp.dependencycheck.data.cwe + Dependency-Check Core 1.1.0 Reference Package org.owasp.dependencycheck.data.cwe diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/cwe/package-summary.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/cwe/package-summary.html index 4c5493b16..a5807baad 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/cwe/package-summary.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/cwe/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.0.8 Reference Package org.owasp.dependencycheck.data.cwe + Dependency-Check Core 1.1.0 Reference Package org.owasp.dependencycheck.data.cwe diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/lucene/FieldAnalyzerTest.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/lucene/FieldAnalyzerTest.html index 172f05e07..a9b69a47d 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/lucene/FieldAnalyzerTest.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/lucene/FieldAnalyzerTest.html @@ -9,133 +9,131 @@ 1 /* 2 * This file is part of dependency-check-core. 3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. -18 */ -19 package org.owasp.dependencycheck.data.lucene; -20 -21 import org.owasp.dependencycheck.data.lucene.SearchFieldAnalyzer; -22 import org.owasp.dependencycheck.data.lucene.FieldAnalyzer; +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. +17 */ +18 package org.owasp.dependencycheck.data.lucene; +19 +20 import java.io.IOException; +21 import java.util.HashMap; +22 import org.apache.lucene.analysis.Analyzer; 23 import org.apache.lucene.analysis.miscellaneous.PerFieldAnalyzerWrapper; -24 import java.util.HashMap; -25 import org.apache.lucene.queryparser.classic.QueryParser; -26 import org.apache.lucene.analysis.standard.StandardAnalyzer; -27 import org.apache.lucene.analysis.Analyzer; -28 import org.apache.lucene.search.ScoreDoc; -29 import org.apache.lucene.search.TopScoreDocCollector; -30 import org.apache.lucene.search.IndexSearcher; -31 import org.apache.lucene.index.IndexReader; -32 import org.apache.lucene.search.Query; -33 import java.io.IOException; -34 import org.apache.lucene.document.Field; -35 import org.apache.lucene.document.TextField; -36 import org.apache.lucene.document.Document; -37 import org.apache.lucene.index.DirectoryReader; -38 import org.apache.lucene.index.IndexWriter; -39 import org.apache.lucene.index.IndexWriterConfig; -40 import org.apache.lucene.store.RAMDirectory; -41 import org.apache.lucene.store.Directory; -42 import org.junit.After; -43 import org.junit.AfterClass; -44 import org.junit.Before; -45 import org.junit.BeforeClass; -46 import org.junit.Test; -47 import static org.junit.Assert.*; -48 -49 /** -50 * -51 * @author Jeremy Long <jeremy.long@owasp.org> -52 */ -53 public class FieldAnalyzerTest { -54 -55 @BeforeClass -56 public static void setUpClass() throws Exception { -57 } -58 -59 @AfterClass -60 public static void tearDownClass() throws Exception { -61 } -62 -63 @Before -64 public void setUp() { -65 } -66 -67 @After -68 public void tearDown() { -69 } -70 -71 @Test -72 public void testAnalyzers() throws Exception { -73 -74 Analyzer analyzer = new FieldAnalyzer(LuceneUtils.CURRENT_VERSION); -75 Directory index = new RAMDirectory(); -76 -77 String field1 = "product"; -78 String text1 = "springframework"; -79 -80 String field2 = "vendor"; -81 String text2 = "springsource"; +24 import org.apache.lucene.analysis.standard.StandardAnalyzer; +25 import org.apache.lucene.document.Document; +26 import org.apache.lucene.document.Field; +27 import org.apache.lucene.document.TextField; +28 import org.apache.lucene.index.DirectoryReader; +29 import org.apache.lucene.index.IndexReader; +30 import org.apache.lucene.index.IndexWriter; +31 import org.apache.lucene.index.IndexWriterConfig; +32 import org.apache.lucene.queryparser.classic.QueryParser; +33 import org.apache.lucene.search.IndexSearcher; +34 import org.apache.lucene.search.Query; +35 import org.apache.lucene.search.ScoreDoc; +36 import org.apache.lucene.search.TopScoreDocCollector; +37 import org.apache.lucene.store.Directory; +38 import org.apache.lucene.store.RAMDirectory; +39 import org.junit.After; +40 import org.junit.AfterClass; +41 import static org.junit.Assert.assertEquals; +42 import static org.junit.Assert.assertFalse; +43 import org.junit.Before; +44 import org.junit.BeforeClass; +45 import org.junit.Test; +46 +47 /** +48 * +49 * @author Jeremy Long <jeremy.long@owasp.org> +50 */ +51 public class FieldAnalyzerTest { +52 +53 @BeforeClass +54 public static void setUpClass() throws Exception { +55 } +56 +57 @AfterClass +58 public static void tearDownClass() throws Exception { +59 } +60 +61 @Before +62 public void setUp() { +63 } +64 +65 @After +66 public void tearDown() { +67 } +68 +69 @Test +70 public void testAnalyzers() throws Exception { +71 +72 Analyzer analyzer = new FieldAnalyzer(LuceneUtils.CURRENT_VERSION); +73 Directory index = new RAMDirectory(); +74 +75 String field1 = "product"; +76 String text1 = "springframework"; +77 +78 String field2 = "vendor"; +79 String text2 = "springsource"; +80 +81 createIndex(analyzer, index, field1, text1, field2, text2); 82 -83 createIndex(analyzer, index, field1, text1, field2, text2); -84 -85 //Analyzer searchingAnalyzer = new SearchFieldAnalyzer(LuceneUtils.CURRENT_VERSION); -86 String querystr = "product:\"(Spring Framework Core)\" vendor:(SpringSource)"; -87 -88 SearchFieldAnalyzer searchAnalyzerProduct = new SearchFieldAnalyzer(LuceneUtils.CURRENT_VERSION); -89 SearchFieldAnalyzer searchAnalyzerVendor = new SearchFieldAnalyzer(LuceneUtils.CURRENT_VERSION); -90 HashMap<String, Analyzer> map = new HashMap<String, Analyzer>(); -91 map.put(field1, searchAnalyzerProduct); -92 map.put(field2, searchAnalyzerVendor); -93 PerFieldAnalyzerWrapper wrapper = new PerFieldAnalyzerWrapper(new StandardAnalyzer(LuceneUtils.CURRENT_VERSION), map); -94 QueryParser parser = new QueryParser(LuceneUtils.CURRENT_VERSION, field1, wrapper); -95 -96 Query q = parser.parse(querystr); -97 //System.out.println(q.toString()); +83 //Analyzer searchingAnalyzer = new SearchFieldAnalyzer(LuceneUtils.CURRENT_VERSION); +84 String querystr = "product:\"(Spring Framework Core)\" vendor:(SpringSource)"; +85 +86 SearchFieldAnalyzer searchAnalyzerProduct = new SearchFieldAnalyzer(LuceneUtils.CURRENT_VERSION); +87 SearchFieldAnalyzer searchAnalyzerVendor = new SearchFieldAnalyzer(LuceneUtils.CURRENT_VERSION); +88 HashMap<String, Analyzer> map = new HashMap<String, Analyzer>(); +89 map.put(field1, searchAnalyzerProduct); +90 map.put(field2, searchAnalyzerVendor); +91 PerFieldAnalyzerWrapper wrapper = new PerFieldAnalyzerWrapper(new StandardAnalyzer(LuceneUtils.CURRENT_VERSION), map); +92 QueryParser parser = new QueryParser(LuceneUtils.CURRENT_VERSION, field1, wrapper); +93 +94 Query q = parser.parse(querystr); +95 //System.out.println(q.toString()); +96 +97 int hitsPerPage = 10; 98 -99 int hitsPerPage = 10; -100 -101 IndexReader reader = DirectoryReader.open(index); -102 IndexSearcher searcher = new IndexSearcher(reader); -103 TopScoreDocCollector collector = TopScoreDocCollector.create(hitsPerPage, true); -104 searcher.search(q, collector); -105 ScoreDoc[] hits = collector.topDocs().scoreDocs; +99 IndexReader reader = DirectoryReader.open(index); +100 IndexSearcher searcher = new IndexSearcher(reader); +101 TopScoreDocCollector collector = TopScoreDocCollector.create(hitsPerPage, true); +102 searcher.search(q, collector); +103 ScoreDoc[] hits = collector.topDocs().scoreDocs; +104 +105 assertEquals("Did not find 1 document?", 1, hits.length); 106 -107 assertEquals("Did not find 1 document?", 1, hits.length); -108 -109 searchAnalyzerProduct.clear(); //ensure we don't have anything left over from the previous search. -110 searchAnalyzerVendor.clear(); -111 querystr = "product:(Apache Struts) vendor:(Apache)"; -112 Query q2 = parser.parse(querystr); -113 //System.out.println(q2.toString()); -114 assertFalse("second parsing contains previousWord from the TokenPairConcatenatingFilter", q2.toString().contains("core")); -115 } -116 -117 private void createIndex(Analyzer analyzer, Directory index, String field1, String text1, String field2, String text2) throws IOException { -118 IndexWriterConfig config = new IndexWriterConfig(LuceneUtils.CURRENT_VERSION, analyzer); -119 IndexWriter w = new IndexWriter(index, config); -120 addDoc(w, field1, text1, field2, text2); -121 w.close(); -122 } -123 -124 private static void addDoc(IndexWriter w, String field1, String text1, String field2, String text2) throws IOException { -125 Document doc = new Document(); -126 doc.add(new TextField(field1, text1, Field.Store.YES)); -127 doc.add(new TextField(field2, text2, Field.Store.YES)); -128 w.addDocument(doc); -129 } -130 } +107 searchAnalyzerProduct.clear(); //ensure we don't have anything left over from the previous search. +108 searchAnalyzerVendor.clear(); +109 querystr = "product:(Apache Struts) vendor:(Apache)"; +110 Query q2 = parser.parse(querystr); +111 //System.out.println(q2.toString()); +112 assertFalse("second parsing contains previousWord from the TokenPairConcatenatingFilter", q2.toString().contains("core")); +113 } +114 +115 private void createIndex(Analyzer analyzer, Directory index, String field1, String text1, String field2, String text2) throws IOException { +116 IndexWriterConfig config = new IndexWriterConfig(LuceneUtils.CURRENT_VERSION, analyzer); +117 IndexWriter w = new IndexWriter(index, config); +118 addDoc(w, field1, text1, field2, text2); +119 w.close(); +120 } +121 +122 private static void addDoc(IndexWriter w, String field1, String text1, String field2, String text2) throws IOException { +123 Document doc = new Document(); +124 doc.add(new TextField(field1, text1, Field.Store.YES)); +125 doc.add(new TextField(field2, text2, Field.Store.YES)); +126 w.addDocument(doc); +127 } +128 }
    diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/lucene/LuceneUtilsTest.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/lucene/LuceneUtilsTest.html index 64240637c..74eba374a 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/lucene/LuceneUtilsTest.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/lucene/LuceneUtilsTest.html @@ -9,98 +9,96 @@ 1 /* 2 * This file is part of dependency-check-core. 3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. -18 */ -19 package org.owasp.dependencycheck.data.lucene; -20 -21 import org.owasp.dependencycheck.data.lucene.LuceneUtils; -22 import org.junit.After; -23 import org.junit.AfterClass; -24 import org.junit.Before; -25 import org.junit.BeforeClass; -26 import org.junit.Test; -27 import static org.junit.Assert.*; -28 -29 /** -30 * -31 * @author Jeremy Long <jeremy.long@owasp.org> -32 */ -33 public class LuceneUtilsTest { -34 -35 @BeforeClass -36 public static void setUpClass() throws Exception { -37 } -38 -39 @AfterClass -40 public static void tearDownClass() throws Exception { -41 } -42 -43 @Before -44 public void setUp() { -45 } -46 -47 @After -48 public void tearDown() { -49 } -50 -51 /** -52 * Test of appendEscapedLuceneQuery method, of class LuceneUtils. -53 */ -54 @Test -55 public void testAppendEscapedLuceneQuery() { -56 StringBuilder buf = new StringBuilder(); -57 CharSequence text = "test encoding + - & | ! ( ) { } [ ] ^ \" ~ * ? : \\"; -58 String expResult = "test encoding \\+ \\- \\& \\| \\! \\( \\) \\{ \\} \\[ \\] \\^ \\\" \\~ \\* \\? \\: \\\\"; -59 LuceneUtils.appendEscapedLuceneQuery(buf, text); -60 assertEquals(expResult, buf.toString()); -61 } -62 -63 /** -64 * Test of appendEscapedLuceneQuery method, of class LuceneUtils. -65 */ -66 @Test -67 public void testAppendEscapedLuceneQuery_null() { -68 StringBuilder buf = new StringBuilder(); -69 CharSequence text = null; -70 LuceneUtils.appendEscapedLuceneQuery(buf, text); -71 assertEquals(0, buf.length()); -72 } -73 -74 /** -75 * Test of escapeLuceneQuery method, of class LuceneUtils. -76 */ -77 @Test -78 public void testEscapeLuceneQuery() { -79 CharSequence text = "test encoding + - & | ! ( ) { } [ ] ^ \" ~ * ? : \\"; -80 String expResult = "test encoding \\+ \\- \\& \\| \\! \\( \\) \\{ \\} \\[ \\] \\^ \\\" \\~ \\* \\? \\: \\\\"; -81 String result = LuceneUtils.escapeLuceneQuery(text); -82 assertEquals(expResult, result); -83 } -84 -85 /** -86 * Test of escapeLuceneQuery method, of class LuceneUtils. -87 */ -88 @Test -89 public void testEscapeLuceneQuery_null() { -90 CharSequence text = null; -91 String expResult = null; -92 String result = LuceneUtils.escapeLuceneQuery(text); -93 assertEquals(expResult, result); -94 } -95 } +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. +17 */ +18 package org.owasp.dependencycheck.data.lucene; +19 +20 import org.junit.After; +21 import org.junit.AfterClass; +22 import static org.junit.Assert.assertEquals; +23 import org.junit.Before; +24 import org.junit.BeforeClass; +25 import org.junit.Test; +26 +27 /** +28 * +29 * @author Jeremy Long <jeremy.long@owasp.org> +30 */ +31 public class LuceneUtilsTest { +32 +33 @BeforeClass +34 public static void setUpClass() throws Exception { +35 } +36 +37 @AfterClass +38 public static void tearDownClass() throws Exception { +39 } +40 +41 @Before +42 public void setUp() { +43 } +44 +45 @After +46 public void tearDown() { +47 } +48 +49 /** +50 * Test of appendEscapedLuceneQuery method, of class LuceneUtils. +51 */ +52 @Test +53 public void testAppendEscapedLuceneQuery() { +54 StringBuilder buf = new StringBuilder(); +55 CharSequence text = "test encoding + - & | ! ( ) { } [ ] ^ \" ~ * ? : \\"; +56 String expResult = "test encoding \\+ \\- \\& \\| \\! \\( \\) \\{ \\} \\[ \\] \\^ \\\" \\~ \\* \\? \\: \\\\"; +57 LuceneUtils.appendEscapedLuceneQuery(buf, text); +58 assertEquals(expResult, buf.toString()); +59 } +60 +61 /** +62 * Test of appendEscapedLuceneQuery method, of class LuceneUtils. +63 */ +64 @Test +65 public void testAppendEscapedLuceneQuery_null() { +66 StringBuilder buf = new StringBuilder(); +67 CharSequence text = null; +68 LuceneUtils.appendEscapedLuceneQuery(buf, text); +69 assertEquals(0, buf.length()); +70 } +71 +72 /** +73 * Test of escapeLuceneQuery method, of class LuceneUtils. +74 */ +75 @Test +76 public void testEscapeLuceneQuery() { +77 CharSequence text = "test encoding + - & | ! ( ) { } [ ] ^ \" ~ * ? : \\"; +78 String expResult = "test encoding \\+ \\- \\& \\| \\! \\( \\) \\{ \\} \\[ \\] \\^ \\\" \\~ \\* \\? \\: \\\\"; +79 String result = LuceneUtils.escapeLuceneQuery(text); +80 assertEquals(expResult, result); +81 } +82 +83 /** +84 * Test of escapeLuceneQuery method, of class LuceneUtils. +85 */ +86 @Test +87 public void testEscapeLuceneQuery_null() { +88 CharSequence text = null; +89 String expResult = null; +90 String result = LuceneUtils.escapeLuceneQuery(text); +91 assertEquals(expResult, result); +92 } +93 }
    diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/lucene/TokenPairConcatenatingFilterTest.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/lucene/TokenPairConcatenatingFilterTest.html index a42e50d27..e15a44399 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/lucene/TokenPairConcatenatingFilterTest.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/lucene/TokenPairConcatenatingFilterTest.html @@ -7,75 +7,90 @@ 
     1   /*
-2    * To change this template, choose Tools | Templates
-3    * and open the template in the editor.
-4    */
-5   package org.owasp.dependencycheck.data.lucene;
-6   
-7   import java.io.IOException;
-8   import java.io.StringReader;
-9   import org.apache.lucene.analysis.BaseTokenStreamTestCase;
-10  import org.apache.lucene.analysis.TokenStream;
-11  import org.apache.lucene.analysis.Tokenizer;
-12  import org.apache.lucene.analysis.core.WhitespaceTokenizer;
-13  import org.junit.After;
-14  import org.junit.AfterClass;
-15  import org.junit.Before;
-16  import org.junit.BeforeClass;
-17  import org.junit.Test;
-18  import static org.apache.lucene.analysis.BaseTokenStreamTestCase.assertTokenStreamContents;
-19  import static org.junit.Assert.*;
-20  
-21  /**
-22   *
-23   * @author Jeremy Long <jeremy.long@owasp.org>
-24   */
-25  public class TokenPairConcatenatingFilterTest extends BaseTokenStreamTestCase {
-26  
-27      @BeforeClass
-28      public static void setUpClass() {
-29      }
-30  
-31      @AfterClass
-32      public static void tearDownClass() {
-33      }
-34  
-35      @Before
-36      public void setUp() throws Exception {
-37          super.setUp();
-38      }
-39  
-40      @After
-41      public void tearDown() throws Exception {
-42          super.tearDown();
-43      }
-44  
-45      /**
-46       * test some examples
-47       */
-48      public void testExamples() throws IOException {
-49          Tokenizer wsTokenizer = new WhitespaceTokenizer(LuceneUtils.CURRENT_VERSION, new StringReader("one two three"));
-50          TokenStream filter = new TokenPairConcatenatingFilter(wsTokenizer);
-51          assertTokenStreamContents(filter,
-52                  new String[]{"one", "onetwo", "two", "twothree", "three"});
+2    * This file is part of dependency-check-core.
+3    *
+4    * Licensed under the Apache License, Version 2.0 (the "License");
+5    * you may not use this file except in compliance with the License.
+6    * You may obtain a copy of the License at
+7    *
+8    *     http://www.apache.org/licenses/LICENSE-2.0
+9    *
+10   * Unless required by applicable law or agreed to in writing, software
+11   * distributed under the License is distributed on an "AS IS" BASIS,
+12   * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+13   * See the License for the specific language governing permissions and
+14   * limitations under the License.
+15   *
+16   * Copyright (c) 2013 Jeremy Long. All Rights Reserved.
+17   */
+18  package org.owasp.dependencycheck.data.lucene;
+19  
+20  import java.io.IOException;
+21  import java.io.StringReader;
+22  import org.apache.lucene.analysis.BaseTokenStreamTestCase;
+23  import static org.apache.lucene.analysis.BaseTokenStreamTestCase.assertTokenStreamContents;
+24  import org.apache.lucene.analysis.TokenStream;
+25  import org.apache.lucene.analysis.Tokenizer;
+26  import org.apache.lucene.analysis.core.WhitespaceTokenizer;
+27  import org.junit.After;
+28  import org.junit.AfterClass;
+29  import static org.junit.Assert.assertNotNull;
+30  import static org.junit.Assert.assertNull;
+31  import static org.junit.Assert.assertTrue;
+32  import org.junit.Before;
+33  import org.junit.BeforeClass;
+34  import org.junit.Test;
+35  
+36  /**
+37   *
+38   * @author Jeremy Long <jeremy.long@owasp.org>
+39   */
+40  public class TokenPairConcatenatingFilterTest extends BaseTokenStreamTestCase {
+41  
+42      @BeforeClass
+43      public static void setUpClass() {
+44      }
+45  
+46      @AfterClass
+47      public static void tearDownClass() {
+48      }
+49  
+50      @Before
+51      public void setUp() throws Exception {
+52          super.setUp();
 53      }
 54  
-55      /**
-56       * Test of clear method, of class TokenPairConcatenatingFilter.
-57       */
-58      @Test
-59      public void testClear() throws IOException {
-60  
-61          TokenStream ts = new WhitespaceTokenizer(LuceneUtils.CURRENT_VERSION, new StringReader("one two three"));
-62          TokenPairConcatenatingFilter filter = new TokenPairConcatenatingFilter(ts);
-63          assertTokenStreamContents(filter, new String[]{"one", "onetwo", "two", "twothree", "three"});
-64  
-65          assertNotNull(filter.getPreviousWord());
-66          filter.clear();
-67          assertNull(filter.getPreviousWord());
-68          assertTrue(filter.getWords().isEmpty());
-69      }
-70  }
+55      @After
+56      public void tearDown() throws Exception {
+57          super.tearDown();
+58      }
+59  
+60      /**
+61       * test some examples
+62       */
+63      public void testExamples() throws IOException {
+64          Tokenizer wsTokenizer = new WhitespaceTokenizer(LuceneUtils.CURRENT_VERSION, new StringReader("one two three"));
+65          TokenStream filter = new TokenPairConcatenatingFilter(wsTokenizer);
+66          assertTokenStreamContents(filter,
+67                  new String[]{"one", "onetwo", "two", "twothree", "three"});
+68      }
+69  
+70      /**
+71       * Test of clear method, of class TokenPairConcatenatingFilter.
+72       */
+73      @Test
+74      public void testClear() throws IOException {
+75  
+76          TokenStream ts = new WhitespaceTokenizer(LuceneUtils.CURRENT_VERSION, new StringReader("one two three"));
+77          TokenPairConcatenatingFilter filter = new TokenPairConcatenatingFilter(ts);
+78          assertTokenStreamContents(filter, new String[]{"one", "onetwo", "two", "twothree", "three"});
+79  
+80          assertNotNull(filter.getPreviousWord());
+81          filter.clear();
+82          assertNull(filter.getPreviousWord());
+83          assertTrue(filter.getWords().isEmpty());
+84      }
+85  }
    diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/lucene/UrlTokenizingFilterTest.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/lucene/UrlTokenizingFilterTest.html index 740312d88..901ee3d8f 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/lucene/UrlTokenizingFilterTest.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/lucene/UrlTokenizingFilterTest.html @@ -7,99 +7,112 @@ 
     1   /*
-2    * To change this template, choose Tools | Templates
-3    * and open the template in the editor.
-4    */
-5   package org.owasp.dependencycheck.data.lucene;
-6   
-7   import java.io.IOException;
-8   import java.io.Reader;
-9   import org.apache.lucene.analysis.Analyzer;
-10  import org.apache.lucene.analysis.Analyzer.TokenStreamComponents;
-11  import org.apache.lucene.analysis.BaseTokenStreamTestCase;
-12  import static org.apache.lucene.analysis.BaseTokenStreamTestCase.checkOneTerm;
-13  import org.apache.lucene.analysis.MockTokenizer;
-14  import org.apache.lucene.analysis.Tokenizer;
-15  import org.apache.lucene.analysis.core.KeywordTokenizer;
-16  import org.junit.After;
-17  import org.junit.AfterClass;
-18  import org.junit.Before;
-19  import org.junit.BeforeClass;
-20  
-21  /**
-22   *
-23   * @author Jeremy Long <jeremy.long@owasp.org>
-24   */
-25  public class UrlTokenizingFilterTest extends BaseTokenStreamTestCase {
-26  
-27      private Analyzer analyzer;
-28  
-29      public UrlTokenizingFilterTest() {
-30          analyzer = new Analyzer() {
-31              @Override
-32              protected TokenStreamComponents createComponents(String fieldName,
-33                      Reader reader) {
-34                  Tokenizer source = new MockTokenizer(reader, MockTokenizer.WHITESPACE, false);
-35                  return new TokenStreamComponents(source, new UrlTokenizingFilter(source));
-36              }
-37          };
-38      }
+2    * This file is part of dependency-check-core.
+3    *
+4    * Licensed under the Apache License, Version 2.0 (the "License");
+5    * you may not use this file except in compliance with the License.
+6    * You may obtain a copy of the License at
+7    *
+8    *     http://www.apache.org/licenses/LICENSE-2.0
+9    *
+10   * Unless required by applicable law or agreed to in writing, software
+11   * distributed under the License is distributed on an "AS IS" BASIS,
+12   * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+13   * See the License for the specific language governing permissions and
+14   * limitations under the License.
+15   *
+16   * Copyright (c) 2013 Jeremy Long. All Rights Reserved.
+17   */
+18  package org.owasp.dependencycheck.data.lucene;
+19  
+20  import java.io.IOException;
+21  import java.io.Reader;
+22  import org.apache.lucene.analysis.Analyzer;
+23  import org.apache.lucene.analysis.Analyzer.TokenStreamComponents;
+24  import org.apache.lucene.analysis.BaseTokenStreamTestCase;
+25  import static org.apache.lucene.analysis.BaseTokenStreamTestCase.checkOneTerm;
+26  import org.apache.lucene.analysis.MockTokenizer;
+27  import org.apache.lucene.analysis.Tokenizer;
+28  import org.apache.lucene.analysis.core.KeywordTokenizer;
+29  import org.junit.After;
+30  import org.junit.AfterClass;
+31  import org.junit.Before;
+32  import org.junit.BeforeClass;
+33  
+34  /**
+35   *
+36   * @author Jeremy Long <jeremy.long@owasp.org>
+37   */
+38  public class UrlTokenizingFilterTest extends BaseTokenStreamTestCase {
 39  
-40      @BeforeClass
-41      public static void setUpClass() {
-42      }
-43  
-44      @AfterClass
-45      public static void tearDownClass() {
-46      }
-47  
-48      @Before
-49      public void setUp() throws Exception {
-50          super.setUp();
+40      private Analyzer analyzer;
+41  
+42      public UrlTokenizingFilterTest() {
+43          analyzer = new Analyzer() {
+44              @Override
+45              protected TokenStreamComponents createComponents(String fieldName,
+46                      Reader reader) {
+47                  Tokenizer source = new MockTokenizer(reader, MockTokenizer.WHITESPACE, false);
+48                  return new TokenStreamComponents(source, new UrlTokenizingFilter(source));
+49              }
+50          };
 51      }
 52  
-53      @After
-54      public void tearDown() throws Exception {
-55          super.tearDown();
-56      }
-57  
-58      /**
-59       * test some example domains
-60       */
-61      public void testExamples() throws IOException {
-62          String[] expected = new String[2];
-63          expected[0] = "domain";
-64          expected[1] = "test";
-65          assertAnalyzesTo(analyzer, "http://www.domain.com/test.php", expected);
-66          checkOneTerm(analyzer, "https://apache.org", "apache");
-67      }
-68  
-69      /**
-70       * copied from
-71       * http://svn.apache.org/repos/asf/lucene/dev/trunk/lucene/analysis/common/src/test/org/apache/lucene/analysis/en/TestEnglishMinimalStemFilter.java
-72       * blast some random strings through the analyzer
+53      @BeforeClass
+54      public static void setUpClass() {
+55      }
+56  
+57      @AfterClass
+58      public static void tearDownClass() {
+59      }
+60  
+61      @Before
+62      public void setUp() throws Exception {
+63          super.setUp();
+64      }
+65  
+66      @After
+67      public void tearDown() throws Exception {
+68          super.tearDown();
+69      }
+70  
+71      /**
+72       * test some example domains
 73       */
-74      public void testRandomStrings() throws Exception {
-75          checkRandomData(random(), analyzer, 1000 * RANDOM_MULTIPLIER);
-76      }
-77  
-78      /**
-79       * copied from
-80       * http://svn.apache.org/repos/asf/lucene/dev/trunk/lucene/analysis/common/src/test/org/apache/lucene/analysis/en/TestEnglishMinimalStemFilter.java
-81       *
-82       * @throws IOException
-83       */
-84      public void testEmptyTerm() throws IOException {
-85          Analyzer a = new Analyzer() {
-86              @Override
-87              protected TokenStreamComponents createComponents(String fieldName, Reader reader) {
-88                  Tokenizer tokenizer = new KeywordTokenizer(reader);
-89                  return new TokenStreamComponents(tokenizer, new UrlTokenizingFilter(tokenizer));
-90              }
-91          };
-92          checkOneTermReuse(a, "", "");
-93      }
-94  }
+74      public void testExamples() throws IOException {
+75          String[] expected = new String[2];
+76          expected[0] = "domain";
+77          expected[1] = "test";
+78          assertAnalyzesTo(analyzer, "http://www.domain.com/test.php", expected);
+79          checkOneTerm(analyzer, "https://apache.org", "apache");
+80      }
+81  
+82      /**
+83       * copied from
+84       * http://svn.apache.org/repos/asf/lucene/dev/trunk/lucene/analysis/common/src/test/org/apache/lucene/analysis/en/TestEnglishMinimalStemFilter.java
+85       * blast some random strings through the analyzer
+86       */
+87      public void testRandomStrings() throws Exception {
+88          checkRandomData(random(), analyzer, 1000 * RANDOM_MULTIPLIER);
+89      }
+90  
+91      /**
+92       * copied from
+93       * http://svn.apache.org/repos/asf/lucene/dev/trunk/lucene/analysis/common/src/test/org/apache/lucene/analysis/en/TestEnglishMinimalStemFilter.java
+94       *
+95       * @throws IOException
+96       */
+97      public void testEmptyTerm() throws IOException {
+98          Analyzer a = new Analyzer() {
+99              @Override
+100             protected TokenStreamComponents createComponents(String fieldName, Reader reader) {
+101                 Tokenizer tokenizer = new KeywordTokenizer(reader);
+102                 return new TokenStreamComponents(tokenizer, new UrlTokenizingFilter(tokenizer));
+103             }
+104         };
+105         checkOneTermReuse(a, "", "");
+106     }
+107 }
    diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/lucene/package-frame.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/lucene/package-frame.html index 8c6e32dc8..c59e286bd 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/lucene/package-frame.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/lucene/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.0.8 Reference Package org.owasp.dependencycheck.data.lucene + Dependency-Check Core 1.1.0 Reference Package org.owasp.dependencycheck.data.lucene diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/lucene/package-summary.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/lucene/package-summary.html index c32c97c7c..b56f5d898 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/lucene/package-summary.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/lucene/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.0.8 Reference Package org.owasp.dependencycheck.data.lucene + Dependency-Check Core 1.1.0 Reference Package org.owasp.dependencycheck.data.lucene diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/nexus/NexusSearchTest.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/nexus/NexusSearchTest.html index 0a40adb59..751a53725 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/nexus/NexusSearchTest.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/nexus/NexusSearchTest.html @@ -6,62 +6,81 @@ 
    -1   package org.owasp.dependencycheck.data.nexus;
-2   
-3   import java.io.FileNotFoundException;
-4   import java.net.URL;
-5   import java.util.logging.Logger;
-6   
-7   import static org.junit.Assert.*;
-8   import org.junit.Before;
-9   import org.junit.Ignore;
-10  import org.junit.Test;
-11  
-12  import org.owasp.dependencycheck.utils.Settings;
-13  
-14  public class NexusSearchTest {
-15      private static final Logger LOGGER = Logger.getLogger(NexusSearchTest.class.getName());
-16      private NexusSearch searcher;
-17  
-18      @Before
-19      public void setUp() throws Exception {
-20          String nexusUrl = Settings.getString(Settings.KEYS.ANALYZER_NEXUS_URL);
-21          LOGGER.fine(nexusUrl);
-22          searcher = new NexusSearch(new URL(nexusUrl));
-23      }
-24      
-25      @Test(expected = IllegalArgumentException.class)
-26      public void testNullSha1() throws Exception {
-27          searcher.searchSha1(null);
-28      }
+1   /*
+2    * This file is part of dependency-check-core.
+3    *
+4    * Licensed under the Apache License, Version 2.0 (the "License");
+5    * you may not use this file except in compliance with the License.
+6    * You may obtain a copy of the License at
+7    *
+8    *     http://www.apache.org/licenses/LICENSE-2.0
+9    *
+10   * Unless required by applicable law or agreed to in writing, software
+11   * distributed under the License is distributed on an "AS IS" BASIS,
+12   * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+13   * See the License for the specific language governing permissions and
+14   * limitations under the License.
+15   *
+16   * Copyright (c) 2014 Jeremy Long. All Rights Reserved.
+17   */
+18  package org.owasp.dependencycheck.data.nexus;
+19  
+20  import java.io.FileNotFoundException;
+21  import java.net.URL;
+22  import java.util.logging.Logger;
+23  import static org.junit.Assert.assertEquals;
+24  import static org.junit.Assert.assertNotNull;
+25  import org.junit.Before;
+26  import org.junit.Ignore;
+27  import org.junit.Test;
+28  import org.owasp.dependencycheck.utils.Settings;
 29  
-30      @Test(expected = IllegalArgumentException.class)
-31      public void testMalformedSha1() throws Exception {
-32          searcher.searchSha1("invalid");
-33      }
+30  public class NexusSearchTest {
+31  
+32      private static final Logger LOGGER = Logger.getLogger(NexusSearchTest.class.getName());
+33      private NexusSearch searcher;
 34  
-35      // This test does generate network traffic and communicates with a host
-36      // you may not be able to reach. Remove the @Ignore annotation if you want to
-37      // test it anyway
-38      @Ignore @Test
-39      public void testValidSha1() throws Exception {
-40          MavenArtifact ma = searcher.searchSha1("9977a8d04e75609cf01badc4eb6a9c7198c4c5ea");
-41          assertEquals("Incorrect group", "org.apache.maven.plugins", ma.getGroupId());
-42          assertEquals("Incorrect artifact", "maven-compiler-plugin", ma.getArtifactId());
-43          assertEquals("Incorrect version", "3.1", ma.getVersion());
-44          assertNotNull("URL Should not be null", ma.getArtifactUrl());
+35      @Before
+36      public void setUp() throws Exception {
+37          String nexusUrl = Settings.getString(Settings.KEYS.ANALYZER_NEXUS_URL);
+38          LOGGER.fine(nexusUrl);
+39          searcher = new NexusSearch(new URL(nexusUrl));
+40      }
+41  
+42      @Test(expected = IllegalArgumentException.class)
+43      public void testNullSha1() throws Exception {
+44          searcher.searchSha1(null);
 45      }
 46  
-47      // This test does generate network traffic and communicates with a host
-48      // you may not be able to reach. Remove the @Ignore annotation if you want to
-49      // test it anyway
-50      @Ignore @Test(expected = FileNotFoundException.class)
-51      public void testMissingSha1() throws Exception {
-52          searcher.searchSha1("AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA");
-53      }
-54  }
-55  
-56  // vim: cc=120:sw=4:ts=4:sts=4
+47      @Test(expected = IllegalArgumentException.class)
+48      public void testMalformedSha1() throws Exception {
+49          searcher.searchSha1("invalid");
+50      }
+51  
+52      // This test does generate network traffic and communicates with a host
+53      // you may not be able to reach. Remove the @Ignore annotation if you want to
+54      // test it anyway
+55      @Ignore
+56      @Test
+57      public void testValidSha1() throws Exception {
+58          MavenArtifact ma = searcher.searchSha1("9977a8d04e75609cf01badc4eb6a9c7198c4c5ea");
+59          assertEquals("Incorrect group", "org.apache.maven.plugins", ma.getGroupId());
+60          assertEquals("Incorrect artifact", "maven-compiler-plugin", ma.getArtifactId());
+61          assertEquals("Incorrect version", "3.1", ma.getVersion());
+62          assertNotNull("URL Should not be null", ma.getArtifactUrl());
+63      }
+64  
+65      // This test does generate network traffic and communicates with a host
+66      // you may not be able to reach. Remove the @Ignore annotation if you want to
+67      // test it anyway
+68      @Ignore
+69      @Test(expected = FileNotFoundException.class)
+70      public void testMissingSha1() throws Exception {
+71          searcher.searchSha1("AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA");
+72      }
+73  }
+74  
+75  // vim: cc=120:sw=4:ts=4:sts=4
    diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/nexus/package-frame.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/nexus/package-frame.html index 66fc5d11a..53b31e1ac 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/nexus/package-frame.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/nexus/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.0.8 Reference Package org.owasp.dependencycheck.data.nexus + Dependency-Check Core 1.1.0 Reference Package org.owasp.dependencycheck.data.nexus diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/nexus/package-summary.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/nexus/package-summary.html index 2969e76c5..241b3c97f 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/nexus/package-summary.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/nexus/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.0.8 Reference Package org.owasp.dependencycheck.data.nexus + Dependency-Check Core 1.1.0 Reference Package org.owasp.dependencycheck.data.nexus diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/nvdcve/BaseDBTestCase.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/nvdcve/BaseDBTestCase.html index 46c05a993..653fc48bb 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/nvdcve/BaseDBTestCase.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/nvdcve/BaseDBTestCase.html @@ -9,118 +9,117 @@ 1 /* 2 * This file is part of dependency-check-core. 3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. -18 */ -19 package org.owasp.dependencycheck.data.nvdcve; -20 -21 import java.io.BufferedInputStream; -22 import java.io.BufferedOutputStream; -23 import java.io.File; -24 import java.io.FileInputStream; -25 import java.io.FileOutputStream; -26 import java.util.logging.Level; -27 import java.util.logging.Logger; -28 import java.util.zip.ZipEntry; -29 import java.util.zip.ZipInputStream; -30 import junit.framework.TestCase; -31 import org.owasp.dependencycheck.utils.Settings; -32 -33 /** -34 * -35 * @author Jeremy Long <jeremy.long@owasp.org> -36 */ -37 public abstract class BaseDBTestCase extends TestCase { -38 -39 protected final static int BUFFER_SIZE = 2048; -40 -41 @Override -42 protected void setUp() throws Exception { -43 super.setUp(); -44 ensureDBExists(); -45 } -46 -47 public static void ensureDBExists() throws Exception { -48 -49 java.io.File dataPath = Settings.getDataFile(Settings.KEYS.DATA_DIRECTORY); -50 if (!dataPath.exists() || (dataPath.isDirectory() && dataPath.listFiles().length < 3)) { -51 dataPath.mkdirs(); -52 FileInputStream fis = null; -53 ZipInputStream zin = null; -54 try { -55 File path = new File(BaseDBTestCase.class.getClassLoader().getResource("data.zip").getPath()); -56 fis = new FileInputStream(path); -57 zin = new ZipInputStream(new BufferedInputStream(fis)); -58 ZipEntry entry; -59 while ((entry = zin.getNextEntry()) != null) { -60 if (entry.isDirectory()) { -61 final File d = new File(dataPath, entry.getName()); -62 d.mkdir(); -63 continue; -64 } -65 FileOutputStream fos = null; -66 BufferedOutputStream dest = null; -67 try { -68 File o = new File(dataPath, entry.getName()); -69 o.createNewFile(); -70 fos = new FileOutputStream(o, false); -71 dest = new BufferedOutputStream(fos, BUFFER_SIZE); -72 byte data[] = new byte[BUFFER_SIZE]; -73 int count; -74 while ((count = zin.read(data, 0, BUFFER_SIZE)) != -1) { -75 dest.write(data, 0, count); -76 } -77 } catch (Exception ex) { -78 Logger.getLogger(BaseDBTestCase.class.getName()).log(Level.SEVERE, null, ex); -79 } finally { -80 try { -81 if (dest != null) { -82 dest.flush(); -83 dest.close(); -84 } -85 } catch (Throwable ex) { -86 Logger.getLogger(BaseDBTestCase.class.getName()).log(Level.FINEST, null, ex); -87 } -88 try { -89 if (fos != null) { -90 fos.close(); -91 } -92 } catch (Throwable ex) { -93 Logger.getLogger(BaseDBTestCase.class.getName()).log(Level.FINEST, null, ex); -94 } -95 } -96 } -97 } finally { -98 try { -99 if (zin != null) { -100 zin.close(); -101 } -102 } catch (Throwable ex) { -103 Logger.getLogger(BaseDBTestCase.class.getName()).log(Level.FINEST, null, ex); -104 } -105 try { -106 if (fis != null) { -107 fis.close(); -108 } -109 } catch (Throwable ex) { -110 Logger.getLogger(BaseDBTestCase.class.getName()).log(Level.FINEST, null, ex); -111 } -112 } -113 } -114 } -115 } +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. +17 */ +18 package org.owasp.dependencycheck.data.nvdcve; +19 +20 import java.io.BufferedInputStream; +21 import java.io.BufferedOutputStream; +22 import java.io.File; +23 import java.io.FileInputStream; +24 import java.io.FileOutputStream; +25 import java.util.logging.Level; +26 import java.util.logging.Logger; +27 import java.util.zip.ZipEntry; +28 import java.util.zip.ZipInputStream; +29 import junit.framework.TestCase; +30 import org.owasp.dependencycheck.utils.Settings; +31 +32 /** +33 * +34 * @author Jeremy Long <jeremy.long@owasp.org> +35 */ +36 public abstract class BaseDBTestCase extends TestCase { +37 +38 protected final static int BUFFER_SIZE = 2048; +39 +40 @Override +41 protected void setUp() throws Exception { +42 super.setUp(); +43 ensureDBExists(); +44 } +45 +46 public static void ensureDBExists() throws Exception { +47 +48 java.io.File dataPath = Settings.getDataFile(Settings.KEYS.DATA_DIRECTORY); +49 if (!dataPath.exists() || (dataPath.isDirectory() && dataPath.listFiles().length < 3)) { +50 dataPath.mkdirs(); +51 FileInputStream fis = null; +52 ZipInputStream zin = null; +53 try { +54 File path = new File(BaseDBTestCase.class.getClassLoader().getResource("data.zip").getPath()); +55 fis = new FileInputStream(path); +56 zin = new ZipInputStream(new BufferedInputStream(fis)); +57 ZipEntry entry; +58 while ((entry = zin.getNextEntry()) != null) { +59 if (entry.isDirectory()) { +60 final File d = new File(dataPath, entry.getName()); +61 d.mkdir(); +62 continue; +63 } +64 FileOutputStream fos = null; +65 BufferedOutputStream dest = null; +66 try { +67 File o = new File(dataPath, entry.getName()); +68 o.createNewFile(); +69 fos = new FileOutputStream(o, false); +70 dest = new BufferedOutputStream(fos, BUFFER_SIZE); +71 byte data[] = new byte[BUFFER_SIZE]; +72 int count; +73 while ((count = zin.read(data, 0, BUFFER_SIZE)) != -1) { +74 dest.write(data, 0, count); +75 } +76 } catch (Exception ex) { +77 Logger.getLogger(BaseDBTestCase.class.getName()).log(Level.SEVERE, null, ex); +78 } finally { +79 try { +80 if (dest != null) { +81 dest.flush(); +82 dest.close(); +83 } +84 } catch (Throwable ex) { +85 Logger.getLogger(BaseDBTestCase.class.getName()).log(Level.FINEST, null, ex); +86 } +87 try { +88 if (fos != null) { +89 fos.close(); +90 } +91 } catch (Throwable ex) { +92 Logger.getLogger(BaseDBTestCase.class.getName()).log(Level.FINEST, null, ex); +93 } +94 } +95 } +96 } finally { +97 try { +98 if (zin != null) { +99 zin.close(); +100 } +101 } catch (Throwable ex) { +102 Logger.getLogger(BaseDBTestCase.class.getName()).log(Level.FINEST, null, ex); +103 } +104 try { +105 if (fis != null) { +106 fis.close(); +107 } +108 } catch (Throwable ex) { +109 Logger.getLogger(BaseDBTestCase.class.getName()).log(Level.FINEST, null, ex); +110 } +111 } +112 } +113 } +114 }
    diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/nvdcve/CveDBMySQLTest.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/nvdcve/CveDBMySQLTest.html index b08828ee7..89a9799cf 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/nvdcve/CveDBMySQLTest.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/nvdcve/CveDBMySQLTest.html @@ -9,109 +9,108 @@ 1 /* 2 * This file is part of dependency-check-core. 3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2014 Jeremy Long. All Rights Reserved. -18 */ -19 package org.owasp.dependencycheck.data.nvdcve; -20 -21 import java.util.List; -22 import java.util.Set; -23 import org.junit.After; -24 import org.junit.AfterClass; -25 import static org.junit.Assert.assertTrue; -26 import org.junit.Before; -27 import org.junit.BeforeClass; -28 import org.junit.Test; -29 import org.owasp.dependencycheck.dependency.VulnerableSoftware; -30 -31 /** -32 * -33 * @author Jeremy Long <jeremy.long@owasp.org> -34 */ -35 public class CveDBMySQLTest { -36 -37 @BeforeClass -38 public static void setUpClass() { -39 } -40 -41 @AfterClass -42 public static void tearDownClass() { -43 } -44 -45 @Before -46 public void setUp() throws Exception { -47 } -48 -49 @After -50 public void tearDown() throws Exception { -51 } -52 -53 /** -54 * Pretty useless tests of open, commit, and close methods, of class CveDB. -55 */ -56 @Test -57 public void testOpen() throws DatabaseException { -58 try { -59 CveDB instance = new CveDB(); -60 instance.open(); -61 instance.close(); -62 } catch (DatabaseException ex) { -63 System.out.println("Unable to connect to the My SQL database; verify that the db server is running and that the schema has been generated"); -64 throw ex; -65 } -66 } -67 -68 /** -69 * Test of getCPEs method, of class CveDB. -70 */ -71 @Test -72 public void testGetCPEs() throws Exception { -73 CveDB instance = new CveDB(); -74 try { -75 String vendor = "apache"; -76 String product = "struts"; -77 instance.open(); -78 Set<VulnerableSoftware> result = instance.getCPEs(vendor, product); -79 assertTrue("Has data been loaded into the MySQL DB? if not consider using the CLI to populate it", result.size() > 5); -80 } catch (Exception ex) { -81 System.out.println("Unable to access the My SQL database; verify that the db server is running and that the schema has been generated"); -82 throw ex; -83 } finally { -84 instance.close(); -85 } -86 } -87 -88 /** -89 * Test of getVulnerabilities method, of class CveDB. -90 */ -91 @Test -92 public void testGetVulnerabilities() throws Exception { -93 String cpeStr = "cpe:/a:apache:struts:2.1.2"; -94 CveDB instance = new CveDB(); -95 try { -96 instance.open(); -97 List result = instance.getVulnerabilities(cpeStr); -98 assertTrue(result.size() > 5); -99 } catch (Exception ex) { -100 System.out.println("Unable to access the My SQL database; verify that the db server is running and that the schema has been generated"); -101 throw ex; -102 } finally { -103 instance.close(); -104 } -105 } -106 } +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2014 Jeremy Long. All Rights Reserved. +17 */ +18 package org.owasp.dependencycheck.data.nvdcve; +19 +20 import java.util.List; +21 import java.util.Set; +22 import org.junit.After; +23 import org.junit.AfterClass; +24 import static org.junit.Assert.assertTrue; +25 import org.junit.Before; +26 import org.junit.BeforeClass; +27 import org.junit.Test; +28 import org.owasp.dependencycheck.dependency.VulnerableSoftware; +29 +30 /** +31 * +32 * @author Jeremy Long <jeremy.long@owasp.org> +33 */ +34 public class CveDBMySQLTest { +35 +36 @BeforeClass +37 public static void setUpClass() { +38 } +39 +40 @AfterClass +41 public static void tearDownClass() { +42 } +43 +44 @Before +45 public void setUp() throws Exception { +46 } +47 +48 @After +49 public void tearDown() throws Exception { +50 } +51 +52 /** +53 * Pretty useless tests of open, commit, and close methods, of class CveDB. +54 */ +55 @Test +56 public void testOpen() throws DatabaseException { +57 try { +58 CveDB instance = new CveDB(); +59 instance.open(); +60 instance.close(); +61 } catch (DatabaseException ex) { +62 System.out.println("Unable to connect to the My SQL database; verify that the db server is running and that the schema has been generated"); +63 throw ex; +64 } +65 } +66 +67 /** +68 * Test of getCPEs method, of class CveDB. +69 */ +70 @Test +71 public void testGetCPEs() throws Exception { +72 CveDB instance = new CveDB(); +73 try { +74 String vendor = "apache"; +75 String product = "struts"; +76 instance.open(); +77 Set<VulnerableSoftware> result = instance.getCPEs(vendor, product); +78 assertTrue("Has data been loaded into the MySQL DB? if not consider using the CLI to populate it", result.size() > 5); +79 } catch (Exception ex) { +80 System.out.println("Unable to access the My SQL database; verify that the db server is running and that the schema has been generated"); +81 throw ex; +82 } finally { +83 instance.close(); +84 } +85 } +86 +87 /** +88 * Test of getVulnerabilities method, of class CveDB. +89 */ +90 @Test +91 public void testGetVulnerabilities() throws Exception { +92 String cpeStr = "cpe:/a:apache:struts:2.1.2"; +93 CveDB instance = new CveDB(); +94 try { +95 instance.open(); +96 List result = instance.getVulnerabilities(cpeStr); +97 assertTrue(result.size() > 5); +98 } catch (Exception ex) { +99 System.out.println("Unable to access the My SQL database; verify that the db server is running and that the schema has been generated"); +100 throw ex; +101 } finally { +102 instance.close(); +103 } +104 } +105 }
    diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/nvdcve/CveDBTest.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/nvdcve/CveDBTest.html index 09b3bb735..18bc02037 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/nvdcve/CveDBTest.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/nvdcve/CveDBTest.html @@ -9,103 +9,101 @@ 1 /* 2 * This file is part of dependency-check-core. 3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2013 Jeremy Long. All Rights Reserved. -18 */ -19 package org.owasp.dependencycheck.data.nvdcve; -20 -21 import java.util.List; -22 import java.util.Set; -23 -24 import org.junit.After; -25 import org.junit.AfterClass; -26 import org.junit.Before; -27 import org.junit.BeforeClass; -28 import org.junit.Test; -29 import org.owasp.dependencycheck.dependency.VulnerableSoftware; -30 -31 /** -32 * -33 * @author Jeremy Long <jeremy.long@owasp.org> -34 */ -35 public class CveDBTest extends BaseDBTestCase { -36 -37 @BeforeClass -38 public static void setUpClass() { -39 } -40 -41 @AfterClass -42 public static void tearDownClass() { -43 } -44 -45 @Before -46 @Override -47 public void setUp() throws Exception { -48 super.setUp(); -49 } -50 -51 @After -52 @Override -53 public void tearDown() throws Exception { -54 super.tearDown(); -55 } -56 -57 /** -58 * Pretty useless tests of open, commit, and close methods, of class CveDB. -59 */ -60 @Test -61 public void testOpen() throws Exception { -62 CveDB instance = new CveDB(); -63 instance.open(); -64 instance.commit(); -65 instance.close(); -66 } -67 -68 /** -69 * Test of getCPEs method, of class CveDB. -70 */ -71 @Test -72 public void testGetCPEs() throws Exception { -73 CveDB instance = new CveDB(); -74 try { -75 String vendor = "apache"; -76 String product = "struts"; -77 instance.open(); -78 Set<VulnerableSoftware> result = instance.getCPEs(vendor, product); -79 assertTrue(result.size() > 5); -80 } finally { -81 instance.close(); -82 } -83 } -84 -85 /** -86 * Test of getVulnerabilities method, of class CveDB. -87 */ -88 @Test -89 public void testGetVulnerabilities() throws Exception { -90 String cpeStr = "cpe:/a:apache:struts:2.1.2"; -91 CveDB instance = new CveDB(); -92 try { -93 instance.open(); -94 List result = instance.getVulnerabilities(cpeStr); -95 assertTrue(result.size() > 5); -96 } finally { -97 instance.close(); -98 } -99 } -100 } +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2013 Jeremy Long. All Rights Reserved. +17 */ +18 package org.owasp.dependencycheck.data.nvdcve; +19 +20 import java.util.List; +21 import java.util.Set; +22 import org.junit.After; +23 import org.junit.AfterClass; +24 import org.junit.Before; +25 import org.junit.BeforeClass; +26 import org.junit.Test; +27 import org.owasp.dependencycheck.dependency.VulnerableSoftware; +28 +29 /** +30 * +31 * @author Jeremy Long <jeremy.long@owasp.org> +32 */ +33 public class CveDBTest extends BaseDBTestCase { +34 +35 @BeforeClass +36 public static void setUpClass() { +37 } +38 +39 @AfterClass +40 public static void tearDownClass() { +41 } +42 +43 @Before +44 @Override +45 public void setUp() throws Exception { +46 super.setUp(); +47 } +48 +49 @After +50 @Override +51 public void tearDown() throws Exception { +52 super.tearDown(); +53 } +54 +55 /** +56 * Pretty useless tests of open, commit, and close methods, of class CveDB. +57 */ +58 @Test +59 public void testOpen() throws Exception { +60 CveDB instance = new CveDB(); +61 instance.open(); +62 instance.commit(); +63 instance.close(); +64 } +65 +66 /** +67 * Test of getCPEs method, of class CveDB. +68 */ +69 @Test +70 public void testGetCPEs() throws Exception { +71 CveDB instance = new CveDB(); +72 try { +73 String vendor = "apache"; +74 String product = "struts"; +75 instance.open(); +76 Set<VulnerableSoftware> result = instance.getCPEs(vendor, product); +77 assertTrue(result.size() > 5); +78 } finally { +79 instance.close(); +80 } +81 } +82 +83 /** +84 * Test of getVulnerabilities method, of class CveDB. +85 */ +86 @Test +87 public void testGetVulnerabilities() throws Exception { +88 String cpeStr = "cpe:/a:apache:struts:2.1.2"; +89 CveDB instance = new CveDB(); +90 try { +91 instance.open(); +92 List result = instance.getVulnerabilities(cpeStr); +93 assertTrue(result.size() > 5); +94 } finally { +95 instance.close(); +96 } +97 } +98 }
    diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/nvdcve/DatabasePropertiesTest.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/nvdcve/DatabasePropertiesTest.html index 2de34d6c9..a345dcd2c 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/nvdcve/DatabasePropertiesTest.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/nvdcve/DatabasePropertiesTest.html @@ -9,113 +9,140 @@ 1 /* 2 * This file is part of dependency-check-core. 3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2013 Jeremy Long. All Rights Reserved. -18 */ -19 package org.owasp.dependencycheck.data.nvdcve; -20 -21 import org.owasp.dependencycheck.data.nvdcve.DatabaseProperties; -22 import org.junit.After; -23 import org.junit.AfterClass; -24 import org.junit.Before; -25 import org.junit.BeforeClass; -26 import org.junit.Test; -27 import static org.junit.Assert.*; -28 import org.owasp.dependencycheck.data.nvdcve.CveDB; -29 import org.owasp.dependencycheck.data.update.NvdCveInfo; -30 -31 /** -32 * -33 * @author Jeremy Long <jeremy.long@owasp.org> -34 */ -35 public class DatabasePropertiesTest { -36 -37 public DatabasePropertiesTest() { -38 } -39 -40 @BeforeClass -41 public static void setUpClass() { -42 } -43 -44 @AfterClass -45 public static void tearDownClass() { +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2013 Jeremy Long. All Rights Reserved. +17 */ +18 package org.owasp.dependencycheck.data.nvdcve; +19 +20 import java.util.Properties; +21 import org.junit.After; +22 import org.junit.AfterClass; +23 import org.junit.Before; +24 import org.junit.BeforeClass; +25 import org.junit.Test; +26 import org.owasp.dependencycheck.data.update.NvdCveInfo; +27 +28 /** +29 * +30 * @author Jeremy Long <jeremy.long@owasp.org> +31 */ +32 public class DatabasePropertiesTest extends BaseDBTestCase { +33 +34 @BeforeClass +35 public static void setUpClass() { +36 } +37 +38 @AfterClass +39 public static void tearDownClass() { +40 } +41 +42 @Before +43 @Override +44 public void setUp() throws Exception { +45 super.setUp(); 46 } 47 -48 @Before -49 public void setUp() { -50 } -51 -52 @After -53 public void tearDown() { -54 } -55 -56 /** -57 * Test of isEmpty method, of class DatabaseProperties. -58 */ -59 @Test -60 public void testIsEmpty() throws Exception { -61 CveDB cveDB = new CveDB(); -62 cveDB.open(); -63 DatabaseProperties instance = cveDB.getDatabaseProperties(); -64 boolean expResult = false; -65 boolean result = instance.isEmpty(); -66 //no exception means the call worked... whether or not it is empty depends on if the db is new -67 //assertEquals(expResult, result); -68 cveDB.close(); -69 } -70 -71 /** -72 * Test of save method, of class DatabaseProperties. -73 */ -74 @Test -75 public void testSave() throws Exception { -76 NvdCveInfo updatedValue = new NvdCveInfo(); -77 String key = "test"; -78 long expected = 1337; -79 updatedValue.setId(key); -80 updatedValue.setTimestamp(expected); -81 CveDB cveDB = new CveDB(); -82 cveDB.open(); -83 DatabaseProperties instance = cveDB.getDatabaseProperties(); -84 instance.save(updatedValue); -85 //reload the properties -86 cveDB.close(); -87 cveDB = new CveDB(); -88 cveDB.open(); -89 instance = cveDB.getDatabaseProperties(); -90 cveDB.close(); -91 long results = Long.parseLong(instance.getProperty("lastupdated." + key)); -92 assertEquals(expected, results); -93 } -94 -95 /** -96 * Test of getProperty method, of class DatabaseProperties. -97 */ -98 @Test -99 public void testGetProperty_String_String() throws Exception { -100 String key = "doesn't exist"; -101 String defaultValue = "default"; -102 CveDB cveDB = new CveDB(); -103 cveDB.open(); -104 DatabaseProperties instance = cveDB.getDatabaseProperties(); -105 cveDB.close(); -106 String expResult = "default"; -107 String result = instance.getProperty(key, defaultValue); -108 assertEquals(expResult, result); -109 } -110 } +48 @After +49 @Override +50 public void tearDown() throws Exception { +51 super.tearDown(); +52 } +53 +54 /** +55 * Test of isEmpty method, of class DatabaseProperties. +56 */ +57 @Test +58 public void testIsEmpty() throws Exception { +59 CveDB cveDB = new CveDB(); +60 cveDB.open(); +61 DatabaseProperties instance = cveDB.getDatabaseProperties(); +62 boolean expResult = false; +63 boolean result = instance.isEmpty(); +64 //no exception means the call worked... whether or not it is empty depends on if the db is new +65 //assertEquals(expResult, result); +66 cveDB.close(); +67 } +68 +69 /** +70 * Test of save method, of class DatabaseProperties. +71 */ +72 @Test +73 public void testSave() throws Exception { +74 NvdCveInfo updatedValue = new NvdCveInfo(); +75 String key = "test"; +76 long expected = 1337; +77 updatedValue.setId(key); +78 updatedValue.setTimestamp(expected); +79 CveDB cveDB = new CveDB(); +80 cveDB.open(); +81 DatabaseProperties instance = cveDB.getDatabaseProperties(); +82 instance.save(updatedValue); +83 //reload the properties +84 cveDB.close(); +85 cveDB = new CveDB(); +86 cveDB.open(); +87 instance = cveDB.getDatabaseProperties(); +88 cveDB.close(); +89 long results = Long.parseLong(instance.getProperty("NVD CVE " + key)); +90 assertEquals(expected, results); +91 } +92 +93 /** +94 * Test of getProperty method, of class DatabaseProperties. +95 */ +96 @Test +97 public void testGetProperty_String_String() throws Exception { +98 String key = "doesn't exist"; +99 String defaultValue = "default"; +100 CveDB cveDB = new CveDB(); +101 cveDB.open(); +102 DatabaseProperties instance = cveDB.getDatabaseProperties(); +103 cveDB.close(); +104 String expResult = "default"; +105 String result = instance.getProperty(key, defaultValue); +106 assertEquals(expResult, result); +107 } +108 +109 /** +110 * Test of getProperty method, of class DatabaseProperties. +111 */ +112 @Test +113 public void testGetProperty_String() throws DatabaseException { +114 String key = "version"; +115 CveDB cveDB = new CveDB(); +116 cveDB.open(); +117 DatabaseProperties instance = cveDB.getDatabaseProperties(); +118 cveDB.close(); +119 String result = instance.getProperty(key); +120 double version = Double.parseDouble(result); +121 assertTrue(version >= 2.8); +122 assertTrue(version <= 10); +123 } +124 +125 /** +126 * Test of getProperties method, of class DatabaseProperties. +127 */ +128 @Test +129 public void testGetProperties() throws DatabaseException { +130 CveDB cveDB = new CveDB(); +131 cveDB.open(); +132 DatabaseProperties instance = cveDB.getDatabaseProperties(); +133 cveDB.close(); +134 Properties result = instance.getProperties(); +135 assertTrue(result.size() > 0); +136 } +137 }
    diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/nvdcve/DriverLoaderTest.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/nvdcve/DriverLoaderTest.html index 5b073f99f..8000b27fb 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/nvdcve/DriverLoaderTest.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/nvdcve/DriverLoaderTest.html @@ -9,134 +9,133 @@ 1 /* 2 * This file is part of dependency-check-core. 3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2014 Jeremy Long. All Rights Reserved. -18 */ -19 package org.owasp.dependencycheck.data.nvdcve; -20 -21 import java.io.File; -22 import java.sql.Driver; -23 import java.sql.DriverManager; -24 import org.junit.After; -25 import org.junit.AfterClass; -26 import static org.junit.Assert.assertNotNull; -27 import static org.junit.Assert.assertTrue; -28 import org.junit.Before; -29 import org.junit.BeforeClass; -30 import org.junit.Test; -31 -32 /** -33 * -34 * @author Jeremy Long <jeremy.long@owasp.org> -35 */ -36 public class DriverLoaderTest { -37 -38 public DriverLoaderTest() { -39 } -40 -41 @BeforeClass -42 public static void setUpClass() { -43 } -44 -45 @AfterClass -46 public static void tearDownClass() { -47 } -48 -49 @Before -50 public void setUp() { -51 } -52 -53 @After -54 public void tearDown() { -55 } -56 -57 /** -58 * Test of load method, of class DriverLoader. -59 */ -60 @Test -61 public void testLoad_String() throws Exception { -62 String className = "org.h2.Driver"; -63 DriverLoader.load(className); -64 } -65 -66 /** -67 * Test of load method, of class DriverLoader; expecting an exception due to a bad driver class name. -68 */ -69 @Test(expected = DriverLoadException.class) -70 public void testLoad_String_ex() throws Exception { -71 String className = "bad.Driver"; -72 DriverLoader.load(className); -73 } -74 -75 /** -76 * Test of load method, of class DriverLoader. -77 */ -78 @Test -79 public void testLoad_String_String() throws Exception { -80 String className = "com.mysql.jdbc.Driver"; -81 //we know this is in target/test-classes -82 File testClassPath = (new File(this.getClass().getClassLoader().getResource("org.mortbay.jetty.jar").getPath())).getParentFile(); -83 File driver = new File(testClassPath, "../../src/test/resources/mysql-connector-java-5.1.27-bin.jar"); -84 assertTrue("MySQL Driver JAR file not found in src/test/resources?", driver.isFile()); -85 -86 DriverLoader.load(className, driver.getAbsolutePath()); -87 Driver d = DriverManager.getDriver("jdbc:mysql://localhost:3306/dependencycheck"); -88 assertNotNull(d); -89 } -90 -91 /** -92 * Test of load method, of class DriverLoader. -93 */ -94 @Test -95 public void testLoad_String_String_multiple_paths() throws Exception { -96 final String className = "com.mysql.jdbc.Driver"; -97 //we know this is in target/test-classes -98 final File testClassPath = (new File(this.getClass().getClassLoader().getResource("org.mortbay.jetty.jar").getPath())).getParentFile(); -99 final File dir1 = new File(testClassPath, "../../src/test/"); -100 final File dir2 = new File(testClassPath, "../../src/test/resources/"); -101 final String paths = String.format("%s;%s", dir1.getAbsolutePath(), dir2.getAbsolutePath()); -102 -103 DriverLoader.load(className, paths); -104 } -105 -106 /** -107 * Test of load method, of class DriverLoader with an incorrect class name. -108 */ -109 @Test(expected = DriverLoadException.class) -110 public void testLoad_String_String_badClassName() throws Exception { -111 String className = "com.mybad.jdbc.Driver"; -112 //we know this is in target/test-classes -113 File testClassPath = (new File(this.getClass().getClassLoader().getResource("org.mortbay.jetty.jar").getPath())).getParentFile(); -114 File driver = new File(testClassPath, "../../src/test/resources/mysql-connector-java-5.1.27-bin.jar"); -115 assertTrue("MySQL Driver JAR file not found in src/test/resources?", driver.isFile()); -116 -117 DriverLoader.load(className, driver.getAbsolutePath()); -118 } -119 -120 /** -121 * Test of load method, of class DriverLoader with an incorrect class path. -122 */ -123 @Test(expected = DriverLoadException.class) -124 public void testLoad_String_String_badPath() throws Exception { -125 String className = "com.mysql.jdbc.Driver"; -126 //we know this is in target/test-classes -127 File testClassPath = (new File(this.getClass().getClassLoader().getResource("org.mortbay.jetty.jar").getPath())).getParentFile(); -128 File driver = new File(testClassPath, "../../src/test/bad/mysql-connector-java-5.1.27-bin.jar"); -129 DriverLoader.load(className, driver.getAbsolutePath()); -130 } -131 } +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2014 Jeremy Long. All Rights Reserved. +17 */ +18 package org.owasp.dependencycheck.data.nvdcve; +19 +20 import java.io.File; +21 import java.sql.Driver; +22 import java.sql.DriverManager; +23 import org.junit.After; +24 import org.junit.AfterClass; +25 import static org.junit.Assert.assertNotNull; +26 import static org.junit.Assert.assertTrue; +27 import org.junit.Before; +28 import org.junit.BeforeClass; +29 import org.junit.Test; +30 +31 /** +32 * +33 * @author Jeremy Long <jeremy.long@owasp.org> +34 */ +35 public class DriverLoaderTest { +36 +37 public DriverLoaderTest() { +38 } +39 +40 @BeforeClass +41 public static void setUpClass() { +42 } +43 +44 @AfterClass +45 public static void tearDownClass() { +46 } +47 +48 @Before +49 public void setUp() { +50 } +51 +52 @After +53 public void tearDown() { +54 } +55 +56 /** +57 * Test of load method, of class DriverLoader. +58 */ +59 @Test +60 public void testLoad_String() throws Exception { +61 String className = "org.h2.Driver"; +62 DriverLoader.load(className); +63 } +64 +65 /** +66 * Test of load method, of class DriverLoader; expecting an exception due to a bad driver class name. +67 */ +68 @Test(expected = DriverLoadException.class) +69 public void testLoad_String_ex() throws Exception { +70 String className = "bad.Driver"; +71 DriverLoader.load(className); +72 } +73 +74 /** +75 * Test of load method, of class DriverLoader. +76 */ +77 @Test +78 public void testLoad_String_String() throws Exception { +79 String className = "com.mysql.jdbc.Driver"; +80 //we know this is in target/test-classes +81 File testClassPath = (new File(this.getClass().getClassLoader().getResource("org.mortbay.jetty.jar").getPath())).getParentFile(); +82 File driver = new File(testClassPath, "../../src/test/resources/mysql-connector-java-5.1.27-bin.jar"); +83 assertTrue("MySQL Driver JAR file not found in src/test/resources?", driver.isFile()); +84 +85 DriverLoader.load(className, driver.getAbsolutePath()); +86 Driver d = DriverManager.getDriver("jdbc:mysql://localhost:3306/dependencycheck"); +87 assertNotNull(d); +88 } +89 +90 /** +91 * Test of load method, of class DriverLoader. +92 */ +93 @Test +94 public void testLoad_String_String_multiple_paths() throws Exception { +95 final String className = "com.mysql.jdbc.Driver"; +96 //we know this is in target/test-classes +97 final File testClassPath = (new File(this.getClass().getClassLoader().getResource("org.mortbay.jetty.jar").getPath())).getParentFile(); +98 final File dir1 = new File(testClassPath, "../../src/test/"); +99 final File dir2 = new File(testClassPath, "../../src/test/resources/"); +100 final String paths = String.format("%s" + File.pathSeparator + "%s", dir1.getAbsolutePath(), dir2.getAbsolutePath()); +101 +102 DriverLoader.load(className, paths); +103 } +104 +105 /** +106 * Test of load method, of class DriverLoader with an incorrect class name. +107 */ +108 @Test(expected = DriverLoadException.class) +109 public void testLoad_String_String_badClassName() throws Exception { +110 String className = "com.mybad.jdbc.Driver"; +111 //we know this is in target/test-classes +112 File testClassPath = (new File(this.getClass().getClassLoader().getResource("org.mortbay.jetty.jar").getPath())).getParentFile(); +113 File driver = new File(testClassPath, "../../src/test/resources/mysql-connector-java-5.1.27-bin.jar"); +114 assertTrue("MySQL Driver JAR file not found in src/test/resources?", driver.isFile()); +115 +116 DriverLoader.load(className, driver.getAbsolutePath()); +117 } +118 +119 /** +120 * Test of load method, of class DriverLoader with an incorrect class path. +121 */ +122 @Test(expected = DriverLoadException.class) +123 public void testLoad_String_String_badPath() throws Exception { +124 String className = "com.mysql.jdbc.Driver"; +125 //we know this is in target/test-classes +126 File testClassPath = (new File(this.getClass().getClassLoader().getResource("org.mortbay.jetty.jar").getPath())).getParentFile(); +127 File driver = new File(testClassPath, "../../src/test/bad/mysql-connector-java-5.1.27-bin.jar"); +128 DriverLoader.load(className, driver.getAbsolutePath()); +129 } +130 }
    diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/nvdcve/package-frame.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/nvdcve/package-frame.html index f48e32447..c6f95fbec 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/nvdcve/package-frame.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/nvdcve/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.0.8 Reference Package org.owasp.dependencycheck.data.nvdcve + Dependency-Check Core 1.1.0 Reference Package org.owasp.dependencycheck.data.nvdcve diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/nvdcve/package-summary.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/nvdcve/package-summary.html index 4a2106af5..f9a25589e 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/nvdcve/package-summary.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/nvdcve/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.0.8 Reference Package org.owasp.dependencycheck.data.nvdcve + Dependency-Check Core 1.1.0 Reference Package org.owasp.dependencycheck.data.nvdcve diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/update/NvdCveInfoTest.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/update/NvdCveInfoTest.html index 59d0a439a..4bc9a2226 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/update/NvdCveInfoTest.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/update/NvdCveInfoTest.html @@ -9,116 +9,115 @@ 1 /* 2 * This file is part of dependency-check-core. 3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2013 Jeremy Long. All Rights Reserved. -18 */ -19 package org.owasp.dependencycheck.data.update; -20 -21 import org.junit.After; -22 import org.junit.AfterClass; +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2013 Jeremy Long. All Rights Reserved. +17 */ +18 package org.owasp.dependencycheck.data.update; +19 +20 import org.junit.After; +21 import org.junit.AfterClass; +22 import static org.junit.Assert.assertEquals; 23 import org.junit.Before; 24 import org.junit.BeforeClass; 25 import org.junit.Test; -26 import static org.junit.Assert.*; -27 -28 /** -29 * Rigorous test of setters/getters. -30 * -31 * @author Jeremy Long <jeremy.long@owasp.org> -32 */ -33 public class NvdCveInfoTest { -34 -35 public NvdCveInfoTest() { -36 } -37 -38 @BeforeClass -39 public static void setUpClass() { -40 } -41 -42 @AfterClass -43 public static void tearDownClass() { -44 } -45 -46 @Before -47 public void setUp() { -48 } -49 -50 @After -51 public void tearDown() { -52 } -53 -54 /** -55 * Test of setId and getId method, of class NvdCveInfo. -56 */ -57 @Test -58 public void testSetGetId() { -59 NvdCveInfo instance = new NvdCveInfo(); -60 String expResult = "id"; -61 instance.setId(expResult); -62 String result = instance.getId(); -63 assertEquals(expResult, result); -64 } -65 -66 /** -67 * Test of getUrl method, of class NvdCveInfo. -68 */ -69 @Test -70 public void testSetGetUrl() { -71 NvdCveInfo instance = new NvdCveInfo(); -72 String expResult = "http://www.someurl.com/something"; -73 instance.setUrl(expResult); -74 String result = instance.getUrl(); -75 assertEquals(expResult, result); -76 } -77 -78 /** -79 * Test of getOldSchemaVersionUrl method, of class NvdCveInfo. -80 */ -81 @Test -82 public void testSetGetOldSchemaVersionUrl() { -83 NvdCveInfo instance = new NvdCveInfo(); -84 String expResult = "http://www.someurl.com/something"; -85 instance.setOldSchemaVersionUrl(expResult); -86 String result = instance.getOldSchemaVersionUrl(); -87 assertEquals(expResult, result); -88 } -89 -90 /** -91 * Test of getTimestamp method, of class NvdCveInfo. -92 */ -93 @Test -94 public void testSetGetTimestamp() { -95 NvdCveInfo instance = new NvdCveInfo(); -96 long expResult = 1337L; -97 instance.setTimestamp(expResult); -98 long result = instance.getTimestamp(); -99 assertEquals(expResult, result); -100 } -101 -102 /** -103 * Test of getNeedsUpdate method, of class NvdCveInfo. -104 */ -105 @Test -106 public void testSetGetNeedsUpdate() { -107 NvdCveInfo instance = new NvdCveInfo(); -108 boolean expResult = true; -109 instance.setNeedsUpdate(expResult); -110 boolean result = instance.getNeedsUpdate(); -111 assertEquals(expResult, result); -112 } -113 } +26 +27 /** +28 * Rigorous test of setters/getters. +29 * +30 * @author Jeremy Long <jeremy.long@owasp.org> +31 */ +32 public class NvdCveInfoTest { +33 +34 public NvdCveInfoTest() { +35 } +36 +37 @BeforeClass +38 public static void setUpClass() { +39 } +40 +41 @AfterClass +42 public static void tearDownClass() { +43 } +44 +45 @Before +46 public void setUp() { +47 } +48 +49 @After +50 public void tearDown() { +51 } +52 +53 /** +54 * Test of setId and getId method, of class NvdCveInfo. +55 */ +56 @Test +57 public void testSetGetId() { +58 NvdCveInfo instance = new NvdCveInfo(); +59 String expResult = "id"; +60 instance.setId(expResult); +61 String result = instance.getId(); +62 assertEquals(expResult, result); +63 } +64 +65 /** +66 * Test of getUrl method, of class NvdCveInfo. +67 */ +68 @Test +69 public void testSetGetUrl() { +70 NvdCveInfo instance = new NvdCveInfo(); +71 String expResult = "http://www.someurl.com/something"; +72 instance.setUrl(expResult); +73 String result = instance.getUrl(); +74 assertEquals(expResult, result); +75 } +76 +77 /** +78 * Test of getOldSchemaVersionUrl method, of class NvdCveInfo. +79 */ +80 @Test +81 public void testSetGetOldSchemaVersionUrl() { +82 NvdCveInfo instance = new NvdCveInfo(); +83 String expResult = "http://www.someurl.com/something"; +84 instance.setOldSchemaVersionUrl(expResult); +85 String result = instance.getOldSchemaVersionUrl(); +86 assertEquals(expResult, result); +87 } +88 +89 /** +90 * Test of getTimestamp method, of class NvdCveInfo. +91 */ +92 @Test +93 public void testSetGetTimestamp() { +94 NvdCveInfo instance = new NvdCveInfo(); +95 long expResult = 1337L; +96 instance.setTimestamp(expResult); +97 long result = instance.getTimestamp(); +98 assertEquals(expResult, result); +99 } +100 +101 /** +102 * Test of getNeedsUpdate method, of class NvdCveInfo. +103 */ +104 @Test +105 public void testSetGetNeedsUpdate() { +106 NvdCveInfo instance = new NvdCveInfo(); +107 boolean expResult = true; +108 instance.setNeedsUpdate(expResult); +109 boolean result = instance.getNeedsUpdate(); +110 assertEquals(expResult, result); +111 } +112 }
    diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/update/NvdCveUpdaterIntegrationTest.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/update/NvdCveUpdaterIntegrationTest.html index b123cb1e0..936ff5f04 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/update/NvdCveUpdaterIntegrationTest.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/update/NvdCveUpdaterIntegrationTest.html @@ -9,63 +9,62 @@ 1 /* 2 * This file is part of dependency-check-core. 3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2013 Jeremy Long. All Rights Reserved. -18 */ -19 package org.owasp.dependencycheck.data.update; -20 -21 import org.junit.After; -22 import org.junit.AfterClass; -23 import org.junit.Before; -24 import org.junit.BeforeClass; -25 import org.junit.Test; -26 -27 /** -28 * -29 * @author Jeremy Long <jeremy.long@owasp.org> -30 */ -31 public class NvdCveUpdaterIntegrationTest { -32 -33 public NvdCveUpdaterIntegrationTest() { -34 } -35 -36 @BeforeClass -37 public static void setUpClass() { -38 } -39 -40 @AfterClass -41 public static void tearDownClass() { -42 } -43 -44 @Before -45 public void setUp() { -46 } -47 -48 @After -49 public void tearDown() { -50 } -51 -52 /** -53 * Test of update method, of class NvdCveUpdater. -54 */ -55 @Test -56 public void testUpdate() throws Exception { -57 NvdCveUpdater instance = new NvdCveUpdater(); -58 instance.update(); -59 } -60 } +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2013 Jeremy Long. All Rights Reserved. +17 */ +18 package org.owasp.dependencycheck.data.update; +19 +20 import org.junit.After; +21 import org.junit.AfterClass; +22 import org.junit.Before; +23 import org.junit.BeforeClass; +24 import org.junit.Test; +25 +26 /** +27 * +28 * @author Jeremy Long <jeremy.long@owasp.org> +29 */ +30 public class NvdCveUpdaterIntegrationTest { +31 +32 public NvdCveUpdaterIntegrationTest() { +33 } +34 +35 @BeforeClass +36 public static void setUpClass() { +37 } +38 +39 @AfterClass +40 public static void tearDownClass() { +41 } +42 +43 @Before +44 public void setUp() { +45 } +46 +47 @After +48 public void tearDown() { +49 } +50 +51 /** +52 * Test of update method, of class NvdCveUpdater. +53 */ +54 @Test +55 public void testUpdate() throws Exception { +56 NvdCveUpdater instance = new NvdCveUpdater(); +57 instance.update(); +58 } +59 }
    diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/update/StandardUpdateIntegrationTest.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/update/StandardUpdateIntegrationTest.html index 37e00c770..5c83f42c6 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/update/StandardUpdateIntegrationTest.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/update/StandardUpdateIntegrationTest.html @@ -9,116 +9,115 @@ 1 /* 2 * This file is part of dependency-check-core. 3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2013 Jeremy Long. All Rights Reserved. -18 */ -19 package org.owasp.dependencycheck.data.update; -20 -21 import org.owasp.dependencycheck.data.update.exception.UpdateException; -22 -23 import java.net.MalformedURLException; -24 import java.util.Calendar; -25 import org.junit.After; -26 import org.junit.AfterClass; -27 import org.junit.Before; -28 import org.junit.BeforeClass; -29 import org.junit.Test; -30 import static org.junit.Assert.*; -31 import org.owasp.dependencycheck.utils.DownloadFailedException; -32 -33 /** -34 * -35 * @author Jeremy Long <jeremy.long@owasp.org> -36 */ -37 public class StandardUpdateIntegrationTest { -38 -39 public StandardUpdateIntegrationTest() { -40 } -41 -42 @BeforeClass -43 public static void setUpClass() { -44 } -45 -46 @AfterClass -47 public static void tearDownClass() { -48 } -49 -50 @Before -51 public void setUp() { -52 } -53 -54 @After -55 public void tearDown() { -56 } -57 -58 public StandardUpdate getStandardUpdateTask() throws MalformedURLException, DownloadFailedException, UpdateException { -59 StandardUpdate instance = new StandardUpdate(); -60 return instance; -61 } -62 -63 /** -64 * Test of openDataStores method, of class StandardUpdate. -65 */ -66 @Test -67 public void testOpenDataStores() throws Exception { -68 StandardUpdate instance = getStandardUpdateTask(); -69 instance.openDataStores(); -70 instance.closeDataStores(); -71 } -72 -73 /** -74 * Test of withinRange method, of class StandardUpdate. -75 */ -76 @Test -77 public void testWithinRange() throws Exception { -78 Calendar c = Calendar.getInstance(); -79 -80 long current = c.getTimeInMillis(); -81 long lastRun = c.getTimeInMillis() - (3 * (1000 * 60 * 60 * 24)); -82 int range = 7; // 7 days -83 StandardUpdate instance = getStandardUpdateTask(); -84 boolean expResult = true; -85 boolean result = instance.withinRange(lastRun, current, range); -86 assertEquals(expResult, result); -87 -88 lastRun = c.getTimeInMillis() - (8 * (1000 * 60 * 60 * 24)); -89 expResult = false; -90 result = instance.withinRange(lastRun, current, range); -91 assertEquals(expResult, result); -92 } -93 -94 /** -95 * Test of update method, of class StandardUpdate. -96 */ -97 @Test -98 public void testUpdate() throws Exception { -99 StandardUpdate instance = getStandardUpdateTask(); -100 instance.update(); -101 //TODO make this an actual test -102 } -103 -104 /** -105 * Test of updatesNeeded method, of class StandardUpdate. -106 */ -107 @Test -108 public void testUpdatesNeeded() throws Exception { -109 StandardUpdate instance = getStandardUpdateTask(); -110 UpdateableNvdCve result = instance.updatesNeeded(); -111 assertNotNull(result); -112 } -113 } +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2013 Jeremy Long. All Rights Reserved. +17 */ +18 package org.owasp.dependencycheck.data.update; +19 +20 import java.net.MalformedURLException; +21 import java.util.Calendar; +22 import org.junit.After; +23 import org.junit.AfterClass; +24 import static org.junit.Assert.assertEquals; +25 import static org.junit.Assert.assertNotNull; +26 import org.junit.Before; +27 import org.junit.BeforeClass; +28 import org.junit.Test; +29 import org.owasp.dependencycheck.data.update.exception.UpdateException; +30 import org.owasp.dependencycheck.utils.DownloadFailedException; +31 +32 /** +33 * +34 * @author Jeremy Long <jeremy.long@owasp.org> +35 */ +36 public class StandardUpdateIntegrationTest { +37 +38 public StandardUpdateIntegrationTest() { +39 } +40 +41 @BeforeClass +42 public static void setUpClass() { +43 } +44 +45 @AfterClass +46 public static void tearDownClass() { +47 } +48 +49 @Before +50 public void setUp() { +51 } +52 +53 @After +54 public void tearDown() { +55 } +56 +57 public StandardUpdate getStandardUpdateTask() throws MalformedURLException, DownloadFailedException, UpdateException { +58 StandardUpdate instance = new StandardUpdate(); +59 return instance; +60 } +61 +62 /** +63 * Test of openDataStores method, of class StandardUpdate. +64 */ +65 @Test +66 public void testOpenDataStores() throws Exception { +67 StandardUpdate instance = getStandardUpdateTask(); +68 instance.openDataStores(); +69 instance.closeDataStores(); +70 } +71 +72 /** +73 * Test of withinRange method, of class StandardUpdate. +74 */ +75 @Test +76 public void testWithinRange() throws Exception { +77 Calendar c = Calendar.getInstance(); +78 +79 long current = c.getTimeInMillis(); +80 long lastRun = c.getTimeInMillis() - (3 * (1000 * 60 * 60 * 24)); +81 int range = 7; // 7 days +82 StandardUpdate instance = getStandardUpdateTask(); +83 boolean expResult = true; +84 boolean result = instance.withinRange(lastRun, current, range); +85 assertEquals(expResult, result); +86 +87 lastRun = c.getTimeInMillis() - (8 * (1000 * 60 * 60 * 24)); +88 expResult = false; +89 result = instance.withinRange(lastRun, current, range); +90 assertEquals(expResult, result); +91 } +92 +93 /** +94 * Test of update method, of class StandardUpdate. +95 */ +96 @Test +97 public void testUpdate() throws Exception { +98 StandardUpdate instance = getStandardUpdateTask(); +99 instance.update(); +100 //TODO make this an actual test +101 } +102 +103 /** +104 * Test of updatesNeeded method, of class StandardUpdate. +105 */ +106 @Test +107 public void testUpdatesNeeded() throws Exception { +108 StandardUpdate instance = getStandardUpdateTask(); +109 UpdateableNvdCve result = instance.updatesNeeded(); +110 assertNotNull(result); +111 } +112 }
    diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/update/UpdateableNvdCveTest.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/update/UpdateableNvdCveTest.html index d0625b78b..db7642029 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/update/UpdateableNvdCveTest.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/update/UpdateableNvdCveTest.html @@ -9,163 +9,164 @@ 1 /* 2 * This file is part of dependency-check-core. 3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2013 Jeremy Long. All Rights Reserved. -18 */ -19 package org.owasp.dependencycheck.data.update; -20 -21 import java.io.File; -22 import java.io.IOException; -23 import java.net.MalformedURLException; -24 import org.junit.After; -25 import org.junit.AfterClass; -26 import org.junit.Before; -27 import org.junit.BeforeClass; -28 import org.junit.Test; -29 import static org.junit.Assert.*; -30 import org.owasp.dependencycheck.utils.DownloadFailedException; -31 -32 /** -33 * -34 * @author Jeremy Long <jeremy.long@owasp.org> -35 */ -36 public class UpdateableNvdCveTest { -37 -38 public UpdateableNvdCveTest() { -39 } -40 -41 @BeforeClass -42 public static void setUpClass() { -43 } -44 -45 @AfterClass -46 public static void tearDownClass() { -47 } -48 -49 @Before -50 public void setUp() { -51 } -52 -53 @After -54 public void tearDown() { -55 } -56 -57 /** -58 * Test of isUpdateNeeded method, of class UpdateableNvdCve. -59 */ -60 @Test -61 public void testIsUpdateNeeded() throws MalformedURLException, DownloadFailedException, IOException { -62 String id = "key"; -63 //use a local file as this test will load the result and check the timestamp -64 File f = new File("target/test-classes/nvdcve-2.0-2012.xml"); -65 String url = "file:///" + f.getCanonicalPath(); -66 UpdateableNvdCve instance = new UpdateableNvdCve(); -67 instance.add(id, url, url, false); -68 -69 boolean expResult = false; -70 boolean result = instance.isUpdateNeeded(); -71 assertEquals(expResult, result); -72 -73 instance.add("nextId", url, url, true); -74 -75 expResult = true; -76 result = instance.isUpdateNeeded(); -77 assertEquals(expResult, result); -78 } -79 -80 /** -81 * Test of add method, of class UpdateableNvdCve. -82 */ -83 @Test -84 public void testAdd_3args() throws Exception { -85 String id = "key"; -86 File f = new File("target/test-classes/nvdcve-2.0-2012.xml"); -87 //use a local file as this test will load the result and check the timestamp -88 String url = "file:///" + f.getCanonicalPath(); -89 UpdateableNvdCve instance = new UpdateableNvdCve(); -90 instance.add(id, url, url); -91 NvdCveInfo results = instance.get(id); -92 assertEquals(id, results.getId()); -93 assertEquals(url, results.getUrl()); -94 assertEquals(url, results.getOldSchemaVersionUrl()); -95 } -96 -97 /** -98 * Test of add method, of class UpdateableNvdCve. -99 */ -100 @Test -101 public void testAdd_4args() throws Exception { -102 String id = "key"; -103 //use a local file as this test will load the result and check the timestamp -104 File f = new File("target/test-classes/nvdcve-2.0-2012.xml"); -105 String url = "file:///" + f.getCanonicalPath(); -106 UpdateableNvdCve instance = new UpdateableNvdCve(); -107 instance.add(id, url, url, false); -108 -109 boolean expResult = false; -110 boolean result = instance.isUpdateNeeded(); -111 assertEquals(expResult, result); -112 -113 instance.add("nextId", url, url, false); -114 NvdCveInfo results = instance.get(id); -115 -116 assertEquals(id, results.getId()); -117 assertEquals(url, results.getUrl()); -118 assertEquals(url, results.getOldSchemaVersionUrl()); -119 -120 } -121 -122 /** -123 * Test of clear method, of class UpdateableNvdCve. -124 */ -125 @Test -126 public void testClear() throws MalformedURLException, DownloadFailedException, IOException { -127 String id = "key"; -128 //use a local file as this test will load the result and check the timestamp -129 File f = new File("target/test-classes/nvdcve-2.0-2012.xml"); -130 String url = "file:///" + f.getCanonicalPath(); -131 UpdateableNvdCve instance = new UpdateableNvdCve(); -132 instance.add(id, url, url, false); -133 assertFalse(instance.getCollection().isEmpty()); -134 instance.clear(); -135 assertTrue(instance.getCollection().isEmpty()); -136 } -137 -138 /** -139 * Test of iterator method, of class UpdatableNvdCve. -140 */ -141 @Test -142 public void testIterator() throws IOException { -143 //use a local file as this test will load the result and check the timestamp -144 File f = new File("target/test-classes/nvdcve-2.0-2012.xml"); -145 String url = "file:///" + f.getCanonicalPath(); -146 UpdateableNvdCve instance = new UpdateableNvdCve(); -147 instance.add("one", url, url, false); -148 instance.add("two", url, url, false); -149 instance.add("three", url, url, false); -150 int itemsProcessed = 0; -151 for (NvdCveInfo item : instance) { -152 if ("one".equals(item.getId())) { -153 instance.remove(); -154 } -155 itemsProcessed += 1; -156 } -157 assertEquals(3, itemsProcessed); -158 assertEquals(2, instance.getCollection().size()); -159 } -160 } +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2013 Jeremy Long. All Rights Reserved. +17 */ +18 package org.owasp.dependencycheck.data.update; +19 +20 import java.io.File; +21 import java.io.IOException; +22 import java.net.MalformedURLException; +23 import org.junit.After; +24 import org.junit.AfterClass; +25 import static org.junit.Assert.assertEquals; +26 import static org.junit.Assert.assertFalse; +27 import static org.junit.Assert.assertTrue; +28 import org.junit.Before; +29 import org.junit.BeforeClass; +30 import org.junit.Test; +31 import org.owasp.dependencycheck.utils.DownloadFailedException; +32 +33 /** +34 * +35 * @author Jeremy Long <jeremy.long@owasp.org> +36 */ +37 public class UpdateableNvdCveTest { +38 +39 public UpdateableNvdCveTest() { +40 } +41 +42 @BeforeClass +43 public static void setUpClass() { +44 } +45 +46 @AfterClass +47 public static void tearDownClass() { +48 } +49 +50 @Before +51 public void setUp() { +52 } +53 +54 @After +55 public void tearDown() { +56 } +57 +58 /** +59 * Test of isUpdateNeeded method, of class UpdateableNvdCve. +60 */ +61 @Test +62 public void testIsUpdateNeeded() throws MalformedURLException, DownloadFailedException, IOException { +63 String id = "key"; +64 //use a local file as this test will load the result and check the timestamp +65 File f = new File("target/test-classes/nvdcve-2.0-2012.xml"); +66 String url = "file:///" + f.getCanonicalPath(); +67 UpdateableNvdCve instance = new UpdateableNvdCve(); +68 instance.add(id, url, url, false); +69 +70 boolean expResult = false; +71 boolean result = instance.isUpdateNeeded(); +72 assertEquals(expResult, result); +73 +74 instance.add("nextId", url, url, true); +75 +76 expResult = true; +77 result = instance.isUpdateNeeded(); +78 assertEquals(expResult, result); +79 } +80 +81 /** +82 * Test of add method, of class UpdateableNvdCve. +83 */ +84 @Test +85 public void testAdd_3args() throws Exception { +86 String id = "key"; +87 File f = new File("target/test-classes/nvdcve-2.0-2012.xml"); +88 //use a local file as this test will load the result and check the timestamp +89 String url = "file:///" + f.getCanonicalPath(); +90 UpdateableNvdCve instance = new UpdateableNvdCve(); +91 instance.add(id, url, url); +92 NvdCveInfo results = instance.get(id); +93 assertEquals(id, results.getId()); +94 assertEquals(url, results.getUrl()); +95 assertEquals(url, results.getOldSchemaVersionUrl()); +96 } +97 +98 /** +99 * Test of add method, of class UpdateableNvdCve. +100 */ +101 @Test +102 public void testAdd_4args() throws Exception { +103 String id = "key"; +104 //use a local file as this test will load the result and check the timestamp +105 File f = new File("target/test-classes/nvdcve-2.0-2012.xml"); +106 String url = "file:///" + f.getCanonicalPath(); +107 UpdateableNvdCve instance = new UpdateableNvdCve(); +108 instance.add(id, url, url, false); +109 +110 boolean expResult = false; +111 boolean result = instance.isUpdateNeeded(); +112 assertEquals(expResult, result); +113 +114 instance.add("nextId", url, url, false); +115 NvdCveInfo results = instance.get(id); +116 +117 assertEquals(id, results.getId()); +118 assertEquals(url, results.getUrl()); +119 assertEquals(url, results.getOldSchemaVersionUrl()); +120 +121 } +122 +123 /** +124 * Test of clear method, of class UpdateableNvdCve. +125 */ +126 @Test +127 public void testClear() throws MalformedURLException, DownloadFailedException, IOException { +128 String id = "key"; +129 //use a local file as this test will load the result and check the timestamp +130 File f = new File("target/test-classes/nvdcve-2.0-2012.xml"); +131 String url = "file:///" + f.getCanonicalPath(); +132 UpdateableNvdCve instance = new UpdateableNvdCve(); +133 instance.add(id, url, url, false); +134 assertFalse(instance.getCollection().isEmpty()); +135 instance.clear(); +136 assertTrue(instance.getCollection().isEmpty()); +137 } +138 +139 /** +140 * Test of iterator method, of class UpdatableNvdCve. +141 */ +142 @Test +143 public void testIterator() throws IOException { +144 //use a local file as this test will load the result and check the timestamp +145 File f = new File("target/test-classes/nvdcve-2.0-2012.xml"); +146 String url = "file:///" + f.getCanonicalPath(); +147 UpdateableNvdCve instance = new UpdateableNvdCve(); +148 instance.add("one", url, url, false); +149 instance.add("two", url, url, false); +150 instance.add("three", url, url, false); +151 int itemsProcessed = 0; +152 for (NvdCveInfo item : instance) { +153 if ("one".equals(item.getId())) { +154 instance.remove(); +155 } +156 itemsProcessed += 1; +157 } +158 assertEquals(3, itemsProcessed); +159 assertEquals(2, instance.getCollection().size()); +160 } +161 }
    diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/update/package-frame.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/update/package-frame.html index 8e2571bdf..8d8ee8105 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/update/package-frame.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/update/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.0.8 Reference Package org.owasp.dependencycheck.data.update + Dependency-Check Core 1.1.0 Reference Package org.owasp.dependencycheck.data.update diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/update/package-summary.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/update/package-summary.html index 59743344f..3c4f66bee 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/update/package-summary.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/update/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.0.8 Reference Package org.owasp.dependencycheck.data.update + Dependency-Check Core 1.1.0 Reference Package org.owasp.dependencycheck.data.update diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/update/xml/NvdCve_1_2_HandlerTest.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/update/xml/NvdCve_1_2_HandlerTest.html index 77bce8b29..a27e23520 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/update/xml/NvdCve_1_2_HandlerTest.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/update/xml/NvdCve_1_2_HandlerTest.html @@ -9,75 +9,73 @@ 1 /* 2 * This file is part of dependency-check-core. 3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. -18 */ -19 package org.owasp.dependencycheck.data.update.xml; -20 -21 import org.owasp.dependencycheck.data.update.xml.NvdCve12Handler; -22 import java.io.File; -23 import java.util.List; -24 import java.util.Map; -25 import javax.xml.parsers.SAXParser; -26 import javax.xml.parsers.SAXParserFactory; -27 import org.owasp.dependencycheck.dependency.VulnerableSoftware; -28 import org.junit.After; -29 import org.junit.AfterClass; -30 import org.junit.Before; -31 import org.junit.BeforeClass; -32 import org.junit.Test; -33 import static org.junit.Assert.*; -34 -35 /** -36 * -37 * @author Jeremy Long <jeremy.long@owasp.org> -38 */ -39 public class NvdCve_1_2_HandlerTest { -40 -41 public NvdCve_1_2_HandlerTest() { -42 } -43 -44 @BeforeClass -45 public static void setUpClass() throws Exception { -46 } -47 -48 @AfterClass -49 public static void tearDownClass() throws Exception { -50 } -51 -52 @Before -53 public void setUp() { -54 } -55 -56 @After -57 public void tearDown() { -58 } -59 -60 @Test -61 public void testParse() throws Exception { -62 SAXParserFactory factory = SAXParserFactory.newInstance(); -63 SAXParser saxParser = factory.newSAXParser(); +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. +17 */ +18 package org.owasp.dependencycheck.data.update.xml; +19 +20 import java.io.File; +21 import java.util.List; +22 import java.util.Map; +23 import javax.xml.parsers.SAXParser; +24 import javax.xml.parsers.SAXParserFactory; +25 import org.junit.After; +26 import org.junit.AfterClass; +27 import static org.junit.Assert.assertTrue; +28 import org.junit.Before; +29 import org.junit.BeforeClass; +30 import org.junit.Test; +31 import org.owasp.dependencycheck.dependency.VulnerableSoftware; +32 +33 /** +34 * +35 * @author Jeremy Long <jeremy.long@owasp.org> +36 */ +37 public class NvdCve_1_2_HandlerTest { +38 +39 public NvdCve_1_2_HandlerTest() { +40 } +41 +42 @BeforeClass +43 public static void setUpClass() throws Exception { +44 } +45 +46 @AfterClass +47 public static void tearDownClass() throws Exception { +48 } +49 +50 @Before +51 public void setUp() { +52 } +53 +54 @After +55 public void tearDown() { +56 } +57 +58 @Test +59 public void testParse() throws Exception { +60 SAXParserFactory factory = SAXParserFactory.newInstance(); +61 SAXParser saxParser = factory.newSAXParser(); +62 +63 File file = new File(this.getClass().getClassLoader().getResource("nvdcve-2012.xml").getPath()); 64 -65 File file = new File(this.getClass().getClassLoader().getResource("nvdcve-2012.xml").getPath()); -66 -67 NvdCve12Handler instance = new NvdCve12Handler(); -68 saxParser.parse(file, instance); -69 Map<String, List<VulnerableSoftware>> results = instance.getVulnerabilities(); -70 assertTrue("No vulnerable software identified with a previous version in 2012 CVE 1.2?", !results.isEmpty()); -71 } -72 } +65 NvdCve12Handler instance = new NvdCve12Handler(); +66 saxParser.parse(file, instance); +67 Map<String, List<VulnerableSoftware>> results = instance.getVulnerabilities(); +68 assertTrue("No vulnerable software identified with a previous version in 2012 CVE 1.2?", !results.isEmpty()); +69 } +70 }
    diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/update/xml/NvdCve_2_0_HandlerTest.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/update/xml/NvdCve_2_0_HandlerTest.html index 9efd50012..2d2f1064b 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/update/xml/NvdCve_2_0_HandlerTest.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/update/xml/NvdCve_2_0_HandlerTest.html @@ -9,81 +9,79 @@ 1 /* 2 * This file is part of dependency-check-core. 3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. -18 */ -19 package org.owasp.dependencycheck.data.update.xml; -20 -21 import org.owasp.dependencycheck.data.update.xml.NvdCve20Handler; -22 import java.io.File; -23 import javax.xml.parsers.SAXParser; -24 import javax.xml.parsers.SAXParserFactory; -25 import org.junit.After; -26 import org.junit.AfterClass; -27 import org.junit.Before; -28 import org.junit.BeforeClass; -29 import org.junit.Test; -30 import static org.junit.Assert.*; -31 -32 /** -33 * -34 * @author Jeremy Long <jeremy.long@owasp.org> -35 */ -36 public class NvdCve_2_0_HandlerTest { -37 -38 public NvdCve_2_0_HandlerTest() { -39 } -40 -41 @BeforeClass -42 public static void setUpClass() throws Exception { -43 } -44 -45 @AfterClass -46 public static void tearDownClass() throws Exception { -47 } -48 -49 @Before -50 public void setUp() { -51 } -52 -53 @After -54 public void tearDown() { -55 } -56 -57 @Test -58 public void testParse() { -59 Exception results = null; -60 try { -61 SAXParserFactory factory = SAXParserFactory.newInstance(); -62 SAXParser saxParser = factory.newSAXParser(); +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. +17 */ +18 package org.owasp.dependencycheck.data.update.xml; +19 +20 import java.io.File; +21 import javax.xml.parsers.SAXParser; +22 import javax.xml.parsers.SAXParserFactory; +23 import org.junit.After; +24 import org.junit.AfterClass; +25 import static org.junit.Assert.assertTrue; +26 import org.junit.Before; +27 import org.junit.BeforeClass; +28 import org.junit.Test; +29 +30 /** +31 * +32 * @author Jeremy Long <jeremy.long@owasp.org> +33 */ +34 public class NvdCve_2_0_HandlerTest { +35 +36 public NvdCve_2_0_HandlerTest() { +37 } +38 +39 @BeforeClass +40 public static void setUpClass() throws Exception { +41 } +42 +43 @AfterClass +44 public static void tearDownClass() throws Exception { +45 } +46 +47 @Before +48 public void setUp() { +49 } +50 +51 @After +52 public void tearDown() { +53 } +54 +55 @Test +56 public void testParse() { +57 Exception results = null; +58 try { +59 SAXParserFactory factory = SAXParserFactory.newInstance(); +60 SAXParser saxParser = factory.newSAXParser(); +61 +62 File file = new File(this.getClass().getClassLoader().getResource("nvdcve-2.0-2012.xml").getPath()); 63 -64 File file = new File(this.getClass().getClassLoader().getResource("nvdcve-2.0-2012.xml").getPath()); +64 NvdCve20Handler instance = new NvdCve20Handler(); 65 -66 NvdCve20Handler instance = new NvdCve20Handler(); -67 -68 saxParser.parse(file, instance); -69 } catch (Exception ex) { -70 results = ex; -71 } -72 assertTrue("Exception thrown during parse of 2012 CVE version 2.0?", results == null); -73 if (results != null) { -74 System.err.println(results); -75 } -76 -77 } -78 } +66 saxParser.parse(file, instance); +67 } catch (Exception ex) { +68 results = ex; +69 } +70 assertTrue("Exception thrown during parse of 2012 CVE version 2.0?", results == null); +71 if (results != null) { +72 System.err.println(results); +73 } +74 +75 } +76 }
    diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/update/xml/package-frame.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/update/xml/package-frame.html index d4dbef4dc..b9896dc28 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/update/xml/package-frame.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/update/xml/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.0.8 Reference Package org.owasp.dependencycheck.data.update.xml + Dependency-Check Core 1.1.0 Reference Package org.owasp.dependencycheck.data.update.xml diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/update/xml/package-summary.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/update/xml/package-summary.html index 66bc78e54..940b6c33f 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/data/update/xml/package-summary.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/data/update/xml/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.0.8 Reference Package org.owasp.dependencycheck.data.update.xml + Dependency-Check Core 1.1.0 Reference Package org.owasp.dependencycheck.data.update.xml diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/dependency/DependencyTest.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/dependency/DependencyTest.html index 85dea3947..3fb60c569 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/dependency/DependencyTest.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/dependency/DependencyTest.html @@ -9,304 +9,300 @@ 1 /* 2 * This file is part of dependency-check-core. 3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2013 Jeremy Long. All Rights Reserved. -18 */ -19 package org.owasp.dependencycheck.dependency; -20 -21 import java.util.Set; -22 import org.owasp.dependencycheck.dependency.EvidenceCollection; -23 import org.owasp.dependencycheck.dependency.Identifier; -24 import org.owasp.dependencycheck.dependency.Dependency; -25 import org.owasp.dependencycheck.dependency.Evidence; -26 import java.io.File; -27 import java.util.List; -28 import org.junit.After; -29 import org.junit.AfterClass; -30 import org.junit.Before; -31 import org.junit.BeforeClass; -32 import org.junit.Test; -33 import static org.junit.Assert.*; -34 -35 /** -36 * -37 * @author Jeremy Long <jeremy.long@owasp.org> -38 */ -39 public class DependencyTest { -40 -41 public DependencyTest() { +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2013 Jeremy Long. All Rights Reserved. +17 */ +18 package org.owasp.dependencycheck.dependency; +19 +20 import java.io.File; +21 import java.util.List; +22 import java.util.Set; +23 import org.junit.After; +24 import org.junit.AfterClass; +25 import static org.junit.Assert.assertEquals; +26 import static org.junit.Assert.assertTrue; +27 import org.junit.Before; +28 import org.junit.BeforeClass; +29 import org.junit.Test; +30 +31 /** +32 * +33 * @author Jeremy Long <jeremy.long@owasp.org> +34 */ +35 public class DependencyTest { +36 +37 public DependencyTest() { +38 } +39 +40 @BeforeClass +41 public static void setUpClass() throws Exception { 42 } 43 -44 @BeforeClass -45 public static void setUpClass() throws Exception { +44 @AfterClass +45 public static void tearDownClass() throws Exception { 46 } 47 -48 @AfterClass -49 public static void tearDownClass() throws Exception { +48 @Before +49 public void setUp() { 50 } 51 -52 @Before -53 public void setUp() { +52 @After +53 public void tearDown() { 54 } 55 -56 @After -57 public void tearDown() { -58 } -59 -60 /** -61 * Test of getFileName method, of class Dependency. -62 */ -63 @Test -64 public void testGetFileName() { -65 Dependency instance = new Dependency(); -66 String expResult = "filename"; -67 instance.setFileName(expResult); -68 String result = instance.getFileName(); -69 assertEquals(expResult, result); -70 } -71 -72 /** -73 * Test of setFileName method, of class Dependency. -74 */ -75 @Test -76 public void testSetFileName() { -77 String fileName = "test.file"; -78 Dependency instance = new Dependency(); -79 instance.setFileName(fileName); -80 assertEquals(fileName, instance.getFileName()); -81 } -82 -83 /** -84 * Test of setActualFilePath method, of class Dependency. -85 */ -86 @Test -87 public void testSetActualFilePath() { -88 String actualFilePath = "test.file"; -89 Dependency instance = new Dependency(); -90 instance.setActualFilePath(actualFilePath); -91 assertEquals(actualFilePath, instance.getActualFilePath()); -92 } -93 -94 /** -95 * Test of getActualFilePath method, of class Dependency. -96 */ -97 @Test -98 public void testGetActualFilePath() { -99 Dependency instance = new Dependency(); -100 String expResult = "test.file"; -101 instance.setActualFilePath(expResult); -102 String result = instance.getActualFilePath(); -103 assertEquals(expResult, result); -104 } -105 -106 /** -107 * Test of setFilePath method, of class Dependency. -108 */ -109 @Test -110 public void testSetFilePath() { -111 String filePath = "test.file"; -112 Dependency instance = new Dependency(); -113 instance.setFilePath(filePath); -114 assertEquals(filePath, instance.getFilePath()); -115 } -116 -117 /** -118 * Test of getFilePath method, of class Dependency. -119 */ -120 @Test -121 public void testGetFilePath() { -122 Dependency instance = new Dependency(); -123 String expResult = "path/test.file"; -124 instance.setFilePath(expResult); -125 String result = instance.getFilePath(); -126 assertEquals(expResult, result); -127 } -128 -129 /** -130 * Test of setFileExtension method, of class Dependency. -131 */ -132 @Test -133 public void testSetFileExtension() { -134 String fileExtension = "jar"; -135 Dependency instance = new Dependency(); -136 instance.setFileExtension(fileExtension); -137 assertEquals(fileExtension, instance.getFileExtension()); -138 } -139 -140 /** -141 * Test of getFileExtension method, of class Dependency. -142 */ -143 @Test -144 public void testGetFileExtension() { -145 Dependency instance = new Dependency(); -146 String expResult = "jar"; -147 instance.setFileExtension(expResult); -148 String result = instance.getFileExtension(); -149 assertEquals(expResult, result); -150 } -151 -152 /** -153 * Test of getMd5sum method, of class Dependency. -154 */ -155 @Test -156 public void testGetMd5sum() { -157 File file = new File(this.getClass().getClassLoader().getResource("struts2-core-2.1.2.jar").getPath()); -158 Dependency instance = new Dependency(file); -159 // assertEquals("89CE9E36AA9A9E03F1450936D2F4F8DD0F961F8B", result.getSha1sum()); -160 String expResult = "C30B57142E1CCBC1EFD5CD15F307358F"; -161 String result = instance.getMd5sum(); -162 assertEquals(expResult, result); -163 } -164 -165 /** -166 * Test of setMd5sum method, of class Dependency. -167 */ -168 @Test -169 public void testSetMd5sum() { -170 String md5sum = "test"; -171 Dependency instance = new Dependency(); -172 instance.setMd5sum(md5sum); -173 assertEquals(md5sum, instance.getMd5sum()); -174 } -175 -176 /** -177 * Test of getSha1sum method, of class Dependency. -178 */ -179 @Test -180 public void testGetSha1sum() { -181 File file = new File(this.getClass().getClassLoader().getResource("struts2-core-2.1.2.jar").getPath()); -182 Dependency instance = new Dependency(file); -183 String expResult = "89CE9E36AA9A9E03F1450936D2F4F8DD0F961F8B"; -184 String result = instance.getSha1sum(); -185 assertEquals(expResult, result); -186 } -187 -188 /** -189 * Test of setSha1sum method, of class Dependency. -190 */ -191 @Test -192 public void testSetSha1sum() { -193 String sha1sum = "test"; -194 Dependency instance = new Dependency(); -195 instance.setSha1sum(sha1sum); -196 assertEquals(sha1sum, instance.getSha1sum()); -197 } -198 -199 /** -200 * Test of getIdentifiers method, of class Dependency. -201 */ -202 @Test -203 public void testGetIdentifiers() { -204 Dependency instance = new Dependency(); -205 List expResult = null; -206 Set<Identifier> result = instance.getIdentifiers(); -207 -208 assertTrue(true); //this is just a getter setter pair. -209 } -210 -211 /** -212 * Test of setIdentifiers method, of class Dependency. -213 */ -214 @Test -215 public void testSetIdentifiers() { -216 Set<Identifier> identifiers = null; -217 Dependency instance = new Dependency(); -218 instance.setIdentifiers(identifiers); -219 assertTrue(true); //this is just a getter setter pair. -220 } -221 -222 /** -223 * Test of addIdentifier method, of class Dependency. -224 */ -225 @Test -226 public void testAddIdentifier() { -227 String type = "cpe"; -228 String value = "cpe:/a:apache:struts:2.1.2"; -229 String url = "http://somewhere"; -230 Identifier expResult = new Identifier(type, value, url); -231 -232 Dependency instance = new Dependency(); -233 instance.addIdentifier(type, value, url); -234 assertEquals(1, instance.getIdentifiers().size()); -235 assertTrue("Identifier doesn't contain expected result.", instance.getIdentifiers().contains(expResult)); -236 } -237 -238 /** -239 * Test of getEvidence method, of class Dependency. -240 */ -241 @Test -242 public void testGetEvidence() { -243 Dependency instance = new Dependency(); -244 EvidenceCollection expResult = null; -245 EvidenceCollection result = instance.getEvidence(); -246 assertTrue(true); //this is just a getter setter pair. -247 } -248 -249 /** -250 * Test of getEvidenceUsed method, of class Dependency. -251 */ -252 @Test -253 public void testGetEvidenceUsed() { -254 Dependency instance = new Dependency(); -255 String expResult = "used"; -256 -257 instance.getProductEvidence().addEvidence("used", "used", "used", Evidence.Confidence.HIGH); -258 instance.getProductEvidence().addEvidence("not", "not", "not", Evidence.Confidence.MEDIUM); -259 for (Evidence e : instance.getProductEvidence().iterator(Evidence.Confidence.HIGH)) { -260 String use = e.getValue(); -261 } -262 -263 EvidenceCollection result = instance.getEvidenceUsed(); +56 /** +57 * Test of getFileName method, of class Dependency. +58 */ +59 @Test +60 public void testGetFileName() { +61 Dependency instance = new Dependency(); +62 String expResult = "filename"; +63 instance.setFileName(expResult); +64 String result = instance.getFileName(); +65 assertEquals(expResult, result); +66 } +67 +68 /** +69 * Test of setFileName method, of class Dependency. +70 */ +71 @Test +72 public void testSetFileName() { +73 String fileName = "file.tar"; +74 Dependency instance = new Dependency(); +75 instance.setFileName(fileName); +76 assertEquals(fileName, instance.getFileName()); +77 } +78 +79 /** +80 * Test of setActualFilePath method, of class Dependency. +81 */ +82 @Test +83 public void testSetActualFilePath() { +84 String actualFilePath = "file.tar"; +85 Dependency instance = new Dependency(); +86 instance.setActualFilePath(actualFilePath); +87 assertEquals(actualFilePath, instance.getActualFilePath()); +88 } +89 +90 /** +91 * Test of getActualFilePath method, of class Dependency. +92 */ +93 @Test +94 public void testGetActualFilePath() { +95 Dependency instance = new Dependency(); +96 String expResult = "file.tar"; +97 instance.setActualFilePath(expResult); +98 String result = instance.getActualFilePath(); +99 assertEquals(expResult, result); +100 } +101 +102 /** +103 * Test of setFilePath method, of class Dependency. +104 */ +105 @Test +106 public void testSetFilePath() { +107 String filePath = "file.tar"; +108 Dependency instance = new Dependency(); +109 instance.setFilePath(filePath); +110 assertEquals(filePath, instance.getFilePath()); +111 } +112 +113 /** +114 * Test of getFilePath method, of class Dependency. +115 */ +116 @Test +117 public void testGetFilePath() { +118 Dependency instance = new Dependency(); +119 String expResult = "file.tar"; +120 instance.setFilePath(expResult); +121 String result = instance.getFilePath(); +122 assertEquals(expResult, result); +123 } +124 +125 /** +126 * Test of setFileExtension method, of class Dependency. +127 */ +128 @Test +129 public void testSetFileExtension() { +130 String fileExtension = "jar"; +131 Dependency instance = new Dependency(); +132 instance.setFileExtension(fileExtension); +133 assertEquals(fileExtension, instance.getFileExtension()); +134 } +135 +136 /** +137 * Test of getFileExtension method, of class Dependency. +138 */ +139 @Test +140 public void testGetFileExtension() { +141 Dependency instance = new Dependency(); +142 String expResult = "jar"; +143 instance.setFileExtension(expResult); +144 String result = instance.getFileExtension(); +145 assertEquals(expResult, result); +146 } +147 +148 /** +149 * Test of getMd5sum method, of class Dependency. +150 */ +151 @Test +152 public void testGetMd5sum() { +153 File file = new File(this.getClass().getClassLoader().getResource("struts2-core-2.1.2.jar").getPath()); +154 Dependency instance = new Dependency(file); +155 // assertEquals("89CE9E36AA9A9E03F1450936D2F4F8DD0F961F8B", result.getSha1sum()); +156 String expResult = "C30B57142E1CCBC1EFD5CD15F307358F"; +157 String result = instance.getMd5sum(); +158 assertEquals(expResult, result); +159 } +160 +161 /** +162 * Test of setMd5sum method, of class Dependency. +163 */ +164 @Test +165 public void testSetMd5sum() { +166 String md5sum = "test"; +167 Dependency instance = new Dependency(); +168 instance.setMd5sum(md5sum); +169 assertEquals(md5sum, instance.getMd5sum()); +170 } +171 +172 /** +173 * Test of getSha1sum method, of class Dependency. +174 */ +175 @Test +176 public void testGetSha1sum() { +177 File file = new File(this.getClass().getClassLoader().getResource("struts2-core-2.1.2.jar").getPath()); +178 Dependency instance = new Dependency(file); +179 String expResult = "89CE9E36AA9A9E03F1450936D2F4F8DD0F961F8B"; +180 String result = instance.getSha1sum(); +181 assertEquals(expResult, result); +182 } +183 +184 /** +185 * Test of setSha1sum method, of class Dependency. +186 */ +187 @Test +188 public void testSetSha1sum() { +189 String sha1sum = "test"; +190 Dependency instance = new Dependency(); +191 instance.setSha1sum(sha1sum); +192 assertEquals(sha1sum, instance.getSha1sum()); +193 } +194 +195 /** +196 * Test of getIdentifiers method, of class Dependency. +197 */ +198 @Test +199 public void testGetIdentifiers() { +200 Dependency instance = new Dependency(); +201 List expResult = null; +202 Set<Identifier> result = instance.getIdentifiers(); +203 +204 assertTrue(true); //this is just a getter setter pair. +205 } +206 +207 /** +208 * Test of setIdentifiers method, of class Dependency. +209 */ +210 @Test +211 public void testSetIdentifiers() { +212 Set<Identifier> identifiers = null; +213 Dependency instance = new Dependency(); +214 instance.setIdentifiers(identifiers); +215 assertTrue(true); //this is just a getter setter pair. +216 } +217 +218 /** +219 * Test of addIdentifier method, of class Dependency. +220 */ +221 @Test +222 public void testAddIdentifier() { +223 String type = "cpe"; +224 String value = "cpe:/a:apache:struts:2.1.2"; +225 String url = "http://somewhere"; +226 Identifier expResult = new Identifier(type, value, url); +227 +228 Dependency instance = new Dependency(); +229 instance.addIdentifier(type, value, url); +230 assertEquals(1, instance.getIdentifiers().size()); +231 assertTrue("Identifier doesn't contain expected result.", instance.getIdentifiers().contains(expResult)); +232 } +233 +234 /** +235 * Test of getEvidence method, of class Dependency. +236 */ +237 @Test +238 public void testGetEvidence() { +239 Dependency instance = new Dependency(); +240 EvidenceCollection expResult = null; +241 EvidenceCollection result = instance.getEvidence(); +242 assertTrue(true); //this is just a getter setter pair. +243 } +244 +245 /** +246 * Test of getEvidenceUsed method, of class Dependency. +247 */ +248 @Test +249 public void testGetEvidenceUsed() { +250 Dependency instance = new Dependency(); +251 String expResult = "used"; +252 +253 instance.getProductEvidence().addEvidence("used", "used", "used", Confidence.HIGH); +254 instance.getProductEvidence().addEvidence("not", "not", "not", Confidence.MEDIUM); +255 for (Evidence e : instance.getProductEvidence().iterator(Confidence.HIGH)) { +256 String use = e.getValue(); +257 } +258 +259 EvidenceCollection result = instance.getEvidenceUsed(); +260 +261 assertEquals(1, result.size()); +262 assertTrue(result.containsUsedString(expResult)); +263 } 264 -265 assertEquals(1, result.size()); -266 assertTrue(result.containsUsedString(expResult)); -267 } -268 -269 /** -270 * Test of getVendorEvidence method, of class Dependency. -271 */ -272 @Test -273 public void testGetVendorEvidence() { -274 Dependency instance = new Dependency(); -275 EvidenceCollection expResult = null; -276 EvidenceCollection result = instance.getVendorEvidence(); -277 assertTrue(true); //this is just a getter setter pair. -278 } -279 -280 /** -281 * Test of getProductEvidence method, of class Dependency. -282 */ -283 @Test -284 public void testGetProductEvidence() { -285 Dependency instance = new Dependency(); -286 EvidenceCollection expResult = null; -287 EvidenceCollection result = instance.getProductEvidence(); -288 assertTrue(true); //this is just a getter setter pair. -289 } -290 -291 /** -292 * Test of getVersionEvidence method, of class Dependency. -293 */ -294 @Test -295 public void testGetVersionEvidence() { -296 Dependency instance = new Dependency(); -297 EvidenceCollection expResult = null; -298 EvidenceCollection result = instance.getVersionEvidence(); -299 assertTrue(true); //this is just a getter setter pair. -300 } -301 } +265 /** +266 * Test of getVendorEvidence method, of class Dependency. +267 */ +268 @Test +269 public void testGetVendorEvidence() { +270 Dependency instance = new Dependency(); +271 EvidenceCollection expResult = null; +272 EvidenceCollection result = instance.getVendorEvidence(); +273 assertTrue(true); //this is just a getter setter pair. +274 } +275 +276 /** +277 * Test of getProductEvidence method, of class Dependency. +278 */ +279 @Test +280 public void testGetProductEvidence() { +281 Dependency instance = new Dependency(); +282 EvidenceCollection expResult = null; +283 EvidenceCollection result = instance.getProductEvidence(); +284 assertTrue(true); //this is just a getter setter pair. +285 } +286 +287 /** +288 * Test of getVersionEvidence method, of class Dependency. +289 */ +290 @Test +291 public void testGetVersionEvidence() { +292 Dependency instance = new Dependency(); +293 EvidenceCollection expResult = null; +294 EvidenceCollection result = instance.getVersionEvidence(); +295 assertTrue(true); //this is just a getter setter pair. +296 } +297 }
    diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/dependency/VulnerableSoftwareTest.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/dependency/VulnerableSoftwareTest.html index 0d28b3e6e..a271905bb 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/dependency/VulnerableSoftwareTest.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/dependency/VulnerableSoftwareTest.html @@ -9,95 +9,94 @@ 1 /* 2 * This file is part of dependency-check-core. 3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2013 Jeremy Long. All Rights Reserved. -18 */ -19 package org.owasp.dependencycheck.dependency; -20 -21 import org.junit.After; -22 import org.junit.AfterClass; +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2013 Jeremy Long. All Rights Reserved. +17 */ +18 package org.owasp.dependencycheck.dependency; +19 +20 import org.junit.After; +21 import org.junit.AfterClass; +22 import static org.junit.Assert.assertEquals; 23 import org.junit.Before; 24 import org.junit.BeforeClass; 25 import org.junit.Test; -26 import static org.junit.Assert.*; -27 -28 /** -29 * -30 * @author Jeremy Long <jeremy.long@owasp.org> -31 */ -32 public class VulnerableSoftwareTest { -33 -34 public VulnerableSoftwareTest() { -35 } -36 -37 @BeforeClass -38 public static void setUpClass() throws Exception { -39 } -40 -41 @AfterClass -42 public static void tearDownClass() throws Exception { -43 } -44 -45 @Before -46 public void setUp() { -47 } -48 -49 @After -50 public void tearDown() { -51 } -52 -53 /** -54 * Test of equals method, of class VulnerableSoftware. -55 */ -56 @Test -57 public void testEquals() { -58 VulnerableSoftware obj = new VulnerableSoftware(); -59 obj.setCpe("cpe:/a:mortbay:jetty:6.1.0"); -60 VulnerableSoftware instance = new VulnerableSoftware(); -61 instance.setCpe("cpe:/a:mortbay:jetty:6.1"); -62 boolean expResult = false; -63 boolean result = instance.equals(obj); -64 assertEquals(expResult, result); -65 } -66 -67 /** -68 * Test of hashCode method, of class VulnerableSoftware. -69 */ -70 @Test -71 public void testHashCode() { -72 VulnerableSoftware instance = new VulnerableSoftware(); -73 instance.setCpe("cpe:/a:mortbay:jetty:6.1"); -74 int expResult = 1849413912; -75 int result = instance.hashCode(); -76 assertEquals(expResult, result); -77 } -78 -79 /** -80 * Test of compareTo method, of class VulnerableSoftware. -81 */ -82 @Test -83 public void testCompareTo() { -84 VulnerableSoftware vs = new VulnerableSoftware(); -85 vs.setCpe("cpe:/a:mortbay:jetty:6.1.0"); -86 VulnerableSoftware instance = new VulnerableSoftware(); -87 instance.setCpe("cpe:/a:mortbay:jetty:6.1"); -88 int expResult = -2; -89 int result = instance.compareTo(vs); -90 assertEquals(expResult, result); -91 } -92 } +26 +27 /** +28 * +29 * @author Jeremy Long <jeremy.long@owasp.org> +30 */ +31 public class VulnerableSoftwareTest { +32 +33 public VulnerableSoftwareTest() { +34 } +35 +36 @BeforeClass +37 public static void setUpClass() throws Exception { +38 } +39 +40 @AfterClass +41 public static void tearDownClass() throws Exception { +42 } +43 +44 @Before +45 public void setUp() { +46 } +47 +48 @After +49 public void tearDown() { +50 } +51 +52 /** +53 * Test of equals method, of class VulnerableSoftware. +54 */ +55 @Test +56 public void testEquals() { +57 VulnerableSoftware obj = new VulnerableSoftware(); +58 obj.setCpe("cpe:/a:mortbay:jetty:6.1.0"); +59 VulnerableSoftware instance = new VulnerableSoftware(); +60 instance.setCpe("cpe:/a:mortbay:jetty:6.1"); +61 boolean expResult = false; +62 boolean result = instance.equals(obj); +63 assertEquals(expResult, result); +64 } +65 +66 /** +67 * Test of hashCode method, of class VulnerableSoftware. +68 */ +69 @Test +70 public void testHashCode() { +71 VulnerableSoftware instance = new VulnerableSoftware(); +72 instance.setCpe("cpe:/a:mortbay:jetty:6.1"); +73 int expResult = 1849413912; +74 int result = instance.hashCode(); +75 assertEquals(expResult, result); +76 } +77 +78 /** +79 * Test of compareTo method, of class VulnerableSoftware. +80 */ +81 @Test +82 public void testCompareTo() { +83 VulnerableSoftware vs = new VulnerableSoftware(); +84 vs.setCpe("cpe:/a:mortbay:jetty:6.1.0"); +85 VulnerableSoftware instance = new VulnerableSoftware(); +86 instance.setCpe("cpe:/a:mortbay:jetty:6.1"); +87 int expResult = -2; +88 int result = instance.compareTo(vs); +89 assertEquals(expResult, result); +90 } +91 }
    diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/dependency/package-frame.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/dependency/package-frame.html index d05d64342..17288460a 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/dependency/package-frame.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/dependency/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.0.8 Reference Package org.owasp.dependencycheck.dependency + Dependency-Check Core 1.1.0 Reference Package org.owasp.dependencycheck.dependency diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/dependency/package-summary.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/dependency/package-summary.html index faa03a815..d1a9a3962 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/dependency/package-summary.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/dependency/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.0.8 Reference Package org.owasp.dependencycheck.dependency + Dependency-Check Core 1.1.0 Reference Package org.owasp.dependencycheck.dependency diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/package-frame.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/package-frame.html index 813ffbfe9..ce0796eac 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/package-frame.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.0.8 Reference Package org.owasp.dependencycheck + Dependency-Check Core 1.1.0 Reference Package org.owasp.dependencycheck diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/package-summary.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/package-summary.html index 1c0e7aeb7..962b5553f 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/package-summary.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.0.8 Reference Package org.owasp.dependencycheck + Dependency-Check Core 1.1.0 Reference Package org.owasp.dependencycheck diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/reporting/ReportGeneratorTest.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/reporting/ReportGeneratorTest.html index affff65fc..f2c9869a0 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/reporting/ReportGeneratorTest.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/reporting/ReportGeneratorTest.html @@ -9,37 +9,37 @@ 1 /* 2 * This file is part of dependency-check-core. 3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. -18 */ -19 package org.owasp.dependencycheck.reporting; -20 -21 import org.owasp.dependencycheck.Engine; -22 import org.junit.After; -23 import org.junit.AfterClass; -24 import org.junit.Before; -25 import org.junit.BeforeClass; -26 import org.junit.Test; -27 -28 import javax.xml.XMLConstants; -29 import javax.xml.transform.stream.StreamSource; -30 import javax.xml.validation.Schema; -31 import javax.xml.validation.SchemaFactory; -32 import javax.xml.validation.Validator; -33 import java.io.File; -34 import java.io.InputStream; +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. +17 */ +18 package org.owasp.dependencycheck.reporting; +19 +20 import java.io.File; +21 import java.io.InputStream; +22 import javax.xml.XMLConstants; +23 import javax.xml.transform.stream.StreamSource; +24 import javax.xml.validation.Schema; +25 import javax.xml.validation.SchemaFactory; +26 import javax.xml.validation.Validator; +27 import org.junit.After; +28 import org.junit.AfterClass; +29 import org.junit.Before; +30 import org.junit.BeforeClass; +31 import org.junit.Test; +32 import org.owasp.dependencycheck.Engine; +33 import org.owasp.dependencycheck.data.nvdcve.CveDB; +34 import org.owasp.dependencycheck.data.nvdcve.DatabaseProperties; 35 36 /** 37 * @@ -125,42 +125,48 @@ 117 } 118 119 /** -120 * Generates an XML report containing known vulnerabilities and realistic -121 * data and validates the generated XML document against the XSD. -122 * @throws Exception -123 */ -124 @Test -125 public void testGenerateXMLReport() throws Exception { -126 String templateName = "XmlReport"; -127 -128 File f = new File("target/test-reports"); -129 if (!f.exists()) { -130 f.mkdir(); -131 } -132 String writeTo = "target/test-reports/Report.xml"; -133 -134 File struts = new File(this.getClass().getClassLoader().getResource("struts2-core-2.1.2.jar").getPath()); -135 File axis = new File(this.getClass().getClassLoader().getResource("axis2-adb-1.4.1.jar").getPath()); -136 File jetty = new File(this.getClass().getClassLoader().getResource("org.mortbay.jetty.jar").getPath()); -137 -138 Engine engine = new Engine(); -139 engine.scan(struts); -140 engine.scan(axis); -141 engine.scan(jetty); -142 engine.analyzeDependencies(); -143 -144 ReportGenerator generator = new ReportGenerator("Test Report", engine.getDependencies(), engine.getAnalyzers()); -145 generator.generateReport(templateName, writeTo); -146 -147 InputStream xsdStream = ReportGenerator.class.getClassLoader().getResourceAsStream("schema/DependencyCheck.xsd"); -148 StreamSource xsdSource = new StreamSource(xsdStream); -149 StreamSource xmlSource = new StreamSource(new File(writeTo)); -150 SchemaFactory sf = SchemaFactory.newInstance(XMLConstants.W3C_XML_SCHEMA_NS_URI); -151 Schema schema = sf.newSchema(xsdSource); -152 Validator validator = schema.newValidator(); -153 validator.validate(xmlSource); -154 } -155 } +120 * Generates an XML report containing known vulnerabilities and realistic data and validates the generated XML +121 * document against the XSD. +122 * +123 * @throws Exception +124 */ +125 @Test +126 public void testGenerateXMLReport() throws Exception { +127 String templateName = "XmlReport"; +128 +129 File f = new File("target/test-reports"); +130 if (!f.exists()) { +131 f.mkdir(); +132 } +133 String writeTo = "target/test-reports/Report.xml"; +134 +135 File struts = new File(this.getClass().getClassLoader().getResource("struts2-core-2.1.2.jar").getPath()); +136 File axis = new File(this.getClass().getClassLoader().getResource("axis2-adb-1.4.1.jar").getPath()); +137 File jetty = new File(this.getClass().getClassLoader().getResource("org.mortbay.jetty.jar").getPath()); +138 +139 Engine engine = new Engine(); +140 engine.scan(struts); +141 engine.scan(axis); +142 engine.scan(jetty); +143 engine.analyzeDependencies(); +144 +145 CveDB cveDB = new CveDB(); +146 cveDB.open(); +147 DatabaseProperties dbProp = cveDB.getDatabaseProperties(); +148 cveDB.close(); +149 +150 ReportGenerator generator = new ReportGenerator("Test Report", engine.getDependencies(), engine.getAnalyzers(), dbProp); +151 generator.generateReport(templateName, writeTo); +152 +153 InputStream xsdStream = ReportGenerator.class.getClassLoader().getResourceAsStream("schema/DependencyCheck.xsd"); +154 StreamSource xsdSource = new StreamSource(xsdStream); +155 StreamSource xmlSource = new StreamSource(new File(writeTo)); +156 SchemaFactory sf = SchemaFactory.newInstance(XMLConstants.W3C_XML_SCHEMA_NS_URI); +157 Schema schema = sf.newSchema(xsdSource); +158 Validator validator = schema.newValidator(); +159 validator.validate(xmlSource); +160 } +161 }
    diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/reporting/package-frame.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/reporting/package-frame.html index 7a678e57d..19c18085b 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/reporting/package-frame.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/reporting/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.0.8 Reference Package org.owasp.dependencycheck.reporting + Dependency-Check Core 1.1.0 Reference Package org.owasp.dependencycheck.reporting diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/reporting/package-summary.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/reporting/package-summary.html index f258c08e5..855b5ed47 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/reporting/package-summary.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/reporting/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.0.8 Reference Package org.owasp.dependencycheck.reporting + Dependency-Check Core 1.1.0 Reference Package org.owasp.dependencycheck.reporting diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/suppression/PropertyTypeTest.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/suppression/PropertyTypeTest.html index 5afe695a0..9756e01e0 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/suppression/PropertyTypeTest.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/suppression/PropertyTypeTest.html @@ -9,111 +9,112 @@ 1 /* 2 * This file is part of dependency-check-core. 3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2013 Jeremy Long. All Rights Reserved. -18 */ -19 package org.owasp.dependencycheck.suppression; -20 -21 import org.junit.After; -22 import org.junit.AfterClass; -23 import org.junit.Before; -24 import org.junit.BeforeClass; -25 import org.junit.Test; -26 import static org.junit.Assert.*; -27 -28 /** -29 * -30 * @author Jeremy Long <jeremy.long@owasp.org> -31 */ -32 public class PropertyTypeTest { -33 -34 public PropertyTypeTest() { -35 } -36 -37 @BeforeClass -38 public static void setUpClass() { -39 } -40 -41 @AfterClass -42 public static void tearDownClass() { -43 } -44 -45 @Before -46 public void setUp() { -47 } -48 -49 @After -50 public void tearDown() { -51 } -52 -53 /** -54 * Test of set and getValue method, of class PropertyType. -55 */ -56 @Test -57 public void testSetGetValue() { -58 -59 PropertyType instance = new PropertyType(); -60 String expResult = "test"; -61 instance.setValue(expResult); -62 String result = instance.getValue(); -63 assertEquals(expResult, result); -64 } -65 -66 /** -67 * Test of isRegex method, of class PropertyType. -68 */ -69 @Test -70 public void testIsRegex() { -71 PropertyType instance = new PropertyType(); -72 boolean result = instance.isRegex(); -73 assertFalse(instance.isRegex()); -74 instance.setRegex(true); -75 assertTrue(instance.isRegex()); -76 } -77 -78 /** -79 * Test of isCaseSensitive method, of class PropertyType. -80 */ -81 @Test -82 public void testIsCaseSensitive() { -83 PropertyType instance = new PropertyType(); -84 assertFalse(instance.isCaseSensitive()); -85 instance.setCaseSensitive(true); -86 assertTrue(instance.isCaseSensitive()); -87 } -88 -89 /** -90 * Test of matches method, of class PropertyType. -91 */ -92 @Test -93 public void testMatches() { -94 String text = "Simple"; -95 -96 PropertyType instance = new PropertyType(); -97 instance.setValue("simple"); -98 assertTrue(instance.matches(text)); -99 instance.setCaseSensitive(true); -100 assertFalse(instance.matches(text)); -101 -102 instance.setValue("s.*le"); -103 instance.setRegex(true); -104 assertFalse(instance.matches(text)); -105 instance.setCaseSensitive(false); -106 assertTrue(instance.matches(text)); -107 } -108 } +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2013 Jeremy Long. All Rights Reserved. +17 */ +18 package org.owasp.dependencycheck.suppression; +19 +20 import org.junit.After; +21 import org.junit.AfterClass; +22 import static org.junit.Assert.assertEquals; +23 import static org.junit.Assert.assertFalse; +24 import static org.junit.Assert.assertTrue; +25 import org.junit.Before; +26 import org.junit.BeforeClass; +27 import org.junit.Test; +28 +29 /** +30 * +31 * @author Jeremy Long <jeremy.long@owasp.org> +32 */ +33 public class PropertyTypeTest { +34 +35 public PropertyTypeTest() { +36 } +37 +38 @BeforeClass +39 public static void setUpClass() { +40 } +41 +42 @AfterClass +43 public static void tearDownClass() { +44 } +45 +46 @Before +47 public void setUp() { +48 } +49 +50 @After +51 public void tearDown() { +52 } +53 +54 /** +55 * Test of set and getValue method, of class PropertyType. +56 */ +57 @Test +58 public void testSetGetValue() { +59 +60 PropertyType instance = new PropertyType(); +61 String expResult = "test"; +62 instance.setValue(expResult); +63 String result = instance.getValue(); +64 assertEquals(expResult, result); +65 } +66 +67 /** +68 * Test of isRegex method, of class PropertyType. +69 */ +70 @Test +71 public void testIsRegex() { +72 PropertyType instance = new PropertyType(); +73 boolean result = instance.isRegex(); +74 assertFalse(instance.isRegex()); +75 instance.setRegex(true); +76 assertTrue(instance.isRegex()); +77 } +78 +79 /** +80 * Test of isCaseSensitive method, of class PropertyType. +81 */ +82 @Test +83 public void testIsCaseSensitive() { +84 PropertyType instance = new PropertyType(); +85 assertFalse(instance.isCaseSensitive()); +86 instance.setCaseSensitive(true); +87 assertTrue(instance.isCaseSensitive()); +88 } +89 +90 /** +91 * Test of matches method, of class PropertyType. +92 */ +93 @Test +94 public void testMatches() { +95 String text = "Simple"; +96 +97 PropertyType instance = new PropertyType(); +98 instance.setValue("simple"); +99 assertTrue(instance.matches(text)); +100 instance.setCaseSensitive(true); +101 assertFalse(instance.matches(text)); +102 +103 instance.setValue("s.*le"); +104 instance.setRegex(true); +105 assertFalse(instance.matches(text)); +106 instance.setCaseSensitive(false); +107 assertTrue(instance.matches(text)); +108 } +109 }
    diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/suppression/SuppressionHandlerTest.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/suppression/SuppressionHandlerTest.html index 8f452fd39..6945c84e7 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/suppression/SuppressionHandlerTest.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/suppression/SuppressionHandlerTest.html @@ -9,98 +9,97 @@ 1 /* 2 * This file is part of dependency-check-core. 3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2013 Jeremy Long. All Rights Reserved. -18 */ -19 package org.owasp.dependencycheck.suppression; -20 -21 import java.io.File; -22 import java.io.FileInputStream; -23 import java.io.InputStream; -24 import java.io.InputStreamReader; -25 import java.io.Reader; -26 import java.util.List; -27 import javax.xml.parsers.SAXParser; -28 import javax.xml.parsers.SAXParserFactory; -29 import org.junit.After; -30 import org.junit.AfterClass; -31 import static org.junit.Assert.assertTrue; -32 import org.junit.Before; -33 import org.junit.BeforeClass; -34 import org.junit.Test; -35 import org.xml.sax.InputSource; -36 import org.xml.sax.XMLReader; -37 -38 /** -39 * -40 * @author Jeremy Long <jeremy.long@owasp.org> -41 */ -42 public class SuppressionHandlerTest { -43 -44 public SuppressionHandlerTest() { -45 } -46 -47 @BeforeClass -48 public static void setUpClass() { -49 } -50 -51 @AfterClass -52 public static void tearDownClass() { -53 } -54 -55 @Before -56 public void setUp() { -57 } -58 -59 @After -60 public void tearDown() { -61 } -62 -63 /** -64 * Test of getSuppressionRules method, of class SuppressionHandler. -65 * -66 * @throws Exception thrown if there is an exception.... -67 */ -68 @Test -69 public void testHandler() throws Exception { -70 File file = new File(this.getClass().getClassLoader().getResource("suppressions.xml").getPath()); -71 -72 File schema = new File(this.getClass().getClassLoader().getResource("schema/suppression.xsd").getPath()); -73 SuppressionHandler handler = new SuppressionHandler(); -74 -75 SAXParserFactory factory = SAXParserFactory.newInstance(); -76 factory.setNamespaceAware(true); -77 factory.setValidating(true); -78 SAXParser saxParser = factory.newSAXParser(); -79 saxParser.setProperty(SuppressionParser.JAXP_SCHEMA_LANGUAGE, SuppressionParser.W3C_XML_SCHEMA); -80 saxParser.setProperty(SuppressionParser.JAXP_SCHEMA_SOURCE, schema); -81 XMLReader xmlReader = saxParser.getXMLReader(); -82 xmlReader.setErrorHandler(new SuppressionErrorHandler()); -83 xmlReader.setContentHandler(handler); -84 -85 InputStream inputStream = new FileInputStream(file); -86 Reader reader = new InputStreamReader(inputStream, "UTF-8"); -87 InputSource in = new InputSource(reader); -88 //in.setEncoding("UTF-8"); -89 -90 xmlReader.parse(in); -91 -92 List result = handler.getSuppressionRules(); -93 assertTrue(result.size() > 3); -94 } -95 } +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2013 Jeremy Long. All Rights Reserved. +17 */ +18 package org.owasp.dependencycheck.suppression; +19 +20 import java.io.File; +21 import java.io.FileInputStream; +22 import java.io.InputStream; +23 import java.io.InputStreamReader; +24 import java.io.Reader; +25 import java.util.List; +26 import javax.xml.parsers.SAXParser; +27 import javax.xml.parsers.SAXParserFactory; +28 import org.junit.After; +29 import org.junit.AfterClass; +30 import static org.junit.Assert.assertTrue; +31 import org.junit.Before; +32 import org.junit.BeforeClass; +33 import org.junit.Test; +34 import org.xml.sax.InputSource; +35 import org.xml.sax.XMLReader; +36 +37 /** +38 * +39 * @author Jeremy Long <jeremy.long@owasp.org> +40 */ +41 public class SuppressionHandlerTest { +42 +43 public SuppressionHandlerTest() { +44 } +45 +46 @BeforeClass +47 public static void setUpClass() { +48 } +49 +50 @AfterClass +51 public static void tearDownClass() { +52 } +53 +54 @Before +55 public void setUp() { +56 } +57 +58 @After +59 public void tearDown() { +60 } +61 +62 /** +63 * Test of getSuppressionRules method, of class SuppressionHandler. +64 * +65 * @throws Exception thrown if there is an exception.... +66 */ +67 @Test +68 public void testHandler() throws Exception { +69 File file = new File(this.getClass().getClassLoader().getResource("suppressions.xml").getPath()); +70 +71 File schema = new File(this.getClass().getClassLoader().getResource("schema/suppression.xsd").getPath()); +72 SuppressionHandler handler = new SuppressionHandler(); +73 +74 SAXParserFactory factory = SAXParserFactory.newInstance(); +75 factory.setNamespaceAware(true); +76 factory.setValidating(true); +77 SAXParser saxParser = factory.newSAXParser(); +78 saxParser.setProperty(SuppressionParser.JAXP_SCHEMA_LANGUAGE, SuppressionParser.W3C_XML_SCHEMA); +79 saxParser.setProperty(SuppressionParser.JAXP_SCHEMA_SOURCE, schema); +80 XMLReader xmlReader = saxParser.getXMLReader(); +81 xmlReader.setErrorHandler(new SuppressionErrorHandler()); +82 xmlReader.setContentHandler(handler); +83 +84 InputStream inputStream = new FileInputStream(file); +85 Reader reader = new InputStreamReader(inputStream, "UTF-8"); +86 InputSource in = new InputSource(reader); +87 //in.setEncoding("UTF-8"); +88 +89 xmlReader.parse(in); +90 +91 List result = handler.getSuppressionRules(); +92 assertTrue(result.size() > 3); +93 } +94 }
    diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/suppression/SuppressionParserTest.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/suppression/SuppressionParserTest.html index 81f41bcb8..273b6ebd8 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/suppression/SuppressionParserTest.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/suppression/SuppressionParserTest.html @@ -9,69 +9,68 @@ 1 /* 2 * This file is part of dependency-check-core. 3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2013 Jeremy Long. All Rights Reserved. -18 */ -19 package org.owasp.dependencycheck.suppression; -20 -21 import java.io.File; -22 import java.util.List; -23 import org.junit.After; -24 import org.junit.AfterClass; +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2013 Jeremy Long. All Rights Reserved. +17 */ +18 package org.owasp.dependencycheck.suppression; +19 +20 import java.io.File; +21 import java.util.List; +22 import org.junit.After; +23 import org.junit.AfterClass; +24 import static org.junit.Assert.assertTrue; 25 import org.junit.Before; 26 import org.junit.BeforeClass; 27 import org.junit.Test; -28 import static org.junit.Assert.*; -29 -30 /** -31 * Test of the suppression parser. -32 * -33 * @author Jeremy Long <jeremy.long@owasp.org> -34 */ -35 public class SuppressionParserTest { -36 -37 public SuppressionParserTest() { -38 } -39 -40 @BeforeClass -41 public static void setUpClass() { -42 } -43 -44 @AfterClass -45 public static void tearDownClass() { -46 } -47 -48 @Before -49 public void setUp() { -50 } -51 -52 @After -53 public void tearDown() { -54 } -55 -56 /** -57 * Test of parseSuppressionRules method, of class SuppressionParser. -58 */ -59 @Test -60 public void testParseSuppressionRules() throws Exception { -61 File file = new File(this.getClass().getClassLoader().getResource("suppressions.xml").getPath()); -62 SuppressionParser instance = new SuppressionParser(); -63 List result = instance.parseSuppressionRules(file); -64 assertTrue(result.size() > 3); -65 } -66 } +28 +29 /** +30 * Test of the suppression parser. +31 * +32 * @author Jeremy Long <jeremy.long@owasp.org> +33 */ +34 public class SuppressionParserTest { +35 +36 public SuppressionParserTest() { +37 } +38 +39 @BeforeClass +40 public static void setUpClass() { +41 } +42 +43 @AfterClass +44 public static void tearDownClass() { +45 } +46 +47 @Before +48 public void setUp() { +49 } +50 +51 @After +52 public void tearDown() { +53 } +54 +55 /** +56 * Test of parseSuppressionRules method, of class SuppressionParser. +57 */ +58 @Test +59 public void testParseSuppressionRules() throws Exception { +60 File file = new File(this.getClass().getClassLoader().getResource("suppressions.xml").getPath()); +61 SuppressionParser instance = new SuppressionParser(); +62 List result = instance.parseSuppressionRules(file); +63 assertTrue(result.size() > 3); +64 } +65 }
    diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/suppression/SuppressionRuleTest.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/suppression/SuppressionRuleTest.html index ed6afc8f4..77379b716 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/suppression/SuppressionRuleTest.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/suppression/SuppressionRuleTest.html @@ -9,474 +9,475 @@ 1 /* 2 * This file is part of dependency-check-core. 3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2013 Jeremy Long. All Rights Reserved. -18 */ -19 package org.owasp.dependencycheck.suppression; -20 -21 import java.io.File; -22 import java.util.ArrayList; -23 import java.util.List; -24 import org.junit.After; -25 import org.junit.AfterClass; -26 import org.junit.Before; -27 import org.junit.BeforeClass; -28 import org.junit.Test; -29 import static org.junit.Assert.*; -30 import org.owasp.dependencycheck.dependency.Dependency; -31 import org.owasp.dependencycheck.dependency.Identifier; -32 import org.owasp.dependencycheck.dependency.Vulnerability; -33 -34 /** -35 * Test of the suppression rule. -36 * -37 * @author Jeremy Long <jeremy.long@owasp.org> -38 */ -39 public class SuppressionRuleTest { -40 -41 public SuppressionRuleTest() { -42 } -43 -44 @BeforeClass -45 public static void setUpClass() { -46 } -47 -48 @AfterClass -49 public static void tearDownClass() { -50 } -51 -52 @Before -53 public void setUp() { -54 } -55 -56 @After -57 public void tearDown() { -58 } -59 -60 //<editor-fold defaultstate="collapsed" desc="Stupid tests of properties"> -61 /** -62 * Test of FilePath property, of class SuppressionRule. -63 */ -64 @Test -65 public void testFilePath() { -66 SuppressionRule instance = new SuppressionRule(); -67 PropertyType expResult = new PropertyType(); -68 expResult.setValue("test"); -69 instance.setFilePath(expResult); -70 PropertyType result = instance.getFilePath(); -71 assertEquals(expResult, result); -72 } -73 -74 /** -75 * Test of Sha1 property, of class SuppressionRule. -76 */ -77 @Test -78 public void testSha1() { -79 SuppressionRule instance = new SuppressionRule(); -80 String expResult = "384FAA82E193D4E4B0546059CA09572654BC3970"; -81 instance.setSha1(expResult); -82 String result = instance.getSha1(); -83 assertEquals(expResult, result); -84 } -85 -86 /** -87 * Test of Cpe property, of class SuppressionRule. -88 */ -89 @Test -90 public void testCpe() { -91 SuppressionRule instance = new SuppressionRule(); -92 ArrayList<PropertyType> cpe = new ArrayList<PropertyType>(); -93 instance.setCpe(cpe); -94 assertFalse(instance.hasCpe()); -95 PropertyType pt = new PropertyType(); -96 pt.setValue("one"); -97 instance.addCpe(pt); -98 assertTrue(instance.hasCpe()); -99 List<PropertyType> result = instance.getCpe(); -100 assertEquals(cpe, result); -101 -102 } -103 -104 /** -105 * Test of CvssBelow property, of class SuppressionRule. -106 */ -107 @Test -108 public void testGetCvssBelow() { -109 SuppressionRule instance = new SuppressionRule(); -110 ArrayList<Float> cvss = new ArrayList<Float>(); -111 instance.setCvssBelow(cvss); -112 assertFalse(instance.hasCvssBelow()); -113 instance.addCvssBelow(0.7f); -114 assertTrue(instance.hasCvssBelow()); -115 List<Float> result = instance.getCvssBelow(); -116 assertEquals(cvss, result); -117 } -118 -119 /** -120 * Test of Cwe property, of class SuppressionRule. -121 */ -122 @Test -123 public void testCwe() { -124 SuppressionRule instance = new SuppressionRule(); -125 ArrayList<String> cwe = new ArrayList<String>(); -126 instance.setCwe(cwe); -127 assertFalse(instance.hasCwe()); -128 instance.addCwe("2"); -129 assertTrue(instance.hasCwe()); -130 List<String> result = instance.getCwe(); -131 assertEquals(cwe, result); -132 } -133 -134 /** -135 * Test of Cve property, of class SuppressionRule. -136 */ -137 @Test -138 public void testCve() { -139 SuppressionRule instance = new SuppressionRule(); -140 ArrayList<String> cve = new ArrayList<String>(); -141 instance.setCve(cve); -142 assertFalse(instance.hasCve()); -143 instance.addCve("CVE-2013-1337"); -144 assertTrue(instance.hasCve()); -145 List<String> result = instance.getCve(); -146 assertEquals(cve, result); -147 } -148 //</editor-fold> -149 -150 //<editor-fold defaultstate="collapsed" desc="Ignored duplicate tests, left in, as empty tests, so IDE doesn't re-generate them"> -151 /** -152 * Test of getFilePath method, of class SuppressionRule. -153 */ -154 @Test -155 public void testGetFilePath() { -156 //already tested, this is just left so the IDE doesn't recreate it. -157 } -158 -159 /** -160 * Test of setFilePath method, of class SuppressionRule. -161 */ -162 @Test -163 public void testSetFilePath() { -164 //already tested, this is just left so the IDE doesn't recreate it. -165 } -166 -167 /** -168 * Test of getSha1 method, of class SuppressionRule. -169 */ -170 @Test -171 public void testGetSha1() { -172 //already tested, this is just left so the IDE doesn't recreate it. -173 } -174 -175 /** -176 * Test of setSha1 method, of class SuppressionRule. -177 */ -178 @Test -179 public void testSetSha1() { -180 //already tested, this is just left so the IDE doesn't recreate it. -181 } -182 -183 /** -184 * Test of getCpe method, of class SuppressionRule. -185 */ -186 @Test -187 public void testGetCpe() { -188 //already tested, this is just left so the IDE doesn't recreate it. -189 } -190 -191 /** -192 * Test of setCpe method, of class SuppressionRule. -193 */ -194 @Test -195 public void testSetCpe() { -196 //already tested, this is just left so the IDE doesn't recreate it. -197 } -198 -199 /** -200 * Test of addCpe method, of class SuppressionRule. -201 */ -202 @Test -203 public void testAddCpe() { -204 //already tested, this is just left so the IDE doesn't recreate it. -205 } -206 -207 /** -208 * Test of hasCpe method, of class SuppressionRule. -209 */ -210 @Test -211 public void testHasCpe() { -212 //already tested, this is just left so the IDE doesn't recreate it. -213 } -214 -215 /** -216 * Test of setCvssBelow method, of class SuppressionRule. -217 */ -218 @Test -219 public void testSetCvssBelow() { -220 //already tested, this is just left so the IDE doesn't recreate it. -221 } -222 -223 /** -224 * Test of addCvssBelow method, of class SuppressionRule. -225 */ -226 @Test -227 public void testAddCvssBelow() { -228 //already tested, this is just left so the IDE doesn't recreate it. -229 } -230 -231 /** -232 * Test of hasCvssBelow method, of class SuppressionRule. -233 */ -234 @Test -235 public void testHasCvssBelow() { -236 //already tested, this is just left so the IDE doesn't recreate it. -237 } -238 -239 /** -240 * Test of getCwe method, of class SuppressionRule. -241 */ -242 @Test -243 public void testGetCwe() { -244 //already tested, this is just left so the IDE doesn't recreate it. -245 } -246 -247 /** -248 * Test of setCwe method, of class SuppressionRule. -249 */ -250 @Test -251 public void testSetCwe() { -252 //already tested, this is just left so the IDE doesn't recreate it. -253 } -254 -255 /** -256 * Test of addCwe method, of class SuppressionRule. -257 */ -258 @Test -259 public void testAddCwe() { -260 //already tested, this is just left so the IDE doesn't recreate it. -261 } -262 -263 /** -264 * Test of hasCwe method, of class SuppressionRule. -265 */ -266 @Test -267 public void testHasCwe() { -268 //already tested, this is just left so the IDE doesn't recreate it. -269 } -270 -271 /** -272 * Test of getCve method, of class SuppressionRule. -273 */ -274 @Test -275 public void testGetCve() { -276 //already tested, this is just left so the IDE doesn't recreate it. -277 } -278 -279 /** -280 * Test of setCve method, of class SuppressionRule. -281 */ -282 @Test -283 public void testSetCve() { -284 //already tested, this is just left so the IDE doesn't recreate it. -285 } -286 -287 /** -288 * Test of addCve method, of class SuppressionRule. -289 */ -290 @Test -291 public void testAddCve() { -292 //already tested, this is just left so the IDE doesn't recreate it. -293 } -294 -295 /** -296 * Test of hasCve method, of class SuppressionRule. -297 */ -298 @Test -299 public void testHasCve() { -300 //already tested, this is just left so the IDE doesn't recreate it. -301 } -302 //</editor-fold> -303 -304 /** -305 * Test of cpeHasNoVersion method, of class SuppressionRule. -306 */ -307 @Test -308 public void testCpeHasNoVersion() { -309 PropertyType c = new PropertyType(); -310 c.setValue("cpe:/a:microsoft:.net_framework:4.5"); -311 SuppressionRule instance = new SuppressionRule(); -312 assertFalse(instance.cpeHasNoVersion(c)); -313 c.setValue("cpe:/a:microsoft:.net_framework:"); -314 assertFalse(instance.cpeHasNoVersion(c)); -315 c.setValue("cpe:/a:microsoft:.net_framework"); -316 assertTrue(instance.cpeHasNoVersion(c)); -317 } -318 -319 /** -320 * Test of countCharacter method, of class SuppressionRule. -321 */ -322 @Test -323 public void testCountCharacter() { -324 String str = "cpe:/a:microsoft:.net_framework:4.5"; -325 char c = ':'; -326 SuppressionRule instance = new SuppressionRule(); -327 int expResult = 4; -328 int result = instance.countCharacter(str, c); -329 assertEquals(expResult, result); -330 str = "::"; -331 expResult = 2; -332 result = instance.countCharacter(str, c); -333 assertEquals(expResult, result); -334 str = "these are not the characters you are looking for"; -335 expResult = 0; -336 result = instance.countCharacter(str, c); -337 assertEquals(expResult, result); -338 } -339 -340 /** -341 * Test of cpeMatches method, of class SuppressionRule. -342 */ -343 @Test -344 public void testCpeMatches() { -345 Identifier identifier = new Identifier("cwe", "cpe:/a:microsoft:.net_framework:4.5", "some url not needed for this test"); -346 -347 PropertyType cpe = new PropertyType(); -348 cpe.setValue("cpe:/a:microsoft:.net_framework:4.5"); -349 -350 SuppressionRule instance = new SuppressionRule(); -351 boolean expResult = true; -352 boolean result = instance.cpeMatches(cpe, identifier); -353 assertEquals(expResult, result); -354 -355 cpe.setValue("cpe:/a:microsoft:.net_framework:4.0"); -356 expResult = false; -357 result = instance.cpeMatches(cpe, identifier); -358 assertEquals(expResult, result); -359 -360 cpe.setValue("CPE:/a:microsoft:.net_framework:4.5"); -361 cpe.setCaseSensitive(true); -362 expResult = false; -363 result = instance.cpeMatches(cpe, identifier); -364 assertEquals(expResult, result); -365 -366 cpe.setValue("cpe:/a:microsoft:.net_framework"); -367 cpe.setCaseSensitive(false); -368 expResult = true; -369 result = instance.cpeMatches(cpe, identifier); -370 assertEquals(expResult, result); -371 -372 cpe.setValue("cpe:/a:microsoft:.*"); -373 cpe.setRegex(true); -374 expResult = true; -375 result = instance.cpeMatches(cpe, identifier); -376 assertEquals(expResult, result); -377 -378 cpe.setValue("CPE:/a:microsoft:.*"); -379 cpe.setRegex(true); -380 cpe.setCaseSensitive(true); -381 expResult = false; -382 result = instance.cpeMatches(cpe, identifier); -383 assertEquals(expResult, result); -384 -385 cpe.setValue("cpe:/a:apache:.*"); -386 cpe.setRegex(true); -387 cpe.setCaseSensitive(false); -388 expResult = false; -389 result = instance.cpeMatches(cpe, identifier); -390 assertEquals(expResult, result); -391 } -392 -393 /** -394 * Test of process method, of class SuppressionRule. -395 */ -396 @Test -397 public void testProcess() { -398 File struts = new File(this.getClass().getClassLoader().getResource("struts2-core-2.1.2.jar").getPath()); -399 Dependency dependency = new Dependency(struts); -400 dependency.addIdentifier("cwe", "cpe:/a:microsoft:.net_framework:4.5", "some url not needed for this test"); -401 String sha1 = dependency.getSha1sum(); -402 dependency.setSha1sum("384FAA82E193D4E4B0546059CA09572654BC3970"); -403 Vulnerability v = createVulnerability(); -404 dependency.addVulnerability(v); -405 -406 //cwe -407 SuppressionRule instance = new SuppressionRule(); -408 instance.setSha1(sha1); -409 instance.addCwe("287"); -410 instance.process(dependency); -411 assertTrue(dependency.getVulnerabilities().size() == 1); -412 dependency.setSha1sum(sha1); -413 instance.process(dependency); -414 assertTrue(dependency.getVulnerabilities().isEmpty()); -415 -416 //cvss -417 dependency.addVulnerability(v); -418 instance = new SuppressionRule(); -419 instance.addCvssBelow(5f); -420 instance.process(dependency); -421 assertTrue(dependency.getVulnerabilities().size() == 1); -422 instance.addCvssBelow(8f); -423 instance.process(dependency); -424 assertTrue(dependency.getVulnerabilities().isEmpty()); -425 -426 //cve -427 dependency.addVulnerability(v); -428 instance = new SuppressionRule(); -429 instance.addCve("CVE-2012-1337"); -430 instance.process(dependency); -431 assertTrue(dependency.getVulnerabilities().size() == 1); -432 instance.addCve("CVE-2013-1337"); -433 instance.process(dependency); -434 assertTrue(dependency.getVulnerabilities().isEmpty()); -435 -436 //cpe -437 instance = new SuppressionRule(); -438 PropertyType pt = new PropertyType(); -439 pt.setValue("cpe:/a:microsoft:.net_framework:4.0"); -440 instance.addCpe(pt); -441 instance.process(dependency); -442 assertTrue(dependency.getIdentifiers().size() == 1); -443 pt = new PropertyType(); -444 pt.setValue("cpe:/a:microsoft:.net_framework:4.5"); -445 instance.addCpe(pt); -446 pt = new PropertyType(); -447 pt.setValue(".*"); -448 pt.setRegex(true); -449 instance.setFilePath(pt); -450 instance.process(dependency); -451 assertTrue(dependency.getIdentifiers().isEmpty()); -452 -453 dependency.addIdentifier("cwe", "cpe:/a:microsoft:.net_framework:4.0", "some url not needed for this test"); -454 dependency.addIdentifier("cwe", "cpe:/a:microsoft:.net_framework:4.5", "some url not needed for this test"); -455 dependency.addIdentifier("cwe", "cpe:/a:microsoft:.net_framework:5.0", "some url not needed for this test"); -456 pt = new PropertyType(); -457 pt.setValue("cpe:/a:microsoft:.net_framework"); -458 instance.addCpe(pt); -459 assertTrue(dependency.getIdentifiers().size() == 3); -460 instance.process(dependency); -461 assertTrue(dependency.getIdentifiers().isEmpty()); -462 } -463 -464 private Vulnerability createVulnerability() { -465 Vulnerability v = new Vulnerability(); -466 v.setCwe("CWE-287 Improper Authentication"); -467 v.setName("CVE-2013-1337"); -468 v.setCvssScore(7.5f); -469 return v; -470 } -471 } +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2013 Jeremy Long. All Rights Reserved. +17 */ +18 package org.owasp.dependencycheck.suppression; +19 +20 import java.io.File; +21 import java.util.ArrayList; +22 import java.util.List; +23 import org.junit.After; +24 import org.junit.AfterClass; +25 import static org.junit.Assert.assertEquals; +26 import static org.junit.Assert.assertFalse; +27 import static org.junit.Assert.assertTrue; +28 import org.junit.Before; +29 import org.junit.BeforeClass; +30 import org.junit.Test; +31 import org.owasp.dependencycheck.dependency.Dependency; +32 import org.owasp.dependencycheck.dependency.Identifier; +33 import org.owasp.dependencycheck.dependency.Vulnerability; +34 +35 /** +36 * Test of the suppression rule. +37 * +38 * @author Jeremy Long <jeremy.long@owasp.org> +39 */ +40 public class SuppressionRuleTest { +41 +42 public SuppressionRuleTest() { +43 } +44 +45 @BeforeClass +46 public static void setUpClass() { +47 } +48 +49 @AfterClass +50 public static void tearDownClass() { +51 } +52 +53 @Before +54 public void setUp() { +55 } +56 +57 @After +58 public void tearDown() { +59 } +60 +61 //<editor-fold defaultstate="collapsed" desc="Stupid tests of properties"> +62 /** +63 * Test of FilePath property, of class SuppressionRule. +64 */ +65 @Test +66 public void testFilePath() { +67 SuppressionRule instance = new SuppressionRule(); +68 PropertyType expResult = new PropertyType(); +69 expResult.setValue("test"); +70 instance.setFilePath(expResult); +71 PropertyType result = instance.getFilePath(); +72 assertEquals(expResult, result); +73 } +74 +75 /** +76 * Test of Sha1 property, of class SuppressionRule. +77 */ +78 @Test +79 public void testSha1() { +80 SuppressionRule instance = new SuppressionRule(); +81 String expResult = "384FAA82E193D4E4B0546059CA09572654BC3970"; +82 instance.setSha1(expResult); +83 String result = instance.getSha1(); +84 assertEquals(expResult, result); +85 } +86 +87 /** +88 * Test of Cpe property, of class SuppressionRule. +89 */ +90 @Test +91 public void testCpe() { +92 SuppressionRule instance = new SuppressionRule(); +93 ArrayList<PropertyType> cpe = new ArrayList<PropertyType>(); +94 instance.setCpe(cpe); +95 assertFalse(instance.hasCpe()); +96 PropertyType pt = new PropertyType(); +97 pt.setValue("one"); +98 instance.addCpe(pt); +99 assertTrue(instance.hasCpe()); +100 List<PropertyType> result = instance.getCpe(); +101 assertEquals(cpe, result); +102 +103 } +104 +105 /** +106 * Test of CvssBelow property, of class SuppressionRule. +107 */ +108 @Test +109 public void testGetCvssBelow() { +110 SuppressionRule instance = new SuppressionRule(); +111 ArrayList<Float> cvss = new ArrayList<Float>(); +112 instance.setCvssBelow(cvss); +113 assertFalse(instance.hasCvssBelow()); +114 instance.addCvssBelow(0.7f); +115 assertTrue(instance.hasCvssBelow()); +116 List<Float> result = instance.getCvssBelow(); +117 assertEquals(cvss, result); +118 } +119 +120 /** +121 * Test of Cwe property, of class SuppressionRule. +122 */ +123 @Test +124 public void testCwe() { +125 SuppressionRule instance = new SuppressionRule(); +126 ArrayList<String> cwe = new ArrayList<String>(); +127 instance.setCwe(cwe); +128 assertFalse(instance.hasCwe()); +129 instance.addCwe("2"); +130 assertTrue(instance.hasCwe()); +131 List<String> result = instance.getCwe(); +132 assertEquals(cwe, result); +133 } +134 +135 /** +136 * Test of Cve property, of class SuppressionRule. +137 */ +138 @Test +139 public void testCve() { +140 SuppressionRule instance = new SuppressionRule(); +141 ArrayList<String> cve = new ArrayList<String>(); +142 instance.setCve(cve); +143 assertFalse(instance.hasCve()); +144 instance.addCve("CVE-2013-1337"); +145 assertTrue(instance.hasCve()); +146 List<String> result = instance.getCve(); +147 assertEquals(cve, result); +148 } +149 //</editor-fold> +150 +151 //<editor-fold defaultstate="collapsed" desc="Ignored duplicate tests, left in, as empty tests, so IDE doesn't re-generate them"> +152 /** +153 * Test of getFilePath method, of class SuppressionRule. +154 */ +155 @Test +156 public void testGetFilePath() { +157 //already tested, this is just left so the IDE doesn't recreate it. +158 } +159 +160 /** +161 * Test of setFilePath method, of class SuppressionRule. +162 */ +163 @Test +164 public void testSetFilePath() { +165 //already tested, this is just left so the IDE doesn't recreate it. +166 } +167 +168 /** +169 * Test of getSha1 method, of class SuppressionRule. +170 */ +171 @Test +172 public void testGetSha1() { +173 //already tested, this is just left so the IDE doesn't recreate it. +174 } +175 +176 /** +177 * Test of setSha1 method, of class SuppressionRule. +178 */ +179 @Test +180 public void testSetSha1() { +181 //already tested, this is just left so the IDE doesn't recreate it. +182 } +183 +184 /** +185 * Test of getCpe method, of class SuppressionRule. +186 */ +187 @Test +188 public void testGetCpe() { +189 //already tested, this is just left so the IDE doesn't recreate it. +190 } +191 +192 /** +193 * Test of setCpe method, of class SuppressionRule. +194 */ +195 @Test +196 public void testSetCpe() { +197 //already tested, this is just left so the IDE doesn't recreate it. +198 } +199 +200 /** +201 * Test of addCpe method, of class SuppressionRule. +202 */ +203 @Test +204 public void testAddCpe() { +205 //already tested, this is just left so the IDE doesn't recreate it. +206 } +207 +208 /** +209 * Test of hasCpe method, of class SuppressionRule. +210 */ +211 @Test +212 public void testHasCpe() { +213 //already tested, this is just left so the IDE doesn't recreate it. +214 } +215 +216 /** +217 * Test of setCvssBelow method, of class SuppressionRule. +218 */ +219 @Test +220 public void testSetCvssBelow() { +221 //already tested, this is just left so the IDE doesn't recreate it. +222 } +223 +224 /** +225 * Test of addCvssBelow method, of class SuppressionRule. +226 */ +227 @Test +228 public void testAddCvssBelow() { +229 //already tested, this is just left so the IDE doesn't recreate it. +230 } +231 +232 /** +233 * Test of hasCvssBelow method, of class SuppressionRule. +234 */ +235 @Test +236 public void testHasCvssBelow() { +237 //already tested, this is just left so the IDE doesn't recreate it. +238 } +239 +240 /** +241 * Test of getCwe method, of class SuppressionRule. +242 */ +243 @Test +244 public void testGetCwe() { +245 //already tested, this is just left so the IDE doesn't recreate it. +246 } +247 +248 /** +249 * Test of setCwe method, of class SuppressionRule. +250 */ +251 @Test +252 public void testSetCwe() { +253 //already tested, this is just left so the IDE doesn't recreate it. +254 } +255 +256 /** +257 * Test of addCwe method, of class SuppressionRule. +258 */ +259 @Test +260 public void testAddCwe() { +261 //already tested, this is just left so the IDE doesn't recreate it. +262 } +263 +264 /** +265 * Test of hasCwe method, of class SuppressionRule. +266 */ +267 @Test +268 public void testHasCwe() { +269 //already tested, this is just left so the IDE doesn't recreate it. +270 } +271 +272 /** +273 * Test of getCve method, of class SuppressionRule. +274 */ +275 @Test +276 public void testGetCve() { +277 //already tested, this is just left so the IDE doesn't recreate it. +278 } +279 +280 /** +281 * Test of setCve method, of class SuppressionRule. +282 */ +283 @Test +284 public void testSetCve() { +285 //already tested, this is just left so the IDE doesn't recreate it. +286 } +287 +288 /** +289 * Test of addCve method, of class SuppressionRule. +290 */ +291 @Test +292 public void testAddCve() { +293 //already tested, this is just left so the IDE doesn't recreate it. +294 } +295 +296 /** +297 * Test of hasCve method, of class SuppressionRule. +298 */ +299 @Test +300 public void testHasCve() { +301 //already tested, this is just left so the IDE doesn't recreate it. +302 } +303 //</editor-fold> +304 +305 /** +306 * Test of cpeHasNoVersion method, of class SuppressionRule. +307 */ +308 @Test +309 public void testCpeHasNoVersion() { +310 PropertyType c = new PropertyType(); +311 c.setValue("cpe:/a:microsoft:.net_framework:4.5"); +312 SuppressionRule instance = new SuppressionRule(); +313 assertFalse(instance.cpeHasNoVersion(c)); +314 c.setValue("cpe:/a:microsoft:.net_framework:"); +315 assertFalse(instance.cpeHasNoVersion(c)); +316 c.setValue("cpe:/a:microsoft:.net_framework"); +317 assertTrue(instance.cpeHasNoVersion(c)); +318 } +319 +320 /** +321 * Test of countCharacter method, of class SuppressionRule. +322 */ +323 @Test +324 public void testCountCharacter() { +325 String str = "cpe:/a:microsoft:.net_framework:4.5"; +326 char c = ':'; +327 SuppressionRule instance = new SuppressionRule(); +328 int expResult = 4; +329 int result = instance.countCharacter(str, c); +330 assertEquals(expResult, result); +331 str = "::"; +332 expResult = 2; +333 result = instance.countCharacter(str, c); +334 assertEquals(expResult, result); +335 str = "these are not the characters you are looking for"; +336 expResult = 0; +337 result = instance.countCharacter(str, c); +338 assertEquals(expResult, result); +339 } +340 +341 /** +342 * Test of cpeMatches method, of class SuppressionRule. +343 */ +344 @Test +345 public void testCpeMatches() { +346 Identifier identifier = new Identifier("cwe", "cpe:/a:microsoft:.net_framework:4.5", "some url not needed for this test"); +347 +348 PropertyType cpe = new PropertyType(); +349 cpe.setValue("cpe:/a:microsoft:.net_framework:4.5"); +350 +351 SuppressionRule instance = new SuppressionRule(); +352 boolean expResult = true; +353 boolean result = instance.cpeMatches(cpe, identifier); +354 assertEquals(expResult, result); +355 +356 cpe.setValue("cpe:/a:microsoft:.net_framework:4.0"); +357 expResult = false; +358 result = instance.cpeMatches(cpe, identifier); +359 assertEquals(expResult, result); +360 +361 cpe.setValue("CPE:/a:microsoft:.net_framework:4.5"); +362 cpe.setCaseSensitive(true); +363 expResult = false; +364 result = instance.cpeMatches(cpe, identifier); +365 assertEquals(expResult, result); +366 +367 cpe.setValue("cpe:/a:microsoft:.net_framework"); +368 cpe.setCaseSensitive(false); +369 expResult = true; +370 result = instance.cpeMatches(cpe, identifier); +371 assertEquals(expResult, result); +372 +373 cpe.setValue("cpe:/a:microsoft:.*"); +374 cpe.setRegex(true); +375 expResult = true; +376 result = instance.cpeMatches(cpe, identifier); +377 assertEquals(expResult, result); +378 +379 cpe.setValue("CPE:/a:microsoft:.*"); +380 cpe.setRegex(true); +381 cpe.setCaseSensitive(true); +382 expResult = false; +383 result = instance.cpeMatches(cpe, identifier); +384 assertEquals(expResult, result); +385 +386 cpe.setValue("cpe:/a:apache:.*"); +387 cpe.setRegex(true); +388 cpe.setCaseSensitive(false); +389 expResult = false; +390 result = instance.cpeMatches(cpe, identifier); +391 assertEquals(expResult, result); +392 } +393 +394 /** +395 * Test of process method, of class SuppressionRule. +396 */ +397 @Test +398 public void testProcess() { +399 File struts = new File(this.getClass().getClassLoader().getResource("struts2-core-2.1.2.jar").getPath()); +400 Dependency dependency = new Dependency(struts); +401 dependency.addIdentifier("cwe", "cpe:/a:microsoft:.net_framework:4.5", "some url not needed for this test"); +402 String sha1 = dependency.getSha1sum(); +403 dependency.setSha1sum("384FAA82E193D4E4B0546059CA09572654BC3970"); +404 Vulnerability v = createVulnerability(); +405 dependency.addVulnerability(v); +406 +407 //cwe +408 SuppressionRule instance = new SuppressionRule(); +409 instance.setSha1(sha1); +410 instance.addCwe("287"); +411 instance.process(dependency); +412 assertTrue(dependency.getVulnerabilities().size() == 1); +413 dependency.setSha1sum(sha1); +414 instance.process(dependency); +415 assertTrue(dependency.getVulnerabilities().isEmpty()); +416 +417 //cvss +418 dependency.addVulnerability(v); +419 instance = new SuppressionRule(); +420 instance.addCvssBelow(5f); +421 instance.process(dependency); +422 assertTrue(dependency.getVulnerabilities().size() == 1); +423 instance.addCvssBelow(8f); +424 instance.process(dependency); +425 assertTrue(dependency.getVulnerabilities().isEmpty()); +426 +427 //cve +428 dependency.addVulnerability(v); +429 instance = new SuppressionRule(); +430 instance.addCve("CVE-2012-1337"); +431 instance.process(dependency); +432 assertTrue(dependency.getVulnerabilities().size() == 1); +433 instance.addCve("CVE-2013-1337"); +434 instance.process(dependency); +435 assertTrue(dependency.getVulnerabilities().isEmpty()); +436 +437 //cpe +438 instance = new SuppressionRule(); +439 PropertyType pt = new PropertyType(); +440 pt.setValue("cpe:/a:microsoft:.net_framework:4.0"); +441 instance.addCpe(pt); +442 instance.process(dependency); +443 assertTrue(dependency.getIdentifiers().size() == 1); +444 pt = new PropertyType(); +445 pt.setValue("cpe:/a:microsoft:.net_framework:4.5"); +446 instance.addCpe(pt); +447 pt = new PropertyType(); +448 pt.setValue(".*"); +449 pt.setRegex(true); +450 instance.setFilePath(pt); +451 instance.process(dependency); +452 assertTrue(dependency.getIdentifiers().isEmpty()); +453 +454 dependency.addIdentifier("cwe", "cpe:/a:microsoft:.net_framework:4.0", "some url not needed for this test"); +455 dependency.addIdentifier("cwe", "cpe:/a:microsoft:.net_framework:4.5", "some url not needed for this test"); +456 dependency.addIdentifier("cwe", "cpe:/a:microsoft:.net_framework:5.0", "some url not needed for this test"); +457 pt = new PropertyType(); +458 pt.setValue("cpe:/a:microsoft:.net_framework"); +459 instance.addCpe(pt); +460 assertTrue(dependency.getIdentifiers().size() == 3); +461 instance.process(dependency); +462 assertTrue(dependency.getIdentifiers().isEmpty()); +463 } +464 +465 private Vulnerability createVulnerability() { +466 Vulnerability v = new Vulnerability(); +467 v.setCwe("CWE-287 Improper Authentication"); +468 v.setName("CVE-2013-1337"); +469 v.setCvssScore(7.5f); +470 return v; +471 } +472 }
    diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/suppression/package-frame.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/suppression/package-frame.html index bf945aefc..05ef11d2a 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/suppression/package-frame.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/suppression/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.0.8 Reference Package org.owasp.dependencycheck.suppression + Dependency-Check Core 1.1.0 Reference Package org.owasp.dependencycheck.suppression diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/suppression/package-summary.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/suppression/package-summary.html index 24c42c04b..18eeefff8 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/suppression/package-summary.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/suppression/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.0.8 Reference Package org.owasp.dependencycheck.suppression + Dependency-Check Core 1.1.0 Reference Package org.owasp.dependencycheck.suppression diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/utils/ChecksumTest.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/utils/ChecksumTest.html index 9c77bf4fc..ee9bf4d03 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/utils/ChecksumTest.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/utils/ChecksumTest.html @@ -9,153 +9,151 @@ 1 /* 2 * This file is part of dependency-check-core. 3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. -18 */ -19 package org.owasp.dependencycheck.utils; -20 -21 import org.owasp.dependencycheck.utils.Checksum; -22 import java.io.File; -23 import java.io.IOException; -24 import java.security.NoSuchAlgorithmException; -25 import org.junit.After; -26 import org.junit.AfterClass; -27 import org.junit.Assert; -28 import org.junit.Before; -29 import org.junit.BeforeClass; -30 import org.junit.Test; -31 -32 /** -33 * -34 * @author Jeremy Long <jeremy.long@owasp.org> -35 */ -36 public class ChecksumTest { -37 -38 @BeforeClass -39 public static void setUpClass() throws Exception { -40 } -41 -42 @AfterClass -43 public static void tearDownClass() throws Exception { -44 } -45 -46 @Before -47 public void setUp() throws Exception { -48 } -49 -50 @After -51 public void tearDown() throws Exception { -52 } -53 -54 /** -55 * Test of getChecksum method, of class Checksum. -56 * -57 * @throws Exception thrown when an exception occurs. -58 */ -59 @Test -60 public void testGetChecksum() throws Exception { -61 String algorithm = "MD5"; -62 File file = new File(this.getClass().getClassLoader().getResource("checkSumTest.file").getPath()); -63 byte[] expResult = {-16, -111, 92, 95, 70, -72, -49, -94, -125, -27, -83, 103, -96, -101, 55, -109}; -64 byte[] result = Checksum.getChecksum(algorithm, file); -65 boolean arraysAreEqual = true; -66 if (expResult.length == result.length) { -67 for (int i = 0; arraysAreEqual && i < result.length; i++) { -68 arraysAreEqual = result[i] == expResult[i]; -69 } -70 } else { -71 Assert.fail("Checksum results do not match expected results."); -72 } -73 Assert.assertTrue(arraysAreEqual); -74 } -75 -76 /** -77 * Test of getChecksum method, of class Checksum. This checks that an -78 * exception is thrown when an invalid path is specified. -79 * -80 * @throws Exception is thrown when an exception occurs. -81 */ -82 @Test -83 public void testGetChecksum_FileNotFound() throws Exception { -84 String algorithm = "MD5"; -85 File file = new File("not a valid file"); -86 boolean exceptionThrown = false; -87 try { -88 byte[] result = Checksum.getChecksum(algorithm, file); -89 } catch (IOException ex) { -90 exceptionThrown = true; -91 } -92 Assert.assertTrue(exceptionThrown); -93 } -94 -95 /** -96 * Test of getChecksum method, of class Checksum. This checks that an -97 * exception is thrown when an invalid algorithm is specified. -98 * -99 * @throws Exception is thrown when an exception occurs. -100 */ -101 @Test -102 public void testGetChecksum_NoSuchAlgorithm() throws Exception { -103 String algorithm = "some unknown algorithm"; -104 File file = new File(this.getClass().getClassLoader().getResource("checkSumTest.file").getPath()); -105 boolean exceptionThrown = false; -106 try { -107 byte[] result = Checksum.getChecksum(algorithm, file); -108 } catch (NoSuchAlgorithmException ex) { -109 exceptionThrown = true; -110 } -111 Assert.assertTrue(exceptionThrown); -112 } -113 -114 /** -115 * Test of getMD5Checksum method, of class Checksum. -116 * -117 * @throws Exception is thrown when an exception occurs. -118 */ -119 @Test -120 public void testGetMD5Checksum() throws Exception { -121 File file = new File(this.getClass().getClassLoader().getResource("checkSumTest.file").getPath()); -122 String expResult = "F0915C5F46B8CFA283E5AD67A09B3793"; -123 String result = Checksum.getMD5Checksum(file); -124 Assert.assertEquals(expResult, result); -125 } -126 -127 /** -128 * Test of getSHA1Checksum method, of class Checksum. -129 * -130 * @throws Exception is thrown when an exception occurs. -131 */ -132 @Test -133 public void testGetSHA1Checksum() throws Exception { -134 File file = new File(this.getClass().getClassLoader().getResource("checkSumTest.file").getPath()); -135 String expResult = "B8A9FF28B21BCB1D0B50E24A5243D8B51766851A"; -136 String result = Checksum.getSHA1Checksum(file); -137 Assert.assertEquals(expResult, result); -138 } -139 -140 /** -141 * Test of getHex method, of class Checksum. -142 */ -143 @Test -144 public void testGetHex() { -145 byte[] raw = {0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16}; -146 String expResult = "000102030405060708090A0B0C0D0E0F10"; -147 String result = Checksum.getHex(raw); -148 Assert.assertEquals(expResult, result); -149 } -150 } +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. +17 */ +18 package org.owasp.dependencycheck.utils; +19 +20 import java.io.File; +21 import java.io.IOException; +22 import java.security.NoSuchAlgorithmException; +23 import org.junit.After; +24 import org.junit.AfterClass; +25 import org.junit.Assert; +26 import org.junit.Before; +27 import org.junit.BeforeClass; +28 import org.junit.Test; +29 +30 /** +31 * +32 * @author Jeremy Long <jeremy.long@owasp.org> +33 */ +34 public class ChecksumTest { +35 +36 @BeforeClass +37 public static void setUpClass() throws Exception { +38 } +39 +40 @AfterClass +41 public static void tearDownClass() throws Exception { +42 } +43 +44 @Before +45 public void setUp() throws Exception { +46 } +47 +48 @After +49 public void tearDown() throws Exception { +50 } +51 +52 /** +53 * Test of getChecksum method, of class Checksum. +54 * +55 * @throws Exception thrown when an exception occurs. +56 */ +57 @Test +58 public void testGetChecksum() throws Exception { +59 String algorithm = "MD5"; +60 File file = new File(this.getClass().getClassLoader().getResource("checkSumTest.file").getPath()); +61 byte[] expResult = {-16, -111, 92, 95, 70, -72, -49, -94, -125, -27, -83, 103, -96, -101, 55, -109}; +62 byte[] result = Checksum.getChecksum(algorithm, file); +63 boolean arraysAreEqual = true; +64 if (expResult.length == result.length) { +65 for (int i = 0; arraysAreEqual && i < result.length; i++) { +66 arraysAreEqual = result[i] == expResult[i]; +67 } +68 } else { +69 Assert.fail("Checksum results do not match expected results."); +70 } +71 Assert.assertTrue(arraysAreEqual); +72 } +73 +74 /** +75 * Test of getChecksum method, of class Checksum. This checks that an exception is thrown when an invalid path is +76 * specified. +77 * +78 * @throws Exception is thrown when an exception occurs. +79 */ +80 @Test +81 public void testGetChecksum_FileNotFound() throws Exception { +82 String algorithm = "MD5"; +83 File file = new File("not a valid file"); +84 boolean exceptionThrown = false; +85 try { +86 byte[] result = Checksum.getChecksum(algorithm, file); +87 } catch (IOException ex) { +88 exceptionThrown = true; +89 } +90 Assert.assertTrue(exceptionThrown); +91 } +92 +93 /** +94 * Test of getChecksum method, of class Checksum. This checks that an exception is thrown when an invalid algorithm +95 * is specified. +96 * +97 * @throws Exception is thrown when an exception occurs. +98 */ +99 @Test +100 public void testGetChecksum_NoSuchAlgorithm() throws Exception { +101 String algorithm = "some unknown algorithm"; +102 File file = new File(this.getClass().getClassLoader().getResource("checkSumTest.file").getPath()); +103 boolean exceptionThrown = false; +104 try { +105 byte[] result = Checksum.getChecksum(algorithm, file); +106 } catch (NoSuchAlgorithmException ex) { +107 exceptionThrown = true; +108 } +109 Assert.assertTrue(exceptionThrown); +110 } +111 +112 /** +113 * Test of getMD5Checksum method, of class Checksum. +114 * +115 * @throws Exception is thrown when an exception occurs. +116 */ +117 @Test +118 public void testGetMD5Checksum() throws Exception { +119 File file = new File(this.getClass().getClassLoader().getResource("checkSumTest.file").getPath()); +120 String expResult = "F0915C5F46B8CFA283E5AD67A09B3793"; +121 String result = Checksum.getMD5Checksum(file); +122 Assert.assertEquals(expResult, result); +123 } +124 +125 /** +126 * Test of getSHA1Checksum method, of class Checksum. +127 * +128 * @throws Exception is thrown when an exception occurs. +129 */ +130 @Test +131 public void testGetSHA1Checksum() throws Exception { +132 File file = new File(this.getClass().getClassLoader().getResource("checkSumTest.file").getPath()); +133 String expResult = "B8A9FF28B21BCB1D0B50E24A5243D8B51766851A"; +134 String result = Checksum.getSHA1Checksum(file); +135 Assert.assertEquals(expResult, result); +136 } +137 +138 /** +139 * Test of getHex method, of class Checksum. +140 */ +141 @Test +142 public void testGetHex() { +143 byte[] raw = {0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16}; +144 String expResult = "000102030405060708090A0B0C0D0E0F10"; +145 String result = Checksum.getHex(raw); +146 Assert.assertEquals(expResult, result); +147 } +148 }
    diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/utils/DependencyVersionTest.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/utils/DependencyVersionTest.html index e5bff9434..a8635bdc1 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/utils/DependencyVersionTest.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/utils/DependencyVersionTest.html @@ -7,180 +7,194 @@ 
     1   /*
-2    * To change this template, choose Tools | Templates
-3    * and open the template in the editor.
-4    */
-5   package org.owasp.dependencycheck.utils;
-6   
-7   import java.util.Iterator;
-8   import java.util.List;
-9   import org.junit.After;
-10  import org.junit.AfterClass;
-11  import org.junit.Before;
-12  import org.junit.BeforeClass;
-13  import org.junit.Test;
-14  import static org.junit.Assert.*;
-15  
-16  /**
-17   *
-18   * @author Jeremy Long <jeremy.long@owasp.org>
-19   */
-20  public class DependencyVersionTest {
-21  
-22      public DependencyVersionTest() {
-23      }
-24  
-25      @BeforeClass
-26      public static void setUpClass() {
-27      }
-28  
-29      @AfterClass
-30      public static void tearDownClass() {
-31      }
-32  
-33      @Before
-34      public void setUp() {
-35      }
+2    * This file is part of dependency-check-core.
+3    *
+4    * Licensed under the Apache License, Version 2.0 (the "License");
+5    * you may not use this file except in compliance with the License.
+6    * You may obtain a copy of the License at
+7    *
+8    *     http://www.apache.org/licenses/LICENSE-2.0
+9    *
+10   * Unless required by applicable law or agreed to in writing, software
+11   * distributed under the License is distributed on an "AS IS" BASIS,
+12   * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+13   * See the License for the specific language governing permissions and
+14   * limitations under the License.
+15   *
+16   * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
+17   */
+18  package org.owasp.dependencycheck.utils;
+19  
+20  import java.util.Iterator;
+21  import java.util.List;
+22  import org.junit.After;
+23  import org.junit.AfterClass;
+24  import static org.junit.Assert.assertArrayEquals;
+25  import static org.junit.Assert.assertEquals;
+26  import static org.junit.Assert.assertTrue;
+27  import org.junit.Before;
+28  import org.junit.BeforeClass;
+29  import org.junit.Test;
+30  
+31  /**
+32   *
+33   * @author Jeremy Long <jeremy.long@owasp.org>
+34   */
+35  public class DependencyVersionTest {
 36  
-37      @After
-38      public void tearDown() {
-39      }
-40  
-41      /**
-42       * Test of parseVersion method, of class DependencyVersion.
-43       */
-44      @Test
-45      public void testParseVersion() {
-46          String version = "1.2r1";
-47          DependencyVersion instance = new DependencyVersion();
-48          instance.parseVersion(version);
-49          List<String> parts = instance.getVersionParts();
-50          assertEquals(3, parts.size());
-51          assertEquals("1", parts.get(0));
-52          assertEquals("2", parts.get(1));
-53          assertEquals("r1", parts.get(2));
-54  
-55          instance.parseVersion("x6.0");
-56          parts = instance.getVersionParts();
-57          assertEquals(2, parts.size());
-58          assertEquals("x6", parts.get(0));
-59          assertEquals("0", parts.get(1));
-60          //assertEquals("0", parts.get(2));
-61  
-62  
-63      }
-64  
-65      /**
-66       * Test of iterator method, of class DependencyVersion.
-67       */
-68      @Test
-69      public void testIterator() {
-70          DependencyVersion instance = new DependencyVersion("1.2.3");
-71          Iterator result = instance.iterator();
-72          int count = 1;
-73          while (result.hasNext()) {
-74              String v = (String) result.next();
-75              assertTrue(String.valueOf(count++).equals(v));
-76          }
+37      public DependencyVersionTest() {
+38      }
+39  
+40      @BeforeClass
+41      public static void setUpClass() {
+42      }
+43  
+44      @AfterClass
+45      public static void tearDownClass() {
+46      }
+47  
+48      @Before
+49      public void setUp() {
+50      }
+51  
+52      @After
+53      public void tearDown() {
+54      }
+55  
+56      /**
+57       * Test of parseVersion method, of class DependencyVersion.
+58       */
+59      @Test
+60      public void testParseVersion() {
+61          String version = "1.2r1";
+62          DependencyVersion instance = new DependencyVersion();
+63          instance.parseVersion(version);
+64          List<String> parts = instance.getVersionParts();
+65          assertEquals(3, parts.size());
+66          assertEquals("1", parts.get(0));
+67          assertEquals("2", parts.get(1));
+68          assertEquals("r1", parts.get(2));
+69  
+70          instance.parseVersion("x6.0");
+71          parts = instance.getVersionParts();
+72          assertEquals(2, parts.size());
+73          assertEquals("x6", parts.get(0));
+74          assertEquals("0", parts.get(1));
+75          //assertEquals("0", parts.get(2));
+76  
 77      }
 78  
 79      /**
-80       * Test of toString method, of class DependencyVersion.
+80       * Test of iterator method, of class DependencyVersion.
 81       */
 82      @Test
-83      public void testToString() {
-84          DependencyVersion instance = new DependencyVersion("1.2.3r1");
-85          String expResult = "1.2.3.r1";
-86          String result = instance.toString();
-87          assertEquals(expResult, result);
-88      }
-89  
-90      /**
-91       * Test of equals method, of class DependencyVersion.
-92       */
-93      @Test
-94      public void testEquals() {
-95          DependencyVersion obj = new DependencyVersion("1.2.3.r1");
-96          DependencyVersion instance = new DependencyVersion("1.2.3");
-97          boolean expResult = false;
-98          boolean result = instance.equals(obj);
-99          assertEquals(expResult, result);
-100         obj = new DependencyVersion("1.2.3");
-101         expResult = true;
-102         result = instance.equals(obj);
-103         assertEquals(expResult, result);
-104     }
-105 
-106     /**
-107      * Test of hashCode method, of class DependencyVersion.
-108      */
-109     @Test
-110     public void testHashCode() {
-111         DependencyVersion instance = new DependencyVersion("3.2.1");
-112         int expResult = 80756;
-113         int result = instance.hashCode();
-114         assertEquals(expResult, result);
-115     }
-116 
-117     /**
-118      * Test of matchesAtLeastThreeLevels method, of class DependencyVersion.
-119      */
-120     @Test
-121     public void testMatchesAtLeastThreeLevels() {
-122 
-123         DependencyVersion instance = new DependencyVersion("1.2.3.4");
-124         DependencyVersion version = new DependencyVersion("1.2.3.5");
-125         //true tests
-126         assertEquals(true, instance.matchesAtLeastThreeLevels(version));
-127         version = new DependencyVersion("1.2");
-128         assertEquals(true, instance.matchesAtLeastThreeLevels(version));
-129         //false tests
-130         version = new DependencyVersion("1.2.2.5");
-131         assertEquals(false, instance.matchesAtLeastThreeLevels(version));
-132         version = new DependencyVersion("2");
-133         assertEquals(false, instance.matchesAtLeastThreeLevels(version));
-134     }
-135 
-136     /**
-137      * Test of compareTo method, of class DependencyVersion.
-138      */
-139     @Test
-140     public void testCompareTo() {
-141         DependencyVersion instance = new DependencyVersion("1.2.3");
-142         DependencyVersion version = new DependencyVersion("1.2.3");
-143         int expResult = 0;
-144         assertEquals(0, instance.compareTo(version));
-145         version = new DependencyVersion("1.1");
-146         assertEquals(1, instance.compareTo(version));
-147         version = new DependencyVersion("1.2");
-148         assertEquals(1, instance.compareTo(version));
-149         version = new DependencyVersion("1.3");
-150         assertEquals(-1, instance.compareTo(version));
-151         version = new DependencyVersion("1.2.3.1");
-152         assertEquals(-1, instance.compareTo(version));
-153 
-154         DependencyVersion[] dv = new DependencyVersion[7];
-155         dv[0] = new DependencyVersion("2.1.3");
-156         dv[1] = new DependencyVersion("2.1.3.r2");
-157         dv[2] = new DependencyVersion("2.1.3.r1");
-158         dv[3] = new DependencyVersion("1.2.3.1");
-159         dv[4] = new DependencyVersion("1.2.3");
-160         dv[5] = new DependencyVersion("2");
-161         dv[6] = new DependencyVersion("-");
-162 
-163         DependencyVersion[] expected = new DependencyVersion[7];
-164         expected[0] = new DependencyVersion("-");
-165         expected[1] = new DependencyVersion("1.2.3");
-166         expected[2] = new DependencyVersion("1.2.3.1");
-167         expected[3] = new DependencyVersion("2");
-168         expected[4] = new DependencyVersion("2.1.3");
-169         expected[5] = new DependencyVersion("2.1.3.r1");
-170         expected[6] = new DependencyVersion("2.1.3.r2");
-171         java.util.Arrays.sort(dv);
-172 
-173         assertArrayEquals(expected, dv);
-174     }
-175 }
+83      public void testIterator() {
+84          DependencyVersion instance = new DependencyVersion("1.2.3");
+85          Iterator result = instance.iterator();
+86          int count = 1;
+87          while (result.hasNext()) {
+88              String v = (String) result.next();
+89              assertTrue(String.valueOf(count++).equals(v));
+90          }
+91      }
+92  
+93      /**
+94       * Test of toString method, of class DependencyVersion.
+95       */
+96      @Test
+97      public void testToString() {
+98          DependencyVersion instance = new DependencyVersion("1.2.3r1");
+99          String expResult = "1.2.3.r1";
+100         String result = instance.toString();
+101         assertEquals(expResult, result);
+102     }
+103 
+104     /**
+105      * Test of equals method, of class DependencyVersion.
+106      */
+107     @Test
+108     public void testEquals() {
+109         DependencyVersion obj = new DependencyVersion("1.2.3.r1");
+110         DependencyVersion instance = new DependencyVersion("1.2.3");
+111         boolean expResult = false;
+112         boolean result = instance.equals(obj);
+113         assertEquals(expResult, result);
+114         obj = new DependencyVersion("1.2.3");
+115         expResult = true;
+116         result = instance.equals(obj);
+117         assertEquals(expResult, result);
+118     }
+119 
+120     /**
+121      * Test of hashCode method, of class DependencyVersion.
+122      */
+123     @Test
+124     public void testHashCode() {
+125         DependencyVersion instance = new DependencyVersion("3.2.1");
+126         int expResult = 80756;
+127         int result = instance.hashCode();
+128         assertEquals(expResult, result);
+129     }
+130 
+131     /**
+132      * Test of matchesAtLeastThreeLevels method, of class DependencyVersion.
+133      */
+134     @Test
+135     public void testMatchesAtLeastThreeLevels() {
+136 
+137         DependencyVersion instance = new DependencyVersion("1.2.3.4");
+138         DependencyVersion version = new DependencyVersion("1.2.3.5");
+139         //true tests
+140         assertEquals(true, instance.matchesAtLeastThreeLevels(version));
+141         version = new DependencyVersion("1.2");
+142         assertEquals(true, instance.matchesAtLeastThreeLevels(version));
+143         //false tests
+144         version = new DependencyVersion("1.2.2.5");
+145         assertEquals(false, instance.matchesAtLeastThreeLevels(version));
+146         version = new DependencyVersion("2");
+147         assertEquals(false, instance.matchesAtLeastThreeLevels(version));
+148     }
+149 
+150     /**
+151      * Test of compareTo method, of class DependencyVersion.
+152      */
+153     @Test
+154     public void testCompareTo() {
+155         DependencyVersion instance = new DependencyVersion("1.2.3");
+156         DependencyVersion version = new DependencyVersion("1.2.3");
+157         int expResult = 0;
+158         assertEquals(0, instance.compareTo(version));
+159         version = new DependencyVersion("1.1");
+160         assertEquals(1, instance.compareTo(version));
+161         version = new DependencyVersion("1.2");
+162         assertEquals(1, instance.compareTo(version));
+163         version = new DependencyVersion("1.3");
+164         assertEquals(-1, instance.compareTo(version));
+165         version = new DependencyVersion("1.2.3.1");
+166         assertEquals(-1, instance.compareTo(version));
+167 
+168         DependencyVersion[] dv = new DependencyVersion[7];
+169         dv[0] = new DependencyVersion("2.1.3");
+170         dv[1] = new DependencyVersion("2.1.3.r2");
+171         dv[2] = new DependencyVersion("2.1.3.r1");
+172         dv[3] = new DependencyVersion("1.2.3.1");
+173         dv[4] = new DependencyVersion("1.2.3");
+174         dv[5] = new DependencyVersion("2");
+175         dv[6] = new DependencyVersion("-");
+176 
+177         DependencyVersion[] expected = new DependencyVersion[7];
+178         expected[0] = new DependencyVersion("-");
+179         expected[1] = new DependencyVersion("1.2.3");
+180         expected[2] = new DependencyVersion("1.2.3.1");
+181         expected[3] = new DependencyVersion("2");
+182         expected[4] = new DependencyVersion("2.1.3");
+183         expected[5] = new DependencyVersion("2.1.3.r1");
+184         expected[6] = new DependencyVersion("2.1.3.r2");
+185         java.util.Arrays.sort(dv);
+186 
+187         assertArrayEquals(expected, dv);
+188     }
+189 }
    diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/utils/DependencyVersionUtilTest.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/utils/DependencyVersionUtilTest.html index 541558ca9..2d2a06302 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/utils/DependencyVersionUtilTest.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/utils/DependencyVersionUtilTest.html @@ -9,29 +9,29 @@ 1 /* 2 * This file is part of dependency-check-core. 3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. -18 */ -19 package org.owasp.dependencycheck.utils; -20 -21 import org.junit.After; -22 import org.junit.AfterClass; -23 import org.junit.Before; -24 import org.junit.BeforeClass; -25 import org.junit.Test; -26 import static org.junit.Assert.*; +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. +17 */ +18 package org.owasp.dependencycheck.utils; +19 +20 import org.junit.After; +21 import org.junit.AfterClass; +22 import static org.junit.Assert.assertEquals; +23 import static org.junit.Assert.assertNull; +24 import org.junit.Before; +25 import org.junit.BeforeClass; +26 import org.junit.Test; 27 28 /** 29 * diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/utils/DownloaderIntegrationTest.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/utils/DownloaderIntegrationTest.html index 642760fd8..da0e728b9 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/utils/DownloaderIntegrationTest.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/utils/DownloaderIntegrationTest.html @@ -9,81 +9,77 @@ 1 /* 2 * This file is part of dependency-check-core. 3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. -18 */ -19 package org.owasp.dependencycheck.utils; -20 -21 import java.io.File; -22 import org.owasp.dependencycheck.utils.Settings; -23 import org.owasp.dependencycheck.utils.Downloader; -24 import java.net.URL; -25 import org.junit.After; -26 import org.junit.AfterClass; -27 import org.junit.Before; -28 import org.junit.BeforeClass; -29 import org.junit.Test; -30 import static org.junit.Assert.*; -31 -32 /** -33 * -34 * @author Jeremy Long <jeremy.long@owasp.org> -35 */ -36 public class DownloaderIntegrationTest { -37 -38 @BeforeClass -39 public static void setUpClass() throws Exception { -40 } -41 -42 @AfterClass -43 public static void tearDownClass() throws Exception { -44 } -45 -46 @Before -47 public void setUp() { -48 } -49 -50 @After -51 public void tearDown() { -52 } -53 -54 /** -55 * Test of fetchFile method, of class Downloader. -56 * -57 * @throws Exception thrown when an exception occurs. -58 */ -59 @Test -60 public void testFetchFile() throws Exception { -61 -62 // Settings.setString(Settings.KEYS.CONNECTION_TIMEOUT, "1000"); -63 // Settings.setString(Settings.KEYS.PROXY_PORT, "8080"); -64 // Settings.setString(Settings.KEYS.PROXY_URL, "127.0.0.1"); +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. +17 */ +18 package org.owasp.dependencycheck.utils; +19 +20 import java.io.File; +21 import java.net.URL; +22 import org.junit.After; +23 import org.junit.AfterClass; +24 import static org.junit.Assert.assertTrue; +25 import org.junit.Before; +26 import org.junit.BeforeClass; +27 import org.junit.Test; +28 +29 /** +30 * +31 * @author Jeremy Long <jeremy.long@owasp.org> +32 */ +33 public class DownloaderIntegrationTest { +34 +35 @BeforeClass +36 public static void setUpClass() throws Exception { +37 } +38 +39 @AfterClass +40 public static void tearDownClass() throws Exception { +41 } +42 +43 @Before +44 public void setUp() { +45 } +46 +47 @After +48 public void tearDown() { +49 } +50 +51 /** +52 * Test of fetchFile method, of class Downloader. +53 * +54 * @throws Exception thrown when an exception occurs. +55 */ +56 @Test +57 public void testFetchFile() throws Exception { +58 +59 // Settings.setString(Settings.KEYS.CONNECTION_TIMEOUT, "1000"); +60 // Settings.setString(Settings.KEYS.PROXY_PORT, "8080"); +61 // Settings.setString(Settings.KEYS.PROXY_URL, "127.0.0.1"); +62 URL url = new URL(Settings.getString(Settings.KEYS.CVE_MODIFIED_20_URL)); +63 File outputPath = new File("target/downloaded_cve.xml"); +64 Downloader.fetchFile(url, outputPath); 65 -66 URL url = new URL(Settings.getString(Settings.KEYS.CVE_MODIFIED_20_URL)); -67 File outputPath = new File("target/downloaded_cve.xml"); -68 Downloader.fetchFile(url, outputPath); -69 -70 } -71 -72 @Test -73 public void testGetLastModified() throws Exception { -74 URL url = new URL("http://nvd.nist.gov/download/nvdcve-2012.xml"); -75 long timestamp = Downloader.getLastModified(url); -76 assertTrue("timestamp equal to zero?", timestamp > 0); -77 } -78 } +66 } +67 +68 @Test +69 public void testGetLastModified() throws Exception { +70 URL url = new URL("http://nvd.nist.gov/download/nvdcve-2012.xml"); +71 long timestamp = Downloader.getLastModified(url); +72 assertTrue("timestamp equal to zero?", timestamp > 0); +73 } +74 }
    diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/utils/DownloaderTest.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/utils/DownloaderTest.html index 34b7bb232..13c6b7b23 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/utils/DownloaderTest.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/utils/DownloaderTest.html @@ -9,63 +9,61 @@ 1 /* 2 * This file is part of dependency-check-core. 3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. -18 */ -19 package org.owasp.dependencycheck.utils; -20 -21 import java.io.File; -22 import org.owasp.dependencycheck.utils.Downloader; -23 import java.net.URL; -24 import org.junit.After; -25 import org.junit.AfterClass; -26 import org.junit.Before; -27 import org.junit.BeforeClass; -28 import org.junit.Test; -29 import static org.junit.Assert.*; -30 -31 /** -32 * -33 * @author Jeremy Long <jeremy.long@owasp.org> -34 */ -35 public class DownloaderTest { -36 -37 @BeforeClass -38 public static void setUpClass() throws Exception { -39 } -40 -41 @AfterClass -42 public static void tearDownClass() throws Exception { -43 } -44 -45 @Before -46 public void setUp() { -47 } -48 -49 @After -50 public void tearDown() { -51 } -52 -53 @Test -54 public void testGetLastModified_file() throws Exception { -55 File f = new File("target/test-classes/nvdcve-2.0-2012.xml"); -56 URL url = new URL("file:///" + f.getCanonicalPath()); -57 long timestamp = Downloader.getLastModified(url); -58 assertTrue("timestamp equal to zero?", timestamp > 0); -59 } -60 } +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. +17 */ +18 package org.owasp.dependencycheck.utils; +19 +20 import java.io.File; +21 import java.net.URL; +22 import org.junit.After; +23 import org.junit.AfterClass; +24 import static org.junit.Assert.assertTrue; +25 import org.junit.Before; +26 import org.junit.BeforeClass; +27 import org.junit.Test; +28 +29 /** +30 * +31 * @author Jeremy Long <jeremy.long@owasp.org> +32 */ +33 public class DownloaderTest { +34 +35 @BeforeClass +36 public static void setUpClass() throws Exception { +37 } +38 +39 @AfterClass +40 public static void tearDownClass() throws Exception { +41 } +42 +43 @Before +44 public void setUp() { +45 } +46 +47 @After +48 public void tearDown() { +49 } +50 +51 @Test +52 public void testGetLastModified_file() throws Exception { +53 File f = new File("target/test-classes/nvdcve-2.0-2012.xml"); +54 URL url = new URL("file:///" + f.getCanonicalPath()); +55 long timestamp = Downloader.getLastModified(url); +56 assertTrue("timestamp equal to zero?", timestamp > 0); +57 } +58 }
    diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/utils/FileUtilsTest.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/utils/FileUtilsTest.html index 6a0da91cc..ad683af34 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/utils/FileUtilsTest.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/utils/FileUtilsTest.html @@ -9,84 +9,85 @@ 1 /* 2 * This file is part of dependency-check-core. 3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. -18 */ -19 package org.owasp.dependencycheck.utils; -20 -21 import java.io.File; -22 import org.junit.After; -23 import org.junit.AfterClass; -24 import org.junit.Before; -25 import org.junit.BeforeClass; -26 import org.junit.Test; -27 import static org.junit.Assert.*; -28 -29 /** -30 * -31 * @author Jeremy Long <jeremy.long@owasp.org> -32 */ -33 public class FileUtilsTest { -34 -35 public FileUtilsTest() { -36 } -37 -38 @BeforeClass -39 public static void setUpClass() throws Exception { -40 } -41 -42 @AfterClass -43 public static void tearDownClass() throws Exception { -44 } -45 -46 @Before -47 public void setUp() { -48 } -49 -50 @After -51 public void tearDown() { -52 } -53 -54 /** -55 * Test of getFileExtension method, of class FileUtils. -56 */ -57 @Test -58 public void testGetFileExtension() { -59 String[] fileName = {"something-0.9.5.jar", "lib2-1.1.js"}; -60 String[] expResult = {"jar", "js"}; -61 -62 for (int i = 0; i < fileName.length; i++) { -63 String result = FileUtils.getFileExtension(fileName[i]); -64 assertEquals("Failed extraction on \"" + fileName[i] + "\".", expResult[i], result); -65 } -66 } -67 -68 /** -69 * Test of delete method, of class FileUtils. -70 */ -71 @Test -72 public void testDelete() throws Exception { -73 -74 File file = File.createTempFile("tmp", "deleteme"); -75 if (!file.exists()) { -76 fail("Unable to create a temporary file."); -77 } -78 FileUtils.delete(file); -79 assertFalse("Temporary file exists after attempting deletion", file.exists()); -80 } -81 } +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. +17 */ +18 package org.owasp.dependencycheck.utils; +19 +20 import java.io.File; +21 import org.junit.After; +22 import org.junit.AfterClass; +23 import static org.junit.Assert.assertEquals; +24 import static org.junit.Assert.assertFalse; +25 import static org.junit.Assert.fail; +26 import org.junit.Before; +27 import org.junit.BeforeClass; +28 import org.junit.Test; +29 +30 /** +31 * +32 * @author Jeremy Long <jeremy.long@owasp.org> +33 */ +34 public class FileUtilsTest { +35 +36 public FileUtilsTest() { +37 } +38 +39 @BeforeClass +40 public static void setUpClass() throws Exception { +41 } +42 +43 @AfterClass +44 public static void tearDownClass() throws Exception { +45 } +46 +47 @Before +48 public void setUp() { +49 } +50 +51 @After +52 public void tearDown() { +53 } +54 +55 /** +56 * Test of getFileExtension method, of class FileUtils. +57 */ +58 @Test +59 public void testGetFileExtension() { +60 String[] fileName = {"something-0.9.5.jar", "lib2-1.1.js"}; +61 String[] expResult = {"jar", "js"}; +62 +63 for (int i = 0; i < fileName.length; i++) { +64 String result = FileUtils.getFileExtension(fileName[i]); +65 assertEquals("Failed extraction on \"" + fileName[i] + "\".", expResult[i], result); +66 } +67 } +68 +69 /** +70 * Test of delete method, of class FileUtils. +71 */ +72 @Test +73 public void testDelete() throws Exception { +74 +75 File file = File.createTempFile("tmp", "deleteme"); +76 if (!file.exists()) { +77 fail("Unable to create a temporary file."); +78 } +79 FileUtils.delete(file); +80 assertFalse("Temporary file exists after attempting deletion", file.exists()); +81 } +82 }
    diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/utils/FilterTest.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/utils/FilterTest.html index a05f6ccf4..f2dbad361 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/utils/FilterTest.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/utils/FilterTest.html @@ -9,32 +9,32 @@ 1 /* 2 * This file is part of dependency-check-core. 3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. -18 */ -19 package org.owasp.dependencycheck.utils; -20 -21 import org.owasp.dependencycheck.utils.Filter; -22 import java.util.List; -23 import java.util.ArrayList; -24 import org.junit.After; -25 import org.junit.AfterClass; -26 import org.junit.Before; -27 import org.junit.BeforeClass; -28 import org.junit.Test; -29 import static org.junit.Assert.*; +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. +17 */ +18 package org.owasp.dependencycheck.utils; +19 +20 import java.util.ArrayList; +21 import java.util.List; +22 import org.junit.After; +23 import org.junit.AfterClass; +24 import static org.junit.Assert.assertArrayEquals; +25 import static org.junit.Assert.assertFalse; +26 import static org.junit.Assert.assertTrue; +27 import org.junit.Before; +28 import org.junit.BeforeClass; +29 import org.junit.Test; 30 31 /** 32 * @@ -93,12 +93,12 @@ 85 } 86 assertArrayEquals(expResults.toArray(), actResults.toArray()); 87 } -88 private static final Filter<String> TEST_FILTER = -89 new Filter<String>() { -90 public boolean passes(String str) { -91 return str.contains("keep"); -92 } -93 }; +88 private static final Filter<String> TEST_FILTER +89 = new Filter<String>() { +90 public boolean passes(String str) { +91 return str.contains("keep"); +92 } +93 }; 94 }
    diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/utils/SettingsTest.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/utils/SettingsTest.html index 2b4d530e1..9e68c56ee 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/utils/SettingsTest.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/utils/SettingsTest.html @@ -9,181 +9,178 @@ 1 /* 2 * This file is part of dependency-check-core. 3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. -18 */ -19 package org.owasp.dependencycheck.utils; -20 -21 import org.owasp.dependencycheck.utils.InvalidSettingException; -22 import org.owasp.dependencycheck.utils.Settings; -23 import java.io.File; -24 import java.io.IOException; -25 import java.net.URISyntaxException; -26 import org.junit.After; -27 import org.junit.AfterClass; -28 import org.junit.Assert; -29 import org.junit.Before; -30 import org.junit.BeforeClass; -31 import org.junit.Test; -32 -33 /** -34 * -35 * @author Jeremy Long <jeremy.long@owasp.org> -36 */ -37 public class SettingsTest { -38 -39 @BeforeClass -40 public static void setUpClass() throws Exception { -41 } -42 -43 @AfterClass -44 public static void tearDownClass() throws Exception { -45 } -46 -47 @Before -48 public void setUp() throws Exception { -49 } -50 -51 @After -52 public void tearDown() throws Exception { -53 } -54 -55 /** -56 * Test of getString method, of class Settings. -57 */ -58 @Test -59 public void testGetString() { -60 String key = Settings.KEYS.CVE_MODIFIED_VALID_FOR_DAYS; -61 String expResult = "7"; -62 String result = Settings.getString(key); -63 Assert.assertTrue(result.endsWith(expResult)); -64 } -65 -66 /** -67 * Test of getDataFile method, of class Settings. -68 */ -69 @Test -70 public void testGetDataFile() throws IOException { -71 String key = Settings.KEYS.DATA_DIRECTORY; -72 String expResult = "data"; -73 File result = Settings.getDataFile(key); -74 Assert.assertTrue(result.getAbsolutePath().endsWith(expResult)); -75 } -76 -77 /** -78 * Test of mergeProperties method, of class Settings. -79 */ -80 @Test -81 public void testMergeProperties_String() throws IOException, URISyntaxException { -82 String key = Settings.KEYS.PROXY_PORT; -83 String expResult = Settings.getString(key); -84 File f = new File(this.getClass().getClassLoader().getResource("test.properties").toURI()); -85 //InputStream in = this.getClass().getClassLoader().getResourceAsStream("test.properties"); -86 Settings.mergeProperties(f.getAbsolutePath()); -87 String result = Settings.getString(key); -88 Assert.assertTrue("setting didn't change?", (expResult == null && result != null) || !expResult.equals(result)); -89 } -90 -91 /** -92 * Test of setString method, of class Settings. -93 */ -94 @Test -95 public void testSetString() { -96 String key = "newProperty"; -97 String value = "someValue"; -98 Settings.setString(key, value); -99 String expResults = Settings.getString(key); -100 Assert.assertEquals(expResults, value); -101 } -102 -103 /** -104 * Test of getString method, of class Settings. -105 */ -106 @Test -107 public void testGetString_String_String() { -108 String key = "key That Doesn't Exist"; -109 String defaultValue = "blue bunny"; -110 String expResult = "blue bunny"; -111 String result = Settings.getString(key); -112 Assert.assertTrue(result == null); -113 result = Settings.getString(key, defaultValue); -114 Assert.assertEquals(expResult, result); -115 } -116 -117 /** -118 * Test of getString method, of class Settings. -119 */ -120 @Test -121 public void testGetString_String() { -122 String key = Settings.KEYS.CONNECTION_TIMEOUT; -123 String result = Settings.getString(key); -124 Assert.assertTrue(result == null); -125 } -126 -127 /** -128 * Test of getInt method, of class Settings. -129 */ -130 @Test -131 public void testGetInt() throws InvalidSettingException { -132 String key = "SomeNumber"; -133 int expResult = 85; -134 Settings.setString(key, "85"); -135 int result = Settings.getInt(key); -136 Assert.assertEquals(expResult, result); -137 } -138 -139 /** -140 * Test of getLong method, of class Settings. -141 */ -142 @Test -143 public void testGetLong() throws InvalidSettingException { -144 String key = "SomeNumber"; -145 long expResult = 300L; -146 Settings.setString(key, "300"); -147 long result = Settings.getLong(key); -148 Assert.assertEquals(expResult, result); -149 } -150 -151 /** -152 * Test of getBoolean method, of class Settings. -153 */ -154 @Test -155 public void testGetBoolean() throws InvalidSettingException { -156 String key = "SomeBoolean"; -157 Settings.setString(key, "false"); -158 boolean expResult = false; -159 boolean result = Settings.getBoolean(key); -160 Assert.assertEquals(expResult, result); -161 } -162 -163 /** -164 * Test of removeProperty method, of class Settings. -165 */ -166 @Test -167 public void testRemoveProperty() { -168 String key = "SomeKey"; -169 String value = "value"; -170 String dfault = "default"; -171 Settings.setString(key, value); -172 String ret = Settings.getString(key); -173 Assert.assertEquals(value, ret); -174 Settings.removeProperty(key); -175 ret = Settings.getString(key, dfault); -176 Assert.assertEquals(dfault, ret); -177 } -178 } +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. +17 */ +18 package org.owasp.dependencycheck.utils; +19 +20 import java.io.File; +21 import java.io.IOException; +22 import java.net.URISyntaxException; +23 import org.junit.After; +24 import org.junit.AfterClass; +25 import org.junit.Assert; +26 import org.junit.Before; +27 import org.junit.BeforeClass; +28 import org.junit.Test; +29 +30 /** +31 * +32 * @author Jeremy Long <jeremy.long@owasp.org> +33 */ +34 public class SettingsTest { +35 +36 @BeforeClass +37 public static void setUpClass() throws Exception { +38 } +39 +40 @AfterClass +41 public static void tearDownClass() throws Exception { +42 } +43 +44 @Before +45 public void setUp() throws Exception { +46 } +47 +48 @After +49 public void tearDown() throws Exception { +50 } +51 +52 /** +53 * Test of getString method, of class Settings. +54 */ +55 @Test +56 public void testGetString() { +57 String key = Settings.KEYS.CVE_MODIFIED_VALID_FOR_DAYS; +58 String expResult = "7"; +59 String result = Settings.getString(key); +60 Assert.assertTrue(result.endsWith(expResult)); +61 } +62 +63 /** +64 * Test of getDataFile method, of class Settings. +65 */ +66 @Test +67 public void testGetDataFile() throws IOException { +68 String key = Settings.KEYS.DATA_DIRECTORY; +69 String expResult = "data"; +70 File result = Settings.getDataFile(key); +71 Assert.assertTrue(result.getAbsolutePath().endsWith(expResult)); +72 } +73 +74 /** +75 * Test of mergeProperties method, of class Settings. +76 */ +77 @Test +78 public void testMergeProperties_String() throws IOException, URISyntaxException { +79 String key = Settings.KEYS.PROXY_PORT; +80 String expResult = Settings.getString(key); +81 File f = new File(this.getClass().getClassLoader().getResource("test.properties").toURI()); +82 //InputStream in = this.getClass().getClassLoader().getResourceAsStream("test.properties"); +83 Settings.mergeProperties(f.getAbsolutePath()); +84 String result = Settings.getString(key); +85 Assert.assertTrue("setting didn't change?", (expResult == null && result != null) || !expResult.equals(result)); +86 } +87 +88 /** +89 * Test of setString method, of class Settings. +90 */ +91 @Test +92 public void testSetString() { +93 String key = "newProperty"; +94 String value = "someValue"; +95 Settings.setString(key, value); +96 String expResults = Settings.getString(key); +97 Assert.assertEquals(expResults, value); +98 } +99 +100 /** +101 * Test of getString method, of class Settings. +102 */ +103 @Test +104 public void testGetString_String_String() { +105 String key = "key That Doesn't Exist"; +106 String defaultValue = "blue bunny"; +107 String expResult = "blue bunny"; +108 String result = Settings.getString(key); +109 Assert.assertTrue(result == null); +110 result = Settings.getString(key, defaultValue); +111 Assert.assertEquals(expResult, result); +112 } +113 +114 /** +115 * Test of getString method, of class Settings. +116 */ +117 @Test +118 public void testGetString_String() { +119 String key = Settings.KEYS.CONNECTION_TIMEOUT; +120 String result = Settings.getString(key); +121 Assert.assertTrue(result == null); +122 } +123 +124 /** +125 * Test of getInt method, of class Settings. +126 */ +127 @Test +128 public void testGetInt() throws InvalidSettingException { +129 String key = "SomeNumber"; +130 int expResult = 85; +131 Settings.setString(key, "85"); +132 int result = Settings.getInt(key); +133 Assert.assertEquals(expResult, result); +134 } +135 +136 /** +137 * Test of getLong method, of class Settings. +138 */ +139 @Test +140 public void testGetLong() throws InvalidSettingException { +141 String key = "SomeNumber"; +142 long expResult = 300L; +143 Settings.setString(key, "300"); +144 long result = Settings.getLong(key); +145 Assert.assertEquals(expResult, result); +146 } +147 +148 /** +149 * Test of getBoolean method, of class Settings. +150 */ +151 @Test +152 public void testGetBoolean() throws InvalidSettingException { +153 String key = "SomeBoolean"; +154 Settings.setString(key, "false"); +155 boolean expResult = false; +156 boolean result = Settings.getBoolean(key); +157 Assert.assertEquals(expResult, result); +158 } +159 +160 /** +161 * Test of removeProperty method, of class Settings. +162 */ +163 @Test +164 public void testRemoveProperty() { +165 String key = "SomeKey"; +166 String value = "value"; +167 String dfault = "default"; +168 Settings.setString(key, value); +169 String ret = Settings.getString(key); +170 Assert.assertEquals(value, ret); +171 Settings.removeProperty(key); +172 ret = Settings.getString(key, dfault); +173 Assert.assertEquals(dfault, ret); +174 } +175 }
    diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/utils/package-frame.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/utils/package-frame.html index eef6ece0d..4b0aa3f54 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/utils/package-frame.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/utils/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.0.8 Reference Package org.owasp.dependencycheck.utils + Dependency-Check Core 1.1.0 Reference Package org.owasp.dependencycheck.utils diff --git a/dependency-check-core/xref-test/org/owasp/dependencycheck/utils/package-summary.html b/dependency-check-core/xref-test/org/owasp/dependencycheck/utils/package-summary.html index b0573b6c7..88fdd822e 100644 --- a/dependency-check-core/xref-test/org/owasp/dependencycheck/utils/package-summary.html +++ b/dependency-check-core/xref-test/org/owasp/dependencycheck/utils/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.0.8 Reference Package org.owasp.dependencycheck.utils + Dependency-Check Core 1.1.0 Reference Package org.owasp.dependencycheck.utils diff --git a/dependency-check-core/xref-test/overview-frame.html b/dependency-check-core/xref-test/overview-frame.html index 4a82269a6..abebb5a57 100644 --- a/dependency-check-core/xref-test/overview-frame.html +++ b/dependency-check-core/xref-test/overview-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.0.8 Reference + Dependency-Check Core 1.1.0 Reference @@ -20,9 +20,6 @@
  • org.owasp.dependencycheck.analyzer -
    • -
  • - org.owasp.dependencycheck.concurrency
  • org.owasp.dependencycheck.data.cpe diff --git a/dependency-check-core/xref-test/overview-summary.html b/dependency-check-core/xref-test/overview-summary.html index 98cfa7065..abd3ff49a 100644 --- a/dependency-check-core/xref-test/overview-summary.html +++ b/dependency-check-core/xref-test/overview-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.0.8 Reference + Dependency-Check Core 1.1.0 Reference @@ -24,7 +24,7 @@ -

    Dependency-Check Core 1.0.8 Reference

    +

    Dependency-Check Core 1.1.0 Reference

    @@ -42,11 +42,6 @@ - - - diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/exception/NoDataException.html b/dependency-check-core/xref/org/owasp/dependencycheck/exception/NoDataException.html index e1ee46255..f46915765 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/exception/NoDataException.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/exception/NoDataException.html @@ -9,72 +9,71 @@ 1/*2 * This file is part of dependency-check-core.3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2013 Jeremy Long. All Rights Reserved. -18 */ -19package org.owasp.dependencycheck.exception; -20 -21import java.io.IOException; -22 -23/** -24 * An exception used when the data needed does not exist to perform analysis. -25 * -26 * @author Jeremy Long <jeremy.long@owasp.org> -27 */ -28publicclassNoDataExceptionextends IOException { -29 -30/** -31 * The serial version uid. -32 */ -33privatestaticfinallong serialVersionUID = 1L; -34 -35/** -36 * Creates a new NoDataException. -37 */ -38publicNoDataException() { -39super(); -40 } -41 -42/** -43 * Creates a new NoDataException. -44 * -45 * @param msg a message for the exception. -46 */ -47publicNoDataException(String msg) { -48super(msg); -49 } -50 -51/** -52 * Creates a new NoDataException. -53 * -54 * @param ex the cause of the exception. -55 */ -56publicNoDataException(Throwable ex) { -57super(ex); -58 } -59 -60/** -61 * Creates a new NoDataException. -62 * -63 * @param msg a message for the exception. -64 * @param ex the cause of the exception. -65 */ -66publicNoDataException(String msg, Throwable ex) { -67super(msg, ex); -68 } -69 } +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2013 Jeremy Long. All Rights Reserved. +17 */ +18package org.owasp.dependencycheck.exception; +19 +20import java.io.IOException; +21 +22/** +23 * An exception used when the data needed does not exist to perform analysis. +24 * +25 * @author Jeremy Long <jeremy.long@owasp.org> +26 */ +27publicclassNoDataExceptionextends IOException { +28 +29/** +30 * The serial version uid. +31 */ +32privatestaticfinallong serialVersionUID = 1L; +33 +34/** +35 * Creates a new NoDataException. +36 */ +37publicNoDataException() { +38super(); +39 } +40 +41/** +42 * Creates a new NoDataException. +43 * +44 * @param msg a message for the exception. +45 */ +46publicNoDataException(String msg) { +47super(msg); +48 } +49 +50/** +51 * Creates a new NoDataException. +52 * +53 * @param ex the cause of the exception. +54 */ +55publicNoDataException(Throwable ex) { +56super(ex); +57 } +58 +59/** +60 * Creates a new NoDataException. +61 * +62 * @param msg a message for the exception. +63 * @param ex the cause of the exception. +64 */ +65publicNoDataException(String msg, Throwable ex) { +66super(msg, ex); +67 } +68 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/exception/package-frame.html b/dependency-check-core/xref/org/owasp/dependencycheck/exception/package-frame.html index a0d248da5..c29c1e746 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/exception/package-frame.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/exception/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.0.8 Reference Package org.owasp.dependencycheck.exception + Dependency-Check Core 1.1.0 Reference Package org.owasp.dependencycheck.exception diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/exception/package-summary.html b/dependency-check-core/xref/org/owasp/dependencycheck/exception/package-summary.html index 2527e9bfd..c7f111b94 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/exception/package-summary.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/exception/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.0.8 Reference Package org.owasp.dependencycheck.exception + Dependency-Check Core 1.1.0 Reference Package org.owasp.dependencycheck.exception diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/jaxb/pom/MavenNamespaceFilter.html b/dependency-check-core/xref/org/owasp/dependencycheck/jaxb/pom/MavenNamespaceFilter.html index 01f7df7b9..7759d18e6 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/jaxb/pom/MavenNamespaceFilter.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/jaxb/pom/MavenNamespaceFilter.html @@ -9,99 +9,98 @@ 1/*2 * This file is part of dependency-check-core.3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2013 Jeremy Long. All Rights Reserved. -18 */ -19package org.owasp.dependencycheck.jaxb.pom; -20 -21import org.xml.sax.Attributes; -22import org.xml.sax.SAXException; -23import org.xml.sax.helpers.XMLFilterImpl; -24 -25/** -26 * This filter is used when parsing POM documents. Some POM documents do not -27 * specify the xmlns="http://maven.apache.org/POM/4.0.0". This filter ensures -28 * that the correct namespace is added so that both types of POMs can be read. -29 * -30 * @author Jeremy Long <jeremy.long@owasp.org> -31 */ -32publicclassMavenNamespaceFilterextends XMLFilterImpl { -33 -34/** -35 * The namespace to add for Maven POMs. -36 */ -37privatestaticfinal String NAMESPACE = "http://maven.apache.org/POM/4.0.0"; -38/** -39 * A flag indicating whether or not the namespace (prefix) has been added. -40 */ -41privateboolean namespaceAdded = false; -42 -43/** -44 * Called at the start of the document parsing. -45 * -46 * @throws SAXException thrown if there is a SAXException -47 */ -48 @Override -49publicvoid startDocument() throws SAXException { -50super.startDocument(); -51 startPrefixMapping("", NAMESPACE); -52 } -53 -54/** -55 * Called when an element is started. -56 * -57 * @param uri the uri -58 * @param localName the localName -59 * @param qName the qualified name -60 * @param atts the attributes -61 * @throws SAXException thrown if there is a SAXException -62 */ -63 @Override -64publicvoid startElement(String uri, String localName, String qName, Attributes atts) throws SAXException { -65super.startElement(NAMESPACE, localName, qName, atts); -66 } -67 -68/** -69 * Indicatees the start of the document. -70 * -71 * @param uri the uri -72 * @param localName the localName -73 * @param qName the qualified name -74 * @throws SAXException thrown if there is a SAXException -75 */ -76 @Override -77publicvoid endElement(String uri, String localName, String qName) -78throws SAXException { -79super.endElement(NAMESPACE, localName, qName); -80 } -81 -82/** -83 * Called when prefix mapping is started. -84 * -85 * @param prefix the prefix -86 * @param url the url -87 * @throws SAXException thrown if there is a SAXException -88 */ -89 @Override -90publicvoid startPrefixMapping(String prefix, String url) throws SAXException { -91if (!this.namespaceAdded) { -92 namespaceAdded = true; -93super.startPrefixMapping("", NAMESPACE); -94 } -95 } -96 } +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2013 Jeremy Long. All Rights Reserved. +17 */ +18package org.owasp.dependencycheck.jaxb.pom; +19 +20import org.xml.sax.Attributes; +21import org.xml.sax.SAXException; +22import org.xml.sax.helpers.XMLFilterImpl; +23 +24/** +25 * This filter is used when parsing POM documents. Some POM documents do not specify the +26 * xmlns="http://maven.apache.org/POM/4.0.0". This filter ensures that the correct namespace is added so that both types +27 * of POMs can be read. +28 * +29 * @author Jeremy Long <jeremy.long@owasp.org> +30 */ +31publicclassMavenNamespaceFilterextends XMLFilterImpl { +32 +33/** +34 * The namespace to add for Maven POMs. +35 */ +36privatestaticfinal String NAMESPACE = "http://maven.apache.org/POM/4.0.0"; +37/** +38 * A flag indicating whether or not the namespace (prefix) has been added. +39 */ +40privateboolean namespaceAdded = false; +41 +42/** +43 * Called at the start of the document parsing. +44 * +45 * @throws SAXException thrown if there is a SAXException +46 */ +47 @Override +48publicvoid startDocument() throws SAXException { +49super.startDocument(); +50 startPrefixMapping("", NAMESPACE); +51 } +52 +53/** +54 * Called when an element is started. +55 * +56 * @param uri the uri +57 * @param localName the localName +58 * @param qName the qualified name +59 * @param atts the attributes +60 * @throws SAXException thrown if there is a SAXException +61 */ +62 @Override +63publicvoid startElement(String uri, String localName, String qName, Attributes atts) throws SAXException { +64super.startElement(NAMESPACE, localName, qName, atts); +65 } +66 +67/** +68 * Indicatees the start of the document. +69 * +70 * @param uri the uri +71 * @param localName the localName +72 * @param qName the qualified name +73 * @throws SAXException thrown if there is a SAXException +74 */ +75 @Override +76publicvoid endElement(String uri, String localName, String qName) +77throws SAXException { +78super.endElement(NAMESPACE, localName, qName); +79 } +80 +81/** +82 * Called when prefix mapping is started. +83 * +84 * @param prefix the prefix +85 * @param url the url +86 * @throws SAXException thrown if there is a SAXException +87 */ +88 @Override +89publicvoid startPrefixMapping(String prefix, String url) throws SAXException { +90if (!this.namespaceAdded) { +91 namespaceAdded = true; +92super.startPrefixMapping("", NAMESPACE); +93 } +94 } +95 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/jaxb/pom/generated/package-frame.html b/dependency-check-core/xref/org/owasp/dependencycheck/jaxb/pom/generated/package-frame.html index 124e92629..5321cbe77 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/jaxb/pom/generated/package-frame.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/jaxb/pom/generated/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.0.8 Reference Package org.owasp.dependencycheck.jaxb.pom.generated + Dependency-Check Core 1.1.0 Reference Package org.owasp.dependencycheck.jaxb.pom.generated diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/jaxb/pom/generated/package-summary.html b/dependency-check-core/xref/org/owasp/dependencycheck/jaxb/pom/generated/package-summary.html index a2a63d542..513820029 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/jaxb/pom/generated/package-summary.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/jaxb/pom/generated/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.0.8 Reference Package org.owasp.dependencycheck.jaxb.pom.generated + Dependency-Check Core 1.1.0 Reference Package org.owasp.dependencycheck.jaxb.pom.generated diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/jaxb/pom/package-frame.html b/dependency-check-core/xref/org/owasp/dependencycheck/jaxb/pom/package-frame.html index 4a7e5a559..233a5a954 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/jaxb/pom/package-frame.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/jaxb/pom/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.0.8 Reference Package org.owasp.dependencycheck.jaxb.pom + Dependency-Check Core 1.1.0 Reference Package org.owasp.dependencycheck.jaxb.pom diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/jaxb/pom/package-summary.html b/dependency-check-core/xref/org/owasp/dependencycheck/jaxb/pom/package-summary.html index eb38e53e6..52dd98521 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/jaxb/pom/package-summary.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/jaxb/pom/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.0.8 Reference Package org.owasp.dependencycheck.jaxb.pom + Dependency-Check Core 1.1.0 Reference Package org.owasp.dependencycheck.jaxb.pom diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/package-frame.html b/dependency-check-core/xref/org/owasp/dependencycheck/package-frame.html index 94a9859bd..cbeb7a1cd 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/package-frame.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.0.8 Reference Package org.owasp.dependencycheck + Dependency-Check Core 1.1.0 Reference Package org.owasp.dependencycheck diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/package-summary.html b/dependency-check-core/xref/org/owasp/dependencycheck/package-summary.html index ae7aba51b..7c6295c8f 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/package-summary.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.0.8 Reference Package org.owasp.dependencycheck + Dependency-Check Core 1.1.0 Reference Package org.owasp.dependencycheck diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/reporting/ReportGenerator.html b/dependency-check-core/xref/org/owasp/dependencycheck/reporting/ReportGenerator.html index aa7486a39..120be5c7f 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/reporting/ReportGenerator.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/reporting/ReportGenerator.html @@ -9,93 +9,93 @@ 1/*2 * This file is part of dependency-check-core.3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. -18 */ -19package org.owasp.dependencycheck.reporting; -20 +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. +17 */ +18package org.owasp.dependencycheck.reporting; +19 +20import java.io.File; 21import java.io.FileInputStream; -22import java.io.File; -23import java.io.FileNotFoundException; -24import java.io.FileOutputStream; -25import java.io.IOException; -26import java.io.InputStream; -27import java.io.InputStreamReader; -28import java.io.OutputStream; -29import java.io.OutputStreamWriter; -30import java.util.List; -31import java.util.logging.Level; -32import java.util.logging.Logger; -33import org.apache.velocity.app.VelocityEngine; -34import org.apache.velocity.context.Context; -35import org.apache.velocity.runtime.RuntimeConstants; -36import org.apache.velocity.runtime.resource.loader.ClasspathResourceLoader; -37import org.apache.velocity.tools.ToolManager; -38import org.apache.velocity.tools.config.EasyFactoryConfiguration; -39import org.owasp.dependencycheck.analyzer.Analyzer; +22import java.io.FileNotFoundException; +23import java.io.FileOutputStream; +24import java.io.IOException; +25import java.io.InputStream; +26import java.io.InputStreamReader; +27import java.io.OutputStream; +28import java.io.OutputStreamWriter; +29import java.util.List; +30import java.util.logging.Level; +31import java.util.logging.Logger; +32import org.apache.velocity.app.VelocityEngine; +33import org.apache.velocity.context.Context; +34import org.apache.velocity.runtime.RuntimeConstants; +35import org.apache.velocity.runtime.resource.loader.ClasspathResourceLoader; +36import org.apache.velocity.tools.ToolManager; +37import org.apache.velocity.tools.config.EasyFactoryConfiguration; +38import org.owasp.dependencycheck.analyzer.Analyzer; +39import org.owasp.dependencycheck.data.nvdcve.DatabaseProperties; 40import org.owasp.dependencycheck.dependency.Dependency; -41 -42/** -43 * The ReportGenerator is used to, as the name implies, generate reports. -44 * Internally the generator uses the Velocity Templating Engine. The -45 * ReportGenerator exposes a list of Dependencies to the template when -46 * generating the report. -47 * -48 * @author Jeremy Long <jeremy.long@owasp.org> -49 */ -50publicclassReportGenerator { -51 -52/** -53 * An enumeration of the report formats. -54 */ -55public enum Format { -56 -57/** -58 * Generate all reports. -59 */ -60 ALL, -61/** -62 * Generate XML report. -63 */ -64 XML, -65/** -66 * Generate HTML report. -67 */ -68 HTML, -69/** -70 * Generate HTML Vulnerability report. -71 */ -72 VULN -73 } -74/** -75 * The Velocity Engine. -76 */ -77privatefinal VelocityEngine engine; -78/** -79 * The Velocity Engine Context. -80 */ -81privatefinal Context context; -82 -83/** -84 * Constructs a new ReportGenerator. -85 * -86 * @param applicationName the application name being analyzed -87 * @param dependencies the list of dependencies -88 * @param analyzers the list of analyzers used. +41import org.owasp.dependencycheck.utils.Settings; +42 +43/** +44 * The ReportGenerator is used to, as the name implies, generate reports. Internally the generator uses the Velocity +45 * Templating Engine. The ReportGenerator exposes a list of Dependencies to the template when generating the report. +46 * +47 * @author Jeremy Long <jeremy.long@owasp.org> +48 */ +49publicclassReportGenerator { +50 +51/** +52 * An enumeration of the report formats. +53 */ +54public enum Format { +55 +56/** +57 * Generate all reports. +58 */ +59 ALL, +60/** +61 * Generate XML report. +62 */ +63 XML, +64/** +65 * Generate HTML report. +66 */ +67 HTML, +68/** +69 * Generate HTML Vulnerability report. +70 */ +71 VULN +72 } +73/** +74 * The Velocity Engine. +75 */ +76privatefinal VelocityEngine engine; +77/** +78 * The Velocity Engine Context. +79 */ +80privatefinal Context context; +81 +82/** +83 * Constructs a new ReportGenerator. +84 * +85 * @param applicationName the application name being analyzed +86 * @param dependencies the list of dependencies +87 * @param analyzers the list of analyzers used +88 * @param properties the database properties (containing timestamps of the NVD CVE data)89 */ -90publicReportGenerator(String applicationName, List<Dependency> dependencies, List<Analyzer> analyzers) { +90publicReportGenerator(String applicationName, List<Dependency> dependencies, List<Analyzer> analyzers, DatabaseProperties properties) { 91 engine = createVelocityEngine(); 92 context = createContext(); 93 @@ -104,89 +104,89 @@ 96 context.put("applicationName", applicationName); 97 context.put("dependencies", dependencies); 98 context.put("analyzers", analyzers); -99 } -100 -101/** -102 * Creates a new Velocity Engine. -103 * -104 * @return a velocity engine. -105 */ -106private VelocityEngine createVelocityEngine() { -107final VelocityEngine ve = new VelocityEngine(); -108 ve.setProperty(RuntimeConstants.RUNTIME_LOG_LOGSYSTEM_CLASS, VelocityLoggerRedirect.class.getName()); -109 ve.setProperty(RuntimeConstants.RESOURCE_LOADER, "classpath"); -110 ve.setProperty("classpath.resource.loader.class", ClasspathResourceLoader.class.getName()); -111return ve; -112 } -113 -114/** -115 * Creates a new Velocity Context initialized with escape and date tools. -116 * -117 * @return a Velocity Context. -118 */ -119 @edu.umd.cs.findbugs.annotations.SuppressWarnings(value = "RV_RETURN_VALUE_IGNORED_INFERRED", -120 justification = "No plan to fix this style issue") -121private Context createContext() { -122final ToolManager manager = new ToolManager(); -123final Context c = manager.createContext(); -124final EasyFactoryConfiguration config = new EasyFactoryConfiguration(); -125 config.addDefaultTools(); -126 config.toolbox("application").tool("esc", "org.apache.velocity.tools.generic.EscapeTool").tool("org.apache.velocity.tools.generic.DateTool"); -127 manager.configure(config); -128return c; -129 } -130 -131/** -132 * Generates the Dependency Reports for the identified dependencies. -133 * -134 * @param outputDir the path where the reports should be written -135 * @param format the format the report should be written in -136 * @throws IOException is thrown when the template file does not exist -137 * @throws Exception is thrown if there is an error writing out the reports. -138 */ -139publicvoid generateReports(String outputDir, Format format) throws IOException, Exception { -140if (format == Format.XML || format == Format.ALL) { -141 generateReport("XmlReport", outputDir + File.separator + "DependencyCheck-Report.xml"); -142 } -143if (format == Format.HTML || format == Format.ALL) { -144 generateReport("HtmlReport", outputDir + File.separator + "DependencyCheck-Report.html"); -145 } -146if (format == Format.VULN || format == Format.ALL) { -147 generateReport("VulnerabilityReport", outputDir + File.separator + "DependencyCheck-Vulnerability.html"); -148 } -149 } -150 -151/** -152 * Generates the Dependency Reports for the identified dependencies. -153 * -154 * @param outputDir the path where the reports should be written -155 * @param outputFormat the format the report should be written in (XML, -156 * HTML, ALL) -157 * @throws IOException is thrown when the template file does not exist -158 * @throws Exception is thrown if there is an error writing out the reports. -159 */ -160publicvoid generateReports(String outputDir, String outputFormat) throws IOException, Exception { -161final String format = outputFormat.toUpperCase(); -162if (format.matches("^(XML|HTML|VULN|ALL)$")) { -163if ("XML".equalsIgnoreCase(format)) { -164 generateReports(outputDir, Format.XML); -165 } -166if ("HTML".equalsIgnoreCase(format)) { -167 generateReports(outputDir, Format.HTML); -168 } -169if ("VULN".equalsIgnoreCase(format)) { -170 generateReports(outputDir, Format.VULN); -171 } -172if ("ALL".equalsIgnoreCase(format)) { -173 generateReports(outputDir, Format.ALL); -174 } -175 } -176 } -177 -178/** -179 * Generates a report from a given Velocity Template. The template name -180 * provided can be the name of a template contained in the jar file, such as -181 * 'XmlReport' or 'HtmlReport', or the template name can be the path to a +99 context.put("properties", properties); +100 context.put("version", Settings.getString("application.version", "Unknown")); +101 } +102 +103/** +104 * Creates a new Velocity Engine. +105 * +106 * @return a velocity engine. +107 */ +108private VelocityEngine createVelocityEngine() { +109final VelocityEngine ve = new VelocityEngine(); +110 ve.setProperty(RuntimeConstants.RUNTIME_LOG_LOGSYSTEM_CLASS, VelocityLoggerRedirect.class.getName()); +111 ve.setProperty(RuntimeConstants.RESOURCE_LOADER, "classpath"); +112 ve.setProperty("classpath.resource.loader.class", ClasspathResourceLoader.class.getName()); +113return ve; +114 } +115 +116/** +117 * Creates a new Velocity Context initialized with escape and date tools. +118 * +119 * @return a Velocity Context. +120 */ +121 @edu.umd.cs.findbugs.annotations.SuppressWarnings(value = "RV_RETURN_VALUE_IGNORED_INFERRED", +122 justification = "No plan to fix this style issue") +123private Context createContext() { +124final ToolManager manager = new ToolManager(); +125final Context c = manager.createContext(); +126final EasyFactoryConfiguration config = new EasyFactoryConfiguration(); +127 config.addDefaultTools(); +128 config.toolbox("application").tool("esc", "org.apache.velocity.tools.generic.EscapeTool").tool("org.apache.velocity.tools.generic.DateTool"); +129 manager.configure(config); +130return c; +131 } +132 +133/** +134 * Generates the Dependency Reports for the identified dependencies. +135 * +136 * @param outputDir the path where the reports should be written +137 * @param format the format the report should be written in +138 * @throws IOException is thrown when the template file does not exist +139 * @throws Exception is thrown if there is an error writing out the reports. +140 */ +141publicvoid generateReports(String outputDir, Format format) throws IOException, Exception { +142if (format == Format.XML || format == Format.ALL) { +143 generateReport("XmlReport", outputDir + File.separator + "DependencyCheck-Report.xml"); +144 } +145if (format == Format.HTML || format == Format.ALL) { +146 generateReport("HtmlReport", outputDir + File.separator + "DependencyCheck-Report.html"); +147 } +148if (format == Format.VULN || format == Format.ALL) { +149 generateReport("VulnerabilityReport", outputDir + File.separator + "DependencyCheck-Vulnerability.html"); +150 } +151 } +152 +153/** +154 * Generates the Dependency Reports for the identified dependencies. +155 * +156 * @param outputDir the path where the reports should be written +157 * @param outputFormat the format the report should be written in (XML, HTML, ALL) +158 * @throws IOException is thrown when the template file does not exist +159 * @throws Exception is thrown if there is an error writing out the reports. +160 */ +161publicvoid generateReports(String outputDir, String outputFormat) throws IOException, Exception { +162final String format = outputFormat.toUpperCase(); +163if (format.matches("^(XML|HTML|VULN|ALL)$")) { +164if ("XML".equalsIgnoreCase(format)) { +165 generateReports(outputDir, Format.XML); +166 } +167if ("HTML".equalsIgnoreCase(format)) { +168 generateReports(outputDir, Format.HTML); +169 } +170if ("VULN".equalsIgnoreCase(format)) { +171 generateReports(outputDir, Format.VULN); +172 } +173if ("ALL".equalsIgnoreCase(format)) { +174 generateReports(outputDir, Format.ALL); +175 } +176 } +177 } +178 +179/** +180 * Generates a report from a given Velocity Template. The template name provided can be the name of a template +181 * contained in the jar file, such as 'XmlReport' or 'HtmlReport', or the template name can be the path to a182 * template file.183 *184 * @param templateName the name of the template to load. @@ -239,20 +239,20 @@ 231if (writer != null) { 232try { 233 writer.close(); -234 } catch (Exception ex) { +234 } catch (IOException ex) { 235 Logger.getLogger(ReportGenerator.class.getName()).log(Level.FINEST, null, ex); 236 } 237 } 238if (outputStream != null) { 239try { 240 outputStream.close(); -241 } catch (Exception ex) { +241 } catch (IOException ex) { 242 Logger.getLogger(ReportGenerator.class.getName()).log(Level.FINEST, null, ex); 243 } 244 } 245try { 246 reader.close(); -247 } catch (Exception ex) { +247 } catch (IOException ex) { 248 Logger.getLogger(ReportGenerator.class.getName()).log(Level.FINEST, null, ex); 249 } 250 } diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/reporting/VelocityLoggerRedirect.html b/dependency-check-core/xref/org/owasp/dependencycheck/reporting/VelocityLoggerRedirect.html index 7102b37f9..8722b4893 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/reporting/VelocityLoggerRedirect.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/reporting/VelocityLoggerRedirect.html @@ -9,111 +9,107 @@ 1/*2 * This file is part of dependency-check-core.3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2013 Steve Springett. All Rights Reserved. -18 */ -19package org.owasp.dependencycheck.reporting; -20 -21import org.apache.velocity.app.Velocity; -22import org.apache.velocity.runtime.RuntimeServices; -23import org.apache.velocity.runtime.log.LogChute; -24 -25import java.util.logging.Level; -26import java.util.logging.Logger; -27 -28/** -29 * <p>DependencyCheck uses {@link java.util.logging.Logger} as a logging -30 * framework, and Apache Velocity uses a custom logging implementation that -31 * outputs to a file named velocity.log by default. This class is an -32 * implementation of a custom Velocity logger that redirects all velocity -33 * logging to the Java Logger class. -34 * </p><p> -35 * This class was written to address permission issues when using -36 * Dependency-Check in a server environment (such as the Jenkins plugin). In -37 * some circumstances, Velocity would attempt to create velocity.log in an -38 * un-writable directory.</p> -39 * -40 * @author Steve Springett (steve.springett@owasp.org) -41 */ -42publicclassVelocityLoggerRedirectimplements LogChute { -43 -44/** -45 * This will be invoked once by the LogManager. -46 * -47 * @param rsvc the RuntimeServices -48 */ -49publicvoid init(RuntimeServices rsvc) { -50// do nothing -51 } -52 -53/** -54 * Given a Velocity log level and message, this method will call the -55 * appropriate Logger level and log the specified values. -56 * -57 * @param level the logging level -58 * @param message the message to be logged -59 */ -60publicvoid log(int level, String message) { -61 Logger.getLogger(Velocity.class.getName()).log(getLevel(level), message); -62 } -63 -64/** -65 * Given a Velocity log level, message and Throwable, this method will call -66 * the appropriate Logger level and log the specified values. -67 * -68 * @param level the logging level -69 * @param message the message to be logged -70 * @param t a throwable to log -71 */ -72publicvoid log(int level, String message, Throwable t) { -73 Logger.getLogger(Velocity.class.getName()).log(getLevel(level), message, t); -74 } -75 -76/** -77 * Will always return true. The property file will decide what level to log. -78 * -79 * @param level the logging level -80 * @return true -81 */ -82publicboolean isLevelEnabled(int level) { -83returntrue; -84 } -85 -86/** -87 * Maps Velocity log levels to {@link Logger} values. -88 * -89 * @param velocityLevel the logging level -90 * @return the logging level -91 */ -92private Level getLevel(int velocityLevel) { -93switch (velocityLevel) { -94case TRACE_ID: -95return Level.ALL; -96case DEBUG_ID: -97return Level.FINE; -98case INFO_ID: -99return Level.INFO; -100case WARN_ID: -101return Level.WARNING; -102case ERROR_ID: -103return Level.SEVERE; -104default: -105return Level.INFO; -106 } -107 } -108 } +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2013 Steve Springett. All Rights Reserved. +17 */ +18package org.owasp.dependencycheck.reporting; +19 +20import java.util.logging.Level; +21import java.util.logging.Logger; +22import org.apache.velocity.app.Velocity; +23import org.apache.velocity.runtime.RuntimeServices; +24import org.apache.velocity.runtime.log.LogChute; +25 +26/** +27 * <p> +28 * DependencyCheck uses {@link java.util.logging.Logger} as a logging framework, and Apache Velocity uses a custom +29 * logging implementation that outputs to a file named velocity.log by default. This class is an implementation of a +30 * custom Velocity logger that redirects all velocity logging to the Java Logger class. +31 * </p><p> +32 * This class was written to address permission issues when using Dependency-Check in a server environment (such as the +33 * Jenkins plugin). In some circumstances, Velocity would attempt to create velocity.log in an un-writable +34 * directory.</p> +35 * +36 * @author Steve Springett <steve.springett@owasp.org> +37 */ +38publicclassVelocityLoggerRedirectimplements LogChute { +39 +40/** +41 * This will be invoked once by the LogManager. +42 * +43 * @param rsvc the RuntimeServices +44 */ +45publicvoid init(RuntimeServices rsvc) { +46// do nothing +47 } +48 +49/** +50 * Given a Velocity log level and message, this method will call the appropriate Logger level and log the specified +51 * values. +52 * +53 * @param level the logging level +54 * @param message the message to be logged +55 */ +56publicvoid log(int level, String message) { +57 Logger.getLogger(Velocity.class.getName()).log(getLevel(level), message); +58 } +59 +60/** +61 * Given a Velocity log level, message and Throwable, this method will call the appropriate Logger level and log the +62 * specified values. +63 * +64 * @param level the logging level +65 * @param message the message to be logged +66 * @param t a throwable to log +67 */ +68publicvoid log(int level, String message, Throwable t) { +69 Logger.getLogger(Velocity.class.getName()).log(getLevel(level), message, t); +70 } +71 +72/** +73 * Will always return true. The property file will decide what level to log. +74 * +75 * @param level the logging level +76 * @return true +77 */ +78publicboolean isLevelEnabled(int level) { +79returntrue; +80 } +81 +82/** +83 * Maps Velocity log levels to {@link Logger} values. +84 * +85 * @param velocityLevel the logging level +86 * @return the logging level +87 */ +88private Level getLevel(int velocityLevel) { +89switch (velocityLevel) { +90case TRACE_ID: +91return Level.ALL; +92case DEBUG_ID: +93return Level.FINE; +94case INFO_ID: +95return Level.INFO; +96case WARN_ID: +97return Level.WARNING; +98case ERROR_ID: +99return Level.SEVERE; +100default: +101return Level.INFO; +102 } +103 } +104 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/reporting/package-frame.html b/dependency-check-core/xref/org/owasp/dependencycheck/reporting/package-frame.html index 378c63576..945675658 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/reporting/package-frame.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/reporting/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.0.8 Reference Package org.owasp.dependencycheck.reporting + Dependency-Check Core 1.1.0 Reference Package org.owasp.dependencycheck.reporting diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/reporting/package-summary.html b/dependency-check-core/xref/org/owasp/dependencycheck/reporting/package-summary.html index 2e6b59714..efa2fa349 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/reporting/package-summary.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/reporting/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.0.8 Reference Package org.owasp.dependencycheck.reporting + Dependency-Check Core 1.1.0 Reference Package org.owasp.dependencycheck.reporting diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/suppression/PropertyType.html b/dependency-check-core/xref/org/owasp/dependencycheck/suppression/PropertyType.html index 84675f6b6..187b40f1d 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/suppression/PropertyType.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/suppression/PropertyType.html @@ -9,189 +9,186 @@ 1/*2 * This file is part of dependency-check-core.3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2013 Jeremy Long. All Rights Reserved. -18 */ -19package org.owasp.dependencycheck.suppression; -20 -21import java.util.regex.Pattern; -22 -23/** -24 * A simple PropertyType used to represent a string value that could be used as -25 * a regular expression or could be case insensitive. The equals method has been -26 * over-ridden so that the object will correctly compare to strings. -27 * -28 * @author Jeremy Long <jeremy.long@owasp.org> -29 */ -30publicclassPropertyType { -31 -32//<editor-fold defaultstate="collapsed" desc="properties"> -33/** -34 * The value. -35 */ -36private String value; -37 -38/** -39 * Gets the value of the value property. +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2013 Jeremy Long. All Rights Reserved. +17 */ +18package org.owasp.dependencycheck.suppression; +19 +20import java.util.regex.Pattern; +21 +22/** +23 * A simple PropertyType used to represent a string value that could be used as a regular expression or could be case +24 * insensitive. The equals method has been over-ridden so that the object will correctly compare to strings. +25 * +26 * @author Jeremy Long <jeremy.long@owasp.org> +27 */ +28publicclassPropertyType { +29 +30//<editor-fold defaultstate="collapsed" desc="properties"> +31/** +32 * The value. +33 */ +34private String value; +35 +36/** +37 * Gets the value of the value property. +38 * +39 * @return the value of the value property40 * -41 * @return the value of the value property -42 * -43 */ -44public String getValue() { -45return value; -46 } -47 -48/** -49 * Sets the value of the value property. -50 * -51 * @param value the value of the value property -52 */ -53publicvoid setValue(String value) { -54this.value = value; -55 } -56/** -57 * Whether or not the expression is a regex. -58 */ -59privateboolean regex = false; -60 -61/** -62 * Returns whether or not the value is a regex. +41 */ +42public String getValue() { +43return value; +44 } +45 +46/** +47 * Sets the value of the value property. +48 * +49 * @param value the value of the value property +50 */ +51publicvoid setValue(String value) { +52this.value = value; +53 } +54/** +55 * Whether or not the expression is a regex. +56 */ +57privateboolean regex = false; +58 +59/** +60 * Returns whether or not the value is a regex. +61 * +62 * @return true if the value is a regex, otherwise false63 * -64 * @return true if the value is a regex, otherwise false -65 * -66 */ -67publicboolean isRegex() { -68return regex; -69 } -70 -71/** -72 * Sets whether the value property is a regex. +64 */ +65publicboolean isRegex() { +66return regex; +67 } +68 +69/** +70 * Sets whether the value property is a regex. +71 * +72 * @param value true if the value is a regex, otherwise false73 * -74 * @param value true if the value is a regex, otherwise false -75 * -76 */ -77publicvoid setRegex(boolean value) { -78this.regex = value; -79 } -80/** -81 * Indicates case sensitivity. -82 */ -83privateboolean caseSensitive = false; -84 -85/** -86 * Gets the value of the caseSensitive property. +74 */ +75publicvoid setRegex(boolean value) { +76this.regex = value; +77 } +78/** +79 * Indicates case sensitivity. +80 */ +81privateboolean caseSensitive = false; +82 +83/** +84 * Gets the value of the caseSensitive property. +85 * +86 * @return true if the value is case sensitive87 * -88 * @return true if the value is case sensitive -89 * -90 */ -91publicboolean isCaseSensitive() { -92return caseSensitive; -93 } -94 -95/** -96 * Sets the value of the caseSensitive property. +88 */ +89publicboolean isCaseSensitive() { +90return caseSensitive; +91 } +92 +93/** +94 * Sets the value of the caseSensitive property. +95 * +96 * @param value whether the value is case sensitive97 * -98 * @param value whether the value is case sensitive -99 * -100 */ -101publicvoid setCaseSensitive(boolean value) { -102this.caseSensitive = value; -103 } -104//</editor-fold> -105 -106/** -107 * Uses the object's properties to determine if the supplied string matches -108 * the value of this property. -109 * -110 * @param text the String to validate -111 * @return whether the text supplied is matched by the value of the property -112 */ -113publicboolean matches(String text) { -114if (text == null) { -115return false; -116 } -117if (this.regex) { -118 Pattern rx; -119if (this.caseSensitive) { -120 rx = Pattern.compile(this.value); -121 } else { -122 rx = Pattern.compile(this.value, Pattern.CASE_INSENSITIVE); -123 } -124return rx.matcher(text).matches(); -125 } else { -126if (this.caseSensitive) { -127return value.equals(text); -128 } else { -129return value.equalsIgnoreCase(text); -130 } -131 } -132 } -133 -134//<editor-fold defaultstate="collapsed" desc="standard implementations of hashCode, equals, and toString"> -135/** -136 * Default implementation of hashCode. -137 * -138 * @return the hash code -139 */ -140 @Override -141publicint hashCode() { -142int hash = 3; -143 hash = 59 * hash + (this.value != null ? this.value.hashCode() : 0); -144 hash = 59 * hash + (this.regex ? 1 : 0); -145 hash = 59 * hash + (this.caseSensitive ? 1 : 0); -146return hash; -147 } -148 -149/** -150 * Default implementation of equals. -151 * -152 * @param obj the object to compare -153 * @return whether the objects are equivalent -154 */ -155 @Override -156publicboolean equals(Object obj) { -157if (obj == null) { +98 */ +99publicvoid setCaseSensitive(boolean value) { +100this.caseSensitive = value; +101 } +102//</editor-fold> +103 +104/** +105 * Uses the object's properties to determine if the supplied string matches the value of this property. +106 * +107 * @param text the String to validate +108 * @return whether the text supplied is matched by the value of the property +109 */ +110publicboolean matches(String text) { +111if (text == null) { +112return false; +113 } +114if (this.regex) { +115 Pattern rx; +116if (this.caseSensitive) { +117 rx = Pattern.compile(this.value); +118 } else { +119 rx = Pattern.compile(this.value, Pattern.CASE_INSENSITIVE); +120 } +121return rx.matcher(text).matches(); +122 } else { +123if (this.caseSensitive) { +124return value.equals(text); +125 } else { +126return value.equalsIgnoreCase(text); +127 } +128 } +129 } +130 +131//<editor-fold defaultstate="collapsed" desc="standard implementations of hashCode, equals, and toString"> +132/** +133 * Default implementation of hashCode. +134 * +135 * @return the hash code +136 */ +137 @Override +138publicint hashCode() { +139int hash = 3; +140 hash = 59 * hash + (this.value != null ? this.value.hashCode() : 0); +141 hash = 59 * hash + (this.regex ? 1 : 0); +142 hash = 59 * hash + (this.caseSensitive ? 1 : 0); +143return hash; +144 } +145 +146/** +147 * Default implementation of equals. +148 * +149 * @param obj the object to compare +150 * @return whether the objects are equivalent +151 */ +152 @Override +153publicboolean equals(Object obj) { +154if (obj == null) { +155return false; +156 } +157if (getClass() != obj.getClass()) { 158return false; 159 } -160if (getClass() != obj.getClass()) { -161return false; -162 } -163finalPropertyType other = (PropertyType) obj; -164if ((this.value == null) ? (other.value != null) : !this.value.equals(other.value)) { +160finalPropertyType other = (PropertyType) obj; +161if ((this.value == null) ? (other.value != null) : !this.value.equals(other.value)) { +162return false; +163 } +164if (this.regex != other.regex) { 165return false; 166 } -167if (this.regex != other.regex) { +167if (this.caseSensitive != other.caseSensitive) { 168return false; 169 } -170if (this.caseSensitive != other.caseSensitive) { -171return false; -172 } -173returntrue; -174 } -175 -176/** -177 * Default implementation of toString(). -178 * -179 * @return the string representation of the object -180 */ -181 @Override -182public String toString() { -183return"PropertyType{" + "value=" + value + ", regex=" + regex + ", caseSensitive=" + caseSensitive + '}'; -184 } -185//</editor-fold> -186 } +170returntrue; +171 } +172 +173/** +174 * Default implementation of toString(). +175 * +176 * @return the string representation of the object +177 */ +178 @Override +179public String toString() { +180return"PropertyType{" + "value=" + value + ", regex=" + regex + ", caseSensitive=" + caseSensitive + '}'; +181 } +182//</editor-fold> +183 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/suppression/SuppressionErrorHandler.html b/dependency-check-core/xref/org/owasp/dependencycheck/suppression/SuppressionErrorHandler.html index 2dd59e5e6..4ba714c43 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/suppression/SuppressionErrorHandler.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/suppression/SuppressionErrorHandler.html @@ -9,96 +9,95 @@ 1/*2 * This file is part of dependency-check-core.3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2013 Jeremy Long. All Rights Reserved. -18 */ -19package org.owasp.dependencycheck.suppression; -20 -21import java.util.logging.Level; -22import java.util.logging.Logger; -23import org.xml.sax.ErrorHandler; -24import org.xml.sax.SAXException; -25import org.xml.sax.SAXParseException; -26 -27/** -28 * An XML parsing error handler. -29 * -30 * @author Jeremy Long <jeremy.long@owasp.org> -31 */ -32publicclassSuppressionErrorHandlerimplements ErrorHandler { -33 -34/** -35 * Builds a prettier exception message. -36 * -37 * @param ex the SAXParseException -38 * @return an easier to read exception message -39 */ -40private String getPrettyParseExceptionInfo(SAXParseException ex) { -41 -42final StringBuilder sb = new StringBuilder(); -43 -44if (ex.getSystemId() != null) { -45 sb.append("systemId=").append(ex.getSystemId()).append(", "); -46 } -47if (ex.getPublicId() != null) { -48 sb.append("publicId=").append(ex.getPublicId()).append(", "); -49 } -50if (ex.getLineNumber() > 0) { -51 sb.append("Line=").append(ex.getLineNumber()); -52 } -53if (ex.getColumnNumber() > 0) { -54 sb.append(", Column=").append(ex.getColumnNumber()); -55 } -56 sb.append(": ").append(ex.getMessage()); -57 -58return sb.toString(); -59 } -60 -61/** -62 * Logs warnings. -63 * -64 * @param ex the warning to log -65 * @throws SAXException is never thrown -66 */ -67 @Override -68publicvoid warning(SAXParseException ex) throws SAXException { -69 Logger.getLogger(SuppressionErrorHandler.class.getName()).log(Level.FINE, null, ex); -70 } -71 -72/** -73 * Handles errors. -74 * -75 * @param ex the error to handle -76 * @throws SAXException is always thrown -77 */ -78 @Override -79publicvoid error(SAXParseException ex) throws SAXException { -80thrownew SAXException(getPrettyParseExceptionInfo(ex)); -81 } -82 -83/** -84 * Handles fatal exceptions. -85 * -86 * @param ex a fatal exception -87 * @throws SAXException is always -88 */ -89 @Override -90publicvoid fatalError(SAXParseException ex) throws SAXException { -91thrownew SAXException(getPrettyParseExceptionInfo(ex)); -92 } -93 } +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2013 Jeremy Long. All Rights Reserved. +17 */ +18package org.owasp.dependencycheck.suppression; +19 +20import java.util.logging.Level; +21import java.util.logging.Logger; +22import org.xml.sax.ErrorHandler; +23import org.xml.sax.SAXException; +24import org.xml.sax.SAXParseException; +25 +26/** +27 * An XML parsing error handler. +28 * +29 * @author Jeremy Long <jeremy.long@owasp.org> +30 */ +31publicclassSuppressionErrorHandlerimplements ErrorHandler { +32 +33/** +34 * Builds a prettier exception message. +35 * +36 * @param ex the SAXParseException +37 * @return an easier to read exception message +38 */ +39private String getPrettyParseExceptionInfo(SAXParseException ex) { +40 +41final StringBuilder sb = new StringBuilder(); +42 +43if (ex.getSystemId() != null) { +44 sb.append("systemId=").append(ex.getSystemId()).append(", "); +45 } +46if (ex.getPublicId() != null) { +47 sb.append("publicId=").append(ex.getPublicId()).append(", "); +48 } +49if (ex.getLineNumber() > 0) { +50 sb.append("Line=").append(ex.getLineNumber()); +51 } +52if (ex.getColumnNumber() > 0) { +53 sb.append(", Column=").append(ex.getColumnNumber()); +54 } +55 sb.append(": ").append(ex.getMessage()); +56 +57return sb.toString(); +58 } +59 +60/** +61 * Logs warnings. +62 * +63 * @param ex the warning to log +64 * @throws SAXException is never thrown +65 */ +66 @Override +67publicvoid warning(SAXParseException ex) throws SAXException { +68 Logger.getLogger(SuppressionErrorHandler.class.getName()).log(Level.FINE, null, ex); +69 } +70 +71/** +72 * Handles errors. +73 * +74 * @param ex the error to handle +75 * @throws SAXException is always thrown +76 */ +77 @Override +78publicvoid error(SAXParseException ex) throws SAXException { +79thrownew SAXException(getPrettyParseExceptionInfo(ex)); +80 } +81 +82/** +83 * Handles fatal exceptions. +84 * +85 * @param ex a fatal exception +86 * @throws SAXException is always +87 */ +88 @Override +89publicvoid fatalError(SAXParseException ex) throws SAXException { +90thrownew SAXException(getPrettyParseExceptionInfo(ex)); +91 } +92 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/suppression/SuppressionHandler.html b/dependency-check-core/xref/org/owasp/dependencycheck/suppression/SuppressionHandler.html index 90ec55942..dce67bb91 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/suppression/SuppressionHandler.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/suppression/SuppressionHandler.html @@ -9,177 +9,176 @@ 1/*2 * This file is part of dependency-check-core.3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2013 Jeremy Long. All Rights Reserved. -18 */ -19package org.owasp.dependencycheck.suppression; -20 -21import java.util.ArrayList; -22import java.util.List; -23import org.xml.sax.Attributes; -24import org.xml.sax.SAXException; -25import org.xml.sax.helpers.DefaultHandler; -26 -27/** -28 * A handler to load suppression rules. -29 * -30 * @author Jeremy Long <jeremy.long@owasp.org> -31 */ -32publicclassSuppressionHandlerextends DefaultHandler { -33 -34/** -35 * The suppress node, indicates the start of a new rule. -36 */ -37publicstaticfinal String SUPPRESS = "suppress"; -38/** -39 * The file path element name. -40 */ -41publicstaticfinal String FILE_PATH = "filePath"; -42/** -43 * The sha1 hash element name. -44 */ -45publicstaticfinal String SHA1 = "sha1"; -46/** -47 * The CVE element name. -48 */ -49publicstaticfinal String CVE = "cve"; -50/** -51 * The CPE element name. -52 */ -53publicstaticfinal String CPE = "cpe"; -54/** -55 * The CWE element name. -56 */ -57publicstaticfinal String CWE = "cwe"; -58/** -59 * The cvssBelow element name. -60 */ -61publicstaticfinal String CVSS_BELOW = "cvssBelow"; -62/** -63 * A list of suppression rules. -64 */ -65private List<SuppressionRule> suppressionRules = new ArrayList<SuppressionRule>(); -66 -67/** -68 * Get the value of suppressionRules. -69 * -70 * @return the value of suppressionRules -71 */ -72public List<SuppressionRule> getSuppressionRules() { -73return suppressionRules; -74 } -75/** -76 * The current rule being read. -77 */ -78privateSuppressionRule rule; -79/** -80 * The attributes of the node being read. -81 */ -82private Attributes currentAttributes; -83/** -84 * The current node text being extracted from the element. -85 */ -86private StringBuffer currentText; -87 -88/** -89 * Handles the start element event. -90 * -91 * @param uri the uri of the element being processed -92 * @param localName the local name of the element being processed -93 * @param qName the qName of the element being processed -94 * @param attributes the attributes of the element being processed -95 * @throws SAXException thrown if there is an exception processing -96 */ -97 @Override -98publicvoid startElement(String uri, String localName, String qName, Attributes attributes) throws SAXException { -99 currentAttributes = null; -100 currentText = new StringBuffer(); -101 -102if (SUPPRESS.equals(qName)) { -103 rule = newSuppressionRule(); -104 } elseif (FILE_PATH.equals(qName)) { -105 currentAttributes = attributes; -106 } -107 } -108 -109/** -110 * Handles the end element event. -111 * -112 * @param uri the URI of the element -113 * @param localName the local name of the element -114 * @param qName the qName of the element -115 * @throws SAXException thrown if there is an exception processing -116 */ -117 @Override -118publicvoid endElement(String uri, String localName, String qName) throws SAXException { -119if (SUPPRESS.equals(qName)) { -120 suppressionRules.add(rule); -121 rule = null; -122 } elseif (FILE_PATH.equals(qName)) { -123finalPropertyType pt = processPropertyType(); -124 rule.setFilePath(pt); -125 } elseif (SHA1.equals(qName)) { -126 rule.setSha1(currentText.toString()); -127 } elseif (CPE.equals(qName)) { -128finalPropertyType pt = processPropertyType(); -129 rule.addCpe(pt); -130 } elseif (CWE.equals(qName)) { -131 rule.addCwe(currentText.toString()); -132 } elseif (CVE.equals(qName)) { -133 rule.addCve(currentText.toString()); -134 } elseif (CVSS_BELOW.equals(qName)) { -135finalfloat cvss = Float.parseFloat(currentText.toString()); -136 rule.addCvssBelow(cvss); -137 } -138 } -139 -140/** -141 * Collects the body text of the node being processed. -142 * -143 * @param ch the char array of text -144 * @param start the start position to copy text from in the char array -145 * @param length the number of characters to copy from the char array -146 * @throws SAXException thrown if there is a parsing exception -147 */ -148 @Override -149publicvoid characters(char[] ch, int start, int length) throws SAXException { -150 currentText.append(ch, start, length); -151 } -152 -153/** -154 * Processes field members that have been collected during the characters and startElement method to construct a -155 * PropertyType object. -156 * -157 * @return a PropertyType object -158 */ -159privatePropertyType processPropertyType() { -160finalPropertyType pt = newPropertyType(); -161 pt.setValue(currentText.toString()); -162if (currentAttributes != null && currentAttributes.getLength() > 0) { -163final String regex = currentAttributes.getValue("regex"); -164if (regex != null) { -165 pt.setRegex(Boolean.parseBoolean(regex)); -166 } -167final String caseSensitive = currentAttributes.getValue("caseSensitive"); -168if (regex != null) { -169 pt.setCaseSensitive(Boolean.parseBoolean(caseSensitive)); -170 } -171 } -172return pt; -173 } -174 } +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2013 Jeremy Long. All Rights Reserved. +17 */ +18package org.owasp.dependencycheck.suppression; +19 +20import java.util.ArrayList; +21import java.util.List; +22import org.xml.sax.Attributes; +23import org.xml.sax.SAXException; +24import org.xml.sax.helpers.DefaultHandler; +25 +26/** +27 * A handler to load suppression rules. +28 * +29 * @author Jeremy Long <jeremy.long@owasp.org> +30 */ +31publicclassSuppressionHandlerextends DefaultHandler { +32 +33/** +34 * The suppress node, indicates the start of a new rule. +35 */ +36publicstaticfinal String SUPPRESS = "suppress"; +37/** +38 * The file path element name. +39 */ +40publicstaticfinal String FILE_PATH = "filePath"; +41/** +42 * The sha1 hash element name. +43 */ +44publicstaticfinal String SHA1 = "sha1"; +45/** +46 * The CVE element name. +47 */ +48publicstaticfinal String CVE = "cve"; +49/** +50 * The CPE element name. +51 */ +52publicstaticfinal String CPE = "cpe"; +53/** +54 * The CWE element name. +55 */ +56publicstaticfinal String CWE = "cwe"; +57/** +58 * The cvssBelow element name. +59 */ +60publicstaticfinal String CVSS_BELOW = "cvssBelow"; +61/** +62 * A list of suppression rules. +63 */ +64private List<SuppressionRule> suppressionRules = new ArrayList<SuppressionRule>(); +65 +66/** +67 * Get the value of suppressionRules. +68 * +69 * @return the value of suppressionRules +70 */ +71public List<SuppressionRule> getSuppressionRules() { +72return suppressionRules; +73 } +74/** +75 * The current rule being read. +76 */ +77privateSuppressionRule rule; +78/** +79 * The attributes of the node being read. +80 */ +81private Attributes currentAttributes; +82/** +83 * The current node text being extracted from the element. +84 */ +85private StringBuffer currentText; +86 +87/** +88 * Handles the start element event. +89 * +90 * @param uri the uri of the element being processed +91 * @param localName the local name of the element being processed +92 * @param qName the qName of the element being processed +93 * @param attributes the attributes of the element being processed +94 * @throws SAXException thrown if there is an exception processing +95 */ +96 @Override +97publicvoid startElement(String uri, String localName, String qName, Attributes attributes) throws SAXException { +98 currentAttributes = null; +99 currentText = new StringBuffer(); +100 +101if (SUPPRESS.equals(qName)) { +102 rule = newSuppressionRule(); +103 } elseif (FILE_PATH.equals(qName)) { +104 currentAttributes = attributes; +105 } +106 } +107 +108/** +109 * Handles the end element event. +110 * +111 * @param uri the URI of the element +112 * @param localName the local name of the element +113 * @param qName the qName of the element +114 * @throws SAXException thrown if there is an exception processing +115 */ +116 @Override +117publicvoid endElement(String uri, String localName, String qName) throws SAXException { +118if (SUPPRESS.equals(qName)) { +119 suppressionRules.add(rule); +120 rule = null; +121 } elseif (FILE_PATH.equals(qName)) { +122finalPropertyType pt = processPropertyType(); +123 rule.setFilePath(pt); +124 } elseif (SHA1.equals(qName)) { +125 rule.setSha1(currentText.toString()); +126 } elseif (CPE.equals(qName)) { +127finalPropertyType pt = processPropertyType(); +128 rule.addCpe(pt); +129 } elseif (CWE.equals(qName)) { +130 rule.addCwe(currentText.toString()); +131 } elseif (CVE.equals(qName)) { +132 rule.addCve(currentText.toString()); +133 } elseif (CVSS_BELOW.equals(qName)) { +134finalfloat cvss = Float.parseFloat(currentText.toString()); +135 rule.addCvssBelow(cvss); +136 } +137 } +138 +139/** +140 * Collects the body text of the node being processed. +141 * +142 * @param ch the char array of text +143 * @param start the start position to copy text from in the char array +144 * @param length the number of characters to copy from the char array +145 * @throws SAXException thrown if there is a parsing exception +146 */ +147 @Override +148publicvoid characters(char[] ch, int start, int length) throws SAXException { +149 currentText.append(ch, start, length); +150 } +151 +152/** +153 * Processes field members that have been collected during the characters and startElement method to construct a +154 * PropertyType object. +155 * +156 * @return a PropertyType object +157 */ +158privatePropertyType processPropertyType() { +159finalPropertyType pt = newPropertyType(); +160 pt.setValue(currentText.toString()); +161if (currentAttributes != null && currentAttributes.getLength() > 0) { +162final String regex = currentAttributes.getValue("regex"); +163if (regex != null) { +164 pt.setRegex(Boolean.parseBoolean(regex)); +165 } +166final String caseSensitive = currentAttributes.getValue("caseSensitive"); +167if (regex != null) { +168 pt.setCaseSensitive(Boolean.parseBoolean(caseSensitive)); +169 } +170 } +171return pt; +172 } +173 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/suppression/SuppressionParseException.html b/dependency-check-core/xref/org/owasp/dependencycheck/suppression/SuppressionParseException.html index 215a2777b..98f2a279f 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/suppression/SuppressionParseException.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/suppression/SuppressionParseException.html @@ -9,72 +9,71 @@ 1/*2 * This file is part of dependency-check-core.3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2013 Jeremy Long. All Rights Reserved. -18 */ -19package org.owasp.dependencycheck.suppression; -20 -21import java.io.IOException; -22 -23/** -24 * An exception used when parsing a suppression rule file fails. -25 * -26 * @author Jeremy Long <jeremy.long@owasp.org> -27 */ -28publicclassSuppressionParseExceptionextends IOException { -29 -30/** -31 * The serial version UID. -32 */ -33privatestaticfinallong serialVersionUID = 1L; -34 -35/** -36 * Creates a new SuppressionParseException. -37 */ -38publicSuppressionParseException() { -39super(); -40 } -41 -42/** -43 * Creates a new SuppressionParseException. -44 * -45 * @param msg a message for the exception. -46 */ -47publicSuppressionParseException(String msg) { -48super(msg); -49 } -50 -51/** -52 * Creates a new SuppressionParseException. -53 * -54 * @param ex the cause of the download failure. -55 */ -56publicSuppressionParseException(Throwable ex) { -57super(ex); -58 } -59 -60/** -61 * Creates a new SuppressionParseException. -62 * -63 * @param msg a message for the exception. -64 * @param ex the cause of the download failure. -65 */ -66publicSuppressionParseException(String msg, Throwable ex) { -67super(msg, ex); -68 } -69 } +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2013 Jeremy Long. All Rights Reserved. +17 */ +18package org.owasp.dependencycheck.suppression; +19 +20import java.io.IOException; +21 +22/** +23 * An exception used when parsing a suppression rule file fails. +24 * +25 * @author Jeremy Long <jeremy.long@owasp.org> +26 */ +27publicclassSuppressionParseExceptionextends IOException { +28 +29/** +30 * The serial version UID. +31 */ +32privatestaticfinallong serialVersionUID = 1L; +33 +34/** +35 * Creates a new SuppressionParseException. +36 */ +37publicSuppressionParseException() { +38super(); +39 } +40 +41/** +42 * Creates a new SuppressionParseException. +43 * +44 * @param msg a message for the exception. +45 */ +46publicSuppressionParseException(String msg) { +47super(msg); +48 } +49 +50/** +51 * Creates a new SuppressionParseException. +52 * +53 * @param ex the cause of the download failure. +54 */ +55publicSuppressionParseException(Throwable ex) { +56super(ex); +57 } +58 +59/** +60 * Creates a new SuppressionParseException. +61 * +62 * @param msg a message for the exception. +63 * @param ex the cause of the download failure. +64 */ +65publicSuppressionParseException(String msg, Throwable ex) { +66super(msg, ex); +67 } +68 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/suppression/SuppressionParser.html b/dependency-check-core/xref/org/owasp/dependencycheck/suppression/SuppressionParser.html index d9686e946..a78c848e3 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/suppression/SuppressionParser.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/suppression/SuppressionParser.html @@ -9,105 +9,104 @@ 1/*2 * This file is part of dependency-check-core.3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2013 Jeremy Long. All Rights Reserved. -18 */ -19package org.owasp.dependencycheck.suppression; -20 -21import java.io.File; -22import java.io.FileInputStream; -23import java.io.FileNotFoundException; -24import java.io.IOException; -25import java.io.InputStream; -26import java.io.InputStreamReader; -27import java.io.Reader; -28import java.util.List; -29import java.util.logging.Level; -30import java.util.logging.Logger; -31import javax.xml.parsers.ParserConfigurationException; -32import javax.xml.parsers.SAXParser; -33import javax.xml.parsers.SAXParserFactory; -34import org.xml.sax.InputSource; -35import org.xml.sax.SAXException; -36import org.xml.sax.XMLReader; -37 -38/** -39 * A simple validating parser for XML Suppression Rules. -40 * -41 * @author Jeremy Long <jeremy.long@owasp.org> -42 */ -43publicclassSuppressionParser { -44 -45/** -46 * JAXP Schema Language. Source: http://docs.oracle.com/javase/tutorial/jaxp/sax/validation.html -47 */ -48publicstaticfinal String JAXP_SCHEMA_LANGUAGE = "http://java.sun.com/xml/jaxp/properties/schemaLanguage"; -49/** -50 * W3C XML Schema. Source: http://docs.oracle.com/javase/tutorial/jaxp/sax/validation.html -51 */ -52publicstaticfinal String W3C_XML_SCHEMA = "http://www.w3.org/2001/XMLSchema"; -53/** -54 * JAXP Schema Source. Source: http://docs.oracle.com/javase/tutorial/jaxp/sax/validation.html -55 */ -56publicstaticfinal String JAXP_SCHEMA_SOURCE = "http://java.sun.com/xml/jaxp/properties/schemaSource"; -57 -58/** -59 * Parses the given xml file and returns a list of the suppression rules contained. -60 * -61 * @param file an xml file containing suppression rules -62 * @return a list of suppression rules -63 * @throws SuppressionParseException thrown if the xml file cannot be parsed -64 */ -65public List<SuppressionRule> parseSuppressionRules(File file) throws SuppressionParseException { -66try { -67final InputStream schemaStream = this.getClass().getClassLoader().getResourceAsStream("schema/suppression.xsd"); -68finalSuppressionHandler handler = newSuppressionHandler(); -69 -70final SAXParserFactory factory = SAXParserFactory.newInstance(); -71 factory.setNamespaceAware(true); -72 factory.setValidating(true); -73final SAXParser saxParser = factory.newSAXParser(); -74 saxParser.setProperty(SuppressionParser.JAXP_SCHEMA_LANGUAGE, SuppressionParser.W3C_XML_SCHEMA); -75 saxParser.setProperty(SuppressionParser.JAXP_SCHEMA_SOURCE, new InputSource(schemaStream)); -76final XMLReader xmlReader = saxParser.getXMLReader(); -77 xmlReader.setErrorHandler(newSuppressionErrorHandler()); -78 xmlReader.setContentHandler(handler); -79 -80final InputStream inputStream = new FileInputStream(file); -81final Reader reader = new InputStreamReader(inputStream, "UTF-8"); -82final InputSource in = new InputSource(reader); -83//in.setEncoding("UTF-8"); -84 -85 xmlReader.parse(in); -86 -87return handler.getSuppressionRules(); -88 } catch (ParserConfigurationException ex) { -89 Logger.getLogger(SuppressionParser.class.getName()).log(Level.FINE, null, ex); -90thrownewSuppressionParseException(ex); -91 } catch (SAXException ex) { -92 Logger.getLogger(SuppressionParser.class.getName()).log(Level.FINE, null, ex); -93thrownewSuppressionParseException(ex); -94 } catch (FileNotFoundException ex) { -95 Logger.getLogger(SuppressionParser.class.getName()).log(Level.FINE, null, ex); -96thrownewSuppressionParseException(ex); -97 } catch (IOException ex) { -98 Logger.getLogger(SuppressionParser.class.getName()).log(Level.FINE, null, ex); -99thrownewSuppressionParseException(ex); -100 } -101 } -102 } +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2013 Jeremy Long. All Rights Reserved. +17 */ +18package org.owasp.dependencycheck.suppression; +19 +20import java.io.File; +21import java.io.FileInputStream; +22import java.io.FileNotFoundException; +23import java.io.IOException; +24import java.io.InputStream; +25import java.io.InputStreamReader; +26import java.io.Reader; +27import java.util.List; +28import java.util.logging.Level; +29import java.util.logging.Logger; +30import javax.xml.parsers.ParserConfigurationException; +31import javax.xml.parsers.SAXParser; +32import javax.xml.parsers.SAXParserFactory; +33import org.xml.sax.InputSource; +34import org.xml.sax.SAXException; +35import org.xml.sax.XMLReader; +36 +37/** +38 * A simple validating parser for XML Suppression Rules. +39 * +40 * @author Jeremy Long <jeremy.long@owasp.org> +41 */ +42publicclassSuppressionParser { +43 +44/** +45 * JAXP Schema Language. Source: http://docs.oracle.com/javase/tutorial/jaxp/sax/validation.html +46 */ +47publicstaticfinal String JAXP_SCHEMA_LANGUAGE = "http://java.sun.com/xml/jaxp/properties/schemaLanguage"; +48/** +49 * W3C XML Schema. Source: http://docs.oracle.com/javase/tutorial/jaxp/sax/validation.html +50 */ +51publicstaticfinal String W3C_XML_SCHEMA = "http://www.w3.org/2001/XMLSchema"; +52/** +53 * JAXP Schema Source. Source: http://docs.oracle.com/javase/tutorial/jaxp/sax/validation.html +54 */ +55publicstaticfinal String JAXP_SCHEMA_SOURCE = "http://java.sun.com/xml/jaxp/properties/schemaSource"; +56 +57/** +58 * Parses the given xml file and returns a list of the suppression rules contained. +59 * +60 * @param file an xml file containing suppression rules +61 * @return a list of suppression rules +62 * @throws SuppressionParseException thrown if the xml file cannot be parsed +63 */ +64public List<SuppressionRule> parseSuppressionRules(File file) throws SuppressionParseException { +65try { +66final InputStream schemaStream = this.getClass().getClassLoader().getResourceAsStream("schema/suppression.xsd"); +67finalSuppressionHandler handler = newSuppressionHandler(); +68 +69final SAXParserFactory factory = SAXParserFactory.newInstance(); +70 factory.setNamespaceAware(true); +71 factory.setValidating(true); +72final SAXParser saxParser = factory.newSAXParser(); +73 saxParser.setProperty(SuppressionParser.JAXP_SCHEMA_LANGUAGE, SuppressionParser.W3C_XML_SCHEMA); +74 saxParser.setProperty(SuppressionParser.JAXP_SCHEMA_SOURCE, new InputSource(schemaStream)); +75final XMLReader xmlReader = saxParser.getXMLReader(); +76 xmlReader.setErrorHandler(newSuppressionErrorHandler()); +77 xmlReader.setContentHandler(handler); +78 +79final InputStream inputStream = new FileInputStream(file); +80final Reader reader = new InputStreamReader(inputStream, "UTF-8"); +81final InputSource in = new InputSource(reader); +82//in.setEncoding("UTF-8"); +83 +84 xmlReader.parse(in); +85 +86return handler.getSuppressionRules(); +87 } catch (ParserConfigurationException ex) { +88 Logger.getLogger(SuppressionParser.class.getName()).log(Level.FINE, null, ex); +89thrownewSuppressionParseException(ex); +90 } catch (SAXException ex) { +91 Logger.getLogger(SuppressionParser.class.getName()).log(Level.FINE, null, ex); +92thrownewSuppressionParseException(ex); +93 } catch (FileNotFoundException ex) { +94 Logger.getLogger(SuppressionParser.class.getName()).log(Level.FINE, null, ex); +95thrownewSuppressionParseException(ex); +96 } catch (IOException ex) { +97 Logger.getLogger(SuppressionParser.class.getName()).log(Level.FINE, null, ex); +98thrownewSuppressionParseException(ex); +99 } +100 } +101 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/suppression/SuppressionRule.html b/dependency-check-core/xref/org/owasp/dependencycheck/suppression/SuppressionRule.html index d6e37d2c9..14341b4ab 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/suppression/SuppressionRule.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/suppression/SuppressionRule.html @@ -9,368 +9,362 @@ 1/*2 * This file is part of dependency-check-core.3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2013 Jeremy Long. All Rights Reserved. -18 */ -19package org.owasp.dependencycheck.suppression; -20 -21import java.util.ArrayList; -22import java.util.Iterator; -23import java.util.List; -24import org.owasp.dependencycheck.dependency.Dependency; -25import org.owasp.dependencycheck.dependency.Identifier; -26import org.owasp.dependencycheck.dependency.Vulnerability; -27 -28/** -29 * -30 * @author Jeremy Long <jeremy.long@owasp.org> -31 */ -32publicclassSuppressionRule { -33 -34/** -35 * The file path for the suppression. -36 */ -37privatePropertyType filePath; -38 -39/** -40 * Get the value of filePath. -41 * -42 * @return the value of filePath -43 */ -44publicPropertyType getFilePath() { -45return filePath; -46 } -47 -48/** -49 * Set the value of filePath. -50 * -51 * @param filePath new value of filePath -52 */ -53publicvoid setFilePath(PropertyType filePath) { -54this.filePath = filePath; -55 } -56/** -57 * The sha1 hash. -58 */ -59private String sha1; -60 -61/** -62 * Get the value of sha1. -63 * -64 * @return the value of sha1 -65 */ -66public String getSha1() { -67return sha1; -68 } -69 -70/** -71 * Set the value of sha1. -72 * -73 * @param sha1 new value of sha1 -74 */ -75publicvoid setSha1(String sha1) { -76this.sha1 = sha1; -77 } -78/** -79 * A list of CPEs to suppression -80 */ -81private List<PropertyType> cpe = new ArrayList<PropertyType>(); -82 -83/** -84 * Get the value of cpe. -85 * -86 * @return the value of cpe -87 */ -88public List<PropertyType> getCpe() { -89return cpe; -90 } -91 -92/** -93 * Set the value of cpe. -94 * -95 * @param cpe new value of cpe -96 */ -97publicvoid setCpe(List<PropertyType> cpe) { -98this.cpe = cpe; -99 } -100 -101/** -102 * Adds the cpe to the cpe list. -103 * -104 * @param cpe the cpe to add -105 */ -106publicvoid addCpe(PropertyType cpe) { -107this.cpe.add(cpe); -108 } -109 -110/** -111 * Returns whether or not this suppression rule as CPE entries. -112 * -113 * @return whether or not this suppression rule as CPE entries -114 */ -115publicboolean hasCpe() { -116return cpe.size() > 0; -117 } -118/** -119 * The list of cvssBelow scores. -120 */ -121private List<Float> cvssBelow = new ArrayList<Float>(); -122 -123/** -124 * Get the value of cvssBelow. -125 * -126 * @return the value of cvssBelow -127 */ -128public List<Float> getCvssBelow() { -129return cvssBelow; -130 } -131 -132/** -133 * Set the value of cvssBelow. -134 * -135 * @param cvssBelow new value of cvssBelow -136 */ -137publicvoid setCvssBelow(List<Float> cvssBelow) { -138this.cvssBelow = cvssBelow; -139 } -140 -141/** -142 * Adds the cvss to the cvssBelow list. -143 * -144 * @param cvss the cvss to add -145 */ -146publicvoid addCvssBelow(Float cvss) { -147this.cvssBelow.add(cvss); -148 } -149 -150/** -151 * Returns whether or not this suppression rule has cvss suppressions. -152 * -153 * @return whether or not this suppression rule has cvss suppressions -154 */ -155publicboolean hasCvssBelow() { -156return cvssBelow.size() > 0; -157 } -158/** -159 * The list of cwe entries to suppress. -160 */ -161private List<String> cwe = new ArrayList<String>(); -162 -163/** -164 * Get the value of cwe. -165 * -166 * @return the value of cwe -167 */ -168public List<String> getCwe() { -169return cwe; -170 } -171 -172/** -173 * Set the value of cwe. -174 * -175 * @param cwe new value of cwe -176 */ -177publicvoid setCwe(List<String> cwe) { -178this.cwe = cwe; -179 } -180 -181/** -182 * Adds the cwe to the cwe list. -183 * -184 * @param cwe the cwe to add -185 */ -186publicvoid addCwe(String cwe) { -187this.cwe.add(cwe); -188 } -189 -190/** -191 * Returns whether this suppression rule has CWE entries. -192 * -193 * @return whether this suppression rule has CWE entries -194 */ -195publicboolean hasCwe() { -196return cwe.size() > 0; -197 } -198/** -199 * The list of cve entries to suppress. -200 */ -201private List<String> cve = new ArrayList<String>(); -202 -203/** -204 * Get the value of cve. -205 * -206 * @return the value of cve -207 */ -208public List<String> getCve() { -209return cve; -210 } -211 -212/** -213 * Set the value of cve. -214 * -215 * @param cve new value of cve -216 */ -217publicvoid setCve(List<String> cve) { -218this.cve = cve; -219 } -220 -221/** -222 * Adds the cve to the cve list. -223 * -224 * @param cve the cve to add -225 */ -226publicvoid addCve(String cve) { -227this.cve.add(cve); -228 } -229 -230/** -231 * Returns whether this suppression rule has CVE entries. -232 * -233 * @return whether this suppression rule has CVE entries -234 */ -235publicboolean hasCve() { -236return cve.size() > 0; -237 } -238 -239/** -240 * Processes a given dependency to determine if any CPE, CVE, CWE, or CVSS -241 * scores should be suppressed. If any should be, they are removed from the -242 * dependency. -243 * -244 * @param dependency a project dependency to analyze -245 */ -246publicvoid process(Dependency dependency) { -247if (filePath != null && !filePath.matches(dependency.getFilePath())) { -248return; -249 } -250if (sha1 != null && !sha1.equalsIgnoreCase(dependency.getSha1sum())) { -251return; -252 } -253if (this.hasCpe()) { -254final Iterator<Identifier> itr = dependency.getIdentifiers().iterator(); -255while (itr.hasNext()) { -256finalIdentifier i = itr.next(); -257for (PropertyType c : this.cpe) { -258if (cpeMatches(c, i)) { -259 itr.remove(); -260break; -261 } -262 } -263 } -264 } -265if (hasCve() || hasCwe() || hasCvssBelow()) { -266final Iterator<Vulnerability> itr = dependency.getVulnerabilities().iterator(); -267while (itr.hasNext()) { -268boolean remove = false; -269finalVulnerability v = itr.next(); -270for (String entry : this.cve) { -271if (entry.equalsIgnoreCase(v.getName())) { -272 remove = true; -273break; -274 } -275 } -276if (!remove) { -277for (String entry : this.cwe) { -278if (v.getCwe() != null) { -279final String toMatch = String.format("CWE-%s ", entry); -280final String toTest = v.getCwe().substring(0, toMatch.length()).toUpperCase(); -281if (toTest.equals(toMatch)) { -282 remove = true; -283break; -284 } -285 } -286 } -287 } -288if (!remove) { -289for (float cvss : this.cvssBelow) { -290if (v.getCvssScore() < cvss) { -291 remove = true; -292break; -293 } -294 } -295 } -296if (remove) { -297 itr.remove(); -298 } -299 } -300 } -301 } -302 -303/** -304 * Identifies if the cpe specified by the cpe suppression rule does not -305 * specify a version. -306 * -307 * @param c a suppression rule identifier -308 * @return true if the property type does not specify a version; otherwise -309 * false -310 */ -311boolean cpeHasNoVersion(PropertyType c) { -312if (c.isRegex()) { -313return false; -314 } // cpe:/a:jboss:jboss:1.0.0: -315if (countCharacter(c.getValue(), ':') == 3) { -316returntrue; -317 } -318return false; -319 } -320 -321/** -322 * Counts the number of occurrences of the character found within the -323 * string. -324 * -325 * @param str the string to check -326 * @param c the character to count -327 * @return the number of times the character is found in the string -328 */ -329int countCharacter(String str, char c) { -330int count = 0; -331int pos = str.indexOf(c) + 1; -332while (pos > 0) { -333 count += 1; -334 pos = str.indexOf(c, pos) + 1; -335 } -336return count; -337 } -338 -339/** -340 * Determines if the cpeEntry specified as a PropertyType matches the given -341 * Identifier. -342 * -343 * @param cpeEntry a suppression rule entry -344 * @param identifier a CPE identifier to check -345 * @return true if the entry matches; otherwise false -346 */ -347boolean cpeMatches(PropertyType cpeEntry, Identifier identifier) { -348if (cpeEntry.matches(identifier.getValue())) { -349returntrue; -350 } elseif (cpeHasNoVersion(cpeEntry)) { -351if (cpeEntry.isCaseSensitive()) { -352if (identifier.getValue().startsWith(cpeEntry.getValue())) { +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2013 Jeremy Long. All Rights Reserved. +17 */ +18package org.owasp.dependencycheck.suppression; +19 +20import java.util.ArrayList; +21import java.util.Iterator; +22import java.util.List; +23import org.owasp.dependencycheck.dependency.Dependency; +24import org.owasp.dependencycheck.dependency.Identifier; +25import org.owasp.dependencycheck.dependency.Vulnerability; +26 +27/** +28 * +29 * @author Jeremy Long <jeremy.long@owasp.org> +30 */ +31publicclassSuppressionRule { +32 +33/** +34 * The file path for the suppression. +35 */ +36privatePropertyType filePath; +37 +38/** +39 * Get the value of filePath. +40 * +41 * @return the value of filePath +42 */ +43publicPropertyType getFilePath() { +44return filePath; +45 } +46 +47/** +48 * Set the value of filePath. +49 * +50 * @param filePath new value of filePath +51 */ +52publicvoid setFilePath(PropertyType filePath) { +53this.filePath = filePath; +54 } +55/** +56 * The sha1 hash. +57 */ +58private String sha1; +59 +60/** +61 * Get the value of sha1. +62 * +63 * @return the value of sha1 +64 */ +65public String getSha1() { +66return sha1; +67 } +68 +69/** +70 * Set the value of sha1. +71 * +72 * @param sha1 new value of sha1 +73 */ +74publicvoid setSha1(String sha1) { +75this.sha1 = sha1; +76 } +77/** +78 * A list of CPEs to suppression +79 */ +80private List<PropertyType> cpe = new ArrayList<PropertyType>(); +81 +82/** +83 * Get the value of cpe. +84 * +85 * @return the value of cpe +86 */ +87public List<PropertyType> getCpe() { +88return cpe; +89 } +90 +91/** +92 * Set the value of cpe. +93 * +94 * @param cpe new value of cpe +95 */ +96publicvoid setCpe(List<PropertyType> cpe) { +97this.cpe = cpe; +98 } +99 +100/** +101 * Adds the cpe to the cpe list. +102 * +103 * @param cpe the cpe to add +104 */ +105publicvoid addCpe(PropertyType cpe) { +106this.cpe.add(cpe); +107 } +108 +109/** +110 * Returns whether or not this suppression rule as CPE entries. +111 * +112 * @return whether or not this suppression rule as CPE entries +113 */ +114publicboolean hasCpe() { +115return cpe.size() > 0; +116 } +117/** +118 * The list of cvssBelow scores. +119 */ +120private List<Float> cvssBelow = new ArrayList<Float>(); +121 +122/** +123 * Get the value of cvssBelow. +124 * +125 * @return the value of cvssBelow +126 */ +127public List<Float> getCvssBelow() { +128return cvssBelow; +129 } +130 +131/** +132 * Set the value of cvssBelow. +133 * +134 * @param cvssBelow new value of cvssBelow +135 */ +136publicvoid setCvssBelow(List<Float> cvssBelow) { +137this.cvssBelow = cvssBelow; +138 } +139 +140/** +141 * Adds the cvss to the cvssBelow list. +142 * +143 * @param cvss the cvss to add +144 */ +145publicvoid addCvssBelow(Float cvss) { +146this.cvssBelow.add(cvss); +147 } +148 +149/** +150 * Returns whether or not this suppression rule has cvss suppressions. +151 * +152 * @return whether or not this suppression rule has cvss suppressions +153 */ +154publicboolean hasCvssBelow() { +155return cvssBelow.size() > 0; +156 } +157/** +158 * The list of cwe entries to suppress. +159 */ +160private List<String> cwe = new ArrayList<String>(); +161 +162/** +163 * Get the value of cwe. +164 * +165 * @return the value of cwe +166 */ +167public List<String> getCwe() { +168return cwe; +169 } +170 +171/** +172 * Set the value of cwe. +173 * +174 * @param cwe new value of cwe +175 */ +176publicvoid setCwe(List<String> cwe) { +177this.cwe = cwe; +178 } +179 +180/** +181 * Adds the cwe to the cwe list. +182 * +183 * @param cwe the cwe to add +184 */ +185publicvoid addCwe(String cwe) { +186this.cwe.add(cwe); +187 } +188 +189/** +190 * Returns whether this suppression rule has CWE entries. +191 * +192 * @return whether this suppression rule has CWE entries +193 */ +194publicboolean hasCwe() { +195return cwe.size() > 0; +196 } +197/** +198 * The list of cve entries to suppress. +199 */ +200private List<String> cve = new ArrayList<String>(); +201 +202/** +203 * Get the value of cve. +204 * +205 * @return the value of cve +206 */ +207public List<String> getCve() { +208return cve; +209 } +210 +211/** +212 * Set the value of cve. +213 * +214 * @param cve new value of cve +215 */ +216publicvoid setCve(List<String> cve) { +217this.cve = cve; +218 } +219 +220/** +221 * Adds the cve to the cve list. +222 * +223 * @param cve the cve to add +224 */ +225publicvoid addCve(String cve) { +226this.cve.add(cve); +227 } +228 +229/** +230 * Returns whether this suppression rule has CVE entries. +231 * +232 * @return whether this suppression rule has CVE entries +233 */ +234publicboolean hasCve() { +235return cve.size() > 0; +236 } +237 +238/** +239 * Processes a given dependency to determine if any CPE, CVE, CWE, or CVSS scores should be suppressed. If any +240 * should be, they are removed from the dependency. +241 * +242 * @param dependency a project dependency to analyze +243 */ +244publicvoid process(Dependency dependency) { +245if (filePath != null && !filePath.matches(dependency.getFilePath())) { +246return; +247 } +248if (sha1 != null && !sha1.equalsIgnoreCase(dependency.getSha1sum())) { +249return; +250 } +251if (this.hasCpe()) { +252final Iterator<Identifier> itr = dependency.getIdentifiers().iterator(); +253while (itr.hasNext()) { +254finalIdentifier i = itr.next(); +255for (PropertyType c : this.cpe) { +256if (cpeMatches(c, i)) { +257 itr.remove(); +258break; +259 } +260 } +261 } +262 } +263if (hasCve() || hasCwe() || hasCvssBelow()) { +264final Iterator<Vulnerability> itr = dependency.getVulnerabilities().iterator(); +265while (itr.hasNext()) { +266boolean remove = false; +267finalVulnerability v = itr.next(); +268for (String entry : this.cve) { +269if (entry.equalsIgnoreCase(v.getName())) { +270 remove = true; +271break; +272 } +273 } +274if (!remove) { +275for (String entry : this.cwe) { +276if (v.getCwe() != null) { +277final String toMatch = String.format("CWE-%s ", entry); +278final String toTest = v.getCwe().substring(0, toMatch.length()).toUpperCase(); +279if (toTest.equals(toMatch)) { +280 remove = true; +281break; +282 } +283 } +284 } +285 } +286if (!remove) { +287for (float cvss : this.cvssBelow) { +288if (v.getCvssScore() < cvss) { +289 remove = true; +290break; +291 } +292 } +293 } +294if (remove) { +295 itr.remove(); +296 } +297 } +298 } +299 } +300 +301/** +302 * Identifies if the cpe specified by the cpe suppression rule does not specify a version. +303 * +304 * @param c a suppression rule identifier +305 * @return true if the property type does not specify a version; otherwise false +306 */ +307boolean cpeHasNoVersion(PropertyType c) { +308if (c.isRegex()) { +309return false; +310 } // cpe:/a:jboss:jboss:1.0.0: +311if (countCharacter(c.getValue(), ':') == 3) { +312returntrue; +313 } +314return false; +315 } +316 +317/** +318 * Counts the number of occurrences of the character found within the string. +319 * +320 * @param str the string to check +321 * @param c the character to count +322 * @return the number of times the character is found in the string +323 */ +324int countCharacter(String str, char c) { +325int count = 0; +326int pos = str.indexOf(c) + 1; +327while (pos > 0) { +328 count += 1; +329 pos = str.indexOf(c, pos) + 1; +330 } +331return count; +332 } +333 +334/** +335 * Determines if the cpeEntry specified as a PropertyType matches the given Identifier. +336 * +337 * @param cpeEntry a suppression rule entry +338 * @param identifier a CPE identifier to check +339 * @return true if the entry matches; otherwise false +340 */ +341boolean cpeMatches(PropertyType cpeEntry, Identifier identifier) { +342if (cpeEntry.matches(identifier.getValue())) { +343returntrue; +344 } elseif (cpeHasNoVersion(cpeEntry)) { +345if (cpeEntry.isCaseSensitive()) { +346if (identifier.getValue().startsWith(cpeEntry.getValue())) { +347returntrue; +348 } +349 } else { +350final String id = identifier.getValue().toLowerCase(); +351final String check = cpeEntry.getValue().toLowerCase(); +352if (id.startsWith(check)) { 353returntrue; 354 } -355 } else { -356final String id = identifier.getValue().toLowerCase(); -357final String check = cpeEntry.getValue().toLowerCase(); -358if (id.startsWith(check)) { -359returntrue; -360 } -361 } -362 } -363return false; -364 } -365 } +355 } +356 } +357return false; +358 } +359 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/suppression/package-frame.html b/dependency-check-core/xref/org/owasp/dependencycheck/suppression/package-frame.html index b4718605b..45cabce5a 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/suppression/package-frame.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/suppression/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.0.8 Reference Package org.owasp.dependencycheck.suppression + Dependency-Check Core 1.1.0 Reference Package org.owasp.dependencycheck.suppression diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/suppression/package-summary.html b/dependency-check-core/xref/org/owasp/dependencycheck/suppression/package-summary.html index e942a246d..5cef1e123 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/suppression/package-summary.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/suppression/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.0.8 Reference Package org.owasp.dependencycheck.suppression + Dependency-Check Core 1.1.0 Reference Package org.owasp.dependencycheck.suppression diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/utils/DBUtils.html b/dependency-check-core/xref/org/owasp/dependencycheck/utils/DBUtils.html index bfbf4b05c..b7575ea98 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/utils/DBUtils.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/utils/DBUtils.html @@ -9,100 +9,97 @@ 1/*2 * This file is part of dependency-check-core.3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2013 Jeremy Long. All Rights Reserved. -18 */ -19package org.owasp.dependencycheck.utils; -20 -21import java.sql.PreparedStatement; -22import java.sql.ResultSet; -23import java.sql.SQLException; -24import java.sql.Statement; -25import java.util.logging.Level; -26import java.util.logging.Logger; -27import org.owasp.dependencycheck.data.nvdcve.CveDB; -28import org.owasp.dependencycheck.data.nvdcve.DatabaseException; -29 -30/** -31 * -32 * @author Jeremy Long <jeremy.long@owasp.org> -33 */ -34publicfinalclassDBUtils { -35 -36/** -37 * Private constructor for a utility class. -38 */ -39privateDBUtils() { -40 } -41 -42/** -43 * Returns the generated integer primary key for a newly inserted row. -44 * -45 * @param statement a prepared statement that just executed an insert -46 * @return a primary key -47 * @throws DatabaseException thrown if there is an exception obtaining the -48 * key -49 */ -50publicstaticint getGeneratedKey(PreparedStatement statement) throws DatabaseException { -51 ResultSet rs = null; -52int id = 0; -53try { -54 rs = statement.getGeneratedKeys(); -55 rs.next(); -56 id = rs.getInt(1); -57 } catch (SQLException ex) { -58thrownewDatabaseException("Unable to get primary key for inserted row"); -59 } finally { -60 closeResultSet(rs); -61 } -62return id; -63 } -64 -65/** -66 * Closes the given statement object ignoring any exceptions that occur. -67 * -68 * @param statement a Statement object -69 */ -70publicstaticvoid closeStatement(Statement statement) { -71if (statement != null) { -72try { -73 statement.close(); -74 } catch (SQLException ex) { -75 Logger.getLogger(CveDB.class -76 .getName()).log(Level.FINEST, statement.toString(), ex); -77 } -78 } -79 } -80 -81/** -82 * Closes the result set capturing and ignoring any SQLExceptions that -83 * occur. -84 * -85 * @param rs a ResultSet to close -86 */ -87publicstaticvoid closeResultSet(ResultSet rs) { -88if (rs != null) { -89try { -90 rs.close(); -91 } catch (SQLException ex) { -92 Logger.getLogger(CveDB.class -93 .getName()).log(Level.FINEST, rs.toString(), ex); -94 } -95 } -96 } -97 } +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2013 Jeremy Long. All Rights Reserved. +17 */ +18package org.owasp.dependencycheck.utils; +19 +20import java.sql.PreparedStatement; +21import java.sql.ResultSet; +22import java.sql.SQLException; +23import java.sql.Statement; +24import java.util.logging.Level; +25import java.util.logging.Logger; +26import org.owasp.dependencycheck.data.nvdcve.CveDB; +27import org.owasp.dependencycheck.data.nvdcve.DatabaseException; +28 +29/** +30 * +31 * @author Jeremy Long <jeremy.long@owasp.org> +32 */ +33publicfinalclassDBUtils { +34 +35/** +36 * Private constructor for a utility class. +37 */ +38privateDBUtils() { +39 } +40 +41/** +42 * Returns the generated integer primary key for a newly inserted row. +43 * +44 * @param statement a prepared statement that just executed an insert +45 * @return a primary key +46 * @throws DatabaseException thrown if there is an exception obtaining the key +47 */ +48publicstaticint getGeneratedKey(PreparedStatement statement) throws DatabaseException { +49 ResultSet rs = null; +50int id = 0; +51try { +52 rs = statement.getGeneratedKeys(); +53 rs.next(); +54 id = rs.getInt(1); +55 } catch (SQLException ex) { +56thrownewDatabaseException("Unable to get primary key for inserted row"); +57 } finally { +58 closeResultSet(rs); +59 } +60return id; +61 } +62 +63/** +64 * Closes the given statement object ignoring any exceptions that occur. +65 * +66 * @param statement a Statement object +67 */ +68publicstaticvoid closeStatement(Statement statement) { +69if (statement != null) { +70try { +71 statement.close(); +72 } catch (SQLException ex) { +73 Logger.getLogger(CveDB.class +74 .getName()).log(Level.FINEST, statement.toString(), ex); +75 } +76 } +77 } +78 +79/** +80 * Closes the result set capturing and ignoring any SQLExceptions that occur. +81 * +82 * @param rs a ResultSet to close +83 */ +84publicstaticvoid closeResultSet(ResultSet rs) { +85if (rs != null) { +86try { +87 rs.close(); +88 } catch (SQLException ex) { +89 Logger.getLogger(CveDB.class +90 .getName()).log(Level.FINEST, rs.toString(), ex); +91 } +92 } +93 } +94 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/utils/DependencyVersion.html b/dependency-check-core/xref/org/owasp/dependencycheck/utils/DependencyVersion.html index 32313dee5..04802b2bd 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/utils/DependencyVersion.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/utils/DependencyVersion.html @@ -9,258 +9,254 @@ 1/*2 * This file is part of dependency-check-core.3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2013 Jeremy Long. All Rights Reserved. -18 */ -19package org.owasp.dependencycheck.utils; -20 -21import java.util.ArrayList; -22import java.util.Iterator; -23import java.util.List; -24import java.util.regex.Matcher; -25import java.util.regex.Pattern; -26import org.apache.commons.lang.StringUtils; -27 -28/** -29 * <p>Simple object to track the parts of a version number. The parts are -30 * contained in a List such that version 1.2.3 will be stored as: -31 * <code>versionParts[0] = 1; -32 * versionParts[1] = 2; -33 * versionParts[2] = 3; -34 * </code></p> -35 * <p>Note, the parser contained in this class expects the version numbers to be -36 * separated by periods. If a different separator is used the parser will likely -37 * fail.</p> -38 * -39 * @author Jeremy Long <jeremy.long@owasp.org> -40 */ -41publicclassDependencyVersionimplements Iterable, Comparable<DependencyVersion> { -42 -43/** -44 * Constructor for a empty DependencyVersion. -45 */ -46publicDependencyVersion() { -47 } -48 -49/** -50 * Constructor for a DependencyVersion that will parse a version string. -51 * <b>Note</b>, this should only be used when the version passed in is -52 * already known to be a well formated version number. Otherwise, -53 * DependencyVersionUtil.parseVersion() should be used instead. -54 * -55 * @param version the well formated version number to parse -56 */ -57publicDependencyVersion(String version) { -58 parseVersion(version); -59 } -60 -61/** -62 * Parses a version string into its sub parts: major, minor, revision, -63 * build, etc. <b>Note</b>, this should only be used to parse something that -64 * is already known to be a version number. -65 * -66 * @param version the version string to parse -67 */ -68publicfinalvoid parseVersion(String version) { -69 versionParts = new ArrayList<String>(); -70if (version != null) { -71final Pattern rx = Pattern.compile("(\\d+|[a-z]+\\d+|(release|beta|alpha)$)"); -72final Matcher matcher = rx.matcher(version.toLowerCase()); -73while (matcher.find()) { -74 versionParts.add(matcher.group()); +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2013 Jeremy Long. All Rights Reserved. +17 */ +18package org.owasp.dependencycheck.utils; +19 +20import java.util.ArrayList; +21import java.util.Iterator; +22import java.util.List; +23import java.util.regex.Matcher; +24import java.util.regex.Pattern; +25import org.apache.commons.lang.StringUtils; +26 +27/** +28 * <p> +29 * Simple object to track the parts of a version number. The parts are contained in a List such that version 1.2.3 will +30 * be stored as: <code>versionParts[0] = 1; +31 * versionParts[1] = 2; +32 * versionParts[2] = 3; +33 * </code></p> +34 * <p> +35 * Note, the parser contained in this class expects the version numbers to be separated by periods. If a different +36 * separator is used the parser will likely fail.</p> +37 * +38 * @author Jeremy Long <jeremy.long@owasp.org> +39 */ +40publicclassDependencyVersionimplements Iterable, Comparable<DependencyVersion> { +41 +42/** +43 * Constructor for a empty DependencyVersion. +44 */ +45publicDependencyVersion() { +46 } +47 +48/** +49 * Constructor for a DependencyVersion that will parse a version string. +50 * <b>Note</b>, this should only be used when the version passed in is already known to be a well formated version +51 * number. Otherwise, DependencyVersionUtil.parseVersion() should be used instead. +52 * +53 * @param version the well formated version number to parse +54 */ +55publicDependencyVersion(String version) { +56 parseVersion(version); +57 } +58 +59/** +60 * Parses a version string into its sub parts: major, minor, revision, build, etc. <b>Note</b>, this should only be +61 * used to parse something that is already known to be a version number. +62 * +63 * @param version the version string to parse +64 */ +65publicfinalvoid parseVersion(String version) { +66 versionParts = new ArrayList<String>(); +67if (version != null) { +68final Pattern rx = Pattern.compile("(\\d+|[a-z]+\\d+|(release|beta|alpha)$)"); +69final Matcher matcher = rx.matcher(version.toLowerCase()); +70while (matcher.find()) { +71 versionParts.add(matcher.group()); +72 } +73if (versionParts.isEmpty()) { +74 versionParts.add(version); 75 } -76if (versionParts.isEmpty()) { -77 versionParts.add(version); -78 } -79 } -80 } -81/** -82 * A list of the version parts. -83 */ -84private List<String> versionParts; -85 -86/** -87 * Get the value of versionParts. -88 * -89 * @return the value of versionParts -90 */ -91public List<String> getVersionParts() { -92return versionParts; -93 } -94 -95/** -96 * Set the value of versionParts. -97 * -98 * @param versionParts new value of versionParts -99 */ -100publicvoid setVersionParts(List<String> versionParts) { -101this.versionParts = versionParts; -102 } -103 -104/** -105 * Retrieves an iterator for the version parts. -106 * -107 * @return an iterator for the version parts -108 */ -109public Iterator iterator() { -110return versionParts.iterator(); -111 } -112 -113/** -114 * Reconstructs the version string from the split version parts. -115 * -116 * @return a string representing the version. -117 */ -118 @Override -119public String toString() { -120return StringUtils.join(versionParts.toArray(), "."); -121 } -122 -123/** -124 * Compares the equality of this object to the one passed in as a parameter. -125 * -126 * @param obj the object to compare equality -127 * @return returns true only if the two objects are equal, otherwise false -128 */ -129 @Override -130publicboolean equals(Object obj) { -131if (obj == null) { +76 } +77 } +78/** +79 * A list of the version parts. +80 */ +81private List<String> versionParts; +82 +83/** +84 * Get the value of versionParts. +85 * +86 * @return the value of versionParts +87 */ +88public List<String> getVersionParts() { +89return versionParts; +90 } +91 +92/** +93 * Set the value of versionParts. +94 * +95 * @param versionParts new value of versionParts +96 */ +97publicvoid setVersionParts(List<String> versionParts) { +98this.versionParts = versionParts; +99 } +100 +101/** +102 * Retrieves an iterator for the version parts. +103 * +104 * @return an iterator for the version parts +105 */ +106public Iterator iterator() { +107return versionParts.iterator(); +108 } +109 +110/** +111 * Reconstructs the version string from the split version parts. +112 * +113 * @return a string representing the version. +114 */ +115 @Override +116public String toString() { +117return StringUtils.join(versionParts.toArray(), "."); +118 } +119 +120/** +121 * Compares the equality of this object to the one passed in as a parameter. +122 * +123 * @param obj the object to compare equality +124 * @return returns true only if the two objects are equal, otherwise false +125 */ +126 @Override +127publicboolean equals(Object obj) { +128if (obj == null) { +129return false; +130 } +131if (getClass() != obj.getClass()) { 132return false; 133 } -134if (getClass() != obj.getClass()) { -135return false; -136 } -137finalDependencyVersion other = (DependencyVersion) obj; -138finalint max = (this.versionParts.size() < other.versionParts.size()) -139 ? this.versionParts.size() : other.versionParts.size(); -140//TODO steal better version of code from compareTo -141for (int i = 0; i < max; i++) { -142final String thisPart = this.versionParts.get(i); -143final String otherPart = other.versionParts.get(i); -144if (!thisPart.equals(otherPart)) { -145return false; -146 } -147 } -148if (this.versionParts.size() > max) { -149for (int i = max; i < this.versionParts.size(); i++) { -150if (!"0".equals(this.versionParts.get(i))) { -151return false; -152 } -153 } -154 } -155 -156if (other.versionParts.size() > max) { -157for (int i = max; i < other.versionParts.size(); i++) { -158if (!"0".equals(other.versionParts.get(i))) { -159return false; -160 } -161 } -162 } -163 -164/* -165 * if (this.versionParts != other.versionParts && (this.versionParts == null || !this.versionParts.equals(other.versionParts))) { -166 * return false; -167 * } -168 */ -169returntrue; -170 } -171 -172/** -173 * Calculates the hashCode for this object. -174 * -175 * @return the hashCode -176 */ -177 @Override -178publicint hashCode() { -179int hash = 5; -180 hash = 71 * hash + (this.versionParts != null ? this.versionParts.hashCode() : 0); -181return hash; -182 } -183 -184/** -185 * Determines if the three most major major version parts are identical. For -186 * instances, if version 1.2.3.4 was compared to 1.2.3 this function would -187 * return true. -188 * -189 * @param version the version number to compare -190 * @return true if the first three major parts of the version are identical -191 */ -192publicboolean matchesAtLeastThreeLevels(DependencyVersion version) { -193if (version == null) { -194return false; -195 } +134finalDependencyVersion other = (DependencyVersion) obj; +135finalint max = (this.versionParts.size() < other.versionParts.size()) +136 ? this.versionParts.size() : other.versionParts.size(); +137//TODO steal better version of code from compareTo +138for (int i = 0; i < max; i++) { +139final String thisPart = this.versionParts.get(i); +140final String otherPart = other.versionParts.get(i); +141if (!thisPart.equals(otherPart)) { +142return false; +143 } +144 } +145if (this.versionParts.size() > max) { +146for (int i = max; i < this.versionParts.size(); i++) { +147if (!"0".equals(this.versionParts.get(i))) { +148return false; +149 } +150 } +151 } +152 +153if (other.versionParts.size() > max) { +154for (int i = max; i < other.versionParts.size(); i++) { +155if (!"0".equals(other.versionParts.get(i))) { +156return false; +157 } +158 } +159 } +160 +161/* +162 * if (this.versionParts != other.versionParts && (this.versionParts == null || !this.versionParts.equals(other.versionParts))) { +163 * return false; +164 * } +165 */ +166returntrue; +167 } +168 +169/** +170 * Calculates the hashCode for this object. +171 * +172 * @return the hashCode +173 */ +174 @Override +175publicint hashCode() { +176int hash = 5; +177 hash = 71 * hash + (this.versionParts != null ? this.versionParts.hashCode() : 0); +178return hash; +179 } +180 +181/** +182 * Determines if the three most major major version parts are identical. For instances, if version 1.2.3.4 was +183 * compared to 1.2.3 this function would return true. +184 * +185 * @param version the version number to compare +186 * @return true if the first three major parts of the version are identical +187 */ +188publicboolean matchesAtLeastThreeLevels(DependencyVersion version) { +189if (version == null) { +190return false; +191 } +192 +193boolean ret = true; +194int max = (this.versionParts.size() < version.versionParts.size()) +195 ? this.versionParts.size() : version.versionParts.size(); 196 -197boolean ret = true; -198int max = (this.versionParts.size() < version.versionParts.size()) -199 ? this.versionParts.size() : version.versionParts.size(); +197if (max > 3) { +198 max = 3; +199 } 200 -201if (max > 3) { -202 max = 3; -203 } -204 -205for (int i = 0; i < max; i++) { -206if (this.versionParts.get(i) == null || !this.versionParts.get(i).equals(version.versionParts.get(i))) { -207 ret = false; -208break; -209 } -210 } -211 -212return ret; -213 } -214 -215 @Override -216publicint compareTo(DependencyVersion version) { -217if (version == null) { -218return 1; -219 } -220final List<String> left = this.getVersionParts(); -221final List<String> right = version.getVersionParts(); -222finalint max = left.size() < right.size() ? left.size() : right.size(); -223 -224for (int i = 0; i < max; i++) { -225final String lStr = left.get(i); -226final String rStr = right.get(i); -227if (lStr.equals(rStr)) { -228continue; -229 } -230try { -231finalint l = Integer.parseInt(lStr); -232finalint r = Integer.parseInt(rStr); -233if (l < r) { -234return -1; -235 } elseif (l > r) { -236return 1; -237 } -238 } catch (NumberFormatException ex) { -239finalint comp = left.get(i).compareTo(right.get(i)); -240if (comp < 0) { -241return -1; -242 } elseif (comp > 0) { -243return 1; -244 } -245 } -246 } -247if (left.size() < right.size()) { -248return -1; -249 } elseif (left.size() > right.size()) { -250return 1; -251 } else { -252return 0; -253 } -254 } -255 } +201for (int i = 0; i < max; i++) { +202if (this.versionParts.get(i) == null || !this.versionParts.get(i).equals(version.versionParts.get(i))) { +203 ret = false; +204break; +205 } +206 } +207 +208return ret; +209 } +210 +211 @Override +212publicint compareTo(DependencyVersion version) { +213if (version == null) { +214return 1; +215 } +216final List<String> left = this.getVersionParts(); +217final List<String> right = version.getVersionParts(); +218finalint max = left.size() < right.size() ? left.size() : right.size(); +219 +220for (int i = 0; i < max; i++) { +221final String lStr = left.get(i); +222final String rStr = right.get(i); +223if (lStr.equals(rStr)) { +224continue; +225 } +226try { +227finalint l = Integer.parseInt(lStr); +228finalint r = Integer.parseInt(rStr); +229if (l < r) { +230return -1; +231 } elseif (l > r) { +232return 1; +233 } +234 } catch (NumberFormatException ex) { +235finalint comp = left.get(i).compareTo(right.get(i)); +236if (comp < 0) { +237return -1; +238 } elseif (comp > 0) { +239return 1; +240 } +241 } +242 } +243if (left.size() < right.size()) { +244return -1; +245 } elseif (left.size() > right.size()) { +246return 1; +247 } else { +248return 0; +249 } +250 } +251 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/utils/DependencyVersionUtil.html b/dependency-check-core/xref/org/owasp/dependencycheck/utils/DependencyVersionUtil.html index 91094d17d..246742c98 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/utils/DependencyVersionUtil.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/utils/DependencyVersionUtil.html @@ -9,98 +9,96 @@ 1/*2 * This file is part of dependency-check-core.3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2013 Jeremy Long. All Rights Reserved. -18 */ -19package org.owasp.dependencycheck.utils; -20 -21import java.util.ArrayList; -22import java.util.regex.Matcher; -23import java.util.regex.Pattern; -24 -25/** -26 * <p>A utility class to extract version numbers from file names (or other -27 * strings containing version numbers.</p> -28 * -29 * @author Jeremy Long <jeremy.long@owasp.org> -30 */ -31publicfinalclassDependencyVersionUtil { -32 -33/** -34 * Regular expression to extract version numbers from file names. -35 */ -36privatestaticfinal Pattern RX_VERSION = Pattern.compile("\\d+(\\.\\d{1,6})+(\\.?([_-](release|beta|alpha)|[a-zA-Z_-]{1,3}\\d{1,8}))?"); -37/** -38 * Regular expression to extract a single version number without periods. -39 * This is a last ditch effort just to check in case we are missing a -40 * version number using the previous regex. -41 */ -42privatestaticfinal Pattern RX_SINGLE_VERSION = Pattern.compile("\\d+(\\.?([_-](release|beta|alpha)|[a-zA-Z_-]{1,3}\\d{1,8}))?"); -43 -44/** -45 * Private constructor for utility class. -46 */ -47privateDependencyVersionUtil() { -48 } -49 -50/** -51 * <p>A utility class to extract version numbers from file names (or other -52 * strings containing version numbers.<br/> -53 * Example:<br/> -54 * Give the file name: library-name-1.4.1r2-release.jar<br/> -55 * This function would return: 1.4.1.r2</p> -56 * -57 * @param text the text being analyzed -58 * @return a DependencyVersion containing the version -59 */ -60publicstaticDependencyVersion parseVersion(String text) { -61if (text == null) { -62returnnull; -63 } -64//'-' is a special case used within the CVE entries, just include it as the version. -65if ("-".equals(text)) { -66finalDependencyVersion dv = newDependencyVersion(); -67final ArrayList<String> list = new ArrayList<String>(); -68 list.add(text); -69 dv.setVersionParts(list); -70return dv; -71 } -72 String version = null; -73 Matcher matcher = RX_VERSION.matcher(text); -74if (matcher.find()) { -75 version = matcher.group(); -76 } -77//throw away the results if there are two things that look like version numbers -78if (matcher.find()) { -79returnnull; -80 } -81if (version == null) { -82 matcher = RX_SINGLE_VERSION.matcher(text); -83if (matcher.find()) { -84 version = matcher.group(); -85 } else { -86returnnull; -87 } -88//throw away the results if there are two things that look like version numbers -89if (matcher.find()) { -90returnnull; -91 } -92 } -93returnnewDependencyVersion(version); -94 } -95 } +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2013 Jeremy Long. All Rights Reserved. +17 */ +18package org.owasp.dependencycheck.utils; +19 +20import java.util.ArrayList; +21import java.util.regex.Matcher; +22import java.util.regex.Pattern; +23 +24/** +25 * <p> +26 * A utility class to extract version numbers from file names (or other strings containing version numbers.</p> +27 * +28 * @author Jeremy Long <jeremy.long@owasp.org> +29 */ +30publicfinalclassDependencyVersionUtil { +31 +32/** +33 * Regular expression to extract version numbers from file names. +34 */ +35privatestaticfinal Pattern RX_VERSION = Pattern.compile("\\d+(\\.\\d{1,6})+(\\.?([_-](release|beta|alpha)|[a-zA-Z_-]{1,3}\\d{1,8}))?"); +36/** +37 * Regular expression to extract a single version number without periods. This is a last ditch effort just to check +38 * in case we are missing a version number using the previous regex. +39 */ +40privatestaticfinal Pattern RX_SINGLE_VERSION = Pattern.compile("\\d+(\\.?([_-](release|beta|alpha)|[a-zA-Z_-]{1,3}\\d{1,8}))?"); +41 +42/** +43 * Private constructor for utility class. +44 */ +45privateDependencyVersionUtil() { +46 } +47 +48/** +49 * <p> +50 * A utility class to extract version numbers from file names (or other strings containing version numbers.<br/> +51 * Example:<br/> +52 * Give the file name: library-name-1.4.1r2-release.jar<br/> +53 * This function would return: 1.4.1.r2</p> +54 * +55 * @param text the text being analyzed +56 * @return a DependencyVersion containing the version +57 */ +58publicstaticDependencyVersion parseVersion(String text) { +59if (text == null) { +60returnnull; +61 } +62//'-' is a special case used within the CVE entries, just include it as the version. +63if ("-".equals(text)) { +64finalDependencyVersion dv = newDependencyVersion(); +65final ArrayList<String> list = new ArrayList<String>(); +66 list.add(text); +67 dv.setVersionParts(list); +68return dv; +69 } +70 String version = null; +71 Matcher matcher = RX_VERSION.matcher(text); +72if (matcher.find()) { +73 version = matcher.group(); +74 } +75//throw away the results if there are two things that look like version numbers +76if (matcher.find()) { +77returnnull; +78 } +79if (version == null) { +80 matcher = RX_SINGLE_VERSION.matcher(text); +81if (matcher.find()) { +82 version = matcher.group(); +83 } else { +84returnnull; +85 } +86//throw away the results if there are two things that look like version numbers +87if (matcher.find()) { +88returnnull; +89 } +90 } +91returnnewDependencyVersion(version); +92 } +93 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/utils/DownloadFailedException.html b/dependency-check-core/xref/org/owasp/dependencycheck/utils/DownloadFailedException.html index c5e27bf17..fcca2f49d 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/utils/DownloadFailedException.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/utils/DownloadFailedException.html @@ -9,72 +9,71 @@ 1/*2 * This file is part of dependency-check-core.3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. -18 */ -19package org.owasp.dependencycheck.utils; -20 -21import java.io.IOException; -22 -23/** -24 * An exception used when a download fails. -25 * -26 * @author Jeremy Long <jeremy.long@owasp.org> -27 */ -28publicclassDownloadFailedExceptionextends IOException { -29 -30/** -31 * The serial version UID. -32 */ -33privatestaticfinallong serialVersionUID = 1L; -34 -35/** -36 * Creates a new DownloadFailedException. -37 */ -38publicDownloadFailedException() { -39super(); -40 } -41 -42/** -43 * Creates a new DownloadFailedException. -44 * -45 * @param msg a message for the exception. -46 */ -47publicDownloadFailedException(String msg) { -48super(msg); -49 } -50 -51/** -52 * Creates a new DownloadFailedException. -53 * -54 * @param ex the cause of the download failure. -55 */ -56publicDownloadFailedException(Throwable ex) { -57super(ex); -58 } -59 -60/** -61 * Creates a new DownloadFailedException. -62 * -63 * @param msg a message for the exception. -64 * @param ex the cause of the download failure. -65 */ -66publicDownloadFailedException(String msg, Throwable ex) { -67super(msg, ex); -68 } -69 } +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. +17 */ +18package org.owasp.dependencycheck.utils; +19 +20import java.io.IOException; +21 +22/** +23 * An exception used when a download fails. +24 * +25 * @author Jeremy Long <jeremy.long@owasp.org> +26 */ +27publicclassDownloadFailedExceptionextends IOException { +28 +29/** +30 * The serial version UID. +31 */ +32privatestaticfinallong serialVersionUID = 1L; +33 +34/** +35 * Creates a new DownloadFailedException. +36 */ +37publicDownloadFailedException() { +38super(); +39 } +40 +41/** +42 * Creates a new DownloadFailedException. +43 * +44 * @param msg a message for the exception. +45 */ +46publicDownloadFailedException(String msg) { +47super(msg); +48 } +49 +50/** +51 * Creates a new DownloadFailedException. +52 * +53 * @param ex the cause of the download failure. +54 */ +55publicDownloadFailedException(Throwable ex) { +56super(ex); +57 } +58 +59/** +60 * Creates a new DownloadFailedException. +61 * +62 * @param msg a message for the exception. +63 * @param ex the cause of the download failure. +64 */ +65publicDownloadFailedException(String msg, Throwable ex) { +66super(msg, ex); +67 } +68 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/utils/Downloader.html b/dependency-check-core/xref/org/owasp/dependencycheck/utils/Downloader.html index 369ea9e14..ad317b379 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/utils/Downloader.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/utils/Downloader.html @@ -9,230 +9,225 @@ 1/*2 * This file is part of dependency-check-core.3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. -18 */ -19package org.owasp.dependencycheck.utils; -20 -21import java.io.BufferedOutputStream; -22import java.io.File; -23import java.io.FileOutputStream; -24import java.io.IOException; -25import java.io.InputStream; -26import java.net.Authenticator; -27import java.net.HttpURLConnection; -28import java.net.InetSocketAddress; -29import java.net.PasswordAuthentication; -30import java.net.Proxy; -31import java.net.SocketAddress; -32import java.net.URISyntaxException; -33import java.net.URL; -34import java.util.logging.Level; -35import java.util.logging.Logger; -36import java.util.zip.GZIPInputStream; -37import java.util.zip.InflaterInputStream; -38 -39/** -40 * A utility to download files from the Internet. -41 * -42 * @author Jeremy Long <jeremy.long@owasp.org> -43 */ -44publicfinalclassDownloader { -45 -46/** -47 * Private constructor for utility class. -48 */ -49privateDownloader() { -50 } -51 -52/** -53 * Retrieves a file from a given URL and saves it to the outputPath. -54 * -55 * @param url the URL of the file to download. -56 * @param outputPath the path to the save the file to. -57 * @throws DownloadFailedException is thrown if there is an error -58 * downloading the file. -59 */ -60publicstaticvoid fetchFile(URL url, File outputPath) throws DownloadFailedException { -61 HttpURLConnection conn = null; -62try { -63 conn = Downloader.getConnection(url); -64 conn.setRequestProperty("Accept-Encoding", "gzip, deflate"); -65 conn.connect(); -66 } catch (IOException ex) { -67try { -68if (conn != null) { -69 conn.disconnect(); -70 } -71 } finally { -72 conn = null; -73 } -74thrownewDownloadFailedException("Error downloading file.", ex); -75 } -76final String encoding = conn.getContentEncoding(); -77 -78 BufferedOutputStream writer = null; -79 InputStream reader = null; -80try { -81if (encoding != null && "gzip".equalsIgnoreCase(encoding)) { -82 reader = new GZIPInputStream(conn.getInputStream()); -83 } elseif (encoding != null && "deflate".equalsIgnoreCase(encoding)) { -84 reader = new InflaterInputStream(conn.getInputStream()); -85 } else { -86 reader = conn.getInputStream(); -87 } -88 -89 writer = new BufferedOutputStream(new FileOutputStream(outputPath)); -90final byte[] buffer = new byte[4096]; -91int bytesRead; -92while ((bytesRead = reader.read(buffer)) > 0) { -93 writer.write(buffer, 0, bytesRead); -94 } -95 } catch (Exception ex) { -96thrownewDownloadFailedException("Error saving downloaded file.", ex); -97 } finally { -98if (writer != null) { -99try { -100 writer.close(); -101 } catch (Exception ex) { -102 Logger.getLogger(Downloader.class.getName()).log(Level.FINEST, -103"Error closing the writer in Downloader.", ex); -104 } -105 } -106if (reader != null) { -107try { -108 reader.close(); -109 } catch (Exception ex) { -110 Logger.getLogger(Downloader.class.getName()).log(Level.FINEST, -111"Error closing the reader in Downloader.", ex); -112 } -113 } -114try { -115 conn.disconnect(); -116 } finally { -117 conn = null; -118 } -119 } -120 } -121 -122/** -123 * Makes an HTTP Head request to retrieve the last modified date of the -124 * given URL. If the file:// protocol is specified, then the lastTimestamp -125 * of the file is returned. -126 * -127 * @param url the URL to retrieve the timestamp from -128 * @return an epoch timestamp -129 * @throws DownloadFailedException is thrown if an exception occurs making -130 * the HTTP request -131 */ -132publicstaticlong getLastModified(URL url) throws DownloadFailedException { -133long timestamp = 0; -134//TODO add the FPR protocol? -135if ("file".equalsIgnoreCase(url.getProtocol())) { -136 File lastModifiedFile; -137try { -138// if (System.getProperty("os.name").toLowerCase().startsWith("windows")) { -139// String filePath = url.toString(); -140// if (filePath.matches("file://[a-zA-Z]:.*")) { -141// f = new File(filePath.substring(7)); -142// } else { -143// f = new File(url.toURI()); -144// } -145// } else { -146 lastModifiedFile = new File(url.toURI()); -147// } -148 } catch (URISyntaxException ex) { -149final String msg = String.format("Unable to locate '%s'; is the cve.url-2.0.modified property set correctly?", url.toString()); -150thrownewDownloadFailedException(msg); -151 } -152 timestamp = lastModifiedFile.lastModified(); -153 } else { -154 HttpURLConnection conn = null; -155try { -156 conn = Downloader.getConnection(url); -157 conn.setRequestMethod("HEAD"); -158 conn.connect(); -159 timestamp = conn.getLastModified(); -160 } catch (Exception ex) { -161thrownewDownloadFailedException("Error making HTTP HEAD request.", ex); -162 } finally { -163if (conn != null) { -164try { -165 conn.disconnect(); -166 } finally { -167 conn = null; -168 } -169 } -170 } -171 } -172return timestamp; -173 } -174 -175/** -176 * Utility method to get an HttpURLConnection. If the app is configured to -177 * use a proxy this method will retrieve the proxy settings and use them -178 * when setting up the connection. -179 * -180 * @param url the url to connect to -181 * @return an HttpURLConnection -182 * @throws DownloadFailedException thrown if there is an exception -183 */ -184privatestatic HttpURLConnection getConnection(URL url) throws DownloadFailedException { -185 HttpURLConnection conn = null; -186 Proxy proxy = null; -187final String proxyUrl = Settings.getString(Settings.KEYS.PROXY_URL); -188try { -189if (proxyUrl != null) { -190finalint proxyPort = Settings.getInt(Settings.KEYS.PROXY_PORT); -191final SocketAddress addr = new InetSocketAddress(proxyUrl, proxyPort); -192 -193final String username = Settings.getString(Settings.KEYS.PROXY_USERNAME); -194final String password = Settings.getString(Settings.KEYS.PROXY_PASSWORD); -195if (username != null && password != null) { -196final Authenticator auth = new Authenticator() { -197 @Override -198public PasswordAuthentication getPasswordAuthentication() { -199if (getRequestorType().equals(RequestorType.PROXY)) { -200returnnew PasswordAuthentication(username, password.toCharArray()); -201 } -202returnsuper.getPasswordAuthentication(); -203 } -204 }; -205 Authenticator.setDefault(auth); -206 } -207 -208 proxy = new Proxy(Proxy.Type.HTTP, addr); -209 conn = (HttpURLConnection) url.openConnection(proxy); -210 } else { -211 conn = (HttpURLConnection) url.openConnection(); -212 } -213finalint timeout = Settings.getInt(Settings.KEYS.CONNECTION_TIMEOUT, 60000); -214 conn.setConnectTimeout(timeout); -215 } catch (IOException ex) { -216if (conn != null) { -217try { -218 conn.disconnect(); -219 } finally { -220 conn = null; -221 } -222 } -223thrownewDownloadFailedException("Error getting connection.", ex); -224 } -225return conn; -226 } -227 } +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. +17 */ +18package org.owasp.dependencycheck.utils; +19 +20import java.io.BufferedOutputStream; +21import java.io.File; +22import java.io.FileOutputStream; +23import java.io.IOException; +24import java.io.InputStream; +25import java.net.Authenticator; +26import java.net.HttpURLConnection; +27import java.net.InetSocketAddress; +28import java.net.PasswordAuthentication; +29import java.net.Proxy; +30import java.net.SocketAddress; +31import java.net.URISyntaxException; +32import java.net.URL; +33import java.util.logging.Level; +34import java.util.logging.Logger; +35import java.util.zip.GZIPInputStream; +36import java.util.zip.InflaterInputStream; +37 +38/** +39 * A utility to download files from the Internet. +40 * +41 * @author Jeremy Long <jeremy.long@owasp.org> +42 */ +43publicfinalclassDownloader { +44 +45/** +46 * Private constructor for utility class. +47 */ +48privateDownloader() { +49 } +50 +51/** +52 * Retrieves a file from a given URL and saves it to the outputPath. +53 * +54 * @param url the URL of the file to download. +55 * @param outputPath the path to the save the file to. +56 * @throws DownloadFailedException is thrown if there is an error downloading the file. +57 */ +58publicstaticvoid fetchFile(URL url, File outputPath) throws DownloadFailedException { +59 HttpURLConnection conn = null; +60try { +61 conn = Downloader.getConnection(url); +62 conn.setRequestProperty("Accept-Encoding", "gzip, deflate"); +63 conn.connect(); +64 } catch (IOException ex) { +65try { +66if (conn != null) { +67 conn.disconnect(); +68 } +69 } finally { +70 conn = null; +71 } +72thrownewDownloadFailedException("Error downloading file.", ex); +73 } +74final String encoding = conn.getContentEncoding(); +75 +76 BufferedOutputStream writer = null; +77 InputStream reader = null; +78try { +79if (encoding != null && "gzip".equalsIgnoreCase(encoding)) { +80 reader = new GZIPInputStream(conn.getInputStream()); +81 } elseif (encoding != null && "deflate".equalsIgnoreCase(encoding)) { +82 reader = new InflaterInputStream(conn.getInputStream()); +83 } else { +84 reader = conn.getInputStream(); +85 } +86 +87 writer = new BufferedOutputStream(new FileOutputStream(outputPath)); +88final byte[] buffer = new byte[4096]; +89int bytesRead; +90while ((bytesRead = reader.read(buffer)) > 0) { +91 writer.write(buffer, 0, bytesRead); +92 } +93 } catch (Exception ex) { +94thrownewDownloadFailedException("Error saving downloaded file.", ex); +95 } finally { +96if (writer != null) { +97try { +98 writer.close(); +99 } catch (Exception ex) { +100 Logger.getLogger(Downloader.class.getName()).log(Level.FINEST, +101"Error closing the writer in Downloader.", ex); +102 } +103 } +104if (reader != null) { +105try { +106 reader.close(); +107 } catch (Exception ex) { +108 Logger.getLogger(Downloader.class.getName()).log(Level.FINEST, +109"Error closing the reader in Downloader.", ex); +110 } +111 } +112try { +113 conn.disconnect(); +114 } finally { +115 conn = null; +116 } +117 } +118 } +119 +120/** +121 * Makes an HTTP Head request to retrieve the last modified date of the given URL. If the file:// protocol is +122 * specified, then the lastTimestamp of the file is returned. +123 * +124 * @param url the URL to retrieve the timestamp from +125 * @return an epoch timestamp +126 * @throws DownloadFailedException is thrown if an exception occurs making the HTTP request +127 */ +128publicstaticlong getLastModified(URL url) throws DownloadFailedException { +129long timestamp = 0; +130//TODO add the FPR protocol? +131if ("file".equalsIgnoreCase(url.getProtocol())) { +132 File lastModifiedFile; +133try { +134// if (System.getProperty("os.name").toLowerCase().startsWith("windows")) { +135// String filePath = url.toString(); +136// if (filePath.matches("file://[a-zA-Z]:.*")) { +137// f = new File(filePath.substring(7)); +138// } else { +139// f = new File(url.toURI()); +140// } +141// } else { +142 lastModifiedFile = new File(url.toURI()); +143// } +144 } catch (URISyntaxException ex) { +145final String msg = String.format("Unable to locate '%s'; is the cve.url-2.0.modified property set correctly?", url.toString()); +146thrownewDownloadFailedException(msg); +147 } +148 timestamp = lastModifiedFile.lastModified(); +149 } else { +150 HttpURLConnection conn = null; +151try { +152 conn = Downloader.getConnection(url); +153 conn.setRequestMethod("HEAD"); +154 conn.connect(); +155 timestamp = conn.getLastModified(); +156 } catch (Exception ex) { +157thrownewDownloadFailedException("Error making HTTP HEAD request.", ex); +158 } finally { +159if (conn != null) { +160try { +161 conn.disconnect(); +162 } finally { +163 conn = null; +164 } +165 } +166 } +167 } +168return timestamp; +169 } +170 +171/** +172 * Utility method to get an HttpURLConnection. If the app is configured to use a proxy this method will retrieve the +173 * proxy settings and use them when setting up the connection. +174 * +175 * @param url the url to connect to +176 * @return an HttpURLConnection +177 * @throws DownloadFailedException thrown if there is an exception +178 */ +179privatestatic HttpURLConnection getConnection(URL url) throws DownloadFailedException { +180 HttpURLConnection conn = null; +181 Proxy proxy = null; +182final String proxyUrl = Settings.getString(Settings.KEYS.PROXY_URL); +183try { +184if (proxyUrl != null) { +185finalint proxyPort = Settings.getInt(Settings.KEYS.PROXY_PORT); +186final SocketAddress addr = new InetSocketAddress(proxyUrl, proxyPort); +187 +188final String username = Settings.getString(Settings.KEYS.PROXY_USERNAME); +189final String password = Settings.getString(Settings.KEYS.PROXY_PASSWORD); +190if (username != null && password != null) { +191final Authenticator auth = new Authenticator() { +192 @Override +193public PasswordAuthentication getPasswordAuthentication() { +194if (getRequestorType().equals(RequestorType.PROXY)) { +195returnnew PasswordAuthentication(username, password.toCharArray()); +196 } +197returnsuper.getPasswordAuthentication(); +198 } +199 }; +200 Authenticator.setDefault(auth); +201 } +202 +203 proxy = new Proxy(Proxy.Type.HTTP, addr); +204 conn = (HttpURLConnection) url.openConnection(proxy); +205 } else { +206 conn = (HttpURLConnection) url.openConnection(); +207 } +208finalint timeout = Settings.getInt(Settings.KEYS.CONNECTION_TIMEOUT, 60000); +209 conn.setConnectTimeout(timeout); +210 } catch (IOException ex) { +211if (conn != null) { +212try { +213 conn.disconnect(); +214 } finally { +215 conn = null; +216 } +217 } +218thrownewDownloadFailedException("Error getting connection.", ex); +219 } +220return conn; +221 } +222 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/utils/ExtractionException.html b/dependency-check-core/xref/org/owasp/dependencycheck/utils/ExtractionException.html index b3a4dea4d..a8942e462 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/utils/ExtractionException.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/utils/ExtractionException.html @@ -9,72 +9,71 @@ 1/*2 * This file is part of dependency-check-core.3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2013 Jeremy Long. All Rights Reserved. -18 */ -19package org.owasp.dependencycheck.utils; -20 -21import java.io.IOException; -22 -23/** -24 * An exception used when a file is unable to be un-zipped. -25 * -26 * @author Jeremy Long <jeremy.long@owasp.org> -27 */ -28publicclassExtractionExceptionextends IOException { -29 -30/** -31 * The serial version UID. -32 */ -33privatestaticfinallong serialVersionUID = 1L; -34 -35/** -36 * Creates a new ExtractionException. -37 */ -38publicExtractionException() { -39super(); -40 } -41 -42/** -43 * Creates a new ExtractionException. -44 * -45 * @param msg a message for the exception. -46 */ -47publicExtractionException(String msg) { -48super(msg); -49 } -50 -51/** -52 * Creates a new ExtractionException. -53 * -54 * @param ex the cause of the download failure. -55 */ -56publicExtractionException(Throwable ex) { -57super(ex); -58 } -59 -60/** -61 * Creates a new ExtractionException. -62 * -63 * @param msg a message for the exception. -64 * @param ex the cause of the download failure. -65 */ -66publicExtractionException(String msg, Throwable ex) { -67super(msg, ex); -68 } -69 } +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2013 Jeremy Long. All Rights Reserved. +17 */ +18package org.owasp.dependencycheck.utils; +19 +20import java.io.IOException; +21 +22/** +23 * An exception used when a file is unable to be un-zipped. +24 * +25 * @author Jeremy Long <jeremy.long@owasp.org> +26 */ +27publicclassExtractionExceptionextends IOException { +28 +29/** +30 * The serial version UID. +31 */ +32privatestaticfinallong serialVersionUID = 1L; +33 +34/** +35 * Creates a new ExtractionException. +36 */ +37publicExtractionException() { +38super(); +39 } +40 +41/** +42 * Creates a new ExtractionException. +43 * +44 * @param msg a message for the exception. +45 */ +46publicExtractionException(String msg) { +47super(msg); +48 } +49 +50/** +51 * Creates a new ExtractionException. +52 * +53 * @param ex the cause of the download failure. +54 */ +55publicExtractionException(Throwable ex) { +56super(ex); +57 } +58 +59/** +60 * Creates a new ExtractionException. +61 * +62 * @param msg a message for the exception. +63 * @param ex the cause of the download failure. +64 */ +65publicExtractionException(String msg, Throwable ex) { +66super(msg, ex); +67 } +68 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/utils/FileUtils.html b/dependency-check-core/xref/org/owasp/dependencycheck/utils/FileUtils.html index 64bead662..b4cfe1bf6 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/utils/FileUtils.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/utils/FileUtils.html @@ -9,236 +9,226 @@ 1/*2 * This file is part of dependency-check-core.3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. -18 */ -19package org.owasp.dependencycheck.utils; -20 -21import java.io.BufferedInputStream; -22import java.io.BufferedOutputStream; -23import java.io.File; -24import java.io.FileInputStream; -25import java.io.FileNotFoundException; -26import java.io.FileOutputStream; -27import java.io.IOException; -28import java.io.UnsupportedEncodingException; -29import java.net.URLDecoder; -30import java.util.logging.Level; -31import java.util.logging.Logger; -32import java.util.zip.ZipEntry; -33import java.util.zip.ZipInputStream; -34import org.owasp.dependencycheck.Engine; -35 -36/** -37 * A collection of utilities for processing information about files. -38 * -39 * @author Jeremy Long <jeremy.long@owasp.org> -40 */ -41publicfinalclassFileUtils { -42 -43/** -44 * The buffer size to use when extracting files from the archive. -45 */ -46privatestaticfinalint BUFFER_SIZE = 4096; -47 -48/** -49 * Private constructor for a utility class. -50 */ -51privateFileUtils() { -52 } -53 -54/** -55 * Returns the (lowercase) file extension for a specified file. -56 * -57 * @param fileName the file name to retrieve the file extension from. -58 * @return the file extension. -59 */ -60publicstatic String getFileExtension(String fileName) { -61 String ret = null; -62finalint pos = fileName.lastIndexOf("."); -63if (pos >= 0) { -64 ret = fileName.substring(pos + 1, fileName.length()).toLowerCase(); -65 } -66return ret; -67 } -68 -69/** -70 * Deletes a file. If the File is a directory it will recursively delete the -71 * contents. -72 * -73 * @param file the File to delete -74 * @throws IOException is thrown if the file could not be deleted -75 */ -76publicstaticvoid delete(File file) throws IOException { -77if (file.isDirectory()) { -78for (File c : file.listFiles()) { -79 delete(c); -80 } -81 } -82if (!org.apache.commons.io.FileUtils.deleteQuietly(file)) { -83thrownew FileNotFoundException("Failed to delete file: " + file); -84 } -85/* else { -86 //delete on exit was a bad idea. if for some reason the file can't be deleted -87 // this will cause a newly constructed file to be deleted and a subsequent run may fail. -88 // still not sure why a file fails to be deleted, but can be overwritten... odd. -89 file.deleteOnExit(); -90 }*/ -91 } -92 -93/** -94 * Returns the data directory. If a path was specified in -95 * dependencycheck.properties or was specified using the Settings object, -96 * and the path exists, that path will be returned as a File object. If it -97 * does not exist, then a File object will be created based on the file -98 * location of the JAR containing the specified class. -99 * -100 * @param configuredFilePath the configured relative or absolute path -101 * @param clazz the class to resolve the path -102 * @return a File object -103 * @throws IOException is thrown if the path could not be decoded -104 * @deprecated This method should no longer be used. See the implementation -105 * in dependency-check-cli/App.java to see how the data directory should be -106 * set. -107 */ -108 @java.lang.Deprecated -109publicstatic File getDataDirectory(String configuredFilePath, Class clazz) throws IOException { -110final File file = new File(configuredFilePath); -111if (file.isDirectory() && file.canWrite()) { -112returnnew File(file.getCanonicalPath()); -113 } else { -114final File exePath = getPathToJar(clazz); -115returnnew File(exePath, configuredFilePath); -116 } -117 } -118 -119/** -120 * Retrieves the physical path to the parent directory containing the -121 * provided class. For example, if a JAR file contained a class -122 * org.something.clazz this method would return the parent directory of the -123 * JAR file. -124 * -125 * @param clazz the class to determine the parent directory of -126 * @return the parent directory of the file containing the specified class. -127 * @throws UnsupportedEncodingException thrown if UTF-8 is not supported. -128 * @deprecated this should no longer be used. -129 */ -130 @java.lang.Deprecated -131publicstatic File getPathToJar(Class clazz) throws UnsupportedEncodingException { -132final String filePath = clazz.getProtectionDomain().getCodeSource().getLocation().getPath(); -133final String decodedPath = URLDecoder.decode(filePath, "UTF-8"); -134final File jarPath = new File(decodedPath); -135return jarPath.getParentFile(); -136 } -137 -138/** -139 * Extracts the contents of an archive into the specified directory. -140 * -141 * @param archive an archive file such as a WAR or EAR -142 * @param extractTo a directory to extract the contents to -143 * @throws ExtractionException thrown if an exception occurs while -144 * extracting the files -145 */ -146publicstaticvoid extractFiles(File archive, File extractTo) throws ExtractionException { -147 extractFiles(archive, extractTo, null); -148 } -149 -150/** -151 * Extracts the contents of an archive into the specified directory. The -152 * files are only extracted if they are supported by the analyzers loaded -153 * into the specified engine. If the engine is specified as null then all -154 * files are extracted. -155 * -156 * @param archive an archive file such as a WAR or EAR -157 * @param extractTo a directory to extract the contents to -158 * @param engine the scanning engine -159 * @throws ExtractionException thrown if there is an error extracting the -160 * files -161 */ -162publicstaticvoid extractFiles(File archive, File extractTo, Engine engine) throws ExtractionException { -163if (archive == null || extractTo == null) { -164return; +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. +17 */ +18package org.owasp.dependencycheck.utils; +19 +20import java.io.BufferedInputStream; +21import java.io.BufferedOutputStream; +22import java.io.File; +23import java.io.FileInputStream; +24import java.io.FileNotFoundException; +25import java.io.FileOutputStream; +26import java.io.IOException; +27import java.io.UnsupportedEncodingException; +28import java.net.URLDecoder; +29import java.util.logging.Level; +30import java.util.logging.Logger; +31import java.util.zip.ZipEntry; +32import java.util.zip.ZipInputStream; +33import org.owasp.dependencycheck.Engine; +34 +35/** +36 * A collection of utilities for processing information about files. +37 * +38 * @author Jeremy Long <jeremy.long@owasp.org> +39 */ +40publicfinalclassFileUtils { +41 +42/** +43 * The buffer size to use when extracting files from the archive. +44 */ +45privatestaticfinalint BUFFER_SIZE = 4096; +46 +47/** +48 * Private constructor for a utility class. +49 */ +50privateFileUtils() { +51 } +52 +53/** +54 * Returns the (lowercase) file extension for a specified file. +55 * +56 * @param fileName the file name to retrieve the file extension from. +57 * @return the file extension. +58 */ +59publicstatic String getFileExtension(String fileName) { +60 String ret = null; +61finalint pos = fileName.lastIndexOf("."); +62if (pos >= 0) { +63 ret = fileName.substring(pos + 1, fileName.length()).toLowerCase(); +64 } +65return ret; +66 } +67 +68/** +69 * Deletes a file. If the File is a directory it will recursively delete the contents. +70 * +71 * @param file the File to delete +72 * @throws IOException is thrown if the file could not be deleted +73 */ +74publicstaticvoid delete(File file) throws IOException { +75if (file.isDirectory()) { +76for (File c : file.listFiles()) { +77 delete(c); +78 } +79 } +80if (!org.apache.commons.io.FileUtils.deleteQuietly(file)) { +81thrownew FileNotFoundException("Failed to delete file: " + file); +82 } +83/* else { +84 //delete on exit was a bad idea. if for some reason the file can't be deleted +85 // this will cause a newly constructed file to be deleted and a subsequent run may fail. +86 // still not sure why a file fails to be deleted, but can be overwritten... odd. +87 file.deleteOnExit(); +88 }*/ +89 } +90 +91/** +92 * Returns the data directory. If a path was specified in dependencycheck.properties or was specified using the +93 * Settings object, and the path exists, that path will be returned as a File object. If it does not exist, then a +94 * File object will be created based on the file location of the JAR containing the specified class. +95 * +96 * @param configuredFilePath the configured relative or absolute path +97 * @param clazz the class to resolve the path +98 * @return a File object +99 * @throws IOException is thrown if the path could not be decoded +100 * @deprecated This method should no longer be used. See the implementation in dependency-check-cli/App.java to see +101 * how the data directory should be set. +102 */ +103 @java.lang.Deprecated +104publicstatic File getDataDirectory(String configuredFilePath, Class clazz) throws IOException { +105final File file = new File(configuredFilePath); +106if (file.isDirectory() && file.canWrite()) { +107returnnew File(file.getCanonicalPath()); +108 } else { +109final File exePath = getPathToJar(clazz); +110returnnew File(exePath, configuredFilePath); +111 } +112 } +113 +114/** +115 * Retrieves the physical path to the parent directory containing the provided class. For example, if a JAR file +116 * contained a class org.something.clazz this method would return the parent directory of the JAR file. +117 * +118 * @param clazz the class to determine the parent directory of +119 * @return the parent directory of the file containing the specified class. +120 * @throws UnsupportedEncodingException thrown if UTF-8 is not supported. +121 * @deprecated this should no longer be used. +122 */ +123 @java.lang.Deprecated +124publicstatic File getPathToJar(Class clazz) throws UnsupportedEncodingException { +125final String filePath = clazz.getProtectionDomain().getCodeSource().getLocation().getPath(); +126final String decodedPath = URLDecoder.decode(filePath, "UTF-8"); +127final File jarPath = new File(decodedPath); +128return jarPath.getParentFile(); +129 } +130 +131/** +132 * Extracts the contents of an archive into the specified directory. +133 * +134 * @param archive an archive file such as a WAR or EAR +135 * @param extractTo a directory to extract the contents to +136 * @throws ExtractionException thrown if an exception occurs while extracting the files +137 */ +138publicstaticvoid extractFiles(File archive, File extractTo) throws ExtractionException { +139 extractFiles(archive, extractTo, null); +140 } +141 +142/** +143 * Extracts the contents of an archive into the specified directory. The files are only extracted if they are +144 * supported by the analyzers loaded into the specified engine. If the engine is specified as null then all files +145 * are extracted. +146 * +147 * @param archive an archive file such as a WAR or EAR +148 * @param extractTo a directory to extract the contents to +149 * @param engine the scanning engine +150 * @throws ExtractionException thrown if there is an error extracting the files +151 */ +152publicstaticvoid extractFiles(File archive, File extractTo, Engine engine) throws ExtractionException { +153if (archive == null || extractTo == null) { +154return; +155 } +156 +157 FileInputStream fis = null; +158 ZipInputStream zis = null; +159 +160try { +161 fis = new FileInputStream(archive); +162 } catch (FileNotFoundException ex) { +163 Logger.getLogger(FileUtils.class.getName()).log(Level.INFO, null, ex); +164thrownewExtractionException("Archive file was not found.", ex); 165 } -166 -167 FileInputStream fis = null; -168 ZipInputStream zis = null; -169 -170try { -171 fis = new FileInputStream(archive); -172 } catch (FileNotFoundException ex) { -173 Logger.getLogger(FileUtils.class.getName()).log(Level.INFO, null, ex); -174thrownewExtractionException("Archive file was not found.", ex); -175 } -176 zis = new ZipInputStream(new BufferedInputStream(fis)); -177 ZipEntry entry; -178try { -179while ((entry = zis.getNextEntry()) != null) { -180if (entry.isDirectory()) { -181final File d = new File(extractTo, entry.getName()); -182if (!d.exists() && !d.mkdirs()) { -183final String msg = String.format("Unable to create '%s'.", d.getAbsolutePath()); -184thrownewExtractionException(msg); -185 } -186 } else { -187final File file = new File(extractTo, entry.getName()); -188final String ext = getFileExtension(file.getName()); -189if (engine == null || engine.supportsExtension(ext)) { -190 BufferedOutputStream bos = null; -191 FileOutputStream fos; -192try { -193 fos = new FileOutputStream(file); -194 bos = new BufferedOutputStream(fos, BUFFER_SIZE); -195int count; -196final byte data[] = new byte[BUFFER_SIZE]; -197while ((count = zis.read(data, 0, BUFFER_SIZE)) != -1) { -198 bos.write(data, 0, count); -199 } -200 bos.flush(); -201 } catch (FileNotFoundException ex) { -202 Logger.getLogger(FileUtils.class.getName()).log(Level.FINE, null, ex); -203final String msg = String.format("Unable to find file '%s'.", file.getName()); -204thrownewExtractionException(msg, ex); -205 } catch (IOException ex) { -206 Logger.getLogger(FileUtils.class.getName()).log(Level.FINE, null, ex); -207final String msg = String.format("IO Exception while parsing file '%s'.", file.getName()); -208thrownewExtractionException(msg, ex); -209 } finally { -210if (bos != null) { -211try { -212 bos.close(); -213 } catch (IOException ex) { -214 Logger.getLogger(FileUtils.class.getName()).log(Level.FINEST, null, ex); -215 } -216 } -217 } -218 } -219 } +166 zis = new ZipInputStream(new BufferedInputStream(fis)); +167 ZipEntry entry; +168try { +169while ((entry = zis.getNextEntry()) != null) { +170if (entry.isDirectory()) { +171final File d = new File(extractTo, entry.getName()); +172if (!d.exists() && !d.mkdirs()) { +173final String msg = String.format("Unable to create '%s'.", d.getAbsolutePath()); +174thrownewExtractionException(msg); +175 } +176 } else { +177final File file = new File(extractTo, entry.getName()); +178final String ext = getFileExtension(file.getName()); +179if (engine == null || engine.supportsExtension(ext)) { +180 BufferedOutputStream bos = null; +181 FileOutputStream fos; +182try { +183 fos = new FileOutputStream(file); +184 bos = new BufferedOutputStream(fos, BUFFER_SIZE); +185int count; +186final byte data[] = new byte[BUFFER_SIZE]; +187while ((count = zis.read(data, 0, BUFFER_SIZE)) != -1) { +188 bos.write(data, 0, count); +189 } +190 bos.flush(); +191 } catch (FileNotFoundException ex) { +192 Logger.getLogger(FileUtils.class.getName()).log(Level.FINE, null, ex); +193final String msg = String.format("Unable to find file '%s'.", file.getName()); +194thrownewExtractionException(msg, ex); +195 } catch (IOException ex) { +196 Logger.getLogger(FileUtils.class.getName()).log(Level.FINE, null, ex); +197final String msg = String.format("IO Exception while parsing file '%s'.", file.getName()); +198thrownewExtractionException(msg, ex); +199 } finally { +200if (bos != null) { +201try { +202 bos.close(); +203 } catch (IOException ex) { +204 Logger.getLogger(FileUtils.class.getName()).log(Level.FINEST, null, ex); +205 } +206 } +207 } +208 } +209 } +210 } +211 } catch (IOException ex) { +212final String msg = String.format("Exception reading archive '%s'.", archive.getName()); +213 Logger.getLogger(FileUtils.class.getName()).log(Level.FINE, msg, ex); +214thrownewExtractionException(msg, ex); +215 } finally { +216try { +217 zis.close(); +218 } catch (IOException ex) { +219 Logger.getLogger(FileUtils.class.getName()).log(Level.FINEST, null, ex); 220 } -221 } catch (IOException ex) { -222final String msg = String.format("Exception reading archive '%s'.", archive.getName()); -223 Logger.getLogger(FileUtils.class.getName()).log(Level.FINE, msg, ex); -224thrownewExtractionException(msg, ex); -225 } finally { -226try { -227 zis.close(); -228 } catch (IOException ex) { -229 Logger.getLogger(FileUtils.class.getName()).log(Level.FINEST, null, ex); -230 } -231 } -232 } -233 } +221 } +222 } +223 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/utils/InvalidSettingException.html b/dependency-check-core/xref/org/owasp/dependencycheck/utils/InvalidSettingException.html index 3eb613dc4..89f6f668f 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/utils/InvalidSettingException.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/utils/InvalidSettingException.html @@ -9,72 +9,71 @@ 1/*2 * This file is part of dependency-check-core.3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. -18 */ -19package org.owasp.dependencycheck.utils; -20 -21import java.io.IOException; -22 -23/** -24 * An exception used when an error occurs reading a setting. -25 * -26 * @author Jeremy Long <jeremy.long@owasp.org> -27 */ -28publicclassInvalidSettingExceptionextends IOException { -29 -30/** -31 * The serial version UID. -32 */ -33privatestaticfinallong serialVersionUID = 1L; -34 -35/** -36 * Creates a new InvalidSettingException. -37 */ -38publicInvalidSettingException() { -39super(); -40 } -41 -42/** -43 * Creates a new InvalidSettingException. -44 * -45 * @param msg a message for the exception. -46 */ -47publicInvalidSettingException(String msg) { -48super(msg); -49 } -50 -51/** -52 * Creates a new InvalidSettingException. -53 * -54 * @param ex the cause of the setting exception. -55 */ -56publicInvalidSettingException(Throwable ex) { -57super(ex); -58 } -59 -60/** -61 * Creates a new InvalidSettingException. -62 * -63 * @param msg a message for the exception. -64 * @param ex the cause of the setting exception. -65 */ -66publicInvalidSettingException(String msg, Throwable ex) { -67super(msg, ex); -68 } -69 } +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. +17 */ +18package org.owasp.dependencycheck.utils; +19 +20import java.io.IOException; +21 +22/** +23 * An exception used when an error occurs reading a setting. +24 * +25 * @author Jeremy Long <jeremy.long@owasp.org> +26 */ +27publicclassInvalidSettingExceptionextends IOException { +28 +29/** +30 * The serial version UID. +31 */ +32privatestaticfinallong serialVersionUID = 1L; +33 +34/** +35 * Creates a new InvalidSettingException. +36 */ +37publicInvalidSettingException() { +38super(); +39 } +40 +41/** +42 * Creates a new InvalidSettingException. +43 * +44 * @param msg a message for the exception. +45 */ +46publicInvalidSettingException(String msg) { +47super(msg); +48 } +49 +50/** +51 * Creates a new InvalidSettingException. +52 * +53 * @param ex the cause of the setting exception. +54 */ +55publicInvalidSettingException(Throwable ex) { +56super(ex); +57 } +58 +59/** +60 * Creates a new InvalidSettingException. +61 * +62 * @param msg a message for the exception. +63 * @param ex the cause of the setting exception. +64 */ +65publicInvalidSettingException(String msg, Throwable ex) { +66super(msg, ex); +67 } +68 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/utils/LogFilter.html b/dependency-check-core/xref/org/owasp/dependencycheck/utils/LogFilter.html index 7cb712c26..18722cdae 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/utils/LogFilter.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/utils/LogFilter.html @@ -9,47 +9,45 @@ 1/*2 * This file is part of dependency-check-core.3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2013 Jeremy Long. All Rights Reserved. -18 */ -19package org.owasp.dependencycheck.utils; -20 -21import java.util.logging.Filter; -22import java.util.logging.LogRecord; -23 -24/** -25 * A simple log filter to limit the entries written to the verbose log file. The -26 * verbose log file uses the root logger as I couldn't get anything else to -27 * work; as such, this filter limits the log entries to specific classes. -28 * -29 * @author Jeremy Long <jeremy.long@owasp.org> -30 */ -31publicclassLogFilterimplementsFilter { -32 -33/** -34 * Determines if the record should be logged. -35 * -36 * @param record a log record to examine -37 * @return true if the record should be logged, otherwise false -38 */ -39 @Override -40publicboolean isLoggable(LogRecord record) { -41final String name = record.getSourceClassName(); -42return name.startsWith("org.owasp.dependencycheck") && !name.contains("generated") && !name.contains("VelocityLoggerRedirect"); -43 } -44 } +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2013 Jeremy Long. All Rights Reserved. +17 */ +18package org.owasp.dependencycheck.utils; +19 +20import java.util.logging.Filter; +21import java.util.logging.LogRecord; +22 +23/** +24 * A simple log filter to limit the entries written to the verbose log file. The verbose log file uses the root logger +25 * as I couldn't get anything else to work; as such, this filter limits the log entries to specific classes. +26 * +27 * @author Jeremy Long <jeremy.long@owasp.org> +28 */ +29publicclassLogFilterimplementsFilter { +30 +31/** +32 * Determines if the record should be logged. +33 * +34 * @param record a log record to examine +35 * @return true if the record should be logged, otherwise false +36 */ +37 @Override +38publicboolean isLoggable(LogRecord record) { +39final String name = record.getSourceClassName(); +40return name.startsWith("org.owasp.dependencycheck") && !name.contains("generated") && !name.contains("VelocityLoggerRedirect"); +41 } +42 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/utils/LogUtils.html b/dependency-check-core/xref/org/owasp/dependencycheck/utils/LogUtils.html index c9a107236..054fec3ee 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/utils/LogUtils.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/utils/LogUtils.html @@ -9,92 +9,91 @@ 1/*2 * This file is part of dependency-check-core.3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2013 Jeremy Long. All Rights Reserved. -18 */ -19package org.owasp.dependencycheck.utils; -20 -21import java.io.IOException; -22import java.io.InputStream; -23import java.util.logging.FileHandler; -24import java.util.logging.Level; -25import java.util.logging.LogManager; -26import java.util.logging.Logger; -27import java.util.logging.SimpleFormatter; -28 -29/** -30 * A utility class to aide in the setup of the logging mechanism. -31 * -32 * @author Jeremy Long <jeremy.long@owasp.org> -33 */ -34publicfinalclassLogUtils { -35 -36/** -37 * Private constructor for a utility class. -38 */ -39privateLogUtils() { -40 } -41 -42/** -43 * Configures the logger for use by the application. -44 * -45 * @param in the input stream to read the log settings from -46 * @param verboseLogFile the file path for the verbose log -47 */ -48publicstaticvoid prepareLogger(InputStream in, String verboseLogFile) { -49try { -50 LogManager.getLogManager().reset(); -51 LogManager.getLogManager().readConfiguration(in); -52if (verboseLogFile != null && !verboseLogFile.isEmpty()) { -53 verboseLoggingEnabled = true; -54final Logger logger = Logger.getLogger(""); -55final FileHandler handler = new FileHandler(verboseLogFile, true); -56 handler.setFormatter(new SimpleFormatter()); -57 handler.setLevel(Level.FINE); -58 handler.setFilter(newLogFilter()); -59 logger.addHandler(handler); -60 logger.setLevel(Level.FINE); -61 } -62 } catch (IOException ex) { -63 Logger.getLogger(LogUtils.class.getName()).log(Level.FINE, "IO Error preparing the logger", ex); -64 } catch (SecurityException ex) { -65 Logger.getLogger(LogUtils.class.getName()).log(Level.FINE, "Error preparing the logger", ex); -66 } finally { -67if (in != null) { -68try { -69 in.close(); -70 } catch (Exception ex) { -71 Logger.getLogger(LogUtils.class.getName()).log(Level.FINEST, "Error closing resource stream", ex); -72 } -73 } -74 } -75 } -76/** -77 * Whether or not verbose logging is enabled. -78 */ -79privatestaticboolean verboseLoggingEnabled = false; -80 -81/** -82 * Get the value of verboseLoggingEnabled. -83 * -84 * @return the value of verboseLoggingEnabled -85 */ -86publicstaticboolean isVerboseLoggingEnabled() { -87return verboseLoggingEnabled; -88 } -89 } +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2013 Jeremy Long. All Rights Reserved. +17 */ +18package org.owasp.dependencycheck.utils; +19 +20import java.io.IOException; +21import java.io.InputStream; +22import java.util.logging.FileHandler; +23import java.util.logging.Level; +24import java.util.logging.LogManager; +25import java.util.logging.Logger; +26import java.util.logging.SimpleFormatter; +27 +28/** +29 * A utility class to aide in the setup of the logging mechanism. +30 * +31 * @author Jeremy Long <jeremy.long@owasp.org> +32 */ +33publicfinalclassLogUtils { +34 +35/** +36 * Private constructor for a utility class. +37 */ +38privateLogUtils() { +39 } +40 +41/** +42 * Configures the logger for use by the application. +43 * +44 * @param in the input stream to read the log settings from +45 * @param verboseLogFile the file path for the verbose log +46 */ +47publicstaticvoid prepareLogger(InputStream in, String verboseLogFile) { +48try { +49 LogManager.getLogManager().reset(); +50 LogManager.getLogManager().readConfiguration(in); +51if (verboseLogFile != null && !verboseLogFile.isEmpty()) { +52 verboseLoggingEnabled = true; +53final Logger logger = Logger.getLogger(""); +54final FileHandler handler = new FileHandler(verboseLogFile, true); +55 handler.setFormatter(new SimpleFormatter()); +56 handler.setLevel(Level.FINE); +57 handler.setFilter(newLogFilter()); +58 logger.addHandler(handler); +59 logger.setLevel(Level.FINE); +60 } +61 } catch (IOException ex) { +62 Logger.getLogger(LogUtils.class.getName()).log(Level.FINE, "IO Error preparing the logger", ex); +63 } catch (SecurityException ex) { +64 Logger.getLogger(LogUtils.class.getName()).log(Level.FINE, "Error preparing the logger", ex); +65 } finally { +66if (in != null) { +67try { +68 in.close(); +69 } catch (Exception ex) { +70 Logger.getLogger(LogUtils.class.getName()).log(Level.FINEST, "Error closing resource stream", ex); +71 } +72 } +73 } +74 } +75/** +76 * Whether or not verbose logging is enabled. +77 */ +78privatestaticboolean verboseLoggingEnabled = false; +79 +80/** +81 * Get the value of verboseLoggingEnabled. +82 * +83 * @return the value of verboseLoggingEnabled +84 */ +85publicstaticboolean isVerboseLoggingEnabled() { +86return verboseLoggingEnabled; +87 } +88 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/utils/NonClosingStream.html b/dependency-check-core/xref/org/owasp/dependencycheck/utils/NonClosingStream.html index 7d7c9278b..52bc45d04 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/utils/NonClosingStream.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/utils/NonClosingStream.html @@ -9,52 +9,50 @@ 1/*2 * This file is part of dependency-check-core.3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. -18 */ -19package org.owasp.dependencycheck.utils; -20 -21import java.io.FilterInputStream; -22import java.io.InputStream; -23 -24/** -25 * NonClosingStream is a stream filter which prevents another class that -26 * processes the stream from closing it. This is necessary when dealing with -27 * things like JAXB and zipInputStreams. -28 * -29 * @author Jeremy Long <jeremy.long@owasp.org> -30 */ -31publicclassNonClosingStreamextends FilterInputStream { -32 -33/** -34 * Constructs a new NonClosingStream. -35 * -36 * @param in an input stream. -37 */ -38publicNonClosingStream(InputStream in) { -39super(in); -40 } -41 -42/** -43 * Prevents closing of the stream. -44 */ -45 @Override -46publicvoid close() { -47// don't close the stream. -48 } -49 } +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. +17 */ +18package org.owasp.dependencycheck.utils; +19 +20import java.io.FilterInputStream; +21import java.io.InputStream; +22 +23/** +24 * NonClosingStream is a stream filter which prevents another class that processes the stream from closing it. This is +25 * necessary when dealing with things like JAXB and zipInputStreams. +26 * +27 * @author Jeremy Long <jeremy.long@owasp.org> +28 */ +29publicclassNonClosingStreamextends FilterInputStream { +30 +31/** +32 * Constructs a new NonClosingStream. +33 * +34 * @param in an input stream. +35 */ +36publicNonClosingStream(InputStream in) { +37super(in); +38 } +39 +40/** +41 * Prevents closing of the stream. +42 */ +43 @Override +44publicvoid close() { +45// don't close the stream. +46 } +47 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/utils/Settings.html b/dependency-check-core/xref/org/owasp/dependencycheck/utils/Settings.html index 69b0bc60b..3f2ecfb11 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/utils/Settings.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/utils/Settings.html @@ -9,471 +9,441 @@ 1/*2 * This file is part of dependency-check-core.3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. -18 */ -19package org.owasp.dependencycheck.utils; -20 -21import java.io.File; -22import java.io.FileInputStream; -23import java.io.FileNotFoundException; -24import java.io.IOException; -25import java.io.InputStream; -26import java.io.UnsupportedEncodingException; -27import java.net.URLDecoder; -28import java.util.Properties; -29import java.util.logging.Level; -30import java.util.logging.Logger; -31 -32/** -33 * A simple settings container that wraps the dependencycheck.properties file. -34 * -35 * @author Jeremy Long <jeremy.long@owasp.org> -36 */ -37publicfinalclassSettings { -38 -39/** -40 * The collection of keys used within the properties file. -41 */ -42publicstaticfinalclassKEYS { -43 -44/** -45 * private constructor because this is a "utility" class containing -46 * constants -47 */ -48privateKEYS() { -49//do nothing -50 } -51/** -52 * The properties key indicating whether or not the cached data sources -53 * should be updated. -54 */ -55publicstaticfinal String AUTO_UPDATE = "autoupdate"; -56/** -57 * The database driver class name. If this is not in the properties file -58 * the embedded database is used. +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. +17 */ +18package org.owasp.dependencycheck.utils; +19 +20import java.io.File; +21import java.io.FileInputStream; +22import java.io.FileNotFoundException; +23import java.io.IOException; +24import java.io.InputStream; +25import java.io.UnsupportedEncodingException; +26import java.net.URLDecoder; +27import java.util.Properties; +28import java.util.logging.Level; +29import java.util.logging.Logger; +30 +31/** +32 * A simple settings container that wraps the dependencycheck.properties file. +33 * +34 * @author Jeremy Long <jeremy.long@owasp.org> +35 */ +36publicfinalclassSettings { +37 +38/** +39 * The collection of keys used within the properties file. +40 */ +41publicstaticfinalclassKEYS { +42 +43/** +44 * private constructor because this is a "utility" class containing constants +45 */ +46privateKEYS() { +47//do nothing +48 } +49/** +50 * The properties key indicating whether or not the cached data sources should be updated. +51 */ +52publicstaticfinal String AUTO_UPDATE = "autoupdate"; +53/** +54 * The database driver class name. If this is not in the properties file the embedded database is used. +55 */ +56publicstaticfinal String DB_DRIVER_NAME = "data.driver_name"; +57/** +58 * The database driver class name. If this is not in the properties file the embedded database is used.59 */ -60publicstaticfinal String DB_DRIVER_NAME = "data.driver_name"; +60publicstaticfinal String DB_DRIVER_PATH = "data.driver_path"; 61/** -62 * The database driver class name. If this is not in the properties file -63 * the embedded database is used. -64 */ -65publicstaticfinal String DB_DRIVER_PATH = "data.driver_path"; -66/** -67 * The database connection string. If this is not in the properties file -68 * the embedded database is used. -69 */ -70publicstaticfinal String DB_CONNECTION_STRING = "data.connection_string"; -71/** -72 * The username to use when connecting to the database. -73 */ -74publicstaticfinal String DB_USER = "data.user"; -75/** -76 * The password to authenticate to the database. -77 */ -78publicstaticfinal String DB_PASSWORD = "data.password"; -79/** -80 * The base path to use for the data directory (for embedded db). -81 */ -82publicstaticfinal String DATA_DIRECTORY = "data.directory"; -83/** -84 * The properties key for the URL to retrieve the "meta" data from about -85 * the CVE entries. -86 */ -87publicstaticfinal String CVE_META_URL = "cve.url.meta"; -88/** -89 * The properties key for the URL to retrieve the recently modified and -90 * added CVE entries (last 8 days) using the 2.0 schema. -91 */ -92publicstaticfinal String CVE_MODIFIED_20_URL = "cve.url-2.0.modified"; -93/** -94 * The properties key for the URL to retrieve the recently modified and -95 * added CVE entries (last 8 days) using the 1.2 schema. -96 */ -97publicstaticfinal String CVE_MODIFIED_12_URL = "cve.url-1.2.modified"; -98/** -99 * The properties key for the URL to retrieve the recently modified and -100 * added CVE entries (last 8 days). -101 */ -102publicstaticfinal String CVE_MODIFIED_VALID_FOR_DAYS = "cve.url.modified.validfordays"; -103/** -104 * The properties key for the telling us how many cvr.url.* URLs exists. -105 * This is used in combination with CVE_BASE_URL to be able to retrieve -106 * the URLs for all of the files that make up the NVD CVE listing. -107 */ -108publicstaticfinal String CVE_START_YEAR = "cve.startyear"; -109/** -110 * The properties key for the CVE schema version 1.2. -111 */ -112publicstaticfinal String CVE_SCHEMA_1_2 = "cve.url-1.2.base"; -113/** -114 * The properties key for the CVE schema version 2.0. -115 */ -116publicstaticfinal String CVE_SCHEMA_2_0 = "cve.url-2.0.base"; -117/** -118 * The properties key for the proxy url. -119 */ -120publicstaticfinal String PROXY_URL = "proxy.url"; -121/** -122 * The properties key for the proxy port - this must be an integer -123 * value. -124 */ -125publicstaticfinal String PROXY_PORT = "proxy.port"; -126/** -127 * The properties key for the proxy username. -128 */ -129publicstaticfinal String PROXY_USERNAME = "proxy.username"; -130/** -131 * The properties key for the proxy password. -132 */ -133publicstaticfinal String PROXY_PASSWORD = "proxy.password"; -134/** -135 * The properties key for the connection timeout. -136 */ -137publicstaticfinal String CONNECTION_TIMEOUT = "connection.timeout"; -138/** -139 * The location of the temporary directory. -140 */ -141publicstaticfinal String TEMP_DIRECTORY = "temp.directory"; -142/** -143 * The maximum number of threads to allocate when downloading files. -144 */ -145publicstaticfinal String MAX_DOWNLOAD_THREAD_POOL_SIZE = "max.download.threads"; -146/** -147 * The key for a list of suppression files. -148 */ -149publicstaticfinal String SUPPRESSION_FILE = "suppression.file"; -150/** -151 * The properties key for whether the Nexus analyzer is enabled. -152 */ -153publicstaticfinal String ANALYZER_NEXUS_ENABLED = "analyzer.nexus.enabled"; -154/** -155 * The properties key for the Nexus search URL. -156 */ -157publicstaticfinal String ANALYZER_NEXUS_URL = "analyzer.nexus.url"; -158 } -159/** -160 * The properties file location. -161 */ -162privatestaticfinal String PROPERTIES_FILE = "dependencycheck.properties"; -163/** -164 * The singleton instance variable. -165 */ -166privatestaticfinalSettings INSTANCE = newSettings(); -167/** -168 * The properties. -169 */ -170private Properties props = null; -171 -172/** -173 * Private constructor for the Settings class. This class loads the -174 * properties files. -175 */ -176privateSettings() { -177 InputStream in = null; -178 props = new Properties(); -179try { -180 in = this.getClass().getClassLoader().getResourceAsStream(PROPERTIES_FILE); -181 props.load(in); -182 } catch (IOException ex) { -183 Logger.getLogger(Settings.class.getName()).log(Level.SEVERE, "Unable to load default settings."); -184 Logger.getLogger(Settings.class.getName()).log(Level.FINE, null, ex); -185 } finally { -186if (in != null) { -187try { -188 in.close(); -189 } catch (IOException ex) { -190 Logger.getLogger(Settings.class.getName()).log(Level.FINEST, null, ex); -191 } -192 } -193 } -194 } -195 -196/** -197 * Sets a property value. -198 * -199 * @param key the key for the property -200 * @param value the value for the property -201 */ -202publicstaticvoid setString(String key, String value) { -203 INSTANCE.props.setProperty(key, value); -204 } -205 -206/** -207 * Sets a property value. -208 * -209 * @param key the key for the property -210 * @param value the value for the property -211 */ -212publicstaticvoid setBoolean(String key, boolean value) { -213if (value) { -214 INSTANCE.props.setProperty(key, Boolean.TRUE.toString()); -215 } else { -216 INSTANCE.props.setProperty(key, Boolean.FALSE.toString()); -217 } -218 } -219 -220/** -221 * Merges a new properties file into the current properties. This method -222 * allows for the loading of a user provided properties file.<br/><br/> -223 * Note: even if using this method - system properties will be loaded before -224 * properties loaded from files. -225 * -226 * @param filePath the path to the properties file to merge. -227 * @throws FileNotFoundException is thrown when the filePath points to a -228 * non-existent file -229 * @throws IOException is thrown when there is an exception loading/merging -230 * the properties +62 * The database connection string. If this is not in the properties file the embedded database is used. +63 */ +64publicstaticfinal String DB_CONNECTION_STRING = "data.connection_string"; +65/** +66 * The username to use when connecting to the database. +67 */ +68publicstaticfinal String DB_USER = "data.user"; +69/** +70 * The password to authenticate to the database. +71 */ +72publicstaticfinal String DB_PASSWORD = "data.password"; +73/** +74 * The base path to use for the data directory (for embedded db). +75 */ +76publicstaticfinal String DATA_DIRECTORY = "data.directory"; +77/** +78 * The properties key for the URL to retrieve the "meta" data from about the CVE entries. +79 */ +80publicstaticfinal String CVE_META_URL = "cve.url.meta"; +81/** +82 * The properties key for the URL to retrieve the recently modified and added CVE entries (last 8 days) using +83 * the 2.0 schema. +84 */ +85publicstaticfinal String CVE_MODIFIED_20_URL = "cve.url-2.0.modified"; +86/** +87 * The properties key for the URL to retrieve the recently modified and added CVE entries (last 8 days) using +88 * the 1.2 schema. +89 */ +90publicstaticfinal String CVE_MODIFIED_12_URL = "cve.url-1.2.modified"; +91/** +92 * The properties key for the URL to retrieve the recently modified and added CVE entries (last 8 days). +93 */ +94publicstaticfinal String CVE_MODIFIED_VALID_FOR_DAYS = "cve.url.modified.validfordays"; +95/** +96 * The properties key for the telling us how many cvr.url.* URLs exists. This is used in combination with +97 * CVE_BASE_URL to be able to retrieve the URLs for all of the files that make up the NVD CVE listing. +98 */ +99publicstaticfinal String CVE_START_YEAR = "cve.startyear"; +100/** +101 * The properties key for the CVE schema version 1.2. +102 */ +103publicstaticfinal String CVE_SCHEMA_1_2 = "cve.url-1.2.base"; +104/** +105 * The properties key for the CVE schema version 2.0. +106 */ +107publicstaticfinal String CVE_SCHEMA_2_0 = "cve.url-2.0.base"; +108/** +109 * The properties key for the proxy url. +110 */ +111publicstaticfinal String PROXY_URL = "proxy.url"; +112/** +113 * The properties key for the proxy port - this must be an integer value. +114 */ +115publicstaticfinal String PROXY_PORT = "proxy.port"; +116/** +117 * The properties key for the proxy username. +118 */ +119publicstaticfinal String PROXY_USERNAME = "proxy.username"; +120/** +121 * The properties key for the proxy password. +122 */ +123publicstaticfinal String PROXY_PASSWORD = "proxy.password"; +124/** +125 * The properties key for the connection timeout. +126 */ +127publicstaticfinal String CONNECTION_TIMEOUT = "connection.timeout"; +128/** +129 * The location of the temporary directory. +130 */ +131publicstaticfinal String TEMP_DIRECTORY = "temp.directory"; +132/** +133 * The maximum number of threads to allocate when downloading files. +134 */ +135publicstaticfinal String MAX_DOWNLOAD_THREAD_POOL_SIZE = "max.download.threads"; +136/** +137 * The key for a list of suppression files. +138 */ +139publicstaticfinal String SUPPRESSION_FILE = "suppression.file"; +140/** +141 * The properties key for whether the Nexus analyzer is enabled. +142 */ +143publicstaticfinal String ANALYZER_NEXUS_ENABLED = "analyzer.nexus.enabled"; +144/** +145 * The properties key for the Nexus search URL. +146 */ +147publicstaticfinal String ANALYZER_NEXUS_URL = "analyzer.nexus.url"; +148 } +149/** +150 * The properties file location. +151 */ +152privatestaticfinal String PROPERTIES_FILE = "dependencycheck.properties"; +153/** +154 * The singleton instance variable. +155 */ +156privatestaticfinalSettings INSTANCE = newSettings(); +157/** +158 * The properties. +159 */ +160private Properties props = null; +161 +162/** +163 * Private constructor for the Settings class. This class loads the properties files. +164 */ +165privateSettings() { +166 InputStream in = null; +167 props = new Properties(); +168try { +169 in = this.getClass().getClassLoader().getResourceAsStream(PROPERTIES_FILE); +170 props.load(in); +171 } catch (IOException ex) { +172 Logger.getLogger(Settings.class.getName()).log(Level.SEVERE, "Unable to load default settings."); +173 Logger.getLogger(Settings.class.getName()).log(Level.FINE, null, ex); +174 } finally { +175if (in != null) { +176try { +177 in.close(); +178 } catch (IOException ex) { +179 Logger.getLogger(Settings.class.getName()).log(Level.FINEST, null, ex); +180 } +181 } +182 } +183 } +184 +185/** +186 * Sets a property value. +187 * +188 * @param key the key for the property +189 * @param value the value for the property +190 */ +191publicstaticvoid setString(String key, String value) { +192 INSTANCE.props.setProperty(key, value); +193 } +194 +195/** +196 * Sets a property value. +197 * +198 * @param key the key for the property +199 * @param value the value for the property +200 */ +201publicstaticvoid setBoolean(String key, boolean value) { +202if (value) { +203 INSTANCE.props.setProperty(key, Boolean.TRUE.toString()); +204 } else { +205 INSTANCE.props.setProperty(key, Boolean.FALSE.toString()); +206 } +207 } +208 +209/** +210 * Merges a new properties file into the current properties. This method allows for the loading of a user provided +211 * properties file.<br/><br/> +212 * Note: even if using this method - system properties will be loaded before properties loaded from files. +213 * +214 * @param filePath the path to the properties file to merge. +215 * @throws FileNotFoundException is thrown when the filePath points to a non-existent file +216 * @throws IOException is thrown when there is an exception loading/merging the properties +217 */ +218publicstaticvoid mergeProperties(File filePath) throws FileNotFoundException, IOException { +219final FileInputStream fis = new FileInputStream(filePath); +220 mergeProperties(fis); +221 } +222 +223/** +224 * Merges a new properties file into the current properties. This method allows for the loading of a user provided +225 * properties file.<br/><br/> +226 * Note: even if using this method - system properties will be loaded before properties loaded from files. +227 * +228 * @param filePath the path to the properties file to merge. +229 * @throws FileNotFoundException is thrown when the filePath points to a non-existent file +230 * @throws IOException is thrown when there is an exception loading/merging the properties231 */ -232publicstaticvoid mergeProperties(File filePath) throws FileNotFoundException, IOException { +232publicstaticvoid mergeProperties(String filePath) throws FileNotFoundException, IOException { 233final FileInputStream fis = new FileInputStream(filePath); 234 mergeProperties(fis); 235 } 236237/** -238 * Merges a new properties file into the current properties. This method -239 * allows for the loading of a user provided properties file.<br/><br/> -240 * Note: even if using this method - system properties will be loaded before -241 * properties loaded from files. -242 * -243 * @param filePath the path to the properties file to merge. -244 * @throws FileNotFoundException is thrown when the filePath points to a -245 * non-existent file -246 * @throws IOException is thrown when there is an exception loading/merging -247 * the properties -248 */ -249publicstaticvoid mergeProperties(String filePath) throws FileNotFoundException, IOException { -250final FileInputStream fis = new FileInputStream(filePath); -251 mergeProperties(fis); -252 } -253 -254/** -255 * Merges a new properties file into the current properties. This method -256 * allows for the loading of a user provided properties file.<br/><br/> -257 * Note: even if using this method - system properties will be loaded before -258 * properties loaded from files. -259 * -260 * @param stream an Input Stream pointing at a properties file to merge -261 * @throws IOException is thrown when there is an exception loading/merging -262 * the properties -263 */ -264publicstaticvoid mergeProperties(InputStream stream) throws IOException { -265 INSTANCE.props.load(stream); -266 } -267 -268/** -269 * Returns a value from the properties file as a File object. If the value -270 * was specified as a system property or passed in via the -Dprop=value -271 * argument - this method will return the value from the system properties -272 * before the values in the contained configuration file. +238 * Merges a new properties file into the current properties. This method allows for the loading of a user provided +239 * properties file.<br/><br/> +240 * Note: even if using this method - system properties will be loaded before properties loaded from files. +241 * +242 * @param stream an Input Stream pointing at a properties file to merge +243 * @throws IOException is thrown when there is an exception loading/merging the properties +244 */ +245publicstaticvoid mergeProperties(InputStream stream) throws IOException { +246 INSTANCE.props.load(stream); +247 } +248 +249/** +250 * Returns a value from the properties file as a File object. If the value was specified as a system property or +251 * passed in via the -Dprop=value argument - this method will return the value from the system properties before the +252 * values in the contained configuration file. +253 * +254 * @param key the key to lookup within the properties file +255 * @return the property from the properties file converted to a File object +256 */ +257publicstatic File getFile(String key) { +258final String file = getString(key); +259if (file == null) { +260returnnull; +261 } +262returnnew File(file); +263 } +264 +265/** +266 * Returns a value from the properties file as a File object. If the value was specified as a system property or +267 * passed in via the -Dprop=value argument - this method will return the value from the system properties before the +268 * values in the contained configuration file. +269 * +270 * This method will check the configured base directory and will use this as the base of the file path. +271 * Additionally, if the base directory begins with a leading "[JAR]\" sequence with the path to the folder +272 * containing the JAR file containing this class.273 *274 * @param key the key to lookup within the properties file275 * @return the property from the properties file converted to a File object276 */ -277publicstatic File getFile(String key) { +277publicstatic File getDataFile(String key) { 278final String file = getString(key); -279if (file == null) { -280returnnull; -281 } -282returnnew File(file); -283 } -284 -285/** -286 * Returns a value from the properties file as a File object. If the value -287 * was specified as a system property or passed in via the -Dprop=value -288 * argument - this method will return the value from the system properties -289 * before the values in the contained configuration file. -290 * -291 * This method will check the configured base directory and will use this as -292 * the base of the file path. Additionally, if the base directory begins -293 * with a leading "[JAR]\" sequence with the path to the folder containing -294 * the JAR file containing this class. -295 * -296 * @param key the key to lookup within the properties file -297 * @return the property from the properties file converted to a File object +279 Logger.getLogger(Settings.class.getName()).log(Level.FINE, String.format("Settings.getDataFile() - file: '%s'", file)); +280if (file == null) { +281returnnull; +282 } +283if (file.startsWith("[JAR]")) { +284 Logger.getLogger(Settings.class.getName()).log(Level.FINE, "Settings.getDataFile() - transforming filename"); +285final File jarPath = getJarPath(); +286 Logger.getLogger(Settings.class.getName()).log(Level.FINE, String.format("Settings.getDataFile() - jar file: '%s'", jarPath.toString())); +287final File retVal = new File(jarPath, file.substring(6)); +288 Logger.getLogger(Settings.class.getName()).log(Level.FINE, String.format("Settings.getDataFile() - returning: '%s'", retVal.toString())); +289return retVal; +290 } +291returnnew File(file); +292 } +293 +294/** +295 * Attempts to retrieve the folder containing the Jar file containing the Settings class. +296 * +297 * @return a File object298 */ -299publicstatic File getDataFile(String key) { -300final String file = getString(key); -301if (file == null) { -302returnnull; -303 } -304if (file.startsWith("[JAR]/")) { -305final File jarPath = getJarPath(); -306final File newBase = new File(jarPath, file.substring(6)); -307returnnew File(newBase, file); -308 } -309returnnew File(file); -310 } -311 -312/** -313 * Attempts to retrieve the folder containing the Jar file containing the -314 * Settings class. -315 * -316 * @return a File object -317 */ -318privatestatic File getJarPath() { -319final String jarPath = Settings.class.getProtectionDomain().getCodeSource().getLocation().getPath(); -320 String decodedPath = "."; -321try { -322 decodedPath = URLDecoder.decode(jarPath, "UTF-8"); -323 } catch (UnsupportedEncodingException ex) { -324 Logger.getLogger(Settings.class.getName()).log(Level.FINEST, null, ex); -325 } -326 -327final File path = new File(decodedPath); -328if (path.getName().toLowerCase().endsWith(".jar")) { -329return path.getParentFile(); -330 } else { -331returnnew File("."); -332 } -333 } -334 -335/** -336 * Returns a value from the properties file. If the value was specified as a -337 * system property or passed in via the -Dprop=value argument - this method -338 * will return the value from the system properties before the values in the -339 * contained configuration file. -340 * -341 * @param key the key to lookup within the properties file -342 * @param defaultValue the default value for the requested property -343 * @return the property from the properties file -344 */ -345publicstatic String getString(String key, String defaultValue) { -346final String str = System.getProperty(key, INSTANCE.props.getProperty(key, defaultValue)); -347return str; -348 } -349 -350/** -351 * Returns the temporary directory. -352 * -353 * @return the temporary directory -354 */ -355publicstatic File getTempDirectory() { -356returnnew File(Settings.getString(Settings.KEYS.TEMP_DIRECTORY, System.getProperty("java.io.tmpdir"))); -357 } -358 -359/** -360 * Returns a value from the properties file. If the value was specified as a -361 * system property or passed in via the -Dprop=value argument - this method -362 * will return the value from the system properties before the values in the +299privatestatic File getJarPath() { +300final String jarPath = Settings.class.getProtectionDomain().getCodeSource().getLocation().getPath(); +301 String decodedPath = "."; +302try { +303 decodedPath = URLDecoder.decode(jarPath, "UTF-8"); +304 } catch (UnsupportedEncodingException ex) { +305 Logger.getLogger(Settings.class.getName()).log(Level.FINEST, null, ex); +306 } +307 +308final File path = new File(decodedPath); +309if (path.getName().toLowerCase().endsWith(".jar")) { +310return path.getParentFile(); +311 } else { +312returnnew File("."); +313 } +314 } +315 +316/** +317 * Returns a value from the properties file. If the value was specified as a system property or passed in via the +318 * -Dprop=value argument - this method will return the value from the system properties before the values in the +319 * contained configuration file. +320 * +321 * @param key the key to lookup within the properties file +322 * @param defaultValue the default value for the requested property +323 * @return the property from the properties file +324 */ +325publicstatic String getString(String key, String defaultValue) { +326final String str = System.getProperty(key, INSTANCE.props.getProperty(key, defaultValue)); +327return str; +328 } +329 +330/** +331 * Returns the temporary directory. +332 * +333 * @return the temporary directory +334 */ +335publicstatic File getTempDirectory() { +336returnnew File(Settings.getString(Settings.KEYS.TEMP_DIRECTORY, System.getProperty("java.io.tmpdir"))); +337 } +338 +339/** +340 * Returns a value from the properties file. If the value was specified as a system property or passed in via the +341 * -Dprop=value argument - this method will return the value from the system properties before the values in the +342 * contained configuration file. +343 * +344 * @param key the key to lookup within the properties file +345 * @return the property from the properties file +346 */ +347publicstatic String getString(String key) { +348return System.getProperty(key, INSTANCE.props.getProperty(key)); +349 } +350 +351/** +352 * Removes a property from the local properties collection. This is mainly used in test cases. +353 * +354 * @param key the property key to remove +355 */ +356publicstaticvoid removeProperty(String key) { +357 INSTANCE.props.remove(key); +358 } +359 +360/** +361 * Returns an int value from the properties file. If the value was specified as a system property or passed in via +362 * the -Dprop=value argument - this method will return the value from the system properties before the values in the363 * contained configuration file.364 *365 * @param key the key to lookup within the properties file366 * @return the property from the properties file -367 */ -368publicstatic String getString(String key) { -369return System.getProperty(key, INSTANCE.props.getProperty(key)); -370 } -371 -372/** -373 * Removes a property from the local properties collection. This is mainly -374 * used in test cases. -375 * -376 * @param key the property key to remove -377 */ -378publicstaticvoid removeProperty(String key) { -379 INSTANCE.props.remove(key); -380 } -381 -382/** -383 * Returns an int value from the properties file. If the value was specified -384 * as a system property or passed in via the -Dprop=value argument - this -385 * method will return the value from the system properties before the values -386 * in the contained configuration file. -387 * -388 * @param key the key to lookup within the properties file -389 * @return the property from the properties file -390 * @throws InvalidSettingException is thrown if there is an error retrieving -391 * the setting -392 */ -393publicstaticint getInt(String key) throws InvalidSettingException { -394int value; -395try { -396 value = Integer.parseInt(Settings.getString(key)); -397 } catch (NumberFormatException ex) { -398thrownewInvalidSettingException("Could not convert property '" + key + "' to an int.", ex); -399 } -400return value; -401 } -402 -403/** -404 * Returns an int value from the properties file. If the value was specified -405 * as a system property or passed in via the -Dprop=value argument - this -406 * method will return the value from the system properties before the values -407 * in the contained configuration file. -408 * -409 * @param key the key to lookup within the properties file -410 * @param defaultValue the default value to return -411 * @return the property from the properties file or the defaultValue if the -412 * property does not exist or cannot be converted to an integer -413 */ -414publicstaticint getInt(String key, int defaultValue) { -415int value; -416try { -417 value = Integer.parseInt(Settings.getString(key)); -418 } catch (NumberFormatException ex) { -419final String msg = String.format("Could not convert property '%s' to an int.", key); -420 Logger.getLogger(Settings.class.getName()).log(Level.FINEST, msg, ex); -421 value = defaultValue; -422 } -423return value; -424 } -425 -426/** -427 * Returns a long value from the properties file. If the value was specified -428 * as a system property or passed in via the -Dprop=value argument - this -429 * method will return the value from the system properties before the values -430 * in the contained configuration file. -431 * -432 * @param key the key to lookup within the properties file -433 * @return the property from the properties file -434 * @throws InvalidSettingException is thrown if there is an error retrieving -435 * the setting -436 */ -437publicstaticlong getLong(String key) throws InvalidSettingException { -438long value; -439try { -440 value = Long.parseLong(Settings.getString(key)); -441 } catch (NumberFormatException ex) { -442thrownewInvalidSettingException("Could not convert property '" + key + "' to an int.", ex); -443 } -444return value; -445 } -446 -447/** -448 * Returns a boolean value from the properties file. If the value was -449 * specified as a system property or passed in via the -450 * <code>-Dprop=value</code> argument this method will return the value from -451 * the system properties before the values in the contained configuration -452 * file. -453 * -454 * @param key the key to lookup within the properties file -455 * @return the property from the properties file -456 * @throws InvalidSettingException is thrown if there is an error retrieving -457 * the setting -458 */ -459publicstaticboolean getBoolean(String key) throws InvalidSettingException { -460boolean value; -461try { -462 value = Boolean.parseBoolean(Settings.getString(key)); -463 } catch (NumberFormatException ex) { -464thrownewInvalidSettingException("Could not convert property '" + key + "' to an int.", ex); -465 } -466return value; -467 } -468 } +367 * @throws InvalidSettingException is thrown if there is an error retrieving the setting +368 */ +369publicstaticint getInt(String key) throws InvalidSettingException { +370int value; +371try { +372 value = Integer.parseInt(Settings.getString(key)); +373 } catch (NumberFormatException ex) { +374thrownewInvalidSettingException("Could not convert property '" + key + "' to an int.", ex); +375 } +376return value; +377 } +378 +379/** +380 * Returns an int value from the properties file. If the value was specified as a system property or passed in via +381 * the -Dprop=value argument - this method will return the value from the system properties before the values in the +382 * contained configuration file. +383 * +384 * @param key the key to lookup within the properties file +385 * @param defaultValue the default value to return +386 * @return the property from the properties file or the defaultValue if the property does not exist or cannot be +387 * converted to an integer +388 */ +389publicstaticint getInt(String key, int defaultValue) { +390int value; +391try { +392 value = Integer.parseInt(Settings.getString(key)); +393 } catch (NumberFormatException ex) { +394final String msg = String.format("Could not convert property '%s' to an int.", key); +395 Logger.getLogger(Settings.class.getName()).log(Level.FINEST, msg, ex); +396 value = defaultValue; +397 } +398return value; +399 } +400 +401/** +402 * Returns a long value from the properties file. If the value was specified as a system property or passed in via +403 * the -Dprop=value argument - this method will return the value from the system properties before the values in the +404 * contained configuration file. +405 * +406 * @param key the key to lookup within the properties file +407 * @return the property from the properties file +408 * @throws InvalidSettingException is thrown if there is an error retrieving the setting +409 */ +410publicstaticlong getLong(String key) throws InvalidSettingException { +411long value; +412try { +413 value = Long.parseLong(Settings.getString(key)); +414 } catch (NumberFormatException ex) { +415thrownewInvalidSettingException("Could not convert property '" + key + "' to an int.", ex); +416 } +417return value; +418 } +419 +420/** +421 * Returns a boolean value from the properties file. If the value was specified as a system property or passed in +422 * via the <code>-Dprop=value</code> argument this method will return the value from the system properties before +423 * the values in the contained configuration file. +424 * +425 * @param key the key to lookup within the properties file +426 * @return the property from the properties file +427 * @throws InvalidSettingException is thrown if there is an error retrieving the setting +428 */ +429publicstaticboolean getBoolean(String key) throws InvalidSettingException { +430boolean value; +431try { +432 value = Boolean.parseBoolean(Settings.getString(key)); +433 } catch (NumberFormatException ex) { +434thrownewInvalidSettingException("Could not convert property '" + key + "' to an int.", ex); +435 } +436return value; +437 } +438 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/utils/UrlStringUtils.html b/dependency-check-core/xref/org/owasp/dependencycheck/utils/UrlStringUtils.html index fca417c37..e9a7f5085 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/utils/UrlStringUtils.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/utils/UrlStringUtils.html @@ -9,84 +9,84 @@ 1/*2 * This file is part of dependency-check-core.3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2013 Jeremy Long. All Rights Reserved. -18 */ -19package org.owasp.dependencycheck.utils; -20 -21import java.net.MalformedURLException; -22import java.net.URL; -23import java.util.ArrayList; -24import java.util.Arrays; -25import java.util.HashSet; -26import java.util.List; -27import java.util.regex.Pattern; -28 -29/** -30 * -31 * @author Jeremy Long <jeremy.long@owasp.org> -32 */ -33publicfinalclassUrlStringUtils { -34 -35/** -36 * Private constructor for a utility class. -37 */ -38privateUrlStringUtils() { -39 } -40/** -41 * A regular expression to test if a string contains a URL. -42 */ -43privatestaticfinal Pattern CONTAINS_URL_TEST = Pattern.compile("^.*(ht|f)tps?://.*$", Pattern.MULTILINE | Pattern.CASE_INSENSITIVE); -44/** -45 * A regular expression to test if a string is a URL. -46 */ -47privatestaticfinal Pattern IS_URL_TEST = Pattern.compile("^(ht|f)tps?://.*", Pattern.CASE_INSENSITIVE); -48 -49/** -50 * Tests if the text provided contains a URL. This is somewhat limited -51 * search in that it only looks for (ftp|http|https):// -52 * -53 * @param text the text to search -54 * @return true if the text contains a url, otherwise false -55 */ -56publicstaticboolean containsUrl(String text) { -57return CONTAINS_URL_TEST.matcher(text).matches(); -58 } -59 -60/** -61 * Tests if the given text is url. -62 * -63 * @param text the string to test -64 * @return returns true if the text is a url, otherwise false -65 */ -66publicstaticboolean isUrl(String text) { -67return IS_URL_TEST.matcher(text).matches(); -68 } -69/** -70 * A listing of domain parts that should not be used as evidence. Yes, this -71 * is an incomplete list. -72 */ -73privatestaticfinal HashSet<String> IGNORE_LIST = new HashSet<String>( -74 Arrays.asList("www", "com", "org", "gov", "info", "name", "net", "pro", "tel", "mobi", "xxx")); -75 -76/** -77 * <p>Takes a URL, in String format, and adds the important parts of the URL -78 * to a list of strings.</p> -79 * <p>Example, given the following input:</p> -80 * <code>"https://www.somedomain.com/path1/path2/file.php?id=439"</code> -81 * <p>The function would return:</p> +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2013 Jeremy Long. All Rights Reserved. +17 */ +18package org.owasp.dependencycheck.utils; +19 +20import java.net.MalformedURLException; +21import java.net.URL; +22import java.util.ArrayList; +23import java.util.Arrays; +24import java.util.HashSet; +25import java.util.List; +26import java.util.regex.Pattern; +27 +28/** +29 * +30 * @author Jeremy Long <jeremy.long@owasp.org> +31 */ +32publicfinalclassUrlStringUtils { +33 +34/** +35 * Private constructor for a utility class. +36 */ +37privateUrlStringUtils() { +38 } +39/** +40 * A regular expression to test if a string contains a URL. +41 */ +42privatestaticfinal Pattern CONTAINS_URL_TEST = Pattern.compile("^.*(ht|f)tps?://.*$", Pattern.MULTILINE | Pattern.CASE_INSENSITIVE); +43/** +44 * A regular expression to test if a string is a URL. +45 */ +46privatestaticfinal Pattern IS_URL_TEST = Pattern.compile("^(ht|f)tps?://.*", Pattern.CASE_INSENSITIVE); +47 +48/** +49 * Tests if the text provided contains a URL. This is somewhat limited search in that it only looks for +50 * (ftp|http|https):// +51 * +52 * @param text the text to search +53 * @return true if the text contains a url, otherwise false +54 */ +55publicstaticboolean containsUrl(String text) { +56return CONTAINS_URL_TEST.matcher(text).matches(); +57 } +58 +59/** +60 * Tests if the given text is url. +61 * +62 * @param text the string to test +63 * @return returns true if the text is a url, otherwise false +64 */ +65publicstaticboolean isUrl(String text) { +66return IS_URL_TEST.matcher(text).matches(); +67 } +68/** +69 * A listing of domain parts that should not be used as evidence. Yes, this is an incomplete list. +70 */ +71privatestaticfinal HashSet<String> IGNORE_LIST = new HashSet<String>( +72 Arrays.asList("www", "com", "org", "gov", "info", "name", "net", "pro", "tel", "mobi", "xxx")); +73 +74/** +75 * <p> +76 * Takes a URL, in String format, and adds the important parts of the URL to a list of strings.</p> +77 * <p> +78 * Example, given the following input:</p> +79 * <code>"https://www.somedomain.com/path1/path2/file.php?id=439"</code> +80 * <p> +81 * The function would return:</p>82 * <code>{"some.domain", "path1", "path2", "file"}</code>83 *84 * @param text a URL diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/utils/package-frame.html b/dependency-check-core/xref/org/owasp/dependencycheck/utils/package-frame.html index 412e62b39..390a75f59 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/utils/package-frame.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/utils/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.0.8 Reference Package org.owasp.dependencycheck.utils + Dependency-Check Core 1.1.0 Reference Package org.owasp.dependencycheck.utils diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/utils/package-summary.html b/dependency-check-core/xref/org/owasp/dependencycheck/utils/package-summary.html index 69f614c98..b9deec0db 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/utils/package-summary.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/utils/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.0.8 Reference Package org.owasp.dependencycheck.utils + Dependency-Check Core 1.1.0 Reference Package org.owasp.dependencycheck.utils diff --git a/dependency-check-core/xref/overview-frame.html b/dependency-check-core/xref/overview-frame.html index 923d58ddf..da9603163 100644 --- a/dependency-check-core/xref/overview-frame.html +++ b/dependency-check-core/xref/overview-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.0.8 Reference + Dependency-Check Core 1.1.0 Reference @@ -16,16 +16,10 @@ -

    Dependency-Check Core 1.0.8 Reference

    +

    Dependency-Check Core 1.1.0 Reference

    org.owasp.dependencycheck.analyzer
    - org.owasp.dependencycheck.concurrency -
    diff --git a/dependency-check-core/xref/allclasses-frame.html b/dependency-check-core/xref/allclasses-frame.html index 39b33f85e..6bba2c98b 100644 --- a/dependency-check-core/xref/allclasses-frame.html +++ b/dependency-check-core/xref/allclasses-frame.html @@ -78,7 +78,7 @@ ClassNameInformation
  • - Confidence + Confidence
  • Configuration @@ -148,12 +148,6 @@
  • Developers -
    • -
  • - DirectoryLockException -
    • -
  • - DirectorySpinLock
  • DistributionManagement @@ -259,9 +253,6 @@
  • InvalidDataException -
    • -
  • - InvalidDirectoryException
  • InvalidSettingException diff --git a/dependency-check-core/xref/index.html b/dependency-check-core/xref/index.html index ee1057b2b..a4104d262 100644 --- a/dependency-check-core/xref/index.html +++ b/dependency-check-core/xref/index.html @@ -4,7 +4,7 @@ - Dependency-Check Core 1.0.8 Reference + Dependency-Check Core 1.1.0 Reference diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/Engine.html b/dependency-check-core/xref/org/owasp/dependencycheck/Engine.html index 4c1a112b1..092bbd2da 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/Engine.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/Engine.html @@ -9,453 +9,441 @@ 1 /* 2 * This file is part of dependency-check-core. 3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. -18 */ -19 package org.owasp.dependencycheck; -20 -21 import java.io.File; -22 import java.util.ArrayList; -23 import java.util.EnumMap; -24 import java.util.HashSet; -25 import java.util.Iterator; -26 import java.util.List; -27 import java.util.Set; -28 import java.util.logging.Level; -29 import java.util.logging.Logger; -30 import org.owasp.dependencycheck.analyzer.AnalysisException; -31 import org.owasp.dependencycheck.analyzer.AnalysisPhase; -32 import org.owasp.dependencycheck.analyzer.Analyzer; -33 import org.owasp.dependencycheck.analyzer.AnalyzerService; -34 import org.owasp.dependencycheck.data.cpe.CpeMemoryIndex; -35 import org.owasp.dependencycheck.data.cpe.IndexException; -36 import org.owasp.dependencycheck.data.nvdcve.CveDB; -37 import org.owasp.dependencycheck.data.nvdcve.DatabaseException; -38 import org.owasp.dependencycheck.data.update.CachedWebDataSource; -39 import org.owasp.dependencycheck.data.update.UpdateService; -40 import org.owasp.dependencycheck.data.update.exception.UpdateException; -41 import org.owasp.dependencycheck.dependency.Dependency; -42 import org.owasp.dependencycheck.exception.NoDataException; -43 import org.owasp.dependencycheck.utils.FileUtils; -44 import org.owasp.dependencycheck.utils.InvalidSettingException; -45 import org.owasp.dependencycheck.utils.Settings; -46 -47 /** -48 * Scans files, directories, etc. for Dependencies. Analyzers are loaded and used to process the files found by the -49 * scan, if a file is encountered and an Analyzer is associated with the file type then the file is turned into a -50 * dependency. -51 * -52 * @author Jeremy Long <jeremy.long@owasp.org> -53 */ -54 public class Engine { -55 -56 /** -57 * The list of dependencies. -58 */ -59 private final List<Dependency> dependencies = new ArrayList<Dependency>(); -60 /** -61 * A Map of analyzers grouped by Analysis phase. -62 */ -63 private final EnumMap<AnalysisPhase, List<Analyzer>> analyzers -64 = new EnumMap<AnalysisPhase, List<Analyzer>>(AnalysisPhase.class); -65 /** -66 * A set of extensions supported by the analyzers. -67 */ -68 private final Set<String> extensions = new HashSet<String>(); -69 -70 /** -71 * Creates a new Engine. -72 */ -73 public Engine() { -74 boolean autoUpdate = true; -75 try { -76 autoUpdate = Settings.getBoolean(Settings.KEYS.AUTO_UPDATE); -77 } catch (InvalidSettingException ex) { -78 Logger.getLogger(Engine.class.getName()).log(Level.FINE, "Invalid setting for auto-update; using true."); -79 } -80 if (autoUpdate) { -81 doUpdates(); -82 } -83 loadAnalyzers(); -84 } -85 -86 /** -87 * Creates a new Engine. -88 * -89 * @param autoUpdate indicates whether or not data should be updated from the Internet -90 * @deprecated This function should no longer be used; the autoupdate flag should be set using: -91 * <code>Settings.setBoolean(Settings.KEYS.AUTO_UPDATE, value);</code> -92 */ -93 @Deprecated -94 public Engine(boolean autoUpdate) { -95 if (autoUpdate) { -96 doUpdates(); -97 } -98 loadAnalyzers(); -99 } -100 -101 /** -102 * Loads the analyzers specified in the configuration file (or system properties). -103 */ -104 private void loadAnalyzers() { -105 -106 for (AnalysisPhase phase : AnalysisPhase.values()) { -107 analyzers.put(phase, new ArrayList<Analyzer>()); -108 } -109 -110 final AnalyzerService service = AnalyzerService.getInstance(); -111 final Iterator<Analyzer> iterator = service.getAnalyzers(); -112 while (iterator.hasNext()) { -113 final Analyzer a = iterator.next(); -114 analyzers.get(a.getAnalysisPhase()).add(a); -115 if (a.getSupportedExtensions() != null) { -116 extensions.addAll(a.getSupportedExtensions()); -117 } -118 } -119 } -120 -121 /** -122 * Get the List of the analyzers for a specific phase of analysis. -123 * -124 * @param phase the phase to get the configured analyzers. -125 * @return the analyzers loaded -126 */ -127 public List<Analyzer> getAnalyzers(AnalysisPhase phase) { -128 return analyzers.get(phase); -129 } -130 -131 /** -132 * Get the dependencies identified. -133 * -134 * @return the dependencies identified -135 */ -136 public List<Dependency> getDependencies() { -137 return dependencies; -138 } -139 -140 /** -141 * Scans an array of files or directories. If a directory is specified, it will be scanned recursively. Any -142 * dependencies identified are added to the dependency collection. -143 * -144 * @since v0.3.2.5 +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. +17 */ +18 package org.owasp.dependencycheck; +19 +20 import java.io.File; +21 import java.util.ArrayList; +22 import java.util.EnumMap; +23 import java.util.HashSet; +24 import java.util.Iterator; +25 import java.util.List; +26 import java.util.Set; +27 import java.util.logging.Level; +28 import java.util.logging.Logger; +29 import org.owasp.dependencycheck.analyzer.AnalysisException; +30 import org.owasp.dependencycheck.analyzer.AnalysisPhase; +31 import org.owasp.dependencycheck.analyzer.Analyzer; +32 import org.owasp.dependencycheck.analyzer.AnalyzerService; +33 import org.owasp.dependencycheck.data.cpe.CpeMemoryIndex; +34 import org.owasp.dependencycheck.data.cpe.IndexException; +35 import org.owasp.dependencycheck.data.nvdcve.CveDB; +36 import org.owasp.dependencycheck.data.nvdcve.DatabaseException; +37 import org.owasp.dependencycheck.data.update.CachedWebDataSource; +38 import org.owasp.dependencycheck.data.update.UpdateService; +39 import org.owasp.dependencycheck.data.update.exception.UpdateException; +40 import org.owasp.dependencycheck.dependency.Dependency; +41 import org.owasp.dependencycheck.exception.NoDataException; +42 import org.owasp.dependencycheck.utils.FileUtils; +43 import org.owasp.dependencycheck.utils.InvalidSettingException; +44 import org.owasp.dependencycheck.utils.Settings; +45 +46 /** +47 * Scans files, directories, etc. for Dependencies. Analyzers are loaded and used to process the files found by the +48 * scan, if a file is encountered and an Analyzer is associated with the file type then the file is turned into a +49 * dependency. +50 * +51 * @author Jeremy Long <jeremy.long@owasp.org> +52 */ +53 public class Engine { +54 +55 /** +56 * The list of dependencies. +57 */ +58 private final List<Dependency> dependencies; +59 /** +60 * A Map of analyzers grouped by Analysis phase. +61 */ +62 private final EnumMap<AnalysisPhase, List<Analyzer>> analyzers; +63 /** +64 * A set of extensions supported by the analyzers. +65 */ +66 private final Set<String> extensions; +67 +68 /** +69 * Creates a new Engine. +70 */ +71 public Engine() { +72 this.extensions = new HashSet<String>(); +73 this.dependencies = new ArrayList<Dependency>(); +74 this.analyzers = new EnumMap<AnalysisPhase, List<Analyzer>>(AnalysisPhase.class); +75 +76 boolean autoUpdate = true; +77 try { +78 autoUpdate = Settings.getBoolean(Settings.KEYS.AUTO_UPDATE); +79 } catch (InvalidSettingException ex) { +80 Logger.getLogger(Engine.class.getName()).log(Level.FINE, "Invalid setting for auto-update; using true."); +81 } +82 if (autoUpdate) { +83 doUpdates(); +84 } +85 loadAnalyzers(); +86 } +87 +88 /** +89 * Loads the analyzers specified in the configuration file (or system properties). +90 */ +91 private void loadAnalyzers() { +92 +93 for (AnalysisPhase phase : AnalysisPhase.values()) { +94 analyzers.put(phase, new ArrayList<Analyzer>()); +95 } +96 +97 final AnalyzerService service = AnalyzerService.getInstance(); +98 final Iterator<Analyzer> iterator = service.getAnalyzers(); +99 while (iterator.hasNext()) { +100 final Analyzer a = iterator.next(); +101 analyzers.get(a.getAnalysisPhase()).add(a); +102 if (a.getSupportedExtensions() != null) { +103 extensions.addAll(a.getSupportedExtensions()); +104 } +105 } +106 } +107 +108 /** +109 * Get the List of the analyzers for a specific phase of analysis. +110 * +111 * @param phase the phase to get the configured analyzers. +112 * @return the analyzers loaded +113 */ +114 public List<Analyzer> getAnalyzers(AnalysisPhase phase) { +115 return analyzers.get(phase); +116 } +117 +118 /** +119 * Get the dependencies identified. +120 * +121 * @return the dependencies identified +122 */ +123 public List<Dependency> getDependencies() { +124 return dependencies; +125 } +126 +127 /** +128 * Scans an array of files or directories. If a directory is specified, it will be scanned recursively. Any +129 * dependencies identified are added to the dependency collection. +130 * +131 * @since v0.3.2.5 +132 * +133 * @param paths an array of paths to files or directories to be analyzed. +134 */ +135 public void scan(String[] paths) { +136 for (String path : paths) { +137 final File file = new File(path); +138 scan(file); +139 } +140 } +141 +142 /** +143 * Scans a given file or directory. If a directory is specified, it will be scanned recursively. Any dependencies +144 * identified are added to the dependency collection. 145 * -146 * @param paths an array of paths to files or directories to be analyzed. +146 * @param path the path to a file or directory to be analyzed. 147 */ -148 public void scan(String[] paths) { -149 for (String path : paths) { -150 final File file = new File(path); -151 scan(file); -152 } -153 } -154 -155 /** -156 * Scans a given file or directory. If a directory is specified, it will be scanned recursively. Any dependencies -157 * identified are added to the dependency collection. +148 public void scan(String path) { +149 final File file = new File(path); +150 scan(file); +151 } +152 +153 /** +154 * Scans an array of files or directories. If a directory is specified, it will be scanned recursively. Any +155 * dependencies identified are added to the dependency collection. +156 * +157 * @since v0.3.2.5 158 * -159 * @param path the path to a file or directory to be analyzed. +159 * @param files an array of paths to files or directories to be analyzed. 160 */ -161 public void scan(String path) { -162 final File file = new File(path); -163 scan(file); -164 } -165 -166 /** -167 * Scans an array of files or directories. If a directory is specified, it will be scanned recursively. Any -168 * dependencies identified are added to the dependency collection. -169 * -170 * @since v0.3.2.5 -171 * -172 * @param files an array of paths to files or directories to be analyzed. -173 */ -174 public void scan(File[] files) { -175 for (File file : files) { -176 scan(file); -177 } -178 } -179 -180 /** -181 * Scans a list of files or directories. If a directory is specified, it will be scanned recursively. Any -182 * dependencies identified are added to the dependency collection. -183 * -184 * @since v0.3.2.5 -185 * -186 * @param files a set of paths to files or directories to be analyzed. -187 */ -188 public void scan(Set<File> files) { -189 for (File file : files) { -190 scan(file); -191 } -192 } -193 -194 /** -195 * Scans a list of files or directories. If a directory is specified, it will be scanned recursively. Any -196 * dependencies identified are added to the dependency collection. -197 * -198 * @since v0.3.2.5 -199 * -200 * @param files a set of paths to files or directories to be analyzed. -201 */ -202 public void scan(List<File> files) { -203 for (File file : files) { -204 scan(file); -205 } -206 } -207 -208 /** -209 * Scans a given file or directory. If a directory is specified, it will be scanned recursively. Any dependencies -210 * identified are added to the dependency collection. -211 * -212 * @since v0.3.2.4 -213 * -214 * @param file the path to a file or directory to be analyzed. -215 */ -216 public void scan(File file) { -217 if (file.exists()) { -218 if (file.isDirectory()) { -219 scanDirectory(file); -220 } else { -221 scanFile(file); -222 } -223 } -224 } -225 -226 /** -227 * Recursively scans files and directories. Any dependencies identified are added to the dependency collection. -228 * -229 * @param dir the directory to scan. -230 */ -231 protected void scanDirectory(File dir) { -232 final File[] files = dir.listFiles(); -233 if (files != null) { -234 for (File f : files) { -235 if (f.isDirectory()) { -236 scanDirectory(f); -237 } else { -238 scanFile(f); -239 } -240 } +161 public void scan(File[] files) { +162 for (File file : files) { +163 scan(file); +164 } +165 } +166 +167 /** +168 * Scans a list of files or directories. If a directory is specified, it will be scanned recursively. Any +169 * dependencies identified are added to the dependency collection. +170 * +171 * @since v0.3.2.5 +172 * +173 * @param files a set of paths to files or directories to be analyzed. +174 */ +175 public void scan(Set<File> files) { +176 for (File file : files) { +177 scan(file); +178 } +179 } +180 +181 /** +182 * Scans a list of files or directories. If a directory is specified, it will be scanned recursively. Any +183 * dependencies identified are added to the dependency collection. +184 * +185 * @since v0.3.2.5 +186 * +187 * @param files a set of paths to files or directories to be analyzed. +188 */ +189 public void scan(List<File> files) { +190 for (File file : files) { +191 scan(file); +192 } +193 } +194 +195 /** +196 * Scans a given file or directory. If a directory is specified, it will be scanned recursively. Any dependencies +197 * identified are added to the dependency collection. +198 * +199 * @since v0.3.2.4 +200 * +201 * @param file the path to a file or directory to be analyzed. +202 */ +203 public void scan(File file) { +204 if (file.exists()) { +205 if (file.isDirectory()) { +206 scanDirectory(file); +207 } else { +208 scanFile(file); +209 } +210 } +211 } +212 +213 /** +214 * Recursively scans files and directories. Any dependencies identified are added to the dependency collection. +215 * +216 * @param dir the directory to scan. +217 */ +218 protected void scanDirectory(File dir) { +219 final File[] files = dir.listFiles(); +220 if (files != null) { +221 for (File f : files) { +222 if (f.isDirectory()) { +223 scanDirectory(f); +224 } else { +225 scanFile(f); +226 } +227 } +228 } +229 } +230 +231 /** +232 * Scans a specified file. If a dependency is identified it is added to the dependency collection. +233 * +234 * @param file The file to scan. +235 */ +236 protected void scanFile(File file) { +237 if (!file.isFile()) { +238 final String msg = String.format("Path passed to scanFile(File) is not a file: %s. Skipping the file.", file.toString()); +239 Logger.getLogger(Engine.class.getName()).log(Level.FINE, msg); +240 return; 241 } -242 } -243 -244 /** -245 * Scans a specified file. If a dependency is identified it is added to the dependency collection. -246 * -247 * @param file The file to scan. -248 */ -249 protected void scanFile(File file) { -250 if (!file.isFile()) { -251 final String msg = String.format("Path passed to scanFile(File) is not a file: %s. Skipping the file.", file.toString()); -252 Logger.getLogger(Engine.class.getName()).log(Level.FINE, msg); -253 return; -254 } -255 final String fileName = file.getName(); -256 final String extension = FileUtils.getFileExtension(fileName); -257 if (extension != null) { -258 if (extensions.contains(extension)) { -259 final Dependency dependency = new Dependency(file); -260 dependencies.add(dependency); -261 } -262 } else { -263 final String msg = String.format("No file extension found on file '%s'. The file was not analyzed.", -264 file.toString()); -265 Logger.getLogger(Engine.class.getName()).log(Level.FINEST, msg); -266 } -267 } -268 -269 /** -270 * Runs the analyzers against all of the dependencies. -271 */ -272 public void analyzeDependencies() { -273 //need to ensure that data exists -274 try { -275 ensureDataExists(); -276 } catch (NoDataException ex) { -277 final String msg = String.format("%s%n%nUnable to continue dependency-check analysis.", ex.getMessage()); -278 Logger.getLogger(Engine.class.getName()).log(Level.SEVERE, msg); -279 Logger.getLogger(Engine.class.getName()).log(Level.FINE, null, ex); -280 return; -281 } catch (DatabaseException ex) { -282 final String msg = String.format("%s%n%nUnable to continue dependency-check analysis.", ex.getMessage()); -283 Logger.getLogger(Engine.class.getName()).log(Level.SEVERE, msg); -284 Logger.getLogger(Engine.class.getName()).log(Level.FINE, null, ex); -285 return; -286 -287 } -288 -289 final String logHeader = String.format("%n" -290 + "----------------------------------------------------%n" -291 + "BEGIN ANALYSIS%n" -292 + "----------------------------------------------------"); -293 Logger.getLogger(Engine.class.getName()).log(Level.FINE, logHeader); -294 Logger.getLogger(Engine.class.getName()).log(Level.INFO, "Analysis Starting"); -295 -296 //phase one initialize -297 for (AnalysisPhase phase : AnalysisPhase.values()) { -298 final List<Analyzer> analyzerList = analyzers.get(phase); -299 for (Analyzer a : analyzerList) { -300 try { -301 final String msg = String.format("Initializing %s", a.getName()); -302 Logger.getLogger(Engine.class.getName()).log(Level.FINE, msg); -303 a.initialize(); -304 } catch (Exception ex) { -305 final String msg = String.format("Exception occurred initializing %s.", a.getName()); -306 Logger.getLogger(Engine.class.getName()).log(Level.SEVERE, msg); -307 Logger.getLogger(Engine.class.getName()).log(Level.INFO, null, ex); -308 try { -309 a.close(); -310 } catch (Exception ex1) { -311 Logger.getLogger(Engine.class.getName()).log(Level.FINEST, null, ex1); -312 } -313 } -314 } -315 } -316 -317 // analysis phases -318 for (AnalysisPhase phase : AnalysisPhase.values()) { -319 final List<Analyzer> analyzerList = analyzers.get(phase); -320 -321 for (Analyzer a : analyzerList) { -322 /* need to create a copy of the collection because some of the -323 * analyzers may modify it. This prevents ConcurrentModificationExceptions. -324 * This is okay for adds/deletes because it happens per analyzer. -325 */ -326 final String msg = String.format("Begin Analyzer '%s'", a.getName()); -327 Logger.getLogger(Engine.class.getName()).log(Level.FINE, msg); -328 final Set<Dependency> dependencySet = new HashSet<Dependency>(); -329 dependencySet.addAll(dependencies); -330 for (Dependency d : dependencySet) { -331 if (a.supportsExtension(d.getFileExtension())) { -332 final String msgFile = String.format("Begin Analysis of '%s'", d.getActualFilePath()); -333 Logger.getLogger(Engine.class.getName()).log(Level.FINE, msgFile); -334 try { -335 a.analyze(d, this); -336 } catch (AnalysisException ex) { -337 d.addAnalysisException(ex); -338 } catch (Throwable ex) { -339 final String axMsg = String.format("An unexpected error occurred during analysis of '%s'", d.getActualFilePath()); -340 final AnalysisException ax = new AnalysisException(axMsg, ex); -341 d.addAnalysisException(ax); -342 Logger.getLogger(Engine.class.getName()).log(Level.SEVERE, axMsg); -343 Logger.getLogger(Engine.class.getName()).log(Level.FINE, axMsg, ex); -344 } -345 } -346 } -347 } -348 } -349 -350 //close/cleanup -351 for (AnalysisPhase phase : AnalysisPhase.values()) { -352 final List<Analyzer> analyzerList = analyzers.get(phase); -353 for (Analyzer a : analyzerList) { -354 final String msg = String.format("Closing Analyzer '%s'", a.getName()); -355 Logger.getLogger(Engine.class.getName()).log(Level.FINE, msg); -356 try { -357 a.close(); -358 } catch (Exception ex) { -359 Logger.getLogger(Engine.class.getName()).log(Level.FINEST, null, ex); -360 } -361 } -362 } -363 -364 final String logFooter = String.format("%n" -365 + "----------------------------------------------------%n" -366 + "END ANALYSIS%n" -367 + "----------------------------------------------------"); -368 Logger.getLogger(Engine.class.getName()).log(Level.FINE, logFooter); -369 } -370 -371 /** -372 * Cycles through the cached web data sources and calls update on all of them. -373 */ -374 private void doUpdates() { -375 final UpdateService service = UpdateService.getInstance(); -376 final Iterator<CachedWebDataSource> iterator = service.getDataSources(); -377 while (iterator.hasNext()) { -378 final CachedWebDataSource source = iterator.next(); -379 try { -380 source.update(); -381 } catch (UpdateException ex) { -382 Logger.getLogger(Engine.class.getName()).log(Level.WARNING, -383 "Unable to update Cached Web DataSource, using local data instead. Results may not include recent vulnerabilities."); -384 Logger.getLogger(Engine.class.getName()).log(Level.FINE, -385 String.format("Unable to update details for %s", source.getClass().getName()), ex); -386 } -387 } -388 } -389 -390 /** -391 * Returns a full list of all of the analyzers. This is useful for reporting which analyzers where used. -392 * -393 * @return a list of Analyzers -394 */ -395 public List<Analyzer> getAnalyzers() { -396 final List<Analyzer> ret = new ArrayList<Analyzer>(); -397 for (AnalysisPhase phase : AnalysisPhase.values()) { -398 final List<Analyzer> analyzerList = analyzers.get(phase); -399 ret.addAll(analyzerList); -400 } -401 return ret; -402 } -403 -404 /** -405 * Checks all analyzers to see if an extension is supported. -406 * -407 * @param ext a file extension -408 * @return true or false depending on whether or not the file extension is supported -409 */ -410 public boolean supportsExtension(String ext) { -411 if (ext == null) { -412 return false; -413 } -414 for (AnalysisPhase phase : AnalysisPhase.values()) { -415 final List<Analyzer> analyzerList = analyzers.get(phase); -416 for (Analyzer a : analyzerList) { -417 if (a.getSupportedExtensions() != null && a.supportsExtension(ext)) { -418 return true; -419 } -420 } -421 } -422 return false; -423 } -424 -425 /** -426 * Checks the CPE Index to ensure documents exists. If none exist a NoDataException is thrown. -427 * -428 * @throws NoDataException thrown if no data exists in the CPE Index -429 * @throws DatabaseException thrown if there is an exception opening the database -430 */ -431 private void ensureDataExists() throws NoDataException, DatabaseException { -432 final CpeMemoryIndex cpe = CpeMemoryIndex.getInstance(); -433 final CveDB cve = new CveDB(); -434 -435 try { -436 cve.open(); -437 cpe.open(cve); -438 } catch (IndexException ex) { -439 throw new NoDataException(ex.getMessage(), ex); -440 } catch (DatabaseException ex) { -441 throw new NoDataException(ex.getMessage(), ex); -442 } finally { -443 cve.close(); -444 } -445 if (cpe.numDocs() <= 0) { -446 cpe.close(); -447 throw new NoDataException("No documents exist"); -448 } -449 } -450 } +242 final String fileName = file.getName(); +243 final String extension = FileUtils.getFileExtension(fileName); +244 if (extension != null) { +245 if (extensions.contains(extension)) { +246 final Dependency dependency = new Dependency(file); +247 dependencies.add(dependency); +248 } +249 } else { +250 final String msg = String.format("No file extension found on file '%s'. The file was not analyzed.", +251 file.toString()); +252 Logger.getLogger(Engine.class.getName()).log(Level.FINEST, msg); +253 } +254 } +255 +256 /** +257 * Runs the analyzers against all of the dependencies. +258 */ +259 public void analyzeDependencies() { +260 //need to ensure that data exists +261 try { +262 ensureDataExists(); +263 } catch (NoDataException ex) { +264 final String msg = String.format("%s%n%nUnable to continue dependency-check analysis.", ex.getMessage()); +265 Logger.getLogger(Engine.class.getName()).log(Level.SEVERE, msg); +266 Logger.getLogger(Engine.class.getName()).log(Level.FINE, null, ex); +267 return; +268 } catch (DatabaseException ex) { +269 final String msg = String.format("%s%n%nUnable to continue dependency-check analysis.", ex.getMessage()); +270 Logger.getLogger(Engine.class.getName()).log(Level.SEVERE, msg); +271 Logger.getLogger(Engine.class.getName()).log(Level.FINE, null, ex); +272 return; +273 +274 } +275 +276 final String logHeader = String.format("%n" +277 + "----------------------------------------------------%n" +278 + "BEGIN ANALYSIS%n" +279 + "----------------------------------------------------"); +280 Logger.getLogger(Engine.class.getName()).log(Level.FINE, logHeader); +281 Logger.getLogger(Engine.class.getName()).log(Level.INFO, "Analysis Starting"); +282 +283 //phase one initialize +284 for (AnalysisPhase phase : AnalysisPhase.values()) { +285 final List<Analyzer> analyzerList = analyzers.get(phase); +286 for (Analyzer a : analyzerList) { +287 try { +288 final String msg = String.format("Initializing %s", a.getName()); +289 Logger.getLogger(Engine.class.getName()).log(Level.FINE, msg); +290 a.initialize(); +291 } catch (Exception ex) { +292 final String msg = String.format("Exception occurred initializing %s.", a.getName()); +293 Logger.getLogger(Engine.class.getName()).log(Level.SEVERE, msg); +294 Logger.getLogger(Engine.class.getName()).log(Level.INFO, null, ex); +295 try { +296 a.close(); +297 } catch (Exception ex1) { +298 Logger.getLogger(Engine.class.getName()).log(Level.FINEST, null, ex1); +299 } +300 } +301 } +302 } +303 +304 // analysis phases +305 for (AnalysisPhase phase : AnalysisPhase.values()) { +306 final List<Analyzer> analyzerList = analyzers.get(phase); +307 +308 for (Analyzer a : analyzerList) { +309 /* need to create a copy of the collection because some of the +310 * analyzers may modify it. This prevents ConcurrentModificationExceptions. +311 * This is okay for adds/deletes because it happens per analyzer. +312 */ +313 final String msg = String.format("Begin Analyzer '%s'", a.getName()); +314 Logger.getLogger(Engine.class.getName()).log(Level.FINE, msg); +315 final Set<Dependency> dependencySet = new HashSet<Dependency>(); +316 dependencySet.addAll(dependencies); +317 for (Dependency d : dependencySet) { +318 if (a.supportsExtension(d.getFileExtension())) { +319 final String msgFile = String.format("Begin Analysis of '%s'", d.getActualFilePath()); +320 Logger.getLogger(Engine.class.getName()).log(Level.FINE, msgFile); +321 try { +322 a.analyze(d, this); +323 } catch (AnalysisException ex) { +324 d.addAnalysisException(ex); +325 } catch (Throwable ex) { +326 final String axMsg = String.format("An unexpected error occurred during analysis of '%s'", d.getActualFilePath()); +327 final AnalysisException ax = new AnalysisException(axMsg, ex); +328 d.addAnalysisException(ax); +329 Logger.getLogger(Engine.class.getName()).log(Level.SEVERE, axMsg); +330 Logger.getLogger(Engine.class.getName()).log(Level.FINE, axMsg, ex); +331 } +332 } +333 } +334 } +335 } +336 +337 //close/cleanup +338 for (AnalysisPhase phase : AnalysisPhase.values()) { +339 final List<Analyzer> analyzerList = analyzers.get(phase); +340 for (Analyzer a : analyzerList) { +341 final String msg = String.format("Closing Analyzer '%s'", a.getName()); +342 Logger.getLogger(Engine.class.getName()).log(Level.FINE, msg); +343 try { +344 a.close(); +345 } catch (Exception ex) { +346 Logger.getLogger(Engine.class.getName()).log(Level.FINEST, null, ex); +347 } +348 } +349 } +350 +351 final String logFooter = String.format("%n" +352 + "----------------------------------------------------%n" +353 + "END ANALYSIS%n" +354 + "----------------------------------------------------"); +355 Logger.getLogger(Engine.class.getName()).log(Level.FINE, logFooter); +356 Logger.getLogger(Engine.class.getName()).log(Level.INFO, "Analysis Complete"); +357 } +358 +359 /** +360 * Cycles through the cached web data sources and calls update on all of them. +361 */ +362 private void doUpdates() { +363 final UpdateService service = UpdateService.getInstance(); +364 final Iterator<CachedWebDataSource> iterator = service.getDataSources(); +365 while (iterator.hasNext()) { +366 final CachedWebDataSource source = iterator.next(); +367 try { +368 source.update(); +369 } catch (UpdateException ex) { +370 Logger.getLogger(Engine.class.getName()).log(Level.WARNING, +371 "Unable to update Cached Web DataSource, using local data instead. Results may not include recent vulnerabilities."); +372 Logger.getLogger(Engine.class.getName()).log(Level.FINE, +373 String.format("Unable to update details for %s", source.getClass().getName()), ex); +374 } +375 } +376 } +377 +378 /** +379 * Returns a full list of all of the analyzers. This is useful for reporting which analyzers where used. +380 * +381 * @return a list of Analyzers +382 */ +383 public List<Analyzer> getAnalyzers() { +384 final List<Analyzer> ret = new ArrayList<Analyzer>(); +385 for (AnalysisPhase phase : AnalysisPhase.values()) { +386 final List<Analyzer> analyzerList = analyzers.get(phase); +387 ret.addAll(analyzerList); +388 } +389 return ret; +390 } +391 +392 /** +393 * Checks all analyzers to see if an extension is supported. +394 * +395 * @param ext a file extension +396 * @return true or false depending on whether or not the file extension is supported +397 */ +398 public boolean supportsExtension(String ext) { +399 if (ext == null) { +400 return false; +401 } +402 for (AnalysisPhase phase : AnalysisPhase.values()) { +403 final List<Analyzer> analyzerList = analyzers.get(phase); +404 for (Analyzer a : analyzerList) { +405 if (a.getSupportedExtensions() != null && a.supportsExtension(ext)) { +406 return true; +407 } +408 } +409 } +410 return false; +411 } +412 +413 /** +414 * Checks the CPE Index to ensure documents exists. If none exist a NoDataException is thrown. +415 * +416 * @throws NoDataException thrown if no data exists in the CPE Index +417 * @throws DatabaseException thrown if there is an exception opening the database +418 */ +419 private void ensureDataExists() throws NoDataException, DatabaseException { +420 final CpeMemoryIndex cpe = CpeMemoryIndex.getInstance(); +421 final CveDB cve = new CveDB(); +422 +423 try { +424 cve.open(); +425 cpe.open(cve); +426 } catch (IndexException ex) { +427 throw new NoDataException(ex.getMessage(), ex); +428 } catch (DatabaseException ex) { +429 throw new NoDataException(ex.getMessage(), ex); +430 } finally { +431 cve.close(); +432 } +433 if (cpe.numDocs() <= 0) { +434 cpe.close(); +435 throw new NoDataException("No documents exist"); +436 } +437 } +438 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/AbstractAnalyzer.html b/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/AbstractAnalyzer.html index 5c9546c96..fe33563bb 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/AbstractAnalyzer.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/AbstractAnalyzer.html @@ -9,71 +9,69 @@ 1 /* 2 * This file is part of dependency-check-core. 3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. -18 */ -19 package org.owasp.dependencycheck.analyzer; -20 -21 import java.util.Collections; -22 import java.util.HashSet; -23 import java.util.Set; -24 -25 /** -26 * -27 * @author Jeremy Long <jeremy.long@owasp.org> -28 */ -29 public abstract class AbstractAnalyzer implements Analyzer { -30 -31 /** -32 * Utility method to help in the creation of the extensions set. This -33 * constructs a new Set that can be used in a final static -34 * declaration.<br/><br/> -35 * -36 * This implementation was copied from -37 * http://stackoverflow.com/questions/2041778/initialize-java-hashset-values-by-construction -38 * -39 * @param strings a list of strings to add to the set. -40 * @return a Set of strings. -41 */ -42 protected static Set<String> newHashSet(String... strings) { -43 final Set<String> set = new HashSet<String>(); -44 -45 Collections.addAll(set, strings); -46 return set; -47 } -48 -49 /** -50 * The initialize method does nothing for this Analyzer. -51 * -52 * @throws Exception thrown if there is an exception -53 */ -54 @Override -55 public void initialize() throws Exception { -56 //do nothing -57 } -58 -59 /** -60 * The close method does nothing for this Analyzer. -61 * -62 * @throws Exception thrown if there is an exception -63 */ -64 @Override -65 public void close() throws Exception { -66 //do nothing -67 } -68 } +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. +17 */ +18 package org.owasp.dependencycheck.analyzer; +19 +20 import java.util.Collections; +21 import java.util.HashSet; +22 import java.util.Set; +23 +24 /** +25 * +26 * @author Jeremy Long <jeremy.long@owasp.org> +27 */ +28 public abstract class AbstractAnalyzer implements Analyzer { +29 +30 /** +31 * Utility method to help in the creation of the extensions set. This constructs a new Set that can be used in a +32 * final static declaration.<br/><br/> +33 * +34 * This implementation was copied from +35 * http://stackoverflow.com/questions/2041778/initialize-java-hashset-values-by-construction +36 * +37 * @param strings a list of strings to add to the set. +38 * @return a Set of strings. +39 */ +40 protected static Set<String> newHashSet(String... strings) { +41 final Set<String> set = new HashSet<String>(); +42 +43 Collections.addAll(set, strings); +44 return set; +45 } +46 +47 /** +48 * The initialize method does nothing for this Analyzer. +49 * +50 * @throws Exception thrown if there is an exception +51 */ +52 @Override +53 public void initialize() throws Exception { +54 //do nothing +55 } +56 +57 /** +58 * The close method does nothing for this Analyzer. +59 * +60 * @throws Exception thrown if there is an exception +61 */ +62 @Override +63 public void close() throws Exception { +64 //do nothing +65 } +66 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/AbstractSuppressionAnalyzer.html b/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/AbstractSuppressionAnalyzer.html index 163f28c5a..beba5b35f 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/AbstractSuppressionAnalyzer.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/AbstractSuppressionAnalyzer.html @@ -9,118 +9,115 @@ 1 /* 2 * This file is part of dependency-check-core. 3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2013 Jeremy Long. All Rights Reserved. -18 */ -19 package org.owasp.dependencycheck.analyzer; -20 -21 import java.io.File; -22 import java.util.List; -23 import java.util.Set; -24 import java.util.logging.Level; -25 import java.util.logging.Logger; -26 import org.owasp.dependencycheck.suppression.SuppressionParseException; -27 import org.owasp.dependencycheck.suppression.SuppressionParser; -28 import org.owasp.dependencycheck.suppression.SuppressionRule; -29 import org.owasp.dependencycheck.utils.Settings; -30 -31 /** -32 * Abstract base suppression analyzer that contains methods for parsing the -33 * suppression xml file. -34 * -35 * @author Jeremy Long <jeremy.long@owasp.org> -36 */ -37 public abstract class AbstractSuppressionAnalyzer extends AbstractAnalyzer { -38 -39 //<editor-fold defaultstate="collapsed" desc="All standard implementation details of Analyzer"> -40 /** -41 * Returns a list of file EXTENSIONS supported by this analyzer. -42 * -43 * @return a list of file EXTENSIONS supported by this analyzer. -44 */ -45 public Set<String> getSupportedExtensions() { -46 return null; -47 } -48 -49 /** -50 * Returns whether or not this analyzer can process the given extension. -51 * -52 * @param extension the file extension to test for support. -53 * @return whether or not the specified file extension is supported by this -54 * analyzer. -55 */ -56 @Override -57 public boolean supportsExtension(String extension) { -58 return true; -59 } -60 -61 //</editor-fold> -62 /** -63 * The initialize method loads the suppression XML file. -64 * -65 * @throws Exception thrown if there is an exception -66 */ -67 @Override -68 public void initialize() throws Exception { -69 super.initialize(); -70 loadSuppressionData(); -71 } -72 /** -73 * The list of suppression rules -74 */ -75 private List<SuppressionRule> rules; -76 -77 /** -78 * Get the value of rules. -79 * -80 * @return the value of rules -81 */ -82 public List<SuppressionRule> getRules() { -83 return rules; -84 } -85 -86 /** -87 * Set the value of rules. -88 * -89 * @param rules new value of rules -90 */ -91 public void setRules(List<SuppressionRule> rules) { -92 this.rules = rules; -93 } -94 -95 /** -96 * Loads the suppression rules file. -97 * -98 * @throws SuppressionParseException thrown if the XML cannot be parsed. -99 */ -100 private void loadSuppressionData() throws SuppressionParseException { -101 final File file = Settings.getFile(Settings.KEYS.SUPPRESSION_FILE); -102 if (file != null) { -103 final SuppressionParser parser = new SuppressionParser(); -104 try { -105 rules = parser.parseSuppressionRules(file); -106 } catch (SuppressionParseException ex) { -107 final String msg = String.format("Unable to parse suppression xml file '%s'", file.getPath()); -108 Logger.getLogger(AbstractSuppressionAnalyzer.class.getName()).log(Level.WARNING, msg); -109 Logger.getLogger(AbstractSuppressionAnalyzer.class.getName()).log(Level.WARNING, ex.getMessage()); -110 Logger.getLogger(AbstractSuppressionAnalyzer.class.getName()).log(Level.FINE, null, ex); -111 throw ex; -112 } -113 } -114 } -115 } +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2013 Jeremy Long. All Rights Reserved. +17 */ +18 package org.owasp.dependencycheck.analyzer; +19 +20 import java.io.File; +21 import java.util.List; +22 import java.util.Set; +23 import java.util.logging.Level; +24 import java.util.logging.Logger; +25 import org.owasp.dependencycheck.suppression.SuppressionParseException; +26 import org.owasp.dependencycheck.suppression.SuppressionParser; +27 import org.owasp.dependencycheck.suppression.SuppressionRule; +28 import org.owasp.dependencycheck.utils.Settings; +29 +30 /** +31 * Abstract base suppression analyzer that contains methods for parsing the suppression xml file. +32 * +33 * @author Jeremy Long <jeremy.long@owasp.org> +34 */ +35 public abstract class AbstractSuppressionAnalyzer extends AbstractAnalyzer { +36 +37 //<editor-fold defaultstate="collapsed" desc="All standard implementation details of Analyzer"> +38 /** +39 * Returns a list of file EXTENSIONS supported by this analyzer. +40 * +41 * @return a list of file EXTENSIONS supported by this analyzer. +42 */ +43 public Set<String> getSupportedExtensions() { +44 return null; +45 } +46 +47 /** +48 * Returns whether or not this analyzer can process the given extension. +49 * +50 * @param extension the file extension to test for support. +51 * @return whether or not the specified file extension is supported by this analyzer. +52 */ +53 @Override +54 public boolean supportsExtension(String extension) { +55 return true; +56 } +57 +58 //</editor-fold> +59 /** +60 * The initialize method loads the suppression XML file. +61 * +62 * @throws Exception thrown if there is an exception +63 */ +64 @Override +65 public void initialize() throws Exception { +66 super.initialize(); +67 loadSuppressionData(); +68 } +69 /** +70 * The list of suppression rules +71 */ +72 private List<SuppressionRule> rules; +73 +74 /** +75 * Get the value of rules. +76 * +77 * @return the value of rules +78 */ +79 public List<SuppressionRule> getRules() { +80 return rules; +81 } +82 +83 /** +84 * Set the value of rules. +85 * +86 * @param rules new value of rules +87 */ +88 public void setRules(List<SuppressionRule> rules) { +89 this.rules = rules; +90 } +91 +92 /** +93 * Loads the suppression rules file. +94 * +95 * @throws SuppressionParseException thrown if the XML cannot be parsed. +96 */ +97 private void loadSuppressionData() throws SuppressionParseException { +98 final File file = Settings.getFile(Settings.KEYS.SUPPRESSION_FILE); +99 if (file != null) { +100 final SuppressionParser parser = new SuppressionParser(); +101 try { +102 rules = parser.parseSuppressionRules(file); +103 } catch (SuppressionParseException ex) { +104 final String msg = String.format("Unable to parse suppression xml file '%s'", file.getPath()); +105 Logger.getLogger(AbstractSuppressionAnalyzer.class.getName()).log(Level.WARNING, msg); +106 Logger.getLogger(AbstractSuppressionAnalyzer.class.getName()).log(Level.WARNING, ex.getMessage()); +107 Logger.getLogger(AbstractSuppressionAnalyzer.class.getName()).log(Level.FINE, null, ex); +108 throw ex; +109 } +110 } +111 } +112 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/AnalysisException.html b/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/AnalysisException.html index cb349b854..16c987eb6 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/AnalysisException.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/AnalysisException.html @@ -9,70 +9,69 @@ 1 /* 2 * This file is part of dependency-check-core. 3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. -18 */ -19 package org.owasp.dependencycheck.analyzer; -20 -21 /** -22 * An exception thrown when the analysis of a dependency fails. -23 * -24 * @author Jeremy Long <jeremy.long@owasp.org> -25 */ -26 public class AnalysisException extends Exception { -27 -28 /** -29 * The serial version UID for serialization. -30 */ -31 private static final long serialVersionUID = 1L; -32 -33 /** -34 * Creates a new AnalysisException. -35 */ -36 public AnalysisException() { -37 super(); -38 } -39 -40 /** -41 * Creates a new AnalysisException. -42 * -43 * @param msg a message for the exception. -44 */ -45 public AnalysisException(String msg) { -46 super(msg); -47 } -48 -49 /** -50 * Creates a new AnalysisException. -51 * -52 * @param ex the cause of the failure. -53 */ -54 public AnalysisException(Throwable ex) { -55 super(ex); -56 } -57 -58 /** -59 * Creates a new AnalysisException. -60 * -61 * @param msg a message for the exception. -62 * @param ex the cause of the failure. -63 */ -64 public AnalysisException(String msg, Throwable ex) { -65 super(msg, ex); -66 } -67 } +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. +17 */ +18 package org.owasp.dependencycheck.analyzer; +19 +20 /** +21 * An exception thrown when the analysis of a dependency fails. +22 * +23 * @author Jeremy Long <jeremy.long@owasp.org> +24 */ +25 public class AnalysisException extends Exception { +26 +27 /** +28 * The serial version UID for serialization. +29 */ +30 private static final long serialVersionUID = 1L; +31 +32 /** +33 * Creates a new AnalysisException. +34 */ +35 public AnalysisException() { +36 super(); +37 } +38 +39 /** +40 * Creates a new AnalysisException. +41 * +42 * @param msg a message for the exception. +43 */ +44 public AnalysisException(String msg) { +45 super(msg); +46 } +47 +48 /** +49 * Creates a new AnalysisException. +50 * +51 * @param ex the cause of the failure. +52 */ +53 public AnalysisException(Throwable ex) { +54 super(ex); +55 } +56 +57 /** +58 * Creates a new AnalysisException. +59 * +60 * @param msg a message for the exception. +61 * @param ex the cause of the failure. +62 */ +63 public AnalysisException(String msg, Throwable ex) { +64 super(msg, ex); +65 } +66 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/AnalysisPhase.html b/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/AnalysisPhase.html index 6a44fbe5f..3e0031c14 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/AnalysisPhase.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/AnalysisPhase.html @@ -9,67 +9,66 @@ 1 /* 2 * This file is part of dependency-check-core. 3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. -18 */ -19 package org.owasp.dependencycheck.analyzer; -20 -21 /** -22 * An enumeration defining the phases of analysis. -23 * -24 * @author Jeremy Long <jeremy.long@owasp.org> -25 */ -26 public enum AnalysisPhase { -27 -28 /** -29 * Initialization phase. -30 */ -31 INITIAL, -32 /** -33 * Information collection phase. -34 */ -35 INFORMATION_COLLECTION, -36 /** -37 * Pre identifier analysis phase. -38 */ -39 PRE_IDENTIFIER_ANALYSIS, -40 /** -41 * Identifier analysis phase. -42 */ -43 IDENTIFIER_ANALYSIS, -44 /** -45 * Post identifier analysis phase. -46 */ -47 POST_IDENTIFIER_ANALYSIS, -48 /** -49 * Pre finding analysis phase. -50 */ -51 PRE_FINDING_ANALYSIS, -52 /** -53 * Finding analysis phase. -54 */ -55 FINDING_ANALYSIS, -56 /** -57 * Post analysis phase. -58 */ -59 POST_FINDING_ANALYSIS, -60 /** -61 * The final analysis phase. -62 */ -63 FINAL -64 } +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. +17 */ +18 package org.owasp.dependencycheck.analyzer; +19 +20 /** +21 * An enumeration defining the phases of analysis. +22 * +23 * @author Jeremy Long <jeremy.long@owasp.org> +24 */ +25 public enum AnalysisPhase { +26 +27 /** +28 * Initialization phase. +29 */ +30 INITIAL, +31 /** +32 * Information collection phase. +33 */ +34 INFORMATION_COLLECTION, +35 /** +36 * Pre identifier analysis phase. +37 */ +38 PRE_IDENTIFIER_ANALYSIS, +39 /** +40 * Identifier analysis phase. +41 */ +42 IDENTIFIER_ANALYSIS, +43 /** +44 * Post identifier analysis phase. +45 */ +46 POST_IDENTIFIER_ANALYSIS, +47 /** +48 * Pre finding analysis phase. +49 */ +50 PRE_FINDING_ANALYSIS, +51 /** +52 * Finding analysis phase. +53 */ +54 FINDING_ANALYSIS, +55 /** +56 * Post analysis phase. +57 */ +58 POST_FINDING_ANALYSIS, +59 /** +60 * The final analysis phase. +61 */ +62 FINAL +63 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/Analyzer.html b/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/Analyzer.html index dce8a2480..ab80769a6 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/Analyzer.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/Analyzer.html @@ -9,105 +9,98 @@ 1 /* 2 * This file is part of dependency-check-core. 3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. -18 */ -19 package org.owasp.dependencycheck.analyzer; -20 -21 import java.util.Set; -22 import org.owasp.dependencycheck.Engine; -23 import org.owasp.dependencycheck.dependency.Dependency; -24 -25 /** -26 * An interface that defines an Analyzer that is used to identify Dependencies. -27 * An analyzer will collect information about the dependency in the form of -28 * Evidence. -29 * -30 * @author Jeremy Long <jeremy.long@owasp.org> -31 */ -32 public interface Analyzer { -33 -34 /** -35 * Analyzes the given dependency. The analysis could be anything from -36 * identifying an Identifier for the dependency, to finding vulnerabilities, -37 * etc. Additionally, if the analyzer collects enough information to add a -38 * description or license information for the dependency it should be added. -39 * -40 * @param dependency a dependency to analyze. -41 * @param engine the engine that is scanning the dependencies - this is -42 * useful if we need to check other dependencies -43 * @throws AnalysisException is thrown if there is an error analyzing the -44 * dependency file -45 */ -46 void analyze(Dependency dependency, Engine engine) throws AnalysisException; -47 -48 /** -49 * <p>Returns a list of supported file extensions. An example would be an -50 * analyzer that inspected java jar files. The getSupportedExtensions -51 * function would return a set with a single element "jar".</p> -52 * -53 * <p><b>Note:</b> when implementing this the extensions returned MUST be -54 * lowercase.</p> -55 * -56 * @return The file extensions supported by this analyzer. -57 * -58 * <p>If the analyzer returns null it will not cause additional files to be -59 * analyzed but will be executed against every file loaded</p> -60 */ -61 Set<String> getSupportedExtensions(); -62 -63 /** -64 * Returns the name of the analyzer. -65 * -66 * @return the name of the analyzer. -67 */ -68 String getName(); -69 -70 /** -71 * Returns whether or not this analyzer can process the given extension. -72 * -73 * @param extension the file extension to test for support. -74 * @return whether or not the specified file extension is supported by this -75 * analyzer. -76 */ -77 boolean supportsExtension(String extension); -78 -79 /** -80 * Returns the phase that the analyzer is intended to run in. -81 * -82 * @return the phase that the analyzer is intended to run in. -83 */ -84 AnalysisPhase getAnalysisPhase(); -85 -86 /** -87 * The initialize method is called (once) prior to the analyze method being -88 * called on all of the dependencies. -89 * -90 * @throws Exception is thrown if an exception occurs initializing the -91 * analyzer. -92 */ -93 void initialize() throws Exception; -94 -95 /** -96 * The close method is called after all of the dependencies have been -97 * analyzed. -98 * -99 * @throws Exception is thrown if an exception occurs closing the analyzer. -100 */ -101 void close() throws Exception; -102 } +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. +17 */ +18 package org.owasp.dependencycheck.analyzer; +19 +20 import java.util.Set; +21 import org.owasp.dependencycheck.Engine; +22 import org.owasp.dependencycheck.dependency.Dependency; +23 +24 /** +25 * An interface that defines an Analyzer that is used to identify Dependencies. An analyzer will collect information +26 * about the dependency in the form of Evidence. +27 * +28 * @author Jeremy Long <jeremy.long@owasp.org> +29 */ +30 public interface Analyzer { +31 +32 /** +33 * Analyzes the given dependency. The analysis could be anything from identifying an Identifier for the dependency, +34 * to finding vulnerabilities, etc. Additionally, if the analyzer collects enough information to add a description +35 * or license information for the dependency it should be added. +36 * +37 * @param dependency a dependency to analyze. +38 * @param engine the engine that is scanning the dependencies - this is useful if we need to check other +39 * dependencies +40 * @throws AnalysisException is thrown if there is an error analyzing the dependency file +41 */ +42 void analyze(Dependency dependency, Engine engine) throws AnalysisException; +43 +44 /** +45 * <p> +46 * Returns a list of supported file extensions. An example would be an analyzer that inspected java jar files. The +47 * getSupportedExtensions function would return a set with a single element "jar".</p> +48 * +49 * <p> +50 * <b>Note:</b> when implementing this the extensions returned MUST be lowercase.</p> +51 * +52 * @return The file extensions supported by this analyzer. +53 * +54 * <p> +55 * If the analyzer returns null it will not cause additional files to be analyzed but will be executed against every +56 * file loaded</p> +57 */ +58 Set<String> getSupportedExtensions(); +59 +60 /** +61 * Returns the name of the analyzer. +62 * +63 * @return the name of the analyzer. +64 */ +65 String getName(); +66 +67 /** +68 * Returns whether or not this analyzer can process the given extension. +69 * +70 * @param extension the file extension to test for support. +71 * @return whether or not the specified file extension is supported by this analyzer. +72 */ +73 boolean supportsExtension(String extension); +74 +75 /** +76 * Returns the phase that the analyzer is intended to run in. +77 * +78 * @return the phase that the analyzer is intended to run in. +79 */ +80 AnalysisPhase getAnalysisPhase(); +81 +82 /** +83 * The initialize method is called (once) prior to the analyze method being called on all of the dependencies. +84 * +85 * @throws Exception is thrown if an exception occurs initializing the analyzer. +86 */ +87 void initialize() throws Exception; +88 +89 /** +90 * The close method is called after all of the dependencies have been analyzed. +91 * +92 * @throws Exception is thrown if an exception occurs closing the analyzer. +93 */ +94 void close() throws Exception; +95 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/AnalyzerService.html b/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/AnalyzerService.html index a6014ed68..43a4823aa 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/AnalyzerService.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/AnalyzerService.html @@ -9,69 +9,68 @@ 1 /* 2 * This file is part of dependency-check-core. 3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. -18 */ -19 package org.owasp.dependencycheck.analyzer; -20 -21 import java.util.Iterator; -22 import java.util.ServiceLoader; -23 -24 /** -25 * -26 * @author Jeremy Long <jeremy.long@owasp.org> -27 */ -28 public final class AnalyzerService { -29 -30 /** -31 * The analyzer service singleton. -32 */ -33 private static AnalyzerService service; -34 /** -35 * The service loader for analyzers. -36 */ -37 private final ServiceLoader<Analyzer> loader; -38 -39 /** -40 * Creates a new instance of AnalyzerService. -41 */ -42 private AnalyzerService() { -43 loader = ServiceLoader.load(Analyzer.class); -44 } -45 -46 /** -47 * Retrieve the singleton instance of AnalyzerService. -48 * -49 * @return a singleton AnalyzerService. -50 */ -51 public static synchronized AnalyzerService getInstance() { -52 if (service == null) { -53 service = new AnalyzerService(); -54 } -55 return service; -56 } -57 -58 /** -59 * Returns an Iterator for all instances of the Analyzer interface. -60 * -61 * @return an iterator of Analyzers. -62 */ -63 public Iterator<Analyzer> getAnalyzers() { -64 return loader.iterator(); -65 } -66 } +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. +17 */ +18 package org.owasp.dependencycheck.analyzer; +19 +20 import java.util.Iterator; +21 import java.util.ServiceLoader; +22 +23 /** +24 * +25 * @author Jeremy Long <jeremy.long@owasp.org> +26 */ +27 public final class AnalyzerService { +28 +29 /** +30 * The analyzer service singleton. +31 */ +32 private static AnalyzerService service; +33 /** +34 * The service loader for analyzers. +35 */ +36 private final ServiceLoader<Analyzer> loader; +37 +38 /** +39 * Creates a new instance of AnalyzerService. +40 */ +41 private AnalyzerService() { +42 loader = ServiceLoader.load(Analyzer.class); +43 } +44 +45 /** +46 * Retrieve the singleton instance of AnalyzerService. +47 * +48 * @return a singleton AnalyzerService. +49 */ +50 public static synchronized AnalyzerService getInstance() { +51 if (service == null) { +52 service = new AnalyzerService(); +53 } +54 return service; +55 } +56 +57 /** +58 * Returns an Iterator for all instances of the Analyzer interface. +59 * +60 * @return an iterator of Analyzers. +61 */ +62 public Iterator<Analyzer> getAnalyzers() { +63 return loader.iterator(); +64 } +65 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/ArchiveAnalyzer.html b/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/ArchiveAnalyzer.html index 1489447e9..b5d456b59 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/ArchiveAnalyzer.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/ArchiveAnalyzer.html @@ -9,52 +9,52 @@ 1 /* 2 * This file is part of dependency-check-core. 3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2013 Jeremy Long. All Rights Reserved. -18 */ -19 package org.owasp.dependencycheck.analyzer; -20 -21 import java.io.BufferedInputStream; -22 import java.io.BufferedOutputStream; -23 import java.io.File; -24 import java.io.FileInputStream; -25 import java.io.FileNotFoundException; -26 import java.io.FileOutputStream; -27 import java.io.IOException; -28 import java.util.ArrayList; -29 import java.util.Collections; -30 import java.util.HashSet; -31 import java.util.List; -32 import java.util.Set; -33 import java.util.logging.Level; -34 import java.util.logging.Logger; -35 import org.apache.commons.compress.archivers.ArchiveEntry; -36 import org.apache.commons.compress.archivers.ArchiveInputStream; -37 import org.apache.commons.compress.archivers.tar.TarArchiveInputStream; -38 import org.apache.commons.compress.archivers.zip.ZipArchiveInputStream; -39 import org.apache.commons.compress.compressors.CompressorInputStream; -40 import org.apache.commons.compress.compressors.gzip.GzipCompressorInputStream; -41 import org.apache.commons.compress.compressors.gzip.GzipUtils; -42 import org.h2.store.fs.FileUtils; -43 import org.owasp.dependencycheck.Engine; -44 import org.owasp.dependencycheck.dependency.Dependency; -45 import org.owasp.dependencycheck.utils.Settings; -46 -47 /** -48 * <p>An analyzer that extracts files from archives and ensures any supported -49 * files contained within the archive are added to the dependency list.</p> +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2013 Jeremy Long. All Rights Reserved. +17 */ +18 package org.owasp.dependencycheck.analyzer; +19 +20 import java.io.BufferedInputStream; +21 import java.io.BufferedOutputStream; +22 import java.io.File; +23 import java.io.FileInputStream; +24 import java.io.FileNotFoundException; +25 import java.io.FileOutputStream; +26 import java.io.IOException; +27 import java.util.ArrayList; +28 import java.util.Collections; +29 import java.util.HashSet; +30 import java.util.List; +31 import java.util.Set; +32 import java.util.logging.Level; +33 import java.util.logging.Logger; +34 import org.apache.commons.compress.archivers.ArchiveEntry; +35 import org.apache.commons.compress.archivers.ArchiveInputStream; +36 import org.apache.commons.compress.archivers.tar.TarArchiveInputStream; +37 import org.apache.commons.compress.archivers.zip.ZipArchiveInputStream; +38 import org.apache.commons.compress.compressors.CompressorInputStream; +39 import org.apache.commons.compress.compressors.gzip.GzipCompressorInputStream; +40 import org.apache.commons.compress.compressors.gzip.GzipUtils; +41 import org.h2.store.fs.FileUtils; +42 import org.owasp.dependencycheck.Engine; +43 import org.owasp.dependencycheck.dependency.Dependency; +44 import org.owasp.dependencycheck.utils.Settings; +45 +46 /** +47 * <p> +48 * An analyzer that extracts files from archives and ensures any supported files contained within the archive are added +49 * to the dependency list.</p> 50 * 51 * @author Jeremy Long <jeremy.long@owasp.org> 52 */ @@ -65,343 +65,341 @@ 57 */ 58 private static final int BUFFER_SIZE = 4096; 59 /** -60 * The count of directories created during analysis. This is used for -61 * creating temporary directories. -62 */ -63 private static int dirCount = 0; -64 /** -65 * The parent directory for the individual directories per archive. -66 */ -67 private File tempFileLocation = null; -68 /** -69 * The max scan depth that the analyzer will recursively extract nested -70 * archives. -71 */ -72 private static final int MAX_SCAN_DEPTH = Settings.getInt("archive.scan.depth", 3); -73 /** -74 * Tracks the current scan/extraction depth for nested archives. -75 */ -76 private int scanDepth = 0; -77 //<editor-fold defaultstate="collapsed" desc="All standard implementation details of Analyzer"> -78 /** -79 * The name of the analyzer. -80 */ -81 private static final String ANALYZER_NAME = "Archive Analyzer"; -82 /** -83 * The phase that this analyzer is intended to run in. -84 */ -85 private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.INITIAL; -86 /** -87 * The set of file extensions supported by this analyzer. -88 */ -89 private static final Set<String> EXTENSIONS = newHashSet("zip", "ear", "war", "tar", "gz", "tgz"); -90 -91 /** -92 * Returns a list of file EXTENSIONS supported by this analyzer. -93 * -94 * @return a list of file EXTENSIONS supported by this analyzer. -95 */ -96 public Set<String> getSupportedExtensions() { -97 return EXTENSIONS; -98 } -99 -100 /** -101 * Returns the name of the analyzer. -102 * -103 * @return the name of the analyzer. -104 */ -105 public String getName() { -106 return ANALYZER_NAME; -107 } -108 -109 /** -110 * Returns whether or not this analyzer can process the given extension. -111 * -112 * @param extension the file extension to test for support. -113 * @return whether or not the specified file extension is supported by this -114 * analyzer. -115 */ -116 public boolean supportsExtension(String extension) { -117 return EXTENSIONS.contains(extension); -118 } -119 -120 /** -121 * Returns the phase that the analyzer is intended to run in. -122 * -123 * @return the phase that the analyzer is intended to run in. -124 */ -125 public AnalysisPhase getAnalysisPhase() { -126 return ANALYSIS_PHASE; -127 } -128 //</editor-fold> -129 -130 /** -131 * The initialize method does nothing for this Analyzer. -132 * -133 * @throws Exception is thrown if there is an exception deleting or creating -134 * temporary files -135 */ -136 @Override -137 public void initialize() throws Exception { -138 final File baseDir = Settings.getTempDirectory(); -139 if (!baseDir.exists()) { -140 if (!baseDir.mkdirs()) { -141 final String msg = String.format("Unable to make a temporary folder '%s'", baseDir.getPath()); -142 throw new AnalysisException(msg); -143 } -144 } -145 tempFileLocation = File.createTempFile("check", "tmp", baseDir); -146 if (!tempFileLocation.delete()) { -147 final String msg = String.format("Unable to delete temporary file '%s'.", tempFileLocation.getAbsolutePath()); +60 * The count of directories created during analysis. This is used for creating temporary directories. +61 */ +62 private static int dirCount = 0; +63 /** +64 * The parent directory for the individual directories per archive. +65 */ +66 private File tempFileLocation = null; +67 /** +68 * The max scan depth that the analyzer will recursively extract nested archives. +69 */ +70 private static final int MAX_SCAN_DEPTH = Settings.getInt("archive.scan.depth", 3); +71 /** +72 * Tracks the current scan/extraction depth for nested archives. +73 */ +74 private int scanDepth = 0; +75 //<editor-fold defaultstate="collapsed" desc="All standard implementation details of Analyzer"> +76 /** +77 * The name of the analyzer. +78 */ +79 private static final String ANALYZER_NAME = "Archive Analyzer"; +80 /** +81 * The phase that this analyzer is intended to run in. +82 */ +83 private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.INITIAL; +84 /** +85 * The set of file extensions supported by this analyzer. +86 */ +87 private static final Set<String> EXTENSIONS = newHashSet("zip", "ear", "war", "tar", "gz", "tgz"); +88 +89 /** +90 * Returns a list of file EXTENSIONS supported by this analyzer. +91 * +92 * @return a list of file EXTENSIONS supported by this analyzer. +93 */ +94 public Set<String> getSupportedExtensions() { +95 return EXTENSIONS; +96 } +97 +98 /** +99 * Returns the name of the analyzer. +100 * +101 * @return the name of the analyzer. +102 */ +103 public String getName() { +104 return ANALYZER_NAME; +105 } +106 +107 /** +108 * Returns whether or not this analyzer can process the given extension. +109 * +110 * @param extension the file extension to test for support. +111 * @return whether or not the specified file extension is supported by this analyzer. +112 */ +113 public boolean supportsExtension(String extension) { +114 return EXTENSIONS.contains(extension); +115 } +116 +117 /** +118 * Returns the phase that the analyzer is intended to run in. +119 * +120 * @return the phase that the analyzer is intended to run in. +121 */ +122 public AnalysisPhase getAnalysisPhase() { +123 return ANALYSIS_PHASE; +124 } +125 //</editor-fold> +126 +127 /** +128 * The initialize method does nothing for this Analyzer. +129 * +130 * @throws Exception is thrown if there is an exception deleting or creating temporary files +131 */ +132 @Override +133 public void initialize() throws Exception { +134 final File baseDir = Settings.getTempDirectory(); +135 if (!baseDir.exists()) { +136 if (!baseDir.mkdirs()) { +137 final String msg = String.format("Unable to make a temporary folder '%s'", baseDir.getPath()); +138 throw new AnalysisException(msg); +139 } +140 } +141 tempFileLocation = File.createTempFile("check", "tmp", baseDir); +142 if (!tempFileLocation.delete()) { +143 final String msg = String.format("Unable to delete temporary file '%s'.", tempFileLocation.getAbsolutePath()); +144 throw new AnalysisException(msg); +145 } +146 if (!tempFileLocation.mkdirs()) { +147 final String msg = String.format("Unable to create directory '%s'.", tempFileLocation.getAbsolutePath()); 148 throw new AnalysisException(msg); 149 } -150 if (!tempFileLocation.mkdirs()) { -151 final String msg = String.format("Unable to create directory '%s'.", tempFileLocation.getAbsolutePath()); -152 throw new AnalysisException(msg); -153 } -154 } -155 -156 /** -157 * The close method does nothing for this Analyzer. -158 * -159 * @throws Exception thrown if there is an exception deleting temporary -160 * files -161 */ -162 @Override -163 public void close() throws Exception { -164 if (tempFileLocation != null && tempFileLocation.exists()) { -165 FileUtils.deleteRecursive(tempFileLocation.getAbsolutePath(), true); -166 } -167 } -168 -169 /** -170 * Analyzes a given dependency. If the dependency is an archive, such as a -171 * WAR or EAR, the contents are extracted, scanned, and added to the list of -172 * dependencies within the engine. -173 * -174 * @param dependency the dependency to analyze -175 * @param engine the engine scanning -176 * @throws AnalysisException thrown if there is an analysis exception -177 */ -178 @Override -179 public void analyze(Dependency dependency, Engine engine) throws AnalysisException { -180 final File f = new File(dependency.getActualFilePath()); -181 final File tmpDir = getNextTempDirectory(); -182 extractFiles(f, tmpDir, engine); -183 -184 //make a copy -185 final List<Dependency> dependencies = new ArrayList<Dependency>(engine.getDependencies()); -186 engine.scan(tmpDir); -187 final List<Dependency> newDependencies = engine.getDependencies(); -188 if (dependencies.size() != newDependencies.size()) { -189 //get the new dependencies -190 final Set<Dependency> dependencySet = new HashSet<Dependency>(); -191 dependencySet.addAll(newDependencies); -192 dependencySet.removeAll(dependencies); -193 -194 for (Dependency d : dependencySet) { -195 //fix the dependency's display name and path -196 final String displayPath = String.format("%s%s", -197 dependency.getFilePath(), -198 d.getActualFilePath().substring(tmpDir.getAbsolutePath().length())); -199 final String displayName = String.format("%s%s%s", -200 dependency.getFileName(), -201 File.separator, -202 d.getFileName()); -203 d.setFilePath(displayPath); -204 d.setFileName(displayName); -205 -206 //TODO - can we get more evidence from the parent? EAR contains module name, etc. -207 -208 //analyze the dependency (i.e. extract files) if it is a supported type. -209 if (this.supportsExtension(d.getFileExtension()) && scanDepth < MAX_SCAN_DEPTH) { -210 scanDepth += 1; -211 analyze(d, engine); -212 scanDepth -= 1; -213 } -214 } -215 } -216 Collections.sort(engine.getDependencies()); -217 } -218 -219 /** -220 * Retrieves the next temporary directory to extract an archive too. -221 * -222 * @return a directory -223 * @throws AnalysisException thrown if unable to create temporary directory -224 */ -225 private File getNextTempDirectory() throws AnalysisException { -226 dirCount += 1; -227 final File directory = new File(tempFileLocation, String.valueOf(dirCount)); -228 //getting an exception for some directories not being able to be created; might be because the directory already exists? -229 if (directory.exists()) { -230 return getNextTempDirectory(); -231 } -232 if (!directory.mkdirs()) { -233 final String msg = String.format("Unable to create temp directory '%s'.", directory.getAbsolutePath()); -234 throw new AnalysisException(msg); -235 } -236 return directory; -237 } -238 -239 /** -240 * Extracts the contents of an archive into the specified directory. -241 * -242 * @param archive an archive file such as a WAR or EAR -243 * @param destination a directory to extract the contents to -244 * @param engine the scanning engine -245 * @throws AnalysisException thrown if the archive is not found -246 */ -247 private void extractFiles(File archive, File destination, Engine engine) throws AnalysisException { -248 if (archive == null || destination == null) { -249 return; -250 } -251 -252 FileInputStream fis = null; +150 } +151 +152 /** +153 * The close method does nothing for this Analyzer. +154 * +155 * @throws Exception thrown if there is an exception deleting temporary files +156 */ +157 @Override +158 public void close() throws Exception { +159 if (tempFileLocation != null && tempFileLocation.exists()) { +160 FileUtils.deleteRecursive(tempFileLocation.getAbsolutePath(), true); +161 } +162 } +163 +164 /** +165 * Analyzes a given dependency. If the dependency is an archive, such as a WAR or EAR, the contents are extracted, +166 * scanned, and added to the list of dependencies within the engine. +167 * +168 * @param dependency the dependency to analyze +169 * @param engine the engine scanning +170 * @throws AnalysisException thrown if there is an analysis exception +171 */ +172 @Override +173 public void analyze(Dependency dependency, Engine engine) throws AnalysisException { +174 final File f = new File(dependency.getActualFilePath()); +175 final File tmpDir = getNextTempDirectory(); +176 extractFiles(f, tmpDir, engine); +177 +178 //make a copy +179 final List<Dependency> dependencies = new ArrayList<Dependency>(engine.getDependencies()); +180 engine.scan(tmpDir); +181 final List<Dependency> newDependencies = engine.getDependencies(); +182 if (dependencies.size() != newDependencies.size()) { +183 //get the new dependencies +184 final Set<Dependency> dependencySet = new HashSet<Dependency>(); +185 dependencySet.addAll(newDependencies); +186 dependencySet.removeAll(dependencies); +187 +188 for (Dependency d : dependencySet) { +189 //fix the dependency's display name and path +190 final String displayPath = String.format("%s%s", +191 dependency.getFilePath(), +192 d.getActualFilePath().substring(tmpDir.getAbsolutePath().length())); +193 final String displayName = String.format("%s%s%s", +194 dependency.getFileName(), +195 File.separator, +196 d.getFileName()); +197 d.setFilePath(displayPath); +198 d.setFileName(displayName); +199 +200 //TODO - can we get more evidence from the parent? EAR contains module name, etc. +201 //analyze the dependency (i.e. extract files) if it is a supported type. +202 if (this.supportsExtension(d.getFileExtension()) && scanDepth < MAX_SCAN_DEPTH) { +203 scanDepth += 1; +204 analyze(d, engine); +205 scanDepth -= 1; +206 } +207 } +208 } +209 Collections.sort(engine.getDependencies()); +210 } +211 +212 /** +213 * Retrieves the next temporary directory to extract an archive too. +214 * +215 * @return a directory +216 * @throws AnalysisException thrown if unable to create temporary directory +217 */ +218 private File getNextTempDirectory() throws AnalysisException { +219 dirCount += 1; +220 final File directory = new File(tempFileLocation, String.valueOf(dirCount)); +221 //getting an exception for some directories not being able to be created; might be because the directory already exists? +222 if (directory.exists()) { +223 return getNextTempDirectory(); +224 } +225 if (!directory.mkdirs()) { +226 final String msg = String.format("Unable to create temp directory '%s'.", directory.getAbsolutePath()); +227 throw new AnalysisException(msg); +228 } +229 return directory; +230 } +231 +232 /** +233 * Extracts the contents of an archive into the specified directory. +234 * +235 * @param archive an archive file such as a WAR or EAR +236 * @param destination a directory to extract the contents to +237 * @param engine the scanning engine +238 * @throws AnalysisException thrown if the archive is not found +239 */ +240 private void extractFiles(File archive, File destination, Engine engine) throws AnalysisException { +241 if (archive == null || destination == null) { +242 return; +243 } +244 +245 FileInputStream fis = null; +246 try { +247 fis = new FileInputStream(archive); +248 } catch (FileNotFoundException ex) { +249 Logger.getLogger(ArchiveAnalyzer.class.getName()).log(Level.INFO, null, ex); +250 throw new AnalysisException("Archive file was not found.", ex); +251 } +252 final String archiveExt = org.owasp.dependencycheck.utils.FileUtils.getFileExtension(archive.getName()).toLowerCase(); 253 try { -254 fis = new FileInputStream(archive); -255 } catch (FileNotFoundException ex) { -256 Logger.getLogger(ArchiveAnalyzer.class.getName()).log(Level.INFO, null, ex); -257 throw new AnalysisException("Archive file was not found.", ex); -258 } -259 final String archiveExt = org.owasp.dependencycheck.utils.FileUtils.getFileExtension(archive.getName()).toLowerCase(); -260 try { -261 if ("zip".equals(archiveExt) || "war".equals(archiveExt) || "ear".equals(archiveExt)) { -262 extractArchive(new ZipArchiveInputStream(new BufferedInputStream(fis)), destination, engine); -263 } else if ("tar".equals(archiveExt)) { -264 extractArchive(new TarArchiveInputStream(new BufferedInputStream(fis)), destination, engine); -265 } else if ("gz".equals(archiveExt) || "tgz".equals(archiveExt)) { -266 final String uncompressedName = GzipUtils.getUncompressedFilename(archive.getName()); -267 final String uncompressedExt = org.owasp.dependencycheck.utils.FileUtils.getFileExtension(uncompressedName).toLowerCase(); -268 if (engine.supportsExtension(uncompressedExt)) { -269 decompressFile(new GzipCompressorInputStream(new BufferedInputStream(fis)), new File(destination, uncompressedName)); -270 } -271 } -272 } catch (ArchiveExtractionException ex) { -273 final String msg = String.format("Exception extracting archive '%s'.", archive.getName()); -274 Logger.getLogger(ArchiveAnalyzer.class.getName()).log(Level.WARNING, msg); -275 Logger.getLogger(ArchiveAnalyzer.class.getName()).log(Level.FINE, null, ex); -276 } catch (IOException ex) { -277 final String msg = String.format("Exception reading archive '%s'.", archive.getName()); -278 Logger.getLogger(ArchiveAnalyzer.class.getName()).log(Level.WARNING, msg); -279 Logger.getLogger(ArchiveAnalyzer.class.getName()).log(Level.FINE, null, ex); -280 } finally { -281 try { -282 fis.close(); -283 } catch (IOException ex) { -284 Logger.getLogger(ArchiveAnalyzer.class.getName()).log(Level.FINEST, null, ex); -285 } -286 } -287 } -288 -289 /** -290 * Extracts files from an archive. -291 * -292 * @param input the archive to extract files from -293 * @param destination the location to write the files too -294 * @param engine the dependency-check engine -295 * @throws ArchiveExtractionException thrown if there is an exception -296 * extracting files from the archive -297 */ -298 private void extractArchive(ArchiveInputStream input, File destination, Engine engine) throws ArchiveExtractionException { -299 ArchiveEntry entry; -300 try { -301 while ((entry = input.getNextEntry()) != null) { -302 if (entry.isDirectory()) { -303 final File d = new File(destination, entry.getName()); -304 if (!d.exists()) { -305 if (!d.mkdirs()) { -306 final String msg = String.format("Unable to create '%s'.", d.getAbsolutePath()); -307 throw new AnalysisException(msg); -308 } -309 } -310 } else { -311 final File file = new File(destination, entry.getName()); -312 final String ext = org.owasp.dependencycheck.utils.FileUtils.getFileExtension(file.getName()); -313 if (engine.supportsExtension(ext)) { -314 BufferedOutputStream bos = null; -315 FileOutputStream fos; -316 try { -317 fos = new FileOutputStream(file); -318 bos = new BufferedOutputStream(fos, BUFFER_SIZE); -319 int count; -320 final byte data[] = new byte[BUFFER_SIZE]; -321 while ((count = input.read(data, 0, BUFFER_SIZE)) != -1) { -322 bos.write(data, 0, count); -323 } -324 bos.flush(); -325 } catch (FileNotFoundException ex) { -326 Logger.getLogger(ArchiveAnalyzer.class -327 .getName()).log(Level.FINE, null, ex); -328 final String msg = String.format("Unable to find file '%s'.", file.getName()); -329 throw new AnalysisException(msg, ex); -330 } catch (IOException ex) { -331 Logger.getLogger(ArchiveAnalyzer.class -332 .getName()).log(Level.FINE, null, ex); -333 final String msg = String.format("IO Exception while parsing file '%s'.", file.getName()); -334 throw new AnalysisException(msg, ex); -335 } finally { -336 if (bos != null) { -337 try { -338 bos.close(); -339 } catch (IOException ex) { -340 Logger.getLogger(ArchiveAnalyzer.class -341 .getName()).log(Level.FINEST, null, ex); -342 } -343 } -344 } -345 } -346 } -347 } -348 } catch (IOException ex) { -349 throw new ArchiveExtractionException(ex); -350 } catch (Throwable ex) { -351 throw new ArchiveExtractionException(ex); -352 } finally { -353 if (input != null) { -354 try { -355 input.close(); -356 } catch (IOException ex) { -357 Logger.getLogger(ArchiveAnalyzer.class.getName()).log(Level.FINEST, null, ex); -358 } -359 } -360 } -361 } -362 -363 /** -364 * Decompresses a file. -365 * -366 * @param inputStream the compressed file -367 * @param outputFile the location to write the decompressed file -368 * @throws ArchiveExtractionException thrown if there is an exception -369 * decompressing the file -370 */ -371 private void decompressFile(CompressorInputStream inputStream, File outputFile) throws ArchiveExtractionException { -372 FileOutputStream out = null; -373 try { -374 out = new FileOutputStream(outputFile); -375 final byte[] buffer = new byte[BUFFER_SIZE]; -376 int n = 0; -377 while (-1 != (n = inputStream.read(buffer))) { -378 out.write(buffer, 0, n); -379 } -380 } catch (FileNotFoundException ex) { -381 Logger.getLogger(ArchiveAnalyzer.class.getName()).log(Level.FINE, null, ex); -382 throw new ArchiveExtractionException(ex); -383 } catch (IOException ex) { -384 Logger.getLogger(ArchiveAnalyzer.class.getName()).log(Level.FINE, null, ex); -385 throw new ArchiveExtractionException(ex); -386 } finally { -387 if (out != null) { -388 try { -389 out.close(); -390 } catch (IOException ex) { -391 Logger.getLogger(ArchiveAnalyzer.class.getName()).log(Level.FINEST, null, ex); -392 } -393 } -394 } -395 } -396 } +254 if ("zip".equals(archiveExt) || "war".equals(archiveExt) || "ear".equals(archiveExt)) { +255 extractArchive(new ZipArchiveInputStream(new BufferedInputStream(fis)), destination, engine); +256 } else if ("tar".equals(archiveExt)) { +257 extractArchive(new TarArchiveInputStream(new BufferedInputStream(fis)), destination, engine); +258 } else if ("gz".equals(archiveExt) || "tgz".equals(archiveExt)) { +259 final String uncompressedName = GzipUtils.getUncompressedFilename(archive.getName()); +260 final String uncompressedExt = org.owasp.dependencycheck.utils.FileUtils.getFileExtension(uncompressedName).toLowerCase(); +261 if (engine.supportsExtension(uncompressedExt)) { +262 decompressFile(new GzipCompressorInputStream(new BufferedInputStream(fis)), new File(destination, uncompressedName)); +263 } +264 } +265 } catch (ArchiveExtractionException ex) { +266 final String msg = String.format("Exception extracting archive '%s'.", archive.getName()); +267 Logger.getLogger(ArchiveAnalyzer.class.getName()).log(Level.WARNING, msg); +268 Logger.getLogger(ArchiveAnalyzer.class.getName()).log(Level.FINE, null, ex); +269 } catch (IOException ex) { +270 final String msg = String.format("Exception reading archive '%s'.", archive.getName()); +271 Logger.getLogger(ArchiveAnalyzer.class.getName()).log(Level.WARNING, msg); +272 Logger.getLogger(ArchiveAnalyzer.class.getName()).log(Level.FINE, null, ex); +273 } finally { +274 try { +275 fis.close(); +276 } catch (IOException ex) { +277 Logger.getLogger(ArchiveAnalyzer.class.getName()).log(Level.FINEST, null, ex); +278 } +279 } +280 } +281 +282 /** +283 * Extracts files from an archive. +284 * +285 * @param input the archive to extract files from +286 * @param destination the location to write the files too +287 * @param engine the dependency-check engine +288 * @throws ArchiveExtractionException thrown if there is an exception extracting files from the archive +289 */ +290 private void extractArchive(ArchiveInputStream input, File destination, Engine engine) throws ArchiveExtractionException { +291 ArchiveEntry entry; +292 try { +293 while ((entry = input.getNextEntry()) != null) { +294 if (entry.isDirectory()) { +295 final File d = new File(destination, entry.getName()); +296 if (!d.exists()) { +297 if (!d.mkdirs()) { +298 final String msg = String.format("Unable to create directory '%s'.", d.getAbsolutePath()); +299 throw new AnalysisException(msg); +300 } +301 } +302 } else { +303 final File file = new File(destination, entry.getName()); +304 final String ext = org.owasp.dependencycheck.utils.FileUtils.getFileExtension(file.getName()); +305 if (engine.supportsExtension(ext)) { +306 BufferedOutputStream bos = null; +307 FileOutputStream fos; +308 try { +309 final File parent = file.getParentFile(); +310 if (!parent.isDirectory()) { +311 if (!parent.mkdirs()) { +312 final String msg = String.format("Unable to build directory '%s'.", parent.getAbsolutePath()); +313 throw new AnalysisException(msg); +314 } +315 } +316 fos = new FileOutputStream(file); +317 bos = new BufferedOutputStream(fos, BUFFER_SIZE); +318 int count; +319 final byte data[] = new byte[BUFFER_SIZE]; +320 while ((count = input.read(data, 0, BUFFER_SIZE)) != -1) { +321 bos.write(data, 0, count); +322 } +323 bos.flush(); +324 } catch (FileNotFoundException ex) { +325 Logger.getLogger(ArchiveAnalyzer.class +326 .getName()).log(Level.FINE, null, ex); +327 final String msg = String.format("Unable to find file '%s'.", file.getName()); +328 throw new AnalysisException(msg, ex); +329 } catch (IOException ex) { +330 Logger.getLogger(ArchiveAnalyzer.class +331 .getName()).log(Level.FINE, null, ex); +332 final String msg = String.format("IO Exception while parsing file '%s'.", file.getName()); +333 throw new AnalysisException(msg, ex); +334 } finally { +335 if (bos != null) { +336 try { +337 bos.close(); +338 } catch (IOException ex) { +339 Logger.getLogger(ArchiveAnalyzer.class +340 .getName()).log(Level.FINEST, null, ex); +341 } +342 } +343 } +344 } +345 } +346 } +347 } catch (IOException ex) { +348 throw new ArchiveExtractionException(ex); +349 } catch (Throwable ex) { +350 throw new ArchiveExtractionException(ex); +351 } finally { +352 if (input != null) { +353 try { +354 input.close(); +355 } catch (IOException ex) { +356 Logger.getLogger(ArchiveAnalyzer.class.getName()).log(Level.FINEST, null, ex); +357 } +358 } +359 } +360 } +361 +362 /** +363 * Decompresses a file. +364 * +365 * @param inputStream the compressed file +366 * @param outputFile the location to write the decompressed file +367 * @throws ArchiveExtractionException thrown if there is an exception decompressing the file +368 */ +369 private void decompressFile(CompressorInputStream inputStream, File outputFile) throws ArchiveExtractionException { +370 FileOutputStream out = null; +371 try { +372 out = new FileOutputStream(outputFile); +373 final byte[] buffer = new byte[BUFFER_SIZE]; +374 int n = 0; +375 while (-1 != (n = inputStream.read(buffer))) { +376 out.write(buffer, 0, n); +377 } +378 } catch (FileNotFoundException ex) { +379 Logger.getLogger(ArchiveAnalyzer.class.getName()).log(Level.FINE, null, ex); +380 throw new ArchiveExtractionException(ex); +381 } catch (IOException ex) { +382 Logger.getLogger(ArchiveAnalyzer.class.getName()).log(Level.FINE, null, ex); +383 throw new ArchiveExtractionException(ex); +384 } finally { +385 if (out != null) { +386 try { +387 out.close(); +388 } catch (IOException ex) { +389 Logger.getLogger(ArchiveAnalyzer.class.getName()).log(Level.FINEST, null, ex); +390 } +391 } +392 } +393 } +394 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/ArchiveExtractionException.html b/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/ArchiveExtractionException.html index c02a177ed..8bec48ec3 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/ArchiveExtractionException.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/ArchiveExtractionException.html @@ -9,70 +9,69 @@ 1 /* 2 * This file is part of dependency-check-core. 3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2013 Jeremy Long. All Rights Reserved. -18 */ -19 package org.owasp.dependencycheck.analyzer; -20 -21 /** -22 * An exception thrown when files in an archive cannot be extracted. -23 * -24 * @author Jeremy Long <jeremy.long@owasp.org> -25 */ -26 public class ArchiveExtractionException extends Exception { -27 -28 /** -29 * The serial version UID for serialization. -30 */ -31 private static final long serialVersionUID = 1L; -32 -33 /** -34 * Creates a new ArchiveExtractionException. -35 */ -36 public ArchiveExtractionException() { -37 super(); -38 } -39 -40 /** -41 * Creates a new ArchiveExtractionException. -42 * -43 * @param msg a message for the exception. -44 */ -45 public ArchiveExtractionException(String msg) { -46 super(msg); -47 } -48 -49 /** -50 * Creates a new ArchiveExtractionException. -51 * -52 * @param ex the cause of the failure. -53 */ -54 public ArchiveExtractionException(Throwable ex) { -55 super(ex); -56 } -57 -58 /** -59 * Creates a new ArchiveExtractionException. -60 * -61 * @param msg a message for the exception. -62 * @param ex the cause of the failure. -63 */ -64 public ArchiveExtractionException(String msg, Throwable ex) { -65 super(msg, ex); -66 } -67 } +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2013 Jeremy Long. All Rights Reserved. +17 */ +18 package org.owasp.dependencycheck.analyzer; +19 +20 /** +21 * An exception thrown when files in an archive cannot be extracted. +22 * +23 * @author Jeremy Long <jeremy.long@owasp.org> +24 */ +25 public class ArchiveExtractionException extends Exception { +26 +27 /** +28 * The serial version UID for serialization. +29 */ +30 private static final long serialVersionUID = 1L; +31 +32 /** +33 * Creates a new ArchiveExtractionException. +34 */ +35 public ArchiveExtractionException() { +36 super(); +37 } +38 +39 /** +40 * Creates a new ArchiveExtractionException. +41 * +42 * @param msg a message for the exception. +43 */ +44 public ArchiveExtractionException(String msg) { +45 super(msg); +46 } +47 +48 /** +49 * Creates a new ArchiveExtractionException. +50 * +51 * @param ex the cause of the failure. +52 */ +53 public ArchiveExtractionException(Throwable ex) { +54 super(ex); +55 } +56 +57 /** +58 * Creates a new ArchiveExtractionException. +59 * +60 * @param msg a message for the exception. +61 * @param ex the cause of the failure. +62 */ +63 public ArchiveExtractionException(String msg, Throwable ex) { +64 super(msg, ex); +65 } +66 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/CPEAnalyzer.html b/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/CPEAnalyzer.html index f1fe2eaab..0456e12e2 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/CPEAnalyzer.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/CPEAnalyzer.html @@ -9,791 +9,772 @@ 1 /* 2 * This file is part of dependency-check-core. 3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. -18 */ -19 package org.owasp.dependencycheck.analyzer; -20 -21 import java.io.IOException; -22 import java.io.UnsupportedEncodingException; -23 import java.net.URLEncoder; -24 import java.util.ArrayList; -25 import java.util.Collections; -26 import java.util.List; -27 import java.util.Set; -28 import java.util.StringTokenizer; -29 import java.util.logging.Level; -30 import java.util.logging.Logger; -31 import org.apache.lucene.document.Document; -32 import org.apache.lucene.index.CorruptIndexException; -33 import org.apache.lucene.queryparser.classic.ParseException; -34 import org.apache.lucene.search.ScoreDoc; -35 import org.apache.lucene.search.TopDocs; -36 import org.owasp.dependencycheck.Engine; -37 import org.owasp.dependencycheck.data.lucene.LuceneUtils; -38 import org.owasp.dependencycheck.dependency.Dependency; -39 import org.owasp.dependencycheck.dependency.Evidence; -40 import org.owasp.dependencycheck.dependency.Evidence.Confidence; -41 import org.owasp.dependencycheck.dependency.EvidenceCollection; -42 import org.owasp.dependencycheck.data.cpe.CpeMemoryIndex; -43 import org.owasp.dependencycheck.data.cpe.Fields; -44 import org.owasp.dependencycheck.data.cpe.IndexEntry; -45 import org.owasp.dependencycheck.data.cpe.IndexException; -46 import org.owasp.dependencycheck.data.nvdcve.CveDB; -47 import org.owasp.dependencycheck.data.nvdcve.DatabaseException; -48 import org.owasp.dependencycheck.dependency.Identifier; -49 import org.owasp.dependencycheck.dependency.VulnerableSoftware; -50 import org.owasp.dependencycheck.utils.DependencyVersion; -51 import org.owasp.dependencycheck.utils.DependencyVersionUtil; -52 -53 /** -54 * CPEAnalyzer is a utility class that takes a project dependency and attempts -55 * to discern if there is an associated CPE. It uses the evidence contained -56 * within the dependency to search the Lucene index. -57 * -58 * @author Jeremy Long <jeremy.long@owasp.org> -59 */ -60 public class CPEAnalyzer implements Analyzer { -61 -62 /** -63 * The maximum number of query results to return. -64 */ -65 static final int MAX_QUERY_RESULTS = 25; -66 /** -67 * The weighting boost to give terms when constructing the Lucene query. -68 */ -69 static final String WEIGHTING_BOOST = "^5"; -70 /** -71 * A string representation of a regular expression defining characters -72 * utilized within the CPE Names. -73 */ -74 static final String CLEANSE_CHARACTER_RX = "[^A-Za-z0-9 ._-]"; -75 /** -76 * A string representation of a regular expression used to remove all but -77 * alpha characters. +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. +17 */ +18 package org.owasp.dependencycheck.analyzer; +19 +20 import java.io.IOException; +21 import java.io.UnsupportedEncodingException; +22 import java.net.URLEncoder; +23 import java.util.ArrayList; +24 import java.util.Collections; +25 import java.util.List; +26 import java.util.Set; +27 import java.util.StringTokenizer; +28 import java.util.logging.Level; +29 import java.util.logging.Logger; +30 import org.apache.lucene.document.Document; +31 import org.apache.lucene.index.CorruptIndexException; +32 import org.apache.lucene.queryparser.classic.ParseException; +33 import org.apache.lucene.search.ScoreDoc; +34 import org.apache.lucene.search.TopDocs; +35 import org.owasp.dependencycheck.Engine; +36 import org.owasp.dependencycheck.data.cpe.CpeMemoryIndex; +37 import org.owasp.dependencycheck.data.cpe.Fields; +38 import org.owasp.dependencycheck.data.cpe.IndexEntry; +39 import org.owasp.dependencycheck.data.cpe.IndexException; +40 import org.owasp.dependencycheck.data.lucene.LuceneUtils; +41 import org.owasp.dependencycheck.data.nvdcve.CveDB; +42 import org.owasp.dependencycheck.data.nvdcve.DatabaseException; +43 import org.owasp.dependencycheck.dependency.Confidence; +44 import org.owasp.dependencycheck.dependency.Dependency; +45 import org.owasp.dependencycheck.dependency.Evidence; +46 import org.owasp.dependencycheck.dependency.EvidenceCollection; +47 import org.owasp.dependencycheck.dependency.Identifier; +48 import org.owasp.dependencycheck.dependency.VulnerableSoftware; +49 import org.owasp.dependencycheck.utils.DependencyVersion; +50 import org.owasp.dependencycheck.utils.DependencyVersionUtil; +51 +52 /** +53 * CPEAnalyzer is a utility class that takes a project dependency and attempts to discern if there is an associated CPE. +54 * It uses the evidence contained within the dependency to search the Lucene index. +55 * +56 * @author Jeremy Long <jeremy.long@owasp.org> +57 */ +58 public class CPEAnalyzer implements Analyzer { +59 +60 /** +61 * The maximum number of query results to return. +62 */ +63 static final int MAX_QUERY_RESULTS = 25; +64 /** +65 * The weighting boost to give terms when constructing the Lucene query. +66 */ +67 static final String WEIGHTING_BOOST = "^5"; +68 /** +69 * A string representation of a regular expression defining characters utilized within the CPE Names. +70 */ +71 static final String CLEANSE_CHARACTER_RX = "[^A-Za-z0-9 ._-]"; +72 /** +73 * A string representation of a regular expression used to remove all but alpha characters. +74 */ +75 static final String CLEANSE_NONALPHA_RX = "[^A-Za-z]*"; +76 /** +77 * The additional size to add to a new StringBuilder to account for extra data that will be written into the string. 78 */ -79 static final String CLEANSE_NONALPHA_RX = "[^A-Za-z]*"; +79 static final int STRING_BUILDER_BUFFER = 20; 80 /** -81 * The additional size to add to a new StringBuilder to account for extra -82 * data that will be written into the string. -83 */ -84 static final int STRING_BUILDER_BUFFER = 20; -85 /** -86 * The CPE in memory index. -87 */ -88 private CpeMemoryIndex cpe; +81 * The CPE in memory index. +82 */ +83 private CpeMemoryIndex cpe; +84 /** +85 * The CVE Database. +86 */ +87 private CveDB cve; +88 89 /** -90 * The CVE Database. -91 */ -92 private CveDB cve; -93 -94 /** -95 * Opens the data source. -96 * -97 * @throws IOException when the Lucene directory to be queried does not -98 * exist or is corrupt. -99 * @throws DatabaseException when the database throws an exception. This -100 * usually occurs when the database is in use by another process. -101 */ -102 public void open() throws IOException, DatabaseException { -103 Logger.getLogger(CPEAnalyzer.class.getName()).log(Level.FINE, "Opening the CVE Database"); -104 cve = new CveDB(); -105 cve.open(); -106 Logger.getLogger(CPEAnalyzer.class.getName()).log(Level.FINE, "Creating the Lucene CPE Index"); -107 cpe = CpeMemoryIndex.getInstance(); -108 try { -109 cpe.open(cve); -110 } catch (IndexException ex) { -111 Logger.getLogger(CPEAnalyzer.class.getName()).log(Level.FINE, "IndexException", ex); -112 throw new DatabaseException(ex); -113 } -114 } -115 -116 /** -117 * Closes the data sources. -118 */ -119 @Override -120 public void close() { -121 if (cpe != null) { -122 cpe.close(); -123 } -124 if (cve != null) { -125 cve.close(); -126 } -127 } -128 -129 /** -130 * Searches the data store of CPE entries, trying to identify the CPE for -131 * the given dependency based on the evidence contained within. The -132 * dependency passed in is updated with any identified CPE values. -133 * -134 * @param dependency the dependency to search for CPE entries on. -135 * @throws CorruptIndexException is thrown when the Lucene index is corrupt. -136 * @throws IOException is thrown when an IOException occurs. -137 * @throws ParseException is thrown when the Lucene query cannot be parsed. -138 */ -139 protected void determineCPE(Dependency dependency) throws CorruptIndexException, IOException, ParseException { -140 Confidence confidence = Confidence.HIGHEST; -141 -142 String vendors = addEvidenceWithoutDuplicateTerms("", dependency.getVendorEvidence(), confidence); -143 String products = addEvidenceWithoutDuplicateTerms("", dependency.getProductEvidence(), confidence); -144 /* bug fix for #40 - version evidence is not showing up as "used" in the reports if there is no -145 * CPE identified. As such, we are "using" the evidence and ignoring the results. */ -146 addEvidenceWithoutDuplicateTerms("", dependency.getVersionEvidence(), confidence); -147 -148 int ctr = 0; -149 do { -150 if (!vendors.isEmpty() && !products.isEmpty()) { -151 final List<IndexEntry> entries = searchCPE(vendors, products, dependency.getProductEvidence().getWeighting(), -152 dependency.getVendorEvidence().getWeighting()); -153 -154 for (IndexEntry e : entries) { -155 if (verifyEntry(e, dependency)) { -156 final String vendor = e.getVendor(); -157 final String product = e.getProduct(); -158 determineIdentifiers(dependency, vendor, product); -159 } -160 } +90 * Opens the data source. +91 * +92 * @throws IOException when the Lucene directory to be queried does not exist or is corrupt. +93 * @throws DatabaseException when the database throws an exception. This usually occurs when the database is in use +94 * by another process. +95 */ +96 public void open() throws IOException, DatabaseException { +97 Logger.getLogger(CPEAnalyzer.class.getName()).log(Level.FINE, "Opening the CVE Database"); +98 cve = new CveDB(); +99 cve.open(); +100 Logger.getLogger(CPEAnalyzer.class.getName()).log(Level.FINE, "Creating the Lucene CPE Index"); +101 cpe = CpeMemoryIndex.getInstance(); +102 try { +103 cpe.open(cve); +104 } catch (IndexException ex) { +105 Logger.getLogger(CPEAnalyzer.class.getName()).log(Level.FINE, "IndexException", ex); +106 throw new DatabaseException(ex); +107 } +108 } +109 +110 /** +111 * Closes the data sources. +112 */ +113 @Override +114 public void close() { +115 if (cpe != null) { +116 cpe.close(); +117 } +118 if (cve != null) { +119 cve.close(); +120 } +121 } +122 +123 /** +124 * Searches the data store of CPE entries, trying to identify the CPE for the given dependency based on the evidence +125 * contained within. The dependency passed in is updated with any identified CPE values. +126 * +127 * @param dependency the dependency to search for CPE entries on. +128 * @throws CorruptIndexException is thrown when the Lucene index is corrupt. +129 * @throws IOException is thrown when an IOException occurs. +130 * @throws ParseException is thrown when the Lucene query cannot be parsed. +131 */ +132 protected void determineCPE(Dependency dependency) throws CorruptIndexException, IOException, ParseException { +133 Confidence confidence = Confidence.HIGHEST; +134 +135 String vendors = addEvidenceWithoutDuplicateTerms("", dependency.getVendorEvidence(), confidence); +136 String products = addEvidenceWithoutDuplicateTerms("", dependency.getProductEvidence(), confidence); +137 /* bug fix for #40 - version evidence is not showing up as "used" in the reports if there is no +138 * CPE identified. As such, we are "using" the evidence and ignoring the results. */ +139 addEvidenceWithoutDuplicateTerms("", dependency.getVersionEvidence(), confidence); +140 +141 int ctr = 0; +142 do { +143 if (!vendors.isEmpty() && !products.isEmpty()) { +144 final List<IndexEntry> entries = searchCPE(vendors, products, dependency.getProductEvidence().getWeighting(), +145 dependency.getVendorEvidence().getWeighting()); +146 +147 for (IndexEntry e : entries) { +148 if (verifyEntry(e, dependency)) { +149 final String vendor = e.getVendor(); +150 final String product = e.getProduct(); +151 determineIdentifiers(dependency, vendor, product); +152 } +153 } +154 } +155 confidence = reduceConfidence(confidence); +156 if (dependency.getVendorEvidence().contains(confidence)) { +157 vendors = addEvidenceWithoutDuplicateTerms(vendors, dependency.getVendorEvidence(), confidence); +158 } +159 if (dependency.getProductEvidence().contains(confidence)) { +160 products = addEvidenceWithoutDuplicateTerms(products, dependency.getProductEvidence(), confidence); 161 } -162 confidence = reduceConfidence(confidence); -163 if (dependency.getVendorEvidence().contains(confidence)) { -164 vendors = addEvidenceWithoutDuplicateTerms(vendors, dependency.getVendorEvidence(), confidence); -165 } -166 if (dependency.getProductEvidence().contains(confidence)) { -167 products = addEvidenceWithoutDuplicateTerms(products, dependency.getProductEvidence(), confidence); -168 } -169 /* bug fix for #40 - version evidence is not showing up as "used" in the reports if there is no -170 * CPE identified. As such, we are "using" the evidence and ignoring the results. */ -171 if (dependency.getVersionEvidence().contains(confidence)) { -172 addEvidenceWithoutDuplicateTerms("", dependency.getVersionEvidence(), confidence); -173 } -174 } while ((++ctr) < 4); -175 } -176 -177 /** -178 * Returns the text created by concatenating the text and the values from -179 * the EvidenceCollection (filtered for a specific confidence). This -180 * attempts to prevent duplicate terms from being added.<br/<br/> Note, if -181 * the evidence is longer then 200 characters it will be truncated. -182 * -183 * @param text the base text. -184 * @param ec an EvidenceCollection -185 * @param confidenceFilter a Confidence level to filter the evidence by. -186 * @return the new evidence text -187 */ -188 private String addEvidenceWithoutDuplicateTerms(final String text, final EvidenceCollection ec, Confidence confidenceFilter) { -189 final String txt = (text == null) ? "" : text; -190 final StringBuilder sb = new StringBuilder(txt.length() + (20 * ec.size())); -191 sb.append(' ').append(txt).append(' '); -192 for (Evidence e : ec.iterator(confidenceFilter)) { -193 String value = e.getValue(); -194 -195 //hack to get around the fact that lucene does a really good job of recognizing domains and not -196 // splitting them. TODO - put together a better lucene analyzer specific to the domain. -197 if (value.startsWith("http://")) { -198 value = value.substring(7).replaceAll("\\.", " "); -199 } -200 if (value.startsWith("https://")) { -201 value = value.substring(8).replaceAll("\\.", " "); -202 } -203 if (sb.indexOf(" " + value + " ") < 0) { -204 sb.append(value).append(' '); -205 } -206 } -207 return sb.toString().trim(); -208 } -209 -210 /** -211 * Reduces the given confidence by one level. This returns LOW if the -212 * confidence passed in is not HIGH. -213 * -214 * @param c the confidence to reduce. -215 * @return One less then the confidence passed in. -216 */ -217 private Confidence reduceConfidence(final Confidence c) { -218 if (c == Confidence.HIGHEST) { -219 return Confidence.HIGH; -220 } else if (c == Confidence.HIGH) { -221 return Confidence.MEDIUM; -222 } else { -223 return Confidence.LOW; -224 } -225 } -226 -227 /** -228 * <p>Searches the Lucene CPE index to identify possible CPE entries -229 * associated with the supplied vendor, product, and version.</p> -230 * -231 * <p>If either the vendorWeightings or productWeightings lists have been -232 * populated this data is used to add weighting factors to the search.</p> -233 * -234 * @param vendor the text used to search the vendor field -235 * @param product the text used to search the product field -236 * @param vendorWeightings a list of strings to use to add weighting factors -237 * to the vendor field -238 * @param productWeightings Adds a list of strings that will be used to add -239 * weighting factors to the product search -240 * @return a list of possible CPE values -241 * @throws CorruptIndexException when the Lucene index is corrupt -242 * @throws IOException when the Lucene index is not found -243 * @throws ParseException when the generated query is not valid -244 */ -245 protected List<IndexEntry> searchCPE(String vendor, String product, -246 Set<String> vendorWeightings, Set<String> productWeightings) -247 throws CorruptIndexException, IOException, ParseException { -248 final ArrayList<IndexEntry> ret = new ArrayList<IndexEntry>(MAX_QUERY_RESULTS); -249 -250 final String searchString = buildSearch(vendor, product, vendorWeightings, productWeightings); -251 if (searchString == null) { -252 return ret; -253 } -254 -255 final TopDocs docs = cpe.search(searchString, MAX_QUERY_RESULTS); -256 for (ScoreDoc d : docs.scoreDocs) { -257 if (d.score >= 0.08) { -258 final Document doc = cpe.getDocument(d.doc); -259 final IndexEntry entry = new IndexEntry(); -260 entry.setVendor(doc.get(Fields.VENDOR)); -261 entry.setProduct(doc.get(Fields.PRODUCT)); -262 // if (d.score < 0.08) { -263 // System.out.print(entry.getVendor()); -264 // System.out.print(":"); -265 // System.out.print(entry.getProduct()); -266 // System.out.print(":"); -267 // System.out.println(d.score); -268 // } -269 entry.setSearchScore(d.score); -270 if (!ret.contains(entry)) { -271 ret.add(entry); -272 } -273 } -274 } -275 return ret; -276 } -277 -278 /** -279 * <p>Builds a Lucene search string by properly escaping data and -280 * constructing a valid search query.</p> -281 * -282 * <p>If either the possibleVendor or possibleProducts lists have been -283 * populated this data is used to add weighting factors to the search string -284 * generated.</p> -285 * -286 * @param vendor text to search the vendor field -287 * @param product text to search the product field -288 * @param vendorWeighting a list of strings to apply to the vendor to boost -289 * the terms weight -290 * @param productWeightings a list of strings to apply to the product to -291 * boost the terms weight -292 * @return the Lucene query -293 */ -294 protected String buildSearch(String vendor, String product, -295 Set<String> vendorWeighting, Set<String> productWeightings) { -296 final String v = vendor; //.replaceAll("[^\\w\\d]", " "); -297 final String p = product; //.replaceAll("[^\\w\\d]", " "); -298 final StringBuilder sb = new StringBuilder(v.length() + p.length() -299 + Fields.PRODUCT.length() + Fields.VENDOR.length() + STRING_BUILDER_BUFFER); -300 -301 if (!appendWeightedSearch(sb, Fields.PRODUCT, p, productWeightings)) { -302 return null; -303 } -304 sb.append(" AND "); -305 if (!appendWeightedSearch(sb, Fields.VENDOR, v, vendorWeighting)) { -306 return null; -307 } -308 return sb.toString(); -309 } -310 -311 /** -312 * This method constructs a Lucene query for a given field. The searchText -313 * is split into separate words and if the word is within the list of -314 * weighted words then an additional weighting is applied to the term as it -315 * is appended into the query. -316 * -317 * @param sb a StringBuilder that the query text will be appended to. -318 * @param field the field within the Lucene index that the query is -319 * searching. -320 * @param searchText text used to construct the query. -321 * @param weightedText a list of terms that will be considered higher -322 * importance when searching. -323 * @return if the append was successful. -324 */ -325 private boolean appendWeightedSearch(StringBuilder sb, String field, String searchText, Set<String> weightedText) { -326 sb.append(" ").append(field).append(":( "); -327 -328 final String cleanText = cleanseText(searchText); -329 -330 if ("".equals(cleanText)) { -331 return false; -332 } -333 -334 if (weightedText == null || weightedText.isEmpty()) { -335 LuceneUtils.appendEscapedLuceneQuery(sb, cleanText); -336 } else { -337 final StringTokenizer tokens = new StringTokenizer(cleanText); -338 while (tokens.hasMoreElements()) { -339 final String word = tokens.nextToken(); -340 String temp = null; -341 for (String weighted : weightedText) { -342 final String weightedStr = cleanseText(weighted); -343 if (equalsIgnoreCaseAndNonAlpha(word, weightedStr)) { -344 temp = LuceneUtils.escapeLuceneQuery(word) + WEIGHTING_BOOST; -345 if (!word.equalsIgnoreCase(weightedStr)) { -346 temp += " " + LuceneUtils.escapeLuceneQuery(weightedStr) + WEIGHTING_BOOST; -347 } -348 } -349 } -350 if (temp == null) { -351 temp = LuceneUtils.escapeLuceneQuery(word); -352 } -353 sb.append(" ").append(temp); -354 } -355 } -356 sb.append(" ) "); -357 return true; -358 } -359 -360 /** -361 * Removes characters from the input text that are not used within the CPE -362 * index. -363 * -364 * @param text is the text to remove the characters from. -365 * @return the text having removed some characters. -366 */ -367 private String cleanseText(String text) { -368 return text.replaceAll(CLEANSE_CHARACTER_RX, " "); -369 } -370 -371 /** -372 * Compares two strings after lower casing them and removing the non-alpha -373 * characters. -374 * -375 * @param l string one to compare. -376 * @param r string two to compare. -377 * @return whether or not the two strings are similar. -378 */ -379 private boolean equalsIgnoreCaseAndNonAlpha(String l, String r) { -380 if (l == null || r == null) { -381 return false; -382 } +162 /* bug fix for #40 - version evidence is not showing up as "used" in the reports if there is no +163 * CPE identified. As such, we are "using" the evidence and ignoring the results. */ +164 if (dependency.getVersionEvidence().contains(confidence)) { +165 addEvidenceWithoutDuplicateTerms("", dependency.getVersionEvidence(), confidence); +166 } +167 } while ((++ctr) < 4); +168 } +169 +170 /** +171 * Returns the text created by concatenating the text and the values from the EvidenceCollection (filtered for a +172 * specific confidence). This attempts to prevent duplicate terms from being added.<br/<br/> Note, if the evidence +173 * is longer then 200 characters it will be truncated. +174 * +175 * @param text the base text. +176 * @param ec an EvidenceCollection +177 * @param confidenceFilter a Confidence level to filter the evidence by. +178 * @return the new evidence text +179 */ +180 private String addEvidenceWithoutDuplicateTerms(final String text, final EvidenceCollection ec, Confidence confidenceFilter) { +181 final String txt = (text == null) ? "" : text; +182 final StringBuilder sb = new StringBuilder(txt.length() + (20 * ec.size())); +183 sb.append(' ').append(txt).append(' '); +184 for (Evidence e : ec.iterator(confidenceFilter)) { +185 String value = e.getValue(); +186 +187 //hack to get around the fact that lucene does a really good job of recognizing domains and not +188 // splitting them. TODO - put together a better lucene analyzer specific to the domain. +189 if (value.startsWith("http://")) { +190 value = value.substring(7).replaceAll("\\.", " "); +191 } +192 if (value.startsWith("https://")) { +193 value = value.substring(8).replaceAll("\\.", " "); +194 } +195 if (sb.indexOf(" " + value + " ") < 0) { +196 sb.append(value).append(' '); +197 } +198 } +199 return sb.toString().trim(); +200 } +201 +202 /** +203 * Reduces the given confidence by one level. This returns LOW if the confidence passed in is not HIGH. +204 * +205 * @param c the confidence to reduce. +206 * @return One less then the confidence passed in. +207 */ +208 private Confidence reduceConfidence(final Confidence c) { +209 if (c == Confidence.HIGHEST) { +210 return Confidence.HIGH; +211 } else if (c == Confidence.HIGH) { +212 return Confidence.MEDIUM; +213 } else { +214 return Confidence.LOW; +215 } +216 } +217 +218 /** +219 * <p> +220 * Searches the Lucene CPE index to identify possible CPE entries associated with the supplied vendor, product, and +221 * version.</p> +222 * +223 * <p> +224 * If either the vendorWeightings or productWeightings lists have been populated this data is used to add weighting +225 * factors to the search.</p> +226 * +227 * @param vendor the text used to search the vendor field +228 * @param product the text used to search the product field +229 * @param vendorWeightings a list of strings to use to add weighting factors to the vendor field +230 * @param productWeightings Adds a list of strings that will be used to add weighting factors to the product search +231 * @return a list of possible CPE values +232 * @throws CorruptIndexException when the Lucene index is corrupt +233 * @throws IOException when the Lucene index is not found +234 * @throws ParseException when the generated query is not valid +235 */ +236 protected List<IndexEntry> searchCPE(String vendor, String product, +237 Set<String> vendorWeightings, Set<String> productWeightings) +238 throws CorruptIndexException, IOException, ParseException { +239 final ArrayList<IndexEntry> ret = new ArrayList<IndexEntry>(MAX_QUERY_RESULTS); +240 +241 final String searchString = buildSearch(vendor, product, vendorWeightings, productWeightings); +242 if (searchString == null) { +243 return ret; +244 } +245 +246 final TopDocs docs = cpe.search(searchString, MAX_QUERY_RESULTS); +247 for (ScoreDoc d : docs.scoreDocs) { +248 if (d.score >= 0.08) { +249 final Document doc = cpe.getDocument(d.doc); +250 final IndexEntry entry = new IndexEntry(); +251 entry.setVendor(doc.get(Fields.VENDOR)); +252 entry.setProduct(doc.get(Fields.PRODUCT)); +253 // if (d.score < 0.08) { +254 // System.out.print(entry.getVendor()); +255 // System.out.print(":"); +256 // System.out.print(entry.getProduct()); +257 // System.out.print(":"); +258 // System.out.println(d.score); +259 // } +260 entry.setSearchScore(d.score); +261 if (!ret.contains(entry)) { +262 ret.add(entry); +263 } +264 } +265 } +266 return ret; +267 } +268 +269 /** +270 * <p> +271 * Builds a Lucene search string by properly escaping data and constructing a valid search query.</p> +272 * +273 * <p> +274 * If either the possibleVendor or possibleProducts lists have been populated this data is used to add weighting +275 * factors to the search string generated.</p> +276 * +277 * @param vendor text to search the vendor field +278 * @param product text to search the product field +279 * @param vendorWeighting a list of strings to apply to the vendor to boost the terms weight +280 * @param productWeightings a list of strings to apply to the product to boost the terms weight +281 * @return the Lucene query +282 */ +283 protected String buildSearch(String vendor, String product, +284 Set<String> vendorWeighting, Set<String> productWeightings) { +285 final String v = vendor; //.replaceAll("[^\\w\\d]", " "); +286 final String p = product; //.replaceAll("[^\\w\\d]", " "); +287 final StringBuilder sb = new StringBuilder(v.length() + p.length() +288 + Fields.PRODUCT.length() + Fields.VENDOR.length() + STRING_BUILDER_BUFFER); +289 +290 if (!appendWeightedSearch(sb, Fields.PRODUCT, p, productWeightings)) { +291 return null; +292 } +293 sb.append(" AND "); +294 if (!appendWeightedSearch(sb, Fields.VENDOR, v, vendorWeighting)) { +295 return null; +296 } +297 return sb.toString(); +298 } +299 +300 /** +301 * This method constructs a Lucene query for a given field. The searchText is split into separate words and if the +302 * word is within the list of weighted words then an additional weighting is applied to the term as it is appended +303 * into the query. +304 * +305 * @param sb a StringBuilder that the query text will be appended to. +306 * @param field the field within the Lucene index that the query is searching. +307 * @param searchText text used to construct the query. +308 * @param weightedText a list of terms that will be considered higher importance when searching. +309 * @return if the append was successful. +310 */ +311 private boolean appendWeightedSearch(StringBuilder sb, String field, String searchText, Set<String> weightedText) { +312 sb.append(" ").append(field).append(":( "); +313 +314 final String cleanText = cleanseText(searchText); +315 +316 if ("".equals(cleanText)) { +317 return false; +318 } +319 +320 if (weightedText == null || weightedText.isEmpty()) { +321 LuceneUtils.appendEscapedLuceneQuery(sb, cleanText); +322 } else { +323 final StringTokenizer tokens = new StringTokenizer(cleanText); +324 while (tokens.hasMoreElements()) { +325 final String word = tokens.nextToken(); +326 String temp = null; +327 for (String weighted : weightedText) { +328 final String weightedStr = cleanseText(weighted); +329 if (equalsIgnoreCaseAndNonAlpha(word, weightedStr)) { +330 temp = LuceneUtils.escapeLuceneQuery(word) + WEIGHTING_BOOST; +331 if (!word.equalsIgnoreCase(weightedStr)) { +332 temp += " " + LuceneUtils.escapeLuceneQuery(weightedStr) + WEIGHTING_BOOST; +333 } +334 } +335 } +336 if (temp == null) { +337 temp = LuceneUtils.escapeLuceneQuery(word); +338 } +339 sb.append(" ").append(temp); +340 } +341 } +342 sb.append(" ) "); +343 return true; +344 } +345 +346 /** +347 * Removes characters from the input text that are not used within the CPE index. +348 * +349 * @param text is the text to remove the characters from. +350 * @return the text having removed some characters. +351 */ +352 private String cleanseText(String text) { +353 return text.replaceAll(CLEANSE_CHARACTER_RX, " "); +354 } +355 +356 /** +357 * Compares two strings after lower casing them and removing the non-alpha characters. +358 * +359 * @param l string one to compare. +360 * @param r string two to compare. +361 * @return whether or not the two strings are similar. +362 */ +363 private boolean equalsIgnoreCaseAndNonAlpha(String l, String r) { +364 if (l == null || r == null) { +365 return false; +366 } +367 +368 final String left = l.replaceAll(CLEANSE_NONALPHA_RX, ""); +369 final String right = r.replaceAll(CLEANSE_NONALPHA_RX, ""); +370 return left.equalsIgnoreCase(right); +371 } +372 +373 /** +374 * Ensures that the CPE Identified matches the dependency. This validates that the product, vendor, and version +375 * information for the CPE are contained within the dependencies evidence. +376 * +377 * @param entry a CPE entry. +378 * @param dependency the dependency that the CPE entries could be for. +379 * @return whether or not the entry is valid. +380 */ +381 private boolean verifyEntry(final IndexEntry entry, final Dependency dependency) { +382 boolean isValid = false; 383 -384 final String left = l.replaceAll(CLEANSE_NONALPHA_RX, ""); -385 final String right = r.replaceAll(CLEANSE_NONALPHA_RX, ""); -386 return left.equalsIgnoreCase(right); -387 } -388 -389 /** -390 * Ensures that the CPE Identified matches the dependency. This validates -391 * that the product, vendor, and version information for the CPE are -392 * contained within the dependencies evidence. -393 * -394 * @param entry a CPE entry. -395 * @param dependency the dependency that the CPE entries could be for. -396 * @return whether or not the entry is valid. -397 */ -398 private boolean verifyEntry(final IndexEntry entry, final Dependency dependency) { -399 boolean isValid = false; +384 if (collectionContainsString(dependency.getProductEvidence(), entry.getProduct()) +385 && collectionContainsString(dependency.getVendorEvidence(), entry.getVendor())) { +386 //&& collectionContainsVersion(dependency.getVersionEvidence(), entry.getVersion()) +387 isValid = true; +388 } +389 return isValid; +390 } +391 +392 /** +393 * Used to determine if the EvidenceCollection contains a specific string. +394 * +395 * @param ec an EvidenceCollection +396 * @param text the text to search for +397 * @return whether or not the EvidenceCollection contains the string +398 */ +399 private boolean collectionContainsString(EvidenceCollection ec, String text) { 400 -401 if (collectionContainsString(dependency.getProductEvidence(), entry.getProduct()) -402 && collectionContainsString(dependency.getVendorEvidence(), entry.getVendor())) { -403 //&& collectionContainsVersion(dependency.getVersionEvidence(), entry.getVersion()) -404 isValid = true; -405 } -406 return isValid; -407 } -408 -409 /** -410 * Used to determine if the EvidenceCollection contains a specific string. -411 * -412 * @param ec an EvidenceCollection -413 * @param text the text to search for -414 * @return whether or not the EvidenceCollection contains the string -415 */ -416 private boolean collectionContainsString(EvidenceCollection ec, String text) { -417 -418 //<editor-fold defaultstate="collapsed" desc="This code fold contains an old version of the code, delete once more testing is done"> -419 // String[] splitText = text.split("[\\s_-]"); -420 // -421 // for (String search : splitText) { -422 // //final String search = text.replaceAll("[\\s_-]", "").toLowerCase(); -423 // if (ec.containsUsedString(search)) { -424 // return true; -425 // } -426 // } -427 //</editor-fold> -428 -429 //TODO - likely need to change the split... not sure if this will work for CPE with special chars -430 if (text == null) { -431 return false; -432 } -433 final String[] words = text.split("[\\s_-]"); -434 final List<String> list = new ArrayList<String>(); -435 String tempWord = null; -436 for (String word : words) { -437 /* -438 single letter words should be concatenated with the next word. -439 so { "m", "core", "sample" } -> { "mcore", "sample" } -440 */ -441 if (tempWord != null) { -442 list.add(tempWord + word); -443 tempWord = null; -444 } else if (word.length() <= 2) { -445 tempWord = word; -446 } else { -447 list.add(word); -448 } -449 } -450 if (tempWord != null && !list.isEmpty()) { -451 final String tmp = list.get(list.size() - 1) + tempWord; -452 list.add(tmp); -453 } -454 boolean contains = true; -455 for (String word : list) { -456 contains &= ec.containsUsedString(word); -457 } -458 return contains; -459 } -460 -461 /** -462 * Analyzes a dependency and attempts to determine if there are any CPE -463 * identifiers for this dependency. -464 * -465 * @param dependency The Dependency to analyze. -466 * @param engine The analysis engine -467 * @throws AnalysisException is thrown if there is an issue analyzing the -468 * dependency. -469 */ -470 @Override -471 public void analyze(Dependency dependency, Engine engine) throws AnalysisException { -472 try { -473 determineCPE(dependency); -474 } catch (CorruptIndexException ex) { -475 throw new AnalysisException("CPE Index is corrupt.", ex); -476 } catch (IOException ex) { -477 throw new AnalysisException("Failure opening the CPE Index.", ex); -478 } catch (ParseException ex) { -479 throw new AnalysisException("Unable to parse the generated Lucene query for this dependency.", ex); -480 } +401 //<editor-fold defaultstate="collapsed" desc="This code fold contains an old version of the code, delete once more testing is done"> +402 // String[] splitText = text.split("[\\s_-]"); +403 // +404 // for (String search : splitText) { +405 // //final String search = text.replaceAll("[\\s_-]", "").toLowerCase(); +406 // if (ec.containsUsedString(search)) { +407 // return true; +408 // } +409 // } +410 //</editor-fold> +411 //TODO - likely need to change the split... not sure if this will work for CPE with special chars +412 if (text == null) { +413 return false; +414 } +415 final String[] words = text.split("[\\s_-]"); +416 final List<String> list = new ArrayList<String>(); +417 String tempWord = null; +418 for (String word : words) { +419 /* +420 single letter words should be concatenated with the next word. +421 so { "m", "core", "sample" } -> { "mcore", "sample" } +422 */ +423 if (tempWord != null) { +424 list.add(tempWord + word); +425 tempWord = null; +426 } else if (word.length() <= 2) { +427 tempWord = word; +428 } else { +429 list.add(word); +430 } +431 } +432 if (tempWord != null && !list.isEmpty()) { +433 final String tmp = list.get(list.size() - 1) + tempWord; +434 list.add(tmp); +435 } +436 boolean contains = true; +437 for (String word : list) { +438 contains &= ec.containsUsedString(word); +439 } +440 return contains; +441 } +442 +443 /** +444 * Analyzes a dependency and attempts to determine if there are any CPE identifiers for this dependency. +445 * +446 * @param dependency The Dependency to analyze. +447 * @param engine The analysis engine +448 * @throws AnalysisException is thrown if there is an issue analyzing the dependency. +449 */ +450 @Override +451 public void analyze(Dependency dependency, Engine engine) throws AnalysisException { +452 try { +453 determineCPE(dependency); +454 } catch (CorruptIndexException ex) { +455 throw new AnalysisException("CPE Index is corrupt.", ex); +456 } catch (IOException ex) { +457 throw new AnalysisException("Failure opening the CPE Index.", ex); +458 } catch (ParseException ex) { +459 throw new AnalysisException("Unable to parse the generated Lucene query for this dependency.", ex); +460 } +461 } +462 +463 /** +464 * Returns true because this analyzer supports all dependency types. +465 * +466 * @return true. +467 */ +468 @Override +469 public Set<String> getSupportedExtensions() { +470 return null; +471 } +472 +473 /** +474 * Returns the name of this analyzer. +475 * +476 * @return the name of this analyzer. +477 */ +478 @Override +479 public String getName() { +480 return "CPE Analyzer"; 481 } 482 483 /** 484 * Returns true because this analyzer supports all dependency types. 485 * -486 * @return true. -487 */ -488 @Override -489 public Set<String> getSupportedExtensions() { -490 return null; -491 } -492 -493 /** -494 * Returns the name of this analyzer. -495 * -496 * @return the name of this analyzer. -497 */ -498 @Override -499 public String getName() { -500 return "CPE Analyzer"; -501 } -502 -503 /** -504 * Returns true because this analyzer supports all dependency types. -505 * -506 * @param extension the file extension of the dependency being analyzed. -507 * @return true. +486 * @param extension the file extension of the dependency being analyzed. +487 * @return true. +488 */ +489 @Override +490 public boolean supportsExtension(String extension) { +491 return true; +492 } +493 +494 /** +495 * Returns the analysis phase that this analyzer should run in. +496 * +497 * @return the analysis phase that this analyzer should run in. +498 */ +499 @Override +500 public AnalysisPhase getAnalysisPhase() { +501 return AnalysisPhase.IDENTIFIER_ANALYSIS; +502 } +503 +504 /** +505 * Opens the CPE Lucene Index. +506 * +507 * @throws Exception is thrown if there is an issue opening the index. 508 */ 509 @Override -510 public boolean supportsExtension(String extension) { -511 return true; +510 public void initialize() throws Exception { +511 this.open(); 512 } 513 514 /** -515 * Returns the analysis phase that this analyzer should run in. -516 * -517 * @return the analysis phase that this analyzer should run in. -518 */ -519 @Override -520 public AnalysisPhase getAnalysisPhase() { -521 return AnalysisPhase.IDENTIFIER_ANALYSIS; -522 } -523 -524 /** -525 * Opens the CPE Lucene Index. -526 * -527 * @throws Exception is thrown if there is an issue opening the index. -528 */ -529 @Override -530 public void initialize() throws Exception { -531 this.open(); -532 } -533 -534 /** -535 * Retrieves a list of CPE values from the CveDB based on the vendor and -536 * product passed in. The list is then validated to find only CPEs that are -537 * valid for the given dependency. It is possible that the CPE identified is -538 * a best effort "guess" based on the vendor, product, and version -539 * information. -540 * -541 * @param dependency the Dependency being analyzed -542 * @param vendor the vendor for the CPE being analyzed -543 * @param product the product for the CPE being analyzed -544 * @throws UnsupportedEncodingException is thrown if UTF-8 is not supported -545 */ -546 private void determineIdentifiers(Dependency dependency, String vendor, String product) throws UnsupportedEncodingException { -547 final Set<VulnerableSoftware> cpes = cve.getCPEs(vendor, product); -548 DependencyVersion bestGuess = new DependencyVersion("-"); -549 Confidence bestGuessConf = null; -550 final List<IdentifierMatch> collected = new ArrayList<IdentifierMatch>(); -551 for (Confidence conf : Confidence.values()) { -552 for (Evidence evidence : dependency.getVersionEvidence().iterator(conf)) { -553 final DependencyVersion evVer = DependencyVersionUtil.parseVersion(evidence.getValue()); -554 if (evVer == null) { -555 continue; -556 } -557 for (VulnerableSoftware vs : cpes) { -558 DependencyVersion dbVer; -559 if (vs.getRevision() != null && !vs.getRevision().isEmpty()) { -560 dbVer = DependencyVersionUtil.parseVersion(vs.getVersion() + "." + vs.getRevision()); -561 } else { -562 dbVer = DependencyVersionUtil.parseVersion(vs.getVersion()); -563 } -564 if (dbVer == null //special case, no version specified - everything is vulnerable -565 || evVer.equals(dbVer)) { //yeah! exact match -566 final String url = String.format("http://web.nvd.nist.gov/view/vuln/search?cpe=%s", URLEncoder.encode(vs.getName(), "UTF-8")); -567 final IdentifierMatch match = new IdentifierMatch("cpe", vs.getName(), url, IdentifierConfidence.EXACT_MATCH, conf); -568 collected.add(match); -569 } else { -570 //TODO the following isn't quite right is it? need to think about this guessing game a bit more. -571 if (evVer.getVersionParts().size() <= dbVer.getVersionParts().size() -572 && evVer.matchesAtLeastThreeLevels(dbVer)) { -573 if (bestGuessConf == null || bestGuessConf.compareTo(conf) > 0) { -574 if (bestGuess.getVersionParts().size() < dbVer.getVersionParts().size()) { -575 bestGuess = dbVer; -576 bestGuessConf = conf; -577 } -578 } -579 } -580 } -581 } -582 if (bestGuessConf == null || bestGuessConf.compareTo(conf) > 0) { -583 if (bestGuess.getVersionParts().size() < evVer.getVersionParts().size()) { -584 bestGuess = evVer; -585 bestGuessConf = conf; -586 } +515 * Retrieves a list of CPE values from the CveDB based on the vendor and product passed in. The list is then +516 * validated to find only CPEs that are valid for the given dependency. It is possible that the CPE identified is a +517 * best effort "guess" based on the vendor, product, and version information. +518 * +519 * @param dependency the Dependency being analyzed +520 * @param vendor the vendor for the CPE being analyzed +521 * @param product the product for the CPE being analyzed +522 * @throws UnsupportedEncodingException is thrown if UTF-8 is not supported +523 */ +524 private void determineIdentifiers(Dependency dependency, String vendor, String product) throws UnsupportedEncodingException { +525 final Set<VulnerableSoftware> cpes = cve.getCPEs(vendor, product); +526 DependencyVersion bestGuess = new DependencyVersion("-"); +527 Confidence bestGuessConf = null; +528 final List<IdentifierMatch> collected = new ArrayList<IdentifierMatch>(); +529 for (Confidence conf : Confidence.values()) { +530 for (Evidence evidence : dependency.getVersionEvidence().iterator(conf)) { +531 final DependencyVersion evVer = DependencyVersionUtil.parseVersion(evidence.getValue()); +532 if (evVer == null) { +533 continue; +534 } +535 for (VulnerableSoftware vs : cpes) { +536 DependencyVersion dbVer; +537 if (vs.getRevision() != null && !vs.getRevision().isEmpty()) { +538 dbVer = DependencyVersionUtil.parseVersion(vs.getVersion() + "." + vs.getRevision()); +539 } else { +540 dbVer = DependencyVersionUtil.parseVersion(vs.getVersion()); +541 } +542 if (dbVer == null //special case, no version specified - everything is vulnerable +543 || evVer.equals(dbVer)) { //yeah! exact match +544 final String url = String.format("http://web.nvd.nist.gov/view/vuln/search?cpe=%s", URLEncoder.encode(vs.getName(), "UTF-8")); +545 final IdentifierMatch match = new IdentifierMatch("cpe", vs.getName(), url, IdentifierConfidence.EXACT_MATCH, conf); +546 collected.add(match); +547 } else { +548 //TODO the following isn't quite right is it? need to think about this guessing game a bit more. +549 if (evVer.getVersionParts().size() <= dbVer.getVersionParts().size() +550 && evVer.matchesAtLeastThreeLevels(dbVer)) { +551 if (bestGuessConf == null || bestGuessConf.compareTo(conf) > 0) { +552 if (bestGuess.getVersionParts().size() < dbVer.getVersionParts().size()) { +553 bestGuess = dbVer; +554 bestGuessConf = conf; +555 } +556 } +557 } +558 } +559 } +560 if (bestGuessConf == null || bestGuessConf.compareTo(conf) > 0) { +561 if (bestGuess.getVersionParts().size() < evVer.getVersionParts().size()) { +562 bestGuess = evVer; +563 bestGuessConf = conf; +564 } +565 } +566 } +567 } +568 final String cpeName = String.format("cpe:/a:%s:%s:%s", vendor, product, bestGuess.toString()); +569 final String url = null; //String.format("http://web.nvd.nist.gov/view/vuln/search?cpe=%s", URLEncoder.encode(cpeName, "UTF-8")); +570 if (bestGuessConf == null) { +571 bestGuessConf = Confidence.LOW; +572 } +573 final IdentifierMatch match = new IdentifierMatch("cpe", cpeName, url, IdentifierConfidence.BEST_GUESS, bestGuessConf); +574 collected.add(match); +575 +576 Collections.sort(collected); +577 final IdentifierConfidence bestIdentifierQuality = collected.get(0).getConfidence(); +578 final Confidence bestEvidenceQuality = collected.get(0).getEvidenceConfidence(); +579 for (IdentifierMatch m : collected) { +580 if (bestIdentifierQuality.equals(m.getConfidence()) +581 && bestEvidenceQuality.equals(m.getEvidenceConfidence())) { +582 final Identifier i = m.getIdentifier(); +583 if (bestIdentifierQuality == IdentifierConfidence.BEST_GUESS) { +584 i.setConfidence(Confidence.LOW); +585 } else { +586 i.setConfidence(bestEvidenceQuality); 587 } -588 } -589 } -590 final String cpeName = String.format("cpe:/a:%s:%s:%s", vendor, product, bestGuess.toString()); -591 final String url = null; //String.format("http://web.nvd.nist.gov/view/vuln/search?cpe=%s", URLEncoder.encode(cpeName, "UTF-8")); -592 if (bestGuessConf == null) { -593 bestGuessConf = Confidence.LOW; -594 } -595 final IdentifierMatch match = new IdentifierMatch("cpe", cpeName, url, IdentifierConfidence.BEST_GUESS, bestGuessConf); -596 collected.add(match); +588 dependency.addIdentifier(i); +589 } +590 } +591 } +592 +593 /** +594 * The confidence whether the identifier is an exact match, or a best guess. +595 */ +596 private enum IdentifierConfidence { 597 -598 Collections.sort(collected); -599 final IdentifierConfidence bestIdentifierQuality = collected.get(0).getConfidence(); -600 final Confidence bestEvidenceQuality = collected.get(0).getEvidenceConfidence(); -601 for (IdentifierMatch m : collected) { -602 if (bestIdentifierQuality.equals(m.getConfidence()) -603 && bestEvidenceQuality.equals(m.getEvidenceConfidence())) { -604 dependency.addIdentifier(m.getIdentifier()); -605 } -606 } -607 } -608 -609 /** -610 * The confidence whether the identifier is an exact match, or a best guess. -611 */ -612 private enum IdentifierConfidence { -613 -614 /** -615 * An exact match for the CPE. -616 */ -617 EXACT_MATCH, -618 /** -619 * A best guess for the CPE. -620 */ -621 BEST_GUESS -622 } -623 -624 /** -625 * A simple object to hold an identifier and carry information about the -626 * confidence in the identifier. -627 */ -628 private static class IdentifierMatch implements Comparable<IdentifierMatch> { -629 -630 /** -631 * Constructs an IdentifierMatch. -632 * -633 * @param type the type of identifier (such as CPE) -634 * @param value the value of the identifier -635 * @param url the URL of the identifier -636 * @param identifierConfidence the confidence in the identifier: best -637 * guess or exact match -638 * @param evidenceConfidence the confidence of the evidence used to find -639 * the identifier -640 */ -641 IdentifierMatch(String type, String value, String url, IdentifierConfidence identifierConfidence, Confidence evidenceConfidence) { -642 this.identifier = new Identifier(type, value, url); -643 this.confidence = identifierConfidence; -644 this.evidenceConfidence = evidenceConfidence; -645 } -646 //<editor-fold defaultstate="collapsed" desc="Property implementations: evidenceConfidence, confidence, identifier"> -647 /** -648 * The confidence in the evidence used to identify this match. -649 */ -650 private Confidence evidenceConfidence; -651 -652 /** -653 * Get the value of evidenceConfidence -654 * -655 * @return the value of evidenceConfidence -656 */ -657 public Confidence getEvidenceConfidence() { -658 return evidenceConfidence; -659 } -660 -661 /** -662 * Set the value of evidenceConfidence -663 * -664 * @param evidenceConfidence new value of evidenceConfidence -665 */ -666 public void setEvidenceConfidence(Confidence evidenceConfidence) { -667 this.evidenceConfidence = evidenceConfidence; -668 } -669 /** -670 * The confidence whether this is an exact match, or a best guess. -671 */ -672 private IdentifierConfidence confidence; -673 -674 /** -675 * Get the value of confidence. -676 * -677 * @return the value of confidence -678 */ -679 public IdentifierConfidence getConfidence() { -680 return confidence; -681 } -682 -683 /** -684 * Set the value of confidence. -685 * -686 * @param confidence new value of confidence -687 */ -688 public void setConfidence(IdentifierConfidence confidence) { -689 this.confidence = confidence; -690 } -691 /** -692 * The CPE identifier. -693 */ -694 private Identifier identifier; -695 -696 /** -697 * Get the value of identifier. -698 * -699 * @return the value of identifier -700 */ -701 public Identifier getIdentifier() { -702 return identifier; -703 } -704 -705 /** -706 * Set the value of identifier. -707 * -708 * @param identifier new value of identifier -709 */ -710 public void setIdentifier(Identifier identifier) { -711 this.identifier = identifier; -712 } -713 //</editor-fold> -714 //<editor-fold defaultstate="collapsed" desc="Standard implementations of toString, hashCode, and equals"> -715 -716 /** -717 * Standard toString() implementation. -718 * -719 * @return the string representation of the object -720 */ -721 @Override -722 public String toString() { -723 return "IdentifierMatch{" + "evidenceConfidence=" + evidenceConfidence -724 + ", confidence=" + confidence + ", identifier=" + identifier + '}'; -725 } -726 -727 /** -728 * Standard hashCode() implementation. -729 * -730 * @return the hashCode -731 */ -732 @Override -733 public int hashCode() { -734 int hash = 5; -735 hash = 97 * hash + (this.evidenceConfidence != null ? this.evidenceConfidence.hashCode() : 0); -736 hash = 97 * hash + (this.confidence != null ? this.confidence.hashCode() : 0); -737 hash = 97 * hash + (this.identifier != null ? this.identifier.hashCode() : 0); -738 return hash; -739 } -740 -741 /** -742 * Standard equals implementation. -743 * -744 * @param obj the object to compare -745 * @return true if the objects are equal, otherwise false -746 */ -747 @Override -748 public boolean equals(Object obj) { -749 if (obj == null) { -750 return false; -751 } -752 if (getClass() != obj.getClass()) { -753 return false; -754 } -755 final IdentifierMatch other = (IdentifierMatch) obj; -756 if (this.evidenceConfidence != other.evidenceConfidence) { -757 return false; -758 } -759 if (this.confidence != other.confidence) { -760 return false; -761 } -762 if (this.identifier != other.identifier && (this.identifier == null || !this.identifier.equals(other.identifier))) { -763 return false; -764 } -765 return true; -766 } -767 //</editor-fold> -768 -769 /** -770 * Standard implementation of compareTo that compares identifier -771 * confidence, evidence confidence, and then the identifier. -772 * -773 * @param o the IdentifierMatch to compare to -774 * @return the natural ordering of IdentifierMatch -775 */ -776 @Override -777 public int compareTo(IdentifierMatch o) { -778 int conf = this.confidence.compareTo(o.confidence); -779 if (conf == 0) { -780 conf = this.evidenceConfidence.compareTo(o.evidenceConfidence); -781 if (conf == 0) { -782 conf = identifier.compareTo(o.identifier); -783 } -784 } -785 return conf; -786 } -787 } -788 } +598 /** +599 * An exact match for the CPE. +600 */ +601 EXACT_MATCH, +602 /** +603 * A best guess for the CPE. +604 */ +605 BEST_GUESS +606 } +607 +608 /** +609 * A simple object to hold an identifier and carry information about the confidence in the identifier. +610 */ +611 private static class IdentifierMatch implements Comparable<IdentifierMatch> { +612 +613 /** +614 * Constructs an IdentifierMatch. +615 * +616 * @param type the type of identifier (such as CPE) +617 * @param value the value of the identifier +618 * @param url the URL of the identifier +619 * @param identifierConfidence the confidence in the identifier: best guess or exact match +620 * @param evidenceConfidence the confidence of the evidence used to find the identifier +621 */ +622 IdentifierMatch(String type, String value, String url, IdentifierConfidence identifierConfidence, Confidence evidenceConfidence) { +623 this.identifier = new Identifier(type, value, url); +624 this.confidence = identifierConfidence; +625 this.evidenceConfidence = evidenceConfidence; +626 } +627 //<editor-fold defaultstate="collapsed" desc="Property implementations: evidenceConfidence, confidence, identifier"> +628 /** +629 * The confidence in the evidence used to identify this match. +630 */ +631 private Confidence evidenceConfidence; +632 +633 /** +634 * Get the value of evidenceConfidence +635 * +636 * @return the value of evidenceConfidence +637 */ +638 public Confidence getEvidenceConfidence() { +639 return evidenceConfidence; +640 } +641 +642 /** +643 * Set the value of evidenceConfidence +644 * +645 * @param evidenceConfidence new value of evidenceConfidence +646 */ +647 public void setEvidenceConfidence(Confidence evidenceConfidence) { +648 this.evidenceConfidence = evidenceConfidence; +649 } +650 /** +651 * The confidence whether this is an exact match, or a best guess. +652 */ +653 private IdentifierConfidence confidence; +654 +655 /** +656 * Get the value of confidence. +657 * +658 * @return the value of confidence +659 */ +660 public IdentifierConfidence getConfidence() { +661 return confidence; +662 } +663 +664 /** +665 * Set the value of confidence. +666 * +667 * @param confidence new value of confidence +668 */ +669 public void setConfidence(IdentifierConfidence confidence) { +670 this.confidence = confidence; +671 } +672 /** +673 * The CPE identifier. +674 */ +675 private Identifier identifier; +676 +677 /** +678 * Get the value of identifier. +679 * +680 * @return the value of identifier +681 */ +682 public Identifier getIdentifier() { +683 return identifier; +684 } +685 +686 /** +687 * Set the value of identifier. +688 * +689 * @param identifier new value of identifier +690 */ +691 public void setIdentifier(Identifier identifier) { +692 this.identifier = identifier; +693 } +694 //</editor-fold> +695 //<editor-fold defaultstate="collapsed" desc="Standard implementations of toString, hashCode, and equals"> +696 +697 /** +698 * Standard toString() implementation. +699 * +700 * @return the string representation of the object +701 */ +702 @Override +703 public String toString() { +704 return "IdentifierMatch{" + "evidenceConfidence=" + evidenceConfidence +705 + ", confidence=" + confidence + ", identifier=" + identifier + '}'; +706 } +707 +708 /** +709 * Standard hashCode() implementation. +710 * +711 * @return the hashCode +712 */ +713 @Override +714 public int hashCode() { +715 int hash = 5; +716 hash = 97 * hash + (this.evidenceConfidence != null ? this.evidenceConfidence.hashCode() : 0); +717 hash = 97 * hash + (this.confidence != null ? this.confidence.hashCode() : 0); +718 hash = 97 * hash + (this.identifier != null ? this.identifier.hashCode() : 0); +719 return hash; +720 } +721 +722 /** +723 * Standard equals implementation. +724 * +725 * @param obj the object to compare +726 * @return true if the objects are equal, otherwise false +727 */ +728 @Override +729 public boolean equals(Object obj) { +730 if (obj == null) { +731 return false; +732 } +733 if (getClass() != obj.getClass()) { +734 return false; +735 } +736 final IdentifierMatch other = (IdentifierMatch) obj; +737 if (this.evidenceConfidence != other.evidenceConfidence) { +738 return false; +739 } +740 if (this.confidence != other.confidence) { +741 return false; +742 } +743 if (this.identifier != other.identifier && (this.identifier == null || !this.identifier.equals(other.identifier))) { +744 return false; +745 } +746 return true; +747 } +748 //</editor-fold> +749 +750 /** +751 * Standard implementation of compareTo that compares identifier confidence, evidence confidence, and then the +752 * identifier. +753 * +754 * @param o the IdentifierMatch to compare to +755 * @return the natural ordering of IdentifierMatch +756 */ +757 @Override +758 public int compareTo(IdentifierMatch o) { +759 int conf = this.confidence.compareTo(o.confidence); +760 if (conf == 0) { +761 conf = this.evidenceConfidence.compareTo(o.evidenceConfidence); +762 if (conf == 0) { +763 conf = identifier.compareTo(o.identifier); +764 } +765 } +766 return conf; +767 } +768 } +769 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/CpeSuppressionAnalyzer.html b/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/CpeSuppressionAnalyzer.html index 5b9baa981..afc86a62b 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/CpeSuppressionAnalyzer.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/CpeSuppressionAnalyzer.html @@ -9,79 +9,77 @@ 1 /* 2 * This file is part of dependency-check-core. 3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2013 Jeremy Long. All Rights Reserved. -18 */ -19 package org.owasp.dependencycheck.analyzer; -20 -21 import org.owasp.dependencycheck.Engine; -22 import org.owasp.dependencycheck.dependency.Dependency; -23 import org.owasp.dependencycheck.suppression.SuppressionRule; -24 -25 /** -26 * The suppression analyzer processes an externally defined XML document that -27 * complies with the suppressions.xsd schema. Any identified CPE entries within -28 * the dependencies that match will be removed. -29 * -30 * @author Jeremy Long <jeremy.long@owasp.org> -31 */ -32 public class CpeSuppressionAnalyzer extends AbstractSuppressionAnalyzer { -33 -34 //<editor-fold defaultstate="collapsed" desc="All standard implmentation details of Analyzer"> -35 /** -36 * The name of the analyzer. -37 */ -38 private static final String ANALYZER_NAME = "Cpe Suppression Analyzer"; -39 /** -40 * The phase that this analyzer is intended to run in. -41 */ -42 private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.POST_IDENTIFIER_ANALYSIS; -43 -44 /** -45 * Returns the name of the analyzer. -46 * -47 * @return the name of the analyzer. -48 */ -49 @Override -50 public String getName() { -51 return ANALYZER_NAME; -52 } -53 -54 /** -55 * Returns the phase that the analyzer is intended to run in. -56 * -57 * @return the phase that the analyzer is intended to run in. -58 */ -59 @Override -60 public AnalysisPhase getAnalysisPhase() { -61 return ANALYSIS_PHASE; -62 } -63 //</editor-fold> -64 -65 @Override -66 public void analyze(final Dependency dependency, final Engine engine) throws AnalysisException { -67 -68 if (getRules() == null || getRules().size() <= 0) { -69 return; -70 } -71 -72 for (final SuppressionRule rule : getRules()) { -73 rule.process(dependency); -74 } -75 } -76 } +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2013 Jeremy Long. All Rights Reserved. +17 */ +18 package org.owasp.dependencycheck.analyzer; +19 +20 import org.owasp.dependencycheck.Engine; +21 import org.owasp.dependencycheck.dependency.Dependency; +22 import org.owasp.dependencycheck.suppression.SuppressionRule; +23 +24 /** +25 * The suppression analyzer processes an externally defined XML document that complies with the suppressions.xsd schema. +26 * Any identified CPE entries within the dependencies that match will be removed. +27 * +28 * @author Jeremy Long <jeremy.long@owasp.org> +29 */ +30 public class CpeSuppressionAnalyzer extends AbstractSuppressionAnalyzer { +31 +32 //<editor-fold defaultstate="collapsed" desc="All standard implmentation details of Analyzer"> +33 /** +34 * The name of the analyzer. +35 */ +36 private static final String ANALYZER_NAME = "Cpe Suppression Analyzer"; +37 /** +38 * The phase that this analyzer is intended to run in. +39 */ +40 private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.POST_IDENTIFIER_ANALYSIS; +41 +42 /** +43 * Returns the name of the analyzer. +44 * +45 * @return the name of the analyzer. +46 */ +47 @Override +48 public String getName() { +49 return ANALYZER_NAME; +50 } +51 +52 /** +53 * Returns the phase that the analyzer is intended to run in. +54 * +55 * @return the phase that the analyzer is intended to run in. +56 */ +57 @Override +58 public AnalysisPhase getAnalysisPhase() { +59 return ANALYSIS_PHASE; +60 } +61 //</editor-fold> +62 +63 @Override +64 public void analyze(final Dependency dependency, final Engine engine) throws AnalysisException { +65 +66 if (getRules() == null || getRules().size() <= 0) { +67 return; +68 } +69 +70 for (final SuppressionRule rule : getRules()) { +71 rule.process(dependency); +72 } +73 } +74 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/DependencyBundlingAnalyzer.html b/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/DependencyBundlingAnalyzer.html index 407d3e125..e4a037a9a 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/DependencyBundlingAnalyzer.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/DependencyBundlingAnalyzer.html @@ -9,339 +9,413 @@ 1 /* 2 * This file is part of dependency-check-core. 3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. -18 */ -19 package org.owasp.dependencycheck.analyzer; -20 -21 import java.io.File; -22 import java.util.HashSet; -23 import java.util.Iterator; -24 import java.util.ListIterator; -25 import java.util.Set; -26 import java.util.logging.Level; -27 import java.util.logging.Logger; -28 import java.util.regex.Matcher; -29 import java.util.regex.Pattern; -30 import org.owasp.dependencycheck.Engine; -31 import org.owasp.dependencycheck.dependency.Dependency; +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. +17 */ +18 package org.owasp.dependencycheck.analyzer; +19 +20 import java.io.File; +21 import java.util.HashSet; +22 import java.util.Iterator; +23 import java.util.ListIterator; +24 import java.util.Set; +25 import java.util.logging.Level; +26 import java.util.logging.Logger; +27 import java.util.regex.Matcher; +28 import java.util.regex.Pattern; +29 import org.owasp.dependencycheck.Engine; +30 import org.owasp.dependencycheck.dependency.Dependency; +31 import org.owasp.dependencycheck.dependency.Identifier; 32 import org.owasp.dependencycheck.utils.DependencyVersion; 33 import org.owasp.dependencycheck.utils.DependencyVersionUtil; 34 import org.owasp.dependencycheck.utils.LogUtils; 35 36 /** -37 * <p>This analyzer ensures dependencies that should be grouped together, to -38 * remove excess noise from the report, are grouped. An example would be Spring, -39 * Spring Beans, Spring MVC, etc. If they are all for the same version and have -40 * the same relative path then these should be grouped into a single dependency -41 * under the core/main library.</p> -42 * <p>Note, this grouping only works on dependencies with identified CVE -43 * entries</p> -44 * -45 * @author Jeremy Long <jeremy.long@owasp.org> -46 */ -47 public class DependencyBundlingAnalyzer extends AbstractAnalyzer implements Analyzer { -48 -49 //<editor-fold defaultstate="collapsed" desc="Constants and Member Variables"> -50 /** -51 * A pattern for obtaining the first part of a filename. -52 */ -53 private static final Pattern STARTING_TEXT_PATTERN = Pattern.compile("^[a-zA-Z]*"); -54 /** -55 * a flag indicating if this analyzer has run. This analyzer only runs once. -56 */ -57 private boolean analyzed = false; -58 //</editor-fold> -59 //<editor-fold defaultstate="collapsed" desc="All standard implementation details of Analyzer"> -60 /** -61 * The set of file extensions supported by this analyzer. -62 */ -63 private static final Set<String> EXTENSIONS = null; -64 /** -65 * The name of the analyzer. -66 */ -67 private static final String ANALYZER_NAME = "Dependency Bundling Analyzer"; -68 /** -69 * The phase that this analyzer is intended to run in. -70 */ -71 private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.PRE_FINDING_ANALYSIS; -72 -73 /** -74 * Returns a list of file EXTENSIONS supported by this analyzer. -75 * -76 * @return a list of file EXTENSIONS supported by this analyzer. -77 */ -78 public Set<String> getSupportedExtensions() { -79 return EXTENSIONS; -80 } -81 -82 /** -83 * Returns the name of the analyzer. -84 * -85 * @return the name of the analyzer. -86 */ -87 public String getName() { -88 return ANALYZER_NAME; -89 } -90 -91 /** -92 * Returns whether or not this analyzer can process the given extension. -93 * -94 * @param extension the file extension to test for support -95 * @return whether or not the specified file extension is supported by this -96 * analyzer. -97 */ -98 public boolean supportsExtension(String extension) { -99 return true; -100 } -101 -102 /** -103 * Returns the phase that the analyzer is intended to run in. -104 * -105 * @return the phase that the analyzer is intended to run in. -106 */ -107 public AnalysisPhase getAnalysisPhase() { -108 return ANALYSIS_PHASE; -109 } -110 //</editor-fold> -111 -112 /** -113 * Analyzes a set of dependencies. If they have been found to have the same -114 * base path and the same set of identifiers they are likely related. The -115 * related dependencies are bundled into a single reportable item. -116 * -117 * @param ignore this analyzer ignores the dependency being analyzed -118 * @param engine the engine that is scanning the dependencies -119 * @throws AnalysisException is thrown if there is an error reading the JAR -120 * file. -121 */ -122 @Override -123 public void analyze(Dependency ignore, Engine engine) throws AnalysisException { -124 if (!analyzed) { -125 analyzed = true; -126 final Set<Dependency> dependenciesToRemove = new HashSet<Dependency>(); -127 final ListIterator<Dependency> mainIterator = engine.getDependencies().listIterator(); -128 //for (Dependency nextDependency : engine.getDependencies()) { -129 while (mainIterator.hasNext()) { -130 final Dependency dependency = mainIterator.next(); -131 if (mainIterator.hasNext()) { -132 final ListIterator<Dependency> subIterator = engine.getDependencies().listIterator(mainIterator.nextIndex()); -133 while (subIterator.hasNext()) { -134 final Dependency nextDependency = subIterator.next(); -135 -136 if (identifiersMatch(dependency, nextDependency) -137 && hasSameBasePath(dependency, nextDependency) -138 && fileNameMatch(dependency, nextDependency)) { -139 -140 if (isCore(dependency, nextDependency)) { -141 dependency.addRelatedDependency(nextDependency); -142 //move any "related dependencies" to the new "parent" dependency -143 final Iterator<Dependency> i = nextDependency.getRelatedDependencies().iterator(); -144 while (i.hasNext()) { -145 dependency.addRelatedDependency(i.next()); -146 i.remove(); -147 } -148 dependenciesToRemove.add(nextDependency); +37 * <p> +38 * This analyzer ensures dependencies that should be grouped together, to remove excess noise from the report, are +39 * grouped. An example would be Spring, Spring Beans, Spring MVC, etc. If they are all for the same version and have the +40 * same relative path then these should be grouped into a single dependency under the core/main library.</p> +41 * <p> +42 * Note, this grouping only works on dependencies with identified CVE entries</p> +43 * +44 * @author Jeremy Long <jeremy.long@owasp.org> +45 */ +46 public class DependencyBundlingAnalyzer extends AbstractAnalyzer implements Analyzer { +47 +48 //<editor-fold defaultstate="collapsed" desc="Constants and Member Variables"> +49 /** +50 * A pattern for obtaining the first part of a filename. +51 */ +52 private static final Pattern STARTING_TEXT_PATTERN = Pattern.compile("^[a-zA-Z]*"); +53 /** +54 * a flag indicating if this analyzer has run. This analyzer only runs once. +55 */ +56 private boolean analyzed = false; +57 //</editor-fold> +58 //<editor-fold defaultstate="collapsed" desc="All standard implementation details of Analyzer"> +59 /** +60 * The set of file extensions supported by this analyzer. +61 */ +62 private static final Set<String> EXTENSIONS = null; +63 /** +64 * The name of the analyzer. +65 */ +66 private static final String ANALYZER_NAME = "Dependency Bundling Analyzer"; +67 /** +68 * The phase that this analyzer is intended to run in. +69 */ +70 private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.PRE_FINDING_ANALYSIS; +71 +72 /** +73 * Returns a list of file EXTENSIONS supported by this analyzer. +74 * +75 * @return a list of file EXTENSIONS supported by this analyzer. +76 */ +77 public Set<String> getSupportedExtensions() { +78 return EXTENSIONS; +79 } +80 +81 /** +82 * Returns the name of the analyzer. +83 * +84 * @return the name of the analyzer. +85 */ +86 public String getName() { +87 return ANALYZER_NAME; +88 } +89 +90 /** +91 * Returns whether or not this analyzer can process the given extension. +92 * +93 * @param extension the file extension to test for support +94 * @return whether or not the specified file extension is supported by this analyzer. +95 */ +96 public boolean supportsExtension(String extension) { +97 return true; +98 } +99 +100 /** +101 * Returns the phase that the analyzer is intended to run in. +102 * +103 * @return the phase that the analyzer is intended to run in. +104 */ +105 public AnalysisPhase getAnalysisPhase() { +106 return ANALYSIS_PHASE; +107 } +108 //</editor-fold> +109 +110 /** +111 * Analyzes a set of dependencies. If they have been found to have the same base path and the same set of +112 * identifiers they are likely related. The related dependencies are bundled into a single reportable item. +113 * +114 * @param ignore this analyzer ignores the dependency being analyzed +115 * @param engine the engine that is scanning the dependencies +116 * @throws AnalysisException is thrown if there is an error reading the JAR file. +117 */ +118 @Override +119 public void analyze(Dependency ignore, Engine engine) throws AnalysisException { +120 if (!analyzed) { +121 analyzed = true; +122 final Set<Dependency> dependenciesToRemove = new HashSet<Dependency>(); +123 final ListIterator<Dependency> mainIterator = engine.getDependencies().listIterator(); +124 //for (Dependency nextDependency : engine.getDependencies()) { +125 while (mainIterator.hasNext()) { +126 final Dependency dependency = mainIterator.next(); +127 if (mainIterator.hasNext()) { +128 final ListIterator<Dependency> subIterator = engine.getDependencies().listIterator(mainIterator.nextIndex()); +129 while (subIterator.hasNext()) { +130 final Dependency nextDependency = subIterator.next(); +131 if (isShadedJar(dependency, nextDependency)) { +132 if (dependency.getFileName().toLowerCase().endsWith("pom.xml")) { +133 dependenciesToRemove.add(dependency); +134 } else { +135 dependenciesToRemove.add(nextDependency); +136 } +137 } else if (hashesMatch(dependency, nextDependency)) { +138 if (isCore(dependency, nextDependency)) { +139 mergeDependencies(dependency, nextDependency, dependenciesToRemove); +140 } else { +141 mergeDependencies(nextDependency, dependency, dependenciesToRemove); +142 } +143 } else if (cpeIdentifiersMatch(dependency, nextDependency) +144 && hasSameBasePath(dependency, nextDependency) +145 && fileNameMatch(dependency, nextDependency)) { +146 +147 if (isCore(dependency, nextDependency)) { +148 mergeDependencies(dependency, nextDependency, dependenciesToRemove); 149 } else { -150 nextDependency.addRelatedDependency(dependency); -151 //move any "related dependencies" to the new "parent" dependency -152 final Iterator<Dependency> i = dependency.getRelatedDependencies().iterator(); -153 while (i.hasNext()) { -154 nextDependency.addRelatedDependency(i.next()); -155 i.remove(); -156 } -157 dependenciesToRemove.add(dependency); -158 } -159 } -160 } -161 } -162 } -163 //removing dependencies here as ensuring correctness and avoiding ConcurrentUpdateExceptions -164 // was difficult because of the inner iterator. -165 for (Dependency d : dependenciesToRemove) { -166 engine.getDependencies().remove(d); -167 } -168 } -169 } -170 -171 /** -172 * Attempts to trim a maven repo to a common base path. This is typically -173 * [drive]\[repo_location]\repository\[path1]\[path2]. -174 * -175 * @param path the path to trim -176 * @return a string representing the base path. -177 */ -178 private String getBaseRepoPath(final String path) { -179 int pos = path.indexOf("repository" + File.separator) + 11; -180 if (pos < 0) { -181 return path; -182 } -183 int tmp = path.indexOf(File.separator, pos); -184 if (tmp <= 0) { -185 return path; -186 } -187 if (tmp > 0) { -188 pos = tmp + 1; -189 } -190 tmp = path.indexOf(File.separator, pos); -191 if (tmp > 0) { -192 pos = tmp + 1; -193 } -194 return path.substring(0, pos); -195 } -196 -197 /** -198 * Returns true if the file names (and version if it exists) of the two -199 * dependencies are sufficiently similar. -200 * -201 * @param dependency1 a dependency2 to compare -202 * @param dependency2 a dependency2 to compare -203 * @return true if the identifiers in the two supplied dependencies are -204 * equal -205 */ -206 private boolean fileNameMatch(Dependency dependency1, Dependency dependency2) { -207 if (dependency1 == null || dependency1.getFileName() == null -208 || dependency2 == null || dependency2.getFileName() == null) { -209 return false; -210 } -211 String fileName1 = dependency1.getFileName(); -212 String fileName2 = dependency2.getFileName(); -213 -214 //update to deal with archive analyzer, the starting name maybe the same -215 // as this is incorrectly looking at the starting path -216 final File one = new File(fileName1); -217 final File two = new File(fileName2); -218 final String oneParent = one.getParent(); -219 final String twoParent = two.getParent(); -220 if (oneParent != null) { -221 if (oneParent.equals(twoParent)) { -222 fileName1 = one.getName(); -223 fileName2 = two.getName(); -224 } else { -225 return false; -226 } -227 } else if (twoParent != null) { -228 return false; -229 } -230 -231 //version check -232 final DependencyVersion version1 = DependencyVersionUtil.parseVersion(fileName1); -233 final DependencyVersion version2 = DependencyVersionUtil.parseVersion(fileName2); -234 if (version1 != null && version2 != null) { -235 if (!version1.equals(version2)) { -236 return false; -237 } -238 } -239 -240 //filename check -241 final Matcher match1 = STARTING_TEXT_PATTERN.matcher(fileName1); -242 final Matcher match2 = STARTING_TEXT_PATTERN.matcher(fileName2); -243 if (match1.find() && match2.find()) { -244 return match1.group().equals(match2.group()); -245 } -246 -247 return false; -248 } +150 mergeDependencies(nextDependency, dependency, dependenciesToRemove); +151 } +152 } +153 } +154 } +155 } +156 //removing dependencies here as ensuring correctness and avoiding ConcurrentUpdateExceptions +157 // was difficult because of the inner iterator. +158 for (Dependency d : dependenciesToRemove) { +159 engine.getDependencies().remove(d); +160 } +161 } +162 } +163 +164 /** +165 * Adds the relatedDependency to the dependency's related dependencies. +166 * +167 * @param dependency the main dependency +168 * @param relatedDependency a collection of dependencies to be removed from the main analysis loop, this is the +169 * source of dependencies to remove +170 * @param dependenciesToRemove a collection of dependencies that will be removed from the main analysis loop, this +171 * function adds to this collection +172 */ +173 private void mergeDependencies(final Dependency dependency, final Dependency relatedDependency, final Set<Dependency> dependenciesToRemove) { +174 dependency.addRelatedDependency(relatedDependency); +175 final Iterator<Dependency> i = relatedDependency.getRelatedDependencies().iterator(); +176 while (i.hasNext()) { +177 dependency.addRelatedDependency(i.next()); +178 i.remove(); +179 } +180 dependenciesToRemove.add(relatedDependency); +181 } +182 +183 /** +184 * Attempts to trim a maven repo to a common base path. This is typically +185 * [drive]\[repo_location]\repository\[path1]\[path2]. +186 * +187 * @param path the path to trim +188 * @return a string representing the base path. +189 */ +190 private String getBaseRepoPath(final String path) { +191 int pos = path.indexOf("repository" + File.separator) + 11; +192 if (pos < 0) { +193 return path; +194 } +195 int tmp = path.indexOf(File.separator, pos); +196 if (tmp <= 0) { +197 return path; +198 } +199 if (tmp > 0) { +200 pos = tmp + 1; +201 } +202 tmp = path.indexOf(File.separator, pos); +203 if (tmp > 0) { +204 pos = tmp + 1; +205 } +206 return path.substring(0, pos); +207 } +208 +209 /** +210 * Returns true if the file names (and version if it exists) of the two dependencies are sufficiently similar. +211 * +212 * @param dependency1 a dependency2 to compare +213 * @param dependency2 a dependency2 to compare +214 * @return true if the identifiers in the two supplied dependencies are equal +215 */ +216 private boolean fileNameMatch(Dependency dependency1, Dependency dependency2) { +217 if (dependency1 == null || dependency1.getFileName() == null +218 || dependency2 == null || dependency2.getFileName() == null) { +219 return false; +220 } +221 String fileName1 = dependency1.getFileName(); +222 String fileName2 = dependency2.getFileName(); +223 +224 //update to deal with archive analyzer, the starting name maybe the same +225 // as this is incorrectly looking at the starting path +226 final File one = new File(fileName1); +227 final File two = new File(fileName2); +228 final String oneParent = one.getParent(); +229 final String twoParent = two.getParent(); +230 if (oneParent != null) { +231 if (oneParent.equals(twoParent)) { +232 fileName1 = one.getName(); +233 fileName2 = two.getName(); +234 } else { +235 return false; +236 } +237 } else if (twoParent != null) { +238 return false; +239 } +240 +241 //version check +242 final DependencyVersion version1 = DependencyVersionUtil.parseVersion(fileName1); +243 final DependencyVersion version2 = DependencyVersionUtil.parseVersion(fileName2); +244 if (version1 != null && version2 != null) { +245 if (!version1.equals(version2)) { +246 return false; +247 } +248 } 249 -250 /** -251 * Returns true if the identifiers in the two supplied dependencies are -252 * equal. -253 * -254 * @param dependency1 a dependency2 to compare -255 * @param dependency2 a dependency2 to compare -256 * @return true if the identifiers in the two supplied dependencies are -257 * equal -258 */ -259 private boolean identifiersMatch(Dependency dependency1, Dependency dependency2) { -260 if (dependency1 == null || dependency1.getIdentifiers() == null -261 || dependency2 == null || dependency2.getIdentifiers() == null) { -262 return false; -263 } -264 final boolean matches = dependency1.getIdentifiers().size() > 0 -265 && dependency2.getIdentifiers().equals(dependency1.getIdentifiers()); -266 if (LogUtils.isVerboseLoggingEnabled()) { -267 final String msg = String.format("IdentifiersMatch=%s (%s, %s)", matches, dependency1.getFileName(), dependency2.getFileName()); -268 Logger.getLogger(DependencyBundlingAnalyzer.class.getName()).log(Level.FINE, msg); -269 } -270 return matches; -271 } -272 -273 /** -274 * Determines if the two dependencies have the same base path. -275 * -276 * @param dependency1 a Dependency object -277 * @param dependency2 a Dependency object -278 * @return true if the base paths of the dependencies are identical -279 */ -280 private boolean hasSameBasePath(Dependency dependency1, Dependency dependency2) { -281 if (dependency1 == null || dependency2 == null) { -282 return false; -283 } -284 final File lFile = new File(dependency1.getFilePath()); -285 String left = lFile.getParent(); -286 final File rFile = new File(dependency2.getFilePath()); -287 String right = rFile.getParent(); -288 if (left == null) { -289 return right == null; -290 } -291 if (left.equalsIgnoreCase(right)) { -292 return true; -293 } -294 if (left.matches(".*[/\\\\]repository[/\\\\].*") && right.matches(".*[/\\\\]repository[/\\\\].*")) { -295 left = getBaseRepoPath(left); -296 right = getBaseRepoPath(right); -297 } -298 return left.equalsIgnoreCase(right); -299 } -300 -301 /** -302 * This is likely a very broken attempt at determining if the 'left' -303 * dependency is the 'core' library in comparison to the 'right' library. -304 * -305 * @param left the dependency to test -306 * @param right the dependency to test against -307 * @return a boolean indicating whether or not the left dependency should be -308 * considered the "core" version. -309 */ -310 private boolean isCore(Dependency left, Dependency right) { -311 final String leftName = left.getFileName().toLowerCase(); -312 final String rightName = right.getFileName().toLowerCase(); -313 final boolean returnVal; -314 if (rightName.contains("core") && !leftName.contains("core")) { -315 returnVal = false; -316 } else if (!rightName.contains("core") && leftName.contains("core")) { -317 returnVal = true; -318 } else { -319 /* -320 * considered splitting the names up and comparing the components, -321 * but decided that the file name length should be sufficient as the -322 * "core" component, if this follows a normal naming protocol should -323 * be shorter: -324 * axis2-saaj-1.4.1.jar -325 * axis2-1.4.1.jar <----- -326 * axis2-kernal-1.4.1.jar -327 */ -328 returnVal = leftName.length() <= rightName.length(); -329 } -330 if (LogUtils.isVerboseLoggingEnabled()) { -331 final String msg = String.format("IsCore=%s (%s, %s)", returnVal, left.getFileName(), right.getFileName()); -332 Logger.getLogger(DependencyBundlingAnalyzer.class.getName()).log(Level.FINE, msg); +250 //filename check +251 final Matcher match1 = STARTING_TEXT_PATTERN.matcher(fileName1); +252 final Matcher match2 = STARTING_TEXT_PATTERN.matcher(fileName2); +253 if (match1.find() && match2.find()) { +254 return match1.group().equals(match2.group()); +255 } +256 +257 return false; +258 } +259 +260 /** +261 * Returns true if the CPE identifiers in the two supplied dependencies are equal. +262 * +263 * @param dependency1 a dependency2 to compare +264 * @param dependency2 a dependency2 to compare +265 * @return true if the identifiers in the two supplied dependencies are equal +266 */ +267 private boolean cpeIdentifiersMatch(Dependency dependency1, Dependency dependency2) { +268 if (dependency1 == null || dependency1.getIdentifiers() == null +269 || dependency2 == null || dependency2.getIdentifiers() == null) { +270 return false; +271 } +272 boolean matches = false; +273 int cpeCount1 = 0; +274 int cpeCount2 = 0; +275 for (Identifier i : dependency1.getIdentifiers()) { +276 if ("cpe".equals(i.getType())) { +277 cpeCount1 += 1; +278 } +279 } +280 for (Identifier i : dependency2.getIdentifiers()) { +281 if ("cpe".equals(i.getType())) { +282 cpeCount2 += 1; +283 } +284 } +285 if (cpeCount1 > 0 && cpeCount1 == cpeCount2) { +286 for (Identifier i : dependency1.getIdentifiers()) { +287 matches |= dependency2.getIdentifiers().contains(i); +288 if (!matches) { +289 break; +290 } +291 } +292 } +293 if (LogUtils.isVerboseLoggingEnabled()) { +294 final String msg = String.format("IdentifiersMatch=%s (%s, %s)", matches, dependency1.getFileName(), dependency2.getFileName()); +295 Logger.getLogger(DependencyBundlingAnalyzer.class.getName()).log(Level.FINE, msg); +296 } +297 return matches; +298 } +299 +300 /** +301 * Determines if the two dependencies have the same base path. +302 * +303 * @param dependency1 a Dependency object +304 * @param dependency2 a Dependency object +305 * @return true if the base paths of the dependencies are identical +306 */ +307 private boolean hasSameBasePath(Dependency dependency1, Dependency dependency2) { +308 if (dependency1 == null || dependency2 == null) { +309 return false; +310 } +311 final File lFile = new File(dependency1.getFilePath()); +312 String left = lFile.getParent(); +313 final File rFile = new File(dependency2.getFilePath()); +314 String right = rFile.getParent(); +315 if (left == null) { +316 return right == null; +317 } +318 if (left.equalsIgnoreCase(right)) { +319 return true; +320 } +321 if (left.matches(".*[/\\\\]repository[/\\\\].*") && right.matches(".*[/\\\\]repository[/\\\\].*")) { +322 left = getBaseRepoPath(left); +323 right = getBaseRepoPath(right); +324 } +325 if (left.equalsIgnoreCase(right)) { +326 return true; +327 } +328 //new code +329 for (Dependency child : dependency2.getRelatedDependencies()) { +330 if (hasSameBasePath(dependency1, child)) { +331 return true; +332 } 333 } -334 return returnVal; +334 return false; 335 } -336 } +336 +337 /** +338 * This is likely a very broken attempt at determining if the 'left' dependency is the 'core' library in comparison +339 * to the 'right' library. +340 * +341 * @param left the dependency to test +342 * @param right the dependency to test against +343 * @return a boolean indicating whether or not the left dependency should be considered the "core" version. +344 */ +345 boolean isCore(Dependency left, Dependency right) { +346 final String leftName = left.getFileName().toLowerCase(); +347 final String rightName = right.getFileName().toLowerCase(); +348 +349 final boolean returnVal; +350 if (!rightName.matches(".*\\.(tar|tgz|gz|zip|ear|war).+") && leftName.matches(".*\\.(tar|tgz|gz|zip|ear|war).+") +351 || rightName.contains("core") && !leftName.contains("core") +352 || rightName.contains("kernel") && !leftName.contains("kernel")) { +353 returnVal = false; +354 } else if (rightName.matches(".*\\.(tar|tgz|gz|zip|ear|war).+") && !leftName.matches(".*\\.(tar|tgz|gz|zip|ear|war).+") +355 || !rightName.contains("core") && leftName.contains("core") +356 || !rightName.contains("kernel") && leftName.contains("kernel")) { +357 returnVal = true; +358 } else { +359 /* +360 * considered splitting the names up and comparing the components, +361 * but decided that the file name length should be sufficient as the +362 * "core" component, if this follows a normal naming protocol should +363 * be shorter: +364 * axis2-saaj-1.4.1.jar +365 * axis2-1.4.1.jar <----- +366 * axis2-kernal-1.4.1.jar +367 */ +368 returnVal = leftName.length() <= rightName.length(); +369 } +370 if (LogUtils.isVerboseLoggingEnabled()) { +371 final String msg = String.format("IsCore=%s (%s, %s)", returnVal, left.getFileName(), right.getFileName()); +372 Logger.getLogger(DependencyBundlingAnalyzer.class.getName()).log(Level.FINE, msg); +373 } +374 return returnVal; +375 } +376 +377 /** +378 * Compares the SHA1 hashes of two dependencies to determine if they are equal. +379 * +380 * @param dependency1 a dependency object to compare +381 * @param dependency2 a dependency object to compare +382 * @return true if the sha1 hashes of the two dependencies match; otherwise false +383 */ +384 private boolean hashesMatch(Dependency dependency1, Dependency dependency2) { +385 if (dependency1 == null || dependency2 == null || dependency1.getSha1sum() == null || dependency2.getSha1sum() == null) { +386 return false; +387 } +388 return dependency1.getSha1sum().equals(dependency2.getSha1sum()); +389 } +390 +391 /** +392 * Determines if the jar is shaded and the created pom.xml identified the same CPE as the jar - if so, the pom.xml +393 * dependency should be removed. +394 * +395 * @param dependency a dependency to check +396 * @param nextDependency another dependency to check +397 * @return true if on of the dependencies is a pom.xml and the identifiers between the two collections match; +398 * otherwise false +399 */ +400 private boolean isShadedJar(Dependency dependency, Dependency nextDependency) { +401 final String mainName = dependency.getFileName().toLowerCase(); +402 final String nextName = nextDependency.getFileName().toLowerCase(); +403 if (mainName.endsWith(".jar") && nextName.endsWith("pom.xml")) { +404 return dependency.getIdentifiers().containsAll(nextDependency.getIdentifiers()); +405 } else if (nextName.endsWith(".jar") && mainName.endsWith("pom.xml")) { +406 return nextDependency.getIdentifiers().containsAll(dependency.getIdentifiers()); +407 } +408 return false; +409 } +410 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/FalsePositiveAnalyzer.html b/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/FalsePositiveAnalyzer.html index 39395c479..34f264e44 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/FalsePositiveAnalyzer.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/FalsePositiveAnalyzer.html @@ -9,374 +9,365 @@ 1 /* 2 * This file is part of dependency-check-core. 3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. -18 */ -19 package org.owasp.dependencycheck.analyzer; -20 -21 import java.io.UnsupportedEncodingException; -22 import java.net.URLEncoder; -23 import java.util.ArrayList; -24 import java.util.Collections; -25 import java.util.Iterator; -26 import java.util.List; -27 import java.util.ListIterator; -28 import java.util.Set; -29 import java.util.logging.Level; -30 import java.util.logging.Logger; -31 import java.util.regex.Matcher; -32 import java.util.regex.Pattern; -33 import org.owasp.dependencycheck.Engine; -34 import org.owasp.dependencycheck.dependency.Dependency; -35 import org.owasp.dependencycheck.dependency.Identifier; -36 import org.owasp.dependencycheck.dependency.VulnerableSoftware; -37 -38 /** -39 * This analyzer attempts to remove some well known false positives - -40 * specifically regarding the java runtime. -41 * -42 * @author Jeremy Long <jeremy.long@owasp.org> -43 */ -44 public class FalsePositiveAnalyzer extends AbstractAnalyzer { -45 -46 //<editor-fold defaultstate="collapsed" desc="All standard implmentation details of Analyzer"> -47 /** -48 * The set of file extensions supported by this analyzer. -49 */ -50 private static final Set<String> EXTENSIONS = null; -51 /** -52 * The name of the analyzer. -53 */ -54 private static final String ANALYZER_NAME = "False Positive Analyzer"; -55 /** -56 * The phase that this analyzer is intended to run in. -57 */ -58 private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.POST_IDENTIFIER_ANALYSIS; -59 -60 /** -61 * Returns a list of file EXTENSIONS supported by this analyzer. -62 * -63 * @return a list of file EXTENSIONS supported by this analyzer. -64 */ -65 public Set<String> getSupportedExtensions() { -66 return EXTENSIONS; -67 } -68 -69 /** -70 * Returns the name of the analyzer. -71 * -72 * @return the name of the analyzer. -73 */ -74 public String getName() { -75 return ANALYZER_NAME; -76 } -77 -78 /** -79 * Returns whether or not this analyzer can process the given extension. -80 * -81 * @param extension the file extension to test for support -82 * @return whether or not the specified file extension is supported by this -83 * analyzer. -84 */ -85 public boolean supportsExtension(String extension) { -86 return true; -87 } -88 -89 /** -90 * Returns the phase that the analyzer is intended to run in. -91 * -92 * @return the phase that the analyzer is intended to run in. -93 */ -94 public AnalysisPhase getAnalysisPhase() { -95 return ANALYSIS_PHASE; -96 } -97 //</editor-fold> -98 -99 /** -100 * Analyzes the dependencies and removes bad/incorrect CPE associations -101 * based on various heuristics. -102 * -103 * @param dependency the dependency to analyze. -104 * @param engine the engine that is scanning the dependencies -105 * @throws AnalysisException is thrown if there is an error reading the JAR -106 * file. -107 */ -108 @Override -109 public void analyze(Dependency dependency, Engine engine) throws AnalysisException { -110 removeJreEntries(dependency); -111 removeBadMatches(dependency); -112 removeWrongVersionMatches(dependency); -113 removeSpuriousCPE(dependency); -114 addFalseNegativeCPEs(dependency); -115 } -116 -117 /** -118 * <p>Intended to remove spurious CPE entries. By spurious we mean -119 * duplicate, less specific CPE entries.</p> -120 * <p>Example:</p> -121 * <code> -122 * cpe:/a:some-vendor:some-product -123 * cpe:/a:some-vendor:some-product:1.5 -124 * cpe:/a:some-vendor:some-product:1.5.2 -125 * </code> -126 * <p>Should be trimmed to:</p> -127 * <code> -128 * cpe:/a:some-vendor:some-product:1.5.2 -129 * </code> -130 * -131 * @param dependency the dependency being analyzed -132 */ -133 @SuppressWarnings("null") -134 private void removeSpuriousCPE(Dependency dependency) { -135 final List<Identifier> ids = new ArrayList<Identifier>(); -136 ids.addAll(dependency.getIdentifiers()); -137 Collections.sort(ids); -138 final ListIterator<Identifier> mainItr = ids.listIterator(); -139 while (mainItr.hasNext()) { -140 final Identifier currentId = mainItr.next(); -141 final VulnerableSoftware currentCpe = parseCpe(currentId.getType(), currentId.getValue()); -142 if (currentCpe == null) { -143 continue; -144 } -145 final ListIterator<Identifier> subItr = ids.listIterator(mainItr.nextIndex()); -146 while (subItr.hasNext()) { -147 final Identifier nextId = subItr.next(); -148 final VulnerableSoftware nextCpe = parseCpe(nextId.getType(), nextId.getValue()); -149 if (nextCpe == null) { -150 continue; -151 } -152 //TODO fix the version problem below -153 if (currentCpe.getVendor().equals(nextCpe.getVendor())) { -154 if (currentCpe.getProduct().equals(nextCpe.getProduct())) { -155 // see if one is contained in the other.. remove the contained one from dependency.getIdentifier -156 final String currentVersion = currentCpe.getVersion(); -157 final String nextVersion = nextCpe.getVersion(); -158 if (currentVersion == null && nextVersion == null) { -159 //how did we get here? -160 Logger.getLogger(FalsePositiveAnalyzer.class -161 .getName()).log(Level.FINE, "currentVersion and nextVersion are both null?"); -162 } else if (currentVersion == null && nextVersion != null) { -163 dependency.getIdentifiers().remove(currentId); -164 } else if (nextVersion == null && currentVersion != null) { -165 dependency.getIdentifiers().remove(nextId); -166 } else if (currentVersion.length() < nextVersion.length()) { -167 if (nextVersion.startsWith(currentVersion) || "-".equals(currentVersion)) { -168 dependency.getIdentifiers().remove(currentId); -169 } -170 } else { -171 if (currentVersion.startsWith(nextVersion) || "-".equals(nextVersion)) { -172 dependency.getIdentifiers().remove(nextId); -173 } -174 } -175 } -176 } -177 } -178 } -179 } -180 /** -181 * Regex to identify core java libraries and a few other commonly -182 * misidentified ones. -183 */ -184 public static final Pattern CORE_JAVA = Pattern.compile("^cpe:/a:(sun|oracle|ibm):(j2[ems]e|" -185 + "java(_platfrom_micro_edition|_runtime_environment|_se|virtual_machine|se_development_kit|fx)?|" -186 + "jdk|jre|jsf|jsse)($|:.*)"); -187 /** -188 * Regex to identify core java library files. This is currently incomplete. -189 */ -190 public static final Pattern CORE_FILES = Pattern.compile("^((alt[-])?rt|jsf[-].*|jsse|jfxrt|jfr|jce|javaws|deploy|charsets)\\.jar$"); -191 -192 /** -193 * Removes any CPE entries for the JDK/JRE unless the filename ends with -194 * rt.jar -195 * -196 * @param dependency the dependency to remove JRE CPEs from -197 */ -198 private void removeJreEntries(Dependency dependency) { -199 final Set<Identifier> identifiers = dependency.getIdentifiers(); -200 final Iterator<Identifier> itr = identifiers.iterator(); -201 while (itr.hasNext()) { -202 final Identifier i = itr.next(); -203 final Matcher coreCPE = CORE_JAVA.matcher(i.getValue()); -204 final Matcher coreFiles = CORE_FILES.matcher(dependency.getFileName()); -205 if (coreCPE.matches() && !coreFiles.matches()) { -206 itr.remove(); -207 } -208 -209 //replacecd with the regex above. -210 // if (("cpe:/a:sun:java".equals(i.getValue()) -211 // || "cpe:/a:oracle:java".equals(i.getValue()) -212 // || "cpe:/a:ibm:java".equals(i.getValue()) -213 // || "cpe:/a:sun:j2se".equals(i.getValue()) -214 // || "cpe:/a:oracle:j2se".equals(i.getValue()) -215 // || i.getValue().startsWith("cpe:/a:sun:java:") -216 // || i.getValue().startsWith("cpe:/a:sun:j2se:") -217 // || i.getValue().startsWith("cpe:/a:sun:java:jre") -218 // || i.getValue().startsWith("cpe:/a:sun:java:jdk") -219 // || i.getValue().startsWith("cpe:/a:sun:java_se") -220 // || i.getValue().startsWith("cpe:/a:oracle:java_se") -221 // || i.getValue().startsWith("cpe:/a:oracle:java:") -222 // || i.getValue().startsWith("cpe:/a:oracle:j2se:") -223 // || i.getValue().startsWith("cpe:/a:oracle:jre") -224 // || i.getValue().startsWith("cpe:/a:oracle:jdk") -225 // || i.getValue().startsWith("cpe:/a:ibm:java:")) -226 // && !dependency.getFileName().toLowerCase().endsWith("rt.jar")) { -227 // itr.remove(); -228 // } -229 } -230 } -231 -232 /** -233 * Parses a CPE string into an IndexEntry. -234 * -235 * @param type the type of identifier -236 * @param value the cpe identifier to parse -237 * @return an VulnerableSoftware object constructed from the identifier -238 */ -239 private VulnerableSoftware parseCpe(String type, String value) { -240 if (!"cpe".equals(type)) { -241 return null; -242 } -243 final VulnerableSoftware cpe = new VulnerableSoftware(); -244 try { -245 cpe.parseName(value); -246 } catch (UnsupportedEncodingException ex) { -247 Logger.getLogger(FalsePositiveAnalyzer.class.getName()).log(Level.FINEST, null, ex); -248 return null; -249 } -250 return cpe; -251 } -252 -253 /** -254 * Removes bad CPE matches for a dependency. Unfortunately, right now these -255 * are hard-coded patches for specific problems identified when testing this -256 * on a LARGE volume of jar files. -257 * -258 * @param dependency the dependency to analyze -259 */ -260 private void removeBadMatches(Dependency dependency) { -261 final Set<Identifier> identifiers = dependency.getIdentifiers(); -262 final Iterator<Identifier> itr = identifiers.iterator(); -263 -264 /* TODO - can we utilize the pom's groupid and artifactId to filter??? most of -265 * these are due to low quality data. Other idea would be to say any CPE -266 * found based on LOW confidence evidence should have a different CPE type? (this -267 * might be a better solution then just removing the URL for "best-guess" matches). -268 */ -269 -270 //Set<Evidence> groupId = dependency.getVendorEvidence().getEvidence("pom", "groupid"); -271 //Set<Evidence> artifactId = dependency.getVendorEvidence().getEvidence("pom", "artifactid"); -272 -273 while (itr.hasNext()) { -274 final Identifier i = itr.next(); -275 //TODO move this startswith expression to a configuration file? -276 if ("cpe".equals(i.getType())) { -277 if ((i.getValue().matches(".*c\\+\\+.*") -278 || i.getValue().startsWith("cpe:/a:jquery:jquery") -279 || i.getValue().startsWith("cpe:/a:prototypejs:prototype") -280 || i.getValue().startsWith("cpe:/a:yahoo:yui") -281 || i.getValue().startsWith("cpe:/a:file:file") -282 || i.getValue().startsWith("cpe:/a:mozilla:mozilla") -283 || i.getValue().startsWith("cpe:/a:cvs:cvs") -284 || i.getValue().startsWith("cpe:/a:ftp:ftp") -285 || i.getValue().startsWith("cpe:/a:ssh:ssh")) -286 && dependency.getFileName().toLowerCase().endsWith(".jar")) { -287 itr.remove(); -288 } else if (i.getValue().startsWith("cpe:/a:apache:maven") -289 && !dependency.getFileName().toLowerCase().matches("maven-core-[\\d\\.]+\\.jar")) { -290 itr.remove(); -291 } -292 } -293 } -294 } -295 -296 /** -297 * Removes CPE matches for the wrong version of a dependency. Currently, -298 * this only covers Axis 1 & 2. -299 * -300 * @param dependency the dependency to analyze -301 */ -302 private void removeWrongVersionMatches(Dependency dependency) { -303 final Set<Identifier> identifiers = dependency.getIdentifiers(); -304 final Iterator<Identifier> itr = identifiers.iterator(); -305 -306 final String fileName = dependency.getFileName(); -307 if (fileName != null && fileName.contains("axis2")) { -308 while (itr.hasNext()) { -309 final Identifier i = itr.next(); -310 if ("cpe".equals(i.getType())) { -311 final String cpe = i.getValue(); -312 if (cpe != null && (cpe.startsWith("cpe:/a:apache:axis:") || "cpe:/a:apache:axis".equals(cpe))) { -313 itr.remove(); -314 } -315 } -316 } -317 } else if (fileName != null && fileName.contains("axis")) { -318 while (itr.hasNext()) { -319 final Identifier i = itr.next(); -320 if ("cpe".equals(i.getType())) { -321 final String cpe = i.getValue(); -322 if (cpe != null && (cpe.startsWith("cpe:/a:apache:axis2:") || "cpe:/a:apache:axis2".equals(cpe))) { -323 itr.remove(); -324 } -325 } -326 } -327 } -328 } -329 -330 /** -331 * There are some known CPE entries, specifically regarding sun and oracle -332 * products due to the acquisition and changes in product names, that based -333 * on given evidence we can add the related CPE entries to ensure a complete -334 * list of CVE entries. -335 * -336 * @param dependency the dependency being analyzed -337 */ -338 private void addFalseNegativeCPEs(Dependency dependency) { -339 final Iterator<Identifier> itr = dependency.getIdentifiers().iterator(); -340 while (itr.hasNext()) { -341 final Identifier i = itr.next(); -342 if ("cpe".equals(i.getType()) && i.getValue() != null -343 && (i.getValue().startsWith("cpe:/a:oracle:opensso:") -344 || i.getValue().startsWith("cpe:/a:oracle:opensso_enterprise:") -345 || i.getValue().startsWith("cpe:/a:sun:opensso_enterprise:") -346 || i.getValue().startsWith("cpe:/a:sun:opensso:"))) { -347 final String newCpe = String.format("cpe:/a:sun:opensso_enterprise:%s", i.getValue().substring(22)); -348 final String newCpe2 = String.format("cpe:/a:oracle:opensso_enterprise:%s", i.getValue().substring(22)); -349 final String newCpe3 = String.format("cpe:/a:sun:opensso:%s", i.getValue().substring(22)); -350 final String newCpe4 = String.format("cpe:/a:oracle:opensso:%s", i.getValue().substring(22)); -351 try { +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. +17 */ +18 package org.owasp.dependencycheck.analyzer; +19 +20 import java.io.UnsupportedEncodingException; +21 import java.net.URLEncoder; +22 import java.util.ArrayList; +23 import java.util.Collections; +24 import java.util.Iterator; +25 import java.util.List; +26 import java.util.ListIterator; +27 import java.util.Set; +28 import java.util.logging.Level; +29 import java.util.logging.Logger; +30 import java.util.regex.Matcher; +31 import java.util.regex.Pattern; +32 import org.owasp.dependencycheck.Engine; +33 import org.owasp.dependencycheck.dependency.Dependency; +34 import org.owasp.dependencycheck.dependency.Identifier; +35 import org.owasp.dependencycheck.dependency.VulnerableSoftware; +36 +37 /** +38 * This analyzer attempts to remove some well known false positives - specifically regarding the java runtime. +39 * +40 * @author Jeremy Long <jeremy.long@owasp.org> +41 */ +42 public class FalsePositiveAnalyzer extends AbstractAnalyzer { +43 +44 //<editor-fold defaultstate="collapsed" desc="All standard implmentation details of Analyzer"> +45 /** +46 * The set of file extensions supported by this analyzer. +47 */ +48 private static final Set<String> EXTENSIONS = null; +49 /** +50 * The name of the analyzer. +51 */ +52 private static final String ANALYZER_NAME = "False Positive Analyzer"; +53 /** +54 * The phase that this analyzer is intended to run in. +55 */ +56 private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.POST_IDENTIFIER_ANALYSIS; +57 +58 /** +59 * Returns a list of file EXTENSIONS supported by this analyzer. +60 * +61 * @return a list of file EXTENSIONS supported by this analyzer. +62 */ +63 public Set<String> getSupportedExtensions() { +64 return EXTENSIONS; +65 } +66 +67 /** +68 * Returns the name of the analyzer. +69 * +70 * @return the name of the analyzer. +71 */ +72 public String getName() { +73 return ANALYZER_NAME; +74 } +75 +76 /** +77 * Returns whether or not this analyzer can process the given extension. +78 * +79 * @param extension the file extension to test for support +80 * @return whether or not the specified file extension is supported by this analyzer. +81 */ +82 public boolean supportsExtension(String extension) { +83 return true; +84 } +85 +86 /** +87 * Returns the phase that the analyzer is intended to run in. +88 * +89 * @return the phase that the analyzer is intended to run in. +90 */ +91 public AnalysisPhase getAnalysisPhase() { +92 return ANALYSIS_PHASE; +93 } +94 //</editor-fold> +95 +96 /** +97 * Analyzes the dependencies and removes bad/incorrect CPE associations based on various heuristics. +98 * +99 * @param dependency the dependency to analyze. +100 * @param engine the engine that is scanning the dependencies +101 * @throws AnalysisException is thrown if there is an error reading the JAR file. +102 */ +103 @Override +104 public void analyze(Dependency dependency, Engine engine) throws AnalysisException { +105 removeJreEntries(dependency); +106 removeBadMatches(dependency); +107 removeWrongVersionMatches(dependency); +108 removeSpuriousCPE(dependency); +109 addFalseNegativeCPEs(dependency); +110 } +111 +112 /** +113 * <p> +114 * Intended to remove spurious CPE entries. By spurious we mean duplicate, less specific CPE entries.</p> +115 * <p> +116 * Example:</p> +117 * <code> +118 * cpe:/a:some-vendor:some-product +119 * cpe:/a:some-vendor:some-product:1.5 +120 * cpe:/a:some-vendor:some-product:1.5.2 +121 * </code> +122 * <p> +123 * Should be trimmed to:</p> +124 * <code> +125 * cpe:/a:some-vendor:some-product:1.5.2 +126 * </code> +127 * +128 * @param dependency the dependency being analyzed +129 */ +130 @SuppressWarnings("null") +131 private void removeSpuriousCPE(Dependency dependency) { +132 final List<Identifier> ids = new ArrayList<Identifier>(); +133 ids.addAll(dependency.getIdentifiers()); +134 Collections.sort(ids); +135 final ListIterator<Identifier> mainItr = ids.listIterator(); +136 while (mainItr.hasNext()) { +137 final Identifier currentId = mainItr.next(); +138 final VulnerableSoftware currentCpe = parseCpe(currentId.getType(), currentId.getValue()); +139 if (currentCpe == null) { +140 continue; +141 } +142 final ListIterator<Identifier> subItr = ids.listIterator(mainItr.nextIndex()); +143 while (subItr.hasNext()) { +144 final Identifier nextId = subItr.next(); +145 final VulnerableSoftware nextCpe = parseCpe(nextId.getType(), nextId.getValue()); +146 if (nextCpe == null) { +147 continue; +148 } +149 //TODO fix the version problem below +150 if (currentCpe.getVendor().equals(nextCpe.getVendor())) { +151 if (currentCpe.getProduct().equals(nextCpe.getProduct())) { +152 // see if one is contained in the other.. remove the contained one from dependency.getIdentifier +153 final String currentVersion = currentCpe.getVersion(); +154 final String nextVersion = nextCpe.getVersion(); +155 if (currentVersion == null && nextVersion == null) { +156 //how did we get here? +157 Logger.getLogger(FalsePositiveAnalyzer.class +158 .getName()).log(Level.FINE, "currentVersion and nextVersion are both null?"); +159 } else if (currentVersion == null && nextVersion != null) { +160 dependency.getIdentifiers().remove(currentId); +161 } else if (nextVersion == null && currentVersion != null) { +162 dependency.getIdentifiers().remove(nextId); +163 } else if (currentVersion.length() < nextVersion.length()) { +164 if (nextVersion.startsWith(currentVersion) || "-".equals(currentVersion)) { +165 dependency.getIdentifiers().remove(currentId); +166 } +167 } else { +168 if (currentVersion.startsWith(nextVersion) || "-".equals(nextVersion)) { +169 dependency.getIdentifiers().remove(nextId); +170 } +171 } +172 } +173 } +174 } +175 } +176 } +177 /** +178 * Regex to identify core java libraries and a few other commonly misidentified ones. +179 */ +180 public static final Pattern CORE_JAVA = Pattern.compile("^cpe:/a:(sun|oracle|ibm):(j2[ems]e|" +181 + "java(_platfrom_micro_edition|_runtime_environment|_se|virtual_machine|se_development_kit|fx)?|" +182 + "jdk|jre|jsf|jsse)($|:.*)"); +183 /** +184 * Regex to identify core java library files. This is currently incomplete. +185 */ +186 public static final Pattern CORE_FILES = Pattern.compile("^((alt[-])?rt|jsf[-].*|jsse|jfxrt|jfr|jce|javaws|deploy|charsets)\\.jar$"); +187 +188 /** +189 * Removes any CPE entries for the JDK/JRE unless the filename ends with rt.jar +190 * +191 * @param dependency the dependency to remove JRE CPEs from +192 */ +193 private void removeJreEntries(Dependency dependency) { +194 final Set<Identifier> identifiers = dependency.getIdentifiers(); +195 final Iterator<Identifier> itr = identifiers.iterator(); +196 while (itr.hasNext()) { +197 final Identifier i = itr.next(); +198 final Matcher coreCPE = CORE_JAVA.matcher(i.getValue()); +199 final Matcher coreFiles = CORE_FILES.matcher(dependency.getFileName()); +200 if (coreCPE.matches() && !coreFiles.matches()) { +201 itr.remove(); +202 } +203 +204 //replacecd with the regex above. +205 // if (("cpe:/a:sun:java".equals(i.getValue()) +206 // || "cpe:/a:oracle:java".equals(i.getValue()) +207 // || "cpe:/a:ibm:java".equals(i.getValue()) +208 // || "cpe:/a:sun:j2se".equals(i.getValue()) +209 // || "cpe:/a:oracle:j2se".equals(i.getValue()) +210 // || i.getValue().startsWith("cpe:/a:sun:java:") +211 // || i.getValue().startsWith("cpe:/a:sun:j2se:") +212 // || i.getValue().startsWith("cpe:/a:sun:java:jre") +213 // || i.getValue().startsWith("cpe:/a:sun:java:jdk") +214 // || i.getValue().startsWith("cpe:/a:sun:java_se") +215 // || i.getValue().startsWith("cpe:/a:oracle:java_se") +216 // || i.getValue().startsWith("cpe:/a:oracle:java:") +217 // || i.getValue().startsWith("cpe:/a:oracle:j2se:") +218 // || i.getValue().startsWith("cpe:/a:oracle:jre") +219 // || i.getValue().startsWith("cpe:/a:oracle:jdk") +220 // || i.getValue().startsWith("cpe:/a:ibm:java:")) +221 // && !dependency.getFileName().toLowerCase().endsWith("rt.jar")) { +222 // itr.remove(); +223 // } +224 } +225 } +226 +227 /** +228 * Parses a CPE string into an IndexEntry. +229 * +230 * @param type the type of identifier +231 * @param value the cpe identifier to parse +232 * @return an VulnerableSoftware object constructed from the identifier +233 */ +234 private VulnerableSoftware parseCpe(String type, String value) { +235 if (!"cpe".equals(type)) { +236 return null; +237 } +238 final VulnerableSoftware cpe = new VulnerableSoftware(); +239 try { +240 cpe.parseName(value); +241 } catch (UnsupportedEncodingException ex) { +242 Logger.getLogger(FalsePositiveAnalyzer.class.getName()).log(Level.FINEST, null, ex); +243 return null; +244 } +245 return cpe; +246 } +247 +248 /** +249 * Removes bad CPE matches for a dependency. Unfortunately, right now these are hard-coded patches for specific +250 * problems identified when testing this on a LARGE volume of jar files. +251 * +252 * @param dependency the dependency to analyze +253 */ +254 private void removeBadMatches(Dependency dependency) { +255 final Set<Identifier> identifiers = dependency.getIdentifiers(); +256 final Iterator<Identifier> itr = identifiers.iterator(); +257 +258 /* TODO - can we utilize the pom's groupid and artifactId to filter??? most of +259 * these are due to low quality data. Other idea would be to say any CPE +260 * found based on LOW confidence evidence should have a different CPE type? (this +261 * might be a better solution then just removing the URL for "best-guess" matches). +262 */ +263 //Set<Evidence> groupId = dependency.getVendorEvidence().getEvidence("pom", "groupid"); +264 //Set<Evidence> artifactId = dependency.getVendorEvidence().getEvidence("pom", "artifactid"); +265 while (itr.hasNext()) { +266 final Identifier i = itr.next(); +267 //TODO move this startswith expression to a configuration file? +268 if ("cpe".equals(i.getType())) { +269 if ((i.getValue().matches(".*c\\+\\+.*") +270 || i.getValue().startsWith("cpe:/a:jquery:jquery") +271 || i.getValue().startsWith("cpe:/a:prototypejs:prototype") +272 || i.getValue().startsWith("cpe:/a:yahoo:yui") +273 || i.getValue().startsWith("cpe:/a:file:file") +274 || i.getValue().startsWith("cpe:/a:mozilla:mozilla") +275 || i.getValue().startsWith("cpe:/a:cvs:cvs") +276 || i.getValue().startsWith("cpe:/a:ftp:ftp") +277 || i.getValue().startsWith("cpe:/a:ssh:ssh")) +278 && (dependency.getFileName().toLowerCase().endsWith(".jar") +279 || dependency.getFileName().toLowerCase().endsWith("pom.xml"))) { +280 itr.remove(); +281 } else if (i.getValue().startsWith("cpe:/a:apache:maven") +282 && !dependency.getFileName().toLowerCase().matches("maven-core-[\\d\\.]+\\.jar")) { +283 itr.remove(); +284 } +285 } +286 } +287 } +288 +289 /** +290 * Removes CPE matches for the wrong version of a dependency. Currently, this only covers Axis 1 & 2. +291 * +292 * @param dependency the dependency to analyze +293 */ +294 private void removeWrongVersionMatches(Dependency dependency) { +295 final Set<Identifier> identifiers = dependency.getIdentifiers(); +296 final Iterator<Identifier> itr = identifiers.iterator(); +297 +298 final String fileName = dependency.getFileName(); +299 if (fileName != null && fileName.contains("axis2")) { +300 while (itr.hasNext()) { +301 final Identifier i = itr.next(); +302 if ("cpe".equals(i.getType())) { +303 final String cpe = i.getValue(); +304 if (cpe != null && (cpe.startsWith("cpe:/a:apache:axis:") || "cpe:/a:apache:axis".equals(cpe))) { +305 itr.remove(); +306 } +307 } +308 } +309 } else if (fileName != null && fileName.contains("axis")) { +310 while (itr.hasNext()) { +311 final Identifier i = itr.next(); +312 if ("cpe".equals(i.getType())) { +313 final String cpe = i.getValue(); +314 if (cpe != null && (cpe.startsWith("cpe:/a:apache:axis2:") || "cpe:/a:apache:axis2".equals(cpe))) { +315 itr.remove(); +316 } +317 } +318 } +319 } +320 } +321 +322 /** +323 * There are some known CPE entries, specifically regarding sun and oracle products due to the acquisition and +324 * changes in product names, that based on given evidence we can add the related CPE entries to ensure a complete +325 * list of CVE entries. +326 * +327 * @param dependency the dependency being analyzed +328 */ +329 private void addFalseNegativeCPEs(Dependency dependency) { +330 final Iterator<Identifier> itr = dependency.getIdentifiers().iterator(); +331 while (itr.hasNext()) { +332 final Identifier i = itr.next(); +333 if ("cpe".equals(i.getType()) && i.getValue() != null +334 && (i.getValue().startsWith("cpe:/a:oracle:opensso:") +335 || i.getValue().startsWith("cpe:/a:oracle:opensso_enterprise:") +336 || i.getValue().startsWith("cpe:/a:sun:opensso_enterprise:") +337 || i.getValue().startsWith("cpe:/a:sun:opensso:"))) { +338 final String newCpe = String.format("cpe:/a:sun:opensso_enterprise:%s", i.getValue().substring(22)); +339 final String newCpe2 = String.format("cpe:/a:oracle:opensso_enterprise:%s", i.getValue().substring(22)); +340 final String newCpe3 = String.format("cpe:/a:sun:opensso:%s", i.getValue().substring(22)); +341 final String newCpe4 = String.format("cpe:/a:oracle:opensso:%s", i.getValue().substring(22)); +342 try { +343 dependency.addIdentifier("cpe", +344 newCpe, +345 String.format("http://web.nvd.nist.gov/view/vuln/search?cpe=%s", URLEncoder.encode(newCpe, "UTF-8"))); +346 dependency.addIdentifier("cpe", +347 newCpe2, +348 String.format("http://web.nvd.nist.gov/view/vuln/search?cpe=%s", URLEncoder.encode(newCpe2, "UTF-8"))); +349 dependency.addIdentifier("cpe", +350 newCpe3, +351 String.format("http://web.nvd.nist.gov/view/vuln/search?cpe=%s", URLEncoder.encode(newCpe3, "UTF-8"))); 352 dependency.addIdentifier("cpe", -353 newCpe, -354 String.format("http://web.nvd.nist.gov/view/vuln/search?cpe=%s", URLEncoder.encode(newCpe, "UTF-8"))); -355 dependency.addIdentifier("cpe", -356 newCpe2, -357 String.format("http://web.nvd.nist.gov/view/vuln/search?cpe=%s", URLEncoder.encode(newCpe2, "UTF-8"))); -358 dependency.addIdentifier("cpe", -359 newCpe3, -360 String.format("http://web.nvd.nist.gov/view/vuln/search?cpe=%s", URLEncoder.encode(newCpe3, "UTF-8"))); -361 dependency.addIdentifier("cpe", -362 newCpe4, -363 String.format("http://web.nvd.nist.gov/view/vuln/search?cpe=%s", URLEncoder.encode(newCpe4, "UTF-8"))); -364 } catch (UnsupportedEncodingException ex) { -365 Logger.getLogger(FalsePositiveAnalyzer.class -366 .getName()).log(Level.FINE, null, ex); -367 } -368 } -369 } -370 } -371 } +353 newCpe4, +354 String.format("http://web.nvd.nist.gov/view/vuln/search?cpe=%s", URLEncoder.encode(newCpe4, "UTF-8"))); +355 } catch (UnsupportedEncodingException ex) { +356 Logger.getLogger(FalsePositiveAnalyzer.class +357 .getName()).log(Level.FINE, null, ex); +358 } +359 } +360 } +361 } +362 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/FileNameAnalyzer.html b/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/FileNameAnalyzer.html index 03947acc3..c3e8f95f8 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/FileNameAnalyzer.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/FileNameAnalyzer.html @@ -9,136 +9,141 @@ 1 /* 2 * This file is part of dependency-check-core. 3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. -18 */ -19 package org.owasp.dependencycheck.analyzer; -20 -21 import java.io.File; -22 import org.owasp.dependencycheck.dependency.Dependency; -23 import org.owasp.dependencycheck.dependency.Evidence; -24 import java.util.Set; -25 import org.owasp.dependencycheck.Engine; -26 import org.owasp.dependencycheck.utils.DependencyVersion; -27 import org.owasp.dependencycheck.utils.DependencyVersionUtil; -28 -29 /** -30 * -31 * Takes a dependency and analyzes the filename and determines the hashes. -32 * -33 * @author Jeremy Long <jeremy.long@owasp.org> -34 */ -35 public class FileNameAnalyzer extends AbstractAnalyzer implements Analyzer { -36 -37 //<editor-fold defaultstate="collapsed" desc="All standard implmentation details of Analyzer"> -38 /** -39 * The name of the analyzer. -40 */ -41 private static final String ANALYZER_NAME = "File Name Analyzer"; -42 /** -43 * The phase that this analyzer is intended to run in. -44 */ -45 private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.INFORMATION_COLLECTION; -46 /** -47 * The set of file extensions supported by this analyzer. -48 */ -49 private static final Set<String> EXTENSIONS = null; -50 -51 /** -52 * Returns a list of file EXTENSIONS supported by this analyzer. -53 * -54 * @return a list of file EXTENSIONS supported by this analyzer. -55 */ -56 public Set<String> getSupportedExtensions() { -57 return EXTENSIONS; -58 } -59 -60 /** -61 * Returns the name of the analyzer. -62 * -63 * @return the name of the analyzer. -64 */ -65 public String getName() { -66 return ANALYZER_NAME; -67 } -68 -69 /** -70 * Returns whether or not this analyzer can process the given extension. -71 * -72 * @param extension the file extension to test for support. -73 * @return whether or not the specified file extension is supported by this -74 * analyzer. -75 */ -76 public boolean supportsExtension(String extension) { -77 return true; -78 } -79 -80 /** -81 * Returns the phase that the analyzer is intended to run in. -82 * -83 * @return the phase that the analyzer is intended to run in. -84 */ -85 public AnalysisPhase getAnalysisPhase() { -86 return ANALYSIS_PHASE; -87 } -88 //</editor-fold> -89 -90 /** -91 * Collects information about the file name. -92 * -93 * @param dependency the dependency to analyze. -94 * @param engine the engine that is scanning the dependencies -95 * @throws AnalysisException is thrown if there is an error reading the JAR -96 * file. -97 */ -98 @Override -99 public void analyze(Dependency dependency, Engine engine) throws AnalysisException { -100 -101 //strip any path information that may get added by ArchiveAnalyzer, etc. -102 final File f = new File(dependency.getFileName()); -103 String fileName = f.getName(); -104 -105 //remove file extension -106 final int pos = fileName.lastIndexOf("."); -107 if (pos > 0) { -108 fileName = fileName.substring(0, pos); -109 } -110 -111 //add version evidence -112 final DependencyVersion version = DependencyVersionUtil.parseVersion(fileName); -113 if (version != null) { -114 dependency.getVersionEvidence().addEvidence("file", "name", -115 version.toString(), Evidence.Confidence.HIGHEST); -116 dependency.getVersionEvidence().addEvidence("file", "name", -117 fileName, Evidence.Confidence.MEDIUM); -118 } -119 -120 //add as vendor and product evidence -121 if (fileName.contains("-")) { -122 dependency.getProductEvidence().addEvidence("file", "name", -123 fileName, Evidence.Confidence.HIGHEST); -124 dependency.getVendorEvidence().addEvidence("file", "name", -125 fileName, Evidence.Confidence.HIGHEST); -126 } else { +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. +17 */ +18 package org.owasp.dependencycheck.analyzer; +19 +20 import java.io.File; +21 import java.util.Set; +22 import org.owasp.dependencycheck.Engine; +23 import org.owasp.dependencycheck.dependency.Confidence; +24 import org.owasp.dependencycheck.dependency.Dependency; +25 import org.owasp.dependencycheck.utils.DependencyVersion; +26 import org.owasp.dependencycheck.utils.DependencyVersionUtil; +27 +28 /** +29 * +30 * Takes a dependency and analyzes the filename and determines the hashes. +31 * +32 * @author Jeremy Long <jeremy.long@owasp.org> +33 */ +34 public class FileNameAnalyzer extends AbstractAnalyzer implements Analyzer { +35 +36 //<editor-fold defaultstate="collapsed" desc="All standard implmentation details of Analyzer"> +37 /** +38 * The name of the analyzer. +39 */ +40 private static final String ANALYZER_NAME = "File Name Analyzer"; +41 /** +42 * The phase that this analyzer is intended to run in. +43 */ +44 private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.INFORMATION_COLLECTION; +45 /** +46 * The set of file extensions supported by this analyzer. +47 */ +48 private static final Set<String> EXTENSIONS = null; +49 +50 /** +51 * Returns a list of file EXTENSIONS supported by this analyzer. +52 * +53 * @return a list of file EXTENSIONS supported by this analyzer. +54 */ +55 public Set<String> getSupportedExtensions() { +56 return EXTENSIONS; +57 } +58 +59 /** +60 * Returns the name of the analyzer. +61 * +62 * @return the name of the analyzer. +63 */ +64 public String getName() { +65 return ANALYZER_NAME; +66 } +67 +68 /** +69 * Returns whether or not this analyzer can process the given extension. +70 * +71 * @param extension the file extension to test for support. +72 * @return whether or not the specified file extension is supported by this analyzer. +73 */ +74 public boolean supportsExtension(String extension) { +75 return true; +76 } +77 +78 /** +79 * Returns the phase that the analyzer is intended to run in. +80 * +81 * @return the phase that the analyzer is intended to run in. +82 */ +83 public AnalysisPhase getAnalysisPhase() { +84 return ANALYSIS_PHASE; +85 } +86 //</editor-fold> +87 +88 /** +89 * Collects information about the file name. +90 * +91 * @param dependency the dependency to analyze. +92 * @param engine the engine that is scanning the dependencies +93 * @throws AnalysisException is thrown if there is an error reading the JAR file. +94 */ +95 @Override +96 public void analyze(Dependency dependency, Engine engine) throws AnalysisException { +97 +98 //strip any path information that may get added by ArchiveAnalyzer, etc. +99 final File f = new File(dependency.getFileName()); +100 String fileName = f.getName(); +101 +102 //remove file extension +103 final int pos = fileName.lastIndexOf("."); +104 if (pos > 0) { +105 fileName = fileName.substring(0, pos); +106 } +107 +108 //add version evidence +109 final DependencyVersion version = DependencyVersionUtil.parseVersion(fileName); +110 if (version != null) { +111 // If the version number is just a number like 2 or 23, reduce the confidence +112 // a shade. This should hopefully correct for cases like log4j.jar or +113 // struts2-core.jar +114 if (version.getVersionParts() == null || version.getVersionParts().size() < 2) { +115 dependency.getVersionEvidence().addEvidence("file", "name", +116 version.toString(), Confidence.MEDIUM); +117 } else { +118 dependency.getVersionEvidence().addEvidence("file", "name", +119 version.toString(), Confidence.HIGHEST); +120 } +121 dependency.getVersionEvidence().addEvidence("file", "name", +122 fileName, Confidence.MEDIUM); +123 } +124 +125 //add as vendor and product evidence +126 if (fileName.contains("-")) { 127 dependency.getProductEvidence().addEvidence("file", "name", -128 fileName, Evidence.Confidence.HIGH); +128 fileName, Confidence.HIGHEST); 129 dependency.getVendorEvidence().addEvidence("file", "name", -130 fileName, Evidence.Confidence.HIGH); -131 } -132 } -133 } +130 fileName, Confidence.HIGHEST); +131 } else { +132 dependency.getProductEvidence().addEvidence("file", "name", +133 fileName, Confidence.HIGH); +134 dependency.getVendorEvidence().addEvidence("file", "name", +135 fileName, Confidence.HIGH); +136 } +137 } +138 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/HintAnalyzer.html b/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/HintAnalyzer.html index de8bc3234..323095cf6 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/HintAnalyzer.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/HintAnalyzer.html @@ -9,27 +9,27 @@ 1 /* 2 * This file is part of dependency-check-core. 3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. -18 */ -19 package org.owasp.dependencycheck.analyzer; -20 -21 import java.util.ArrayList; -22 import java.util.Iterator; -23 import java.util.Set; -24 import org.owasp.dependencycheck.Engine; +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. +17 */ +18 package org.owasp.dependencycheck.analyzer; +19 +20 import java.util.ArrayList; +21 import java.util.Iterator; +22 import java.util.Set; +23 import org.owasp.dependencycheck.Engine; +24 import org.owasp.dependencycheck.dependency.Confidence; 25 import org.owasp.dependencycheck.dependency.Dependency; 26 import org.owasp.dependencycheck.dependency.Evidence; 27 @@ -75,81 +75,77 @@ 67 * Returns whether or not this analyzer can process the given extension. 68 * 69 * @param extension the file extension to test for support. -70 * @return whether or not the specified file extension is supported by this -71 * analyzer. -72 */ -73 public boolean supportsExtension(String extension) { -74 return true; -75 } -76 -77 /** -78 * Returns the phase that the analyzer is intended to run in. -79 * -80 * @return the phase that the analyzer is intended to run in. -81 */ -82 public AnalysisPhase getAnalysisPhase() { -83 return ANALYSIS_PHASE; -84 } -85 //</editor-fold> -86 -87 /** -88 * The HintAnalyzer uses knowledge about a dependency to add additional -89 * information to help in identification of identifiers or vulnerabilities. -90 * -91 * @param dependency The dependency being analyzed -92 * @param engine The scanning engine -93 * @throws AnalysisException is thrown if there is an exception analyzing -94 * the dependency. -95 */ -96 @Override -97 public void analyze(Dependency dependency, Engine engine) throws AnalysisException { -98 final Evidence springTest1 = new Evidence("Manifest", -99 "Implementation-Title", -100 "Spring Framework", -101 Evidence.Confidence.HIGH); -102 -103 final Evidence springTest2 = new Evidence("Manifest", -104 "Implementation-Title", -105 "org.springframework.core", -106 Evidence.Confidence.HIGH); -107 -108 final Evidence springTest3 = new Evidence("Manifest", -109 "Bundle-Vendor", -110 "SpringSource", -111 Evidence.Confidence.HIGH); -112 -113 -114 Set<Evidence> evidence = dependency.getProductEvidence().getEvidence(); -115 if (evidence.contains(springTest1) || evidence.contains(springTest2)) { -116 dependency.getProductEvidence().addEvidence("hint analyzer", "product", "springsource_spring_framework", Evidence.Confidence.HIGH); -117 dependency.getVendorEvidence().addEvidence("hint analyzer", "vendor", "SpringSource", Evidence.Confidence.HIGH); -118 dependency.getVendorEvidence().addEvidence("hint analyzer", "vendor", "vmware", Evidence.Confidence.HIGH); -119 } -120 -121 evidence = dependency.getVendorEvidence().getEvidence(); -122 if (evidence.contains(springTest3)) { -123 dependency.getProductEvidence().addEvidence("hint analyzer", "product", "springsource_spring_framework", Evidence.Confidence.HIGH); -124 dependency.getVendorEvidence().addEvidence("hint analyzer", "vendor", "vmware", Evidence.Confidence.HIGH); -125 } -126 final Iterator<Evidence> itr = dependency.getVendorEvidence().iterator(); -127 final ArrayList<Evidence> newEntries = new ArrayList<Evidence>(); -128 while (itr.hasNext()) { -129 final Evidence e = itr.next(); -130 if ("sun".equalsIgnoreCase(e.getValue(false))) { -131 final Evidence newEvidence = new Evidence(e.getSource() + " (hint)", e.getName(), "oracle", e.getConfidence()); +70 * @return whether or not the specified file extension is supported by this analyzer. +71 */ +72 public boolean supportsExtension(String extension) { +73 return true; +74 } +75 +76 /** +77 * Returns the phase that the analyzer is intended to run in. +78 * +79 * @return the phase that the analyzer is intended to run in. +80 */ +81 public AnalysisPhase getAnalysisPhase() { +82 return ANALYSIS_PHASE; +83 } +84 //</editor-fold> +85 +86 /** +87 * The HintAnalyzer uses knowledge about a dependency to add additional information to help in identification of +88 * identifiers or vulnerabilities. +89 * +90 * @param dependency The dependency being analyzed +91 * @param engine The scanning engine +92 * @throws AnalysisException is thrown if there is an exception analyzing the dependency. +93 */ +94 @Override +95 public void analyze(Dependency dependency, Engine engine) throws AnalysisException { +96 final Evidence springTest1 = new Evidence("Manifest", +97 "Implementation-Title", +98 "Spring Framework", +99 Confidence.HIGH); +100 +101 final Evidence springTest2 = new Evidence("Manifest", +102 "Implementation-Title", +103 "org.springframework.core", +104 Confidence.HIGH); +105 +106 final Evidence springTest3 = new Evidence("Manifest", +107 "Bundle-Vendor", +108 "SpringSource", +109 Confidence.HIGH); +110 +111 Set<Evidence> evidence = dependency.getProductEvidence().getEvidence(); +112 if (evidence.contains(springTest1) || evidence.contains(springTest2)) { +113 dependency.getProductEvidence().addEvidence("hint analyzer", "product", "springsource_spring_framework", Confidence.HIGH); +114 dependency.getVendorEvidence().addEvidence("hint analyzer", "vendor", "SpringSource", Confidence.HIGH); +115 dependency.getVendorEvidence().addEvidence("hint analyzer", "vendor", "vmware", Confidence.HIGH); +116 } +117 +118 evidence = dependency.getVendorEvidence().getEvidence(); +119 if (evidence.contains(springTest3)) { +120 dependency.getProductEvidence().addEvidence("hint analyzer", "product", "springsource_spring_framework", Confidence.HIGH); +121 dependency.getVendorEvidence().addEvidence("hint analyzer", "vendor", "vmware", Confidence.HIGH); +122 } +123 final Iterator<Evidence> itr = dependency.getVendorEvidence().iterator(); +124 final ArrayList<Evidence> newEntries = new ArrayList<Evidence>(); +125 while (itr.hasNext()) { +126 final Evidence e = itr.next(); +127 if ("sun".equalsIgnoreCase(e.getValue(false))) { +128 final Evidence newEvidence = new Evidence(e.getSource() + " (hint)", e.getName(), "oracle", e.getConfidence()); +129 newEntries.add(newEvidence); +130 } else if ("oracle".equalsIgnoreCase(e.getValue(false))) { +131 final Evidence newEvidence = new Evidence(e.getSource() + " (hint)", e.getName(), "sun", e.getConfidence()); 132 newEntries.add(newEvidence); -133 } else if ("oracle".equalsIgnoreCase(e.getValue(false))) { -134 final Evidence newEvidence = new Evidence(e.getSource() + " (hint)", e.getName(), "sun", e.getConfidence()); -135 newEntries.add(newEvidence); -136 } +133 } +134 } +135 for (Evidence e : newEntries) { +136 dependency.getVendorEvidence().addEvidence(e); 137 } -138 for (Evidence e : newEntries) { -139 dependency.getVendorEvidence().addEvidence(e); -140 } -141 -142 -143 } -144 } +138 +139 } +140 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/JarAnalyzer.html b/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/JarAnalyzer.html index d2c87e85e..86de06e7e 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/JarAnalyzer.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/JarAnalyzer.html @@ -9,1139 +9,1336 @@ 1 /* 2 * This file is part of dependency-check-core. 3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. -18 */ -19 package org.owasp.dependencycheck.analyzer; -20 +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. +17 */ +18 package org.owasp.dependencycheck.analyzer; +19 +20 import java.io.BufferedOutputStream; 21 import java.io.File; -22 import java.util.Enumeration; -23 import java.util.logging.Level; -24 import java.util.logging.Logger; -25 import javax.xml.bind.JAXBException; -26 import javax.xml.parsers.ParserConfigurationException; -27 import org.owasp.dependencycheck.Engine; -28 import org.owasp.dependencycheck.dependency.Dependency; -29 import org.owasp.dependencycheck.dependency.Evidence; -30 import org.owasp.dependencycheck.dependency.EvidenceCollection; -31 import java.io.IOException; -32 import java.io.InputStreamReader; -33 import java.io.Reader; -34 import java.util.ArrayList; -35 import java.util.HashMap; -36 import java.util.List; -37 import java.util.Map; -38 import java.util.Map.Entry; -39 import java.util.Properties; -40 import java.util.Set; -41 import java.util.StringTokenizer; -42 import java.util.jar.Attributes; -43 import java.util.jar.JarEntry; -44 import java.util.jar.JarFile; -45 import java.util.jar.Manifest; +22 import java.io.FileInputStream; +23 import java.io.FileNotFoundException; +24 import java.io.FileOutputStream; +25 import java.io.IOException; +26 import java.io.InputStream; +27 import java.io.InputStreamReader; +28 import java.io.Reader; +29 import java.io.UnsupportedEncodingException; +30 import java.util.ArrayList; +31 import java.util.Collections; +32 import java.util.Enumeration; +33 import java.util.HashMap; +34 import java.util.List; +35 import java.util.Map; +36 import java.util.Map.Entry; +37 import java.util.Properties; +38 import java.util.Set; +39 import java.util.StringTokenizer; +40 import java.util.jar.Attributes; +41 import java.util.jar.JarEntry; +42 import java.util.jar.JarFile; +43 import java.util.jar.Manifest; +44 import java.util.logging.Level; +45 import java.util.logging.Logger; 46 import java.util.regex.Pattern; 47 import java.util.zip.ZipEntry; 48 import javax.xml.bind.JAXBContext; 49 import javax.xml.bind.JAXBElement; -50 import javax.xml.bind.Unmarshaller; -51 import javax.xml.parsers.SAXParser; -52 import javax.xml.parsers.SAXParserFactory; -53 import javax.xml.transform.sax.SAXSource; -54 import org.jsoup.Jsoup; -55 import org.owasp.dependencycheck.jaxb.pom.MavenNamespaceFilter; -56 import org.owasp.dependencycheck.jaxb.pom.generated.License; -57 import org.owasp.dependencycheck.jaxb.pom.generated.Model; -58 import org.owasp.dependencycheck.jaxb.pom.generated.Organization; -59 import org.owasp.dependencycheck.utils.NonClosingStream; -60 import org.xml.sax.InputSource; -61 import org.xml.sax.SAXException; -62 import org.xml.sax.XMLFilter; -63 import org.xml.sax.XMLReader; -64 -65 /** -66 * -67 * Used to load a JAR file and collect information that can be used to determine -68 * the associated CPE. -69 * -70 * @author Jeremy Long <jeremy.long@owasp.org> -71 */ -72 public class JarAnalyzer extends AbstractAnalyzer implements Analyzer { +50 import javax.xml.bind.JAXBException; +51 import javax.xml.bind.Unmarshaller; +52 import javax.xml.parsers.ParserConfigurationException; +53 import javax.xml.parsers.SAXParser; +54 import javax.xml.parsers.SAXParserFactory; +55 import javax.xml.transform.sax.SAXSource; +56 import org.h2.store.fs.FileUtils; +57 import org.jsoup.Jsoup; +58 import org.owasp.dependencycheck.Engine; +59 import org.owasp.dependencycheck.dependency.Confidence; +60 import org.owasp.dependencycheck.dependency.Dependency; +61 import org.owasp.dependencycheck.dependency.EvidenceCollection; +62 import org.owasp.dependencycheck.jaxb.pom.MavenNamespaceFilter; +63 import org.owasp.dependencycheck.jaxb.pom.generated.License; +64 import org.owasp.dependencycheck.jaxb.pom.generated.Model; +65 import org.owasp.dependencycheck.jaxb.pom.generated.Organization; +66 import org.owasp.dependencycheck.jaxb.pom.generated.Parent; +67 import org.owasp.dependencycheck.utils.NonClosingStream; +68 import org.owasp.dependencycheck.utils.Settings; +69 import org.xml.sax.InputSource; +70 import org.xml.sax.SAXException; +71 import org.xml.sax.XMLFilter; +72 import org.xml.sax.XMLReader; 73 -74 //<editor-fold defaultstate="collapsed" desc="Constants and Member Variables"> -75 /** -76 * The system independent newline character. -77 */ -78 private static final String NEWLINE = System.getProperty("line.separator"); -79 /** -80 * A list of values in the manifest to ignore as they only result in false -81 * positives. -82 */ -83 private static final Set<String> IGNORE_VALUES = newHashSet( -84 "Sun Java System Application Server"); -85 /** -86 * A list of elements in the manifest to ignore. -87 */ -88 private static final Set<String> IGNORE_KEYS = newHashSet( -89 "built-by", -90 "created-by", -91 "builtby", -92 "createdby", -93 "build-jdk", -94 "buildjdk", -95 "ant-version", -96 "antversion", -97 "import-package", -98 "export-package", -99 "importpackage", -100 "exportpackage", -101 "sealed", -102 "manifest-version", -103 "archiver-version", -104 "manifestversion", -105 "archiverversion", -106 "classpath", -107 "class-path", -108 "tool", -109 "bundle-manifestversion", -110 "bundlemanifestversion", -111 "include-resource"); -112 /** -113 * item in some manifest, should be considered medium confidence. -114 */ -115 private static final String BUNDLE_VERSION = "Bundle-Version"; //: 2.1.2 -116 /** -117 * item in some manifest, should be considered medium confidence. -118 */ -119 private static final String BUNDLE_DESCRIPTION = "Bundle-Description"; //: Apache Struts 2 -120 /** -121 * item in some manifest, should be considered medium confidence. -122 */ -123 private static final String BUNDLE_NAME = "Bundle-Name"; //: Struts 2 Core -124 /** -125 * item in some manifest, should be considered medium confidence. -126 */ -127 private static final String BUNDLE_VENDOR = "Bundle-Vendor"; //: Apache Software Foundation -128 /** -129 * A pattern to detect HTML within text. -130 */ -131 private static final Pattern HTML_DETECTION_PATTERN = Pattern.compile("\\<[a-z]+.*/?\\>", Pattern.CASE_INSENSITIVE); -132 /** -133 * The unmarshaller used to parse the pom.xml from a JAR file. -134 */ -135 private Unmarshaller pomUnmarshaller; -136 //</editor-fold> -137 -138 /** -139 * Constructs a new JarAnalyzer. -140 */ -141 public JarAnalyzer() { -142 try { -143 final JAXBContext jaxbContext = JAXBContext.newInstance("org.owasp.dependencycheck.jaxb.pom.generated"); -144 pomUnmarshaller = jaxbContext.createUnmarshaller(); -145 } catch (JAXBException ex) { //guess we will just have a null pointer exception later... -146 Logger.getLogger(JarAnalyzer.class.getName()).log(Level.SEVERE, "Unable to load parser. See the log for more details."); -147 Logger.getLogger(JarAnalyzer.class.getName()).log(Level.FINE, null, ex); -148 } -149 } -150 //<editor-fold defaultstate="collapsed" desc="All standard implmentation details of Analyzer"> -151 /** -152 * The name of the analyzer. -153 */ -154 private static final String ANALYZER_NAME = "Jar Analyzer"; -155 /** -156 * The phase that this analyzer is intended to run in. -157 */ -158 private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.INFORMATION_COLLECTION; -159 /** -160 * The set of file extensions supported by this analyzer. -161 */ -162 private static final Set<String> EXTENSIONS = newHashSet("jar", "war"); -163 -164 /** -165 * Returns a list of file EXTENSIONS supported by this analyzer. -166 * -167 * @return a list of file EXTENSIONS supported by this analyzer. +74 /** +75 * +76 * Used to load a JAR file and collect information that can be used to determine the associated CPE. +77 * +78 * @author Jeremy Long <jeremy.long@owasp.org> +79 */ +80 public class JarAnalyzer extends AbstractAnalyzer implements Analyzer { +81 +82 //<editor-fold defaultstate="collapsed" desc="Constants and Member Variables"> +83 /** +84 * The buffer size to use when extracting files from the archive. +85 */ +86 private static final int BUFFER_SIZE = 4096; +87 /** +88 * The count of directories created during analysis. This is used for creating temporary directories. +89 */ +90 private static int dirCount = 0; +91 /** +92 * The system independent newline character. +93 */ +94 private static final String NEWLINE = System.getProperty("line.separator"); +95 /** +96 * A list of values in the manifest to ignore as they only result in false positives. +97 */ +98 private static final Set<String> IGNORE_VALUES = newHashSet( +99 "Sun Java System Application Server"); +100 /** +101 * A list of elements in the manifest to ignore. +102 */ +103 private static final Set<String> IGNORE_KEYS = newHashSet( +104 "built-by", +105 "created-by", +106 "builtby", +107 "createdby", +108 "build-jdk", +109 "buildjdk", +110 "ant-version", +111 "antversion", +112 "import-package", +113 "export-package", +114 "importpackage", +115 "exportpackage", +116 "sealed", +117 "manifest-version", +118 "archiver-version", +119 "manifestversion", +120 "archiverversion", +121 "classpath", +122 "class-path", +123 "tool", +124 "bundle-manifestversion", +125 "bundlemanifestversion", +126 "include-resource"); +127 /** +128 * item in some manifest, should be considered medium confidence. +129 */ +130 private static final String BUNDLE_VERSION = "Bundle-Version"; //: 2.1.2 +131 /** +132 * item in some manifest, should be considered medium confidence. +133 */ +134 private static final String BUNDLE_DESCRIPTION = "Bundle-Description"; //: Apache Struts 2 +135 /** +136 * item in some manifest, should be considered medium confidence. +137 */ +138 private static final String BUNDLE_NAME = "Bundle-Name"; //: Struts 2 Core +139 /** +140 * item in some manifest, should be considered medium confidence. +141 */ +142 private static final String BUNDLE_VENDOR = "Bundle-Vendor"; //: Apache Software Foundation +143 /** +144 * A pattern to detect HTML within text. +145 */ +146 private static final Pattern HTML_DETECTION_PATTERN = Pattern.compile("\\<[a-z]+.*/?\\>", Pattern.CASE_INSENSITIVE); +147 /** +148 * The unmarshaller used to parse the pom.xml from a JAR file. +149 */ +150 private Unmarshaller pomUnmarshaller; +151 //</editor-fold> +152 +153 /** +154 * Constructs a new JarAnalyzer. +155 */ +156 public JarAnalyzer() { +157 try { +158 final JAXBContext jaxbContext = JAXBContext.newInstance("org.owasp.dependencycheck.jaxb.pom.generated"); +159 pomUnmarshaller = jaxbContext.createUnmarshaller(); +160 } catch (JAXBException ex) { //guess we will just have a null pointer exception later... +161 Logger.getLogger(JarAnalyzer.class.getName()).log(Level.SEVERE, "Unable to load parser. See the log for more details."); +162 Logger.getLogger(JarAnalyzer.class.getName()).log(Level.FINE, null, ex); +163 } +164 } +165 //<editor-fold defaultstate="collapsed" desc="All standard implmentation details of Analyzer"> +166 /** +167 * The name of the analyzer. 168 */ -169 public Set<String> getSupportedExtensions() { -170 return EXTENSIONS; -171 } -172 -173 /** -174 * Returns the name of the analyzer. -175 * -176 * @return the name of the analyzer. -177 */ -178 public String getName() { -179 return ANALYZER_NAME; -180 } -181 -182 /** -183 * Returns whether or not this analyzer can process the given extension. -184 * -185 * @param extension the file extension to test for support. -186 * @return whether or not the specified file extension is supported by this -187 * analyzer. -188 */ -189 public boolean supportsExtension(String extension) { -190 return EXTENSIONS.contains(extension); -191 } -192 -193 /** -194 * Returns the phase that the analyzer is intended to run in. -195 * -196 * @return the phase that the analyzer is intended to run in. -197 */ -198 public AnalysisPhase getAnalysisPhase() { -199 return ANALYSIS_PHASE; -200 } -201 //</editor-fold> -202 -203 /** -204 * Loads a specified JAR file and collects information from the manifest and -205 * checksums to identify the correct CPE information. -206 * -207 * @param dependency the dependency to analyze. -208 * @param engine the engine that is scanning the dependencies -209 * @throws AnalysisException is thrown if there is an error reading the JAR -210 * file. +169 private static final String ANALYZER_NAME = "Jar Analyzer"; +170 /** +171 * The phase that this analyzer is intended to run in. +172 */ +173 private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.INFORMATION_COLLECTION; +174 /** +175 * The set of file extensions supported by this analyzer. +176 */ +177 private static final Set<String> EXTENSIONS = newHashSet("jar", "war"); +178 +179 /** +180 * Returns a list of file EXTENSIONS supported by this analyzer. +181 * +182 * @return a list of file EXTENSIONS supported by this analyzer. +183 */ +184 public Set<String> getSupportedExtensions() { +185 return EXTENSIONS; +186 } +187 +188 /** +189 * Returns the name of the analyzer. +190 * +191 * @return the name of the analyzer. +192 */ +193 public String getName() { +194 return ANALYZER_NAME; +195 } +196 +197 /** +198 * Returns whether or not this analyzer can process the given extension. +199 * +200 * @param extension the file extension to test for support. +201 * @return whether or not the specified file extension is supported by this analyzer. +202 */ +203 public boolean supportsExtension(String extension) { +204 return EXTENSIONS.contains(extension); +205 } +206 +207 /** +208 * Returns the phase that the analyzer is intended to run in. +209 * +210 * @return the phase that the analyzer is intended to run in. 211 */ -212 @Override -213 public void analyze(Dependency dependency, Engine engine) throws AnalysisException { -214 try { -215 final ArrayList<ClassNameInformation> classNames = collectClassNames(dependency); -216 final String fileName = dependency.getFileName().toLowerCase(); -217 if (classNames.isEmpty() -218 && (fileName.endsWith("-sources.jar") -219 || fileName.endsWith("-javadoc.jar") -220 || fileName.endsWith("-src.jar") -221 || fileName.endsWith("-doc.jar"))) { -222 engine.getDependencies().remove(dependency); -223 } -224 final boolean hasManifest = parseManifest(dependency, classNames); -225 final boolean hasPOM = analyzePOM(dependency, classNames); -226 final boolean addPackagesAsEvidence = !(hasManifest && hasPOM); -227 analyzePackageNames(classNames, dependency, addPackagesAsEvidence); -228 } catch (IOException ex) { -229 throw new AnalysisException("Exception occurred reading the JAR file.", ex); -230 } -231 } -232 -233 /** -234 * Attempts to find a pom.xml within the JAR file. If found it extracts -235 * information and adds it to the evidence. This will attempt to interpolate -236 * the strings contained within the pom.properties if one exists. -237 * -238 * @param dependency the dependency being analyzed -239 * @param classes a collection of class name information -240 * @throws AnalysisException is thrown if there is an exception parsing the -241 * pom -242 * @return whether or not evidence was added to the dependency -243 */ -244 protected boolean analyzePOM(Dependency dependency, ArrayList<ClassNameInformation> classes) throws AnalysisException { -245 boolean foundSomething = false; -246 final JarFile jar; -247 try { -248 jar = new JarFile(dependency.getActualFilePath()); -249 } catch (IOException ex) { -250 final String msg = String.format("Unable to read JarFile '%s'.", dependency.getActualFilePath()); -251 final AnalysisException ax = new AnalysisException(msg, ex); -252 dependency.getAnalysisExceptions().add(ax); -253 Logger.getLogger(JarAnalyzer.class.getName()).log(Level.WARNING, msg); -254 Logger.getLogger(JarAnalyzer.class.getName()).log(Level.FINE, null, ex); -255 return false; -256 } -257 List<String> pomEntries; -258 try { -259 pomEntries = retrievePomListing(jar); -260 } catch (IOException ex) { -261 final String msg = String.format("Unable to read Jar file entries in '%s'.", dependency.getActualFilePath()); -262 final AnalysisException ax = new AnalysisException(msg, ex); -263 dependency.getAnalysisExceptions().add(ax); -264 Logger.getLogger(JarAnalyzer.class.getName()).log(Level.WARNING, msg); -265 Logger.getLogger(JarAnalyzer.class.getName()).log(Level.INFO, msg, ex); -266 return false; -267 } -268 if (pomEntries.isEmpty()) { -269 return false; -270 } -271 if (pomEntries.size() > 1) { //need to sort out which pom we will use -272 pomEntries = filterPomEntries(pomEntries, classes); -273 } -274 for (String path : pomEntries) { -275 Properties pomProperties = null; -276 try { -277 pomProperties = retrievePomProperties(path, jar); -278 } catch (IOException ex) { -279 Logger.getLogger(JarAnalyzer.class.getName()).log(Level.FINEST, "ignore this, failed reading a non-existent pom.properties", ex); -280 } -281 Model pom = null; -282 try { -283 pom = retrievePom(path, jar); -284 foundSomething = setPomEvidence(dependency, pom, pomProperties, classes) || foundSomething; -285 } catch (AnalysisException ex) { -286 dependency.addAnalysisException(ex); -287 } -288 } -289 return foundSomething; -290 } -291 -292 /** -293 * Given a path to a pom.xml within a JarFile, this method attempts to load -294 * a sibling pom.properties if one exists. -295 * -296 * @param path the path to the pom.xml within the JarFile -297 * @param jar the JarFile to load the pom.properties from -298 * @return a Properties object or null if no pom.properties was found -299 * @throws IOException thrown if there is an exception reading the -300 * pom.properties -301 */ -302 @edu.umd.cs.findbugs.annotations.SuppressWarnings(value = "OS_OPEN_STREAM", -303 justification = "The reader is closed by closing the zipEntry") -304 private Properties retrievePomProperties(String path, final JarFile jar) throws IOException { -305 Properties pomProperties = null; -306 final String propPath = path.substring(0, path.length() - 7) + "pom.properies"; -307 final ZipEntry propEntry = jar.getEntry(propPath); -308 if (propEntry != null) { -309 final Reader reader = new InputStreamReader(jar.getInputStream(propEntry), "UTF-8"); -310 pomProperties = new Properties(); -311 pomProperties.load(reader); -312 } -313 return pomProperties; -314 } -315 -316 /** -317 * Searches a JarFile for pom.xml entries and returns a listing of these -318 * entries. -319 * -320 * @param jar the JarFile to search -321 * @return a list of pom.xml entries -322 * @throws IOException thrown if there is an exception reading a JarEntryf -323 */ -324 private List<String> retrievePomListing(final JarFile jar) throws IOException { -325 final List<String> pomEntries = new ArrayList<String>(); -326 final Enumeration<JarEntry> entries = jar.entries(); -327 while (entries.hasMoreElements()) { -328 final JarEntry entry = entries.nextElement(); -329 final String entryName = (new File(entry.getName())).getName().toLowerCase(); -330 if (!entry.isDirectory() && "pom.xml".equals(entryName)) { -331 pomEntries.add(entry.getName()); -332 } -333 } -334 return pomEntries; -335 } -336 -337 /** -338 * Retrieves the specified POM from a jar file and converts it to a Model. -339 * -340 * @param path the path to the pom.xml file within the jar file -341 * @param jar the jar file to extract the pom from -342 * @return returns a -343 * @throws AnalysisException is thrown if there is an exception extracting -344 * or parsing the POM -345 * {@link org.owasp.dependencycheck.jaxb.pom.generated.Model} object -346 */ -347 private Model retrievePom(String path, JarFile jar) throws AnalysisException { -348 final ZipEntry entry = jar.getEntry(path); -349 Model model = null; -350 if (entry != null) { //should never be null -351 try { -352 final XMLFilter filter = new MavenNamespaceFilter(); -353 final SAXParserFactory spf = SAXParserFactory.newInstance(); -354 final SAXParser sp = spf.newSAXParser(); -355 final XMLReader xr = sp.getXMLReader(); -356 filter.setParent(xr); -357 final NonClosingStream stream = new NonClosingStream(jar.getInputStream(entry)); -358 final InputStreamReader reader = new InputStreamReader(stream, "UTF-8"); -359 final InputSource xml = new InputSource(reader); -360 final SAXSource source = new SAXSource(filter, xml); -361 final JAXBElement<Model> el = pomUnmarshaller.unmarshal(source, Model.class); -362 model = el.getValue(); -363 } catch (SecurityException ex) { -364 final String msg = String.format("Unable to parse pom '%s' in jar '%s'; invalid signature", path, jar.getName()); -365 Logger.getLogger(JarAnalyzer.class.getName()).log(Level.WARNING, msg); -366 Logger.getLogger(JarAnalyzer.class.getName()).log(Level.FINE, null, ex); -367 throw new AnalysisException(ex); -368 } catch (ParserConfigurationException ex) { -369 final String msg = String.format("Unable to parse pom '%s' in jar '%s' (Parser Configuration Error)", path, jar.getName()); -370 Logger.getLogger(JarAnalyzer.class.getName()).log(Level.WARNING, msg); -371 Logger.getLogger(JarAnalyzer.class.getName()).log(Level.FINE, null, ex); -372 throw new AnalysisException(ex); -373 } catch (SAXException ex) { -374 final String msg = String.format("Unable to parse pom '%s' in jar '%s' (SAX Error)", path, jar.getName()); -375 Logger.getLogger(JarAnalyzer.class.getName()).log(Level.WARNING, msg); -376 Logger.getLogger(JarAnalyzer.class.getName()).log(Level.FINE, null, ex); -377 throw new AnalysisException(ex); -378 } catch (JAXBException ex) { -379 final String msg = String.format("Unable to parse pom '%s' in jar '%s' (JAXB Exception)", path, jar.getName()); -380 Logger.getLogger(JarAnalyzer.class.getName()).log(Level.WARNING, msg); -381 Logger.getLogger(JarAnalyzer.class.getName()).log(Level.FINE, null, ex); -382 throw new AnalysisException(ex); -383 } catch (IOException ex) { -384 final String msg = String.format("Unable to parse pom '%s' in jar '%s' (IO Exception)", path, jar.getName()); -385 Logger.getLogger(JarAnalyzer.class.getName()).log(Level.WARNING, msg); -386 Logger.getLogger(JarAnalyzer.class.getName()).log(Level.FINE, null, ex); -387 throw new AnalysisException(ex); -388 } catch (Throwable ex) { -389 final String msg = String.format("Unexpected error during parsing of the pom '%s' in jar '%s'", path, jar.getName()); -390 Logger.getLogger(JarAnalyzer.class.getName()).log(Level.WARNING, msg); -391 Logger.getLogger(JarAnalyzer.class.getName()).log(Level.FINE, null, ex); -392 throw new AnalysisException(ex); -393 } -394 } -395 return model; -396 } -397 -398 /** -399 * Sets evidence from the pom on the supplied dependency. -400 * -401 * @param dependency the dependency to set data on -402 * @param pom the information from the pom -403 * @param pomProperties the pom properties file (null if none exists) -404 * @param classes a collection of ClassNameInformation - containing data -405 * about the fully qualified class names within the JAR file being analyzed -406 * @return true if there was evidence within the pom that we could use; -407 * otherwise false -408 */ -409 private boolean setPomEvidence(Dependency dependency, Model pom, Properties pomProperties, ArrayList<ClassNameInformation> classes) { -410 boolean foundSomething = false; -411 if (pom == null) { -412 return foundSomething; -413 } -414 String groupid = interpolateString(pom.getGroupId(), pomProperties); -415 if (groupid != null && !groupid.isEmpty()) { -416 if (groupid.startsWith("org.") || groupid.startsWith("com.")) { -417 groupid = groupid.substring(4); -418 } -419 foundSomething = true; -420 dependency.getVendorEvidence().addEvidence("pom", "groupid", groupid, Evidence.Confidence.HIGH); -421 dependency.getProductEvidence().addEvidence("pom", "groupid", groupid, Evidence.Confidence.LOW); -422 addMatchingValues(classes, groupid, dependency.getVendorEvidence()); -423 addMatchingValues(classes, groupid, dependency.getProductEvidence()); -424 } -425 String artifactid = interpolateString(pom.getArtifactId(), pomProperties); -426 if (artifactid != null && !artifactid.isEmpty()) { -427 if (artifactid.startsWith("org.") || artifactid.startsWith("com.")) { -428 artifactid = artifactid.substring(4); -429 } -430 foundSomething = true; -431 dependency.getProductEvidence().addEvidence("pom", "artifactid", artifactid, Evidence.Confidence.HIGH); -432 dependency.getVendorEvidence().addEvidence("pom", "artifactid", artifactid, Evidence.Confidence.LOW); -433 addMatchingValues(classes, artifactid, dependency.getVendorEvidence()); -434 addMatchingValues(classes, artifactid, dependency.getProductEvidence()); -435 } -436 //version -437 final String version = interpolateString(pom.getVersion(), pomProperties); -438 if (version != null && !version.isEmpty()) { -439 foundSomething = true; -440 dependency.getVersionEvidence().addEvidence("pom", "version", version, Evidence.Confidence.HIGHEST); -441 } -442 // org name -443 final Organization org = pom.getOrganization(); -444 if (org != null && org.getName() != null) { -445 foundSomething = true; -446 final String orgName = interpolateString(org.getName(), pomProperties); -447 if (orgName != null && !orgName.isEmpty()) { -448 dependency.getVendorEvidence().addEvidence("pom", "organization name", orgName, Evidence.Confidence.HIGH); -449 addMatchingValues(classes, orgName, dependency.getVendorEvidence()); -450 } -451 } -452 //pom name -453 final String pomName = interpolateString(pom.getName(), pomProperties); -454 if (pomName != null && !pomName.isEmpty()) { -455 foundSomething = true; -456 dependency.getProductEvidence().addEvidence("pom", "name", pomName, Evidence.Confidence.HIGH); -457 dependency.getVendorEvidence().addEvidence("pom", "name", pomName, Evidence.Confidence.HIGH); -458 addMatchingValues(classes, pomName, dependency.getVendorEvidence()); -459 addMatchingValues(classes, pomName, dependency.getProductEvidence()); -460 } -461 -462 //Description -463 if (pom.getDescription() != null) { -464 foundSomething = true; -465 final String description = interpolateString(pom.getDescription(), pomProperties); -466 if (description != null && !description.isEmpty()) { -467 addDescription(dependency, description, "pom", "description"); -468 addMatchingValues(classes, description, dependency.getVendorEvidence()); -469 addMatchingValues(classes, description, dependency.getProductEvidence()); -470 } -471 } -472 -473 //license -474 if (pom.getLicenses() != null) { -475 String license = null; -476 for (License lic : pom.getLicenses().getLicense()) { -477 String tmp = null; -478 if (lic.getName() != null) { -479 tmp = interpolateString(lic.getName(), pomProperties); -480 } -481 if (lic.getUrl() != null) { -482 if (tmp == null) { -483 tmp = interpolateString(lic.getUrl(), pomProperties); -484 } else { -485 tmp += ": " + interpolateString(lic.getUrl(), pomProperties); -486 } -487 } -488 if (tmp == null) { -489 continue; -490 } -491 if (HTML_DETECTION_PATTERN.matcher(tmp).find()) { -492 tmp = Jsoup.parse(tmp).text(); -493 } -494 if (license == null) { -495 license = tmp; -496 } else { -497 license += "\n" + tmp; -498 } -499 } -500 if (license != null) { -501 dependency.setLicense(license); -502 } -503 } -504 return foundSomething; -505 } -506 -507 /** -508 * Analyzes the path information of the classes contained within the -509 * JarAnalyzer to try and determine possible vendor or product names. If any -510 * are found they are stored in the packageVendor and packageProduct -511 * hashSets. +212 public AnalysisPhase getAnalysisPhase() { +213 return ANALYSIS_PHASE; +214 } +215 //</editor-fold> +216 +217 /** +218 * Loads a specified JAR file and collects information from the manifest and checksums to identify the correct CPE +219 * information. +220 * +221 * @param dependency the dependency to analyze. +222 * @param engine the engine that is scanning the dependencies +223 * @throws AnalysisException is thrown if there is an error reading the JAR file. +224 */ +225 @Override +226 public void analyze(Dependency dependency, Engine engine) throws AnalysisException { +227 try { +228 final ArrayList<ClassNameInformation> classNames = collectClassNames(dependency); +229 final String fileName = dependency.getFileName().toLowerCase(); +230 if (classNames.isEmpty() +231 && (fileName.endsWith("-sources.jar") +232 || fileName.endsWith("-javadoc.jar") +233 || fileName.endsWith("-src.jar") +234 || fileName.endsWith("-doc.jar"))) { +235 engine.getDependencies().remove(dependency); +236 } +237 final boolean hasManifest = parseManifest(dependency, classNames); +238 final boolean hasPOM = analyzePOM(dependency, classNames, engine); +239 final boolean addPackagesAsEvidence = !(hasManifest && hasPOM); +240 analyzePackageNames(classNames, dependency, addPackagesAsEvidence); +241 } catch (IOException ex) { +242 throw new AnalysisException("Exception occurred reading the JAR file.", ex); +243 } +244 } +245 +246 /** +247 * Attempts to find a pom.xml within the JAR file. If found it extracts information and adds it to the evidence. +248 * This will attempt to interpolate the strings contained within the pom.properties if one exists. +249 * +250 * @param dependency the dependency being analyzed +251 * @param classes a collection of class name information +252 * @param engine the analysis engine, used to add additional dependencies +253 * @throws AnalysisException is thrown if there is an exception parsing the pom +254 * @return whether or not evidence was added to the dependency +255 */ +256 protected boolean analyzePOM(Dependency dependency, ArrayList<ClassNameInformation> classes, Engine engine) throws AnalysisException { +257 boolean foundSomething = false; +258 final JarFile jar; +259 try { +260 jar = new JarFile(dependency.getActualFilePath()); +261 } catch (IOException ex) { +262 final String msg = String.format("Unable to read JarFile '%s'.", dependency.getActualFilePath()); +263 final AnalysisException ax = new AnalysisException(msg, ex); +264 dependency.getAnalysisExceptions().add(ax); +265 Logger.getLogger(JarAnalyzer.class.getName()).log(Level.WARNING, msg); +266 Logger.getLogger(JarAnalyzer.class.getName()).log(Level.FINE, null, ex); +267 return false; +268 } +269 List<String> pomEntries; +270 try { +271 pomEntries = retrievePomListing(jar); +272 } catch (IOException ex) { +273 final String msg = String.format("Unable to read Jar file entries in '%s'.", dependency.getActualFilePath()); +274 final AnalysisException ax = new AnalysisException(msg, ex); +275 dependency.getAnalysisExceptions().add(ax); +276 Logger.getLogger(JarAnalyzer.class.getName()).log(Level.WARNING, msg); +277 Logger.getLogger(JarAnalyzer.class.getName()).log(Level.INFO, msg, ex); +278 return false; +279 } +280 if (pomEntries.isEmpty()) { +281 return false; +282 } +283 for (String path : pomEntries) { +284 Properties pomProperties = null; +285 try { +286 pomProperties = retrievePomProperties(path, jar); +287 } catch (IOException ex) { +288 Logger.getLogger(JarAnalyzer.class.getName()).log(Level.FINEST, "ignore this, failed reading a non-existent pom.properties", ex); +289 } +290 Model pom = null; +291 try { +292 if (pomEntries.size() > 1) { +293 //extract POM to its own directory and add it as its own dependency +294 final Dependency newDependency = new Dependency(); +295 pom = extractPom(path, jar, newDependency); +296 +297 final String displayPath = String.format("%s%s%s", +298 dependency.getFilePath(), +299 File.separator, +300 path); //.replaceAll("[\\/]", File.separator)); +301 final String displayName = String.format("%s%s%s", +302 dependency.getFileName(), +303 File.separator, +304 path); //.replaceAll("[\\/]", File.separator)); +305 +306 newDependency.setFileName(displayName); +307 newDependency.setFilePath(displayPath); +308 addPomEvidence(newDependency, pom, pomProperties); +309 engine.getDependencies().add(newDependency); +310 Collections.sort(engine.getDependencies()); +311 } else { +312 pom = retrievePom(path, jar); +313 foundSomething |= setPomEvidence(dependency, pom, pomProperties, classes); +314 } +315 } catch (AnalysisException ex) { +316 dependency.addAnalysisException(ex); +317 } +318 } +319 return foundSomething; +320 } +321 +322 /** +323 * Given a path to a pom.xml within a JarFile, this method attempts to load a sibling pom.properties if one exists. +324 * +325 * @param path the path to the pom.xml within the JarFile +326 * @param jar the JarFile to load the pom.properties from +327 * @return a Properties object or null if no pom.properties was found +328 * @throws IOException thrown if there is an exception reading the pom.properties +329 */ +330 @edu.umd.cs.findbugs.annotations.SuppressWarnings(value = "OS_OPEN_STREAM", +331 justification = "The reader is closed by closing the zipEntry") +332 private Properties retrievePomProperties(String path, final JarFile jar) throws IOException { +333 Properties pomProperties = null; +334 final String propPath = path.substring(0, path.length() - 7) + "pom.properies"; +335 final ZipEntry propEntry = jar.getEntry(propPath); +336 if (propEntry != null) { +337 final Reader reader = new InputStreamReader(jar.getInputStream(propEntry), "UTF-8"); +338 pomProperties = new Properties(); +339 pomProperties.load(reader); +340 } +341 return pomProperties; +342 } +343 +344 /** +345 * Searches a JarFile for pom.xml entries and returns a listing of these entries. +346 * +347 * @param jar the JarFile to search +348 * @return a list of pom.xml entries +349 * @throws IOException thrown if there is an exception reading a JarEntryf +350 */ +351 private List<String> retrievePomListing(final JarFile jar) throws IOException { +352 final List<String> pomEntries = new ArrayList<String>(); +353 final Enumeration<JarEntry> entries = jar.entries(); +354 while (entries.hasMoreElements()) { +355 final JarEntry entry = entries.nextElement(); +356 final String entryName = (new File(entry.getName())).getName().toLowerCase(); +357 if (!entry.isDirectory() && "pom.xml".equals(entryName)) { +358 pomEntries.add(entry.getName()); +359 } +360 } +361 return pomEntries; +362 } +363 +364 /** +365 * Retrieves the specified POM from a jar file and converts it to a Model. +366 * +367 * @param path the path to the pom.xml file within the jar file +368 * @param jar the jar file to extract the pom from +369 * @param dependency the dependency being analyzed +370 * @return returns the POM object +371 * @throws AnalysisException is thrown if there is an exception extracting or parsing the POM +372 * {@link org.owasp.dependencycheck.jaxb.pom.generated.Model} object +373 */ +374 private Model extractPom(String path, JarFile jar, Dependency dependency) throws AnalysisException { +375 InputStream input = null; +376 FileOutputStream fos = null; +377 BufferedOutputStream bos = null; +378 final File tmpDir = getNextTempDirectory(); +379 final File file = new File(tmpDir, "pom.xml"); +380 try { +381 final ZipEntry entry = jar.getEntry(path); +382 input = jar.getInputStream(entry); +383 fos = new FileOutputStream(file); +384 bos = new BufferedOutputStream(fos, BUFFER_SIZE); +385 int count; +386 final byte data[] = new byte[BUFFER_SIZE]; +387 while ((count = input.read(data, 0, BUFFER_SIZE)) != -1) { +388 bos.write(data, 0, count); +389 } +390 bos.flush(); +391 dependency.setActualFilePath(file.getAbsolutePath()); +392 } catch (IOException ex) { +393 Logger.getLogger(JarAnalyzer.class.getName()).log(Level.SEVERE, null, ex); +394 } finally { +395 try { +396 input.close(); +397 } catch (IOException ex) { +398 Logger.getLogger(JarAnalyzer.class.getName()).log(Level.SEVERE, null, ex); +399 } +400 } +401 Model model = null; +402 FileInputStream fis = null; +403 try { +404 fis = new FileInputStream(file); +405 final InputStreamReader reader = new InputStreamReader(fis, "UTF-8"); +406 final InputSource xml = new InputSource(reader); +407 final SAXSource source = new SAXSource(xml); +408 model = readPom(source); +409 } catch (FileNotFoundException ex) { +410 final String msg = String.format("Unable to parse pom '%s' in jar '%s' (File Not Found)", path, jar.getName()); +411 Logger.getLogger(JarAnalyzer.class.getName()).log(Level.WARNING, msg); +412 Logger.getLogger(JarAnalyzer.class.getName()).log(Level.FINE, null, ex); +413 throw new AnalysisException(ex); +414 } catch (UnsupportedEncodingException ex) { +415 final String msg = String.format("Unable to parse pom '%s' in jar '%s' (IO Exception)", path, jar.getName()); +416 Logger.getLogger(JarAnalyzer.class.getName()).log(Level.WARNING, msg); +417 Logger.getLogger(JarAnalyzer.class.getName()).log(Level.FINE, null, ex); +418 throw new AnalysisException(ex); +419 } catch (AnalysisException ex) { +420 final String msg = String.format("Unable to parse pom '%s' in jar '%s'", path, jar.getName()); +421 Logger.getLogger(JarAnalyzer.class.getName()).log(Level.WARNING, msg); +422 Logger.getLogger(JarAnalyzer.class.getName()).log(Level.FINE, null, ex); +423 throw ex; +424 } finally { +425 if (fis != null) { +426 try { +427 fis.close(); +428 } catch (IOException ex) { +429 Logger.getLogger(JarAnalyzer.class.getName()).log(Level.FINEST, null, ex); +430 } +431 } +432 } +433 return model; +434 } +435 +436 /** +437 * Retrieves the specified POM from a jar file and converts it to a Model. +438 * +439 * @param path the path to the pom.xml file within the jar file +440 * @param jar the jar file to extract the pom from +441 * @return returns a +442 * @throws AnalysisException is thrown if there is an exception extracting or parsing the POM +443 * {@link org.owasp.dependencycheck.jaxb.pom.generated.Model} object +444 */ +445 private Model retrievePom(String path, JarFile jar) throws AnalysisException { +446 final ZipEntry entry = jar.getEntry(path); +447 Model model = null; +448 if (entry != null) { //should never be null +449 try { +450 final NonClosingStream stream = new NonClosingStream(jar.getInputStream(entry)); +451 final InputStreamReader reader = new InputStreamReader(stream, "UTF-8"); +452 final InputSource xml = new InputSource(reader); +453 final SAXSource source = new SAXSource(xml); +454 model = readPom(source); +455 } catch (SecurityException ex) { +456 final String msg = String.format("Unable to parse pom '%s' in jar '%s'; invalid signature", path, jar.getName()); +457 Logger +458 .getLogger(JarAnalyzer.class +459 .getName()).log(Level.WARNING, msg); +460 Logger.getLogger(JarAnalyzer.class +461 .getName()).log(Level.FINE, null, ex); +462 throw new AnalysisException(ex); +463 } catch (IOException ex) { +464 final String msg = String.format("Unable to parse pom '%s' in jar '%s' (IO Exception)", path, jar.getName()); +465 Logger.getLogger(JarAnalyzer.class.getName()).log(Level.WARNING, msg); +466 Logger.getLogger(JarAnalyzer.class.getName()).log(Level.FINE, null, ex); +467 throw new AnalysisException(ex); +468 } catch (Throwable ex) { +469 final String msg = String.format("Unexpected error during parsing of the pom '%s' in jar '%s'", path, jar.getName()); +470 Logger.getLogger(JarAnalyzer.class.getName()).log(Level.WARNING, msg); +471 Logger.getLogger(JarAnalyzer.class.getName()).log(Level.FINE, null, ex); +472 throw new AnalysisException(ex); +473 } +474 } +475 return model; +476 } +477 +478 /** +479 * Retrieves the specified POM from a jar file and converts it to a Model. +480 * +481 * @param source the SAXSource input stream to read the POM from +482 * @return returns the POM object +483 * @throws AnalysisException is thrown if there is an exception extracting or parsing the POM +484 * {@link org.owasp.dependencycheck.jaxb.pom.generated.Model} object +485 */ +486 private Model readPom(SAXSource source) throws AnalysisException { +487 Model model = null; +488 try { +489 final XMLFilter filter = new MavenNamespaceFilter(); +490 final SAXParserFactory spf = SAXParserFactory.newInstance(); +491 final SAXParser sp = spf.newSAXParser(); +492 final XMLReader xr = sp.getXMLReader(); +493 filter.setParent(xr); +494 final JAXBElement<Model> el = pomUnmarshaller.unmarshal(source, Model.class); +495 model = el.getValue(); +496 } catch (SecurityException ex) { +497 throw new AnalysisException(ex); +498 } catch (ParserConfigurationException ex) { +499 throw new AnalysisException(ex); +500 } catch (SAXException ex) { +501 throw new AnalysisException(ex); +502 } catch (JAXBException ex) { +503 throw new AnalysisException(ex); +504 } catch (Throwable ex) { +505 throw new AnalysisException(ex); +506 } +507 return model; +508 } +509 +510 /** +511 * Sets evidence from the pom on the supplied dependency. 512 * -513 * @param classNames a list of class names -514 * @param dependency a dependency to analyze -515 * @param addPackagesAsEvidence a flag indicating whether or not package -516 * names should be added as evidence. -517 */ -518 protected void analyzePackageNames(ArrayList<ClassNameInformation> classNames, -519 Dependency dependency, boolean addPackagesAsEvidence) { -520 final HashMap<String, Integer> vendorIdentifiers = new HashMap<String, Integer>(); -521 final HashMap<String, Integer> productIdentifiers = new HashMap<String, Integer>(); -522 analyzeFullyQualifiedClassNames(classNames, vendorIdentifiers, productIdentifiers); -523 -524 final int classCount = classNames.size(); -525 final EvidenceCollection vendor = dependency.getVendorEvidence(); -526 final EvidenceCollection product = dependency.getProductEvidence(); -527 -528 for (Map.Entry<String, Integer> entry : vendorIdentifiers.entrySet()) { -529 final float ratio = entry.getValue() / (float) classCount; -530 if (ratio > 0.5) { -531 //TODO remove weighting -532 vendor.addWeighting(entry.getKey()); -533 if (addPackagesAsEvidence && entry.getKey().length() > 1) { -534 vendor.addEvidence("jar", "package", entry.getKey(), Evidence.Confidence.LOW); -535 } -536 } -537 } -538 for (Map.Entry<String, Integer> entry : productIdentifiers.entrySet()) { -539 final float ratio = entry.getValue() / (float) classCount; -540 if (ratio > 0.5) { -541 product.addWeighting(entry.getKey()); -542 if (addPackagesAsEvidence && entry.getKey().length() > 1) { -543 product.addEvidence("jar", "package", entry.getKey(), Evidence.Confidence.LOW); -544 } -545 } +513 * @param dependency the dependency to set data on +514 * @param pom the information from the pom +515 * @param pomProperties the pom properties file (null if none exists) +516 * @param classes a collection of ClassNameInformation - containing data about the fully qualified class names +517 * within the JAR file being analyzed +518 * @return true if there was evidence within the pom that we could use; otherwise false +519 */ +520 private boolean setPomEvidence(Dependency dependency, Model pom, Properties pomProperties, ArrayList<ClassNameInformation> classes) { +521 boolean foundSomething = false; +522 if (pom == null) { +523 return foundSomething; +524 } +525 String groupid = interpolateString(pom.getGroupId(), pomProperties); +526 if (groupid != null && !groupid.isEmpty()) { +527 if (groupid.startsWith("org.") || groupid.startsWith("com.")) { +528 groupid = groupid.substring(4); +529 } +530 foundSomething = true; +531 dependency.getVendorEvidence().addEvidence("pom", "groupid", groupid, Confidence.HIGH); +532 dependency.getProductEvidence().addEvidence("pom", "groupid", groupid, Confidence.LOW); +533 addMatchingValues(classes, groupid, dependency.getVendorEvidence()); +534 addMatchingValues(classes, groupid, dependency.getProductEvidence()); +535 } +536 String artifactid = interpolateString(pom.getArtifactId(), pomProperties); +537 if (artifactid != null && !artifactid.isEmpty()) { +538 if (artifactid.startsWith("org.") || artifactid.startsWith("com.")) { +539 artifactid = artifactid.substring(4); +540 } +541 foundSomething = true; +542 dependency.getProductEvidence().addEvidence("pom", "artifactid", artifactid, Confidence.HIGH); +543 dependency.getVendorEvidence().addEvidence("pom", "artifactid", artifactid, Confidence.LOW); +544 addMatchingValues(classes, artifactid, dependency.getVendorEvidence()); +545 addMatchingValues(classes, artifactid, dependency.getProductEvidence()); 546 } -547 } -548 -549 /** -550 * <p>Reads the manifest from the JAR file and collects the entries. Some -551 * vendorKey entries are:</p> <ul><li>Implementation Title</li> -552 * <li>Implementation Version</li> <li>Implementation Vendor</li> -553 * <li>Implementation VendorId</li> <li>Bundle Name</li> <li>Bundle -554 * Version</li> <li>Bundle Vendor</li> <li>Bundle Description</li> <li>Main -555 * Class</li> </ul> -556 * However, all but a handful of specific entries are read in. -557 * -558 * @param dependency A reference to the dependency -559 * @param classInformation a collection of class information -560 * @return whether evidence was identified parsing the manifest -561 * @throws IOException if there is an issue reading the JAR file -562 */ -563 protected boolean parseManifest(Dependency dependency, ArrayList<ClassNameInformation> classInformation) throws IOException { -564 boolean foundSomething = false; -565 JarFile jar = null; -566 try { -567 jar = new JarFile(dependency.getActualFilePath()); -568 -569 final Manifest manifest = jar.getManifest(); -570 if (manifest == null) { -571 //don't log this for javadoc or sources jar files -572 if (!dependency.getFileName().toLowerCase().endsWith("-sources.jar") -573 && !dependency.getFileName().toLowerCase().endsWith("-javadoc.jar") -574 && !dependency.getFileName().toLowerCase().endsWith("-src.jar") -575 && !dependency.getFileName().toLowerCase().endsWith("-doc.jar")) { -576 Logger.getLogger(JarAnalyzer.class.getName()).log(Level.INFO, -577 String.format("Jar file '%s' does not contain a manifest.", -578 dependency.getFileName())); -579 } -580 return false; +547 //version +548 final String version = interpolateString(pom.getVersion(), pomProperties); +549 if (version != null && !version.isEmpty()) { +550 foundSomething = true; +551 dependency.getVersionEvidence().addEvidence("pom", "version", version, Confidence.HIGHEST); +552 } +553 // org name +554 final Organization org = pom.getOrganization(); +555 if (org != null && org.getName() != null) { +556 foundSomething = true; +557 final String orgName = interpolateString(org.getName(), pomProperties); +558 if (orgName != null && !orgName.isEmpty()) { +559 dependency.getVendorEvidence().addEvidence("pom", "organization name", orgName, Confidence.HIGH); +560 addMatchingValues(classes, orgName, dependency.getVendorEvidence()); +561 } +562 } +563 //pom name +564 final String pomName = interpolateString(pom.getName(), pomProperties); +565 if (pomName != null && !pomName.isEmpty()) { +566 foundSomething = true; +567 dependency.getProductEvidence().addEvidence("pom", "name", pomName, Confidence.HIGH); +568 dependency.getVendorEvidence().addEvidence("pom", "name", pomName, Confidence.HIGH); +569 addMatchingValues(classes, pomName, dependency.getVendorEvidence()); +570 addMatchingValues(classes, pomName, dependency.getProductEvidence()); +571 } +572 +573 //Description +574 if (pom.getDescription() != null) { +575 foundSomething = true; +576 final String description = interpolateString(pom.getDescription(), pomProperties); +577 if (description != null && !description.isEmpty()) { +578 addDescription(dependency, description, "pom", "description"); +579 addMatchingValues(classes, description, dependency.getVendorEvidence()); +580 addMatchingValues(classes, description, dependency.getProductEvidence()); 581 } -582 final Attributes atts = manifest.getMainAttributes(); +582 } 583 -584 final EvidenceCollection vendorEvidence = dependency.getVendorEvidence(); -585 final EvidenceCollection productEvidence = dependency.getProductEvidence(); -586 final EvidenceCollection versionEvidence = dependency.getVersionEvidence(); -587 -588 final String source = "Manifest"; -589 -590 for (Entry<Object, Object> entry : atts.entrySet()) { -591 String key = entry.getKey().toString(); -592 String value = atts.getValue(key); -593 if (HTML_DETECTION_PATTERN.matcher(value).find()) { -594 value = Jsoup.parse(value).text(); -595 } -596 if (IGNORE_VALUES.contains(value)) { -597 continue; -598 } else if (key.equalsIgnoreCase(Attributes.Name.IMPLEMENTATION_TITLE.toString())) { -599 foundSomething = true; -600 productEvidence.addEvidence(source, key, value, Evidence.Confidence.HIGH); -601 addMatchingValues(classInformation, value, productEvidence); -602 } else if (key.equalsIgnoreCase(Attributes.Name.IMPLEMENTATION_VERSION.toString())) { -603 foundSomething = true; -604 versionEvidence.addEvidence(source, key, value, Evidence.Confidence.HIGH); -605 } else if (key.equalsIgnoreCase(Attributes.Name.IMPLEMENTATION_VENDOR.toString())) { -606 foundSomething = true; -607 vendorEvidence.addEvidence(source, key, value, Evidence.Confidence.HIGH); -608 addMatchingValues(classInformation, value, vendorEvidence); -609 } else if (key.equalsIgnoreCase(Attributes.Name.IMPLEMENTATION_VENDOR_ID.toString())) { -610 foundSomething = true; -611 vendorEvidence.addEvidence(source, key, value, Evidence.Confidence.MEDIUM); -612 addMatchingValues(classInformation, value, vendorEvidence); -613 } else if (key.equalsIgnoreCase(BUNDLE_DESCRIPTION)) { -614 foundSomething = true; -615 addDescription(dependency, value, "manifest", key); -616 //productEvidence.addEvidence(source, key, value, Evidence.Confidence.MEDIUM); -617 addMatchingValues(classInformation, value, productEvidence); -618 } else if (key.equalsIgnoreCase(BUNDLE_NAME)) { -619 foundSomething = true; -620 productEvidence.addEvidence(source, key, value, Evidence.Confidence.MEDIUM); -621 addMatchingValues(classInformation, value, productEvidence); -622 } else if (key.equalsIgnoreCase(BUNDLE_VENDOR)) { -623 foundSomething = true; -624 vendorEvidence.addEvidence(source, key, value, Evidence.Confidence.HIGH); -625 addMatchingValues(classInformation, value, vendorEvidence); -626 } else if (key.equalsIgnoreCase(BUNDLE_VERSION)) { -627 foundSomething = true; -628 versionEvidence.addEvidence(source, key, value, Evidence.Confidence.HIGH); -629 } else if (key.equalsIgnoreCase(Attributes.Name.MAIN_CLASS.toString())) { -630 continue; -631 //skipping main class as if this has important information to add -632 // it will be added during class name analysis... if other fields -633 // have the information from the class name then they will get added... -634 // foundSomething = true; -635 // productEvidence.addEvidence(source, key, value, Evidence.Confidence.MEDIUM); -636 // vendorEvidence.addEvidence(source, key, value, Evidence.Confidence.MEDIUM); -637 // addMatchingValues(classInformation, value, vendorEvidence); -638 // addMatchingValues(classInformation, value, productEvidence); -639 } else { -640 key = key.toLowerCase(); -641 -642 if (!IGNORE_KEYS.contains(key) -643 && !key.endsWith("jdk") -644 && !key.contains("lastmodified") -645 && !key.endsWith("package") -646 && !key.endsWith("classpath") -647 && !key.endsWith("class-path") -648 && !key.endsWith("-scm") //todo change this to a regex? -649 && !key.startsWith("scm-") -650 && !isImportPackage(key, value) -651 && !isPackage(key, value)) { -652 -653 foundSomething = true; -654 if (key.contains("version")) { -655 if (key.contains("specification")) { -656 versionEvidence.addEvidence(source, key, value, Evidence.Confidence.LOW); -657 } else { -658 versionEvidence.addEvidence(source, key, value, Evidence.Confidence.MEDIUM); -659 } -660 -661 } else if (key.contains("title")) { -662 productEvidence.addEvidence(source, key, value, Evidence.Confidence.MEDIUM); -663 addMatchingValues(classInformation, value, productEvidence); -664 } else if (key.contains("vendor")) { -665 if (key.contains("specification")) { -666 vendorEvidence.addEvidence(source, key, value, Evidence.Confidence.LOW); -667 } else { -668 vendorEvidence.addEvidence(source, key, value, Evidence.Confidence.MEDIUM); -669 addMatchingValues(classInformation, value, vendorEvidence); -670 } -671 } else if (key.contains("name")) { -672 productEvidence.addEvidence(source, key, value, Evidence.Confidence.MEDIUM); -673 vendorEvidence.addEvidence(source, key, value, Evidence.Confidence.MEDIUM); -674 addMatchingValues(classInformation, value, vendorEvidence); -675 addMatchingValues(classInformation, value, productEvidence); -676 } else if (key.contains("license")) { -677 addLicense(dependency, value); -678 } else { -679 if (key.contains("description")) { -680 addDescription(dependency, value, "manifest", key); -681 } else { -682 productEvidence.addEvidence(source, key, value, Evidence.Confidence.LOW); -683 vendorEvidence.addEvidence(source, key, value, Evidence.Confidence.LOW); -684 addMatchingValues(classInformation, value, vendorEvidence); -685 addMatchingValues(classInformation, value, productEvidence); -686 if (value.matches(".*\\d.*")) { -687 final StringTokenizer tokenizer = new StringTokenizer(value, " "); -688 while (tokenizer.hasMoreElements()) { -689 final String s = tokenizer.nextToken(); -690 if (s.matches("^[0-9.]+$")) { -691 versionEvidence.addEvidence(source, key, s, Evidence.Confidence.LOW); -692 } -693 } -694 } -695 } -696 } -697 } -698 } -699 } -700 } finally { -701 if (jar != null) { -702 jar.close(); -703 } -704 } -705 return foundSomething; -706 } -707 -708 /** -709 * Adds a description to the given dependency. -710 * -711 * @param dependency a dependency -712 * @param description the description -713 * @param source the source of the evidence -714 * @param key the "name" of the evidence -715 */ -716 private void addDescription(Dependency dependency, String description, String source, String key) { -717 if (dependency.getDescription() == null) { -718 dependency.setDescription(description); -719 } -720 String desc; -721 if (HTML_DETECTION_PATTERN.matcher(description).find()) { -722 desc = Jsoup.parse(description).text(); -723 } else { -724 desc = description; -725 } -726 dependency.setDescription(desc); -727 if (desc.length() > 100) { -728 final int posSuchAs = desc.toLowerCase().indexOf("such as ", 100); -729 final int posLike = desc.toLowerCase().indexOf("like ", 100); -730 int pos = -1; -731 if (posLike > 0 && posSuchAs > 0) { -732 pos = posLike > posSuchAs ? posLike : posSuchAs; -733 } else if (posLike > 0) { -734 pos = posLike; -735 } else if (posSuchAs > 0) { -736 pos = posSuchAs; -737 } -738 String descToUse = desc; -739 if (pos > 0) { -740 final StringBuilder sb = new StringBuilder(pos + 3); -741 sb.append(desc.substring(0, pos)); -742 sb.append("..."); -743 descToUse = sb.toString(); -744 } -745 dependency.getProductEvidence().addEvidence(source, key, descToUse, Evidence.Confidence.LOW); -746 dependency.getVendorEvidence().addEvidence(source, key, descToUse, Evidence.Confidence.LOW); -747 } else { -748 dependency.getProductEvidence().addEvidence(source, key, desc, Evidence.Confidence.MEDIUM); -749 dependency.getVendorEvidence().addEvidence(source, key, desc, Evidence.Confidence.MEDIUM); -750 } -751 } -752 -753 /** -754 * Adds a license to the given dependency. -755 * -756 * @param d a dependency -757 * @param license the license -758 */ -759 private void addLicense(Dependency d, String license) { -760 if (d.getLicense() == null) { -761 d.setLicense(license); -762 } else if (!d.getLicense().contains(license)) { -763 d.setLicense(d.getLicense() + NEWLINE + license); -764 } -765 } -766 -767 /** -768 * The initialize method does nothing for this Analyzer. -769 */ -770 public void initialize() { -771 //do nothing -772 } -773 -774 /** -775 * The close method does nothing for this Analyzer. -776 */ -777 public void close() { -778 //do nothing -779 } -780 -781 /** -782 * <p>A utility function that will interpolate strings based on values given -783 * in the properties file. It will also interpolate the strings contained -784 * within the properties file so that properties can reference other -785 * properties.</p> -786 * <p><b>Note:</b> if there is no property found the reference will be -787 * removed. In other words, if the interpolated string will be replaced with -788 * an empty string. -789 * </p> -790 * <p>Example:</p> -791 * <code> -792 * Properties p = new Properties(); -793 * p.setProperty("key", "value"); -794 * String s = interpolateString("'${key}' and '${nothing}'", p); -795 * System.out.println(s); -796 * </code> -797 * <p>Will result in:</p> -798 * <code> -799 * 'value' and '' -800 * </code> -801 * -802 * @param text the string that contains references to properties. -803 * @param properties a collection of properties that may be referenced -804 * within the text. -805 * @return the interpolated text. -806 */ -807 protected String interpolateString(String text, Properties properties) { -808 Properties props = properties; -809 if (text == null) { -810 return text; -811 } -812 if (props == null) { -813 props = new Properties(); +584 //license +585 if (pom.getLicenses() != null) { +586 String license = null; +587 for (License lic : pom.getLicenses().getLicense()) { +588 String tmp = null; +589 if (lic.getName() != null) { +590 tmp = interpolateString(lic.getName(), pomProperties); +591 } +592 if (lic.getUrl() != null) { +593 if (tmp == null) { +594 tmp = interpolateString(lic.getUrl(), pomProperties); +595 } else { +596 tmp += ": " + interpolateString(lic.getUrl(), pomProperties); +597 } +598 } +599 if (tmp == null) { +600 continue; +601 } +602 if (HTML_DETECTION_PATTERN.matcher(tmp).find()) { +603 tmp = Jsoup.parse(tmp).text(); +604 } +605 if (license == null) { +606 license = tmp; +607 } else { +608 license += "\n" + tmp; +609 } +610 } +611 if (license != null) { +612 dependency.setLicense(license); +613 } +614 } +615 return foundSomething; +616 } +617 +618 /** +619 * Analyzes the path information of the classes contained within the JarAnalyzer to try and determine possible +620 * vendor or product names. If any are found they are stored in the packageVendor and packageProduct hashSets. +621 * +622 * @param classNames a list of class names +623 * @param dependency a dependency to analyze +624 * @param addPackagesAsEvidence a flag indicating whether or not package names should be added as evidence. +625 */ +626 protected void analyzePackageNames(ArrayList<ClassNameInformation> classNames, +627 Dependency dependency, boolean addPackagesAsEvidence) { +628 final HashMap<String, Integer> vendorIdentifiers = new HashMap<String, Integer>(); +629 final HashMap<String, Integer> productIdentifiers = new HashMap<String, Integer>(); +630 analyzeFullyQualifiedClassNames(classNames, vendorIdentifiers, productIdentifiers); +631 +632 final int classCount = classNames.size(); +633 final EvidenceCollection vendor = dependency.getVendorEvidence(); +634 final EvidenceCollection product = dependency.getProductEvidence(); +635 +636 for (Map.Entry<String, Integer> entry : vendorIdentifiers.entrySet()) { +637 final float ratio = entry.getValue() / (float) classCount; +638 if (ratio > 0.5) { +639 //TODO remove weighting +640 vendor.addWeighting(entry.getKey()); +641 if (addPackagesAsEvidence && entry.getKey().length() > 1) { +642 vendor.addEvidence("jar", "package", entry.getKey(), Confidence.LOW); +643 } +644 } +645 } +646 for (Map.Entry<String, Integer> entry : productIdentifiers.entrySet()) { +647 final float ratio = entry.getValue() / (float) classCount; +648 if (ratio > 0.5) { +649 product.addWeighting(entry.getKey()); +650 if (addPackagesAsEvidence && entry.getKey().length() > 1) { +651 product.addEvidence("jar", "package", entry.getKey(), Confidence.LOW); +652 } +653 } +654 } +655 } +656 +657 /** +658 * <p> +659 * Reads the manifest from the JAR file and collects the entries. Some vendorKey entries are:</p> +660 * <ul><li>Implementation Title</li> +661 * <li>Implementation Version</li> <li>Implementation Vendor</li> +662 * <li>Implementation VendorId</li> <li>Bundle Name</li> <li>Bundle Version</li> <li>Bundle Vendor</li> <li>Bundle +663 * Description</li> <li>Main Class</li> </ul> +664 * However, all but a handful of specific entries are read in. +665 * +666 * @param dependency A reference to the dependency +667 * @param classInformation a collection of class information +668 * @return whether evidence was identified parsing the manifest +669 * @throws IOException if there is an issue reading the JAR file +670 */ +671 protected boolean parseManifest(Dependency dependency, ArrayList<ClassNameInformation> classInformation) throws IOException { +672 boolean foundSomething = false; +673 JarFile jar = null; +674 try { +675 jar = new JarFile(dependency.getActualFilePath()); +676 +677 final Manifest manifest = jar.getManifest(); +678 +679 if (manifest == null) { +680 //don't log this for javadoc or sources jar files +681 if (!dependency.getFileName().toLowerCase().endsWith("-sources.jar") +682 && !dependency.getFileName().toLowerCase().endsWith("-javadoc.jar") +683 && !dependency.getFileName().toLowerCase().endsWith("-src.jar") +684 && !dependency.getFileName().toLowerCase().endsWith("-doc.jar")) { +685 Logger.getLogger(JarAnalyzer.class +686 .getName()).log(Level.INFO, +687 String.format("Jar file '%s' does not contain a manifest.", +688 dependency.getFileName())); +689 } +690 return false; +691 } +692 final Attributes atts = manifest.getMainAttributes(); +693 +694 final EvidenceCollection vendorEvidence = dependency.getVendorEvidence(); +695 final EvidenceCollection productEvidence = dependency.getProductEvidence(); +696 final EvidenceCollection versionEvidence = dependency.getVersionEvidence(); +697 +698 final String source = "Manifest"; +699 +700 for (Entry<Object, Object> entry : atts.entrySet()) { +701 String key = entry.getKey().toString(); +702 String value = atts.getValue(key); +703 if (HTML_DETECTION_PATTERN.matcher(value).find()) { +704 value = Jsoup.parse(value).text(); +705 } +706 if (IGNORE_VALUES.contains(value)) { +707 continue; +708 } else if (key.equalsIgnoreCase(Attributes.Name.IMPLEMENTATION_TITLE.toString())) { +709 foundSomething = true; +710 productEvidence.addEvidence(source, key, value, Confidence.HIGH); +711 addMatchingValues(classInformation, value, productEvidence); +712 } else if (key.equalsIgnoreCase(Attributes.Name.IMPLEMENTATION_VERSION.toString())) { +713 foundSomething = true; +714 versionEvidence.addEvidence(source, key, value, Confidence.HIGH); +715 } else if (key.equalsIgnoreCase(Attributes.Name.IMPLEMENTATION_VENDOR.toString())) { +716 foundSomething = true; +717 vendorEvidence.addEvidence(source, key, value, Confidence.HIGH); +718 addMatchingValues(classInformation, value, vendorEvidence); +719 } else if (key.equalsIgnoreCase(Attributes.Name.IMPLEMENTATION_VENDOR_ID.toString())) { +720 foundSomething = true; +721 vendorEvidence.addEvidence(source, key, value, Confidence.MEDIUM); +722 addMatchingValues(classInformation, value, vendorEvidence); +723 } else if (key.equalsIgnoreCase(BUNDLE_DESCRIPTION)) { +724 foundSomething = true; +725 addDescription(dependency, value, "manifest", key); +726 //productEvidence.addEvidence(source, key, value, Confidence.MEDIUM); +727 addMatchingValues(classInformation, value, productEvidence); +728 } else if (key.equalsIgnoreCase(BUNDLE_NAME)) { +729 foundSomething = true; +730 productEvidence.addEvidence(source, key, value, Confidence.MEDIUM); +731 addMatchingValues(classInformation, value, productEvidence); +732 } else if (key.equalsIgnoreCase(BUNDLE_VENDOR)) { +733 foundSomething = true; +734 vendorEvidence.addEvidence(source, key, value, Confidence.HIGH); +735 addMatchingValues(classInformation, value, vendorEvidence); +736 } else if (key.equalsIgnoreCase(BUNDLE_VERSION)) { +737 foundSomething = true; +738 versionEvidence.addEvidence(source, key, value, Confidence.HIGH); +739 } else if (key.equalsIgnoreCase(Attributes.Name.MAIN_CLASS.toString())) { +740 continue; +741 //skipping main class as if this has important information to add +742 // it will be added during class name analysis... if other fields +743 // have the information from the class name then they will get added... +744 // foundSomething = true; +745 // productEvidence.addEvidence(source, key, value, Confidence.MEDIUM); +746 // vendorEvidence.addEvidence(source, key, value, Confidence.MEDIUM); +747 // addMatchingValues(classInformation, value, vendorEvidence); +748 // addMatchingValues(classInformation, value, productEvidence); +749 } else { +750 key = key.toLowerCase(); +751 +752 if (!IGNORE_KEYS.contains(key) +753 && !key.endsWith("jdk") +754 && !key.contains("lastmodified") +755 && !key.endsWith("package") +756 && !key.endsWith("classpath") +757 && !key.endsWith("class-path") +758 && !key.endsWith("-scm") //todo change this to a regex? +759 && !key.startsWith("scm-") +760 && !isImportPackage(key, value) +761 && !isPackage(key, value)) { +762 +763 foundSomething = true; +764 if (key.contains("version")) { +765 if (key.contains("specification")) { +766 versionEvidence.addEvidence(source, key, value, Confidence.LOW); +767 } else { +768 versionEvidence.addEvidence(source, key, value, Confidence.MEDIUM); +769 } +770 +771 } else if (key.contains("title")) { +772 productEvidence.addEvidence(source, key, value, Confidence.MEDIUM); +773 addMatchingValues(classInformation, value, productEvidence); +774 } else if (key.contains("vendor")) { +775 if (key.contains("specification")) { +776 vendorEvidence.addEvidence(source, key, value, Confidence.LOW); +777 } else { +778 vendorEvidence.addEvidence(source, key, value, Confidence.MEDIUM); +779 addMatchingValues(classInformation, value, vendorEvidence); +780 } +781 } else if (key.contains("name")) { +782 productEvidence.addEvidence(source, key, value, Confidence.MEDIUM); +783 vendorEvidence.addEvidence(source, key, value, Confidence.MEDIUM); +784 addMatchingValues(classInformation, value, vendorEvidence); +785 addMatchingValues(classInformation, value, productEvidence); +786 } else if (key.contains("license")) { +787 addLicense(dependency, value); +788 } else { +789 if (key.contains("description")) { +790 addDescription(dependency, value, "manifest", key); +791 } else { +792 productEvidence.addEvidence(source, key, value, Confidence.LOW); +793 vendorEvidence.addEvidence(source, key, value, Confidence.LOW); +794 addMatchingValues(classInformation, value, vendorEvidence); +795 addMatchingValues(classInformation, value, productEvidence); +796 if (value.matches(".*\\d.*")) { +797 final StringTokenizer tokenizer = new StringTokenizer(value, " "); +798 while (tokenizer.hasMoreElements()) { +799 final String s = tokenizer.nextToken(); +800 if (s.matches("^[0-9.]+$")) { +801 versionEvidence.addEvidence(source, key, s, Confidence.LOW); +802 } +803 } +804 } +805 } +806 } +807 } +808 } +809 } +810 } finally { +811 if (jar != null) { +812 jar.close(); +813 } 814 } -815 -816 final int pos = text.indexOf("${"); -817 if (pos < 0) { -818 return text; -819 } -820 final int end = text.indexOf("}"); -821 if (end < pos) { -822 return text; -823 } -824 -825 final String propName = text.substring(pos + 2, end); -826 String propValue = interpolateString(props.getProperty(propName), props); -827 if (propValue == null) { -828 propValue = ""; +815 return foundSomething; +816 } +817 +818 /** +819 * Adds a description to the given dependency. +820 * +821 * @param dependency a dependency +822 * @param description the description +823 * @param source the source of the evidence +824 * @param key the "name" of the evidence +825 */ +826 private void addDescription(Dependency dependency, String description, String source, String key) { +827 if (dependency.getDescription() == null) { +828 dependency.setDescription(description); 829 } -830 final StringBuilder sb = new StringBuilder(propValue.length() + text.length()); -831 sb.append(text.subSequence(0, pos)); -832 sb.append(propValue); -833 sb.append(text.substring(end + 1)); -834 return interpolateString(sb.toString(), props); //yes yes, this should be a loop... -835 } -836 -837 /** -838 * Determines if the key value pair from the manifest is for an "import" -839 * type entry for package names. -840 * -841 * @param key the key from the manifest -842 * @param value the value from the manifest -843 * @return true or false depending on if it is believed the entry is an -844 * "import" entry -845 */ -846 private boolean isImportPackage(String key, String value) { -847 final Pattern packageRx = Pattern.compile("^((([a-zA-Z_#\\$0-9]\\.)+)\\s*\\;\\s*)+$"); -848 if (packageRx.matcher(value).matches()) { -849 return (key.contains("import") || key.contains("include")); -850 } -851 return false; -852 } -853 -854 /** -855 * Cycles through an enumeration of JarEntries, contained within the -856 * dependency, and returns a list of the class names. This does not include -857 * core Java package names (i.e. java.* or javax.*). -858 * -859 * @param dependency the dependency being analyzed -860 * @return an list of fully qualified class names -861 */ -862 private ArrayList<ClassNameInformation> collectClassNames(Dependency dependency) { -863 final ArrayList<ClassNameInformation> classNames = new ArrayList<ClassNameInformation>(); -864 JarFile jar = null; -865 try { -866 jar = new JarFile(dependency.getActualFilePath()); -867 final Enumeration entries = jar.entries(); -868 while (entries.hasMoreElements()) { -869 final JarEntry entry = (JarEntry) entries.nextElement(); -870 final String name = entry.getName().toLowerCase(); -871 //no longer stripping "|com\\.sun" - there are some com.sun jar files with CVEs. -872 if (name.endsWith(".class") && !name.matches("^javax?\\..*$")) { -873 final ClassNameInformation className = new ClassNameInformation(name.substring(0, name.length() - 6)); -874 classNames.add(className); -875 } -876 } -877 } catch (IOException ex) { -878 final String msg = String.format("Unable to open jar file '%s'.", dependency.getFileName()); -879 Logger.getLogger(JarAnalyzer.class.getName()).log(Level.WARNING, msg); -880 Logger.getLogger(JarAnalyzer.class.getName()).log(Level.FINE, null, ex); -881 } finally { -882 if (jar != null) { -883 try { -884 jar.close(); -885 } catch (IOException ex) { -886 Logger.getLogger(JarAnalyzer.class.getName()).log(Level.FINEST, null, ex); -887 } -888 } -889 } -890 return classNames; -891 } -892 -893 /** -894 * Cycles through the list of class names and places the package levels 0-3 -895 * into the provided maps for vendor and product. This is helpful when -896 * analyzing vendor/product as many times this is included in the package -897 * name. -898 * -899 * @param classNames a list of class names -900 * @param vendor HashMap of possible vendor names from package names (e.g. -901 * owasp) -902 * @param product HashMap of possible product names from package names (e.g. -903 * dependencycheck) -904 */ -905 private void analyzeFullyQualifiedClassNames(ArrayList<ClassNameInformation> classNames, -906 HashMap<String, Integer> vendor, HashMap<String, Integer> product) { -907 for (ClassNameInformation entry : classNames) { -908 final ArrayList<String> list = entry.getPackageStructure(); -909 addEntry(vendor, list.get(0)); -910 -911 if (list.size() == 2) { -912 addEntry(product, list.get(1)); -913 } -914 if (list.size() == 3) { -915 addEntry(vendor, list.get(1)); -916 addEntry(product, list.get(1)); -917 addEntry(product, list.get(2)); -918 } -919 if (list.size() >= 4) { -920 addEntry(vendor, list.get(1)); -921 addEntry(vendor, list.get(2)); -922 addEntry(product, list.get(1)); -923 addEntry(product, list.get(2)); -924 addEntry(product, list.get(3)); -925 } -926 } -927 } -928 -929 /** -930 * Adds an entry to the specified collection and sets the Integer (e.g. the -931 * count) to 1. If the entry already exists in the collection then the -932 * Integer is incremented by 1. -933 * -934 * @param collection a collection of strings and their occurrence count -935 * @param key the key to add to the collection -936 */ -937 private void addEntry(HashMap<String, Integer> collection, String key) { -938 if (collection.containsKey(key)) { -939 collection.put(key, collection.get(key) + 1); -940 } else { -941 collection.put(key, 1); -942 } -943 } -944 -945 /** -946 * Cycles through the collection of class name information to see if parts -947 * of the package names are contained in the provided value. If found, it -948 * will be added as the HIGHEST confidence evidence because we have more -949 * then one source corroborating the value. -950 * -951 * @param classes a collection of class name information -952 * @param value the value to check to see if it contains a package name -953 * @param evidence the evidence collection to add new entries too -954 */ -955 private void addMatchingValues(ArrayList<ClassNameInformation> classes, String value, EvidenceCollection evidence) { -956 if (value == null || value.isEmpty()) { -957 return; -958 } -959 final String text = value.toLowerCase(); -960 for (ClassNameInformation cni : classes) { -961 for (String key : cni.getPackageStructure()) { -962 if (text.contains(key)) { //note, package structure elements are already lowercase. -963 evidence.addEvidence("jar", "package name", key, Evidence.Confidence.HIGHEST); -964 } -965 } +830 String desc; +831 if (HTML_DETECTION_PATTERN.matcher(description).find()) { +832 desc = Jsoup.parse(description).text(); +833 } else { +834 desc = description; +835 } +836 dependency.setDescription(desc); +837 if (desc.length() > 100) { +838 final int posSuchAs = desc.toLowerCase().indexOf("such as ", 100); +839 final int posLike = desc.toLowerCase().indexOf("like ", 100); +840 int pos = -1; +841 if (posLike > 0 && posSuchAs > 0) { +842 pos = posLike > posSuchAs ? posLike : posSuchAs; +843 } else if (posLike > 0) { +844 pos = posLike; +845 } else if (posSuchAs > 0) { +846 pos = posSuchAs; +847 } +848 String descToUse = desc; +849 if (pos > 0) { +850 final StringBuilder sb = new StringBuilder(pos + 3); +851 sb.append(desc.substring(0, pos)); +852 sb.append("..."); +853 descToUse = sb.toString(); +854 } +855 dependency.getProductEvidence().addEvidence(source, key, descToUse, Confidence.LOW); +856 dependency.getVendorEvidence().addEvidence(source, key, descToUse, Confidence.LOW); +857 } else { +858 dependency.getProductEvidence().addEvidence(source, key, desc, Confidence.MEDIUM); +859 dependency.getVendorEvidence().addEvidence(source, key, desc, Confidence.MEDIUM); +860 } +861 } +862 +863 /** +864 * Adds a license to the given dependency. +865 * +866 * @param d a dependency +867 * @param license the license +868 */ +869 private void addLicense(Dependency d, String license) { +870 if (d.getLicense() == null) { +871 d.setLicense(license); +872 } else if (!d.getLicense().contains(license)) { +873 d.setLicense(d.getLicense() + NEWLINE + license); +874 } +875 } +876 +877 /** +878 * The parent directory for the individual directories per archive. +879 */ +880 private File tempFileLocation = null; +881 +882 /** +883 * The initialize method does nothing for this Analyzer. +884 * +885 * @throws Exception is thrown if there is an exception creating a temporary directory +886 */ +887 @Override +888 public void initialize() throws Exception { +889 final File baseDir = Settings.getTempDirectory(); +890 if (!baseDir.exists()) { +891 if (!baseDir.mkdirs()) { +892 final String msg = String.format("Unable to make a temporary folder '%s'", baseDir.getPath()); +893 throw new AnalysisException(msg); +894 } +895 } +896 tempFileLocation = File.createTempFile("check", "tmp", baseDir); +897 if (!tempFileLocation.delete()) { +898 final String msg = String.format("Unable to delete temporary file '%s'.", tempFileLocation.getAbsolutePath()); +899 throw new AnalysisException(msg); +900 } +901 if (!tempFileLocation.mkdirs()) { +902 final String msg = String.format("Unable to create directory '%s'.", tempFileLocation.getAbsolutePath()); +903 throw new AnalysisException(msg); +904 } +905 } +906 +907 /** +908 * Deletes any files extracted from the JAR during analysis. +909 */ +910 @Override +911 public void close() { +912 if (tempFileLocation != null && tempFileLocation.exists()) { +913 FileUtils.deleteRecursive(tempFileLocation.getAbsolutePath(), true); +914 } +915 } +916 +917 /** +918 * <p> +919 * A utility function that will interpolate strings based on values given in the properties file. It will also +920 * interpolate the strings contained within the properties file so that properties can reference other +921 * properties.</p> +922 * <p> +923 * <b>Note:</b> if there is no property found the reference will be removed. In other words, if the interpolated +924 * string will be replaced with an empty string. +925 * </p> +926 * <p> +927 * Example:</p> +928 * <code> +929 * Properties p = new Properties(); +930 * p.setProperty("key", "value"); +931 * String s = interpolateString("'${key}' and '${nothing}'", p); +932 * System.out.println(s); +933 * </code> +934 * <p> +935 * Will result in:</p> +936 * <code> +937 * 'value' and '' +938 * </code> +939 * +940 * @param text the string that contains references to properties. +941 * @param properties a collection of properties that may be referenced within the text. +942 * @return the interpolated text. +943 */ +944 protected String interpolateString(String text, Properties properties) { +945 Properties props = properties; +946 if (text == null) { +947 return text; +948 } +949 if (props == null) { +950 props = new Properties(); +951 } +952 +953 final int pos = text.indexOf("${"); +954 if (pos < 0) { +955 return text; +956 } +957 final int end = text.indexOf("}"); +958 if (end < pos) { +959 return text; +960 } +961 +962 final String propName = text.substring(pos + 2, end); +963 String propValue = interpolateString(props.getProperty(propName), props); +964 if (propValue == null) { +965 propValue = ""; 966 } -967 } -968 -969 /** -970 * <p><b>This is currently a failed implementation.</b> Part of the issue is -971 * I was trying to solve the wrong problem. Instead of multiple POMs being -972 * in the JAR to just add information about dependencies - I didn't realize -973 * until later that I was looking at an uber-jar (aka fat-jar) that included -974 * all of its dependencies.</p> -975 * <p>I'm leaving this method in the source tree, entirely commented out -976 * until a solution https://github.com/jeremylong/DependencyCheck/issues/11 -977 * has been implemented.</p> -978 * <p>Takes a list of pom entries from a JAR file and attempts to filter it -979 * down to the pom related to the jar (rather then the pom entry for a -980 * dependency).</p> -981 * -982 * @param pomEntries a list of pom entries -983 * @param classes a list of fully qualified classes from the JAR file -984 * @return the list of pom entries that are associated with the jar being -985 * analyzed rather then the dependent poms -986 */ -987 private List<String> filterPomEntries(List<String> pomEntries, ArrayList<ClassNameInformation> classes) { -988 return pomEntries; -989 // final HashMap<String, Integer> usePoms = new HashMap<String, Integer>(); -990 // final ArrayList<String> possiblePoms = new ArrayList<String>(); -991 // for (String entry : pomEntries) { -992 // //todo validate that the starts with is correct... or does it start with a ./ or /? -993 // // is it different on different platforms? -994 // if (entry.startsWith("META-INF/maven/")) { -995 // //trim the meta-inf/maven and pom.xml... -996 // final String pomPath = entry.substring(15, entry.length() - 8).toLowerCase(); -997 // final String[] parts = pomPath.split("/"); -998 // if (parts == null || parts.length != 2) { //misplaced pom? -999 // //TODO add logging to FINE -1000 // possiblePoms.add(entry); -1001 // } -1002 // parts[0] = parts[0].replace('.', '/'); -1003 // parts[1] = parts[1].replace('.', '/'); -1004 // for (ClassNameInformation cni : classes) { -1005 // final String name = cni.getName(); -1006 // if (StringUtils.containsIgnoreCase(name, parts[0])) { -1007 // addEntry(usePoms, entry); -1008 // } -1009 // if (StringUtils.containsIgnoreCase(name, parts[1])) { -1010 // addEntry(usePoms, entry); -1011 // } -1012 // } -1013 // } else { // we have a JAR file with an incorrect POM layout... -1014 // //TODO add logging to FINE -1015 // possiblePoms.add(entry); -1016 // } -1017 // } -1018 // List<String> retValue; -1019 // if (usePoms.isEmpty()) { -1020 // if (possiblePoms.isEmpty()) { -1021 // retValue = pomEntries; -1022 // } else { -1023 // retValue = possiblePoms; -1024 // } -1025 // } else { -1026 // retValue = new ArrayList<String>(); -1027 // int maxCount = 0; -1028 // for (Map.Entry<String, Integer> entry : usePoms.entrySet()) { -1029 // final int current = entry.getValue().intValue(); -1030 // if (current > maxCount) { -1031 // maxCount = current; -1032 // retValue.clear(); -1033 // retValue.add(entry.getKey()); -1034 // } else if (current == maxCount) { -1035 // retValue.add(entry.getKey()); -1036 // } -1037 // } -1038 // } -1039 // return retValue; -1040 } -1041 -1042 /** -1043 * Simple check to see if the attribute from a manifest is just a package -1044 * name. -1045 * -1046 * @param key the key of the value to check -1047 * @param value the value to check -1048 * @return true if the value looks like a java package name, otherwise false -1049 */ -1050 private boolean isPackage(String key, String value) { -1051 -1052 return !key.matches(".*(version|title|vendor|name|license|description).*") -1053 && value.matches("^([a-zA-Z_][a-zA-Z0-9_\\$]*(\\.[a-zA-Z_][a-zA-Z0-9_\\$]*)*)?$"); -1054 } -1055 -1056 /** -1057 * Stores information about a class name. -1058 */ -1059 protected static class ClassNameInformation { -1060 -1061 /** -1062 * Stores information about a given class name. This class will keep the -1063 * fully qualified class name and a list of the important parts of the -1064 * package structure. Up to the first four levels of the package -1065 * structure are stored, excluding a leading "org" or "com". Example: -1066 * <code>ClassNameInformation obj = new ClassNameInformation("org.owasp.dependencycheck.analyzer.JarAnalyzer"); -1067 * System.out.println(obj.getName()); -1068 * for (String p : obj.getPackageStructure()) -1069 * System.out.println(p); -1070 * </code> Would result in: -1071 * <code>org.owasp.dependencycheck.analyzer.JarAnalyzer -1072 * owasp -1073 * dependencycheck -1074 * analyzer -1075 * jaranalyzer</code> -1076 * -1077 * @param className a fully qualified class name -1078 */ -1079 ClassNameInformation(String className) { -1080 name = className; -1081 if (name.contains("/")) { -1082 final String[] tmp = className.toLowerCase().split("/"); -1083 int start = 0; -1084 int end = 3; -1085 if ("com".equals(tmp[0]) || "org".equals(tmp[0])) { -1086 start = 1; -1087 end = 4; -1088 } -1089 if (tmp.length <= end) { -1090 end = tmp.length - 1; -1091 } -1092 for (int i = start; i <= end; i++) { -1093 packageStructure.add(tmp[i]); -1094 } -1095 } else { -1096 packageStructure.add(name); -1097 } -1098 } -1099 /** -1100 * The fully qualified class name. -1101 */ -1102 private String name; -1103 -1104 /** -1105 * Get the value of name -1106 * -1107 * @return the value of name -1108 */ -1109 public String getName() { -1110 return name; -1111 } -1112 -1113 /** -1114 * Set the value of name -1115 * -1116 * @param name new value of name -1117 */ -1118 public void setName(String name) { -1119 this.name = name; -1120 } -1121 /** -1122 * Up to the first four levels of the package structure, excluding a -1123 * leading "org" or "com". -1124 */ -1125 private ArrayList<String> packageStructure = new ArrayList<String>(); -1126 -1127 /** -1128 * Get the value of packageStructure -1129 * -1130 * @return the value of packageStructure -1131 */ -1132 public ArrayList<String> getPackageStructure() { -1133 return packageStructure; -1134 } -1135 } -1136 } +967 final StringBuilder sb = new StringBuilder(propValue.length() + text.length()); +968 sb.append(text.subSequence(0, pos)); +969 sb.append(propValue); +970 sb.append(text.substring(end + 1)); +971 return interpolateString(sb.toString(), props); //yes yes, this should be a loop... +972 } +973 +974 /** +975 * Determines if the key value pair from the manifest is for an "import" type entry for package names. +976 * +977 * @param key the key from the manifest +978 * @param value the value from the manifest +979 * @return true or false depending on if it is believed the entry is an "import" entry +980 */ +981 private boolean isImportPackage(String key, String value) { +982 final Pattern packageRx = Pattern.compile("^((([a-zA-Z_#\\$0-9]\\.)+)\\s*\\;\\s*)+$"); +983 if (packageRx.matcher(value).matches()) { +984 return (key.contains("import") || key.contains("include")); +985 } +986 return false; +987 } +988 +989 /** +990 * Cycles through an enumeration of JarEntries, contained within the dependency, and returns a list of the class +991 * names. This does not include core Java package names (i.e. java.* or javax.*). +992 * +993 * @param dependency the dependency being analyzed +994 * @return an list of fully qualified class names +995 */ +996 private ArrayList<ClassNameInformation> collectClassNames(Dependency dependency) { +997 final ArrayList<ClassNameInformation> classNames = new ArrayList<ClassNameInformation>(); +998 JarFile jar = null; +999 try { +1000 jar = new JarFile(dependency.getActualFilePath()); +1001 final Enumeration entries = jar.entries(); +1002 while (entries.hasMoreElements()) { +1003 final JarEntry entry = (JarEntry) entries.nextElement(); +1004 final String name = entry.getName().toLowerCase(); +1005 //no longer stripping "|com\\.sun" - there are some com.sun jar files with CVEs. +1006 if (name.endsWith(".class") && !name.matches("^javax?\\..*$")) { +1007 final ClassNameInformation className = new ClassNameInformation(name.substring(0, name.length() - 6)); +1008 classNames.add(className); +1009 } +1010 } +1011 } catch (IOException ex) { +1012 final String msg = String.format("Unable to open jar file '%s'.", dependency.getFileName()); +1013 Logger +1014 .getLogger(JarAnalyzer.class +1015 .getName()).log(Level.WARNING, msg); +1016 Logger.getLogger(JarAnalyzer.class +1017 .getName()).log(Level.FINE, null, ex); +1018 } finally { +1019 if (jar != null) { +1020 try { +1021 jar.close(); +1022 } catch (IOException ex) { +1023 Logger.getLogger(JarAnalyzer.class.getName()).log(Level.FINEST, null, ex); +1024 } +1025 } +1026 } +1027 return classNames; +1028 } +1029 +1030 /** +1031 * Cycles through the list of class names and places the package levels 0-3 into the provided maps for vendor and +1032 * product. This is helpful when analyzing vendor/product as many times this is included in the package name. +1033 * +1034 * @param classNames a list of class names +1035 * @param vendor HashMap of possible vendor names from package names (e.g. owasp) +1036 * @param product HashMap of possible product names from package names (e.g. dependencycheck) +1037 */ +1038 private void analyzeFullyQualifiedClassNames(ArrayList<ClassNameInformation> classNames, +1039 HashMap<String, Integer> vendor, HashMap<String, Integer> product) { +1040 for (ClassNameInformation entry : classNames) { +1041 final ArrayList<String> list = entry.getPackageStructure(); +1042 addEntry(vendor, list.get(0)); +1043 +1044 if (list.size() == 2) { +1045 addEntry(product, list.get(1)); +1046 } +1047 if (list.size() == 3) { +1048 addEntry(vendor, list.get(1)); +1049 addEntry(product, list.get(1)); +1050 addEntry(product, list.get(2)); +1051 } +1052 if (list.size() >= 4) { +1053 addEntry(vendor, list.get(1)); +1054 addEntry(vendor, list.get(2)); +1055 addEntry(product, list.get(1)); +1056 addEntry(product, list.get(2)); +1057 addEntry(product, list.get(3)); +1058 } +1059 } +1060 } +1061 +1062 /** +1063 * Adds an entry to the specified collection and sets the Integer (e.g. the count) to 1. If the entry already exists +1064 * in the collection then the Integer is incremented by 1. +1065 * +1066 * @param collection a collection of strings and their occurrence count +1067 * @param key the key to add to the collection +1068 */ +1069 private void addEntry(HashMap<String, Integer> collection, String key) { +1070 if (collection.containsKey(key)) { +1071 collection.put(key, collection.get(key) + 1); +1072 } else { +1073 collection.put(key, 1); +1074 } +1075 } +1076 +1077 /** +1078 * Cycles through the collection of class name information to see if parts of the package names are contained in the +1079 * provided value. If found, it will be added as the HIGHEST confidence evidence because we have more then one +1080 * source corroborating the value. +1081 * +1082 * @param classes a collection of class name information +1083 * @param value the value to check to see if it contains a package name +1084 * @param evidence the evidence collection to add new entries too +1085 */ +1086 private void addMatchingValues(ArrayList<ClassNameInformation> classes, String value, EvidenceCollection evidence) { +1087 if (value == null || value.isEmpty()) { +1088 return; +1089 } +1090 final String text = value.toLowerCase(); +1091 for (ClassNameInformation cni : classes) { +1092 for (String key : cni.getPackageStructure()) { +1093 if (text.contains(key)) { //note, package structure elements are already lowercase. +1094 evidence.addEvidence("jar", "package name", key, Confidence.HIGHEST); +1095 } +1096 } +1097 } +1098 } +1099 +1100 /** +1101 * Simple check to see if the attribute from a manifest is just a package name. +1102 * +1103 * @param key the key of the value to check +1104 * @param value the value to check +1105 * @return true if the value looks like a java package name, otherwise false +1106 */ +1107 private boolean isPackage(String key, String value) { +1108 +1109 return !key.matches(".*(version|title|vendor|name|license|description).*") +1110 && value.matches("^([a-zA-Z_][a-zA-Z0-9_\\$]*(\\.[a-zA-Z_][a-zA-Z0-9_\\$]*)*)?$"); +1111 +1112 } +1113 +1114 /** +1115 * Adds evidence from the POM to the dependency. This includes the GAV and in some situations the parent GAV if +1116 * specified. +1117 * +1118 * @param dependency the dependency being analyzed +1119 * @param pom the POM data +1120 * @param pomProperties the properties file associated with the pom +1121 */ +1122 private void addPomEvidence(Dependency dependency, Model pom, Properties pomProperties) { +1123 if (pom == null) { +1124 return; +1125 } +1126 String groupid = interpolateString(pom.getGroupId(), pomProperties); +1127 if (groupid != null && !groupid.isEmpty()) { +1128 if (groupid.startsWith("org.") || groupid.startsWith("com.")) { +1129 groupid = groupid.substring(4); +1130 } +1131 dependency.getVendorEvidence().addEvidence("pom", "groupid", groupid, Confidence.HIGH); +1132 dependency.getProductEvidence().addEvidence("pom", "groupid", groupid, Confidence.LOW); +1133 } +1134 String artifactid = interpolateString(pom.getArtifactId(), pomProperties); +1135 if (artifactid != null && !artifactid.isEmpty()) { +1136 if (artifactid.startsWith("org.") || artifactid.startsWith("com.")) { +1137 artifactid = artifactid.substring(4); +1138 } +1139 dependency.getProductEvidence().addEvidence("pom", "artifactid", artifactid, Confidence.HIGH); +1140 dependency.getVendorEvidence().addEvidence("pom", "artifactid", artifactid, Confidence.LOW); +1141 } +1142 final String version = interpolateString(pom.getVersion(), pomProperties); +1143 if (version != null && !version.isEmpty()) { +1144 dependency.getVersionEvidence().addEvidence("pom", "version", version, Confidence.HIGHEST); +1145 } +1146 +1147 final Parent parent = pom.getParent(); //grab parent GAV +1148 if (parent != null) { +1149 final String parentGroupId = interpolateString(parent.getGroupId(), pomProperties); +1150 if (parentGroupId != null && !parentGroupId.isEmpty()) { +1151 if (groupid == null || groupid.isEmpty()) { +1152 dependency.getVendorEvidence().addEvidence("pom", "parent.groupid", parentGroupId, Confidence.HIGH); +1153 } else { +1154 dependency.getVendorEvidence().addEvidence("pom", "parent.groupid", parentGroupId, Confidence.MEDIUM); +1155 } +1156 dependency.getProductEvidence().addEvidence("pom", "parent.groupid", parentGroupId, Confidence.LOW); +1157 } +1158 final String parentArtifactId = interpolateString(parent.getArtifactId(), pomProperties); +1159 if (parentArtifactId != null && !parentArtifactId.isEmpty()) { +1160 if (artifactid == null || artifactid.isEmpty()) { +1161 dependency.getProductEvidence().addEvidence("pom", "parent.artifactid", parentArtifactId, Confidence.HIGH); +1162 } else { +1163 dependency.getProductEvidence().addEvidence("pom", "parent.artifactid", parentArtifactId, Confidence.MEDIUM); +1164 } +1165 dependency.getVendorEvidence().addEvidence("pom", "parent.artifactid", parentArtifactId, Confidence.LOW); +1166 } +1167 final String parentVersion = interpolateString(parent.getVersion(), pomProperties); +1168 if (parentVersion != null && !parentVersion.isEmpty()) { +1169 if (version == null || version.isEmpty()) { +1170 dependency.getVersionEvidence().addEvidence("pom", "parent.version", parentVersion, Confidence.HIGH); +1171 } else { +1172 dependency.getVersionEvidence().addEvidence("pom", "parent.version", parentVersion, Confidence.LOW); +1173 } +1174 } +1175 } +1176 // org name +1177 final Organization org = pom.getOrganization(); +1178 if (org != null && org.getName() != null) { +1179 final String orgName = interpolateString(org.getName(), pomProperties); +1180 if (orgName != null && !orgName.isEmpty()) { +1181 dependency.getVendorEvidence().addEvidence("pom", "organization name", orgName, Confidence.HIGH); +1182 } +1183 } +1184 //pom name +1185 final String pomName = interpolateString(pom.getName(), pomProperties); +1186 if (pomName != null && !pomName.isEmpty()) { +1187 dependency.getProductEvidence().addEvidence("pom", "name", pomName, Confidence.HIGH); +1188 dependency.getVendorEvidence().addEvidence("pom", "name", pomName, Confidence.HIGH); +1189 } +1190 +1191 //Description +1192 if (pom.getDescription() != null) { +1193 final String description = interpolateString(pom.getDescription(), pomProperties); +1194 if (description != null && !description.isEmpty()) { +1195 addDescription(dependency, description, "pom", "description"); +1196 } +1197 } +1198 +1199 //license +1200 if (pom.getLicenses() != null) { +1201 String license = null; +1202 for (License lic : pom.getLicenses().getLicense()) { +1203 String tmp = null; +1204 if (lic.getName() != null) { +1205 tmp = interpolateString(lic.getName(), pomProperties); +1206 } +1207 if (lic.getUrl() != null) { +1208 if (tmp == null) { +1209 tmp = interpolateString(lic.getUrl(), pomProperties); +1210 } else { +1211 tmp += ": " + interpolateString(lic.getUrl(), pomProperties); +1212 } +1213 } +1214 if (tmp == null) { +1215 continue; +1216 } +1217 if (HTML_DETECTION_PATTERN.matcher(tmp).find()) { +1218 tmp = Jsoup.parse(tmp).text(); +1219 } +1220 if (license == null) { +1221 license = tmp; +1222 } else { +1223 license += "\n" + tmp; +1224 } +1225 } +1226 if (license != null) { +1227 dependency.setLicense(license); +1228 } +1229 } +1230 } +1231 +1232 /** +1233 * Stores information about a class name. +1234 */ +1235 protected static class ClassNameInformation { +1236 +1237 /** +1238 * <p> +1239 * Stores information about a given class name. This class will keep the fully qualified class name and a list +1240 * of the important parts of the package structure. Up to the first four levels of the package structure are +1241 * stored, excluding a leading "org" or "com". Example:</p> +1242 * <code>ClassNameInformation obj = new ClassNameInformation("org.owasp.dependencycheck.analyzer.JarAnalyzer"); +1243 * System.out.println(obj.getName()); +1244 * for (String p : obj.getPackageStructure()) +1245 * System.out.println(p); +1246 * </code> +1247 * <p> +1248 * Would result in:</p> +1249 * <code>org.owasp.dependencycheck.analyzer.JarAnalyzer +1250 * owasp +1251 * dependencycheck +1252 * analyzer +1253 * jaranalyzer</code> +1254 * +1255 * @param className a fully qualified class name +1256 */ +1257 ClassNameInformation(String className) { +1258 name = className; +1259 if (name.contains("/")) { +1260 final String[] tmp = className.toLowerCase().split("/"); +1261 int start = 0; +1262 int end = 3; +1263 if ("com".equals(tmp[0]) || "org".equals(tmp[0])) { +1264 start = 1; +1265 end = 4; +1266 } +1267 if (tmp.length <= end) { +1268 end = tmp.length - 1; +1269 } +1270 for (int i = start; i <= end; i++) { +1271 packageStructure.add(tmp[i]); +1272 } +1273 } else { +1274 packageStructure.add(name); +1275 } +1276 } +1277 /** +1278 * The fully qualified class name. +1279 */ +1280 private String name; +1281 +1282 /** +1283 * Get the value of name +1284 * +1285 * @return the value of name +1286 */ +1287 public String getName() { +1288 return name; +1289 } +1290 +1291 /** +1292 * Set the value of name +1293 * +1294 * @param name new value of name +1295 */ +1296 public void setName(String name) { +1297 this.name = name; +1298 } +1299 /** +1300 * Up to the first four levels of the package structure, excluding a leading "org" or "com". +1301 */ +1302 private final ArrayList<String> packageStructure = new ArrayList<String>(); +1303 +1304 /** +1305 * Get the value of packageStructure +1306 * +1307 * @return the value of packageStructure +1308 */ +1309 public ArrayList<String> getPackageStructure() { +1310 return packageStructure; +1311 } +1312 } +1313 +1314 /** +1315 * Retrieves the next temporary directory to extract an archive too. +1316 * +1317 * @return a directory +1318 * @throws AnalysisException thrown if unable to create temporary directory +1319 */ +1320 private File getNextTempDirectory() throws AnalysisException { +1321 dirCount += 1; +1322 final File directory = new File(tempFileLocation, String.valueOf(dirCount)); +1323 //getting an exception for some directories not being able to be created; might be because the directory already exists? +1324 if (directory.exists()) { +1325 return getNextTempDirectory(); +1326 } +1327 if (!directory.mkdirs()) { +1328 final String msg = String.format("Unable to create temp directory '%s'.", directory.getAbsolutePath()); +1329 throw new AnalysisException(msg); +1330 } +1331 return directory; +1332 } +1333 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/JavaScriptAnalyzer.html b/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/JavaScriptAnalyzer.html index 1f79be00a..684520895 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/JavaScriptAnalyzer.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/JavaScriptAnalyzer.html @@ -9,125 +9,121 @@ 1 /* 2 * This file is part of dependency-check-core. 3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. -18 */ -19 package org.owasp.dependencycheck.analyzer; -20 -21 import org.owasp.dependencycheck.Engine; -22 import org.owasp.dependencycheck.dependency.Dependency; -23 import java.util.Set; -24 import java.util.regex.Pattern; -25 -26 /** -27 * -28 * Used to load a JAR file and collect information that can be used to determine -29 * the associated CPE. -30 * -31 * @author Jeremy Long <jeremy.long@owasp.org> -32 */ -33 public class JavaScriptAnalyzer extends AbstractAnalyzer implements Analyzer { -34 -35 //<editor-fold defaultstate="collapsed" desc="All standard implmentation details of Analyzer"> -36 /** -37 * The name of the analyzer. -38 */ -39 private static final String ANALYZER_NAME = "JavaScript Analyzer"; -40 /** -41 * The phase that this analyzer is intended to run in. -42 */ -43 private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.INFORMATION_COLLECTION; -44 /** -45 * The set of file extensions supported by this analyzer. -46 */ -47 private static final Set<String> EXTENSIONS = newHashSet("js"); -48 -49 /** -50 * Returns a list of file EXTENSIONS supported by this analyzer. -51 * -52 * @return a list of file EXTENSIONS supported by this analyzer. -53 */ -54 public Set<String> getSupportedExtensions() { -55 return EXTENSIONS; -56 } -57 -58 /** -59 * Returns the name of the analyzer. -60 * -61 * @return the name of the analyzer. -62 */ -63 public String getName() { -64 return ANALYZER_NAME; -65 } -66 -67 /** -68 * Returns whether or not this analyzer can process the given extension. -69 * -70 * @param extension the file extension to test for support. -71 * @return whether or not the specified file extension is supported by this -72 * analyzer. -73 */ -74 public boolean supportsExtension(String extension) { -75 return EXTENSIONS.contains(extension); -76 } -77 -78 /** -79 * Returns the phase that the analyzer is intended to run in. -80 * -81 * @return the phase that the analyzer is intended to run in. -82 */ -83 public AnalysisPhase getAnalysisPhase() { -84 return ANALYSIS_PHASE; -85 } -86 //</editor-fold> -87 -88 /** -89 * Loads a specified JAR file and collects information from the manifest and -90 * checksums to identify the correct CPE information. -91 * -92 * @param dependency the dependency to analyze. -93 * @param engine the engine that is scanning the dependencies -94 * @throws AnalysisException is thrown if there is an error reading the JAR -95 * file. -96 */ -97 @Override -98 public void analyze(Dependency dependency, Engine engine) throws AnalysisException { -99 final Pattern extractComments = Pattern.compile("(/\\*([^*]|[\\r\\n]|(\\*+([^*/]|[\\r\\n])))*\\*+/)|(//.*)"); -100 -101 } -102 -103 /** -104 * The initialize method does nothing for this Analyzer. -105 * -106 * @throws Exception thrown if there is an exception -107 */ -108 @Override -109 public void initialize() throws Exception { -110 //do nothing -111 } -112 -113 /** -114 * The close method does nothing for this Analyzer. -115 * -116 * @throws Exception thrown if there is an exception -117 */ -118 @Override -119 public void close() throws Exception { -120 //do nothing -121 } -122 } +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. +17 */ +18 package org.owasp.dependencycheck.analyzer; +19 +20 import java.util.Set; +21 import java.util.regex.Pattern; +22 import org.owasp.dependencycheck.Engine; +23 import org.owasp.dependencycheck.dependency.Dependency; +24 +25 /** +26 * +27 * Used to load a JAR file and collect information that can be used to determine the associated CPE. +28 * +29 * @author Jeremy Long <jeremy.long@owasp.org> +30 */ +31 public class JavaScriptAnalyzer extends AbstractAnalyzer implements Analyzer { +32 +33 //<editor-fold defaultstate="collapsed" desc="All standard implmentation details of Analyzer"> +34 /** +35 * The name of the analyzer. +36 */ +37 private static final String ANALYZER_NAME = "JavaScript Analyzer"; +38 /** +39 * The phase that this analyzer is intended to run in. +40 */ +41 private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.INFORMATION_COLLECTION; +42 /** +43 * The set of file extensions supported by this analyzer. +44 */ +45 private static final Set<String> EXTENSIONS = newHashSet("js"); +46 +47 /** +48 * Returns a list of file EXTENSIONS supported by this analyzer. +49 * +50 * @return a list of file EXTENSIONS supported by this analyzer. +51 */ +52 public Set<String> getSupportedExtensions() { +53 return EXTENSIONS; +54 } +55 +56 /** +57 * Returns the name of the analyzer. +58 * +59 * @return the name of the analyzer. +60 */ +61 public String getName() { +62 return ANALYZER_NAME; +63 } +64 +65 /** +66 * Returns whether or not this analyzer can process the given extension. +67 * +68 * @param extension the file extension to test for support. +69 * @return whether or not the specified file extension is supported by this analyzer. +70 */ +71 public boolean supportsExtension(String extension) { +72 return EXTENSIONS.contains(extension); +73 } +74 +75 /** +76 * Returns the phase that the analyzer is intended to run in. +77 * +78 * @return the phase that the analyzer is intended to run in. +79 */ +80 public AnalysisPhase getAnalysisPhase() { +81 return ANALYSIS_PHASE; +82 } +83 //</editor-fold> +84 +85 /** +86 * Loads a specified JAR file and collects information from the manifest and checksums to identify the correct CPE +87 * information. +88 * +89 * @param dependency the dependency to analyze. +90 * @param engine the engine that is scanning the dependencies +91 * @throws AnalysisException is thrown if there is an error reading the JAR file. +92 */ +93 @Override +94 public void analyze(Dependency dependency, Engine engine) throws AnalysisException { +95 final Pattern extractComments = Pattern.compile("(/\\*([^*]|[\\r\\n]|(\\*+([^*/]|[\\r\\n])))*\\*+/)|(//.*)"); +96 +97 } +98 +99 /** +100 * The initialize method does nothing for this Analyzer. +101 * +102 * @throws Exception thrown if there is an exception +103 */ +104 @Override +105 public void initialize() throws Exception { +106 //do nothing +107 } +108 +109 /** +110 * The close method does nothing for this Analyzer. +111 * +112 * @throws Exception thrown if there is an exception +113 */ +114 @Override +115 public void close() throws Exception { +116 //do nothing +117 } +118 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/NexusAnalyzer.html b/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/NexusAnalyzer.html index c5846ce41..e909cadb0 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/NexusAnalyzer.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/NexusAnalyzer.html @@ -9,112 +9,112 @@ 1 /* 2 * This file is part of dependency-check-core. 3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. -18 */ -19 package org.owasp.dependencycheck.analyzer; -20 -21 import java.io.FileNotFoundException; -22 import java.io.IOException; -23 import java.net.MalformedURLException; -24 import java.net.URL; -25 import java.util.Set; +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2014 Jeremy Long. All Rights Reserved. +17 */ +18 package org.owasp.dependencycheck.analyzer; +19 +20 import java.io.FileNotFoundException; +21 import java.io.IOException; +22 import java.net.MalformedURLException; +23 import java.net.URL; +24 import java.util.Set; +25 import java.util.logging.Level; 26 import java.util.logging.Logger; -27 -28 import org.owasp.dependencycheck.Engine; -29 import org.owasp.dependencycheck.data.nexus.MavenArtifact; -30 import org.owasp.dependencycheck.data.nexus.NexusSearch; +27 import org.owasp.dependencycheck.Engine; +28 import org.owasp.dependencycheck.data.nexus.MavenArtifact; +29 import org.owasp.dependencycheck.data.nexus.NexusSearch; +30 import org.owasp.dependencycheck.dependency.Confidence; 31 import org.owasp.dependencycheck.dependency.Dependency; -32 import org.owasp.dependencycheck.dependency.Evidence; -33 import org.owasp.dependencycheck.utils.Settings; -34 -35 /** -36 * Analyzer which will attempt to locate a dependency on a Nexus service -37 * by SHA-1 digest of the dependency. +32 import org.owasp.dependencycheck.utils.Settings; +33 +34 /** +35 * Analyzer which will attempt to locate a dependency on a Nexus service by SHA-1 digest of the dependency. +36 * +37 * There are two settings which govern this behavior: 38 * -39 * There are two settings which govern this behavior: -40 * -41 * <ul> -42 * <li>{@link org.owasp.dependencycheck.utils.Settings.KEYS#ANALYZER_NEXUS_ENABLED} -43 * determines whether this analyzer is even enabled. This can be overridden by -44 * setting the system property.</li> -45 * <li>{@link org.owasp.dependencycheck.utils.Settings.KEYS#ANALYZER_NEXUS_URL} -46 * the URL to a Nexus service to search by SHA-1. There is an expected <code>%s</code> -47 * in this where the SHA-1 will get entered.</li> -48 * </ul> -49 * -50 * @author colezlaw -51 */ -52 public class NexusAnalyzer extends AbstractAnalyzer { -53 /** -54 * The logger -55 */ -56 private static final Logger LOGGER = Logger.getLogger(NexusAnalyzer.class.getName()); -57 -58 /** -59 * The name of the analyzer -60 */ -61 private static final String ANALYZER_NAME = "Nexus Analyzer"; -62 -63 /** -64 * The phase in which the analyzer runs -65 */ -66 private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.INFORMATION_COLLECTION; -67 -68 /** -69 * The types of files on which this will work. -70 */ -71 private static final Set<String> SUPPORTED_EXTENSIONS = newHashSet("jar"); -72 -73 /** -74 * Whether this is actually enabled. Will get set during initialization -75 */ -76 private boolean enabled = false; -77 -78 /** -79 * The Nexus Search to be set up for this analyzer. -80 */ -81 private NexusSearch searcher; -82 -83 /** -84 * Initializes the analyzer once before any analysis is performed. -85 * -86 * @throws Exception if there's an error during initialization. -87 */ -88 public void initialize() throws Exception { -89 enabled = Settings.getBoolean(Settings.KEYS.ANALYZER_NEXUS_ENABLED); -90 -91 final String searchUrl = Settings.getString(Settings.KEYS.ANALYZER_NEXUS_URL); -92 -93 if (enabled) { -94 try { -95 searcher = new NexusSearch(new URL(searchUrl)); -96 } catch (MalformedURLException mue) { -97 // I know that initialize can throw an exception, but we'll -98 // just disable the analyzer if the URL isn't valid -99 LOGGER.warning(String.format("Property %s not a valid URL. Nexus searching disabled", -100 searchUrl)); -101 } -102 } -103 } -104 -105 /** -106 * Returns the analyzer's name. -107 * -108 * @return the name of the analyzer -109 */ +39 * <ul> +40 * <li>{@link org.owasp.dependencycheck.utils.Settings.KEYS#ANALYZER_NEXUS_ENABLED} determines whether this analyzer is +41 * even enabled. This can be overridden by setting the system property.</li> +42 * <li>{@link org.owasp.dependencycheck.utils.Settings.KEYS#ANALYZER_NEXUS_URL} the URL to a Nexus service to search by +43 * SHA-1. There is an expected <code>%s</code> in this where the SHA-1 will get entered.</li> +44 * </ul> +45 * +46 * @author colezlaw +47 */ +48 public class NexusAnalyzer extends AbstractAnalyzer { +49 +50 /** +51 * The logger +52 */ +53 private static final Logger LOGGER = Logger.getLogger(NexusAnalyzer.class.getName()); +54 +55 /** +56 * The name of the analyzer +57 */ +58 private static final String ANALYZER_NAME = "Nexus Analyzer"; +59 +60 /** +61 * The phase in which the analyzer runs +62 */ +63 private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.INFORMATION_COLLECTION; +64 +65 /** +66 * The types of files on which this will work. +67 */ +68 private static final Set<String> SUPPORTED_EXTENSIONS = newHashSet("jar"); +69 +70 /** +71 * Whether this is actually enabled. Will get set during initialization. +72 */ +73 private boolean enabled = false; +74 +75 /** +76 * The Nexus Search to be set up for this analyzer. +77 */ +78 private NexusSearch searcher; +79 +80 /** +81 * Initializes the analyzer once before any analysis is performed. +82 * +83 * @throws Exception if there's an error during initialization +84 */ +85 @Override +86 public void initialize() throws Exception { +87 enabled = Settings.getBoolean(Settings.KEYS.ANALYZER_NEXUS_ENABLED); +88 LOGGER.fine("Initializing Nexus Analyzer"); +89 LOGGER.fine(String.format("Nexus Analyzer enabled: %s", enabled)); +90 if (enabled) { +91 final String searchUrl = Settings.getString(Settings.KEYS.ANALYZER_NEXUS_URL); +92 LOGGER.fine(String.format("Nexus Analyzer URL: %s", searchUrl)); +93 try { +94 searcher = new NexusSearch(new URL(searchUrl)); +95 } catch (MalformedURLException mue) { +96 // I know that initialize can throw an exception, but we'll +97 // just disable the analyzer if the URL isn't valid +98 LOGGER.warning(String.format("Property %s not a valid URL. Nexus Analyzer disabled", searchUrl)); +99 enabled = false; +100 } +101 } +102 } +103 +104 /** +105 * Returns the analyzer's name. +106 * +107 * @return the name of the analyzer +108 */ +109 @Override 110 public String getName() { 111 return ANALYZER_NAME; 112 } @@ -124,70 +124,75 @@ 116 * 117 * @return the phase under which this analyzer runs 118 */ -119 public AnalysisPhase getAnalysisPhase() { -120 return ANALYSIS_PHASE; -121 } -122 -123 /** -124 * Returns the extensions for which this Analyzer runs. -125 * -126 * @return the extensions for which this Analyzer runs -127 */ -128 public Set<String> getSupportedExtensions() { -129 return SUPPORTED_EXTENSIONS; -130 } -131 -132 /** -133 * Determines whether the incoming extension is supported. -134 * -135 * @param extension the extension to check for support -136 * @return whether the extension is supported -137 */ -138 public boolean supportsExtension(String extension) { -139 return SUPPORTED_EXTENSIONS.contains(extension); -140 } -141 -142 /** -143 * Performs the analysis. -144 * -145 * @param dependency the dependency to analyze -146 * @param engine the engine -147 * @throws AnalysisException when there's an exception during analysis -148 */ -149 public void analyze(Dependency dependency, Engine engine) throws AnalysisException { -150 // Make a quick exit if this analyzer is disabled -151 if (!enabled) { -152 return; -153 } -154 -155 try { -156 final MavenArtifact ma = searcher.searchSha1(dependency.getSha1sum()); -157 if (ma.getGroupId() != null && !"".equals(ma.getGroupId())) { -158 dependency.getVendorEvidence().addEvidence("nexus", "groupid", ma.getGroupId(), -159 Evidence.Confidence.HIGH); -160 } -161 if (ma.getArtifactId() != null && !"".equals(ma.getArtifactId())) { -162 dependency.getProductEvidence().addEvidence("nexus", "artifactid", ma.getArtifactId(), -163 Evidence.Confidence.HIGH); -164 } -165 if (ma.getVersion() != null && !"".equals(ma.getVersion())) { -166 dependency.getVersionEvidence().addEvidence("nexus", "version", ma.getVersion(), -167 Evidence.Confidence.HIGH); -168 } -169 if (ma.getArtifactUrl() != null && !"".equals(ma.getArtifactUrl())) { -170 dependency.addIdentifier("maven", ma.toString(), ma.getArtifactUrl()); -171 } -172 } catch (IllegalArgumentException iae) { -173 dependency.addAnalysisException(new AnalysisException("Invalid SHA-1")); -174 } catch (FileNotFoundException fnfe) { -175 dependency.addAnalysisException(new AnalysisException("Artifact not found on repository")); -176 } catch (IOException ioe) { -177 dependency.addAnalysisException(new AnalysisException("Could not connect to repository", ioe)); -178 } -179 } -180 } -181 -182 // vim: cc=120:sw=4:ts=4:sts=4 +119 @Override +120 public AnalysisPhase getAnalysisPhase() { +121 return ANALYSIS_PHASE; +122 } +123 +124 /** +125 * Returns the extensions for which this Analyzer runs. +126 * +127 * @return the extensions for which this Analyzer runs +128 */ +129 @Override +130 public Set<String> getSupportedExtensions() { +131 return SUPPORTED_EXTENSIONS; +132 } +133 +134 /** +135 * Determines whether the incoming extension is supported. +136 * +137 * @param extension the extension to check for support +138 * @return whether the extension is supported +139 */ +140 @Override +141 public boolean supportsExtension(String extension) { +142 return SUPPORTED_EXTENSIONS.contains(extension); +143 } +144 +145 /** +146 * Performs the analysis. +147 * +148 * @param dependency the dependency to analyze +149 * @param engine the engine +150 * @throws AnalysisException when there's an exception during analysis +151 */ +152 @Override +153 public void analyze(Dependency dependency, Engine engine) throws AnalysisException { +154 // Make a quick exit if this analyzer is disabled +155 if (!enabled) { +156 return; +157 } +158 +159 try { +160 final MavenArtifact ma = searcher.searchSha1(dependency.getSha1sum()); +161 if (ma.getGroupId() != null && !"".equals(ma.getGroupId())) { +162 dependency.getVendorEvidence().addEvidence("nexus", "groupid", ma.getGroupId(), Confidence.HIGH); +163 } +164 if (ma.getArtifactId() != null && !"".equals(ma.getArtifactId())) { +165 dependency.getProductEvidence().addEvidence("nexus", "artifactid", ma.getArtifactId(), Confidence.HIGH); +166 } +167 if (ma.getVersion() != null && !"".equals(ma.getVersion())) { +168 dependency.getVersionEvidence().addEvidence("nexus", "version", ma.getVersion(), Confidence.HIGH); +169 } +170 if (ma.getArtifactUrl() != null && !"".equals(ma.getArtifactUrl())) { +171 dependency.addIdentifier("maven", ma.toString(), ma.getArtifactUrl(), Confidence.HIGHEST); +172 } +173 } catch (IllegalArgumentException iae) { +174 //dependency.addAnalysisException(new AnalysisException("Invalid SHA-1")); +175 LOGGER.info(String.format("invalid sha-1 hash on %s", dependency.getFileName())); +176 } catch (FileNotFoundException fnfe) { +177 //dependency.addAnalysisException(new AnalysisException("Artifact not found on repository")); +178 LOGGER.fine(String.format("Artificat not found in repository '%s'", dependency.getFileName())); +179 LOGGER.log(Level.FINE, fnfe.getMessage(), fnfe); +180 } catch (IOException ioe) { +181 //dependency.addAnalysisException(new AnalysisException("Could not connect to repository", ioe)); +182 LOGGER.log(Level.FINE, "Could not connect to nexus repository", ioe); +183 } +184 } +185 } +186 +187 // vim: cc=120:sw=4:ts=4:sts=4
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/NvdCveAnalyzer.html b/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/NvdCveAnalyzer.html index 12d6ede35..85a14ef04 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/NvdCveAnalyzer.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/NvdCveAnalyzer.html @@ -9,165 +9,160 @@ 1 /* 2 * This file is part of dependency-check-core. 3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. -18 */ -19 package org.owasp.dependencycheck.analyzer; -20 -21 import java.io.IOException; -22 import java.sql.SQLException; -23 import java.util.List; -24 import java.util.Set; -25 import org.owasp.dependencycheck.Engine; -26 import org.owasp.dependencycheck.dependency.Dependency; -27 import org.owasp.dependencycheck.dependency.Vulnerability; +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. +17 */ +18 package org.owasp.dependencycheck.analyzer; +19 +20 import java.io.IOException; +21 import java.sql.SQLException; +22 import java.util.List; +23 import java.util.Set; +24 import org.owasp.dependencycheck.Engine; +25 import org.owasp.dependencycheck.data.nvdcve.CveDB; +26 import org.owasp.dependencycheck.data.nvdcve.DatabaseException; +27 import org.owasp.dependencycheck.dependency.Dependency; 28 import org.owasp.dependencycheck.dependency.Identifier; -29 import org.owasp.dependencycheck.data.nvdcve.CveDB; -30 import org.owasp.dependencycheck.data.nvdcve.DatabaseException; -31 -32 /** -33 * NvdCveAnalyzer is a utility class that takes a project dependency and -34 * attempts to discern if there is an associated CVEs. It uses the the -35 * identifiers found by other analyzers to lookup the CVE data. -36 * -37 * @author Jeremy Long <jeremy.long@owasp.org> -38 */ -39 public class NvdCveAnalyzer implements Analyzer { -40 -41 /** -42 * The maximum number of query results to return. -43 */ -44 static final int MAX_QUERY_RESULTS = 100; -45 /** -46 * The CVE Index. -47 */ -48 private CveDB cveDB; -49 -50 /** -51 * Opens the data source. -52 * -53 * @throws SQLException thrown when there is a SQL Exception -54 * @throws IOException thrown when there is an IO Exception -55 * @throws DatabaseException thrown when there is a database exceptions -56 * @throws ClassNotFoundException thrown if the h2 database driver cannot be -57 * loaded -58 */ -59 public void open() throws SQLException, IOException, DatabaseException, ClassNotFoundException { -60 cveDB = new CveDB(); -61 cveDB.open(); -62 } -63 -64 /** -65 * Closes the data source. -66 */ -67 public void close() { -68 cveDB.close(); -69 cveDB = null; -70 } -71 -72 /** -73 * Returns the status of the data source - is the database open. -74 * -75 * @return true or false. -76 */ -77 public boolean isOpen() { -78 return (cveDB != null); -79 } -80 -81 /** -82 * Ensures that the CVE Database is closed. -83 * -84 * @throws Throwable when a throwable is thrown. -85 */ -86 @Override -87 protected void finalize() throws Throwable { -88 super.finalize(); -89 if (isOpen()) { -90 close(); -91 } -92 } -93 -94 /** -95 * Analyzes a dependency and attempts to determine if there are any CPE -96 * identifiers for this dependency. -97 * -98 * @param dependency The Dependency to analyze -99 * @param engine The analysis engine -100 * @throws AnalysisException is thrown if there is an issue analyzing the -101 * dependency -102 */ -103 public void analyze(Dependency dependency, Engine engine) throws AnalysisException { -104 for (Identifier id : dependency.getIdentifiers()) { -105 if ("cpe".equals(id.getType())) { -106 try { -107 final String value = id.getValue(); -108 final List<Vulnerability> vulns = cveDB.getVulnerabilities(value); -109 dependency.getVulnerabilities().addAll(vulns); -110 } catch (DatabaseException ex) { -111 throw new AnalysisException(ex); -112 } -113 } -114 } -115 } -116 -117 /** -118 * Returns true because this analyzer supports all dependency types. -119 * -120 * @return true. -121 */ -122 public Set<String> getSupportedExtensions() { -123 return null; -124 } -125 -126 /** -127 * Returns the name of this analyzer. -128 * -129 * @return the name of this analyzer. -130 */ -131 public String getName() { -132 return "NVD CVE Analyzer"; -133 } -134 -135 /** -136 * Returns true because this analyzer supports all dependency types. -137 * -138 * @param extension the file extension of the dependency being analyzed. -139 * @return true. -140 */ -141 public boolean supportsExtension(String extension) { -142 return true; -143 } -144 -145 /** -146 * Returns the analysis phase that this analyzer should run in. -147 * -148 * @return the analysis phase that this analyzer should run in. -149 */ -150 public AnalysisPhase getAnalysisPhase() { -151 return AnalysisPhase.FINDING_ANALYSIS; -152 } -153 -154 /** -155 * Opens the NVD CVE Lucene Index. -156 * -157 * @throws Exception is thrown if there is an issue opening the index. -158 */ -159 public void initialize() throws Exception { -160 this.open(); -161 } -162 } +29 import org.owasp.dependencycheck.dependency.Vulnerability; +30 +31 /** +32 * NvdCveAnalyzer is a utility class that takes a project dependency and attempts to discern if there is an associated +33 * CVEs. It uses the the identifiers found by other analyzers to lookup the CVE data. +34 * +35 * @author Jeremy Long <jeremy.long@owasp.org> +36 */ +37 public class NvdCveAnalyzer implements Analyzer { +38 +39 /** +40 * The maximum number of query results to return. +41 */ +42 static final int MAX_QUERY_RESULTS = 100; +43 /** +44 * The CVE Index. +45 */ +46 private CveDB cveDB; +47 +48 /** +49 * Opens the data source. +50 * +51 * @throws SQLException thrown when there is a SQL Exception +52 * @throws IOException thrown when there is an IO Exception +53 * @throws DatabaseException thrown when there is a database exceptions +54 * @throws ClassNotFoundException thrown if the h2 database driver cannot be loaded +55 */ +56 public void open() throws SQLException, IOException, DatabaseException, ClassNotFoundException { +57 cveDB = new CveDB(); +58 cveDB.open(); +59 } +60 +61 /** +62 * Closes the data source. +63 */ +64 public void close() { +65 cveDB.close(); +66 cveDB = null; +67 } +68 +69 /** +70 * Returns the status of the data source - is the database open. +71 * +72 * @return true or false. +73 */ +74 public boolean isOpen() { +75 return (cveDB != null); +76 } +77 +78 /** +79 * Ensures that the CVE Database is closed. +80 * +81 * @throws Throwable when a throwable is thrown. +82 */ +83 @Override +84 protected void finalize() throws Throwable { +85 super.finalize(); +86 if (isOpen()) { +87 close(); +88 } +89 } +90 +91 /** +92 * Analyzes a dependency and attempts to determine if there are any CPE identifiers for this dependency. +93 * +94 * @param dependency The Dependency to analyze +95 * @param engine The analysis engine +96 * @throws AnalysisException is thrown if there is an issue analyzing the dependency +97 */ +98 public void analyze(Dependency dependency, Engine engine) throws AnalysisException { +99 for (Identifier id : dependency.getIdentifiers()) { +100 if ("cpe".equals(id.getType())) { +101 try { +102 final String value = id.getValue(); +103 final List<Vulnerability> vulns = cveDB.getVulnerabilities(value); +104 dependency.getVulnerabilities().addAll(vulns); +105 } catch (DatabaseException ex) { +106 throw new AnalysisException(ex); +107 } +108 } +109 } +110 } +111 +112 /** +113 * Returns true because this analyzer supports all dependency types. +114 * +115 * @return true. +116 */ +117 public Set<String> getSupportedExtensions() { +118 return null; +119 } +120 +121 /** +122 * Returns the name of this analyzer. +123 * +124 * @return the name of this analyzer. +125 */ +126 public String getName() { +127 return "NVD CVE Analyzer"; +128 } +129 +130 /** +131 * Returns true because this analyzer supports all dependency types. +132 * +133 * @param extension the file extension of the dependency being analyzed. +134 * @return true. +135 */ +136 public boolean supportsExtension(String extension) { +137 return true; +138 } +139 +140 /** +141 * Returns the analysis phase that this analyzer should run in. +142 * +143 * @return the analysis phase that this analyzer should run in. +144 */ +145 public AnalysisPhase getAnalysisPhase() { +146 return AnalysisPhase.FINDING_ANALYSIS; +147 } +148 +149 /** +150 * Opens the NVD CVE Lucene Index. +151 * +152 * @throws Exception is thrown if there is an issue opening the index. +153 */ +154 public void initialize() throws Exception { +155 this.open(); +156 } +157 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/VulnerabilitySuppressionAnalyzer.html b/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/VulnerabilitySuppressionAnalyzer.html index 41de7c6ef..b0e9d800d 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/VulnerabilitySuppressionAnalyzer.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/VulnerabilitySuppressionAnalyzer.html @@ -9,79 +9,77 @@ 1 /* 2 * This file is part of dependency-check-core. 3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2013 Jeremy Long. All Rights Reserved. -18 */ -19 package org.owasp.dependencycheck.analyzer; -20 -21 import org.owasp.dependencycheck.Engine; -22 import org.owasp.dependencycheck.dependency.Dependency; -23 import org.owasp.dependencycheck.suppression.SuppressionRule; -24 -25 /** -26 * The suppression analyzer processes an externally defined XML document that -27 * complies with the suppressions.xsd schema. Any identified Vulnerability -28 * entries within the dependencies that match will be removed. -29 * -30 * @author Jeremy Long <jeremy.long@owasp.org> -31 */ -32 public class VulnerabilitySuppressionAnalyzer extends AbstractSuppressionAnalyzer { -33 -34 //<editor-fold defaultstate="collapsed" desc="All standard implementation details of Analyzer"> -35 /** -36 * The name of the analyzer. -37 */ -38 private static final String ANALYZER_NAME = "Vulnerability Suppression Analyzer"; -39 /** -40 * The phase that this analyzer is intended to run in. -41 */ -42 private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.POST_FINDING_ANALYSIS; -43 -44 /** -45 * Returns the name of the analyzer. -46 * -47 * @return the name of the analyzer. -48 */ -49 @Override -50 public String getName() { -51 return ANALYZER_NAME; -52 } -53 -54 /** -55 * Returns the phase that the analyzer is intended to run in. -56 * -57 * @return the phase that the analyzer is intended to run in. -58 */ -59 @Override -60 public AnalysisPhase getAnalysisPhase() { -61 return ANALYSIS_PHASE; -62 } -63 //</editor-fold> -64 -65 @Override -66 public void analyze(final Dependency dependency, final Engine engine) throws AnalysisException { -67 -68 if (getRules() == null || getRules().size() <= 0) { -69 return; -70 } -71 -72 for (final SuppressionRule rule : getRules()) { -73 rule.process(dependency); -74 } -75 } -76 } +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2013 Jeremy Long. All Rights Reserved. +17 */ +18 package org.owasp.dependencycheck.analyzer; +19 +20 import org.owasp.dependencycheck.Engine; +21 import org.owasp.dependencycheck.dependency.Dependency; +22 import org.owasp.dependencycheck.suppression.SuppressionRule; +23 +24 /** +25 * The suppression analyzer processes an externally defined XML document that complies with the suppressions.xsd schema. +26 * Any identified Vulnerability entries within the dependencies that match will be removed. +27 * +28 * @author Jeremy Long <jeremy.long@owasp.org> +29 */ +30 public class VulnerabilitySuppressionAnalyzer extends AbstractSuppressionAnalyzer { +31 +32 //<editor-fold defaultstate="collapsed" desc="All standard implementation details of Analyzer"> +33 /** +34 * The name of the analyzer. +35 */ +36 private static final String ANALYZER_NAME = "Vulnerability Suppression Analyzer"; +37 /** +38 * The phase that this analyzer is intended to run in. +39 */ +40 private static final AnalysisPhase ANALYSIS_PHASE = AnalysisPhase.POST_FINDING_ANALYSIS; +41 +42 /** +43 * Returns the name of the analyzer. +44 * +45 * @return the name of the analyzer. +46 */ +47 @Override +48 public String getName() { +49 return ANALYZER_NAME; +50 } +51 +52 /** +53 * Returns the phase that the analyzer is intended to run in. +54 * +55 * @return the phase that the analyzer is intended to run in. +56 */ +57 @Override +58 public AnalysisPhase getAnalysisPhase() { +59 return ANALYSIS_PHASE; +60 } +61 //</editor-fold> +62 +63 @Override +64 public void analyze(final Dependency dependency, final Engine engine) throws AnalysisException { +65 +66 if (getRules() == null || getRules().size() <= 0) { +67 return; +68 } +69 +70 for (final SuppressionRule rule : getRules()) { +71 rule.process(dependency); +72 } +73 } +74 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/package-frame.html b/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/package-frame.html index 780c0a342..4032dd663 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/package-frame.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.0.8 Reference Package org.owasp.dependencycheck.analyzer + Dependency-Check Core 1.1.0 Reference Package org.owasp.dependencycheck.analyzer diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/package-summary.html b/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/package-summary.html index 54d245cf4..18cffc409 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/package-summary.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/analyzer/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.0.8 Reference Package org.owasp.dependencycheck.analyzer + Dependency-Check Core 1.1.0 Reference Package org.owasp.dependencycheck.analyzer diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/cpe/CpeMemoryIndex.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/cpe/CpeMemoryIndex.html index a6c74532c..96ebb0861 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/cpe/CpeMemoryIndex.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/cpe/CpeMemoryIndex.html @@ -9,331 +9,329 @@ 1 /* 2 * This file is part of dependency-check-core. 3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2013 Jeremy Long. All Rights Reserved. -18 */ -19 package org.owasp.dependencycheck.data.cpe; -20 -21 import java.io.IOException; -22 import java.sql.ResultSet; -23 import java.sql.SQLException; -24 import java.util.HashMap; -25 import java.util.Map; -26 import java.util.logging.Level; -27 import java.util.logging.Logger; -28 import org.apache.lucene.analysis.Analyzer; -29 import org.apache.lucene.analysis.core.KeywordAnalyzer; -30 import org.apache.lucene.analysis.miscellaneous.PerFieldAnalyzerWrapper; -31 import org.apache.lucene.document.Document; -32 import org.apache.lucene.document.Field; -33 import org.apache.lucene.document.TextField; -34 import org.apache.lucene.index.CorruptIndexException; -35 import org.apache.lucene.index.DirectoryReader; -36 import org.apache.lucene.index.IndexReader; -37 import org.apache.lucene.index.IndexWriter; -38 import org.apache.lucene.index.IndexWriterConfig; -39 import org.apache.lucene.queryparser.classic.ParseException; -40 import org.apache.lucene.queryparser.classic.QueryParser; -41 import org.apache.lucene.search.IndexSearcher; -42 import org.apache.lucene.search.Query; -43 import org.apache.lucene.search.TopDocs; +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2013 Jeremy Long. All Rights Reserved. +17 */ +18 package org.owasp.dependencycheck.data.cpe; +19 +20 import java.io.IOException; +21 import java.sql.ResultSet; +22 import java.sql.SQLException; +23 import java.util.HashMap; +24 import java.util.Map; +25 import java.util.logging.Level; +26 import java.util.logging.Logger; +27 import org.apache.lucene.analysis.Analyzer; +28 import org.apache.lucene.analysis.core.KeywordAnalyzer; +29 import org.apache.lucene.analysis.miscellaneous.PerFieldAnalyzerWrapper; +30 import org.apache.lucene.document.Document; +31 import org.apache.lucene.document.Field; +32 import org.apache.lucene.document.TextField; +33 import org.apache.lucene.index.CorruptIndexException; +34 import org.apache.lucene.index.DirectoryReader; +35 import org.apache.lucene.index.IndexReader; +36 import org.apache.lucene.index.IndexWriter; +37 import org.apache.lucene.index.IndexWriterConfig; +38 import org.apache.lucene.queryparser.classic.ParseException; +39 import org.apache.lucene.queryparser.classic.QueryParser; +40 import org.apache.lucene.search.IndexSearcher; +41 import org.apache.lucene.search.Query; +42 import org.apache.lucene.search.TopDocs; +43 import org.apache.lucene.store.RAMDirectory; 44 import org.owasp.dependencycheck.data.lucene.FieldAnalyzer; -45 import org.owasp.dependencycheck.data.nvdcve.CveDB; -46 import org.apache.lucene.store.RAMDirectory; -47 import org.owasp.dependencycheck.data.lucene.LuceneUtils; -48 import org.owasp.dependencycheck.data.lucene.SearchFieldAnalyzer; -49 -50 /** -51 * An in memory lucene index that contains the vendor/product combinations from -52 * the CPE (application) identifiers within the NVD CVE data. -53 * -54 * @author Jeremy Long <jeremy.long@owasp.org> -55 */ -56 public final class CpeMemoryIndex { -57 -58 /** -59 * singleton instance. -60 */ -61 private static CpeMemoryIndex instance = new CpeMemoryIndex(); -62 -63 /** -64 * private constructor for singleton. -65 */ -66 private CpeMemoryIndex() { -67 } -68 -69 /** -70 * Gets the singleton instance of the CpeMemoryIndex. -71 * -72 * @return the instance of the CpeMemoryIndex -73 */ -74 public static CpeMemoryIndex getInstance() { -75 return instance; -76 } -77 /** -78 * The in memory Lucene index. -79 */ -80 private RAMDirectory index; -81 /** -82 * The Lucene IndexReader. -83 */ -84 private IndexReader indexReader; -85 /** -86 * The Lucene IndexSearcher. -87 */ -88 private IndexSearcher indexSearcher; -89 /** -90 * The Lucene Analyzer used for Searching. -91 */ -92 private Analyzer searchingAnalyzer; -93 /** -94 * The Lucene QueryParser used for Searching. -95 */ -96 private QueryParser queryParser; -97 /** -98 * The search field analyzer for the product field. -99 */ -100 private SearchFieldAnalyzer productSearchFieldAnalyzer; -101 /** -102 * The search field analyzer for the vendor field. -103 */ -104 private SearchFieldAnalyzer vendorSearchFieldAnalyzer; -105 -106 /** -107 * Creates and loads data into an in memory index. -108 * -109 * @param cve the data source to retrieve the cpe data -110 * @throws IndexException thrown if there is an error creating the index -111 */ -112 public void open(CveDB cve) throws IndexException { -113 if (!openState) { -114 index = new RAMDirectory(); -115 buildIndex(cve); -116 try { -117 indexReader = DirectoryReader.open(index); -118 } catch (IOException ex) { -119 throw new IndexException(ex); -120 } -121 indexSearcher = new IndexSearcher(indexReader); -122 searchingAnalyzer = createSearchingAnalyzer(); -123 queryParser = new QueryParser(LuceneUtils.CURRENT_VERSION, Fields.DOCUMENT_KEY, searchingAnalyzer); -124 openState = true; -125 } -126 } -127 /** -128 * A flag indicating whether or not the index is open. -129 */ -130 private boolean openState = false; -131 -132 /** -133 * returns whether or not the index is open. -134 * -135 * @return whether or not the index is open -136 */ -137 public boolean isOpen() { -138 return openState; -139 } -140 -141 /** -142 * Creates the indexing analyzer for the CPE Index. -143 * -144 * @return the CPE Analyzer. -145 */ -146 @SuppressWarnings("unchecked") -147 private Analyzer createIndexingAnalyzer() { -148 final Map fieldAnalyzers = new HashMap(); -149 fieldAnalyzers.put(Fields.DOCUMENT_KEY, new KeywordAnalyzer()); -150 return new PerFieldAnalyzerWrapper(new FieldAnalyzer(LuceneUtils.CURRENT_VERSION), fieldAnalyzers); -151 } -152 -153 /** -154 * Creates an Analyzer for searching the CPE Index. -155 * -156 * @return the CPE Analyzer. -157 */ -158 @SuppressWarnings("unchecked") -159 private Analyzer createSearchingAnalyzer() { -160 final Map fieldAnalyzers = new HashMap(); -161 fieldAnalyzers.put(Fields.DOCUMENT_KEY, new KeywordAnalyzer()); -162 productSearchFieldAnalyzer = new SearchFieldAnalyzer(LuceneUtils.CURRENT_VERSION); -163 vendorSearchFieldAnalyzer = new SearchFieldAnalyzer(LuceneUtils.CURRENT_VERSION); -164 fieldAnalyzers.put(Fields.PRODUCT, productSearchFieldAnalyzer); -165 fieldAnalyzers.put(Fields.VENDOR, vendorSearchFieldAnalyzer); -166 -167 return new PerFieldAnalyzerWrapper(new FieldAnalyzer(LuceneUtils.CURRENT_VERSION), fieldAnalyzers); -168 } -169 -170 /** -171 * Saves a CPE IndexEntry into the Lucene index. -172 * -173 * @param vendor the vendor to index -174 * @param product the product to index -175 * @param indexWriter the index writer to write the entry into -176 * @throws CorruptIndexException is thrown if the index is corrupt -177 * @throws IOException is thrown if an IOException occurs -178 */ -179 public void saveEntry(String vendor, String product, IndexWriter indexWriter) throws CorruptIndexException, IOException { -180 final Document doc = new Document(); -181 final Field v = new TextField(Fields.VENDOR, vendor, Field.Store.YES); -182 final Field p = new TextField(Fields.PRODUCT, product, Field.Store.YES); -183 doc.add(v); -184 doc.add(p); -185 indexWriter.addDocument(doc); -186 } -187 -188 /** -189 * Closes the CPE Index. -190 */ -191 public void close() { -192 if (searchingAnalyzer != null) { -193 searchingAnalyzer.close(); -194 searchingAnalyzer = null; -195 } -196 if (indexReader != null) { -197 try { -198 indexReader.close(); -199 } catch (IOException ex) { -200 Logger.getLogger(CpeMemoryIndex.class.getName()).log(Level.FINEST, null, ex); -201 } -202 indexReader = null; -203 } -204 queryParser = null; -205 indexSearcher = null; -206 if (index != null) { -207 index.close(); -208 index = null; -209 } -210 openState = false; -211 } -212 -213 /** -214 * Builds the lucene index based off of the data within the CveDB. -215 * -216 * @param cve the data base containing the CPE data -217 * @throws IndexException thrown if there is an issue creating the index -218 */ -219 private void buildIndex(CveDB cve) throws IndexException { -220 Analyzer analyzer = null; -221 IndexWriter indexWriter = null; -222 try { -223 analyzer = createIndexingAnalyzer(); -224 final IndexWriterConfig conf = new IndexWriterConfig(LuceneUtils.CURRENT_VERSION, analyzer); -225 indexWriter = new IndexWriter(index, conf); -226 final ResultSet rs = cve.getVendorProductList(); -227 if (rs == null) { -228 throw new IndexException("No data exists"); -229 } -230 try { -231 while (rs.next()) { -232 saveEntry(rs.getString(1), rs.getString(2), indexWriter); -233 } -234 } catch (SQLException ex) { -235 Logger.getLogger(CpeMemoryIndex.class.getName()).log(Level.FINE, null, ex); -236 throw new IndexException("Error reading CPE data", ex); -237 } -238 } catch (CorruptIndexException ex) { -239 throw new IndexException("Unable to close an in-memory index", ex); -240 } catch (IOException ex) { -241 throw new IndexException("Unable to close an in-memory index", ex); -242 } finally { -243 if (indexWriter != null) { -244 try { -245 try { -246 indexWriter.commit(); -247 } finally { -248 indexWriter.close(true); -249 } -250 } catch (CorruptIndexException ex) { -251 throw new IndexException("Unable to close an in-memory index", ex); -252 } catch (IOException ex) { -253 throw new IndexException("Unable to close an in-memory index", ex); -254 } -255 if (analyzer != null) { -256 analyzer.close(); -257 } -258 } -259 } -260 } -261 -262 /** -263 * Resets the searching analyzers -264 */ -265 private void resetSearchingAnalyzer() { -266 if (productSearchFieldAnalyzer != null) { -267 productSearchFieldAnalyzer.clear(); -268 } -269 if (vendorSearchFieldAnalyzer != null) { -270 vendorSearchFieldAnalyzer.clear(); -271 } -272 } -273 -274 /** -275 * Searches the index using the given search string. -276 * -277 * @param searchString the query text -278 * @param maxQueryResults the maximum number of documents to return -279 * @return the TopDocs found by the search -280 * @throws ParseException thrown when the searchString is invalid -281 * @throws IOException is thrown if there is an issue with the underlying -282 * Index -283 */ -284 public TopDocs search(String searchString, int maxQueryResults) throws ParseException, IOException { -285 if (searchString == null || searchString.trim().isEmpty()) { -286 throw new ParseException("Query is null or empty"); -287 } -288 final Query query = queryParser.parse(searchString); -289 return indexSearcher.search(query, maxQueryResults); -290 } -291 -292 /** -293 * Searches the index using the given query. -294 * -295 * @param query the query used to search the index -296 * @param maxQueryResults the max number of results to return -297 * @return the TopDocs found be the query -298 * @throws CorruptIndexException thrown if the Index is corrupt -299 * @throws IOException thrown if there is an IOException -300 */ -301 public TopDocs search(Query query, int maxQueryResults) throws CorruptIndexException, IOException { -302 resetSearchingAnalyzer(); -303 return indexSearcher.search(query, maxQueryResults); -304 } -305 -306 /** -307 * Retrieves a document from the Index. -308 * -309 * @param documentId the id of the document to retrieve -310 * @return the Document -311 * @throws IOException thrown if there is an IOException -312 */ -313 public Document getDocument(int documentId) throws IOException { -314 return indexSearcher.doc(documentId); -315 } -316 -317 /** -318 * Returns the number of CPE entries stored in the index. -319 * -320 * @return the number of CPE entries stored in the index -321 */ -322 public int numDocs() { -323 if (indexReader == null) { -324 return -1; -325 } -326 return indexReader.numDocs(); -327 } -328 } +45 import org.owasp.dependencycheck.data.lucene.LuceneUtils; +46 import org.owasp.dependencycheck.data.lucene.SearchFieldAnalyzer; +47 import org.owasp.dependencycheck.data.nvdcve.CveDB; +48 +49 /** +50 * An in memory lucene index that contains the vendor/product combinations from the CPE (application) identifiers within +51 * the NVD CVE data. +52 * +53 * @author Jeremy Long <jeremy.long@owasp.org> +54 */ +55 public final class CpeMemoryIndex { +56 +57 /** +58 * singleton instance. +59 */ +60 private static CpeMemoryIndex instance = new CpeMemoryIndex(); +61 +62 /** +63 * private constructor for singleton. +64 */ +65 private CpeMemoryIndex() { +66 } +67 +68 /** +69 * Gets the singleton instance of the CpeMemoryIndex. +70 * +71 * @return the instance of the CpeMemoryIndex +72 */ +73 public static CpeMemoryIndex getInstance() { +74 return instance; +75 } +76 /** +77 * The in memory Lucene index. +78 */ +79 private RAMDirectory index; +80 /** +81 * The Lucene IndexReader. +82 */ +83 private IndexReader indexReader; +84 /** +85 * The Lucene IndexSearcher. +86 */ +87 private IndexSearcher indexSearcher; +88 /** +89 * The Lucene Analyzer used for Searching. +90 */ +91 private Analyzer searchingAnalyzer; +92 /** +93 * The Lucene QueryParser used for Searching. +94 */ +95 private QueryParser queryParser; +96 /** +97 * The search field analyzer for the product field. +98 */ +99 private SearchFieldAnalyzer productSearchFieldAnalyzer; +100 /** +101 * The search field analyzer for the vendor field. +102 */ +103 private SearchFieldAnalyzer vendorSearchFieldAnalyzer; +104 +105 /** +106 * Creates and loads data into an in memory index. +107 * +108 * @param cve the data source to retrieve the cpe data +109 * @throws IndexException thrown if there is an error creating the index +110 */ +111 public void open(CveDB cve) throws IndexException { +112 if (!openState) { +113 index = new RAMDirectory(); +114 buildIndex(cve); +115 try { +116 indexReader = DirectoryReader.open(index); +117 } catch (IOException ex) { +118 throw new IndexException(ex); +119 } +120 indexSearcher = new IndexSearcher(indexReader); +121 searchingAnalyzer = createSearchingAnalyzer(); +122 queryParser = new QueryParser(LuceneUtils.CURRENT_VERSION, Fields.DOCUMENT_KEY, searchingAnalyzer); +123 openState = true; +124 } +125 } +126 /** +127 * A flag indicating whether or not the index is open. +128 */ +129 private boolean openState = false; +130 +131 /** +132 * returns whether or not the index is open. +133 * +134 * @return whether or not the index is open +135 */ +136 public boolean isOpen() { +137 return openState; +138 } +139 +140 /** +141 * Creates the indexing analyzer for the CPE Index. +142 * +143 * @return the CPE Analyzer. +144 */ +145 @SuppressWarnings("unchecked") +146 private Analyzer createIndexingAnalyzer() { +147 final Map fieldAnalyzers = new HashMap(); +148 fieldAnalyzers.put(Fields.DOCUMENT_KEY, new KeywordAnalyzer()); +149 return new PerFieldAnalyzerWrapper(new FieldAnalyzer(LuceneUtils.CURRENT_VERSION), fieldAnalyzers); +150 } +151 +152 /** +153 * Creates an Analyzer for searching the CPE Index. +154 * +155 * @return the CPE Analyzer. +156 */ +157 @SuppressWarnings("unchecked") +158 private Analyzer createSearchingAnalyzer() { +159 final Map fieldAnalyzers = new HashMap(); +160 fieldAnalyzers.put(Fields.DOCUMENT_KEY, new KeywordAnalyzer()); +161 productSearchFieldAnalyzer = new SearchFieldAnalyzer(LuceneUtils.CURRENT_VERSION); +162 vendorSearchFieldAnalyzer = new SearchFieldAnalyzer(LuceneUtils.CURRENT_VERSION); +163 fieldAnalyzers.put(Fields.PRODUCT, productSearchFieldAnalyzer); +164 fieldAnalyzers.put(Fields.VENDOR, vendorSearchFieldAnalyzer); +165 +166 return new PerFieldAnalyzerWrapper(new FieldAnalyzer(LuceneUtils.CURRENT_VERSION), fieldAnalyzers); +167 } +168 +169 /** +170 * Saves a CPE IndexEntry into the Lucene index. +171 * +172 * @param vendor the vendor to index +173 * @param product the product to index +174 * @param indexWriter the index writer to write the entry into +175 * @throws CorruptIndexException is thrown if the index is corrupt +176 * @throws IOException is thrown if an IOException occurs +177 */ +178 public void saveEntry(String vendor, String product, IndexWriter indexWriter) throws CorruptIndexException, IOException { +179 final Document doc = new Document(); +180 final Field v = new TextField(Fields.VENDOR, vendor, Field.Store.YES); +181 final Field p = new TextField(Fields.PRODUCT, product, Field.Store.YES); +182 doc.add(v); +183 doc.add(p); +184 indexWriter.addDocument(doc); +185 } +186 +187 /** +188 * Closes the CPE Index. +189 */ +190 public void close() { +191 if (searchingAnalyzer != null) { +192 searchingAnalyzer.close(); +193 searchingAnalyzer = null; +194 } +195 if (indexReader != null) { +196 try { +197 indexReader.close(); +198 } catch (IOException ex) { +199 Logger.getLogger(CpeMemoryIndex.class.getName()).log(Level.FINEST, null, ex); +200 } +201 indexReader = null; +202 } +203 queryParser = null; +204 indexSearcher = null; +205 if (index != null) { +206 index.close(); +207 index = null; +208 } +209 openState = false; +210 } +211 +212 /** +213 * Builds the lucene index based off of the data within the CveDB. +214 * +215 * @param cve the data base containing the CPE data +216 * @throws IndexException thrown if there is an issue creating the index +217 */ +218 private void buildIndex(CveDB cve) throws IndexException { +219 Analyzer analyzer = null; +220 IndexWriter indexWriter = null; +221 try { +222 analyzer = createIndexingAnalyzer(); +223 final IndexWriterConfig conf = new IndexWriterConfig(LuceneUtils.CURRENT_VERSION, analyzer); +224 indexWriter = new IndexWriter(index, conf); +225 final ResultSet rs = cve.getVendorProductList(); +226 if (rs == null) { +227 throw new IndexException("No data exists"); +228 } +229 try { +230 while (rs.next()) { +231 saveEntry(rs.getString(1), rs.getString(2), indexWriter); +232 } +233 } catch (SQLException ex) { +234 Logger.getLogger(CpeMemoryIndex.class.getName()).log(Level.FINE, null, ex); +235 throw new IndexException("Error reading CPE data", ex); +236 } +237 } catch (CorruptIndexException ex) { +238 throw new IndexException("Unable to close an in-memory index", ex); +239 } catch (IOException ex) { +240 throw new IndexException("Unable to close an in-memory index", ex); +241 } finally { +242 if (indexWriter != null) { +243 try { +244 try { +245 indexWriter.commit(); +246 } finally { +247 indexWriter.close(true); +248 } +249 } catch (CorruptIndexException ex) { +250 throw new IndexException("Unable to close an in-memory index", ex); +251 } catch (IOException ex) { +252 throw new IndexException("Unable to close an in-memory index", ex); +253 } +254 if (analyzer != null) { +255 analyzer.close(); +256 } +257 } +258 } +259 } +260 +261 /** +262 * Resets the searching analyzers +263 */ +264 private void resetSearchingAnalyzer() { +265 if (productSearchFieldAnalyzer != null) { +266 productSearchFieldAnalyzer.clear(); +267 } +268 if (vendorSearchFieldAnalyzer != null) { +269 vendorSearchFieldAnalyzer.clear(); +270 } +271 } +272 +273 /** +274 * Searches the index using the given search string. +275 * +276 * @param searchString the query text +277 * @param maxQueryResults the maximum number of documents to return +278 * @return the TopDocs found by the search +279 * @throws ParseException thrown when the searchString is invalid +280 * @throws IOException is thrown if there is an issue with the underlying Index +281 */ +282 public TopDocs search(String searchString, int maxQueryResults) throws ParseException, IOException { +283 if (searchString == null || searchString.trim().isEmpty()) { +284 throw new ParseException("Query is null or empty"); +285 } +286 final Query query = queryParser.parse(searchString); +287 return indexSearcher.search(query, maxQueryResults); +288 } +289 +290 /** +291 * Searches the index using the given query. +292 * +293 * @param query the query used to search the index +294 * @param maxQueryResults the max number of results to return +295 * @return the TopDocs found be the query +296 * @throws CorruptIndexException thrown if the Index is corrupt +297 * @throws IOException thrown if there is an IOException +298 */ +299 public TopDocs search(Query query, int maxQueryResults) throws CorruptIndexException, IOException { +300 resetSearchingAnalyzer(); +301 return indexSearcher.search(query, maxQueryResults); +302 } +303 +304 /** +305 * Retrieves a document from the Index. +306 * +307 * @param documentId the id of the document to retrieve +308 * @return the Document +309 * @throws IOException thrown if there is an IOException +310 */ +311 public Document getDocument(int documentId) throws IOException { +312 return indexSearcher.doc(documentId); +313 } +314 +315 /** +316 * Returns the number of CPE entries stored in the index. +317 * +318 * @return the number of CPE entries stored in the index +319 */ +320 public int numDocs() { +321 if (indexReader == null) { +322 return -1; +323 } +324 return indexReader.numDocs(); +325 } +326 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/cpe/Fields.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/cpe/Fields.html index d56c93e33..4ba1c1564 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/cpe/Fields.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/cpe/Fields.html @@ -9,47 +9,45 @@ 1 /* 2 * This file is part of dependency-check-core. 3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. -18 */ -19 package org.owasp.dependencycheck.data.cpe; -20 -21 /** -22 * Fields is a collection of field names used within the Lucene index for CPE -23 * entries. -24 * -25 * @author Jeremy Long <jeremy.long@owasp.org> -26 */ -27 public abstract class Fields { -28 -29 /** -30 * The key for the name document id. -31 */ -32 public static final String DOCUMENT_KEY = "id"; -33 /** -34 * The key for the vendor field. -35 */ -36 public static final String VENDOR = "vendor"; -37 /** -38 * The key for the product field. -39 */ -40 public static final String PRODUCT = "product"; -41 /** -42 * The key for the version field. -43 */ -44 } +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. +17 */ +18 package org.owasp.dependencycheck.data.cpe; +19 +20 /** +21 * Fields is a collection of field names used within the Lucene index for CPE entries. +22 * +23 * @author Jeremy Long <jeremy.long@owasp.org> +24 */ +25 public abstract class Fields { +26 +27 /** +28 * The key for the name document id. +29 */ +30 public static final String DOCUMENT_KEY = "id"; +31 /** +32 * The key for the vendor field. +33 */ +34 public static final String VENDOR = "vendor"; +35 /** +36 * The key for the product field. +37 */ +38 public static final String PRODUCT = "product"; +39 /** +40 * The key for the version field. +41 */ +42 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/cpe/IndexEntry.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/cpe/IndexEntry.html index ab183d995..42f8e5e6f 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/cpe/IndexEntry.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/cpe/IndexEntry.html @@ -9,192 +9,193 @@ 1 /* 2 * This file is part of dependency-check-core. 3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. -18 */ -19 package org.owasp.dependencycheck.data.cpe; -20 -21 import java.io.Serializable; -22 import java.io.UnsupportedEncodingException; -23 import java.net.URLDecoder; -24 -25 /** -26 * A CPE entry containing the name, vendor, product, and version. -27 * -28 * @author Jeremy Long <jeremy.long@owasp.org> -29 */ -30 public class IndexEntry implements Serializable { -31 -32 /** -33 * the serial version uid. -34 */ -35 static final long serialVersionUID = 8011924485946326934L; -36 /** -37 * The vendor name. -38 */ -39 private String vendor; -40 /** -41 * The documentId. -42 */ -43 private String documentId; -44 -45 /** -46 * Get the value of documentId. -47 * -48 * @return the value of documentId -49 */ -50 public String getDocumentId() { -51 if (documentId == null && vendor != null && product != null) { -52 documentId = vendor + ":" + product; -53 } -54 return documentId; -55 } -56 -57 /** -58 * Set the value of documentId. -59 * -60 * @param documentId new value of documentId -61 */ -62 public void setDocumentId(String documentId) { -63 this.documentId = documentId; -64 } -65 -66 /** -67 * Get the value of vendor. -68 * -69 * @return the value of vendor -70 */ -71 public String getVendor() { -72 return vendor; -73 } -74 -75 /** -76 * Set the value of vendor. -77 * -78 * @param vendor new value of vendor -79 */ -80 public void setVendor(String vendor) { -81 this.vendor = vendor; -82 } -83 /** -84 * The product name. -85 */ -86 private String product; -87 -88 /** -89 * Get the value of product. -90 * -91 * @return the value of product -92 */ -93 public String getProduct() { -94 return product; -95 } -96 -97 /** -98 * Set the value of product. -99 * -100 * @param product new value of product -101 */ -102 public void setProduct(String product) { -103 this.product = product; -104 } -105 /** -106 * The search score. -107 */ -108 private float searchScore; -109 -110 /** -111 * Get the value of searchScore. -112 * -113 * @return the value of searchScore -114 */ -115 public float getSearchScore() { -116 return searchScore; -117 } -118 -119 /** -120 * Set the value of searchScore. -121 * -122 * @param searchScore new value of searchScore -123 */ -124 public void setSearchScore(float searchScore) { -125 this.searchScore = searchScore; -126 } -127 -128 /** -129 * <p>Parses a name attribute value, from the cpe.xml, into its -130 * corresponding parts: vendor, product.</p> -131 * <p>Example:</p> +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. +17 */ +18 package org.owasp.dependencycheck.data.cpe; +19 +20 import java.io.Serializable; +21 import java.io.UnsupportedEncodingException; +22 import java.net.URLDecoder; +23 +24 /** +25 * A CPE entry containing the name, vendor, product, and version. +26 * +27 * @author Jeremy Long <jeremy.long@owasp.org> +28 */ +29 public class IndexEntry implements Serializable { +30 +31 /** +32 * the serial version uid. +33 */ +34 static final long serialVersionUID = 8011924485946326934L; +35 /** +36 * The vendor name. +37 */ +38 private String vendor; +39 /** +40 * The documentId. +41 */ +42 private String documentId; +43 +44 /** +45 * Get the value of documentId. +46 * +47 * @return the value of documentId +48 */ +49 public String getDocumentId() { +50 if (documentId == null && vendor != null && product != null) { +51 documentId = vendor + ":" + product; +52 } +53 return documentId; +54 } +55 +56 /** +57 * Set the value of documentId. +58 * +59 * @param documentId new value of documentId +60 */ +61 public void setDocumentId(String documentId) { +62 this.documentId = documentId; +63 } +64 +65 /** +66 * Get the value of vendor. +67 * +68 * @return the value of vendor +69 */ +70 public String getVendor() { +71 return vendor; +72 } +73 +74 /** +75 * Set the value of vendor. +76 * +77 * @param vendor new value of vendor +78 */ +79 public void setVendor(String vendor) { +80 this.vendor = vendor; +81 } +82 /** +83 * The product name. +84 */ +85 private String product; +86 +87 /** +88 * Get the value of product. +89 * +90 * @return the value of product +91 */ +92 public String getProduct() { +93 return product; +94 } +95 +96 /** +97 * Set the value of product. +98 * +99 * @param product new value of product +100 */ +101 public void setProduct(String product) { +102 this.product = product; +103 } +104 /** +105 * The search score. +106 */ +107 private float searchScore; +108 +109 /** +110 * Get the value of searchScore. +111 * +112 * @return the value of searchScore +113 */ +114 public float getSearchScore() { +115 return searchScore; +116 } +117 +118 /** +119 * Set the value of searchScore. +120 * +121 * @param searchScore new value of searchScore +122 */ +123 public void setSearchScore(float searchScore) { +124 this.searchScore = searchScore; +125 } +126 +127 /** +128 * <p> +129 * Parses a name attribute value, from the cpe.xml, into its corresponding parts: vendor, product.</p> +130 * <p> +131 * Example:</p> 132 * <code>nbsp;nbsp;nbsp;cpe:/a:apache:struts:1.1:rc2</code> 133 * -134 * <p>Results in:</p> <ul> <li>Vendor: apache</li> <li>Product: struts</li> -135 * </ul> -136 * <p>If it is necessary to parse the CPE into more parts (i.e. to include -137 * version and revision) then you should use the -138 * {@link org.owasp.dependencycheck.dependency.VulnerableSoftware#parseName VulnerableSoftware.parseName()}. -139 * -140 * @param cpeName the cpe name -141 * @throws UnsupportedEncodingException should never be thrown... -142 */ -143 public void parseName(String cpeName) throws UnsupportedEncodingException { -144 if (cpeName != null && cpeName.length() > 7) { -145 final String[] data = cpeName.substring(7).split(":"); -146 if (data.length >= 1) { -147 vendor = URLDecoder.decode(data[0].replace("+", "%2B"), "UTF-8"); -148 if (data.length >= 2) { -149 product = URLDecoder.decode(data[1].replace("+", "%2B"), "UTF-8"); -150 } -151 } -152 } -153 } -154 -155 @Override -156 public int hashCode() { -157 int hash = 7; -158 hash = 97 * hash + (this.getDocumentId() != null ? this.getDocumentId().hashCode() : 0); -159 return hash; -160 } -161 -162 @Override -163 public boolean equals(Object obj) { -164 if (obj == null) { -165 return false; -166 } -167 if (getClass() != obj.getClass()) { -168 return false; -169 } -170 final IndexEntry other = (IndexEntry) obj; -171 if ((this.vendor == null) ? (other.vendor != null) : !this.vendor.equals(other.vendor)) { -172 return false; -173 } -174 if ((this.product == null) ? (other.product != null) : !this.product.equals(other.product)) { -175 return false; -176 } -177 return true; -178 } -179 -180 /** -181 * Standard implementation of toString showing vendor and product. -182 * -183 * @return the string representation of the object -184 */ -185 @Override -186 public String toString() { -187 return "IndexEntry{" + "vendor=" + vendor + ", product=" + product + '}'; -188 } -189 } +134 * <p> +135 * Results in:</p> <ul> <li>Vendor: apache</li> <li>Product: struts</li> +136 * </ul> +137 * <p> +138 * If it is necessary to parse the CPE into more parts (i.e. to include version and revision) then you should use +139 * the {@link org.owasp.dependencycheck.dependency.VulnerableSoftware#parseName VulnerableSoftware.parseName()}. +140 * +141 * @param cpeName the cpe name +142 * @throws UnsupportedEncodingException should never be thrown... +143 */ +144 public void parseName(String cpeName) throws UnsupportedEncodingException { +145 if (cpeName != null && cpeName.length() > 7) { +146 final String[] data = cpeName.substring(7).split(":"); +147 if (data.length >= 1) { +148 vendor = URLDecoder.decode(data[0].replace("+", "%2B"), "UTF-8"); +149 if (data.length >= 2) { +150 product = URLDecoder.decode(data[1].replace("+", "%2B"), "UTF-8"); +151 } +152 } +153 } +154 } +155 +156 @Override +157 public int hashCode() { +158 int hash = 7; +159 hash = 97 * hash + (this.getDocumentId() != null ? this.getDocumentId().hashCode() : 0); +160 return hash; +161 } +162 +163 @Override +164 public boolean equals(Object obj) { +165 if (obj == null) { +166 return false; +167 } +168 if (getClass() != obj.getClass()) { +169 return false; +170 } +171 final IndexEntry other = (IndexEntry) obj; +172 if ((this.vendor == null) ? (other.vendor != null) : !this.vendor.equals(other.vendor)) { +173 return false; +174 } +175 if ((this.product == null) ? (other.product != null) : !this.product.equals(other.product)) { +176 return false; +177 } +178 return true; +179 } +180 +181 /** +182 * Standard implementation of toString showing vendor and product. +183 * +184 * @return the string representation of the object +185 */ +186 @Override +187 public String toString() { +188 return "IndexEntry{" + "vendor=" + vendor + ", product=" + product + '}'; +189 } +190 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/cpe/IndexException.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/cpe/IndexException.html index ecd751045..22a20d333 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/cpe/IndexException.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/cpe/IndexException.html @@ -9,70 +9,69 @@ 1 /* 2 * This file is part of dependency-check-core. 3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. -18 */ -19 package org.owasp.dependencycheck.data.cpe; -20 -21 /** -22 * An exception thrown when the there is an issue using the in-memory CPE Index. -23 * -24 * @author Jeremy Long <jeremy.long@owasp.org> -25 */ -26 public class IndexException extends Exception { -27 -28 /** -29 * The serial version UID for serialization. -30 */ -31 private static final long serialVersionUID = 1L; -32 -33 /** -34 * Creates a new IndexException. -35 */ -36 public IndexException() { -37 super(); -38 } -39 -40 /** -41 * Creates a new IndexException. -42 * -43 * @param msg a message for the exception. -44 */ -45 public IndexException(String msg) { -46 super(msg); -47 } -48 -49 /** -50 * Creates a new IndexException. -51 * -52 * @param ex the cause of the failure. -53 */ -54 public IndexException(Throwable ex) { -55 super(ex); -56 } -57 -58 /** -59 * Creates a new IndexException. -60 * -61 * @param msg a message for the exception. -62 * @param ex the cause of the failure. -63 */ -64 public IndexException(String msg, Throwable ex) { -65 super(msg, ex); -66 } -67 } +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. +17 */ +18 package org.owasp.dependencycheck.data.cpe; +19 +20 /** +21 * An exception thrown when the there is an issue using the in-memory CPE Index. +22 * +23 * @author Jeremy Long <jeremy.long@owasp.org> +24 */ +25 public class IndexException extends Exception { +26 +27 /** +28 * The serial version UID for serialization. +29 */ +30 private static final long serialVersionUID = 1L; +31 +32 /** +33 * Creates a new IndexException. +34 */ +35 public IndexException() { +36 super(); +37 } +38 +39 /** +40 * Creates a new IndexException. +41 * +42 * @param msg a message for the exception. +43 */ +44 public IndexException(String msg) { +45 super(msg); +46 } +47 +48 /** +49 * Creates a new IndexException. +50 * +51 * @param ex the cause of the failure. +52 */ +53 public IndexException(Throwable ex) { +54 super(ex); +55 } +56 +57 /** +58 * Creates a new IndexException. +59 * +60 * @param msg a message for the exception. +61 * @param ex the cause of the failure. +62 */ +63 public IndexException(String msg, Throwable ex) { +64 super(msg, ex); +65 } +66 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/cpe/package-frame.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/cpe/package-frame.html index 8fb90f167..1e0e0934b 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/cpe/package-frame.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/cpe/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.0.8 Reference Package org.owasp.dependencycheck.data.cpe + Dependency-Check Core 1.1.0 Reference Package org.owasp.dependencycheck.data.cpe diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/cpe/package-summary.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/cpe/package-summary.html index 78f04706f..f38ac9695 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/cpe/package-summary.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/cpe/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.0.8 Reference Package org.owasp.dependencycheck.data.cpe + Dependency-Check Core 1.1.0 Reference Package org.owasp.dependencycheck.data.cpe diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/cwe/CweDB.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/cwe/CweDB.html index e650cc2bf..e1b73f806 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/cwe/CweDB.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/cwe/CweDB.html @@ -9,79 +9,79 @@ 1 /* 2 * This file is part of dependency-check-core. 3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. -18 */ -19 package org.owasp.dependencycheck.data.cwe; -20 -21 import java.io.IOException; -22 import java.io.InputStream; -23 import java.io.ObjectInputStream; -24 import java.util.HashMap; -25 import java.util.logging.Level; -26 import java.util.logging.Logger; -27 -28 /** -29 * -30 * @author Jeremy Long <jeremy.long@owasp.org> -31 */ -32 public final class CweDB { -33 -34 /** -35 * Empty private constructor as this is a utility class. -36 */ -37 private CweDB() { -38 //empty -39 } -40 /** -41 * A HashMap of the CWE data. -42 */ -43 private static final HashMap<String, String> CWE = loadData(); -44 -45 /** -46 * Loads a HashMap containing the CWE data from a resource found in the jar. -47 * -48 * @return a HashMap of CWE data -49 */ -50 private static HashMap<String, String> loadData() { -51 ObjectInputStream oin = null; -52 try { -53 final String filePath = "data/cwe.hashmap.serialized"; -54 final InputStream input = CweDB.class.getClassLoader().getResourceAsStream(filePath); -55 oin = new ObjectInputStream(input); -56 return (HashMap<String, String>) oin.readObject(); -57 } catch (ClassNotFoundException ex) { -58 Logger.getLogger(CweDB.class.getName()).log(Level.WARNING, "Unable to load CWE data. This should not be an issue."); -59 Logger.getLogger(CweDB.class.getName()).log(Level.FINE, null, ex); -60 } catch (IOException ex) { -61 Logger.getLogger(CweDB.class.getName()).log(Level.WARNING, "Unable to load CWE data due to an IO Error. This should not be an issue."); -62 Logger.getLogger(CweDB.class.getName()).log(Level.FINE, null, ex); -63 } finally { -64 if (oin != null) { -65 try { -66 oin.close(); -67 } catch (IOException ex) { -68 Logger.getLogger(CweDB.class.getName()).log(Level.FINEST, null, ex); -69 } -70 } -71 } -72 return null; -73 } -74 -75 /** -76 * <p>Returns the full CWE name from the CWE ID.</p> +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. +17 */ +18 package org.owasp.dependencycheck.data.cwe; +19 +20 import java.io.IOException; +21 import java.io.InputStream; +22 import java.io.ObjectInputStream; +23 import java.util.HashMap; +24 import java.util.logging.Level; +25 import java.util.logging.Logger; +26 +27 /** +28 * +29 * @author Jeremy Long <jeremy.long@owasp.org> +30 */ +31 public final class CweDB { +32 +33 /** +34 * Empty private constructor as this is a utility class. +35 */ +36 private CweDB() { +37 //empty +38 } +39 /** +40 * A HashMap of the CWE data. +41 */ +42 private static final HashMap<String, String> CWE = loadData(); +43 +44 /** +45 * Loads a HashMap containing the CWE data from a resource found in the jar. +46 * +47 * @return a HashMap of CWE data +48 */ +49 private static HashMap<String, String> loadData() { +50 ObjectInputStream oin = null; +51 try { +52 final String filePath = "data/cwe.hashmap.serialized"; +53 final InputStream input = CweDB.class.getClassLoader().getResourceAsStream(filePath); +54 oin = new ObjectInputStream(input); +55 return (HashMap<String, String>) oin.readObject(); +56 } catch (ClassNotFoundException ex) { +57 Logger.getLogger(CweDB.class.getName()).log(Level.WARNING, "Unable to load CWE data. This should not be an issue."); +58 Logger.getLogger(CweDB.class.getName()).log(Level.FINE, null, ex); +59 } catch (IOException ex) { +60 Logger.getLogger(CweDB.class.getName()).log(Level.WARNING, "Unable to load CWE data due to an IO Error. This should not be an issue."); +61 Logger.getLogger(CweDB.class.getName()).log(Level.FINE, null, ex); +62 } finally { +63 if (oin != null) { +64 try { +65 oin.close(); +66 } catch (IOException ex) { +67 Logger.getLogger(CweDB.class.getName()).log(Level.FINEST, null, ex); +68 } +69 } +70 } +71 return null; +72 } +73 +74 /** +75 * <p> +76 * Returns the full CWE name from the CWE ID.</p> 77 * 78 * @param cweId the CWE ID 79 * @return the full name of the CWE diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/cwe/CweHandler.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/cwe/CweHandler.html index 6c568e6c3..29471729a 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/cwe/CweHandler.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/cwe/CweHandler.html @@ -9,59 +9,58 @@ 1 /* 2 * This file is part of dependency-check-core. 3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. -18 */ -19 package org.owasp.dependencycheck.data.cwe; -20 -21 import java.util.HashMap; -22 import org.xml.sax.Attributes; -23 import org.xml.sax.SAXException; -24 import org.xml.sax.helpers.DefaultHandler; -25 -26 /** -27 * A SAX Handler that will parse the CWE XML. -28 * -29 * @author Jeremy Long <jeremy.long@owasp.org> -30 */ -31 public class CweHandler extends DefaultHandler { -32 -33 /** -34 * a HashMap containing the CWE data. -35 */ -36 private final HashMap<String, String> cwe = new HashMap<String, String>(); -37 -38 /** -39 * Returns the HashMap of CWE entries (CWE-ID, Full CWE Name). -40 * -41 * @return a HashMap of CWE entries <String, String> -42 */ -43 public HashMap<String, String> getCwe() { -44 return cwe; -45 } -46 -47 @Override -48 public void startElement(String uri, String localName, String qName, Attributes attributes) throws SAXException { -49 -50 if ("Weakness".equals(qName) || "Category".equals(qName)) { -51 final String id = "CWE-" + attributes.getValue("ID"); -52 final String name = attributes.getValue("Name"); -53 cwe.put(id, name); -54 } -55 } -56 } +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. +17 */ +18 package org.owasp.dependencycheck.data.cwe; +19 +20 import java.util.HashMap; +21 import org.xml.sax.Attributes; +22 import org.xml.sax.SAXException; +23 import org.xml.sax.helpers.DefaultHandler; +24 +25 /** +26 * A SAX Handler that will parse the CWE XML. +27 * +28 * @author Jeremy Long <jeremy.long@owasp.org> +29 */ +30 public class CweHandler extends DefaultHandler { +31 +32 /** +33 * a HashMap containing the CWE data. +34 */ +35 private final HashMap<String, String> cwe = new HashMap<String, String>(); +36 +37 /** +38 * Returns the HashMap of CWE entries (CWE-ID, Full CWE Name). +39 * +40 * @return a HashMap of CWE entries <String, String> +41 */ +42 public HashMap<String, String> getCwe() { +43 return cwe; +44 } +45 +46 @Override +47 public void startElement(String uri, String localName, String qName, Attributes attributes) throws SAXException { +48 +49 if ("Weakness".equals(qName) || "Category".equals(qName)) { +50 final String id = "CWE-" + attributes.getValue("ID"); +51 final String name = attributes.getValue("Name"); +52 cwe.put(id, name); +53 } +54 } +55 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/cwe/package-frame.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/cwe/package-frame.html index 7a8008d59..eb24f7df2 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/cwe/package-frame.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/cwe/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.0.8 Reference Package org.owasp.dependencycheck.data.cwe + Dependency-Check Core 1.1.0 Reference Package org.owasp.dependencycheck.data.cwe diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/cwe/package-summary.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/cwe/package-summary.html index eecb31b6f..af4cf2959 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/cwe/package-summary.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/cwe/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.0.8 Reference Package org.owasp.dependencycheck.data.cwe + Dependency-Check Core 1.1.0 Reference Package org.owasp.dependencycheck.data.cwe diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/lucene/AbstractTokenizingFilter.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/lucene/AbstractTokenizingFilter.html index e352cb045..d7fa58044 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/lucene/AbstractTokenizingFilter.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/lucene/AbstractTokenizingFilter.html @@ -9,88 +9,86 @@ 1 /* 2 * This file is part of dependency-check-core. 3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2013 Jeremy Long. All Rights Reserved. -18 */ -19 package org.owasp.dependencycheck.data.lucene; -20 -21 import java.util.LinkedList; -22 import org.apache.lucene.analysis.TokenFilter; -23 import org.apache.lucene.analysis.TokenStream; -24 import org.apache.lucene.analysis.tokenattributes.CharTermAttribute; -25 -26 /** -27 * An abstract tokenizing filter that can be used as the base for a tokenizing -28 * filter. -29 * -30 * @author Jeremy Long <jeremy.long@owasp.org> -31 */ -32 public abstract class AbstractTokenizingFilter extends TokenFilter { -33 -34 /** -35 * The char term attribute. -36 */ -37 private final CharTermAttribute termAtt = addAttribute(CharTermAttribute.class); -38 -39 /** -40 * Gets the CharTermAttribute. -41 * -42 * @return the CharTermAttribute -43 */ -44 protected CharTermAttribute getTermAtt() { -45 return termAtt; -46 } -47 /** -48 * A collection of tokens to add to the stream. -49 */ -50 private final LinkedList<String> tokens; -51 -52 /** -53 * Gets the list of tokens. -54 * -55 * @return the list of tokens -56 */ -57 protected LinkedList<String> getTokens() { -58 return tokens; -59 } -60 -61 /** -62 * Constructs a new AbstractTokenizingFilter. -63 * -64 * @param stream the TokenStream that this filter will process -65 */ -66 public AbstractTokenizingFilter(TokenStream stream) { -67 super(stream); -68 tokens = new LinkedList<String>(); -69 } -70 -71 /** -72 * Adds a term, if one exists, from the tokens collection. -73 * -74 * @return whether or not a new term was added -75 */ -76 protected boolean addTerm() { -77 final boolean termAdded = tokens.size() > 0; -78 if (termAdded) { -79 final String term = tokens.pop(); -80 clearAttributes(); -81 termAtt.append(term); -82 } -83 return termAdded; -84 } -85 } +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2013 Jeremy Long. All Rights Reserved. +17 */ +18 package org.owasp.dependencycheck.data.lucene; +19 +20 import java.util.LinkedList; +21 import org.apache.lucene.analysis.TokenFilter; +22 import org.apache.lucene.analysis.TokenStream; +23 import org.apache.lucene.analysis.tokenattributes.CharTermAttribute; +24 +25 /** +26 * An abstract tokenizing filter that can be used as the base for a tokenizing filter. +27 * +28 * @author Jeremy Long <jeremy.long@owasp.org> +29 */ +30 public abstract class AbstractTokenizingFilter extends TokenFilter { +31 +32 /** +33 * The char term attribute. +34 */ +35 private final CharTermAttribute termAtt = addAttribute(CharTermAttribute.class); +36 +37 /** +38 * Gets the CharTermAttribute. +39 * +40 * @return the CharTermAttribute +41 */ +42 protected CharTermAttribute getTermAtt() { +43 return termAtt; +44 } +45 /** +46 * A collection of tokens to add to the stream. +47 */ +48 private final LinkedList<String> tokens; +49 +50 /** +51 * Gets the list of tokens. +52 * +53 * @return the list of tokens +54 */ +55 protected LinkedList<String> getTokens() { +56 return tokens; +57 } +58 +59 /** +60 * Constructs a new AbstractTokenizingFilter. +61 * +62 * @param stream the TokenStream that this filter will process +63 */ +64 public AbstractTokenizingFilter(TokenStream stream) { +65 super(stream); +66 tokens = new LinkedList<String>(); +67 } +68 +69 /** +70 * Adds a term, if one exists, from the tokens collection. +71 * +72 * @return whether or not a new term was added +73 */ +74 protected boolean addTerm() { +75 final boolean termAdded = tokens.size() > 0; +76 if (termAdded) { +77 final String term = tokens.pop(); +78 clearAttributes(); +79 termAtt.append(term); +80 } +81 return termAdded; +82 } +83 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/lucene/AlphaNumericTokenizer.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/lucene/AlphaNumericTokenizer.html index 600eff4d6..02348a77e 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/lucene/AlphaNumericTokenizer.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/lucene/AlphaNumericTokenizer.html @@ -9,67 +9,65 @@ 1 /* 2 * This file is part of dependency-check-core. 3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2013 Jeremy Long. All Rights Reserved. -18 */ -19 package org.owasp.dependencycheck.data.lucene; -20 -21 import java.io.Reader; -22 import org.apache.lucene.analysis.util.CharTokenizer; -23 import org.apache.lucene.util.Version; -24 -25 /** -26 * Tokenizes the input breaking it into tokens when non-alpha/numeric characters -27 * are found. -28 * -29 * @author Jeremy Long <jeremy.long@owasp.org> -30 */ -31 public class AlphaNumericTokenizer extends CharTokenizer { -32 -33 /** -34 * Constructs a new AlphaNumericTokenizer. -35 * -36 * @param matchVersion the lucene version -37 * @param in the Reader -38 */ -39 public AlphaNumericTokenizer(Version matchVersion, Reader in) { -40 super(matchVersion, in); -41 } -42 -43 /** -44 * Constructs a new AlphaNumericTokenizer. -45 * -46 * @param matchVersion the lucene version -47 * @param factory the AttributeFactory -48 * @param in the Reader -49 */ -50 public AlphaNumericTokenizer(Version matchVersion, AttributeFactory factory, Reader in) { -51 super(matchVersion, factory, in); -52 } -53 -54 /** -55 * Determines if the char passed in is part of a token. -56 * -57 * @param c the char being analyzed -58 * @return true if the char is a letter or digit, otherwise false -59 */ -60 @Override -61 protected boolean isTokenChar(int c) { -62 return Character.isLetter(c) || Character.isDigit(c); -63 } -64 } +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2013 Jeremy Long. All Rights Reserved. +17 */ +18 package org.owasp.dependencycheck.data.lucene; +19 +20 import java.io.Reader; +21 import org.apache.lucene.analysis.util.CharTokenizer; +22 import org.apache.lucene.util.Version; +23 +24 /** +25 * Tokenizes the input breaking it into tokens when non-alpha/numeric characters are found. +26 * +27 * @author Jeremy Long <jeremy.long@owasp.org> +28 */ +29 public class AlphaNumericTokenizer extends CharTokenizer { +30 +31 /** +32 * Constructs a new AlphaNumericTokenizer. +33 * +34 * @param matchVersion the lucene version +35 * @param in the Reader +36 */ +37 public AlphaNumericTokenizer(Version matchVersion, Reader in) { +38 super(matchVersion, in); +39 } +40 +41 /** +42 * Constructs a new AlphaNumericTokenizer. +43 * +44 * @param matchVersion the lucene version +45 * @param factory the AttributeFactory +46 * @param in the Reader +47 */ +48 public AlphaNumericTokenizer(Version matchVersion, AttributeFactory factory, Reader in) { +49 super(matchVersion, factory, in); +50 } +51 +52 /** +53 * Determines if the char passed in is part of a token. +54 * +55 * @param c the char being analyzed +56 * @return true if the char is a letter or digit, otherwise false +57 */ +58 @Override +59 protected boolean isTokenChar(int c) { +60 return Character.isLetter(c) || Character.isDigit(c); +61 } +62 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/lucene/DependencySimilarity.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/lucene/DependencySimilarity.html index db42ad609..164f8a611 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/lucene/DependencySimilarity.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/lucene/DependencySimilarity.html @@ -9,53 +9,50 @@ 1 /* 2 * This file is part of dependency-check-core. 3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. -18 */ -19 package org.owasp.dependencycheck.data.lucene; -20 -21 import org.apache.lucene.search.similarities.DefaultSimilarity; -22 -23 /** -24 * -25 * @author Jeremy Long <jeremy.long@owasp.org> -26 */ -27 public class DependencySimilarity extends DefaultSimilarity { -28 -29 /** -30 * the serial version uid. -31 */ -32 private static final long serialVersionUID = 1L; -33 -34 /** -35 * <p>Override the default idf implementation so that frequency within all -36 * document is ignored.</p> -37 * -38 * See <a -39 * href="http://www.lucenetutorial.com/advanced-topics/scoring.html">this -40 * article</a> for more details. -41 * -42 * @param docFreq - the number of documents which contain the term -43 * @param numDocs - the total number of documents in the collection -44 * @return 1 -45 */ -46 @Override -47 public float idf(long docFreq, long numDocs) { -48 return 1; -49 } -50 } +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. +17 */ +18 package org.owasp.dependencycheck.data.lucene; +19 +20 import org.apache.lucene.search.similarities.DefaultSimilarity; +21 +22 /** +23 * +24 * @author Jeremy Long <jeremy.long@owasp.org> +25 */ +26 public class DependencySimilarity extends DefaultSimilarity { +27 +28 /** +29 * the serial version uid. +30 */ +31 private static final long serialVersionUID = 1L; +32 +33 /** +34 * <p> +35 * Override the default idf implementation so that frequency within all document is ignored.</p> +36 * +37 * See <a href="http://www.lucenetutorial.com/advanced-topics/scoring.html">this article</a> for more details. +38 * +39 * @param docFreq - the number of documents which contain the term +40 * @param numDocs - the total number of documents in the collection +41 * @return 1 +42 */ +43 @Override +44 public float idf(long docFreq, long numDocs) { +45 return 1; +46 } +47 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/lucene/FieldAnalyzer.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/lucene/FieldAnalyzer.html index 75936434e..8ce695248 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/lucene/FieldAnalyzer.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/lucene/FieldAnalyzer.html @@ -9,84 +9,83 @@ 1 /* 2 * This file is part of dependency-check-core. 3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. -18 */ -19 package org.owasp.dependencycheck.data.lucene; -20 -21 import java.io.Reader; -22 import org.apache.lucene.analysis.Analyzer; -23 import org.apache.lucene.analysis.TokenStream; -24 import org.apache.lucene.analysis.Tokenizer; -25 import org.apache.lucene.analysis.core.LowerCaseFilter; -26 import org.apache.lucene.analysis.core.StopAnalyzer; -27 import org.apache.lucene.analysis.core.StopFilter; -28 import org.apache.lucene.analysis.miscellaneous.WordDelimiterFilter; -29 import org.apache.lucene.util.Version; -30 -31 /** -32 * <p>A Lucene Analyzer that utilizes the WhitespaceTokenizer, -33 * WordDelimiterFilter, LowerCaseFilter, and StopFilter. The intended purpose of -34 * this Analyzer is to index the CPE fields vendor and product.</p> -35 * -36 * @author Jeremy Long <jeremy.long@owasp.org> -37 */ -38 public class FieldAnalyzer extends Analyzer { -39 -40 /** -41 * The Lucene Version used. -42 */ -43 private final Version version; -44 -45 /** -46 * Creates a new FieldAnalyzer. -47 * -48 * @param version the Lucene version -49 */ -50 public FieldAnalyzer(Version version) { -51 this.version = version; -52 } -53 -54 /** -55 * Creates the TokenStreamComponents -56 * -57 * @param fieldName the field name being analyzed -58 * @param reader the reader containing the input -59 * @return the TokenStreamComponents -60 */ -61 @Override -62 protected TokenStreamComponents createComponents(String fieldName, Reader reader) { -63 final Tokenizer source = new AlphaNumericTokenizer(version, reader); -64 -65 TokenStream stream = source; -66 -67 stream = new WordDelimiterFilter(stream, -68 WordDelimiterFilter.CATENATE_WORDS -69 | WordDelimiterFilter.GENERATE_WORD_PARTS -70 | WordDelimiterFilter.GENERATE_NUMBER_PARTS -71 | WordDelimiterFilter.PRESERVE_ORIGINAL -72 | WordDelimiterFilter.SPLIT_ON_CASE_CHANGE -73 | WordDelimiterFilter.SPLIT_ON_NUMERICS -74 | WordDelimiterFilter.STEM_ENGLISH_POSSESSIVE, null); -75 -76 stream = new LowerCaseFilter(version, stream); -77 stream = new StopFilter(version, stream, StopAnalyzer.ENGLISH_STOP_WORDS_SET); -78 -79 return new TokenStreamComponents(source, stream); -80 } -81 } +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. +17 */ +18 package org.owasp.dependencycheck.data.lucene; +19 +20 import java.io.Reader; +21 import org.apache.lucene.analysis.Analyzer; +22 import org.apache.lucene.analysis.TokenStream; +23 import org.apache.lucene.analysis.Tokenizer; +24 import org.apache.lucene.analysis.core.LowerCaseFilter; +25 import org.apache.lucene.analysis.core.StopAnalyzer; +26 import org.apache.lucene.analysis.core.StopFilter; +27 import org.apache.lucene.analysis.miscellaneous.WordDelimiterFilter; +28 import org.apache.lucene.util.Version; +29 +30 /** +31 * <p> +32 * A Lucene Analyzer that utilizes the WhitespaceTokenizer, WordDelimiterFilter, LowerCaseFilter, and StopFilter. The +33 * intended purpose of this Analyzer is to index the CPE fields vendor and product.</p> +34 * +35 * @author Jeremy Long <jeremy.long@owasp.org> +36 */ +37 public class FieldAnalyzer extends Analyzer { +38 +39 /** +40 * The Lucene Version used. +41 */ +42 private final Version version; +43 +44 /** +45 * Creates a new FieldAnalyzer. +46 * +47 * @param version the Lucene version +48 */ +49 public FieldAnalyzer(Version version) { +50 this.version = version; +51 } +52 +53 /** +54 * Creates the TokenStreamComponents +55 * +56 * @param fieldName the field name being analyzed +57 * @param reader the reader containing the input +58 * @return the TokenStreamComponents +59 */ +60 @Override +61 protected TokenStreamComponents createComponents(String fieldName, Reader reader) { +62 final Tokenizer source = new AlphaNumericTokenizer(version, reader); +63 +64 TokenStream stream = source; +65 +66 stream = new WordDelimiterFilter(stream, +67 WordDelimiterFilter.CATENATE_WORDS +68 | WordDelimiterFilter.GENERATE_WORD_PARTS +69 | WordDelimiterFilter.GENERATE_NUMBER_PARTS +70 | WordDelimiterFilter.PRESERVE_ORIGINAL +71 | WordDelimiterFilter.SPLIT_ON_CASE_CHANGE +72 | WordDelimiterFilter.SPLIT_ON_NUMERICS +73 | WordDelimiterFilter.STEM_ENGLISH_POSSESSIVE, null); +74 +75 stream = new LowerCaseFilter(version, stream); +76 stream = new StopFilter(version, stream, StopAnalyzer.ENGLISH_STOP_WORDS_SET); +77 +78 return new TokenStreamComponents(source, stream); +79 } +80 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/lucene/LuceneUtils.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/lucene/LuceneUtils.html index 369d856b4..ad88bf4cb 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/lucene/LuceneUtils.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/lucene/LuceneUtils.html @@ -9,114 +9,111 @@ 1 /* 2 * This file is part of dependency-check-core. 3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. -18 */ -19 package org.owasp.dependencycheck.data.lucene; -20 -21 import org.apache.lucene.util.Version; -22 -23 /** -24 * <p>Lucene utils is a set of utilize written to make constructing Lucene -25 * queries simpler.</p> -26 * -27 * @author Jeremy Long <jeremy.long@owasp.org> -28 */ -29 public final class LuceneUtils { -30 -31 /** -32 * The current version of Lucene being used. Declaring this one place so an -33 * upgrade doesn't require hunting through the code base. -34 */ -35 public static final Version CURRENT_VERSION = Version.LUCENE_45; -36 -37 /** -38 * Private constructor as this is a utility class. -39 */ -40 private LuceneUtils() { -41 } -42 -43 /** -44 * Appends the text to the supplied StringBuilder escaping Lucene control -45 * characters in the process. -46 * -47 * @param buf a StringBuilder to append the escaped text to -48 * @param text the data to be escaped -49 */ -50 @SuppressWarnings("fallthrough") -51 @edu.umd.cs.findbugs.annotations.SuppressWarnings( -52 value = "SF_SWITCH_NO_DEFAULT", -53 justification = "The switch below does have a default.") -54 public static void appendEscapedLuceneQuery(StringBuilder buf, -55 final CharSequence text) { -56 -57 if (text == null || buf == null) { -58 return; -59 } -60 -61 for (int i = 0; i < text.length(); i++) { -62 final char c = text.charAt(i); -63 switch (c) { -64 case '+': -65 case '-': -66 case '&': -67 case '|': -68 case '!': -69 case '(': -70 case ')': -71 case '{': -72 case '}': -73 case '[': -74 case ']': -75 case '^': -76 case '"': -77 case '~': -78 case '*': -79 case '?': -80 case ':': -81 case '\\': //it is supposed to fall through here -82 buf.append('\\'); -83 default: -84 buf.append(c); -85 break; -86 } -87 } -88 } -89 -90 /** -91 * Escapes the text passed in so that it is treated as data instead of -92 * control characters. -93 * -94 * @param text data to be escaped -95 * @return the escaped text. -96 */ -97 public static String escapeLuceneQuery(final CharSequence text) { -98 -99 if (text == null) { -100 return null; -101 } -102 -103 int size = text.length(); -104 size = size >> 1; -105 final StringBuilder buf = new StringBuilder(size); -106 -107 appendEscapedLuceneQuery(buf, text); -108 -109 return buf.toString(); -110 } -111 } +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. +17 */ +18 package org.owasp.dependencycheck.data.lucene; +19 +20 import org.apache.lucene.util.Version; +21 +22 /** +23 * <p> +24 * Lucene utils is a set of utilize written to make constructing Lucene queries simpler.</p> +25 * +26 * @author Jeremy Long <jeremy.long@owasp.org> +27 */ +28 public final class LuceneUtils { +29 +30 /** +31 * The current version of Lucene being used. Declaring this one place so an upgrade doesn't require hunting through +32 * the code base. +33 */ +34 public static final Version CURRENT_VERSION = Version.LUCENE_45; +35 +36 /** +37 * Private constructor as this is a utility class. +38 */ +39 private LuceneUtils() { +40 } +41 +42 /** +43 * Appends the text to the supplied StringBuilder escaping Lucene control characters in the process. +44 * +45 * @param buf a StringBuilder to append the escaped text to +46 * @param text the data to be escaped +47 */ +48 @SuppressWarnings("fallthrough") +49 @edu.umd.cs.findbugs.annotations.SuppressWarnings( +50 value = "SF_SWITCH_NO_DEFAULT", +51 justification = "The switch below does have a default.") +52 public static void appendEscapedLuceneQuery(StringBuilder buf, +53 final CharSequence text) { +54 +55 if (text == null || buf == null) { +56 return; +57 } +58 +59 for (int i = 0; i < text.length(); i++) { +60 final char c = text.charAt(i); +61 switch (c) { +62 case '+': +63 case '-': +64 case '&': +65 case '|': +66 case '!': +67 case '(': +68 case ')': +69 case '{': +70 case '}': +71 case '[': +72 case ']': +73 case '^': +74 case '"': +75 case '~': +76 case '*': +77 case '?': +78 case ':': +79 case '\\': //it is supposed to fall through here +80 buf.append('\\'); +81 default: +82 buf.append(c); +83 break; +84 } +85 } +86 } +87 +88 /** +89 * Escapes the text passed in so that it is treated as data instead of control characters. +90 * +91 * @param text data to be escaped +92 * @return the escaped text. +93 */ +94 public static String escapeLuceneQuery(final CharSequence text) { +95 +96 if (text == null) { +97 return null; +98 } +99 +100 int size = text.length(); +101 size = size >> 1; +102 final StringBuilder buf = new StringBuilder(size); +103 +104 appendEscapedLuceneQuery(buf, text); +105 +106 return buf.toString(); +107 } +108 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/lucene/SearchFieldAnalyzer.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/lucene/SearchFieldAnalyzer.html index 07a40b2e8..27deef010 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/lucene/SearchFieldAnalyzer.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/lucene/SearchFieldAnalyzer.html @@ -9,94 +9,94 @@ 1 /* 2 * This file is part of dependency-check-core. 3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. -18 */ -19 package org.owasp.dependencycheck.data.lucene; -20 -21 import java.io.Reader; -22 import org.apache.lucene.analysis.Analyzer; -23 import org.apache.lucene.analysis.TokenStream; -24 import org.apache.lucene.analysis.Tokenizer; -25 import org.apache.lucene.analysis.core.LowerCaseFilter; -26 import org.apache.lucene.analysis.core.StopAnalyzer; -27 import org.apache.lucene.analysis.core.StopFilter; -28 import org.apache.lucene.analysis.miscellaneous.WordDelimiterFilter; -29 import org.apache.lucene.util.Version; -30 -31 /** -32 * A Lucene field analyzer used to analyzer queries against the CPE data. -33 * -34 * @author Jeremy Long <jeremy.long@owasp.org> -35 */ -36 public class SearchFieldAnalyzer extends Analyzer { -37 -38 /** -39 * The Lucene Version used. -40 */ -41 private final Version version; -42 /** -43 * A local reference to the TokenPairConcatenatingFilter so that we can -44 * clear any left over state if this analyzer is re-used. -45 */ -46 private TokenPairConcatenatingFilter concatenatingFilter; -47 -48 /** -49 * Constructs a new SearchFieldAnalyzer. -50 * -51 * @param version the Lucene version -52 */ -53 public SearchFieldAnalyzer(Version version) { -54 this.version = version; -55 } -56 -57 /** -58 * Creates a the TokenStreamComponents used to analyze the stream. -59 * -60 * @param fieldName the field that this lucene analyzer will process -61 * @param reader a reader containing the tokens -62 * @return the token stream filter chain -63 */ -64 @Override -65 protected TokenStreamComponents createComponents(String fieldName, Reader reader) { -66 final Tokenizer source = new AlphaNumericTokenizer(version, reader); -67 -68 TokenStream stream = source; -69 -70 stream = new WordDelimiterFilter(stream, -71 WordDelimiterFilter.GENERATE_WORD_PARTS -72 | WordDelimiterFilter.GENERATE_NUMBER_PARTS -73 | WordDelimiterFilter.PRESERVE_ORIGINAL -74 | WordDelimiterFilter.SPLIT_ON_CASE_CHANGE -75 | WordDelimiterFilter.SPLIT_ON_NUMERICS -76 | WordDelimiterFilter.STEM_ENGLISH_POSSESSIVE, null); -77 -78 stream = new LowerCaseFilter(version, stream); -79 stream = new UrlTokenizingFilter(stream); -80 concatenatingFilter = new TokenPairConcatenatingFilter(stream); -81 stream = concatenatingFilter; -82 stream = new StopFilter(version, stream, StopAnalyzer.ENGLISH_STOP_WORDS_SET); -83 -84 return new TokenStreamComponents(source, stream); -85 } -86 -87 /** -88 * <p>Resets the analyzer and clears any internal state data that may have -89 * been left-over from previous uses of the analyzer.</p> -90 * <p><b>If this analyzer is re-used this method must be called between -91 * uses.</b></p> +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. +17 */ +18 package org.owasp.dependencycheck.data.lucene; +19 +20 import java.io.Reader; +21 import org.apache.lucene.analysis.Analyzer; +22 import org.apache.lucene.analysis.TokenStream; +23 import org.apache.lucene.analysis.Tokenizer; +24 import org.apache.lucene.analysis.core.LowerCaseFilter; +25 import org.apache.lucene.analysis.core.StopAnalyzer; +26 import org.apache.lucene.analysis.core.StopFilter; +27 import org.apache.lucene.analysis.miscellaneous.WordDelimiterFilter; +28 import org.apache.lucene.util.Version; +29 +30 /** +31 * A Lucene field analyzer used to analyzer queries against the CPE data. +32 * +33 * @author Jeremy Long <jeremy.long@owasp.org> +34 */ +35 public class SearchFieldAnalyzer extends Analyzer { +36 +37 /** +38 * The Lucene Version used. +39 */ +40 private final Version version; +41 /** +42 * A local reference to the TokenPairConcatenatingFilter so that we can clear any left over state if this analyzer +43 * is re-used. +44 */ +45 private TokenPairConcatenatingFilter concatenatingFilter; +46 +47 /** +48 * Constructs a new SearchFieldAnalyzer. +49 * +50 * @param version the Lucene version +51 */ +52 public SearchFieldAnalyzer(Version version) { +53 this.version = version; +54 } +55 +56 /** +57 * Creates a the TokenStreamComponents used to analyze the stream. +58 * +59 * @param fieldName the field that this lucene analyzer will process +60 * @param reader a reader containing the tokens +61 * @return the token stream filter chain +62 */ +63 @Override +64 protected TokenStreamComponents createComponents(String fieldName, Reader reader) { +65 final Tokenizer source = new AlphaNumericTokenizer(version, reader); +66 +67 TokenStream stream = source; +68 +69 stream = new WordDelimiterFilter(stream, +70 WordDelimiterFilter.GENERATE_WORD_PARTS +71 | WordDelimiterFilter.GENERATE_NUMBER_PARTS +72 | WordDelimiterFilter.PRESERVE_ORIGINAL +73 | WordDelimiterFilter.SPLIT_ON_CASE_CHANGE +74 | WordDelimiterFilter.SPLIT_ON_NUMERICS +75 | WordDelimiterFilter.STEM_ENGLISH_POSSESSIVE, null); +76 +77 stream = new LowerCaseFilter(version, stream); +78 stream = new UrlTokenizingFilter(stream); +79 concatenatingFilter = new TokenPairConcatenatingFilter(stream); +80 stream = concatenatingFilter; +81 stream = new StopFilter(version, stream, StopAnalyzer.ENGLISH_STOP_WORDS_SET); +82 +83 return new TokenStreamComponents(source, stream); +84 } +85 +86 /** +87 * <p> +88 * Resets the analyzer and clears any internal state data that may have been left-over from previous uses of the +89 * analyzer.</p> +90 * <p> +91 * <b>If this analyzer is re-used this method must be called between uses.</b></p> 92 */ 93 public void clear() { 94 if (concatenatingFilter != null) { diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/lucene/SearchVersionAnalyzer.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/lucene/SearchVersionAnalyzer.html index 4da60c659..b38c6e1f7 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/lucene/SearchVersionAnalyzer.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/lucene/SearchVersionAnalyzer.html @@ -9,77 +9,75 @@ 1 /* 2 * This file is part of dependency-check-core. 3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. -18 */ -19 package org.owasp.dependencycheck.data.lucene; -20 -21 import java.io.Reader; -22 import org.apache.lucene.analysis.Analyzer; -23 import org.apache.lucene.analysis.TokenStream; -24 import org.apache.lucene.analysis.Tokenizer; -25 import org.apache.lucene.analysis.core.LowerCaseFilter; -26 import org.apache.lucene.analysis.core.WhitespaceTokenizer; -27 import org.apache.lucene.util.Version; -28 -29 /** -30 * SearchVersionAnalyzer is a Lucene Analyzer used to analyze version -31 * information. -32 * -33 * @author Jeremy Long <jeremy.long@owasp.org> -34 * @deprecated version information is no longer stored in lucene -35 */ -36 @Deprecated -37 public class SearchVersionAnalyzer extends Analyzer { -38 //TODO consider implementing payloads/custom attributes... -39 // use custom attributes for major, minor, x, x, x, rcx -40 // these can then be used to weight the score for searches on the version. -41 // see http://lucene.apache.org/core/3_6_1/api/core/org/apache/lucene/analysis/package-summary.html#package_description -42 // look at this article to implement -43 // http://www.codewrecks.com/blog/index.php/2012/08/25/index-your-blog-using-tags-and-lucene-net/ -44 -45 /** -46 * The Lucene Version used. -47 */ -48 private final Version version; -49 -50 /** -51 * Creates a new SearchVersionAnalyzer. -52 * -53 * @param version the Lucene version -54 */ -55 public SearchVersionAnalyzer(Version version) { -56 this.version = version; -57 } -58 -59 /** -60 * Creates the TokenStreamComponents -61 * -62 * @param fieldName the field name being analyzed -63 * @param reader the reader containing the input -64 * @return the TokenStreamComponents -65 */ -66 @Override -67 protected TokenStreamComponents createComponents(String fieldName, Reader reader) { -68 final Tokenizer source = new WhitespaceTokenizer(version, reader); -69 TokenStream stream = source; -70 stream = new LowerCaseFilter(version, stream); -71 stream = new VersionTokenizingFilter(stream); -72 return new TokenStreamComponents(source, stream); -73 } -74 } +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. +17 */ +18 package org.owasp.dependencycheck.data.lucene; +19 +20 import java.io.Reader; +21 import org.apache.lucene.analysis.Analyzer; +22 import org.apache.lucene.analysis.TokenStream; +23 import org.apache.lucene.analysis.Tokenizer; +24 import org.apache.lucene.analysis.core.LowerCaseFilter; +25 import org.apache.lucene.analysis.core.WhitespaceTokenizer; +26 import org.apache.lucene.util.Version; +27 +28 /** +29 * SearchVersionAnalyzer is a Lucene Analyzer used to analyze version information. +30 * +31 * @author Jeremy Long <jeremy.long@owasp.org> +32 * @deprecated version information is no longer stored in lucene +33 */ +34 @Deprecated +35 public class SearchVersionAnalyzer extends Analyzer { +36 //TODO consider implementing payloads/custom attributes... +37 // use custom attributes for major, minor, x, x, x, rcx +38 // these can then be used to weight the score for searches on the version. +39 // see http://lucene.apache.org/core/3_6_1/api/core/org/apache/lucene/analysis/package-summary.html#package_description +40 // look at this article to implement +41 // http://www.codewrecks.com/blog/index.php/2012/08/25/index-your-blog-using-tags-and-lucene-net/ +42 +43 /** +44 * The Lucene Version used. +45 */ +46 private final Version version; +47 +48 /** +49 * Creates a new SearchVersionAnalyzer. +50 * +51 * @param version the Lucene version +52 */ +53 public SearchVersionAnalyzer(Version version) { +54 this.version = version; +55 } +56 +57 /** +58 * Creates the TokenStreamComponents +59 * +60 * @param fieldName the field name being analyzed +61 * @param reader the reader containing the input +62 * @return the TokenStreamComponents +63 */ +64 @Override +65 protected TokenStreamComponents createComponents(String fieldName, Reader reader) { +66 final Tokenizer source = new WhitespaceTokenizer(version, reader); +67 TokenStream stream = source; +68 stream = new LowerCaseFilter(version, stream); +69 stream = new VersionTokenizingFilter(stream); +70 return new TokenStreamComponents(source, stream); +71 } +72 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/lucene/TokenPairConcatenatingFilter.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/lucene/TokenPairConcatenatingFilter.html index cb5edd740..9726f78b8 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/lucene/TokenPairConcatenatingFilter.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/lucene/TokenPairConcatenatingFilter.html @@ -9,128 +9,127 @@ 1 /* 2 * This file is part of dependency-check-core. 3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. -18 */ -19 package org.owasp.dependencycheck.data.lucene; -20 -21 import java.io.IOException; -22 import java.util.LinkedList; -23 import org.apache.lucene.analysis.TokenFilter; -24 import org.apache.lucene.analysis.TokenStream; -25 import org.apache.lucene.analysis.tokenattributes.CharTermAttribute; -26 -27 /** -28 * <p>Takes a TokenStream and adds additional tokens by concatenating pairs of -29 * words.</p> -30 * <p><b>Example:</b> "Spring Framework Core" -> "Spring SpringFramework -31 * Framework FrameworkCore Core".</p> -32 * -33 * @author Jeremy Long <jeremy.long@owasp.org> -34 */ -35 public final class TokenPairConcatenatingFilter extends TokenFilter { -36 -37 /** -38 * The char term attribute. -39 */ -40 private final CharTermAttribute termAtt = addAttribute(CharTermAttribute.class); -41 /** -42 * The previous word parsed. -43 */ -44 private String previousWord; -45 /** -46 * A list of words parsed. -47 */ -48 private final LinkedList<String> words; -49 -50 /** -51 * Returns the previous word. This is needed in the test cases. -52 * -53 * @return te previous word -54 */ -55 protected String getPreviousWord() { -56 return previousWord; -57 } -58 -59 /** -60 * Returns the words list. This is needed in the test cases. -61 * -62 * @return the words list -63 */ -64 protected LinkedList<String> getWords() { -65 return words; -66 } -67 -68 /** -69 * Constructs a new TokenPairConcatenatingFilter. -70 * -71 * @param stream the TokenStream that this filter will process -72 */ -73 public TokenPairConcatenatingFilter(TokenStream stream) { -74 super(stream); -75 words = new LinkedList<String>(); -76 } -77 -78 /** -79 * Increments the underlying TokenStream and sets CharTermAttributes to -80 * construct an expanded set of tokens by concatenating tokens with the -81 * previous token. -82 * -83 * @return whether or not we have hit the end of the TokenStream -84 * @throws IOException is thrown when an IOException occurs -85 */ -86 @Override -87 public boolean incrementToken() throws IOException { -88 -89 //collect all the terms into the words collection -90 while (input.incrementToken()) { -91 final String word = new String(termAtt.buffer(), 0, termAtt.length()); -92 words.add(word); -93 } -94 -95 //if we have a previousTerm - write it out as its own token concatenated -96 // with the current word (if one is available). -97 if (previousWord != null && words.size() > 0) { -98 final String word = words.getFirst(); -99 clearAttributes(); -100 termAtt.append(previousWord).append(word); -101 previousWord = null; -102 return true; -103 } -104 //if we have words, write it out as a single token -105 if (words.size() > 0) { -106 final String word = words.removeFirst(); -107 clearAttributes(); -108 termAtt.append(word); -109 previousWord = word; -110 return true; -111 } -112 return false; -113 } -114 -115 /** -116 * <p>Resets the Filter and clears any internal state data that may have -117 * been left-over from previous uses of the Filter.</p> -118 * <p><b>If this Filter is re-used this method must be called between -119 * uses.</b></p> -120 */ -121 public void clear() { -122 previousWord = null; -123 words.clear(); -124 } -125 } +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. +17 */ +18 package org.owasp.dependencycheck.data.lucene; +19 +20 import java.io.IOException; +21 import java.util.LinkedList; +22 import org.apache.lucene.analysis.TokenFilter; +23 import org.apache.lucene.analysis.TokenStream; +24 import org.apache.lucene.analysis.tokenattributes.CharTermAttribute; +25 +26 /** +27 * <p> +28 * Takes a TokenStream and adds additional tokens by concatenating pairs of words.</p> +29 * <p> +30 * <b>Example:</b> "Spring Framework Core" -> "Spring SpringFramework Framework FrameworkCore Core".</p> +31 * +32 * @author Jeremy Long <jeremy.long@owasp.org> +33 */ +34 public final class TokenPairConcatenatingFilter extends TokenFilter { +35 +36 /** +37 * The char term attribute. +38 */ +39 private final CharTermAttribute termAtt = addAttribute(CharTermAttribute.class); +40 /** +41 * The previous word parsed. +42 */ +43 private String previousWord; +44 /** +45 * A list of words parsed. +46 */ +47 private final LinkedList<String> words; +48 +49 /** +50 * Returns the previous word. This is needed in the test cases. +51 * +52 * @return te previous word +53 */ +54 protected String getPreviousWord() { +55 return previousWord; +56 } +57 +58 /** +59 * Returns the words list. This is needed in the test cases. +60 * +61 * @return the words list +62 */ +63 protected LinkedList<String> getWords() { +64 return words; +65 } +66 +67 /** +68 * Constructs a new TokenPairConcatenatingFilter. +69 * +70 * @param stream the TokenStream that this filter will process +71 */ +72 public TokenPairConcatenatingFilter(TokenStream stream) { +73 super(stream); +74 words = new LinkedList<String>(); +75 } +76 +77 /** +78 * Increments the underlying TokenStream and sets CharTermAttributes to construct an expanded set of tokens by +79 * concatenating tokens with the previous token. +80 * +81 * @return whether or not we have hit the end of the TokenStream +82 * @throws IOException is thrown when an IOException occurs +83 */ +84 @Override +85 public boolean incrementToken() throws IOException { +86 +87 //collect all the terms into the words collection +88 while (input.incrementToken()) { +89 final String word = new String(termAtt.buffer(), 0, termAtt.length()); +90 words.add(word); +91 } +92 +93 //if we have a previousTerm - write it out as its own token concatenated +94 // with the current word (if one is available). +95 if (previousWord != null && words.size() > 0) { +96 final String word = words.getFirst(); +97 clearAttributes(); +98 termAtt.append(previousWord).append(word); +99 previousWord = null; +100 return true; +101 } +102 //if we have words, write it out as a single token +103 if (words.size() > 0) { +104 final String word = words.removeFirst(); +105 clearAttributes(); +106 termAtt.append(word); +107 previousWord = word; +108 return true; +109 } +110 return false; +111 } +112 +113 /** +114 * <p> +115 * Resets the Filter and clears any internal state data that may have been left-over from previous uses of the +116 * Filter.</p> +117 * <p> +118 * <b>If this Filter is re-used this method must be called between uses.</b></p> +119 */ +120 public void clear() { +121 previousWord = null; +122 words.clear(); +123 } +124 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/lucene/UrlTokenizingFilter.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/lucene/UrlTokenizingFilter.html index c2d9d06f6..5cb82d012 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/lucene/UrlTokenizingFilter.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/lucene/UrlTokenizingFilter.html @@ -9,88 +9,86 @@ 1 /* 2 * This file is part of dependency-check-core. 3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2013 Jeremy Long. All Rights Reserved. -18 */ -19 package org.owasp.dependencycheck.data.lucene; -20 -21 import java.io.IOException; -22 import java.net.MalformedURLException; -23 import java.util.LinkedList; -24 import java.util.List; -25 import java.util.logging.Level; -26 import java.util.logging.Logger; -27 import org.apache.lucene.analysis.TokenStream; -28 import org.apache.lucene.analysis.tokenattributes.CharTermAttribute; -29 import org.owasp.dependencycheck.utils.UrlStringUtils; -30 -31 /** -32 * <p>Takes a TokenStream and splits or adds tokens to correctly index version -33 * numbers.</p> -34 * <p><b>Example:</b> "3.0.0.RELEASE" -> "3 3.0 3.0.0 RELEASE -35 * 3.0.0.RELEASE".</p> -36 * -37 * @author Jeremy Long <jeremy.long@owasp.org> -38 */ -39 public final class UrlTokenizingFilter extends AbstractTokenizingFilter { -40 -41 /** -42 * Constructs a new VersionTokenizingFilter. -43 * -44 * @param stream the TokenStream that this filter will process -45 */ -46 public UrlTokenizingFilter(TokenStream stream) { -47 super(stream); -48 } -49 -50 /** -51 * Increments the underlying TokenStream and sets CharTermAttributes to -52 * construct an expanded set of tokens by concatenating tokens with the -53 * previous token. -54 * -55 * @return whether or not we have hit the end of the TokenStream -56 * @throws IOException is thrown when an IOException occurs -57 */ -58 @Override -59 public boolean incrementToken() throws IOException { -60 final LinkedList<String> tokens = getTokens(); -61 final CharTermAttribute termAtt = getTermAtt(); -62 if (tokens.size() == 0 && input.incrementToken()) { -63 final String text = new String(termAtt.buffer(), 0, termAtt.length()); -64 if (UrlStringUtils.containsUrl(text)) { -65 final String[] parts = text.split("\\s"); -66 for (String part : parts) { -67 if (UrlStringUtils.isUrl(part)) { -68 try { -69 final List<String> data = UrlStringUtils.extractImportantUrlData(part); -70 tokens.addAll(data); -71 } catch (MalformedURLException ex) { -72 Logger.getLogger(UrlTokenizingFilter.class.getName()).log(Level.INFO, "error parsing " + part, ex); -73 tokens.add(part); -74 } -75 } else { -76 tokens.add(part); -77 } -78 } -79 } else { -80 tokens.add(text); -81 } -82 } -83 return addTerm(); -84 } -85 } +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2013 Jeremy Long. All Rights Reserved. +17 */ +18 package org.owasp.dependencycheck.data.lucene; +19 +20 import java.io.IOException; +21 import java.net.MalformedURLException; +22 import java.util.LinkedList; +23 import java.util.List; +24 import java.util.logging.Level; +25 import java.util.logging.Logger; +26 import org.apache.lucene.analysis.TokenStream; +27 import org.apache.lucene.analysis.tokenattributes.CharTermAttribute; +28 import org.owasp.dependencycheck.utils.UrlStringUtils; +29 +30 /** +31 * <p> +32 * Takes a TokenStream and splits or adds tokens to correctly index version numbers.</p> +33 * <p> +34 * <b>Example:</b> "3.0.0.RELEASE" -> "3 3.0 3.0.0 RELEASE 3.0.0.RELEASE".</p> +35 * +36 * @author Jeremy Long <jeremy.long@owasp.org> +37 */ +38 public final class UrlTokenizingFilter extends AbstractTokenizingFilter { +39 +40 /** +41 * Constructs a new VersionTokenizingFilter. +42 * +43 * @param stream the TokenStream that this filter will process +44 */ +45 public UrlTokenizingFilter(TokenStream stream) { +46 super(stream); +47 } +48 +49 /** +50 * Increments the underlying TokenStream and sets CharTermAttributes to construct an expanded set of tokens by +51 * concatenating tokens with the previous token. +52 * +53 * @return whether or not we have hit the end of the TokenStream +54 * @throws IOException is thrown when an IOException occurs +55 */ +56 @Override +57 public boolean incrementToken() throws IOException { +58 final LinkedList<String> tokens = getTokens(); +59 final CharTermAttribute termAtt = getTermAtt(); +60 if (tokens.size() == 0 && input.incrementToken()) { +61 final String text = new String(termAtt.buffer(), 0, termAtt.length()); +62 if (UrlStringUtils.containsUrl(text)) { +63 final String[] parts = text.split("\\s"); +64 for (String part : parts) { +65 if (UrlStringUtils.isUrl(part)) { +66 try { +67 final List<String> data = UrlStringUtils.extractImportantUrlData(part); +68 tokens.addAll(data); +69 } catch (MalformedURLException ex) { +70 Logger.getLogger(UrlTokenizingFilter.class.getName()).log(Level.INFO, "error parsing " + part, ex); +71 tokens.add(part); +72 } +73 } else { +74 tokens.add(part); +75 } +76 } +77 } else { +78 tokens.add(text); +79 } +80 } +81 return addTerm(); +82 } +83 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/lucene/VersionAnalyzer.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/lucene/VersionAnalyzer.html index a63ee8661..d5e5412da 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/lucene/VersionAnalyzer.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/lucene/VersionAnalyzer.html @@ -9,75 +9,74 @@ 1 /* 2 * This file is part of dependency-check-core. 3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. -18 */ -19 package org.owasp.dependencycheck.data.lucene; -20 -21 import java.io.Reader; -22 import org.apache.lucene.analysis.Analyzer; -23 import org.apache.lucene.analysis.TokenStream; -24 import org.apache.lucene.analysis.Tokenizer; -25 import org.apache.lucene.analysis.core.LowerCaseFilter; -26 import org.apache.lucene.analysis.core.WhitespaceTokenizer; -27 import org.apache.lucene.util.Version; -28 -29 /** -30 * VersionAnalyzer is a Lucene Analyzer used to analyze version information. -31 * -32 * @author Jeremy Long <jeremy.long@owasp.org> -33 * @deprecated version information is no longer stored in lucene -34 */ -35 @Deprecated -36 public class VersionAnalyzer extends Analyzer { -37 //TODO consider implementing payloads/custom attributes... -38 // use custom attributes for major, minor, x, x, x, rcx -39 // these can then be used to weight the score for searches on the version. -40 // see http://lucene.apache.org/core/3_6_1/api/core/org/apache/lucene/analysis/package-summary.html#package_description -41 // look at this article to implement -42 // http://www.codewrecks.com/blog/index.php/2012/08/25/index-your-blog-using-tags-and-lucene-net/ -43 -44 /** -45 * The Lucene Version used. -46 */ -47 private final Version version; -48 -49 /** -50 * Creates a new VersionAnalyzer. -51 * -52 * @param version the Lucene version -53 */ -54 public VersionAnalyzer(Version version) { -55 this.version = version; -56 } -57 -58 /** -59 * Creates the TokenStreamComponents -60 * -61 * @param fieldName the field name being analyzed -62 * @param reader the reader containing the input -63 * @return the TokenStreamComponents -64 */ -65 @Override -66 protected TokenStreamComponents createComponents(String fieldName, Reader reader) { -67 final Tokenizer source = new WhitespaceTokenizer(version, reader); -68 TokenStream stream = source; -69 stream = new LowerCaseFilter(version, stream); -70 return new TokenStreamComponents(source, stream); -71 } -72 } +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. +17 */ +18 package org.owasp.dependencycheck.data.lucene; +19 +20 import java.io.Reader; +21 import org.apache.lucene.analysis.Analyzer; +22 import org.apache.lucene.analysis.TokenStream; +23 import org.apache.lucene.analysis.Tokenizer; +24 import org.apache.lucene.analysis.core.LowerCaseFilter; +25 import org.apache.lucene.analysis.core.WhitespaceTokenizer; +26 import org.apache.lucene.util.Version; +27 +28 /** +29 * VersionAnalyzer is a Lucene Analyzer used to analyze version information. +30 * +31 * @author Jeremy Long <jeremy.long@owasp.org> +32 * @deprecated version information is no longer stored in lucene +33 */ +34 @Deprecated +35 public class VersionAnalyzer extends Analyzer { +36 //TODO consider implementing payloads/custom attributes... +37 // use custom attributes for major, minor, x, x, x, rcx +38 // these can then be used to weight the score for searches on the version. +39 // see http://lucene.apache.org/core/3_6_1/api/core/org/apache/lucene/analysis/package-summary.html#package_description +40 // look at this article to implement +41 // http://www.codewrecks.com/blog/index.php/2012/08/25/index-your-blog-using-tags-and-lucene-net/ +42 +43 /** +44 * The Lucene Version used. +45 */ +46 private final Version version; +47 +48 /** +49 * Creates a new VersionAnalyzer. +50 * +51 * @param version the Lucene version +52 */ +53 public VersionAnalyzer(Version version) { +54 this.version = version; +55 } +56 +57 /** +58 * Creates the TokenStreamComponents +59 * +60 * @param fieldName the field name being analyzed +61 * @param reader the reader containing the input +62 * @return the TokenStreamComponents +63 */ +64 @Override +65 protected TokenStreamComponents createComponents(String fieldName, Reader reader) { +66 final Tokenizer source = new WhitespaceTokenizer(version, reader); +67 TokenStream stream = source; +68 stream = new LowerCaseFilter(version, stream); +69 return new TokenStreamComponents(source, stream); +70 } +71 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/lucene/VersionTokenizingFilter.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/lucene/VersionTokenizingFilter.html index 9fbaf76d5..62757686c 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/lucene/VersionTokenizingFilter.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/lucene/VersionTokenizingFilter.html @@ -9,103 +9,101 @@ 1 /* 2 * This file is part of dependency-check-core. 3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. -18 */ -19 package org.owasp.dependencycheck.data.lucene; -20 -21 import java.io.IOException; -22 import java.util.LinkedList; -23 import org.apache.lucene.analysis.TokenStream; -24 import org.apache.lucene.analysis.tokenattributes.CharTermAttribute; -25 -26 /** -27 * <p>Takes a TokenStream and splits or adds tokens to correctly index version -28 * numbers.</p> -29 * <p><b>Example:</b> "3.0.0.RELEASE" -> "3 3.0 3.0.0 RELEASE -30 * 3.0.0.RELEASE".</p> -31 * -32 * @author Jeremy Long <jeremy.long@owasp.org> -33 * @deprecated version information is no longer stored in lucene -34 */ -35 @Deprecated -36 public final class VersionTokenizingFilter extends AbstractTokenizingFilter { -37 -38 /** -39 * Constructs a new VersionTokenizingFilter. -40 * -41 * @param stream the TokenStream that this filter will process -42 */ -43 public VersionTokenizingFilter(TokenStream stream) { -44 super(stream); -45 } -46 -47 /** -48 * Increments the underlying TokenStream and sets CharTermAttributes to -49 * construct an expanded set of tokens by concatenating tokens with the -50 * previous token. -51 * -52 * @return whether or not we have hit the end of the TokenStream -53 * @throws IOException is thrown when an IOException occurs -54 */ -55 @Override -56 public boolean incrementToken() throws IOException { -57 final LinkedList<String> tokens = getTokens(); -58 final CharTermAttribute termAtt = getTermAtt(); -59 if (tokens.size() == 0 && input.incrementToken()) { -60 final String version = new String(termAtt.buffer(), 0, termAtt.length()); -61 final String[] toAnalyze = version.split("[_-]"); -62 //ensure we analyze the whole string as one too -63 analyzeVersion(version); -64 for (String str : toAnalyze) { -65 analyzeVersion(str); -66 } -67 } -68 return addTerm(); -69 } -70 -71 /** -72 * <p>Analyzes the version and adds several copies of the version as -73 * different tokens. For example, the version 1.2.7 would create the tokens -74 * 1 1.2 1.2.7. This is useful in discovering the correct version - -75 * sometimes a maintenance or build number will throw off the version -76 * identification.</p> +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. +17 */ +18 package org.owasp.dependencycheck.data.lucene; +19 +20 import java.io.IOException; +21 import java.util.LinkedList; +22 import org.apache.lucene.analysis.TokenStream; +23 import org.apache.lucene.analysis.tokenattributes.CharTermAttribute; +24 +25 /** +26 * <p> +27 * Takes a TokenStream and splits or adds tokens to correctly index version numbers.</p> +28 * <p> +29 * <b>Example:</b> "3.0.0.RELEASE" -> "3 3.0 3.0.0 RELEASE 3.0.0.RELEASE".</p> +30 * +31 * @author Jeremy Long <jeremy.long@owasp.org> +32 * @deprecated version information is no longer stored in lucene +33 */ +34 @Deprecated +35 public final class VersionTokenizingFilter extends AbstractTokenizingFilter { +36 +37 /** +38 * Constructs a new VersionTokenizingFilter. +39 * +40 * @param stream the TokenStream that this filter will process +41 */ +42 public VersionTokenizingFilter(TokenStream stream) { +43 super(stream); +44 } +45 +46 /** +47 * Increments the underlying TokenStream and sets CharTermAttributes to construct an expanded set of tokens by +48 * concatenating tokens with the previous token. +49 * +50 * @return whether or not we have hit the end of the TokenStream +51 * @throws IOException is thrown when an IOException occurs +52 */ +53 @Override +54 public boolean incrementToken() throws IOException { +55 final LinkedList<String> tokens = getTokens(); +56 final CharTermAttribute termAtt = getTermAtt(); +57 if (tokens.size() == 0 && input.incrementToken()) { +58 final String version = new String(termAtt.buffer(), 0, termAtt.length()); +59 final String[] toAnalyze = version.split("[_-]"); +60 //ensure we analyze the whole string as one too +61 analyzeVersion(version); +62 for (String str : toAnalyze) { +63 analyzeVersion(str); +64 } +65 } +66 return addTerm(); +67 } +68 +69 /** +70 * <p> +71 * Analyzes the version and adds several copies of the version as different tokens. For example, the version 1.2.7 +72 * would create the tokens 1 1.2 1.2.7. This is useful in discovering the correct version - sometimes a maintenance +73 * or build number will throw off the version identification.</p> +74 * +75 * <p> +76 * expected&nbsp;format:&nbps;major.minor[.maintenance[.build]]</p> 77 * -78 * <p>expected&nbsp;format:&nbps;major.minor[.maintenance[.build]]</p> -79 * -80 * @param version the version to analyze -81 */ -82 private void analyzeVersion(String version) { -83 //todo should we also be splitting on dash or underscore? we would need -84 // to incorporate the dash or underscore back in... -85 final LinkedList<String> tokens = getTokens(); -86 final String[] versionParts = version.split("\\."); -87 String dottedVersion = null; -88 for (String current : versionParts) { -89 if (!current.matches("^/d+$")) { -90 tokens.add(current); -91 } -92 if (dottedVersion == null) { -93 dottedVersion = current; -94 } else { -95 dottedVersion = dottedVersion + "." + current; -96 } -97 tokens.add(dottedVersion); -98 } -99 } -100 } +78 * @param version the version to analyze +79 */ +80 private void analyzeVersion(String version) { +81 //todo should we also be splitting on dash or underscore? we would need +82 // to incorporate the dash or underscore back in... +83 final LinkedList<String> tokens = getTokens(); +84 final String[] versionParts = version.split("\\."); +85 String dottedVersion = null; +86 for (String current : versionParts) { +87 if (!current.matches("^/d+$")) { +88 tokens.add(current); +89 } +90 if (dottedVersion == null) { +91 dottedVersion = current; +92 } else { +93 dottedVersion = dottedVersion + "." + current; +94 } +95 tokens.add(dottedVersion); +96 } +97 } +98 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/lucene/package-frame.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/lucene/package-frame.html index 9009a6231..a85727c02 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/lucene/package-frame.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/lucene/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.0.8 Reference Package org.owasp.dependencycheck.data.lucene + Dependency-Check Core 1.1.0 Reference Package org.owasp.dependencycheck.data.lucene diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/lucene/package-summary.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/lucene/package-summary.html index 54ad800d6..d4744b0a2 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/lucene/package-summary.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/lucene/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.0.8 Reference Package org.owasp.dependencycheck.data.lucene + Dependency-Check Core 1.1.0 Reference Package org.owasp.dependencycheck.data.lucene diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/nexus/MavenArtifact.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/nexus/MavenArtifact.html index 4d41d7998..3c4d6da7d 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/nexus/MavenArtifact.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/nexus/MavenArtifact.html @@ -9,29 +9,29 @@ 1 /* 2 * This file is part of dependency-check-core. 3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. -18 */ -19 package org.owasp.dependencycheck.data.nexus; -20 -21 /** -22 * Simple bean representing a Maven Artifact. -23 * -24 * @author colezlaw -25 */ -26 public class MavenArtifact { +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2014 Jeremy Long. All Rights Reserved. +17 */ +18 package org.owasp.dependencycheck.data.nexus; +19 +20 /** +21 * Simple bean representing a Maven Artifact. +22 * +23 * @author colezlaw +24 */ +25 public class MavenArtifact { +26 27 /** 28 * The groupId 29 */ @@ -48,118 +48,128 @@ 40 private String version; 41 42 /** -43 * The artifact url. This may change depending on which Nexus -44 * server the search took place. -45 */ -46 private String artifactUrl; -47 -48 -49 /** -50 * Creates an empty MavenArtifact. -51 */ -52 public MavenArtifact() { -53 } -54 -55 /** -56 * Creates a MavenArtifact with the given attributes. -57 * -58 * @param groupId the groupId -59 * @param artifactId the artifactId -60 * @param version the version -61 */ -62 public MavenArtifact(String groupId, String artifactId, String version) { -63 setGroupId(groupId); -64 setArtifactId(artifactId); -65 setVersion(version); -66 } -67 -68 /** -69 * Creates a MavenArtifact with the given attributes. -70 * -71 * @param groupId the groupId -72 * @param artifactId the artifactId -73 * @param version the version -74 * @param url the artifactLink url -75 */ -76 public MavenArtifact(String groupId, String artifactId, String version, String url) { -77 setGroupId(groupId); -78 setArtifactId(artifactId); -79 setVersion(version); -80 setArtifactUrl(url); -81 } -82 -83 /** -84 * Returns the Artifact coordinates as a String. -85 * -86 * @return the String representation of the artifact coordinates -87 */ -88 @Override -89 public String toString() { -90 return String.format("%s:%s:%s", groupId, artifactId, version); -91 } -92 -93 /** -94 * Sets the groupId. -95 * -96 * @param groupId the groupId -97 */ -98 public void setGroupId(String groupId) { this.groupId = groupId; } +43 * The artifact url. This may change depending on which Nexus server the search took place. +44 */ +45 private String artifactUrl; +46 +47 /** +48 * Creates an empty MavenArtifact. +49 */ +50 public MavenArtifact() { +51 } +52 +53 /** +54 * Creates a MavenArtifact with the given attributes. +55 * +56 * @param groupId the groupId +57 * @param artifactId the artifactId +58 * @param version the version +59 */ +60 public MavenArtifact(String groupId, String artifactId, String version) { +61 setGroupId(groupId); +62 setArtifactId(artifactId); +63 setVersion(version); +64 } +65 +66 /** +67 * Creates a MavenArtifact with the given attributes. +68 * +69 * @param groupId the groupId +70 * @param artifactId the artifactId +71 * @param version the version +72 * @param url the artifactLink url +73 */ +74 public MavenArtifact(String groupId, String artifactId, String version, String url) { +75 setGroupId(groupId); +76 setArtifactId(artifactId); +77 setVersion(version); +78 setArtifactUrl(url); +79 } +80 +81 /** +82 * Returns the Artifact coordinates as a String. +83 * +84 * @return the String representation of the artifact coordinates +85 */ +86 @Override +87 public String toString() { +88 return String.format("%s:%s:%s", groupId, artifactId, version); +89 } +90 +91 /** +92 * Sets the groupId. +93 * +94 * @param groupId the groupId +95 */ +96 public void setGroupId(String groupId) { +97 this.groupId = groupId; +98 } 99 100 /** 101 * Gets the groupId. 102 * 103 * @return the groupId 104 */ -105 public String getGroupId() { return groupId; } -106 -107 /** -108 * Sets the artifactId. -109 * -110 * @param artifactId the artifactId -111 */ -112 public void setArtifactId(String artifactId) { this.artifactId = artifactId; } -113 -114 /** -115 * Gets the artifactId. -116 * -117 * @return the artifactId -118 */ -119 public String getArtifactId() { return artifactId; } -120 -121 /** -122 * Sets the version. -123 * -124 * @param version the version -125 */ -126 public void setVersion(String version) { this.version = version; } -127 -128 /** -129 * Gets the version. -130 * -131 * @return the version -132 */ -133 public String getVersion() { return version; } -134 -135 /** -136 * Sets the artifactUrl. -137 * -138 * @param artifactUrl the artifactUrl -139 */ -140 public void setArtifactUrl(String artifactUrl) { -141 this.artifactUrl = artifactUrl; -142 } -143 -144 /** -145 * Gets the artifactUrl. -146 * -147 * @return the artifactUrl -148 */ -149 public String getArtifactUrl() { -150 return artifactUrl; -151 } -152 } +105 public String getGroupId() { +106 return groupId; +107 } +108 +109 /** +110 * Sets the artifactId. +111 * +112 * @param artifactId the artifactId +113 */ +114 public void setArtifactId(String artifactId) { +115 this.artifactId = artifactId; +116 } +117 +118 /** +119 * Gets the artifactId. +120 * +121 * @return the artifactId +122 */ +123 public String getArtifactId() { +124 return artifactId; +125 } +126 +127 /** +128 * Sets the version. +129 * +130 * @param version the version +131 */ +132 public void setVersion(String version) { +133 this.version = version; +134 } +135 +136 /** +137 * Gets the version. +138 * +139 * @return the version +140 */ +141 public String getVersion() { +142 return version; +143 } +144 +145 /** +146 * Sets the artifactUrl. +147 * +148 * @param artifactUrl the artifactUrl +149 */ +150 public void setArtifactUrl(String artifactUrl) { +151 this.artifactUrl = artifactUrl; +152 } 153 -154 // vim: cc=120:sw=4:ts=4:sts=4 +154 /** +155 * Gets the artifactUrl. +156 * +157 * @return the artifactUrl +158 */ +159 public String getArtifactUrl() { +160 return artifactUrl; +161 } +162 } +163 +164 // vim: cc=120:sw=4:ts=4:sts=4
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/nexus/NexusSearch.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/nexus/NexusSearch.html index 6af514494..cd9add0a2 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/nexus/NexusSearch.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/nexus/NexusSearch.html @@ -9,40 +9,40 @@ 1 /* 2 * This file is part of dependency-check-core. 3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. -18 */ -19 package org.owasp.dependencycheck.data.nexus; -20 -21 import java.io.FileNotFoundException; -22 import java.io.IOException; -23 import java.net.URL; -24 import java.net.URLConnection; -25 import java.util.logging.Logger; -26 import javax.xml.parsers.DocumentBuilder; -27 import javax.xml.parsers.DocumentBuilderFactory; -28 import javax.xml.xpath.XPath; -29 import javax.xml.xpath.XPathFactory; -30 import org.w3c.dom.Document; -31 -32 /** -33 * Class of methods to search Nexus repositories. -34 * -35 * @author colezlaw -36 */ -37 public class NexusSearch { +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2014 Jeremy Long. All Rights Reserved. +17 */ +18 package org.owasp.dependencycheck.data.nexus; +19 +20 import java.io.FileNotFoundException; +21 import java.io.IOException; +22 import java.net.URL; +23 import java.net.URLConnection; +24 import java.util.logging.Logger; +25 import javax.xml.parsers.DocumentBuilder; +26 import javax.xml.parsers.DocumentBuilderFactory; +27 import javax.xml.xpath.XPath; +28 import javax.xml.xpath.XPathFactory; +29 import org.w3c.dom.Document; +30 +31 /** +32 * Class of methods to search Nexus repositories. +33 * +34 * @author colezlaw +35 */ +36 public class NexusSearch { +37 38 /** 39 * The root URL for the Nexus repository service 40 */ @@ -56,61 +56,60 @@ 48 /** 49 * Creates a NexusSearch for the given repository URL. 50 * -51 * @param rootURL the root URL of the repository on which searches should execute. -52 * full URL's are calculated relative to this URL, so it should end with a / +51 * @param rootURL the root URL of the repository on which searches should execute. full URL's are calculated +52 * relative to this URL, so it should end with a / 53 */ 54 public NexusSearch(URL rootURL) { 55 this.rootURL = rootURL; 56 } 57 58 /** -59 * Searches the configured Nexus repository for the given sha1 -60 * hash. If the artifact is found, a <code>MavenArtifact</code> is populated -61 * with the coordinate information. -62 * -63 * @param sha1 The SHA-1 hash string for which to search -64 * @return the populated Maven coordinates -65 * @throws IOException if it's unable to connect to the specified repositor or -66 * if the specified artifact is not found. -67 */ -68 public MavenArtifact searchSha1(String sha1) throws IOException { -69 if (null == sha1 || !sha1.matches("^[0-9A-Fa-f]{40}$")) { -70 throw new IllegalArgumentException("Invalid SHA1 format"); -71 } -72 -73 final URL url = new URL(rootURL, String.format("identify/sha1/%s", sha1.toLowerCase())); -74 -75 LOGGER.fine(String.format("Searching Nexus url %s", url.toString())); -76 -77 final URLConnection conn = url.openConnection(); -78 conn.setDoOutput(true); -79 -80 // JSON would be more elegant, but there's not currently a dependency -81 // on JSON, so don't want to add one just for this -82 conn.addRequestProperty("Accept", "application/xml"); -83 conn.connect(); -84 -85 try { -86 final DocumentBuilder builder = DocumentBuilderFactory.newInstance().newDocumentBuilder(); -87 final Document doc = builder.parse(conn.getInputStream()); -88 final XPath xpath = XPathFactory.newInstance().newXPath(); -89 final String groupId = xpath.evaluate("/org.sonatype.nexus.rest.model.NexusArtifact/groupId", doc); -90 final String artifactId = xpath.evaluate("/org.sonatype.nexus.rest.model.NexusArtifact/artifactId", doc); -91 final String version = xpath.evaluate("/org.sonatype.nexus.rest.model.NexusArtifact/version", doc); -92 final String link = xpath.evaluate("/org.sonatype.nexus.rest.model.NexusArtifact/artifactLink", doc); -93 return new MavenArtifact(groupId, artifactId, version, link); -94 } catch (FileNotFoundException fnfe) { -95 // This is what we get when the SHA1 they sent doesn't exist in Nexus. This -96 // is useful upstream for recovery, so we just re-throw it -97 throw fnfe; -98 } catch (Exception e) { -99 // Anything else is jacked-up XML stuff that we really can't recover from well -100 throw new IOException(e.getMessage(), e); -101 } -102 } -103 } -104 -105 // vim: cc=120:sw=4:ts=4:sts=4 +59 * Searches the configured Nexus repository for the given sha1 hash. If the artifact is found, a +60 * <code>MavenArtifact</code> is populated with the coordinate information. +61 * +62 * @param sha1 The SHA-1 hash string for which to search +63 * @return the populated Maven coordinates +64 * @throws IOException if it's unable to connect to the specified repositor or if the specified artifact is not +65 * found. +66 */ +67 public MavenArtifact searchSha1(String sha1) throws IOException { +68 if (null == sha1 || !sha1.matches("^[0-9A-Fa-f]{40}$")) { +69 throw new IllegalArgumentException("Invalid SHA1 format"); +70 } +71 +72 final URL url = new URL(rootURL, String.format("identify/sha1/%s", sha1.toLowerCase())); +73 +74 LOGGER.fine(String.format("Searching Nexus url %s", url.toString())); +75 +76 final URLConnection conn = url.openConnection(); +77 conn.setDoOutput(true); +78 +79 // JSON would be more elegant, but there's not currently a dependency +80 // on JSON, so don't want to add one just for this +81 conn.addRequestProperty("Accept", "application/xml"); +82 conn.connect(); +83 +84 try { +85 final DocumentBuilder builder = DocumentBuilderFactory.newInstance().newDocumentBuilder(); +86 final Document doc = builder.parse(conn.getInputStream()); +87 final XPath xpath = XPathFactory.newInstance().newXPath(); +88 final String groupId = xpath.evaluate("/org.sonatype.nexus.rest.model.NexusArtifact/groupId", doc); +89 final String artifactId = xpath.evaluate("/org.sonatype.nexus.rest.model.NexusArtifact/artifactId", doc); +90 final String version = xpath.evaluate("/org.sonatype.nexus.rest.model.NexusArtifact/version", doc); +91 final String link = xpath.evaluate("/org.sonatype.nexus.rest.model.NexusArtifact/artifactLink", doc); +92 return new MavenArtifact(groupId, artifactId, version, link); +93 } catch (FileNotFoundException fnfe) { +94 // This is what we get when the SHA1 they sent doesn't exist in Nexus. This +95 // is useful upstream for recovery, so we just re-throw it +96 throw fnfe; +97 } catch (Exception e) { +98 // Anything else is jacked-up XML stuff that we really can't recover from well +99 throw new IOException(e.getMessage(), e); +100 } +101 } +102 } +103 +104 // vim: cc=120:sw=4:ts=4:sts=4
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/nexus/package-frame.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/nexus/package-frame.html index f3d15be10..7a3ef671c 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/nexus/package-frame.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/nexus/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.0.8 Reference Package org.owasp.dependencycheck.data.nexus + Dependency-Check Core 1.1.0 Reference Package org.owasp.dependencycheck.data.nexus diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/nexus/package-summary.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/nexus/package-summary.html index 618355bee..cf5936410 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/nexus/package-summary.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/nexus/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.0.8 Reference Package org.owasp.dependencycheck.data.nexus + Dependency-Check Core 1.1.0 Reference Package org.owasp.dependencycheck.data.nexus diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/nvdcve/ConnectionFactory.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/nvdcve/ConnectionFactory.html index 785502fdc..bb3eef2ae 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/nvdcve/ConnectionFactory.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/nvdcve/ConnectionFactory.html @@ -9,241 +9,248 @@ 1 /* 2 * This file is part of dependency-check-core. 3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2014 Jeremy Long. All Rights Reserved. -18 */ -19 package org.owasp.dependencycheck.data.nvdcve; -20 -21 import java.io.BufferedReader; -22 import java.io.File; -23 import java.io.IOException; -24 import java.io.InputStream; -25 import java.io.InputStreamReader; -26 import java.sql.CallableStatement; -27 import java.sql.Connection; -28 import java.sql.DriverManager; -29 import java.sql.ResultSet; -30 import java.sql.SQLException; -31 import java.sql.Statement; -32 import java.util.logging.Level; -33 import java.util.logging.Logger; -34 import org.owasp.dependencycheck.utils.DBUtils; -35 import org.owasp.dependencycheck.utils.Settings; -36 -37 /** -38 * Loads the configured database driver and returns the database connection. If the embedded H2 database is used -39 * obtaining a connection will ensure the database file exists and that the appropriate table structure has been -40 * created. -41 * -42 * @author Jeremy Long <jeremy.long@owasp.org> -43 */ -44 public final class ConnectionFactory { -45 -46 /** -47 * The version of the current DB Schema. -48 */ -49 public static final String DB_SCHEMA_VERSION = "2.8"; -50 /** -51 * Resource location for SQL file used to create the database schema. -52 */ -53 public static final String DB_STRUCTURE_RESOURCE = "data/initialize.sql"; -54 -55 /** -56 * Private constructor for this factory class; no instance is ever needed. -57 */ -58 private ConnectionFactory() { -59 } -60 -61 /** -62 * Constructs a new database connection object per the database configuration. This will load the appropriate -63 * database driver, via the DriverManager, if configured. -64 * -65 * @return a database connection object -66 * @throws DatabaseException thrown if there is an exception loading the database connection -67 */ -68 public static Connection getConnection() throws DatabaseException { -69 Connection conn = null; -70 try { -71 Logger.getLogger(CveDB.class.getName()).log(Level.FINE, "Loading database connection"); -72 -73 final String connStr = getConnectionString(); -74 final String user = Settings.getString(Settings.KEYS.DB_USER, "dcuser"); -75 //yes, yes - hard-coded password - only if there isn't one in the properties file. -76 final String pass = Settings.getString(Settings.KEYS.DB_PASSWORD, "DC-Pass1337!"); -77 Logger.getLogger(CveDB.class.getName()).log(Level.FINE, "Connection String: {0}", connStr); -78 Logger.getLogger(CveDB.class.getName()).log(Level.FINE, "Database User: {0}", user); -79 boolean createTables = false; -80 if (connStr.startsWith("jdbc:h2:file:")) { //H2 -81 createTables = needToCreateDatabaseStructure(); -82 Logger.getLogger(CveDB.class.getName()).log(Level.FINE, "Need to create DB Structure: {0}", createTables); -83 } -84 final String driverName = Settings.getString(Settings.KEYS.DB_DRIVER_NAME, ""); -85 if (!driverName.isEmpty()) { //likely need to load the correct driver -86 Logger.getLogger(CveDB.class.getName()).log(Level.FINE, "Loading driver: {0}", driverName); -87 final String driverPath = Settings.getString(Settings.KEYS.DB_DRIVER_PATH, ""); -88 if (!driverPath.isEmpty()) { //ugh, driver is not on classpath? -89 Logger.getLogger(CveDB.class.getName()).log(Level.FINE, "Loading driver from: {0}", driverPath); -90 DriverLoader.load(driverName, driverPath); -91 } else { -92 DriverLoader.load(driverName); -93 } -94 } -95 -96 //JDBC4 drivers don't need this call. -97 //Class.forName("org.h2.Driver"); -98 conn = DriverManager.getConnection(connStr, user, pass); -99 if (createTables) { -100 createTables(conn); -101 } else { -102 ensureSchemaVersion(conn); -103 } -104 } catch (IOException ex) { -105 Logger.getLogger(ConnectionFactory.class.getName()).log(Level.FINE, null, ex); -106 throw new DatabaseException("Unable to load database"); -107 } catch (DriverLoadException ex) { -108 Logger.getLogger(ConnectionFactory.class.getName()).log(Level.FINE, null, ex); -109 throw new DatabaseException("Unable to load database driver"); -110 } catch (SQLException ex) { -111 Logger.getLogger(ConnectionFactory.class.getName()).log(Level.FINE, null, ex); -112 throw new DatabaseException("Unable to connect to the database"); -113 } catch (DatabaseException ex) { +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2014 Jeremy Long. All Rights Reserved. +17 */ +18 package org.owasp.dependencycheck.data.nvdcve; +19 +20 import java.io.BufferedReader; +21 import java.io.File; +22 import java.io.IOException; +23 import java.io.InputStream; +24 import java.io.InputStreamReader; +25 import java.sql.CallableStatement; +26 import java.sql.Connection; +27 import java.sql.DriverManager; +28 import java.sql.ResultSet; +29 import java.sql.SQLException; +30 import java.sql.Statement; +31 import java.util.logging.Level; +32 import java.util.logging.Logger; +33 import org.owasp.dependencycheck.utils.DBUtils; +34 import org.owasp.dependencycheck.utils.Settings; +35 +36 /** +37 * Loads the configured database driver and returns the database connection. If the embedded H2 database is used +38 * obtaining a connection will ensure the database file exists and that the appropriate table structure has been +39 * created. +40 * +41 * @author Jeremy Long <jeremy.long@owasp.org> +42 */ +43 public final class ConnectionFactory { +44 +45 /** +46 * The version of the current DB Schema. +47 */ +48 public static final String DB_SCHEMA_VERSION = "2.9"; +49 /** +50 * Resource location for SQL file used to create the database schema. +51 */ +52 public static final String DB_STRUCTURE_RESOURCE = "data/initialize.sql"; +53 +54 /** +55 * Private constructor for this factory class; no instance is ever needed. +56 */ +57 private ConnectionFactory() { +58 } +59 +60 /** +61 * Constructs a new database connection object per the database configuration. This will load the appropriate +62 * database driver, via the DriverManager, if configured. +63 * +64 * @return a database connection object +65 * @throws DatabaseException thrown if there is an exception loading the database connection +66 */ +67 public static Connection getConnection() throws DatabaseException { +68 Connection conn = null; +69 try { +70 Logger.getLogger(CveDB.class.getName()).log(Level.FINE, "Loading database connection"); +71 +72 final String connStr = getConnectionString(); +73 final String user = Settings.getString(Settings.KEYS.DB_USER, "dcuser"); +74 //yes, yes - hard-coded password - only if there isn't one in the properties file. +75 final String pass = Settings.getString(Settings.KEYS.DB_PASSWORD, "DC-Pass1337!"); +76 Logger.getLogger(CveDB.class.getName()).log(Level.FINE, "Connection String: {0}", connStr); +77 Logger.getLogger(CveDB.class.getName()).log(Level.FINE, "Database User: {0}", user); +78 boolean createTables = false; +79 if (connStr.startsWith("jdbc:h2:file:")) { //H2 +80 createTables = needToCreateDatabaseStructure(); +81 Logger.getLogger(CveDB.class.getName()).log(Level.FINE, "Need to create DB Structure: {0}", createTables); +82 } +83 final String driverName = Settings.getString(Settings.KEYS.DB_DRIVER_NAME, ""); +84 if (!driverName.isEmpty()) { //likely need to load the correct driver +85 Logger.getLogger(CveDB.class.getName()).log(Level.FINE, "Loading driver: {0}", driverName); +86 final String driverPath = Settings.getString(Settings.KEYS.DB_DRIVER_PATH, ""); +87 if (!driverPath.isEmpty()) { //ugh, driver is not on classpath? +88 Logger.getLogger(CveDB.class.getName()).log(Level.FINE, "Loading driver from: {0}", driverPath); +89 DriverLoader.load(driverName, driverPath); +90 } else { +91 DriverLoader.load(driverName); +92 } +93 } +94 +95 //JDBC4 drivers don't need this call. +96 //Class.forName("org.h2.Driver"); +97 conn = DriverManager.getConnection(connStr, user, pass); +98 if (createTables) { +99 try { +100 createTables(conn); +101 } catch (DatabaseException ex) { +102 Logger.getLogger(ConnectionFactory.class.getName()).log(Level.FINE, null, ex); +103 throw new DatabaseException("Unable to create the database structure"); +104 } +105 } else { +106 try { +107 ensureSchemaVersion(conn); +108 } catch (DatabaseException ex) { +109 Logger.getLogger(ConnectionFactory.class.getName()).log(Level.FINE, null, ex); +110 throw new DatabaseException("Database schema does not match this version of dependency-check"); +111 } +112 } +113 } catch (IOException ex) { 114 Logger.getLogger(ConnectionFactory.class.getName()).log(Level.FINE, null, ex); -115 throw new DatabaseException("Unable to create the database structure"); -116 } -117 return conn; -118 } -119 -120 /** -121 * Returns the configured connection string. If using the embedded H2 database this function will also ensure the -122 * data directory exists and if not create it. -123 * -124 * @return the connection string -125 * @throws IOException thrown the data directory cannot be created -126 */ -127 private static String getConnectionString() throws IOException { -128 final String connStr = Settings.getString(Settings.KEYS.DB_CONNECTION_STRING, "jdbc:h2:file:%s;AUTO_SERVER=TRUE"); -129 if (connStr.contains("%s")) { -130 final String fileName = getDataDirectory().getCanonicalPath(); -131 final File file = new File(fileName, "cve." + DB_SCHEMA_VERSION); -132 return String.format(connStr, file.getAbsolutePath()); -133 } -134 return connStr; -135 } -136 -137 /** -138 * Retrieves the directory that the JAR file exists in so that we can ensure we always use a common data directory -139 * for the embedded H2 database. This is public solely for some unit tests; otherwise this should be private. -140 * -141 * @return the data directory to store data files -142 * @throws IOException is thrown if an IOException occurs of course... -143 */ -144 public static File getDataDirectory() throws IOException { -145 final File path = Settings.getDataFile(Settings.KEYS.DATA_DIRECTORY); -146 if (!path.exists()) { -147 if (!path.mkdirs()) { -148 throw new IOException("Unable to create NVD CVE Data directory"); -149 } -150 } -151 return path; -152 } -153 -154 /** -155 * Determines if the H2 database file exists. If it does not exist then the data structure will need to be created. -156 * -157 * @return true if the H2 database file does not exist; otherwise false -158 * @throws IOException thrown if the data directory does not exist and cannot be created -159 */ -160 private static boolean needToCreateDatabaseStructure() throws IOException { -161 final File dir = getDataDirectory(); -162 final String name = String.format("cve.%s.h2.db", DB_SCHEMA_VERSION); -163 final File file = new File(dir, name); -164 return !file.exists(); -165 } -166 -167 /** -168 * Creates the database structure (tables and indexes) to store the CVE data. -169 * -170 * @param conn the database connection -171 * @throws DatabaseException thrown if there is a Database Exception -172 */ -173 private static void createTables(Connection conn) throws DatabaseException { -174 Logger.getLogger(ConnectionFactory.class.getName()).log(Level.FINE, "Creating database structure"); -175 InputStream is; -176 InputStreamReader reader; -177 BufferedReader in = null; -178 try { -179 is = ConnectionFactory.class.getClassLoader().getResourceAsStream(DB_STRUCTURE_RESOURCE); -180 reader = new InputStreamReader(is, "UTF-8"); -181 in = new BufferedReader(reader); -182 final StringBuilder sb = new StringBuilder(2110); -183 String tmp; -184 while ((tmp = in.readLine()) != null) { -185 sb.append(tmp); -186 } -187 Statement statement = null; -188 try { -189 statement = conn.createStatement(); -190 statement.execute(sb.toString()); -191 } catch (SQLException ex) { -192 Logger.getLogger(ConnectionFactory.class.getName()).log(Level.FINE, null, ex); -193 throw new DatabaseException("Unable to create database statement", ex); -194 } finally { -195 DBUtils.closeStatement(statement); -196 } -197 } catch (IOException ex) { -198 throw new DatabaseException("Unable to create database schema", ex); -199 } finally { -200 if (in != null) { -201 try { -202 in.close(); -203 } catch (IOException ex) { -204 Logger.getLogger(ConnectionFactory.class.getName()).log(Level.FINEST, null, ex); -205 } -206 } -207 } -208 } -209 -210 /** -211 * Uses the provided connection to check the specified schema version within the database. -212 * -213 * @param conn the database connection object -214 * @throws DatabaseException thrown if the schema version is not compatible with this version of dependency-check -215 */ -216 private static void ensureSchemaVersion(Connection conn) throws DatabaseException { -217 ResultSet rs = null; -218 CallableStatement cs = null; -219 try { -220 cs = conn.prepareCall("SELECT value FROM properties WHERE id = 'version'"); -221 rs = cs.executeQuery(); -222 if (rs.next()) { -223 final boolean isWrongSchema = !DB_SCHEMA_VERSION.equals(rs.getString(1)); -224 if (isWrongSchema) { -225 throw new DatabaseException("Incorrect database schema; unable to continue"); -226 } -227 } else { -228 throw new DatabaseException("Database schema is missing"); -229 } -230 } catch (SQLException ex) { -231 Logger.getLogger(ConnectionFactory.class.getName()).log(Level.FINE, null, ex); -232 throw new DatabaseException("Unable to check the database schema version"); -233 } finally { -234 DBUtils.closeResultSet(rs); -235 DBUtils.closeStatement(cs); -236 } -237 } -238 } +115 throw new DatabaseException("Unable to load database"); +116 } catch (DriverLoadException ex) { +117 Logger.getLogger(ConnectionFactory.class.getName()).log(Level.FINE, null, ex); +118 throw new DatabaseException("Unable to load database driver"); +119 } catch (SQLException ex) { +120 Logger.getLogger(ConnectionFactory.class.getName()).log(Level.FINE, null, ex); +121 throw new DatabaseException("Unable to connect to the database"); +122 } +123 return conn; +124 } +125 +126 /** +127 * Returns the configured connection string. If using the embedded H2 database this function will also ensure the +128 * data directory exists and if not create it. +129 * +130 * @return the connection string +131 * @throws IOException thrown the data directory cannot be created +132 */ +133 private static String getConnectionString() throws IOException { +134 final String connStr = Settings.getString(Settings.KEYS.DB_CONNECTION_STRING, "jdbc:h2:file:%s;AUTO_SERVER=TRUE"); +135 if (connStr.contains("%s")) { +136 final String directory = getDataDirectory().getCanonicalPath(); +137 final File dataFile = new File(directory, "cve." + DB_SCHEMA_VERSION); +138 Logger.getLogger(ConnectionFactory.class.getName()).log(Level.FINE, String.format("File path for H2 file: '%s'", dataFile.toString())); +139 return String.format(connStr, dataFile.getAbsolutePath()); +140 } +141 return connStr; +142 } +143 +144 /** +145 * Retrieves the directory that the JAR file exists in so that we can ensure we always use a common data directory +146 * for the embedded H2 database. This is public solely for some unit tests; otherwise this should be private. +147 * +148 * @return the data directory to store data files +149 * @throws IOException is thrown if an IOException occurs of course... +150 */ +151 public static File getDataDirectory() throws IOException { +152 final File path = Settings.getDataFile(Settings.KEYS.DATA_DIRECTORY); +153 if (!path.exists()) { +154 if (!path.mkdirs()) { +155 throw new IOException("Unable to create NVD CVE Data directory"); +156 } +157 } +158 return path; +159 } +160 +161 /** +162 * Determines if the H2 database file exists. If it does not exist then the data structure will need to be created. +163 * +164 * @return true if the H2 database file does not exist; otherwise false +165 * @throws IOException thrown if the data directory does not exist and cannot be created +166 */ +167 private static boolean needToCreateDatabaseStructure() throws IOException { +168 final File dir = getDataDirectory(); +169 final String name = String.format("cve.%s.h2.db", DB_SCHEMA_VERSION); +170 final File file = new File(dir, name); +171 return !file.exists(); +172 } +173 +174 /** +175 * Creates the database structure (tables and indexes) to store the CVE data. +176 * +177 * @param conn the database connection +178 * @throws DatabaseException thrown if there is a Database Exception +179 */ +180 private static void createTables(Connection conn) throws DatabaseException { +181 Logger.getLogger(ConnectionFactory.class.getName()).log(Level.FINE, "Creating database structure"); +182 InputStream is; +183 InputStreamReader reader; +184 BufferedReader in = null; +185 try { +186 is = ConnectionFactory.class.getClassLoader().getResourceAsStream(DB_STRUCTURE_RESOURCE); +187 reader = new InputStreamReader(is, "UTF-8"); +188 in = new BufferedReader(reader); +189 final StringBuilder sb = new StringBuilder(2110); +190 String tmp; +191 while ((tmp = in.readLine()) != null) { +192 sb.append(tmp); +193 } +194 Statement statement = null; +195 try { +196 statement = conn.createStatement(); +197 statement.execute(sb.toString()); +198 } catch (SQLException ex) { +199 Logger.getLogger(ConnectionFactory.class.getName()).log(Level.FINE, null, ex); +200 throw new DatabaseException("Unable to create database statement", ex); +201 } finally { +202 DBUtils.closeStatement(statement); +203 } +204 } catch (IOException ex) { +205 throw new DatabaseException("Unable to create database schema", ex); +206 } finally { +207 if (in != null) { +208 try { +209 in.close(); +210 } catch (IOException ex) { +211 Logger.getLogger(ConnectionFactory.class.getName()).log(Level.FINEST, null, ex); +212 } +213 } +214 } +215 } +216 +217 /** +218 * Uses the provided connection to check the specified schema version within the database. +219 * +220 * @param conn the database connection object +221 * @throws DatabaseException thrown if the schema version is not compatible with this version of dependency-check +222 */ +223 private static void ensureSchemaVersion(Connection conn) throws DatabaseException { +224 ResultSet rs = null; +225 CallableStatement cs = null; +226 try { +227 cs = conn.prepareCall("SELECT value FROM properties WHERE id = 'version'"); +228 rs = cs.executeQuery(); +229 if (rs.next()) { +230 final boolean isWrongSchema = !DB_SCHEMA_VERSION.equals(rs.getString(1)); +231 if (isWrongSchema) { +232 throw new DatabaseException("Incorrect database schema; unable to continue"); +233 } +234 } else { +235 throw new DatabaseException("Database schema is missing"); +236 } +237 } catch (SQLException ex) { +238 Logger.getLogger(ConnectionFactory.class.getName()).log(Level.FINE, null, ex); +239 throw new DatabaseException("Unable to check the database schema version"); +240 } finally { +241 DBUtils.closeResultSet(rs); +242 DBUtils.closeStatement(cs); +243 } +244 } +245 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/nvdcve/CorruptDatabaseException.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/nvdcve/CorruptDatabaseException.html index 30cab9242..0bc57f21b 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/nvdcve/CorruptDatabaseException.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/nvdcve/CorruptDatabaseException.html @@ -9,55 +9,54 @@ 1 /* 2 * This file is part of dependency-check-core. 3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. -18 */ -19 package org.owasp.dependencycheck.data.nvdcve; -20 -21 /** -22 * An exception used to indicate the db4o database is corrupt. This could be due -23 * to invalid data or a complete failure of the db. -24 * -25 * @author Jeremy Long <jeremy.long@owasp.org> -26 */ -27 class CorruptDatabaseException extends DatabaseException { -28 -29 /** -30 * the serial version uid. -31 */ -32 private static final long serialVersionUID = 1L; -33 -34 /** -35 * Creates an CorruptDatabaseException -36 * -37 * @param msg the exception message -38 */ -39 public CorruptDatabaseException(String msg) { -40 super(msg); -41 } -42 -43 /** -44 * Creates an CorruptDatabaseException -45 * -46 * @param msg the exception message -47 * @param ex the cause of the exception -48 */ -49 public CorruptDatabaseException(String msg, Exception ex) { -50 super(msg, ex); -51 } -52 } +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. +17 */ +18 package org.owasp.dependencycheck.data.nvdcve; +19 +20 /** +21 * An exception used to indicate the db4o database is corrupt. This could be due to invalid data or a complete failure +22 * of the db. +23 * +24 * @author Jeremy Long <jeremy.long@owasp.org> +25 */ +26 class CorruptDatabaseException extends DatabaseException { +27 +28 /** +29 * the serial version uid. +30 */ +31 private static final long serialVersionUID = 1L; +32 +33 /** +34 * Creates an CorruptDatabaseException +35 * +36 * @param msg the exception message +37 */ +38 public CorruptDatabaseException(String msg) { +39 super(msg); +40 } +41 +42 /** +43 * Creates an CorruptDatabaseException +44 * +45 * @param msg the exception message +46 * @param ex the cause of the exception +47 */ +48 public CorruptDatabaseException(String msg, Exception ex) { +49 super(msg, ex); +50 } +51 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/nvdcve/CveDB.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/nvdcve/CveDB.html index 11ec2fdcc..f6200776f 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/nvdcve/CveDB.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/nvdcve/CveDB.html @@ -9,778 +9,780 @@ 1 /* 2 * This file is part of dependency-check-core. 3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. -18 */ -19 package org.owasp.dependencycheck.data.nvdcve; -20 -21 import java.io.UnsupportedEncodingException; -22 import java.sql.Connection; -23 import java.sql.PreparedStatement; -24 import java.sql.ResultSet; -25 import java.sql.SQLException; -26 import java.sql.Statement; -27 import java.util.ArrayList; -28 import java.util.HashSet; -29 import java.util.List; -30 import java.util.Map.Entry; -31 import java.util.Properties; -32 import java.util.Set; -33 import java.util.logging.Level; -34 import java.util.logging.Logger; -35 import org.owasp.dependencycheck.data.cwe.CweDB; -36 import org.owasp.dependencycheck.dependency.Reference; -37 import org.owasp.dependencycheck.dependency.Vulnerability; -38 import org.owasp.dependencycheck.dependency.VulnerableSoftware; -39 import org.owasp.dependencycheck.utils.DBUtils; -40 import org.owasp.dependencycheck.utils.DependencyVersion; -41 import org.owasp.dependencycheck.utils.DependencyVersionUtil; -42 -43 /** -44 * The database holding information about the NVD CVE data. -45 * -46 * @author Jeremy Long <jeremy.long@owasp.org> -47 */ -48 public class CveDB { -49 -50 /** -51 * Database connection -52 */ -53 private Connection conn; -54 -55 /** -56 * Creates a new CveDB object and opens the database connection. Note, the connection must be closed by the caller -57 * by calling the close method. -58 * -59 * @throws DatabaseException thrown if there is an exception opening the database. -60 */ -61 public CveDB() throws DatabaseException { -62 super(); -63 try { -64 open(); -65 databaseProperties = new DatabaseProperties(this); -66 } catch (DatabaseException ex) { -67 throw ex; -68 } -69 } -70 -71 /** -72 * Returns the database connection. -73 * -74 * @return the database connection -75 */ -76 protected Connection getConnection() { -77 return conn; -78 } -79 -80 /** -81 * Opens the database connection. If the database does not exist, it will create a new one. -82 * -83 * @throws DatabaseException thrown if there is an error opening the database connection -84 */ -85 public final void open() throws DatabaseException { -86 conn = ConnectionFactory.getConnection(); -87 } -88 -89 /** -90 * Closes the DB4O database. Close should be called on this object when it is done being used. -91 */ -92 public void close() { -93 if (conn != null) { -94 try { -95 conn.close(); -96 } catch (SQLException ex) { -97 final String msg = "There was an error attempting to close the CveDB, see the log for more details."; -98 Logger.getLogger(DBUtils.class.getName()).log(Level.SEVERE, msg); -99 Logger.getLogger(DBUtils.class.getName()).log(Level.FINE, null, ex); -100 } -101 conn = null; -102 } -103 } -104 -105 /** -106 * Returns whether the database connection is open or closed. -107 * -108 * @return whether the database connection is open or closed -109 */ -110 public boolean isOpen() { -111 return conn != null; -112 } -113 -114 /** -115 * Commits all completed transactions. -116 * -117 * @throws SQLException thrown if a SQL Exception occurs -118 */ -119 public void commit() throws SQLException { -120 if (conn != null) { -121 //temporary remove this as autocommit is on. -122 //conn.commit(); -123 } -124 } -125 -126 /** -127 * Cleans up the object and ensures that "close" has been called. -128 * -129 * @throws Throwable thrown if there is a problem -130 */ -131 @Override -132 protected void finalize() throws Throwable { -133 close(); -134 super.finalize(); -135 } -136 /** -137 * Database properties object containing the 'properties' from the database table. -138 */ -139 private DatabaseProperties databaseProperties; -140 -141 /** -142 * Get the value of databaseProperties. -143 * -144 * @return the value of databaseProperties -145 */ -146 public DatabaseProperties getDatabaseProperties() { -147 return databaseProperties; -148 } -149 //<editor-fold defaultstate="collapsed" desc="Constants to create, maintain, and retrieve data from the CVE Database"> -150 /** -151 * SQL Statement to delete references by vulnerability ID. -152 */ -153 private static final String DELETE_REFERENCE = "DELETE FROM reference WHERE cveid = ?"; -154 /** -155 * SQL Statement to delete software by vulnerability ID. -156 */ -157 private static final String DELETE_SOFTWARE = "DELETE FROM software WHERE cveid = ?"; -158 /** -159 * SQL Statement to delete a vulnerability by CVE. -160 */ -161 private static final String DELETE_VULNERABILITY = "DELETE FROM vulnerability WHERE id = ?"; -162 /** -163 * SQL Statement to cleanup orphan entries. Yes, the db schema could be a little tighter, but what we have works -164 * well to keep the data file size down a bit. -165 */ -166 private static final String CLEANUP_ORPHANS = "DELETE FROM CpeEntry WHERE id not in (SELECT CPEEntryId FROM Software); "; -167 /** -168 * SQL Statement to insert a new reference. -169 */ -170 private static final String INSERT_REFERENCE = "INSERT INTO reference (cveid, name, url, source) VALUES (?, ?, ?, ?)"; -171 /** -172 * SQL Statement to insert a new software. -173 */ -174 private static final String INSERT_SOFTWARE = "INSERT INTO software (cveid, cpeEntryId, previousVersion) VALUES (?, ?, ?)"; -175 /** -176 * SQL Statement to insert a new cpe. -177 */ -178 private static final String INSERT_CPE = "INSERT INTO cpeEntry (cpe, vendor, product) VALUES (?, ?, ?)"; -179 /** -180 * SQL Statement to get a CPEProductID. -181 */ -182 private static final String SELECT_CPE_ID = "SELECT id FROM cpeEntry WHERE cpe = ?"; -183 /** -184 * SQL Statement to insert a new vulnerability. -185 */ -186 private static final String INSERT_VULNERABILITY = "INSERT INTO vulnerability (cve, description, cwe, cvssScore, cvssAccessVector, " -187 + "cvssAccessComplexity, cvssAuthentication, cvssConfidentialityImpact, cvssIntegrityImpact, cvssAvailabilityImpact) " -188 + "VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)"; -189 /** -190 * SQL Statement to update a vulnerability. -191 */ -192 private static final String UPDATE_VULNERABILITY = "UPDATE vulnerability SET description=?, cwe=?, cvssScore=?, cvssAccessVector=?, " -193 + "cvssAccessComplexity=?, cvssAuthentication=?, cvssConfidentialityImpact=?, cvssIntegrityImpact=?, cvssAvailabilityImpact=? " -194 + "WHERE id=?"; -195 /** -196 * SQL Statement to find CVE entries based on CPE data. -197 */ -198 private static final String SELECT_CVE_FROM_SOFTWARE = "SELECT cve, cpe, previousVersion " -199 + "FROM software INNER JOIN vulnerability ON vulnerability.id = software.cveId " -200 + "INNER JOIN cpeEntry ON cpeEntry.id = software.cpeEntryId " -201 + "WHERE vendor = ? AND product = ?"; -202 //unfortunately, the version info is too complicated to do in a select. Need to filter this afterwards -203 // + " AND (version = '-' OR previousVersion IS NOT NULL OR version=?)"; -204 // -205 /** -206 * SQL Statement to find the CPE entry based on the vendor and product. -207 */ -208 private static final String SELECT_CPE_ENTRIES = "SELECT cpe FROM cpeEntry WHERE vendor = ? AND product = ?"; -209 /** -210 * SQL Statement to select references by CVEID. -211 */ -212 private static final String SELECT_REFERENCE = "SELECT source, name, url FROM reference WHERE cveid = ?"; -213 /** -214 * SQL Statement to select vendor and product for lucene index. -215 */ -216 private static final String SELECT_VENDOR_PRODUCT_LIST = "SELECT vendor, product FROM cpeEntry GROUP BY vendor, product"; -217 /** -218 * SQL Statement to select software by CVEID. -219 */ -220 private static final String SELECT_SOFTWARE = "SELECT cpe, previousVersion " -221 + "FROM software INNER JOIN cpeEntry ON software.cpeEntryId = cpeEntry.id WHERE cveid = ?"; -222 // public static final String SELECT_SOFTWARE = "SELECT part, vendor, product, version, revision, previousVersion " -223 // + "FROM software INNER JOIN cpeProduct ON cpeProduct.id = software.cpeProductId LEFT JOIN cpeVersion ON " -224 // + "software.cpeVersionId = cpeVersion.id LEFT JOIN Version ON cpeVersion.versionId = version.id WHERE cveid = ?"; -225 /** -226 * SQL Statement to select a vulnerability by CVEID. -227 */ -228 private static final String SELECT_VULNERABILITY = "SELECT id, description, cwe, cvssScore, cvssAccessVector, cvssAccessComplexity, " -229 + "cvssAuthentication, cvssConfidentialityImpact, cvssIntegrityImpact, cvssAvailabilityImpact FROM vulnerability WHERE cve = ?"; -230 /** -231 * SQL Statement to select a vulnerability's primary key. -232 */ -233 private static final String SELECT_VULNERABILITY_ID = "SELECT id FROM vulnerability WHERE cve = ?"; -234 /** -235 * SQL Statement to retrieve the properties from the database. -236 */ -237 private static final String SELECT_PROPERTIES = "SELECT id, value FROM properties"; -238 /** -239 * SQL Statement to retrieve a property from the database. -240 */ -241 private static final String SELECT_PROPERTY = "SELECT id, value FROM properties WHERE id = ?"; -242 /** -243 * SQL Statement to insert a new property. -244 */ -245 private static final String INSERT_PROPERTY = "INSERT INTO properties (id, value) VALUES (?, ?)"; -246 /** -247 * SQL Statement to update a property. -248 */ -249 private static final String UPDATE_PROPERTY = "UPDATE properties SET value = ? WHERE id = ?"; -250 /** -251 * SQL Statement to delete a property. -252 */ -253 private static final String DELETE_PROPERTY = "DELETE FROM properties WHERE id = ?"; -254 -255 //</editor-fold> -256 /** -257 * Searches the CPE entries in the database and retrieves all entries for a given vendor and product combination. -258 * The returned list will include all versions of the product that are registered in the NVD CVE data. -259 * -260 * @param vendor the identified vendor name of the dependency being analyzed -261 * @param product the identified name of the product of the dependency being analyzed -262 * @return a set of vulnerable software -263 */ -264 public Set<VulnerableSoftware> getCPEs(String vendor, String product) { -265 final Set<VulnerableSoftware> cpe = new HashSet<VulnerableSoftware>(); -266 ResultSet rs = null; -267 PreparedStatement ps = null; -268 try { -269 ps = getConnection().prepareStatement(SELECT_CPE_ENTRIES); -270 ps.setString(1, vendor); -271 ps.setString(2, product); -272 rs = ps.executeQuery(); -273 -274 while (rs.next()) { -275 final VulnerableSoftware vs = new VulnerableSoftware(); -276 vs.setCpe(rs.getString(1)); -277 cpe.add(vs); -278 } -279 } catch (SQLException ex) { -280 final String msg = "An unexpected SQL Exception occurred; please see the verbose log for more details."; -281 Logger.getLogger(CveDB.class.getName()).log(Level.SEVERE, msg); -282 Logger.getLogger(CveDB.class.getName()).log(Level.FINE, null, ex); -283 } finally { -284 DBUtils.closeResultSet(rs); -285 DBUtils.closeStatement(ps); -286 } -287 return cpe; -288 } -289 -290 /** -291 * Returns the entire list of vendor/product combinations. -292 * -293 * @return the entire list of vendor/product combinations. -294 */ -295 public ResultSet getVendorProductList() { -296 ResultSet rs = null; -297 try { -298 final PreparedStatement ps = getConnection().prepareStatement(SELECT_VENDOR_PRODUCT_LIST); -299 rs = ps.executeQuery(); -300 } catch (SQLException ex) { -301 final String msg = "An unexpected SQL Exception occurred; please see the verbose log for more details."; -302 Logger.getLogger(CveDB.class.getName()).log(Level.SEVERE, msg); -303 Logger.getLogger(CveDB.class.getName()).log(Level.FINE, null, ex); -304 } // can't close the statement in the PS as the resultset is returned, closing PS would close the resultset -305 return rs; -306 } -307 -308 /** -309 * Returns a set of properties. -310 * -311 * @return the properties from the database -312 */ -313 Properties getProperties() { -314 final Properties prop = new Properties(); -315 PreparedStatement ps = null; -316 ResultSet rs = null; -317 try { -318 ps = getConnection().prepareStatement(SELECT_PROPERTIES); -319 rs = ps.executeQuery(); -320 while (rs.next()) { -321 prop.setProperty(rs.getString(1), rs.getString(2)); -322 } -323 } catch (SQLException ex) { -324 final String msg = "An unexpected SQL Exception occurred; please see the verbose log for more details."; -325 Logger.getLogger(CveDB.class.getName()).log(Level.SEVERE, msg); -326 Logger.getLogger(CveDB.class.getName()).log(Level.FINE, null, ex); -327 } finally { -328 DBUtils.closeStatement(ps); -329 DBUtils.closeResultSet(rs); -330 } -331 return prop; -332 } -333 -334 /** -335 * Saves a set of properties to the database. -336 * -337 * @param props a collection of properties -338 */ -339 void saveProperties(Properties props) { -340 PreparedStatement updateProperty = null; -341 PreparedStatement insertProperty = null; -342 try { -343 try { -344 updateProperty = getConnection().prepareStatement(UPDATE_PROPERTY); -345 insertProperty = getConnection().prepareStatement(INSERT_PROPERTY); -346 } catch (SQLException ex) { -347 Logger.getLogger(CveDB.class.getName()).log(Level.WARNING, "Unable to save properties to the database"); -348 Logger.getLogger(CveDB.class.getName()).log(Level.FINE, "Unable to save properties to the database", ex); -349 return; -350 } -351 for (Entry<Object, Object> entry : props.entrySet()) { -352 final String key = entry.getKey().toString(); -353 final String value = entry.getValue().toString(); -354 try { -355 updateProperty.setString(1, value); -356 updateProperty.setString(2, key); -357 if (updateProperty.executeUpdate() == 0) { -358 insertProperty.setString(1, key); -359 insertProperty.setString(2, value); -360 } -361 } catch (SQLException ex) { -362 final String msg = String.format("Unable to save property '%s' with a value of '%s' to the database", key, value); -363 Logger.getLogger(CveDB.class.getName()).log(Level.WARNING, msg); -364 Logger.getLogger(CveDB.class.getName()).log(Level.FINE, null, ex); -365 } -366 } -367 } finally { -368 DBUtils.closeStatement(updateProperty); -369 DBUtils.closeStatement(insertProperty); -370 } -371 } -372 -373 /** -374 * Saves a property to the database. -375 * -376 * @param key the property key -377 * @param value the property value -378 */ -379 void saveProperty(String key, String value) { -380 PreparedStatement updateProperty = null; -381 PreparedStatement insertProperty = null; -382 try { -383 try { -384 updateProperty = getConnection().prepareStatement(UPDATE_PROPERTY); -385 } catch (SQLException ex) { -386 Logger.getLogger(CveDB.class.getName()).log(Level.WARNING, "Unable to save properties to the database"); -387 Logger.getLogger(CveDB.class.getName()).log(Level.FINE, "Unable to save properties to the database", ex); -388 return; -389 } -390 try { -391 updateProperty.setString(1, value); -392 updateProperty.setString(2, key); -393 if (updateProperty.executeUpdate() == 0) { -394 try { -395 insertProperty = getConnection().prepareStatement(INSERT_PROPERTY); -396 } catch (SQLException ex) { -397 Logger.getLogger(CveDB.class.getName()).log(Level.WARNING, "Unable to save properties to the database"); -398 Logger.getLogger(CveDB.class.getName()).log(Level.FINE, "Unable to save properties to the database", ex); -399 return; -400 } -401 insertProperty.setString(1, key); -402 insertProperty.setString(2, value); -403 insertProperty.execute(); -404 } -405 } catch (SQLException ex) { -406 final String msg = String.format("Unable to save property '%s' with a value of '%s' to the database", key, value); -407 Logger.getLogger(CveDB.class.getName()).log(Level.WARNING, msg); -408 Logger.getLogger(CveDB.class.getName()).log(Level.FINE, null, ex); -409 } -410 } finally { -411 DBUtils.closeStatement(updateProperty); -412 DBUtils.closeStatement(insertProperty); -413 } -414 } -415 -416 /** -417 * Retrieves the vulnerabilities associated with the specified CPE. -418 * -419 * @param cpeStr the CPE name -420 * @return a list of Vulnerabilities -421 * @throws DatabaseException thrown if there is an exception retrieving data -422 */ -423 public List<Vulnerability> getVulnerabilities(String cpeStr) throws DatabaseException { -424 ResultSet rs = null; -425 final VulnerableSoftware cpe = new VulnerableSoftware(); -426 try { -427 cpe.parseName(cpeStr); -428 } catch (UnsupportedEncodingException ex) { -429 Logger.getLogger(CveDB.class.getName()).log(Level.FINEST, null, ex); -430 } -431 final DependencyVersion detectedVersion = parseDependencyVersion(cpe); -432 final List<Vulnerability> vulnerabilities = new ArrayList<Vulnerability>(); -433 -434 PreparedStatement ps; -435 final HashSet<String> cveEntries = new HashSet<String>(); -436 try { -437 ps = getConnection().prepareStatement(SELECT_CVE_FROM_SOFTWARE); -438 ps.setString(1, cpe.getVendor()); -439 ps.setString(2, cpe.getProduct()); -440 rs = ps.executeQuery(); -441 while (rs.next()) { -442 final String cveId = rs.getString(1); -443 final String cpeId = rs.getString(2); -444 final String previous = rs.getString(3); -445 if (!cveEntries.contains(cveId) && isAffected(cpe.getVendor(), cpe.getProduct(), detectedVersion, cpeId, previous)) { -446 cveEntries.add(cveId); -447 } -448 } -449 DBUtils.closeResultSet(rs); -450 DBUtils.closeStatement(ps); -451 for (String cve : cveEntries) { -452 final Vulnerability v = getVulnerability(cve); -453 vulnerabilities.add(v); -454 } -455 -456 } catch (SQLException ex) { -457 throw new DatabaseException("Exception retrieving vulnerability for " + cpeStr, ex); -458 } finally { -459 DBUtils.closeResultSet(rs); -460 } -461 return vulnerabilities; -462 } -463 -464 /** -465 * Gets a vulnerability for the provided CVE. -466 * -467 * @param cve the CVE to lookup -468 * @return a vulnerability object -469 * @throws DatabaseException if an exception occurs -470 */ -471 private Vulnerability getVulnerability(String cve) throws DatabaseException { -472 PreparedStatement psV = null; -473 PreparedStatement psR = null; -474 PreparedStatement psS = null; -475 ResultSet rsV = null; -476 ResultSet rsR = null; -477 ResultSet rsS = null; -478 Vulnerability vuln = null; -479 try { -480 psV = getConnection().prepareStatement(SELECT_VULNERABILITY); -481 psV.setString(1, cve); -482 rsV = psV.executeQuery(); -483 if (rsV.next()) { -484 vuln = new Vulnerability(); -485 vuln.setName(cve); -486 vuln.setDescription(rsV.getString(2)); -487 String cwe = rsV.getString(3); -488 if (cwe != null) { -489 final String name = CweDB.getCweName(cwe); -490 if (name != null) { -491 cwe += " " + name; -492 } -493 } -494 final int cveId = rsV.getInt(1); -495 vuln.setCwe(cwe); -496 vuln.setCvssScore(rsV.getFloat(4)); -497 vuln.setCvssAccessVector(rsV.getString(5)); -498 vuln.setCvssAccessComplexity(rsV.getString(6)); -499 vuln.setCvssAuthentication(rsV.getString(7)); -500 vuln.setCvssConfidentialityImpact(rsV.getString(8)); -501 vuln.setCvssIntegrityImpact(rsV.getString(9)); -502 vuln.setCvssAvailabilityImpact(rsV.getString(10)); -503 -504 psR = getConnection().prepareStatement(SELECT_REFERENCE); -505 psR.setInt(1, cveId); -506 rsR = psR.executeQuery(); -507 while (rsR.next()) { -508 vuln.addReference(rsR.getString(1), rsR.getString(2), rsR.getString(3)); -509 } -510 psS = getConnection().prepareStatement(SELECT_SOFTWARE); -511 psS.setInt(1, cveId); -512 rsS = psS.executeQuery(); -513 while (rsS.next()) { -514 final String cpe = rsS.getString(1); -515 final String prevVersion = rsS.getString(2); -516 if (prevVersion == null) { -517 vuln.addVulnerableSoftware(cpe); -518 } else { -519 vuln.addVulnerableSoftware(cpe, prevVersion); -520 } -521 } -522 } -523 } catch (SQLException ex) { -524 throw new DatabaseException("Error retrieving " + cve, ex); -525 } finally { -526 DBUtils.closeResultSet(rsV); -527 DBUtils.closeResultSet(rsR); -528 DBUtils.closeResultSet(rsS); -529 DBUtils.closeStatement(psV); -530 DBUtils.closeStatement(psR); -531 DBUtils.closeStatement(psS); -532 } -533 return vuln; -534 } -535 -536 /** -537 * Updates the vulnerability within the database. If the vulnerability does not exist it will be added. -538 * -539 * @param vuln the vulnerability to add to the database -540 * @throws DatabaseException is thrown if the database -541 */ -542 public void updateVulnerability(Vulnerability vuln) throws DatabaseException { -543 PreparedStatement selectVulnerabilityId = null; -544 PreparedStatement deleteVulnerability = null; -545 PreparedStatement deleteReferences = null; -546 PreparedStatement deleteSoftware = null; -547 PreparedStatement updateVulnerability = null; -548 PreparedStatement insertVulnerability = null; -549 PreparedStatement insertReference = null; -550 PreparedStatement selectCpeId = null; -551 PreparedStatement insertCpe = null; -552 PreparedStatement insertSoftware = null; -553 -554 try { -555 selectVulnerabilityId = getConnection().prepareStatement(SELECT_VULNERABILITY_ID); -556 deleteVulnerability = getConnection().prepareStatement(DELETE_VULNERABILITY); -557 deleteReferences = getConnection().prepareStatement(DELETE_REFERENCE); -558 deleteSoftware = getConnection().prepareStatement(DELETE_SOFTWARE); -559 updateVulnerability = getConnection().prepareStatement(UPDATE_VULNERABILITY); -560 insertVulnerability = getConnection().prepareStatement(INSERT_VULNERABILITY, Statement.RETURN_GENERATED_KEYS); -561 insertReference = getConnection().prepareStatement(INSERT_REFERENCE); -562 selectCpeId = getConnection().prepareStatement(SELECT_CPE_ID); -563 insertCpe = getConnection().prepareStatement(INSERT_CPE, Statement.RETURN_GENERATED_KEYS); -564 insertSoftware = getConnection().prepareStatement(INSERT_SOFTWARE); -565 int vulnerabilityId = 0; -566 selectVulnerabilityId.setString(1, vuln.getName()); -567 ResultSet rs = selectVulnerabilityId.executeQuery(); -568 if (rs.next()) { -569 vulnerabilityId = rs.getInt(1); -570 // first delete any existing vulnerability info. We don't know what was updated. yes, slower but atm easier. -571 deleteReferences.setInt(1, vulnerabilityId); -572 deleteReferences.execute(); -573 deleteSoftware.setInt(1, vulnerabilityId); -574 deleteSoftware.execute(); -575 } -576 DBUtils.closeResultSet(rs); -577 rs = null; -578 if (vulnerabilityId != 0) { -579 if (vuln.getDescription().contains("** REJECT **")) { -580 deleteVulnerability.setInt(1, vulnerabilityId); -581 deleteVulnerability.executeUpdate(); -582 } else { -583 updateVulnerability.setString(1, vuln.getDescription()); -584 updateVulnerability.setString(2, vuln.getCwe()); -585 updateVulnerability.setFloat(3, vuln.getCvssScore()); -586 updateVulnerability.setString(4, vuln.getCvssAccessVector()); -587 updateVulnerability.setString(5, vuln.getCvssAccessComplexity()); -588 updateVulnerability.setString(6, vuln.getCvssAuthentication()); -589 updateVulnerability.setString(7, vuln.getCvssConfidentialityImpact()); -590 updateVulnerability.setString(8, vuln.getCvssIntegrityImpact()); -591 updateVulnerability.setString(9, vuln.getCvssAvailabilityImpact()); -592 updateVulnerability.setInt(10, vulnerabilityId); -593 updateVulnerability.executeUpdate(); -594 } -595 } else { -596 insertVulnerability.setString(1, vuln.getName()); -597 insertVulnerability.setString(2, vuln.getDescription()); -598 insertVulnerability.setString(3, vuln.getCwe()); -599 insertVulnerability.setFloat(4, vuln.getCvssScore()); -600 insertVulnerability.setString(5, vuln.getCvssAccessVector()); -601 insertVulnerability.setString(6, vuln.getCvssAccessComplexity()); -602 insertVulnerability.setString(7, vuln.getCvssAuthentication()); -603 insertVulnerability.setString(8, vuln.getCvssConfidentialityImpact()); -604 insertVulnerability.setString(9, vuln.getCvssIntegrityImpact()); -605 insertVulnerability.setString(10, vuln.getCvssAvailabilityImpact()); -606 insertVulnerability.execute(); -607 try { -608 rs = insertVulnerability.getGeneratedKeys(); -609 rs.next(); -610 vulnerabilityId = rs.getInt(1); -611 } catch (SQLException ex) { -612 final String msg = String.format("Unable to retrieve id for new vulnerability for '%s'", vuln.getName()); -613 throw new DatabaseException(msg, ex); -614 } finally { -615 DBUtils.closeResultSet(rs); -616 rs = null; -617 } -618 } -619 insertReference.setInt(1, vulnerabilityId); -620 for (Reference r : vuln.getReferences()) { -621 insertReference.setString(2, r.getName()); -622 insertReference.setString(3, r.getUrl()); -623 insertReference.setString(4, r.getSource()); -624 insertReference.execute(); -625 } -626 for (VulnerableSoftware s : vuln.getVulnerableSoftware()) { -627 int cpeProductId = 0; -628 selectCpeId.setString(1, s.getName()); -629 try { -630 rs = selectCpeId.executeQuery(); -631 if (rs.next()) { -632 cpeProductId = rs.getInt(1); -633 } -634 } catch (SQLException ex) { -635 throw new DatabaseException("Unable to get primary key for new cpe: " + s.getName(), ex); -636 } finally { -637 DBUtils.closeResultSet(rs); -638 rs = null; -639 } -640 -641 if (cpeProductId == 0) { -642 insertCpe.setString(1, s.getName()); -643 insertCpe.setString(2, s.getVendor()); -644 insertCpe.setString(3, s.getProduct()); -645 insertCpe.executeUpdate(); -646 cpeProductId = DBUtils.getGeneratedKey(insertCpe); -647 } -648 if (cpeProductId == 0) { -649 throw new DatabaseException("Unable to retrieve cpeProductId - no data returned"); -650 } -651 -652 insertSoftware.setInt(1, vulnerabilityId); -653 insertSoftware.setInt(2, cpeProductId); -654 if (s.getPreviousVersion() == null) { -655 insertSoftware.setNull(3, java.sql.Types.VARCHAR); -656 } else { -657 insertSoftware.setString(3, s.getPreviousVersion()); -658 } -659 insertSoftware.execute(); -660 } -661 -662 } catch (SQLException ex) { -663 final String msg = String.format("Error updating '%s'", vuln.getName()); -664 Logger.getLogger(CveDB.class.getName()).log(Level.FINE, null, ex); -665 throw new DatabaseException(msg, ex); -666 } finally { -667 DBUtils.closeStatement(selectVulnerabilityId); -668 DBUtils.closeStatement(deleteReferences); -669 DBUtils.closeStatement(deleteSoftware); -670 DBUtils.closeStatement(updateVulnerability); -671 DBUtils.closeStatement(deleteVulnerability); -672 DBUtils.closeStatement(insertVulnerability); -673 DBUtils.closeStatement(insertReference); -674 DBUtils.closeStatement(selectCpeId); -675 DBUtils.closeStatement(insertCpe); -676 DBUtils.closeStatement(insertSoftware); -677 } -678 } -679 -680 /** -681 * It is possible that orphaned rows may be generated during database updates. This should be called after all -682 * updates have been completed to ensure orphan entries are removed. -683 */ -684 public void cleanupDatabase() { -685 PreparedStatement ps = null; -686 try { -687 ps = getConnection().prepareStatement(CLEANUP_ORPHANS); -688 if (ps != null) { -689 ps.executeUpdate(); -690 } -691 } catch (SQLException ex) { -692 final String msg = "An unexpected SQL Exception occurred; please see the verbose log for more details."; -693 Logger.getLogger(CveDB.class.getName()).log(Level.SEVERE, msg); -694 Logger.getLogger(CveDB.class.getName()).log(Level.FINE, null, ex); -695 } finally { -696 DBUtils.closeStatement(ps); -697 } -698 } -699 -700 /** -701 * Determines if the given identifiedVersion is affected by the given cpeId and previous version flag. A non-null, -702 * non-empty string passed to the previous version argument indicates that all previous versions are affected. -703 * -704 * @param vendor the vendor of the dependency being analyzed -705 * @param product the product name of the dependency being analyzed -706 * @param identifiedVersion the identified version of the dependency being analyzed -707 * @param cpeId the cpe identifier of software that has a known vulnerability -708 * @param previous a flag indicating if previous versions of the product are vulnerable -709 * @return true if the identified version is affected, otherwise false -710 */ -711 private boolean isAffected(String vendor, String product, DependencyVersion identifiedVersion, String cpeId, String previous) { -712 boolean affected = false; -713 final boolean isStruts = "apache".equals(vendor) && "struts".equals(product); -714 final DependencyVersion v = parseDependencyVersion(cpeId); -715 final boolean prevAffected = previous != null && !previous.isEmpty(); -716 if (identifiedVersion == null || "-".equals(identifiedVersion.toString())) { -717 if (v == null || "-".equals(v.toString())) { -718 affected = true; -719 } -720 } else if (identifiedVersion.equals(v) || (prevAffected && identifiedVersion.compareTo(v) < 0)) { -721 if (isStruts) { //struts 2 vulns don't affect struts 1 -722 if (identifiedVersion.getVersionParts().get(0).equals(v.getVersionParts().get(0))) { -723 affected = true; -724 } -725 } else { -726 affected = true; -727 } -728 } -729 /* -730 * TODO consider utilizing the matchThreeVersion method to get additional results. However, this -731 * might also introduce false positives. -732 */ -733 return affected; -734 } -735 -736 /** -737 * Parses the version (including revision) from a CPE identifier. If no version is identified then a '-' is -738 * returned. -739 * -740 * @param cpeStr a cpe identifier -741 * @return a dependency version -742 */ -743 private DependencyVersion parseDependencyVersion(String cpeStr) { -744 final VulnerableSoftware cpe = new VulnerableSoftware(); -745 try { -746 cpe.parseName(cpeStr); -747 } catch (UnsupportedEncodingException ex) { -748 //never going to happen. -749 Logger.getLogger(CveDB.class.getName()).log(Level.FINEST, null, ex); -750 } -751 return parseDependencyVersion(cpe); -752 } -753 -754 /** -755 * Takes a CPE and parses out the version number. If no version is identified then a '-' is returned. -756 * -757 * @param cpe a cpe object -758 * @return a dependency version -759 */ -760 private DependencyVersion parseDependencyVersion(VulnerableSoftware cpe) { -761 DependencyVersion cpeVersion; -762 if (cpe.getVersion() != null && cpe.getVersion().length() > 0) { -763 String versionText; -764 if (cpe.getRevision() != null && cpe.getRevision().length() > 0) { -765 versionText = String.format("%s.%s", cpe.getVersion(), cpe.getRevision()); -766 } else { -767 versionText = cpe.getVersion(); -768 } -769 cpeVersion = DependencyVersionUtil.parseVersion(versionText); -770 } else { -771 cpeVersion = new DependencyVersion("-"); -772 } -773 return cpeVersion; -774 } -775 } +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. +17 */ +18 package org.owasp.dependencycheck.data.nvdcve; +19 +20 import java.io.UnsupportedEncodingException; +21 import java.sql.Connection; +22 import java.sql.PreparedStatement; +23 import java.sql.ResultSet; +24 import java.sql.SQLException; +25 import java.sql.Statement; +26 import java.util.ArrayList; +27 import java.util.HashSet; +28 import java.util.List; +29 import java.util.Map.Entry; +30 import java.util.Properties; +31 import java.util.Set; +32 import java.util.logging.Level; +33 import java.util.logging.Logger; +34 import org.owasp.dependencycheck.data.cwe.CweDB; +35 import org.owasp.dependencycheck.dependency.Reference; +36 import org.owasp.dependencycheck.dependency.Vulnerability; +37 import org.owasp.dependencycheck.dependency.VulnerableSoftware; +38 import org.owasp.dependencycheck.utils.DBUtils; +39 import org.owasp.dependencycheck.utils.DependencyVersion; +40 import org.owasp.dependencycheck.utils.DependencyVersionUtil; +41 +42 /** +43 * The database holding information about the NVD CVE data. +44 * +45 * @author Jeremy Long <jeremy.long@owasp.org> +46 */ +47 public class CveDB { +48 +49 /** +50 * Database connection +51 */ +52 private Connection conn; +53 +54 /** +55 * Creates a new CveDB object and opens the database connection. Note, the connection must be closed by the caller +56 * by calling the close method. +57 * +58 * @throws DatabaseException thrown if there is an exception opening the database. +59 */ +60 public CveDB() throws DatabaseException { +61 super(); +62 try { +63 open(); +64 databaseProperties = new DatabaseProperties(this); +65 } catch (DatabaseException ex) { +66 throw ex; +67 } +68 } +69 +70 /** +71 * Returns the database connection. +72 * +73 * @return the database connection +74 */ +75 protected Connection getConnection() { +76 return conn; +77 } +78 +79 /** +80 * Opens the database connection. If the database does not exist, it will create a new one. +81 * +82 * @throws DatabaseException thrown if there is an error opening the database connection +83 */ +84 public final void open() throws DatabaseException { +85 conn = ConnectionFactory.getConnection(); +86 } +87 +88 /** +89 * Closes the DB4O database. Close should be called on this object when it is done being used. +90 */ +91 public void close() { +92 if (conn != null) { +93 try { +94 conn.close(); +95 } catch (SQLException ex) { +96 final String msg = "There was an error attempting to close the CveDB, see the log for more details."; +97 Logger.getLogger(DBUtils.class.getName()).log(Level.SEVERE, msg); +98 Logger.getLogger(DBUtils.class.getName()).log(Level.FINE, null, ex); +99 } +100 conn = null; +101 } +102 } +103 +104 /** +105 * Returns whether the database connection is open or closed. +106 * +107 * @return whether the database connection is open or closed +108 */ +109 public boolean isOpen() { +110 return conn != null; +111 } +112 +113 /** +114 * Commits all completed transactions. +115 * +116 * @throws SQLException thrown if a SQL Exception occurs +117 */ +118 public void commit() throws SQLException { +119 //temporary remove this as autocommit is on. +120 //if (conn != null) { +121 // conn.commit(); +122 //} +123 } +124 +125 /** +126 * Cleans up the object and ensures that "close" has been called. +127 * +128 * @throws Throwable thrown if there is a problem +129 */ +130 @Override +131 protected void finalize() throws Throwable { +132 close(); +133 super.finalize(); +134 } +135 /** +136 * Database properties object containing the 'properties' from the database table. +137 */ +138 private DatabaseProperties databaseProperties; +139 +140 /** +141 * Get the value of databaseProperties. +142 * +143 * @return the value of databaseProperties +144 */ +145 public DatabaseProperties getDatabaseProperties() { +146 return databaseProperties; +147 } +148 //<editor-fold defaultstate="collapsed" desc="Constants to create, maintain, and retrieve data from the CVE Database"> +149 /** +150 * SQL Statement to delete references by vulnerability ID. +151 */ +152 private static final String DELETE_REFERENCE = "DELETE FROM reference WHERE cveid = ?"; +153 /** +154 * SQL Statement to delete software by vulnerability ID. +155 */ +156 private static final String DELETE_SOFTWARE = "DELETE FROM software WHERE cveid = ?"; +157 /** +158 * SQL Statement to delete a vulnerability by CVE. +159 */ +160 private static final String DELETE_VULNERABILITY = "DELETE FROM vulnerability WHERE id = ?"; +161 /** +162 * SQL Statement to cleanup orphan entries. Yes, the db schema could be a little tighter, but what we have works +163 * well to keep the data file size down a bit. +164 */ +165 private static final String CLEANUP_ORPHANS = "DELETE FROM CpeEntry WHERE id not in (SELECT CPEEntryId FROM Software); "; +166 /** +167 * SQL Statement to insert a new reference. +168 */ +169 private static final String INSERT_REFERENCE = "INSERT INTO reference (cveid, name, url, source) VALUES (?, ?, ?, ?)"; +170 /** +171 * SQL Statement to insert a new software. +172 */ +173 private static final String INSERT_SOFTWARE = "INSERT INTO software (cveid, cpeEntryId, previousVersion) VALUES (?, ?, ?)"; +174 /** +175 * SQL Statement to insert a new cpe. +176 */ +177 private static final String INSERT_CPE = "INSERT INTO cpeEntry (cpe, vendor, product) VALUES (?, ?, ?)"; +178 /** +179 * SQL Statement to get a CPEProductID. +180 */ +181 private static final String SELECT_CPE_ID = "SELECT id FROM cpeEntry WHERE cpe = ?"; +182 /** +183 * SQL Statement to insert a new vulnerability. +184 */ +185 private static final String INSERT_VULNERABILITY = "INSERT INTO vulnerability (cve, description, cwe, cvssScore, cvssAccessVector, " +186 + "cvssAccessComplexity, cvssAuthentication, cvssConfidentialityImpact, cvssIntegrityImpact, cvssAvailabilityImpact) " +187 + "VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)"; +188 /** +189 * SQL Statement to update a vulnerability. +190 */ +191 private static final String UPDATE_VULNERABILITY = "UPDATE vulnerability SET description=?, cwe=?, cvssScore=?, cvssAccessVector=?, " +192 + "cvssAccessComplexity=?, cvssAuthentication=?, cvssConfidentialityImpact=?, cvssIntegrityImpact=?, cvssAvailabilityImpact=? " +193 + "WHERE id=?"; +194 /** +195 * SQL Statement to find CVE entries based on CPE data. +196 */ +197 private static final String SELECT_CVE_FROM_SOFTWARE = "SELECT cve, cpe, previousVersion " +198 + "FROM software INNER JOIN vulnerability ON vulnerability.id = software.cveId " +199 + "INNER JOIN cpeEntry ON cpeEntry.id = software.cpeEntryId " +200 + "WHERE vendor = ? AND product = ?"; +201 //unfortunately, the version info is too complicated to do in a select. Need to filter this afterwards +202 // + " AND (version = '-' OR previousVersion IS NOT NULL OR version=?)"; +203 // +204 /** +205 * SQL Statement to find the CPE entry based on the vendor and product. +206 */ +207 private static final String SELECT_CPE_ENTRIES = "SELECT cpe FROM cpeEntry WHERE vendor = ? AND product = ?"; +208 /** +209 * SQL Statement to select references by CVEID. +210 */ +211 private static final String SELECT_REFERENCE = "SELECT source, name, url FROM reference WHERE cveid = ?"; +212 /** +213 * SQL Statement to select vendor and product for lucene index. +214 */ +215 private static final String SELECT_VENDOR_PRODUCT_LIST = "SELECT vendor, product FROM cpeEntry GROUP BY vendor, product"; +216 /** +217 * SQL Statement to select software by CVEID. +218 */ +219 private static final String SELECT_SOFTWARE = "SELECT cpe, previousVersion " +220 + "FROM software INNER JOIN cpeEntry ON software.cpeEntryId = cpeEntry.id WHERE cveid = ?"; +221 // public static final String SELECT_SOFTWARE = "SELECT part, vendor, product, version, revision, previousVersion " +222 // + "FROM software INNER JOIN cpeProduct ON cpeProduct.id = software.cpeProductId LEFT JOIN cpeVersion ON " +223 // + "software.cpeVersionId = cpeVersion.id LEFT JOIN Version ON cpeVersion.versionId = version.id WHERE cveid = ?"; +224 /** +225 * SQL Statement to select a vulnerability by CVEID. +226 */ +227 private static final String SELECT_VULNERABILITY = "SELECT id, description, cwe, cvssScore, cvssAccessVector, cvssAccessComplexity, " +228 + "cvssAuthentication, cvssConfidentialityImpact, cvssIntegrityImpact, cvssAvailabilityImpact FROM vulnerability WHERE cve = ?"; +229 /** +230 * SQL Statement to select a vulnerability's primary key. +231 */ +232 private static final String SELECT_VULNERABILITY_ID = "SELECT id FROM vulnerability WHERE cve = ?"; +233 /** +234 * SQL Statement to retrieve the properties from the database. +235 */ +236 private static final String SELECT_PROPERTIES = "SELECT id, value FROM properties"; +237 /** +238 * SQL Statement to retrieve a property from the database. +239 */ +240 private static final String SELECT_PROPERTY = "SELECT id, value FROM properties WHERE id = ?"; +241 /** +242 * SQL Statement to insert a new property. +243 */ +244 private static final String INSERT_PROPERTY = "INSERT INTO properties (id, value) VALUES (?, ?)"; +245 /** +246 * SQL Statement to update a property. +247 */ +248 private static final String UPDATE_PROPERTY = "UPDATE properties SET value = ? WHERE id = ?"; +249 /** +250 * SQL Statement to delete a property. +251 */ +252 private static final String DELETE_PROPERTY = "DELETE FROM properties WHERE id = ?"; +253 +254 //</editor-fold> +255 /** +256 * Searches the CPE entries in the database and retrieves all entries for a given vendor and product combination. +257 * The returned list will include all versions of the product that are registered in the NVD CVE data. +258 * +259 * @param vendor the identified vendor name of the dependency being analyzed +260 * @param product the identified name of the product of the dependency being analyzed +261 * @return a set of vulnerable software +262 */ +263 public Set<VulnerableSoftware> getCPEs(String vendor, String product) { +264 final Set<VulnerableSoftware> cpe = new HashSet<VulnerableSoftware>(); +265 ResultSet rs = null; +266 PreparedStatement ps = null; +267 try { +268 ps = getConnection().prepareStatement(SELECT_CPE_ENTRIES); +269 ps.setString(1, vendor); +270 ps.setString(2, product); +271 rs = ps.executeQuery(); +272 +273 while (rs.next()) { +274 final VulnerableSoftware vs = new VulnerableSoftware(); +275 vs.setCpe(rs.getString(1)); +276 cpe.add(vs); +277 } +278 } catch (SQLException ex) { +279 final String msg = "An unexpected SQL Exception occurred; please see the verbose log for more details."; +280 Logger.getLogger(CveDB.class.getName()).log(Level.SEVERE, msg); +281 Logger.getLogger(CveDB.class.getName()).log(Level.FINE, null, ex); +282 } finally { +283 DBUtils.closeResultSet(rs); +284 DBUtils.closeStatement(ps); +285 } +286 return cpe; +287 } +288 +289 /** +290 * Returns the entire list of vendor/product combinations. +291 * +292 * @return the entire list of vendor/product combinations. +293 */ +294 public ResultSet getVendorProductList() { +295 ResultSet rs = null; +296 try { +297 final PreparedStatement ps = getConnection().prepareStatement(SELECT_VENDOR_PRODUCT_LIST); +298 rs = ps.executeQuery(); +299 } catch (SQLException ex) { +300 final String msg = "An unexpected SQL Exception occurred; please see the verbose log for more details."; +301 Logger.getLogger(CveDB.class.getName()).log(Level.SEVERE, msg); +302 Logger.getLogger(CveDB.class.getName()).log(Level.FINE, null, ex); +303 } // can't close the statement in the PS as the resultset is returned, closing PS would close the resultset +304 return rs; +305 } +306 +307 /** +308 * Returns a set of properties. +309 * +310 * @return the properties from the database +311 */ +312 Properties getProperties() { +313 final Properties prop = new Properties(); +314 PreparedStatement ps = null; +315 ResultSet rs = null; +316 try { +317 ps = getConnection().prepareStatement(SELECT_PROPERTIES); +318 rs = ps.executeQuery(); +319 while (rs.next()) { +320 prop.setProperty(rs.getString(1), rs.getString(2)); +321 } +322 } catch (SQLException ex) { +323 final String msg = "An unexpected SQL Exception occurred; please see the verbose log for more details."; +324 Logger.getLogger(CveDB.class.getName()).log(Level.SEVERE, msg); +325 Logger.getLogger(CveDB.class.getName()).log(Level.FINE, null, ex); +326 } finally { +327 DBUtils.closeStatement(ps); +328 DBUtils.closeResultSet(rs); +329 } +330 return prop; +331 } +332 +333 /** +334 * Saves a set of properties to the database. +335 * +336 * @param props a collection of properties +337 */ +338 void saveProperties(Properties props) { +339 PreparedStatement updateProperty = null; +340 PreparedStatement insertProperty = null; +341 try { +342 try { +343 updateProperty = getConnection().prepareStatement(UPDATE_PROPERTY); +344 insertProperty = getConnection().prepareStatement(INSERT_PROPERTY); +345 } catch (SQLException ex) { +346 Logger.getLogger(CveDB.class.getName()).log(Level.WARNING, "Unable to save properties to the database"); +347 Logger.getLogger(CveDB.class.getName()).log(Level.FINE, "Unable to save properties to the database", ex); +348 return; +349 } +350 for (Entry<Object, Object> entry : props.entrySet()) { +351 final String key = entry.getKey().toString(); +352 final String value = entry.getValue().toString(); +353 try { +354 updateProperty.setString(1, value); +355 updateProperty.setString(2, key); +356 if (updateProperty.executeUpdate() == 0) { +357 insertProperty.setString(1, key); +358 insertProperty.setString(2, value); +359 } +360 } catch (SQLException ex) { +361 final String msg = String.format("Unable to save property '%s' with a value of '%s' to the database", key, value); +362 Logger.getLogger(CveDB.class.getName()).log(Level.WARNING, msg); +363 Logger.getLogger(CveDB.class.getName()).log(Level.FINE, null, ex); +364 } +365 } +366 } finally { +367 DBUtils.closeStatement(updateProperty); +368 DBUtils.closeStatement(insertProperty); +369 } +370 } +371 +372 /** +373 * Saves a property to the database. +374 * +375 * @param key the property key +376 * @param value the property value +377 */ +378 void saveProperty(String key, String value) { +379 PreparedStatement updateProperty = null; +380 PreparedStatement insertProperty = null; +381 try { +382 try { +383 updateProperty = getConnection().prepareStatement(UPDATE_PROPERTY); +384 } catch (SQLException ex) { +385 Logger.getLogger(CveDB.class.getName()).log(Level.WARNING, "Unable to save properties to the database"); +386 Logger.getLogger(CveDB.class.getName()).log(Level.FINE, "Unable to save properties to the database", ex); +387 return; +388 } +389 try { +390 updateProperty.setString(1, value); +391 updateProperty.setString(2, key); +392 if (updateProperty.executeUpdate() == 0) { +393 try { +394 insertProperty = getConnection().prepareStatement(INSERT_PROPERTY); +395 } catch (SQLException ex) { +396 Logger.getLogger(CveDB.class.getName()).log(Level.WARNING, "Unable to save properties to the database"); +397 Logger.getLogger(CveDB.class.getName()).log(Level.FINE, "Unable to save properties to the database", ex); +398 return; +399 } +400 insertProperty.setString(1, key); +401 insertProperty.setString(2, value); +402 insertProperty.execute(); +403 } +404 } catch (SQLException ex) { +405 final String msg = String.format("Unable to save property '%s' with a value of '%s' to the database", key, value); +406 Logger.getLogger(CveDB.class.getName()).log(Level.WARNING, msg); +407 Logger.getLogger(CveDB.class.getName()).log(Level.FINE, null, ex); +408 } +409 } finally { +410 DBUtils.closeStatement(updateProperty); +411 DBUtils.closeStatement(insertProperty); +412 } +413 } +414 +415 /** +416 * Retrieves the vulnerabilities associated with the specified CPE. +417 * +418 * @param cpeStr the CPE name +419 * @return a list of Vulnerabilities +420 * @throws DatabaseException thrown if there is an exception retrieving data +421 */ +422 public List<Vulnerability> getVulnerabilities(String cpeStr) throws DatabaseException { +423 ResultSet rs = null; +424 final VulnerableSoftware cpe = new VulnerableSoftware(); +425 try { +426 cpe.parseName(cpeStr); +427 } catch (UnsupportedEncodingException ex) { +428 Logger.getLogger(CveDB.class.getName()).log(Level.FINEST, null, ex); +429 } +430 final DependencyVersion detectedVersion = parseDependencyVersion(cpe); +431 final List<Vulnerability> vulnerabilities = new ArrayList<Vulnerability>(); +432 +433 PreparedStatement ps; +434 final HashSet<String> cveEntries = new HashSet<String>(); +435 try { +436 ps = getConnection().prepareStatement(SELECT_CVE_FROM_SOFTWARE); +437 ps.setString(1, cpe.getVendor()); +438 ps.setString(2, cpe.getProduct()); +439 rs = ps.executeQuery(); +440 while (rs.next()) { +441 final String cveId = rs.getString(1); +442 final String cpeId = rs.getString(2); +443 final String previous = rs.getString(3); +444 if (!cveEntries.contains(cveId) && isAffected(cpe.getVendor(), cpe.getProduct(), detectedVersion, cpeId, previous)) { +445 cveEntries.add(cveId); +446 final Vulnerability v = getVulnerability(cveId); +447 v.setMatchedCPE(cpeId, previous); +448 vulnerabilities.add(v); +449 } +450 } +451 DBUtils.closeResultSet(rs); +452 DBUtils.closeStatement(ps); +453 // for (String cve : cveEntries) { +454 // final Vulnerability v = getVulnerability(cve); +455 // vulnerabilities.add(v); +456 // } +457 +458 } catch (SQLException ex) { +459 throw new DatabaseException("Exception retrieving vulnerability for " + cpeStr, ex); +460 } finally { +461 DBUtils.closeResultSet(rs); +462 } +463 return vulnerabilities; +464 } +465 +466 /** +467 * Gets a vulnerability for the provided CVE. +468 * +469 * @param cve the CVE to lookup +470 * @return a vulnerability object +471 * @throws DatabaseException if an exception occurs +472 */ +473 private Vulnerability getVulnerability(String cve) throws DatabaseException { +474 PreparedStatement psV = null; +475 PreparedStatement psR = null; +476 PreparedStatement psS = null; +477 ResultSet rsV = null; +478 ResultSet rsR = null; +479 ResultSet rsS = null; +480 Vulnerability vuln = null; +481 try { +482 psV = getConnection().prepareStatement(SELECT_VULNERABILITY); +483 psV.setString(1, cve); +484 rsV = psV.executeQuery(); +485 if (rsV.next()) { +486 vuln = new Vulnerability(); +487 vuln.setName(cve); +488 vuln.setDescription(rsV.getString(2)); +489 String cwe = rsV.getString(3); +490 if (cwe != null) { +491 final String name = CweDB.getCweName(cwe); +492 if (name != null) { +493 cwe += " " + name; +494 } +495 } +496 final int cveId = rsV.getInt(1); +497 vuln.setCwe(cwe); +498 vuln.setCvssScore(rsV.getFloat(4)); +499 vuln.setCvssAccessVector(rsV.getString(5)); +500 vuln.setCvssAccessComplexity(rsV.getString(6)); +501 vuln.setCvssAuthentication(rsV.getString(7)); +502 vuln.setCvssConfidentialityImpact(rsV.getString(8)); +503 vuln.setCvssIntegrityImpact(rsV.getString(9)); +504 vuln.setCvssAvailabilityImpact(rsV.getString(10)); +505 +506 psR = getConnection().prepareStatement(SELECT_REFERENCE); +507 psR.setInt(1, cveId); +508 rsR = psR.executeQuery(); +509 while (rsR.next()) { +510 vuln.addReference(rsR.getString(1), rsR.getString(2), rsR.getString(3)); +511 } +512 psS = getConnection().prepareStatement(SELECT_SOFTWARE); +513 psS.setInt(1, cveId); +514 rsS = psS.executeQuery(); +515 while (rsS.next()) { +516 final String cpe = rsS.getString(1); +517 final String prevVersion = rsS.getString(2); +518 if (prevVersion == null) { +519 vuln.addVulnerableSoftware(cpe); +520 } else { +521 vuln.addVulnerableSoftware(cpe, prevVersion); +522 } +523 } +524 } +525 } catch (SQLException ex) { +526 throw new DatabaseException("Error retrieving " + cve, ex); +527 } finally { +528 DBUtils.closeResultSet(rsV); +529 DBUtils.closeResultSet(rsR); +530 DBUtils.closeResultSet(rsS); +531 DBUtils.closeStatement(psV); +532 DBUtils.closeStatement(psR); +533 DBUtils.closeStatement(psS); +534 } +535 return vuln; +536 } +537 +538 /** +539 * Updates the vulnerability within the database. If the vulnerability does not exist it will be added. +540 * +541 * @param vuln the vulnerability to add to the database +542 * @throws DatabaseException is thrown if the database +543 */ +544 public void updateVulnerability(Vulnerability vuln) throws DatabaseException { +545 PreparedStatement selectVulnerabilityId = null; +546 PreparedStatement deleteVulnerability = null; +547 PreparedStatement deleteReferences = null; +548 PreparedStatement deleteSoftware = null; +549 PreparedStatement updateVulnerability = null; +550 PreparedStatement insertVulnerability = null; +551 PreparedStatement insertReference = null; +552 PreparedStatement selectCpeId = null; +553 PreparedStatement insertCpe = null; +554 PreparedStatement insertSoftware = null; +555 +556 try { +557 selectVulnerabilityId = getConnection().prepareStatement(SELECT_VULNERABILITY_ID); +558 deleteVulnerability = getConnection().prepareStatement(DELETE_VULNERABILITY); +559 deleteReferences = getConnection().prepareStatement(DELETE_REFERENCE); +560 deleteSoftware = getConnection().prepareStatement(DELETE_SOFTWARE); +561 updateVulnerability = getConnection().prepareStatement(UPDATE_VULNERABILITY); +562 insertVulnerability = getConnection().prepareStatement(INSERT_VULNERABILITY, Statement.RETURN_GENERATED_KEYS); +563 insertReference = getConnection().prepareStatement(INSERT_REFERENCE); +564 selectCpeId = getConnection().prepareStatement(SELECT_CPE_ID); +565 insertCpe = getConnection().prepareStatement(INSERT_CPE, Statement.RETURN_GENERATED_KEYS); +566 insertSoftware = getConnection().prepareStatement(INSERT_SOFTWARE); +567 int vulnerabilityId = 0; +568 selectVulnerabilityId.setString(1, vuln.getName()); +569 ResultSet rs = selectVulnerabilityId.executeQuery(); +570 if (rs.next()) { +571 vulnerabilityId = rs.getInt(1); +572 // first delete any existing vulnerability info. We don't know what was updated. yes, slower but atm easier. +573 deleteReferences.setInt(1, vulnerabilityId); +574 deleteReferences.execute(); +575 deleteSoftware.setInt(1, vulnerabilityId); +576 deleteSoftware.execute(); +577 } +578 DBUtils.closeResultSet(rs); +579 rs = null; +580 if (vulnerabilityId != 0) { +581 if (vuln.getDescription().contains("** REJECT **")) { +582 deleteVulnerability.setInt(1, vulnerabilityId); +583 deleteVulnerability.executeUpdate(); +584 } else { +585 updateVulnerability.setString(1, vuln.getDescription()); +586 updateVulnerability.setString(2, vuln.getCwe()); +587 updateVulnerability.setFloat(3, vuln.getCvssScore()); +588 updateVulnerability.setString(4, vuln.getCvssAccessVector()); +589 updateVulnerability.setString(5, vuln.getCvssAccessComplexity()); +590 updateVulnerability.setString(6, vuln.getCvssAuthentication()); +591 updateVulnerability.setString(7, vuln.getCvssConfidentialityImpact()); +592 updateVulnerability.setString(8, vuln.getCvssIntegrityImpact()); +593 updateVulnerability.setString(9, vuln.getCvssAvailabilityImpact()); +594 updateVulnerability.setInt(10, vulnerabilityId); +595 updateVulnerability.executeUpdate(); +596 } +597 } else { +598 insertVulnerability.setString(1, vuln.getName()); +599 insertVulnerability.setString(2, vuln.getDescription()); +600 insertVulnerability.setString(3, vuln.getCwe()); +601 insertVulnerability.setFloat(4, vuln.getCvssScore()); +602 insertVulnerability.setString(5, vuln.getCvssAccessVector()); +603 insertVulnerability.setString(6, vuln.getCvssAccessComplexity()); +604 insertVulnerability.setString(7, vuln.getCvssAuthentication()); +605 insertVulnerability.setString(8, vuln.getCvssConfidentialityImpact()); +606 insertVulnerability.setString(9, vuln.getCvssIntegrityImpact()); +607 insertVulnerability.setString(10, vuln.getCvssAvailabilityImpact()); +608 insertVulnerability.execute(); +609 try { +610 rs = insertVulnerability.getGeneratedKeys(); +611 rs.next(); +612 vulnerabilityId = rs.getInt(1); +613 } catch (SQLException ex) { +614 final String msg = String.format("Unable to retrieve id for new vulnerability for '%s'", vuln.getName()); +615 throw new DatabaseException(msg, ex); +616 } finally { +617 DBUtils.closeResultSet(rs); +618 rs = null; +619 } +620 } +621 insertReference.setInt(1, vulnerabilityId); +622 for (Reference r : vuln.getReferences()) { +623 insertReference.setString(2, r.getName()); +624 insertReference.setString(3, r.getUrl()); +625 insertReference.setString(4, r.getSource()); +626 insertReference.execute(); +627 } +628 for (VulnerableSoftware s : vuln.getVulnerableSoftware()) { +629 int cpeProductId = 0; +630 selectCpeId.setString(1, s.getName()); +631 try { +632 rs = selectCpeId.executeQuery(); +633 if (rs.next()) { +634 cpeProductId = rs.getInt(1); +635 } +636 } catch (SQLException ex) { +637 throw new DatabaseException("Unable to get primary key for new cpe: " + s.getName(), ex); +638 } finally { +639 DBUtils.closeResultSet(rs); +640 rs = null; +641 } +642 +643 if (cpeProductId == 0) { +644 insertCpe.setString(1, s.getName()); +645 insertCpe.setString(2, s.getVendor()); +646 insertCpe.setString(3, s.getProduct()); +647 insertCpe.executeUpdate(); +648 cpeProductId = DBUtils.getGeneratedKey(insertCpe); +649 } +650 if (cpeProductId == 0) { +651 throw new DatabaseException("Unable to retrieve cpeProductId - no data returned"); +652 } +653 +654 insertSoftware.setInt(1, vulnerabilityId); +655 insertSoftware.setInt(2, cpeProductId); +656 if (s.getPreviousVersion() == null) { +657 insertSoftware.setNull(3, java.sql.Types.VARCHAR); +658 } else { +659 insertSoftware.setString(3, s.getPreviousVersion()); +660 } +661 insertSoftware.execute(); +662 } +663 +664 } catch (SQLException ex) { +665 final String msg = String.format("Error updating '%s'", vuln.getName()); +666 Logger.getLogger(CveDB.class.getName()).log(Level.FINE, null, ex); +667 throw new DatabaseException(msg, ex); +668 } finally { +669 DBUtils.closeStatement(selectVulnerabilityId); +670 DBUtils.closeStatement(deleteReferences); +671 DBUtils.closeStatement(deleteSoftware); +672 DBUtils.closeStatement(updateVulnerability); +673 DBUtils.closeStatement(deleteVulnerability); +674 DBUtils.closeStatement(insertVulnerability); +675 DBUtils.closeStatement(insertReference); +676 DBUtils.closeStatement(selectCpeId); +677 DBUtils.closeStatement(insertCpe); +678 DBUtils.closeStatement(insertSoftware); +679 } +680 } +681 +682 /** +683 * It is possible that orphaned rows may be generated during database updates. This should be called after all +684 * updates have been completed to ensure orphan entries are removed. +685 */ +686 public void cleanupDatabase() { +687 PreparedStatement ps = null; +688 try { +689 ps = getConnection().prepareStatement(CLEANUP_ORPHANS); +690 if (ps != null) { +691 ps.executeUpdate(); +692 } +693 } catch (SQLException ex) { +694 final String msg = "An unexpected SQL Exception occurred; please see the verbose log for more details."; +695 Logger.getLogger(CveDB.class.getName()).log(Level.SEVERE, msg); +696 Logger.getLogger(CveDB.class.getName()).log(Level.FINE, null, ex); +697 } finally { +698 DBUtils.closeStatement(ps); +699 } +700 } +701 +702 /** +703 * Determines if the given identifiedVersion is affected by the given cpeId and previous version flag. A non-null, +704 * non-empty string passed to the previous version argument indicates that all previous versions are affected. +705 * +706 * @param vendor the vendor of the dependency being analyzed +707 * @param product the product name of the dependency being analyzed +708 * @param identifiedVersion the identified version of the dependency being analyzed +709 * @param cpeId the cpe identifier of software that has a known vulnerability +710 * @param previous a flag indicating if previous versions of the product are vulnerable +711 * @return true if the identified version is affected, otherwise false +712 */ +713 private boolean isAffected(String vendor, String product, DependencyVersion identifiedVersion, String cpeId, String previous) { +714 boolean affected = false; +715 final boolean isStruts = "apache".equals(vendor) && "struts".equals(product); +716 final DependencyVersion v = parseDependencyVersion(cpeId); +717 final boolean prevAffected = previous != null && !previous.isEmpty(); +718 if (identifiedVersion == null || "-".equals(identifiedVersion.toString())) { +719 if (v == null || "-".equals(v.toString())) { +720 affected = true; +721 } +722 } else if (identifiedVersion.equals(v) || (prevAffected && identifiedVersion.compareTo(v) < 0)) { +723 if (isStruts) { //struts 2 vulns don't affect struts 1 +724 if (identifiedVersion.getVersionParts().get(0).equals(v.getVersionParts().get(0))) { +725 affected = true; +726 } +727 } else { +728 affected = true; +729 } +730 } +731 /* +732 * TODO consider utilizing the matchThreeVersion method to get additional results. However, this +733 * might also introduce false positives. +734 */ +735 return affected; +736 } +737 +738 /** +739 * Parses the version (including revision) from a CPE identifier. If no version is identified then a '-' is +740 * returned. +741 * +742 * @param cpeStr a cpe identifier +743 * @return a dependency version +744 */ +745 private DependencyVersion parseDependencyVersion(String cpeStr) { +746 final VulnerableSoftware cpe = new VulnerableSoftware(); +747 try { +748 cpe.parseName(cpeStr); +749 } catch (UnsupportedEncodingException ex) { +750 //never going to happen. +751 Logger.getLogger(CveDB.class.getName()).log(Level.FINEST, null, ex); +752 } +753 return parseDependencyVersion(cpe); +754 } +755 +756 /** +757 * Takes a CPE and parses out the version number. If no version is identified then a '-' is returned. +758 * +759 * @param cpe a cpe object +760 * @return a dependency version +761 */ +762 private DependencyVersion parseDependencyVersion(VulnerableSoftware cpe) { +763 DependencyVersion cpeVersion; +764 if (cpe.getVersion() != null && cpe.getVersion().length() > 0) { +765 String versionText; +766 if (cpe.getRevision() != null && cpe.getRevision().length() > 0) { +767 versionText = String.format("%s.%s", cpe.getVersion(), cpe.getRevision()); +768 } else { +769 versionText = cpe.getVersion(); +770 } +771 cpeVersion = DependencyVersionUtil.parseVersion(versionText); +772 } else { +773 cpeVersion = new DependencyVersion("-"); +774 } +775 return cpeVersion; +776 } +777 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/nvdcve/DatabaseException.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/nvdcve/DatabaseException.html index 11fa2f17b..0d866a99b 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/nvdcve/DatabaseException.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/nvdcve/DatabaseException.html @@ -9,63 +9,62 @@ 1 /* 2 * This file is part of dependency-check-core. 3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. -18 */ -19 package org.owasp.dependencycheck.data.nvdcve; -20 -21 /** -22 * An exception thrown if an operation against the database fails. -23 * -24 * @author Jeremy Long <jeremy.long@owasp.org> -25 */ -26 public class DatabaseException extends Exception { -27 -28 /** -29 * the serial version uid. -30 */ -31 private static final long serialVersionUID = 1L; -32 -33 /** -34 * Creates an DatabaseException. -35 * -36 * @param msg the exception message -37 */ -38 public DatabaseException(String msg) { -39 super(msg); -40 } -41 -42 /** -43 * Creates an DatabaseException. -44 * -45 * @param ex the cause of the exception -46 */ -47 public DatabaseException(Throwable ex) { -48 super(ex); -49 } -50 -51 /** -52 * Creates an DatabaseException. -53 * -54 * @param msg the exception message -55 * @param ex the cause of the exception -56 */ -57 public DatabaseException(String msg, Throwable ex) { -58 super(msg, ex); -59 } -60 } +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. +17 */ +18 package org.owasp.dependencycheck.data.nvdcve; +19 +20 /** +21 * An exception thrown if an operation against the database fails. +22 * +23 * @author Jeremy Long <jeremy.long@owasp.org> +24 */ +25 public class DatabaseException extends Exception { +26 +27 /** +28 * the serial version uid. +29 */ +30 private static final long serialVersionUID = 1L; +31 +32 /** +33 * Creates an DatabaseException. +34 * +35 * @param msg the exception message +36 */ +37 public DatabaseException(String msg) { +38 super(msg); +39 } +40 +41 /** +42 * Creates an DatabaseException. +43 * +44 * @param ex the cause of the exception +45 */ +46 public DatabaseException(Throwable ex) { +47 super(ex); +48 } +49 +50 /** +51 * Creates an DatabaseException. +52 * +53 * @param msg the exception message +54 * @param ex the cause of the exception +55 */ +56 public DatabaseException(String msg, Throwable ex) { +57 super(msg, ex); +58 } +59 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/nvdcve/DatabaseProperties.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/nvdcve/DatabaseProperties.html index cb5731bc1..70c67924c 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/nvdcve/DatabaseProperties.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/nvdcve/DatabaseProperties.html @@ -9,123 +9,167 @@ 1 /* 2 * This file is part of dependency-check-core. 3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2013 Jeremy Long. All Rights Reserved. -18 */ -19 package org.owasp.dependencycheck.data.nvdcve; -20 -21 import java.util.Properties; -22 import org.owasp.dependencycheck.data.update.exception.UpdateException; -23 import org.owasp.dependencycheck.data.update.NvdCveInfo; -24 -25 /** -26 * This is a wrapper around a set of properties that are stored in the database. -27 * -28 * @author Jeremy Long <jeremy.long@owasp.org> -29 */ -30 public class DatabaseProperties { +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2013 Jeremy Long. All Rights Reserved. +17 */ +18 package org.owasp.dependencycheck.data.nvdcve; +19 +20 import com.hazelcast.logging.Logger; +21 import java.text.DateFormat; +22 import java.text.SimpleDateFormat; +23 import java.util.Date; +24 import java.util.Map; +25 import java.util.Map.Entry; +26 import java.util.Properties; +27 import java.util.TreeMap; +28 import java.util.logging.Level; +29 import org.owasp.dependencycheck.data.update.NvdCveInfo; +30 import org.owasp.dependencycheck.data.update.exception.UpdateException; 31 -32 /** -33 * Modified key word, used as a key to store information about the modified -34 * file (i.e. the containing the last 8 days of updates).. -35 */ -36 public static final String MODIFIED = "modified"; -37 /** -38 * The properties file key for the last updated field - used to store the -39 * last updated time of the Modified NVD CVE xml file. -40 */ -41 public static final String LAST_UPDATED = "lastupdated.modified"; -42 /** -43 * Stores the last updated time for each of the NVD CVE files. These -44 * timestamps should be updated if we process the modified file within 7 -45 * days of the last update. -46 */ -47 public static final String LAST_UPDATED_BASE = "lastupdated."; -48 /** -49 * A collection of properties about the data. -50 */ -51 private Properties properties; -52 /** -53 * A reference to the database. -54 */ -55 private CveDB cveDB; -56 -57 /** -58 * Constructs a new data properties object. -59 * -60 * @param cveDB the database object holding the properties -61 */ -62 DatabaseProperties(CveDB cveDB) { -63 this.cveDB = cveDB; -64 loadProperties(); -65 } -66 -67 /** -68 * Loads the properties from the database. -69 */ -70 private void loadProperties() { -71 this.properties = cveDB.getProperties(); -72 } -73 -74 /** -75 * Returns whether or not any properties are set. -76 * -77 * @return whether or not any properties are set -78 */ -79 public boolean isEmpty() { -80 return properties == null || properties.isEmpty(); -81 } -82 -83 /** -84 * Writes a properties file containing the last updated date to the -85 * VULNERABLE_CPE directory. -86 * -87 * @param updatedValue the updated NVD CVE entry -88 * @throws UpdateException is thrown if there is an update exception -89 */ -90 public void save(NvdCveInfo updatedValue) throws UpdateException { -91 if (updatedValue == null) { -92 return; -93 } -94 properties.put(LAST_UPDATED_BASE + updatedValue.getId(), String.valueOf(updatedValue.getTimestamp())); -95 cveDB.saveProperty(LAST_UPDATED_BASE + updatedValue.getId(), String.valueOf(updatedValue.getTimestamp())); -96 } -97 -98 /** -99 * Returns the property value for the given key. If the key is not contained -100 * in the underlying properties null is returned. -101 * -102 * @param key the property key -103 * @return the value of the property -104 */ -105 public String getProperty(String key) { -106 return properties.getProperty(key); -107 } -108 -109 /** -110 * Returns the property value for the given key. If the key is not contained -111 * in the underlying properties the default value is returned. -112 * -113 * @param key the property key -114 * @param defaultValue the default value -115 * @return the value of the property -116 */ -117 public String getProperty(String key, String defaultValue) { -118 return properties.getProperty(key, defaultValue); -119 } -120 } +32 /** +33 * This is a wrapper around a set of properties that are stored in the database. +34 * +35 * @author Jeremy Long <jeremy.long@owasp.org> +36 */ +37 public class DatabaseProperties { +38 +39 /** +40 * Modified key word, used as a key to store information about the modified file (i.e. the containing the last 8 +41 * days of updates).. +42 */ +43 public static final String MODIFIED = "Modified"; +44 /** +45 * The properties file key for the last updated field - used to store the last updated time of the Modified NVD CVE +46 * xml file. +47 */ +48 public static final String LAST_UPDATED = "NVD CVE Modified"; +49 /** +50 * Stores the last updated time for each of the NVD CVE files. These timestamps should be updated if we process the +51 * modified file within 7 days of the last update. +52 */ +53 public static final String LAST_UPDATED_BASE = "NVD CVE "; +54 /** +55 * A collection of properties about the data. +56 */ +57 private Properties properties; +58 /** +59 * A reference to the database. +60 */ +61 private CveDB cveDB; +62 +63 /** +64 * Constructs a new data properties object. +65 * +66 * @param cveDB the database object holding the properties +67 */ +68 DatabaseProperties(CveDB cveDB) { +69 this.cveDB = cveDB; +70 loadProperties(); +71 } +72 +73 /** +74 * Loads the properties from the database. +75 */ +76 private void loadProperties() { +77 this.properties = cveDB.getProperties(); +78 } +79 +80 /** +81 * Returns whether or not any properties are set. +82 * +83 * @return whether or not any properties are set +84 */ +85 public boolean isEmpty() { +86 return properties == null || properties.isEmpty(); +87 } +88 +89 /** +90 * Writes a properties file containing the last updated date to the VULNERABLE_CPE directory. +91 * +92 * @param updatedValue the updated NVD CVE entry +93 * @throws UpdateException is thrown if there is an update exception +94 */ +95 public void save(NvdCveInfo updatedValue) throws UpdateException { +96 if (updatedValue == null) { +97 return; +98 } +99 properties.put(LAST_UPDATED_BASE + updatedValue.getId(), String.valueOf(updatedValue.getTimestamp())); +100 cveDB.saveProperty(LAST_UPDATED_BASE + updatedValue.getId(), String.valueOf(updatedValue.getTimestamp())); +101 } +102 +103 /** +104 * Returns the property value for the given key. If the key is not contained in the underlying properties null is +105 * returned. +106 * +107 * @param key the property key +108 * @return the value of the property +109 */ +110 public String getProperty(String key) { +111 return properties.getProperty(key); +112 } +113 +114 /** +115 * Returns the property value for the given key. If the key is not contained in the underlying properties the +116 * default value is returned. +117 * +118 * @param key the property key +119 * @param defaultValue the default value +120 * @return the value of the property +121 */ +122 public String getProperty(String key, String defaultValue) { +123 return properties.getProperty(key, defaultValue); +124 } +125 +126 /** +127 * Returns the collection of Database Properties as a properties collection. +128 * +129 * @return the collection of Database Properties +130 */ +131 public Properties getProperties() { +132 return properties; +133 } +134 +135 /** +136 * Returns a map of the meta data from the database properties. This primarily contains timestamps of when the NVD +137 * CVE information was last updated. +138 * +139 * @return a map of the database meta data +140 */ +141 public Map getMetaData() { +142 final TreeMap map = new TreeMap(); +143 for (Entry<Object, Object> entry : properties.entrySet()) { +144 final String key = (String) entry.getKey(); +145 if (!"version".equals(key)) { +146 if (key.startsWith("NVD CVE ")) { +147 try { +148 final long epoch = Long.parseLong((String) entry.getValue()); +149 final Date date = new Date(epoch); +150 final DateFormat format = new SimpleDateFormat("dd/MM/yyyy HH:mm:ss"); +151 final String formatted = format.format(date); +152 map.put(key, formatted); +153 } catch (Throwable ex) { //deliberatly being broad in this catch clause +154 Logger.getLogger(DatabaseProperties.class.getName()).log(Level.FINE, "Unable to parse timestamp from DB", ex); +155 map.put(key, entry.getValue()); +156 } +157 } else { +158 map.put(key, entry.getValue()); +159 } +160 } +161 } +162 return map; +163 } +164 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/nvdcve/DriverLoadException.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/nvdcve/DriverLoadException.html index ea683bd1b..f0697d391 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/nvdcve/DriverLoadException.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/nvdcve/DriverLoadException.html @@ -9,63 +9,62 @@ 1 /* 2 * This file is part of dependency-check-core. 3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2014 Jeremy Long. All Rights Reserved. -18 */ -19 package org.owasp.dependencycheck.data.nvdcve; -20 -21 /** -22 * An exception thrown the database driver is unable to be loaded. -23 * -24 * @author Jeremy Long <jeremy.long@owasp.org> -25 */ -26 public class DriverLoadException extends Exception { -27 -28 /** -29 * the serial version uid. -30 */ -31 private static final long serialVersionUID = 1L; -32 -33 /** -34 * Creates an DriverLoadException. -35 * -36 * @param msg the exception message -37 */ -38 public DriverLoadException(String msg) { -39 super(msg); -40 } -41 -42 /** -43 * Creates an DriverLoadException. -44 * -45 * @param ex the cause of the exception -46 */ -47 public DriverLoadException(Throwable ex) { -48 super(ex); -49 } -50 -51 /** -52 * Creates an DriverLoadException. -53 * -54 * @param msg the exception message -55 * @param ex the cause of the exception -56 */ -57 public DriverLoadException(String msg, Throwable ex) { -58 super(msg, ex); -59 } -60 } +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2014 Jeremy Long. All Rights Reserved. +17 */ +18 package org.owasp.dependencycheck.data.nvdcve; +19 +20 /** +21 * An exception thrown the database driver is unable to be loaded. +22 * +23 * @author Jeremy Long <jeremy.long@owasp.org> +24 */ +25 public class DriverLoadException extends Exception { +26 +27 /** +28 * the serial version uid. +29 */ +30 private static final long serialVersionUID = 1L; +31 +32 /** +33 * Creates an DriverLoadException. +34 * +35 * @param msg the exception message +36 */ +37 public DriverLoadException(String msg) { +38 super(msg); +39 } +40 +41 /** +42 * Creates an DriverLoadException. +43 * +44 * @param ex the cause of the exception +45 */ +46 public DriverLoadException(Throwable ex) { +47 super(ex); +48 } +49 +50 /** +51 * Creates an DriverLoadException. +52 * +53 * @param msg the exception message +54 * @param ex the cause of the exception +55 */ +56 public DriverLoadException(String msg, Throwable ex) { +57 super(msg, ex); +58 } +59 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/nvdcve/DriverLoader.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/nvdcve/DriverLoader.html index 8e6d8a917..0b3030767 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/nvdcve/DriverLoader.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/nvdcve/DriverLoader.html @@ -9,122 +9,122 @@ 1 /* 2 * This file is part of dependency-check-core. 3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2014 Jeremy Long. All Rights Reserved. -18 */ -19 package org.owasp.dependencycheck.data.nvdcve; -20 -21 import java.io.File; -22 import java.net.MalformedURLException; -23 import java.net.URL; -24 import java.net.URLClassLoader; -25 import java.security.AccessController; -26 import java.security.PrivilegedAction; -27 import java.sql.Driver; -28 import java.sql.DriverManager; -29 import java.sql.SQLException; -30 import java.util.ArrayList; -31 import java.util.logging.Level; -32 import java.util.logging.Logger; -33 -34 /** -35 * DriverLoader is a utility class that is used to load database drivers. -36 * -37 * @author Jeremy Long <jeremy.long@owasp.org> -38 */ -39 public final class DriverLoader { -40 -41 /** -42 * Private constructor for a utility class. -43 */ -44 private DriverLoader() { -45 } -46 -47 /** -48 * Loads the specified class using the system class loader and registers the driver with the driver manager. -49 * -50 * @param className the fully qualified name of the desired class -51 * @throws DriverLoadException thrown if the driver cannot be loaded -52 */ -53 public static void load(String className) throws DriverLoadException { -54 final ClassLoader loader = ClassLoader.getSystemClassLoader(); -55 load(className, loader); -56 } -57 -58 /** -59 * Loads the specified class by registering the supplied paths to the class loader and then registers the driver -60 * with the driver manager. The pathToDriver argument is added to the class loader so that an external driver can be -61 * loaded. Note, the pathTodriver can contain a semi-colon separated list of paths so any dependencies can be added -62 * as needed. If a path in the pathToDriver argument is a directory all files in the directory are added to the -63 * class path. -64 * -65 * @param className the fully qualified name of the desired class -66 * @param pathToDriver the path to the JAR file containing the driver; note, this can be a semi-colon separated list -67 * of paths -68 * @throws DriverLoadException thrown if the driver cannot be loaded -69 */ -70 public static void load(String className, String pathToDriver) throws DriverLoadException { -71 final URLClassLoader parent = (URLClassLoader) ClassLoader.getSystemClassLoader(); -72 final ArrayList<URL> urls = new ArrayList<URL>(); -73 final String[] paths = pathToDriver.split(File.pathSeparator); -74 for (String path : paths) { -75 final File file = new File(path); -76 if (file.isDirectory()) { -77 final File[] files = file.listFiles(); -78 -79 for (File f : files) { -80 try { -81 urls.add(f.toURI().toURL()); -82 } catch (MalformedURLException ex) { -83 final String msg = String.format("Unable to load database driver '%s'; invalid path provided '%s'", -84 className, f.getAbsoluteFile()); -85 Logger.getLogger(DriverLoader.class.getName()).log(Level.FINE, msg, ex); -86 throw new DriverLoadException(msg, ex); -87 } -88 } -89 } else if (file.exists()) { -90 try { -91 urls.add(file.toURI().toURL()); -92 } catch (MalformedURLException ex) { -93 final String msg = String.format("Unable to load database driver '%s'; invalid path provided '%s'", -94 className, file.getAbsoluteFile()); -95 Logger.getLogger(DriverLoader.class.getName()).log(Level.FINE, msg, ex); -96 throw new DriverLoadException(msg, ex); -97 } -98 } -99 } -100 final URLClassLoader loader = AccessController.doPrivileged(new PrivilegedAction<URLClassLoader>() { -101 @Override -102 public URLClassLoader run() { -103 return new URLClassLoader(urls.toArray(new URL[urls.size()]), parent); -104 } -105 }); -106 -107 load(className, loader); -108 } -109 -110 /** -111 * Loads the specified class using the supplied class loader and registers the driver with the driver manager. -112 * -113 * @param className the fully qualified name of the desired class -114 * @param loader the class loader to use when loading the driver -115 * @throws DriverLoadException thrown if the driver cannot be loaded -116 */ -117 private static void load(String className, ClassLoader loader) throws DriverLoadException { -118 try { -119 final Class c = loader.loadClass(className); +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2014 Jeremy Long. All Rights Reserved. +17 */ +18 package org.owasp.dependencycheck.data.nvdcve; +19 +20 import java.io.File; +21 import java.net.MalformedURLException; +22 import java.net.URL; +23 import java.net.URLClassLoader; +24 import java.security.AccessController; +25 import java.security.PrivilegedAction; +26 import java.sql.Driver; +27 import java.sql.DriverManager; +28 import java.sql.SQLException; +29 import java.util.ArrayList; +30 import java.util.logging.Level; +31 import java.util.logging.Logger; +32 +33 /** +34 * DriverLoader is a utility class that is used to load database drivers. +35 * +36 * @author Jeremy Long <jeremy.long@owasp.org> +37 */ +38 public final class DriverLoader { +39 +40 /** +41 * Private constructor for a utility class. +42 */ +43 private DriverLoader() { +44 } +45 +46 /** +47 * Loads the specified class using the system class loader and registers the driver with the driver manager. +48 * +49 * @param className the fully qualified name of the desired class +50 * @throws DriverLoadException thrown if the driver cannot be loaded +51 */ +52 public static void load(String className) throws DriverLoadException { +53 final ClassLoader loader = DriverLoader.class.getClassLoader(); //ClassLoader.getSystemClassLoader(); +54 load(className, loader); +55 } +56 +57 /** +58 * Loads the specified class by registering the supplied paths to the class loader and then registers the driver +59 * with the driver manager. The pathToDriver argument is added to the class loader so that an external driver can be +60 * loaded. Note, the pathTodriver can contain a semi-colon separated list of paths so any dependencies can be added +61 * as needed. If a path in the pathToDriver argument is a directory all files in the directory are added to the +62 * class path. +63 * +64 * @param className the fully qualified name of the desired class +65 * @param pathToDriver the path to the JAR file containing the driver; note, this can be a semi-colon separated list +66 * of paths +67 * @throws DriverLoadException thrown if the driver cannot be loaded +68 */ +69 public static void load(String className, String pathToDriver) throws DriverLoadException { +70 final URLClassLoader parent = (URLClassLoader) ClassLoader.getSystemClassLoader(); +71 final ArrayList<URL> urls = new ArrayList<URL>(); +72 final String[] paths = pathToDriver.split(File.pathSeparator); +73 for (String path : paths) { +74 final File file = new File(path); +75 if (file.isDirectory()) { +76 final File[] files = file.listFiles(); +77 +78 for (File f : files) { +79 try { +80 urls.add(f.toURI().toURL()); +81 } catch (MalformedURLException ex) { +82 final String msg = String.format("Unable to load database driver '%s'; invalid path provided '%s'", +83 className, f.getAbsoluteFile()); +84 Logger.getLogger(DriverLoader.class.getName()).log(Level.FINE, msg, ex); +85 throw new DriverLoadException(msg, ex); +86 } +87 } +88 } else if (file.exists()) { +89 try { +90 urls.add(file.toURI().toURL()); +91 } catch (MalformedURLException ex) { +92 final String msg = String.format("Unable to load database driver '%s'; invalid path provided '%s'", +93 className, file.getAbsoluteFile()); +94 Logger.getLogger(DriverLoader.class.getName()).log(Level.FINE, msg, ex); +95 throw new DriverLoadException(msg, ex); +96 } +97 } +98 } +99 final URLClassLoader loader = AccessController.doPrivileged(new PrivilegedAction<URLClassLoader>() { +100 @Override +101 public URLClassLoader run() { +102 return new URLClassLoader(urls.toArray(new URL[urls.size()]), parent); +103 } +104 }); +105 +106 load(className, loader); +107 } +108 +109 /** +110 * Loads the specified class using the supplied class loader and registers the driver with the driver manager. +111 * +112 * @param className the fully qualified name of the desired class +113 * @param loader the class loader to use when loading the driver +114 * @throws DriverLoadException thrown if the driver cannot be loaded +115 */ +116 private static void load(String className, ClassLoader loader) throws DriverLoadException { +117 try { +118 final Class c = Class.forName(className, true, loader); +119 //final Class c = loader.loadClass(className); 120 final Driver driver = (Driver) c.newInstance(); 121 //using the DriverShim to get around the fact that the DriverManager won't register a driver not in the base class path 122 DriverManager.registerDriver(new DriverShim(driver)); diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/nvdcve/DriverShim.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/nvdcve/DriverShim.html index 8f70d42c2..470fe9969 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/nvdcve/DriverShim.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/nvdcve/DriverShim.html @@ -9,183 +9,182 @@ 1 /* 2 * This file is part of dependency-check-core. 3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2014 Jeremy Long. All Rights Reserved. -18 */ -19 package org.owasp.dependencycheck.data.nvdcve; -20 -21 import java.sql.Connection; -22 import java.sql.Driver; -23 import java.sql.DriverPropertyInfo; -24 import java.sql.SQLException; -25 import java.sql.SQLFeatureNotSupportedException; -26 import java.util.Properties; -27 import java.util.logging.Logger; -28 -29 /** -30 * <p> -31 * Driver shim to get around the class loader issue with the DriverManager. The following code is a nearly identical -32 * copy (with more comments and a few more methods implemented) of the DriverShim from:</p> -33 * <blockquote>http://www.kfu.com/~nsayer/Java/dyn-jdbc.html</blockquote>; -34 * -35 * @author Jeremy Long <jeremy.long@owasp.org> -36 * @see java.sql.Driver -37 */ -38 class DriverShim implements Driver { -39 -40 /** -41 * The database driver being wrapped. -42 */ -43 private final Driver driver; -44 -45 /** -46 * Constructs a new wrapper around a Driver. -47 * -48 * @param driver the database driver to wrap -49 */ -50 DriverShim(Driver driver) { -51 this.driver = driver; -52 } -53 -54 /** -55 * Wraps the underlying driver's call to acceptsURL. Returns whether or not the driver can open a connection to the -56 * given URL. -57 * -58 * @param url the URL of the database -59 * @return true if the wrapped driver can connect to the specified URL -60 * @throws SQLException thrown if there is an error connecting to the database -61 * @see java.sql.Driver#acceptsURL(java.lang.String) -62 */ -63 @Override -64 public boolean acceptsURL(String url) throws SQLException { -65 return this.driver.acceptsURL(url); -66 } -67 -68 /** -69 * Returns the wrapped driver's major version number. -70 * -71 * @return the wrapped driver's major version number -72 * @see java.sql.Driver#getMajorVersion() -73 */ -74 @Override -75 public int getMajorVersion() { -76 return this.driver.getMajorVersion(); -77 } -78 -79 /** -80 * Returns the wrapped driver's minor version number. -81 * -82 * @return the wrapped driver's minor version number -83 * @see java.sql.Driver#getMinorVersion() -84 */ -85 @Override -86 public int getMinorVersion() { -87 return this.driver.getMinorVersion(); -88 } -89 -90 /** -91 * Returns whether or not the wrapped driver is jdbcCompliant. -92 * -93 * @return true if the wrapped driver is JDBC compliant; otherwise false -94 * @see java.sql.Driver#jdbcCompliant() -95 */ -96 @Override -97 public boolean jdbcCompliant() { -98 return this.driver.jdbcCompliant(); -99 } -100 -101 /** -102 * Wraps the call to the underlying driver's connect method. -103 * -104 * @param url the URL of the database -105 * @param info a collection of string/value pairs -106 * @return a Connection object -107 * @throws SQLException thrown if there is an error connecting to the database -108 * @see java.sql.Driver#connect(java.lang.String, java.util.Properties) -109 */ -110 @Override -111 public Connection connect(String url, Properties info) throws SQLException { -112 return this.driver.connect(url, info); -113 } -114 -115 /** -116 * Wraps the call to the underlying driver's getPropertyInfo method. -117 * -118 * @param url the URL of the database -119 * @param info a collection of string/value pairs -120 * @return an array of DriverPropertyInfo objects -121 * @throws SQLException thrown if there is an error accessing the database -122 * @see java.sql.Driver#getPropertyInfo(java.lang.String, java.util.Properties) -123 */ -124 @Override -125 public DriverPropertyInfo[] getPropertyInfo(String url, Properties info) throws SQLException { -126 return this.driver.getPropertyInfo(url, info); -127 } -128 -129 /** -130 * Wraps the call to the underlying driver's getParentLogger method. -131 * -132 * @return the parent's Logger -133 * @throws SQLFeatureNotSupportedException thrown if the feature is not supported -134 * @see java.sql.Driver#getParentLogger() -135 */ -136 @Override -137 public Logger getParentLogger() throws SQLFeatureNotSupportedException { -138 return this.driver.getParentLogger(); -139 } -140 -141 /** -142 * Standard implementation of hashCode. -143 * -144 * @return the hashCode of the object -145 */ -146 @Override -147 public int hashCode() { -148 int hash = 7; -149 hash = 97 * hash + (this.driver != null ? this.driver.hashCode() : 0); -150 return hash; -151 } -152 -153 /** -154 * Standard implementation of equals. -155 * -156 * @param obj the object to compare -157 * @return returns true if the objects are equal; otherwise false -158 */ -159 @Override -160 public boolean equals(Object obj) { -161 if (obj == null) { -162 return false; -163 } -164 if (getClass() != obj.getClass()) { -165 return false; -166 } -167 final DriverShim other = (DriverShim) obj; -168 return this.driver == other.driver || (this.driver != null && this.driver.equals(other.driver)); -169 } -170 -171 /** -172 * Standard implementation of toString(). -173 * -174 * @return the String representation of the object -175 */ -176 @Override -177 public String toString() { -178 return "DriverShim{" + "driver=" + driver + '}'; -179 } -180 } +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2014 Jeremy Long. All Rights Reserved. +17 */ +18 package org.owasp.dependencycheck.data.nvdcve; +19 +20 import java.sql.Connection; +21 import java.sql.Driver; +22 import java.sql.DriverPropertyInfo; +23 import java.sql.SQLException; +24 import java.sql.SQLFeatureNotSupportedException; +25 import java.util.Properties; +26 import java.util.logging.Logger; +27 +28 /** +29 * <p> +30 * Driver shim to get around the class loader issue with the DriverManager. The following code is a nearly identical +31 * copy (with more comments and a few more methods implemented) of the DriverShim from:</p> +32 * <blockquote>http://www.kfu.com/~nsayer/Java/dyn-jdbc.html</blockquote>; +33 * +34 * @author Jeremy Long <jeremy.long@owasp.org> +35 * @see java.sql.Driver +36 */ +37 class DriverShim implements Driver { +38 +39 /** +40 * The database driver being wrapped. +41 */ +42 private final Driver driver; +43 +44 /** +45 * Constructs a new wrapper around a Driver. +46 * +47 * @param driver the database driver to wrap +48 */ +49 DriverShim(Driver driver) { +50 this.driver = driver; +51 } +52 +53 /** +54 * Wraps the underlying driver's call to acceptsURL. Returns whether or not the driver can open a connection to the +55 * given URL. +56 * +57 * @param url the URL of the database +58 * @return true if the wrapped driver can connect to the specified URL +59 * @throws SQLException thrown if there is an error connecting to the database +60 * @see java.sql.Driver#acceptsURL(java.lang.String) +61 */ +62 @Override +63 public boolean acceptsURL(String url) throws SQLException { +64 return this.driver.acceptsURL(url); +65 } +66 +67 /** +68 * Returns the wrapped driver's major version number. +69 * +70 * @return the wrapped driver's major version number +71 * @see java.sql.Driver#getMajorVersion() +72 */ +73 @Override +74 public int getMajorVersion() { +75 return this.driver.getMajorVersion(); +76 } +77 +78 /** +79 * Returns the wrapped driver's minor version number. +80 * +81 * @return the wrapped driver's minor version number +82 * @see java.sql.Driver#getMinorVersion() +83 */ +84 @Override +85 public int getMinorVersion() { +86 return this.driver.getMinorVersion(); +87 } +88 +89 /** +90 * Returns whether or not the wrapped driver is jdbcCompliant. +91 * +92 * @return true if the wrapped driver is JDBC compliant; otherwise false +93 * @see java.sql.Driver#jdbcCompliant() +94 */ +95 @Override +96 public boolean jdbcCompliant() { +97 return this.driver.jdbcCompliant(); +98 } +99 +100 /** +101 * Wraps the call to the underlying driver's connect method. +102 * +103 * @param url the URL of the database +104 * @param info a collection of string/value pairs +105 * @return a Connection object +106 * @throws SQLException thrown if there is an error connecting to the database +107 * @see java.sql.Driver#connect(java.lang.String, java.util.Properties) +108 */ +109 @Override +110 public Connection connect(String url, Properties info) throws SQLException { +111 return this.driver.connect(url, info); +112 } +113 +114 /** +115 * Wraps the call to the underlying driver's getPropertyInfo method. +116 * +117 * @param url the URL of the database +118 * @param info a collection of string/value pairs +119 * @return an array of DriverPropertyInfo objects +120 * @throws SQLException thrown if there is an error accessing the database +121 * @see java.sql.Driver#getPropertyInfo(java.lang.String, java.util.Properties) +122 */ +123 @Override +124 public DriverPropertyInfo[] getPropertyInfo(String url, Properties info) throws SQLException { +125 return this.driver.getPropertyInfo(url, info); +126 } +127 +128 /** +129 * Wraps the call to the underlying driver's getParentLogger method. +130 * +131 * @return the parent's Logger +132 * @throws SQLFeatureNotSupportedException thrown if the feature is not supported +133 * @see java.sql.Driver#getParentLogger() +134 */ +135 @Override +136 public Logger getParentLogger() throws SQLFeatureNotSupportedException { +137 return this.driver.getParentLogger(); +138 } +139 +140 /** +141 * Standard implementation of hashCode. +142 * +143 * @return the hashCode of the object +144 */ +145 @Override +146 public int hashCode() { +147 int hash = 7; +148 hash = 97 * hash + (this.driver != null ? this.driver.hashCode() : 0); +149 return hash; +150 } +151 +152 /** +153 * Standard implementation of equals. +154 * +155 * @param obj the object to compare +156 * @return returns true if the objects are equal; otherwise false +157 */ +158 @Override +159 public boolean equals(Object obj) { +160 if (obj == null) { +161 return false; +162 } +163 if (getClass() != obj.getClass()) { +164 return false; +165 } +166 final DriverShim other = (DriverShim) obj; +167 return this.driver == other.driver || (this.driver != null && this.driver.equals(other.driver)); +168 } +169 +170 /** +171 * Standard implementation of toString(). +172 * +173 * @return the String representation of the object +174 */ +175 @Override +176 public String toString() { +177 return "DriverShim{" + "driver=" + driver + '}'; +178 } +179 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/nvdcve/package-frame.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/nvdcve/package-frame.html index 178342811..bb402b0af 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/nvdcve/package-frame.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/nvdcve/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.0.8 Reference Package org.owasp.dependencycheck.data.nvdcve + Dependency-Check Core 1.1.0 Reference Package org.owasp.dependencycheck.data.nvdcve diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/nvdcve/package-summary.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/nvdcve/package-summary.html index 4b751e1db..3546b2e09 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/nvdcve/package-summary.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/nvdcve/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.0.8 Reference Package org.owasp.dependencycheck.data.nvdcve + Dependency-Check Core 1.1.0 Reference Package org.owasp.dependencycheck.data.nvdcve diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/update/CachedWebDataSource.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/update/CachedWebDataSource.html index 40cd22399..14b368173 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/update/CachedWebDataSource.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/update/CachedWebDataSource.html @@ -9,43 +9,40 @@ 1 /* 2 * This file is part of dependency-check-core. 3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. -18 */ -19 package org.owasp.dependencycheck.data.update; -20 -21 import org.owasp.dependencycheck.data.update.exception.UpdateException; -22 -23 /** -24 * Defines a data source who's data is retrieved from the Internet. This data -25 * can be downloaded and the local cache updated. -26 * -27 * @author Jeremy Long <jeremy.long@owasp.org> -28 */ -29 public interface CachedWebDataSource { -30 -31 /** -32 * Determines if an update to the current data store is needed, if it is the -33 * new data is downloaded from the Internet and imported into the current -34 * cached data store. -35 * -36 * @throws UpdateException is thrown if there is an exception downloading -37 * the data or updating the data store. -38 */ -39 void update() throws UpdateException; -40 } +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. +17 */ +18 package org.owasp.dependencycheck.data.update; +19 +20 import org.owasp.dependencycheck.data.update.exception.UpdateException; +21 +22 /** +23 * Defines a data source who's data is retrieved from the Internet. This data can be downloaded and the local cache +24 * updated. +25 * +26 * @author Jeremy Long <jeremy.long@owasp.org> +27 */ +28 public interface CachedWebDataSource { +29 +30 /** +31 * Determines if an update to the current data store is needed, if it is the new data is downloaded from the +32 * Internet and imported into the current cached data store. +33 * +34 * @throws UpdateException is thrown if there is an exception downloading the data or updating the data store. +35 */ +36 void update() throws UpdateException; +37 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/update/NvdCveInfo.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/update/NvdCveInfo.html index 8342a834b..ef91b25a0 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/update/NvdCveInfo.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/update/NvdCveInfo.html @@ -9,141 +9,140 @@ 1 /* 2 * This file is part of dependency-check-core. 3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2013 Jeremy Long. All Rights Reserved. -18 */ -19 package org.owasp.dependencycheck.data.update; -20 -21 /** -22 * A pojo that contains the Url and timestamp of the current NvdCve XML files. -23 * -24 * @author Jeremy Long <jeremy.long@owasp.org> -25 */ -26 public class NvdCveInfo { -27 -28 /** -29 * an id. -30 */ -31 private String id; -32 -33 /** -34 * Get the value of id. -35 * -36 * @return the value of id -37 */ -38 public String getId() { -39 return id; -40 } -41 -42 /** -43 * Set the value of id. -44 * -45 * @param id new value of id -46 */ -47 public void setId(String id) { -48 this.id = id; -49 } -50 /** -51 * a url. -52 */ -53 private String url; -54 -55 /** -56 * Get the value of url. -57 * -58 * @return the value of url -59 */ -60 public String getUrl() { -61 return url; -62 } -63 -64 /** -65 * Set the value of url. -66 * -67 * @param url new value of url -68 */ -69 public void setUrl(String url) { -70 this.url = url; -71 } -72 /** -73 * The 1.2 schema URL. -74 */ -75 private String oldSchemaVersionUrl; -76 -77 /** -78 * Get the value of oldSchemaVersionUrl. -79 * -80 * @return the value of oldSchemaVersionUrl -81 */ -82 public String getOldSchemaVersionUrl() { -83 return oldSchemaVersionUrl; -84 } -85 -86 /** -87 * Set the value of oldSchemaVersionUrl. -88 * -89 * @param oldSchemaVersionUrl new value of oldSchemaVersionUrl -90 */ -91 public void setOldSchemaVersionUrl(String oldSchemaVersionUrl) { -92 this.oldSchemaVersionUrl = oldSchemaVersionUrl; -93 } -94 /** -95 * a timestamp - epoch time. -96 */ -97 private long timestamp; -98 -99 /** -100 * Get the value of timestamp - epoch time. -101 * -102 * @return the value of timestamp - epoch time -103 */ -104 public long getTimestamp() { -105 return timestamp; -106 } -107 -108 /** -109 * Set the value of timestamp - epoch time. -110 * -111 * @param timestamp new value of timestamp - epoch time -112 */ -113 public void setTimestamp(long timestamp) { -114 this.timestamp = timestamp; -115 } -116 /** -117 * indicates whether or not this item should be updated. -118 */ -119 private boolean needsUpdate = true; -120 -121 /** -122 * Get the value of needsUpdate. -123 * -124 * @return the value of needsUpdate -125 */ -126 public boolean getNeedsUpdate() { -127 return needsUpdate; -128 } -129 -130 /** -131 * Set the value of needsUpdate. -132 * -133 * @param needsUpdate new value of needsUpdate -134 */ -135 public void setNeedsUpdate(boolean needsUpdate) { -136 this.needsUpdate = needsUpdate; -137 } -138 } +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2013 Jeremy Long. All Rights Reserved. +17 */ +18 package org.owasp.dependencycheck.data.update; +19 +20 /** +21 * A pojo that contains the Url and timestamp of the current NvdCve XML files. +22 * +23 * @author Jeremy Long <jeremy.long@owasp.org> +24 */ +25 public class NvdCveInfo { +26 +27 /** +28 * an id. +29 */ +30 private String id; +31 +32 /** +33 * Get the value of id. +34 * +35 * @return the value of id +36 */ +37 public String getId() { +38 return id; +39 } +40 +41 /** +42 * Set the value of id. +43 * +44 * @param id new value of id +45 */ +46 public void setId(String id) { +47 this.id = id; +48 } +49 /** +50 * a url. +51 */ +52 private String url; +53 +54 /** +55 * Get the value of url. +56 * +57 * @return the value of url +58 */ +59 public String getUrl() { +60 return url; +61 } +62 +63 /** +64 * Set the value of url. +65 * +66 * @param url new value of url +67 */ +68 public void setUrl(String url) { +69 this.url = url; +70 } +71 /** +72 * The 1.2 schema URL. +73 */ +74 private String oldSchemaVersionUrl; +75 +76 /** +77 * Get the value of oldSchemaVersionUrl. +78 * +79 * @return the value of oldSchemaVersionUrl +80 */ +81 public String getOldSchemaVersionUrl() { +82 return oldSchemaVersionUrl; +83 } +84 +85 /** +86 * Set the value of oldSchemaVersionUrl. +87 * +88 * @param oldSchemaVersionUrl new value of oldSchemaVersionUrl +89 */ +90 public void setOldSchemaVersionUrl(String oldSchemaVersionUrl) { +91 this.oldSchemaVersionUrl = oldSchemaVersionUrl; +92 } +93 /** +94 * a timestamp - epoch time. +95 */ +96 private long timestamp; +97 +98 /** +99 * Get the value of timestamp - epoch time. +100 * +101 * @return the value of timestamp - epoch time +102 */ +103 public long getTimestamp() { +104 return timestamp; +105 } +106 +107 /** +108 * Set the value of timestamp - epoch time. +109 * +110 * @param timestamp new value of timestamp - epoch time +111 */ +112 public void setTimestamp(long timestamp) { +113 this.timestamp = timestamp; +114 } +115 /** +116 * indicates whether or not this item should be updated. +117 */ +118 private boolean needsUpdate = true; +119 +120 /** +121 * Get the value of needsUpdate. +122 * +123 * @return the value of needsUpdate +124 */ +125 public boolean getNeedsUpdate() { +126 return needsUpdate; +127 } +128 +129 /** +130 * Set the value of needsUpdate. +131 * +132 * @param needsUpdate new value of needsUpdate +133 */ +134 public void setNeedsUpdate(boolean needsUpdate) { +135 this.needsUpdate = needsUpdate; +136 } +137 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/update/NvdCveUpdater.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/update/NvdCveUpdater.html index 7a2eac9b5..03e7579b7 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/update/NvdCveUpdater.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/update/NvdCveUpdater.html @@ -9,61 +9,59 @@ 1 /* 2 * This file is part of dependency-check-core. 3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. -18 */ -19 package org.owasp.dependencycheck.data.update; -20 -21 import org.owasp.dependencycheck.data.update.exception.UpdateException; -22 import java.net.MalformedURLException; -23 import java.util.logging.Level; -24 import java.util.logging.Logger; -25 import org.owasp.dependencycheck.utils.DownloadFailedException; -26 -27 /** -28 * Class responsible for updating the NVD CVE and CPE data stores. -29 * -30 * @author Jeremy Long <jeremy.long@owasp.org> -31 */ -32 public class NvdCveUpdater implements CachedWebDataSource { -33 -34 /** -35 * <p>Downloads the latest NVD CVE XML file from the web and imports it into -36 * the current CVE Database.</p> -37 * -38 * @throws UpdateException is thrown if there is an error updating the -39 * database -40 */ -41 @Override -42 public void update() throws UpdateException { -43 try { -44 final StandardUpdate task = new StandardUpdate(); -45 if (task.isUpdateNeeded()) { -46 task.update(); -47 } -48 } catch (MalformedURLException ex) { -49 Logger.getLogger(NvdCveUpdater.class.getName()).log(Level.WARNING, -50 "NVD CVE properties files contain an invalid URL, unable to update the data to use the most current data."); -51 Logger.getLogger(NvdCveUpdater.class.getName()).log(Level.FINE, null, ex); -52 } catch (DownloadFailedException ex) { -53 Logger.getLogger(NvdCveUpdater.class.getName()).log(Level.WARNING, -54 "Unable to download the NVD CVE data, unable to update the data to use the most current data."); -55 Logger.getLogger(NvdCveUpdater.class.getName()).log(Level.FINE, null, ex); -56 } -57 } -58 } +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. +17 */ +18 package org.owasp.dependencycheck.data.update; +19 +20 import java.net.MalformedURLException; +21 import java.util.logging.Level; +22 import java.util.logging.Logger; +23 import org.owasp.dependencycheck.data.update.exception.UpdateException; +24 import org.owasp.dependencycheck.utils.DownloadFailedException; +25 +26 /** +27 * Class responsible for updating the NVD CVE and CPE data stores. +28 * +29 * @author Jeremy Long <jeremy.long@owasp.org> +30 */ +31 public class NvdCveUpdater implements CachedWebDataSource { +32 +33 /** +34 * <p> +35 * Downloads the latest NVD CVE XML file from the web and imports it into the current CVE Database.</p> +36 * +37 * @throws UpdateException is thrown if there is an error updating the database +38 */ +39 @Override +40 public void update() throws UpdateException { +41 try { +42 final StandardUpdate task = new StandardUpdate(); +43 if (task.isUpdateNeeded()) { +44 task.update(); +45 } +46 } catch (MalformedURLException ex) { +47 Logger.getLogger(NvdCveUpdater.class.getName()).log(Level.WARNING, +48 "NVD CVE properties files contain an invalid URL, unable to update the data to use the most current data."); +49 Logger.getLogger(NvdCveUpdater.class.getName()).log(Level.FINE, null, ex); +50 } catch (DownloadFailedException ex) { +51 Logger.getLogger(NvdCveUpdater.class.getName()).log(Level.WARNING, +52 "Unable to download the NVD CVE data, unable to update the data to use the most current data."); +53 Logger.getLogger(NvdCveUpdater.class.getName()).log(Level.FINE, null, ex); +54 } +55 } +56 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/update/StandardUpdate.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/update/StandardUpdate.html index a9984bd9a..65f203515 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/update/StandardUpdate.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/update/StandardUpdate.html @@ -9,350 +9,337 @@ 1 /* 2 * This file is part of dependency-check-core. 3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. -18 */ -19 package org.owasp.dependencycheck.data.update; -20 -21 import org.owasp.dependencycheck.data.update.task.ProcessTask; -22 import org.owasp.dependencycheck.data.update.task.CallableDownloadTask; -23 import org.owasp.dependencycheck.data.update.exception.UpdateException; -24 import org.owasp.dependencycheck.data.update.exception.InvalidDataException; -25 import org.owasp.dependencycheck.data.nvdcve.DatabaseProperties; -26 import java.net.MalformedURLException; -27 import java.util.Calendar; -28 import java.util.Date; -29 import java.util.HashSet; -30 import java.util.Set; -31 import java.util.concurrent.ExecutionException; -32 import java.util.concurrent.ExecutorService; -33 import java.util.concurrent.Executors; -34 import java.util.concurrent.Future; -35 import java.util.logging.Level; -36 import java.util.logging.Logger; -37 import org.owasp.dependencycheck.data.nvdcve.CveDB; -38 import org.owasp.dependencycheck.utils.DownloadFailedException; -39 import org.owasp.dependencycheck.utils.Settings; -40 import org.owasp.dependencycheck.data.nvdcve.DatabaseException; -41 import org.owasp.dependencycheck.utils.InvalidSettingException; -42 import static org.owasp.dependencycheck.data.nvdcve.DatabaseProperties.MODIFIED; -43 -44 /** -45 * Class responsible for updating the NVDCVE data store. -46 * -47 * @author Jeremy Long <jeremy.long@owasp.org> -48 */ -49 public class StandardUpdate { -50 -51 /** -52 * The max thread pool size to use when downloading files. -53 */ -54 public static final int MAX_THREAD_POOL_SIZE = Settings.getInt(Settings.KEYS.MAX_DOWNLOAD_THREAD_POOL_SIZE, 3); -55 /** -56 * Information about the timestamps and URLs for data that needs to be -57 * updated. -58 */ -59 private DatabaseProperties properties; -60 /** -61 * A collection of updateable NVD CVE items. -62 */ -63 private UpdateableNvdCve updateable; -64 /** -65 * Reference to the Cve Database. -66 */ -67 private CveDB cveDB = null; -68 -69 /** -70 * Gets whether or not an update is needed. -71 * -72 * @return true or false depending on whether an update is needed -73 */ -74 public boolean isUpdateNeeded() { -75 return updateable.isUpdateNeeded(); -76 } -77 -78 /** -79 * Constructs a new Standard Update Task. -80 * -81 * @throws MalformedURLException thrown if a configured URL is malformed -82 * @throws DownloadFailedException thrown if a timestamp cannot be checked -83 * on a configured URL -84 * @throws UpdateException thrown if there is an exception generating the -85 * update task -86 */ -87 public StandardUpdate() throws MalformedURLException, DownloadFailedException, UpdateException { -88 openDataStores(); -89 properties = cveDB.getDatabaseProperties(); -90 updateable = updatesNeeded(); -91 } -92 -93 /** -94 * <p>Downloads the latest NVD CVE XML file from the web and imports it into -95 * the current CVE Database.</p> -96 * -97 * @throws UpdateException is thrown if there is an error updating the -98 * database -99 */ -100 public void update() throws UpdateException { -101 int maxUpdates = 0; -102 try { -103 for (NvdCveInfo cve : updateable) { -104 if (cve.getNeedsUpdate()) { -105 maxUpdates += 1; -106 } -107 } -108 if (maxUpdates <= 0) { -109 return; -110 } -111 if (maxUpdates > 3) { -112 Logger.getLogger(StandardUpdate.class.getName()).log(Level.INFO, -113 "NVD CVE requires several updates; this could take a couple of minutes."); -114 } -115 if (maxUpdates > 0) { -116 openDataStores(); -117 } -118 -119 final int poolSize = (MAX_THREAD_POOL_SIZE < maxUpdates) ? MAX_THREAD_POOL_SIZE : maxUpdates; -120 -121 final ExecutorService downloadExecutors = Executors.newFixedThreadPool(poolSize); -122 final ExecutorService processExecutor = Executors.newSingleThreadExecutor(); -123 final Set<Future<Future<ProcessTask>>> downloadFutures = new HashSet<Future<Future<ProcessTask>>>(maxUpdates); -124 for (NvdCveInfo cve : updateable) { -125 if (cve.getNeedsUpdate()) { -126 final CallableDownloadTask call = new CallableDownloadTask(cve, processExecutor, cveDB); -127 downloadFutures.add(downloadExecutors.submit(call)); -128 } -129 } -130 downloadExecutors.shutdown(); -131 -132 //next, move the future future processTasks to just future processTasks -133 final Set<Future<ProcessTask>> processFutures = new HashSet<Future<ProcessTask>>(maxUpdates); -134 for (Future<Future<ProcessTask>> future : downloadFutures) { -135 Future<ProcessTask> task = null; -136 try { -137 task = future.get(); -138 } catch (InterruptedException ex) { -139 downloadExecutors.shutdownNow(); -140 processExecutor.shutdownNow(); -141 -142 Logger.getLogger(StandardUpdate.class.getName()).log(Level.FINE, "Thread was interupted during download", ex); -143 throw new UpdateException("The download was interupted", ex); -144 } catch (ExecutionException ex) { -145 downloadExecutors.shutdownNow(); -146 processExecutor.shutdownNow(); -147 -148 Logger.getLogger(StandardUpdate.class.getName()).log(Level.FINE, "Thread was interupted during download execution", ex); -149 throw new UpdateException("The execution of the download was interupted", ex); -150 } -151 if (task == null) { -152 downloadExecutors.shutdownNow(); -153 processExecutor.shutdownNow(); -154 Logger.getLogger(StandardUpdate.class.getName()).log(Level.FINE, "Thread was interupted during download"); -155 throw new UpdateException("The download was interupted; unable to complete the update"); -156 } else { -157 processFutures.add(task); -158 } -159 } -160 -161 for (Future<ProcessTask> future : processFutures) { -162 try { -163 final ProcessTask task = future.get(); -164 if (task.getException() != null) { -165 throw task.getException(); -166 } -167 } catch (InterruptedException ex) { -168 processExecutor.shutdownNow(); -169 Logger.getLogger(StandardUpdate.class.getName()).log(Level.FINE, "Thread was interupted during processing", ex); -170 throw new UpdateException(ex); -171 } catch (ExecutionException ex) { -172 processExecutor.shutdownNow(); -173 Logger.getLogger(StandardUpdate.class.getName()).log(Level.FINE, "Execution Exception during process", ex); -174 throw new UpdateException(ex); -175 } finally { -176 processExecutor.shutdown(); -177 } +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. +17 */ +18 package org.owasp.dependencycheck.data.update; +19 +20 import java.net.MalformedURLException; +21 import java.util.Calendar; +22 import java.util.Date; +23 import java.util.HashSet; +24 import java.util.Set; +25 import java.util.concurrent.ExecutionException; +26 import java.util.concurrent.ExecutorService; +27 import java.util.concurrent.Executors; +28 import java.util.concurrent.Future; +29 import java.util.logging.Level; +30 import java.util.logging.Logger; +31 import org.owasp.dependencycheck.data.nvdcve.CveDB; +32 import org.owasp.dependencycheck.data.nvdcve.DatabaseException; +33 import org.owasp.dependencycheck.data.nvdcve.DatabaseProperties; +34 import static org.owasp.dependencycheck.data.nvdcve.DatabaseProperties.MODIFIED; +35 import org.owasp.dependencycheck.data.update.exception.InvalidDataException; +36 import org.owasp.dependencycheck.data.update.exception.UpdateException; +37 import org.owasp.dependencycheck.data.update.task.CallableDownloadTask; +38 import org.owasp.dependencycheck.data.update.task.ProcessTask; +39 import org.owasp.dependencycheck.utils.DownloadFailedException; +40 import org.owasp.dependencycheck.utils.InvalidSettingException; +41 import org.owasp.dependencycheck.utils.Settings; +42 +43 /** +44 * Class responsible for updating the NVDCVE data store. +45 * +46 * @author Jeremy Long <jeremy.long@owasp.org> +47 */ +48 public class StandardUpdate { +49 +50 /** +51 * The max thread pool size to use when downloading files. +52 */ +53 public static final int MAX_THREAD_POOL_SIZE = Settings.getInt(Settings.KEYS.MAX_DOWNLOAD_THREAD_POOL_SIZE, 3); +54 /** +55 * Information about the timestamps and URLs for data that needs to be updated. +56 */ +57 private DatabaseProperties properties; +58 /** +59 * A collection of updateable NVD CVE items. +60 */ +61 private UpdateableNvdCve updateable; +62 /** +63 * Reference to the Cve Database. +64 */ +65 private CveDB cveDB = null; +66 +67 /** +68 * Gets whether or not an update is needed. +69 * +70 * @return true or false depending on whether an update is needed +71 */ +72 public boolean isUpdateNeeded() { +73 return updateable.isUpdateNeeded(); +74 } +75 +76 /** +77 * Constructs a new Standard Update Task. +78 * +79 * @throws MalformedURLException thrown if a configured URL is malformed +80 * @throws DownloadFailedException thrown if a timestamp cannot be checked on a configured URL +81 * @throws UpdateException thrown if there is an exception generating the update task +82 */ +83 public StandardUpdate() throws MalformedURLException, DownloadFailedException, UpdateException { +84 openDataStores(); +85 properties = cveDB.getDatabaseProperties(); +86 updateable = updatesNeeded(); +87 } +88 +89 /** +90 * <p> +91 * Downloads the latest NVD CVE XML file from the web and imports it into the current CVE Database.</p> +92 * +93 * @throws UpdateException is thrown if there is an error updating the database +94 */ +95 public void update() throws UpdateException { +96 int maxUpdates = 0; +97 try { +98 for (NvdCveInfo cve : updateable) { +99 if (cve.getNeedsUpdate()) { +100 maxUpdates += 1; +101 } +102 } +103 if (maxUpdates <= 0) { +104 return; +105 } +106 if (maxUpdates > 3) { +107 Logger.getLogger(StandardUpdate.class.getName()).log(Level.INFO, +108 "NVD CVE requires several updates; this could take a couple of minutes."); +109 } +110 if (maxUpdates > 0) { +111 openDataStores(); +112 } +113 +114 final int poolSize = (MAX_THREAD_POOL_SIZE < maxUpdates) ? MAX_THREAD_POOL_SIZE : maxUpdates; +115 +116 final ExecutorService downloadExecutors = Executors.newFixedThreadPool(poolSize); +117 final ExecutorService processExecutor = Executors.newSingleThreadExecutor(); +118 final Set<Future<Future<ProcessTask>>> downloadFutures = new HashSet<Future<Future<ProcessTask>>>(maxUpdates); +119 for (NvdCveInfo cve : updateable) { +120 if (cve.getNeedsUpdate()) { +121 final CallableDownloadTask call = new CallableDownloadTask(cve, processExecutor, cveDB); +122 downloadFutures.add(downloadExecutors.submit(call)); +123 } +124 } +125 downloadExecutors.shutdown(); +126 +127 //next, move the future future processTasks to just future processTasks +128 final Set<Future<ProcessTask>> processFutures = new HashSet<Future<ProcessTask>>(maxUpdates); +129 for (Future<Future<ProcessTask>> future : downloadFutures) { +130 Future<ProcessTask> task = null; +131 try { +132 task = future.get(); +133 } catch (InterruptedException ex) { +134 downloadExecutors.shutdownNow(); +135 processExecutor.shutdownNow(); +136 +137 Logger.getLogger(StandardUpdate.class.getName()).log(Level.FINE, "Thread was interupted during download", ex); +138 throw new UpdateException("The download was interupted", ex); +139 } catch (ExecutionException ex) { +140 downloadExecutors.shutdownNow(); +141 processExecutor.shutdownNow(); +142 +143 Logger.getLogger(StandardUpdate.class.getName()).log(Level.FINE, "Thread was interupted during download execution", ex); +144 throw new UpdateException("The execution of the download was interupted", ex); +145 } +146 if (task == null) { +147 downloadExecutors.shutdownNow(); +148 processExecutor.shutdownNow(); +149 Logger.getLogger(StandardUpdate.class.getName()).log(Level.FINE, "Thread was interupted during download"); +150 throw new UpdateException("The download was interupted; unable to complete the update"); +151 } else { +152 processFutures.add(task); +153 } +154 } +155 +156 for (Future<ProcessTask> future : processFutures) { +157 try { +158 final ProcessTask task = future.get(); +159 if (task.getException() != null) { +160 throw task.getException(); +161 } +162 } catch (InterruptedException ex) { +163 processExecutor.shutdownNow(); +164 Logger.getLogger(StandardUpdate.class.getName()).log(Level.FINE, "Thread was interupted during processing", ex); +165 throw new UpdateException(ex); +166 } catch (ExecutionException ex) { +167 processExecutor.shutdownNow(); +168 Logger.getLogger(StandardUpdate.class.getName()).log(Level.FINE, "Execution Exception during process", ex); +169 throw new UpdateException(ex); +170 } finally { +171 processExecutor.shutdown(); +172 } +173 } +174 +175 if (maxUpdates >= 1) { //ensure the modified file date gets written (we may not have actually updated it) +176 properties.save(updateable.get(MODIFIED)); +177 cveDB.cleanupDatabase(); 178 } -179 -180 if (maxUpdates >= 1) { //ensure the modified file date gets written (we may not have actually updated it) -181 properties.save(updateable.get(MODIFIED)); -182 cveDB.cleanupDatabase(); -183 } -184 } finally { -185 closeDataStores(); -186 } -187 } -188 -189 /** -190 * Determines if the index needs to be updated. This is done by fetching the -191 * NVD CVE meta data and checking the last update date. If the data needs to -192 * be refreshed this method will return the NvdCveUrl for the files that -193 * need to be updated. -194 * -195 * @return the collection of files that need to be updated -196 * @throws MalformedURLException is thrown if the URL for the NVD CVE Meta -197 * data is incorrect -198 * @throws DownloadFailedException is thrown if there is an error. -199 * downloading the NVD CVE download data file -200 * @throws UpdateException Is thrown if there is an issue with the last -201 * updated properties file -202 */ -203 protected final UpdateableNvdCve updatesNeeded() throws MalformedURLException, DownloadFailedException, UpdateException { -204 UpdateableNvdCve updates = null; -205 try { -206 updates = retrieveCurrentTimestampsFromWeb(); -207 } catch (InvalidDataException ex) { -208 final String msg = "Unable to retrieve valid timestamp from nvd cve downloads page"; -209 Logger.getLogger(StandardUpdate.class.getName()).log(Level.FINE, msg, ex); -210 throw new DownloadFailedException(msg, ex); -211 } catch (InvalidSettingException ex) { -212 Logger.getLogger(StandardUpdate.class.getName()).log(Level.FINE, "Invalid setting found when retrieving timestamps", ex); -213 throw new DownloadFailedException("Invalid settings", ex); -214 } -215 -216 if (updates == null) { -217 throw new DownloadFailedException("Unable to retrieve the timestamps of the currently published NVD CVE data"); -218 } -219 if (!properties.isEmpty()) { -220 try { -221 final long lastUpdated = Long.parseLong(properties.getProperty(DatabaseProperties.LAST_UPDATED, "0")); -222 final Date now = new Date(); -223 final int days = Settings.getInt(Settings.KEYS.CVE_MODIFIED_VALID_FOR_DAYS, 7); -224 if (lastUpdated == updates.getTimeStamp(MODIFIED)) { -225 updates.clear(); //we don't need to update anything. -226 } else if (withinRange(lastUpdated, now.getTime(), days)) { -227 for (NvdCveInfo entry : updates) { -228 if (MODIFIED.equals(entry.getId())) { -229 entry.setNeedsUpdate(true); -230 } else { -231 entry.setNeedsUpdate(false); -232 } -233 } -234 } else { //we figure out which of the several XML files need to be downloaded. -235 for (NvdCveInfo entry : updates) { -236 if (MODIFIED.equals(entry.getId())) { -237 entry.setNeedsUpdate(true); -238 } else { -239 long currentTimestamp = 0; -240 try { -241 currentTimestamp = Long.parseLong(properties.getProperty(DatabaseProperties.LAST_UPDATED_BASE + entry.getId(), "0")); -242 } catch (NumberFormatException ex) { -243 final String msg = String.format("Error parsing '%s' '%s' from nvdcve.lastupdated", -244 DatabaseProperties.LAST_UPDATED_BASE, entry.getId()); -245 Logger -246 .getLogger(StandardUpdate.class -247 .getName()).log(Level.FINE, msg, ex); -248 } -249 if (currentTimestamp == entry.getTimestamp()) { -250 entry.setNeedsUpdate(false); -251 } -252 } -253 } -254 } -255 } catch (NumberFormatException ex) { -256 final String msg = "An invalid schema version or timestamp exists in the data.properties file."; -257 Logger -258 .getLogger(StandardUpdate.class -259 .getName()).log(Level.WARNING, msg); -260 Logger.getLogger(StandardUpdate.class -261 .getName()).log(Level.FINE, null, ex); -262 } -263 } -264 return updates; -265 } -266 -267 /** -268 * Retrieves the timestamps from the NVD CVE meta data file. -269 * -270 * @return the timestamp from the currently published nvdcve downloads page -271 * @throws MalformedURLException thrown if the URL for the NVD CCE Meta data -272 * is incorrect. -273 * @throws DownloadFailedException thrown if there is an error downloading -274 * the nvd cve meta data file -275 * @throws InvalidDataException thrown if there is an exception parsing the -276 * timestamps -277 * @throws InvalidSettingException thrown if the settings are invalid -278 */ -279 private UpdateableNvdCve retrieveCurrentTimestampsFromWeb() -280 throws MalformedURLException, DownloadFailedException, InvalidDataException, InvalidSettingException { -281 -282 final UpdateableNvdCve updates = new UpdateableNvdCve(); -283 updates.add(MODIFIED, Settings.getString(Settings.KEYS.CVE_MODIFIED_20_URL), -284 Settings.getString(Settings.KEYS.CVE_MODIFIED_12_URL), -285 false); -286 -287 final int start = Settings.getInt(Settings.KEYS.CVE_START_YEAR); -288 final int end = Calendar.getInstance().get(Calendar.YEAR); -289 final String baseUrl20 = Settings.getString(Settings.KEYS.CVE_SCHEMA_2_0); -290 final String baseUrl12 = Settings.getString(Settings.KEYS.CVE_SCHEMA_1_2); -291 for (int i = start; i <= end; i++) { -292 updates.add(Integer.toString(i), String.format(baseUrl20, i), -293 String.format(baseUrl12, i), -294 true); -295 } -296 -297 return updates; -298 } -299 -300 /** -301 * Closes the CVE and CPE data stores. -302 */ -303 protected void closeDataStores() { -304 if (cveDB != null) { -305 try { -306 cveDB.close(); -307 } catch (Exception ignore) { -308 Logger.getLogger(StandardUpdate.class.getName()).log(Level.FINEST, "Error closing the cveDB", ignore); -309 } -310 } -311 } -312 -313 /** -314 * Opens the CVE and CPE data stores. -315 * -316 * @throws UpdateException thrown if a data store cannot be opened -317 */ -318 protected final void openDataStores() throws UpdateException { -319 if (cveDB != null) { -320 return; -321 } -322 try { -323 cveDB = new CveDB(); -324 cveDB.open(); -325 } catch (DatabaseException ex) { -326 closeDataStores(); -327 Logger.getLogger(StandardUpdate.class.getName()).log(Level.FINE, "Database Exception opening databases", ex); -328 throw new UpdateException("Error updating the CPE/CVE data, please see the log file for more details."); -329 } -330 } -331 -332 /** -333 * Determines if the epoch date is within the range specified of the -334 * compareTo epoch time. This takes the (compareTo-date)/1000/60/60/24 to -335 * get the number of days. If the calculated days is less then the range the -336 * date is considered valid. -337 * -338 * @param date the date to be checked. -339 * @param compareTo the date to compare to. -340 * @param range the range in days to be considered valid. -341 * @return whether or not the date is within the range. -342 */ -343 protected boolean withinRange(long date, long compareTo, int range) { -344 final double differenceInDays = (compareTo - date) / 1000.0 / 60.0 / 60.0 / 24.0; -345 return differenceInDays < range; -346 } -347 } +179 } finally { +180 closeDataStores(); +181 } +182 } +183 +184 /** +185 * Determines if the index needs to be updated. This is done by fetching the NVD CVE meta data and checking the last +186 * update date. If the data needs to be refreshed this method will return the NvdCveUrl for the files that need to +187 * be updated. +188 * +189 * @return the collection of files that need to be updated +190 * @throws MalformedURLException is thrown if the URL for the NVD CVE Meta data is incorrect +191 * @throws DownloadFailedException is thrown if there is an error. downloading the NVD CVE download data file +192 * @throws UpdateException Is thrown if there is an issue with the last updated properties file +193 */ +194 protected final UpdateableNvdCve updatesNeeded() throws MalformedURLException, DownloadFailedException, UpdateException { +195 UpdateableNvdCve updates = null; +196 try { +197 updates = retrieveCurrentTimestampsFromWeb(); +198 } catch (InvalidDataException ex) { +199 final String msg = "Unable to retrieve valid timestamp from nvd cve downloads page"; +200 Logger.getLogger(StandardUpdate.class.getName()).log(Level.FINE, msg, ex); +201 throw new DownloadFailedException(msg, ex); +202 } catch (InvalidSettingException ex) { +203 Logger.getLogger(StandardUpdate.class.getName()).log(Level.FINE, "Invalid setting found when retrieving timestamps", ex); +204 throw new DownloadFailedException("Invalid settings", ex); +205 } +206 +207 if (updates == null) { +208 throw new DownloadFailedException("Unable to retrieve the timestamps of the currently published NVD CVE data"); +209 } +210 if (!properties.isEmpty()) { +211 try { +212 final long lastUpdated = Long.parseLong(properties.getProperty(DatabaseProperties.LAST_UPDATED, "0")); +213 final Date now = new Date(); +214 final int days = Settings.getInt(Settings.KEYS.CVE_MODIFIED_VALID_FOR_DAYS, 7); +215 if (lastUpdated == updates.getTimeStamp(MODIFIED)) { +216 updates.clear(); //we don't need to update anything. +217 } else if (withinRange(lastUpdated, now.getTime(), days)) { +218 for (NvdCveInfo entry : updates) { +219 if (MODIFIED.equals(entry.getId())) { +220 entry.setNeedsUpdate(true); +221 } else { +222 entry.setNeedsUpdate(false); +223 } +224 } +225 } else { //we figure out which of the several XML files need to be downloaded. +226 for (NvdCveInfo entry : updates) { +227 if (MODIFIED.equals(entry.getId())) { +228 entry.setNeedsUpdate(true); +229 } else { +230 long currentTimestamp = 0; +231 try { +232 currentTimestamp = Long.parseLong(properties.getProperty(DatabaseProperties.LAST_UPDATED_BASE + entry.getId(), "0")); +233 } catch (NumberFormatException ex) { +234 final String msg = String.format("Error parsing '%s' '%s' from nvdcve.lastupdated", +235 DatabaseProperties.LAST_UPDATED_BASE, entry.getId()); +236 Logger +237 .getLogger(StandardUpdate.class +238 .getName()).log(Level.FINE, msg, ex); +239 } +240 if (currentTimestamp == entry.getTimestamp()) { +241 entry.setNeedsUpdate(false); +242 } +243 } +244 } +245 } +246 } catch (NumberFormatException ex) { +247 final String msg = "An invalid schema version or timestamp exists in the data.properties file."; +248 Logger +249 .getLogger(StandardUpdate.class +250 .getName()).log(Level.WARNING, msg); +251 Logger.getLogger(StandardUpdate.class +252 .getName()).log(Level.FINE, null, ex); +253 } +254 } +255 return updates; +256 } +257 +258 /** +259 * Retrieves the timestamps from the NVD CVE meta data file. +260 * +261 * @return the timestamp from the currently published nvdcve downloads page +262 * @throws MalformedURLException thrown if the URL for the NVD CCE Meta data is incorrect. +263 * @throws DownloadFailedException thrown if there is an error downloading the nvd cve meta data file +264 * @throws InvalidDataException thrown if there is an exception parsing the timestamps +265 * @throws InvalidSettingException thrown if the settings are invalid +266 */ +267 private UpdateableNvdCve retrieveCurrentTimestampsFromWeb() +268 throws MalformedURLException, DownloadFailedException, InvalidDataException, InvalidSettingException { +269 +270 final UpdateableNvdCve updates = new UpdateableNvdCve(); +271 updates.add(MODIFIED, Settings.getString(Settings.KEYS.CVE_MODIFIED_20_URL), +272 Settings.getString(Settings.KEYS.CVE_MODIFIED_12_URL), +273 false); +274 +275 final int start = Settings.getInt(Settings.KEYS.CVE_START_YEAR); +276 final int end = Calendar.getInstance().get(Calendar.YEAR); +277 final String baseUrl20 = Settings.getString(Settings.KEYS.CVE_SCHEMA_2_0); +278 final String baseUrl12 = Settings.getString(Settings.KEYS.CVE_SCHEMA_1_2); +279 for (int i = start; i <= end; i++) { +280 updates.add(Integer.toString(i), String.format(baseUrl20, i), +281 String.format(baseUrl12, i), +282 true); +283 } +284 +285 return updates; +286 } +287 +288 /** +289 * Closes the CVE and CPE data stores. +290 */ +291 protected void closeDataStores() { +292 if (cveDB != null) { +293 try { +294 cveDB.close(); +295 } catch (Exception ignore) { +296 Logger.getLogger(StandardUpdate.class.getName()).log(Level.FINEST, "Error closing the cveDB", ignore); +297 } +298 } +299 } +300 +301 /** +302 * Opens the CVE and CPE data stores. +303 * +304 * @throws UpdateException thrown if a data store cannot be opened +305 */ +306 protected final void openDataStores() throws UpdateException { +307 if (cveDB != null) { +308 return; +309 } +310 try { +311 cveDB = new CveDB(); +312 cveDB.open(); +313 } catch (DatabaseException ex) { +314 closeDataStores(); +315 Logger.getLogger(StandardUpdate.class.getName()).log(Level.FINE, "Database Exception opening databases", ex); +316 throw new UpdateException("Error updating the CPE/CVE data, please see the log file for more details."); +317 } +318 } +319 +320 /** +321 * Determines if the epoch date is within the range specified of the compareTo epoch time. This takes the +322 * (compareTo-date)/1000/60/60/24 to get the number of days. If the calculated days is less then the range the date +323 * is considered valid. +324 * +325 * @param date the date to be checked. +326 * @param compareTo the date to compare to. +327 * @param range the range in days to be considered valid. +328 * @return whether or not the date is within the range. +329 */ +330 protected boolean withinRange(long date, long compareTo, int range) { +331 final double differenceInDays = (compareTo - date) / 1000.0 / 60.0 / 60.0 / 24.0; +332 return differenceInDays < range; +333 } +334 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/update/UpdateService.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/update/UpdateService.html index e0885c2c0..aee3bd95f 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/update/UpdateService.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/update/UpdateService.html @@ -9,70 +9,68 @@ 1 /* 2 * This file is part of dependency-check-core. 3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. -18 */ -19 package org.owasp.dependencycheck.data.update; -20 -21 import java.util.Iterator; -22 import java.util.ServiceLoader; -23 -24 /** -25 * -26 * @author Jeremy Long <jeremy.long@owasp.org> -27 */ -28 public final class UpdateService { -29 -30 /** -31 * the singleton reference to the service. -32 */ -33 private static UpdateService service; -34 /** -35 * the service loader for CachedWebDataSource. -36 */ -37 private final ServiceLoader<CachedWebDataSource> loader; -38 -39 /** -40 * Creates a new instance of UpdateService -41 */ -42 private UpdateService() { -43 loader = ServiceLoader.load(CachedWebDataSource.class); -44 } -45 -46 /** -47 * Retrieve the singleton instance of UpdateService. -48 * -49 * @return a singleton UpdateService. -50 */ -51 public static synchronized UpdateService getInstance() { -52 if (service == null) { -53 service = new UpdateService(); -54 } -55 return service; -56 } -57 -58 /** -59 * Returns an Iterator for all instances of the CachedWebDataSource -60 * interface. -61 * -62 * @return an iterator of CachedWebDataSource. -63 */ -64 public Iterator<CachedWebDataSource> getDataSources() { -65 return loader.iterator(); -66 } -67 } +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. +17 */ +18 package org.owasp.dependencycheck.data.update; +19 +20 import java.util.Iterator; +21 import java.util.ServiceLoader; +22 +23 /** +24 * +25 * @author Jeremy Long <jeremy.long@owasp.org> +26 */ +27 public final class UpdateService { +28 +29 /** +30 * the singleton reference to the service. +31 */ +32 private static UpdateService service; +33 /** +34 * the service loader for CachedWebDataSource. +35 */ +36 private final ServiceLoader<CachedWebDataSource> loader; +37 +38 /** +39 * Creates a new instance of UpdateService +40 */ +41 private UpdateService() { +42 loader = ServiceLoader.load(CachedWebDataSource.class); +43 } +44 +45 /** +46 * Retrieve the singleton instance of UpdateService. +47 * +48 * @return a singleton UpdateService. +49 */ +50 public static synchronized UpdateService getInstance() { +51 if (service == null) { +52 service = new UpdateService(); +53 } +54 return service; +55 } +56 +57 /** +58 * Returns an Iterator for all instances of the CachedWebDataSource interface. +59 * +60 * @return an iterator of CachedWebDataSource. +61 */ +62 public Iterator<CachedWebDataSource> getDataSources() { +63 return loader.iterator(); +64 } +65 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/update/UpdateableNvdCve.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/update/UpdateableNvdCve.html index bfe9ad1bd..3ec760257 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/update/UpdateableNvdCve.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/update/UpdateableNvdCve.html @@ -9,128 +9,128 @@ 1 /* 2 * This file is part of dependency-check-core. 3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. -18 */ -19 package org.owasp.dependencycheck.data.update; -20 -21 import java.net.MalformedURLException; -22 import java.net.URL; -23 import java.util.Iterator; -24 import java.util.Map; -25 import java.util.Map.Entry; -26 import java.util.TreeMap; -27 import org.owasp.dependencycheck.utils.DownloadFailedException; -28 import org.owasp.dependencycheck.utils.Downloader; -29 -30 /** -31 * Contains a collection of updateable NvdCveInfo objects. This is used to -32 * determine which files need to be downloaded and processed. -33 * -34 * @author Jeremy Long <jeremy.long@owasp.org> -35 */ -36 public class UpdateableNvdCve implements java.lang.Iterable<NvdCveInfo>, Iterator<NvdCveInfo> { -37 -38 /** -39 * A collection of sources of data. -40 */ -41 private Map<String, NvdCveInfo> collection = new TreeMap<String, NvdCveInfo>(); -42 -43 /** -44 * Returns the collection of NvdCveInfo objects. This method is mainly used -45 * for testing. -46 * -47 * @return the collection of NvdCveInfo objects -48 */ -49 protected Map<String, NvdCveInfo> getCollection() { -50 return collection; -51 } -52 -53 /** -54 * Gets whether or not an update is needed. -55 * -56 * @return true or false depending on whether an update is needed -57 */ -58 public boolean isUpdateNeeded() { -59 for (NvdCveInfo item : this) { -60 if (item.getNeedsUpdate()) { -61 return true; -62 } -63 } -64 return false; -65 } -66 -67 /** -68 * Adds a new entry of updateable information to the contained collection. -69 * -70 * @param id the key for the item to be added -71 * @param url the URL to download the item -72 * @param oldUrl the URL for the old version of the item (the NVD CVE old -73 * schema still contains useful data we need). -74 * @throws MalformedURLException thrown if the URL provided is invalid -75 * @throws DownloadFailedException thrown if the download fails. -76 */ -77 public void add(String id, String url, String oldUrl) throws MalformedURLException, DownloadFailedException { -78 add(id, url, oldUrl, false); -79 } -80 -81 /** -82 * Adds a new entry of updateable information to the contained collection. -83 * -84 * @param id the key for the item to be added -85 * @param url the URL to download the item -86 * @param oldUrl the URL for the old version of the item (the NVD CVE old -87 * schema still contains useful data we need). -88 * @param needsUpdate whether or not the data needs to be updated -89 * @throws MalformedURLException thrown if the URL provided is invalid -90 * @throws DownloadFailedException thrown if the download fails. -91 */ -92 public void add(String id, String url, String oldUrl, boolean needsUpdate) throws MalformedURLException, DownloadFailedException { -93 final NvdCveInfo item = new NvdCveInfo(); -94 item.setNeedsUpdate(needsUpdate); //the others default to true, to make life easier later this should default to false. -95 item.setId(id); -96 item.setUrl(url); -97 item.setOldSchemaVersionUrl(oldUrl); -98 item.setTimestamp(Downloader.getLastModified(new URL(url))); -99 collection.put(id, item); -100 } -101 -102 /** -103 * Clears the contained collection of NvdCveInfo entries. -104 */ -105 public void clear() { -106 collection.clear(); -107 } -108 -109 /** -110 * Returns the timestamp for the given entry. -111 * -112 * @param key the key to lookup in the collection of NvdCveInfo items -113 * @return the timestamp for the given entry -114 */ -115 public long getTimeStamp(String key) { -116 return collection.get(key).getTimestamp(); -117 } -118 /** -119 * An internal iterator used to implement iterable. -120 */ -121 private Iterator<Entry<String, NvdCveInfo>> iterableContent = null; -122 -123 /** -124 * <p>Returns an iterator for the NvdCveInfo contained.</p> -125 * <p><b>This method is not thread safe.</b></p> +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. +17 */ +18 package org.owasp.dependencycheck.data.update; +19 +20 import java.net.MalformedURLException; +21 import java.net.URL; +22 import java.util.Iterator; +23 import java.util.Map; +24 import java.util.Map.Entry; +25 import java.util.TreeMap; +26 import org.owasp.dependencycheck.utils.DownloadFailedException; +27 import org.owasp.dependencycheck.utils.Downloader; +28 +29 /** +30 * Contains a collection of updateable NvdCveInfo objects. This is used to determine which files need to be downloaded +31 * and processed. +32 * +33 * @author Jeremy Long <jeremy.long@owasp.org> +34 */ +35 public class UpdateableNvdCve implements java.lang.Iterable<NvdCveInfo>, Iterator<NvdCveInfo> { +36 +37 /** +38 * A collection of sources of data. +39 */ +40 private Map<String, NvdCveInfo> collection = new TreeMap<String, NvdCveInfo>(); +41 +42 /** +43 * Returns the collection of NvdCveInfo objects. This method is mainly used for testing. +44 * +45 * @return the collection of NvdCveInfo objects +46 */ +47 protected Map<String, NvdCveInfo> getCollection() { +48 return collection; +49 } +50 +51 /** +52 * Gets whether or not an update is needed. +53 * +54 * @return true or false depending on whether an update is needed +55 */ +56 public boolean isUpdateNeeded() { +57 for (NvdCveInfo item : this) { +58 if (item.getNeedsUpdate()) { +59 return true; +60 } +61 } +62 return false; +63 } +64 +65 /** +66 * Adds a new entry of updateable information to the contained collection. +67 * +68 * @param id the key for the item to be added +69 * @param url the URL to download the item +70 * @param oldUrl the URL for the old version of the item (the NVD CVE old schema still contains useful data we +71 * need). +72 * @throws MalformedURLException thrown if the URL provided is invalid +73 * @throws DownloadFailedException thrown if the download fails. +74 */ +75 public void add(String id, String url, String oldUrl) throws MalformedURLException, DownloadFailedException { +76 add(id, url, oldUrl, false); +77 } +78 +79 /** +80 * Adds a new entry of updateable information to the contained collection. +81 * +82 * @param id the key for the item to be added +83 * @param url the URL to download the item +84 * @param oldUrl the URL for the old version of the item (the NVD CVE old schema still contains useful data we +85 * need). +86 * @param needsUpdate whether or not the data needs to be updated +87 * @throws MalformedURLException thrown if the URL provided is invalid +88 * @throws DownloadFailedException thrown if the download fails. +89 */ +90 public void add(String id, String url, String oldUrl, boolean needsUpdate) throws MalformedURLException, DownloadFailedException { +91 final NvdCveInfo item = new NvdCveInfo(); +92 item.setNeedsUpdate(needsUpdate); //the others default to true, to make life easier later this should default to false. +93 item.setId(id); +94 item.setUrl(url); +95 item.setOldSchemaVersionUrl(oldUrl); +96 item.setTimestamp(Downloader.getLastModified(new URL(url))); +97 collection.put(id, item); +98 } +99 +100 /** +101 * Clears the contained collection of NvdCveInfo entries. +102 */ +103 public void clear() { +104 collection.clear(); +105 } +106 +107 /** +108 * Returns the timestamp for the given entry. +109 * +110 * @param key the key to lookup in the collection of NvdCveInfo items +111 * @return the timestamp for the given entry +112 */ +113 public long getTimeStamp(String key) { +114 return collection.get(key).getTimestamp(); +115 } +116 /** +117 * An internal iterator used to implement iterable. +118 */ +119 private Iterator<Entry<String, NvdCveInfo>> iterableContent = null; +120 +121 /** +122 * <p> +123 * Returns an iterator for the NvdCveInfo contained.</p> +124 * <p> +125 * <b>This method is not thread safe.</b></p> 126 * 127 * @return an NvdCveInfo Iterator 128 */ @@ -141,52 +141,57 @@ 133 } 134 135 /** -136 * <p>Returns whether or not there is another item in the collection.</p> -137 * <p><b>This method is not thread safe.</b></p> -138 * -139 * @return true or false depending on whether or not another item exists in -140 * the collection -141 */ -142 @Override -143 public boolean hasNext() { -144 return iterableContent.hasNext(); -145 } -146 -147 /** -148 * <p>Returns the next item in the collection.</p> -149 * <p><b>This method is not thread safe.</b></p> -150 * -151 * @return the next NvdCveInfo item in the collection -152 */ -153 @Override -154 public NvdCveInfo next() { -155 return iterableContent.next().getValue(); -156 } -157 -158 /** -159 * <p>Removes the current NvdCveInfo object from the collection.</p> -160 * <p><b>This method is not thread safe.</b></p> -161 */ -162 @Override -163 public void remove() { -164 iterableContent.remove(); -165 } -166 -167 /** -168 * Returns the specified item from the collection. -169 * -170 * @param key the key to lookup the return value -171 * @return the NvdCveInfo object stored using the specified key -172 */ -173 NvdCveInfo get(String key) { -174 return collection.get(key); -175 } -176 -177 @Override -178 public String toString() { -179 return "Updateable{" + "size=" + collection.size() + '}'; +136 * <p> +137 * Returns whether or not there is another item in the collection.</p> +138 * <p> +139 * <b>This method is not thread safe.</b></p> +140 * +141 * @return true or false depending on whether or not another item exists in the collection +142 */ +143 @Override +144 public boolean hasNext() { +145 return iterableContent.hasNext(); +146 } +147 +148 /** +149 * <p> +150 * Returns the next item in the collection.</p> +151 * <p> +152 * <b>This method is not thread safe.</b></p> +153 * +154 * @return the next NvdCveInfo item in the collection +155 */ +156 @Override +157 public NvdCveInfo next() { +158 return iterableContent.next().getValue(); +159 } +160 +161 /** +162 * <p> +163 * Removes the current NvdCveInfo object from the collection.</p> +164 * <p> +165 * <b>This method is not thread safe.</b></p> +166 */ +167 @Override +168 public void remove() { +169 iterableContent.remove(); +170 } +171 +172 /** +173 * Returns the specified item from the collection. +174 * +175 * @param key the key to lookup the return value +176 * @return the NvdCveInfo object stored using the specified key +177 */ +178 NvdCveInfo get(String key) { +179 return collection.get(key); 180 } -181 } +181 +182 @Override +183 public String toString() { +184 return "Updateable{" + "size=" + collection.size() + '}'; +185 } +186 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/update/exception/InvalidDataException.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/update/exception/InvalidDataException.html index 6d3817731..9adf3fcb3 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/update/exception/InvalidDataException.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/update/exception/InvalidDataException.html @@ -9,55 +9,53 @@ 1 /* 2 * This file is part of dependency-check-core. 3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. -18 */ -19 package org.owasp.dependencycheck.data.update.exception; -20 -21 /** -22 * An InvalidDataDataException is a generic exception used when trying to load -23 * the NVD CVE meta data. -24 * -25 * @author Jeremy Long <jeremy.long@owasp.org> -26 */ -27 public class InvalidDataException extends Exception { -28 -29 /** -30 * The serial version UID. -31 */ -32 private static final long serialVersionUID = 1L; -33 -34 /** -35 * Creates an InvalidDataException. -36 * -37 * @param msg the exception message -38 */ -39 public InvalidDataException(String msg) { -40 super(msg); -41 } -42 -43 /** -44 * Creates an InvalidDataException. -45 * -46 * @param msg the exception message -47 * @param ex the cause of the exception -48 */ -49 public InvalidDataException(String msg, Exception ex) { -50 super(msg, ex); -51 } -52 } +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. +17 */ +18 package org.owasp.dependencycheck.data.update.exception; +19 +20 /** +21 * An InvalidDataDataException is a generic exception used when trying to load the NVD CVE meta data. +22 * +23 * @author Jeremy Long <jeremy.long@owasp.org> +24 */ +25 public class InvalidDataException extends Exception { +26 +27 /** +28 * The serial version UID. +29 */ +30 private static final long serialVersionUID = 1L; +31 +32 /** +33 * Creates an InvalidDataException. +34 * +35 * @param msg the exception message +36 */ +37 public InvalidDataException(String msg) { +38 super(msg); +39 } +40 +41 /** +42 * Creates an InvalidDataException. +43 * +44 * @param msg the exception message +45 * @param ex the cause of the exception +46 */ +47 public InvalidDataException(String msg, Exception ex) { +48 super(msg, ex); +49 } +50 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/update/exception/UpdateException.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/update/exception/UpdateException.html index a32fc9bb7..2274bd825 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/update/exception/UpdateException.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/update/exception/UpdateException.html @@ -9,72 +9,71 @@ 1 /* 2 * This file is part of dependency-check-core. 3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. -18 */ -19 package org.owasp.dependencycheck.data.update.exception; -20 -21 import java.io.IOException; -22 -23 /** -24 * An exception used when an error occurs reading a setting. -25 * -26 * @author Jeremy Long <jeremy.long@owasp.org> -27 */ -28 public class UpdateException extends IOException { -29 -30 /** -31 * The serial version uid. -32 */ -33 private static final long serialVersionUID = 1L; -34 -35 /** -36 * Creates a new UpdateException. -37 */ -38 public UpdateException() { -39 super(); -40 } -41 -42 /** -43 * Creates a new UpdateException. -44 * -45 * @param msg a message for the exception. -46 */ -47 public UpdateException(String msg) { -48 super(msg); -49 } -50 -51 /** -52 * Creates a new UpdateException. -53 * -54 * @param ex the cause of the update exception. -55 */ -56 public UpdateException(Throwable ex) { -57 super(ex); -58 } -59 -60 /** -61 * Creates a new UpdateException. -62 * -63 * @param msg a message for the exception. -64 * @param ex the cause of the update exception. -65 */ -66 public UpdateException(String msg, Throwable ex) { -67 super(msg, ex); -68 } -69 } +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. +17 */ +18 package org.owasp.dependencycheck.data.update.exception; +19 +20 import java.io.IOException; +21 +22 /** +23 * An exception used when an error occurs reading a setting. +24 * +25 * @author Jeremy Long <jeremy.long@owasp.org> +26 */ +27 public class UpdateException extends IOException { +28 +29 /** +30 * The serial version uid. +31 */ +32 private static final long serialVersionUID = 1L; +33 +34 /** +35 * Creates a new UpdateException. +36 */ +37 public UpdateException() { +38 super(); +39 } +40 +41 /** +42 * Creates a new UpdateException. +43 * +44 * @param msg a message for the exception. +45 */ +46 public UpdateException(String msg) { +47 super(msg); +48 } +49 +50 /** +51 * Creates a new UpdateException. +52 * +53 * @param ex the cause of the update exception. +54 */ +55 public UpdateException(Throwable ex) { +56 super(ex); +57 } +58 +59 /** +60 * Creates a new UpdateException. +61 * +62 * @param msg a message for the exception. +63 * @param ex the cause of the update exception. +64 */ +65 public UpdateException(String msg, Throwable ex) { +66 super(msg, ex); +67 } +68 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/update/exception/package-frame.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/update/exception/package-frame.html index 85cbccafa..19090dc8c 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/update/exception/package-frame.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/update/exception/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.0.8 Reference Package org.owasp.dependencycheck.data.update.exception + Dependency-Check Core 1.1.0 Reference Package org.owasp.dependencycheck.data.update.exception diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/update/exception/package-summary.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/update/exception/package-summary.html index a1b6fc400..8ba2f2c1b 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/update/exception/package-summary.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/update/exception/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.0.8 Reference Package org.owasp.dependencycheck.data.update.exception + Dependency-Check Core 1.1.0 Reference Package org.owasp.dependencycheck.data.update.exception diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/update/package-frame.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/update/package-frame.html index f409856f1..9217928e6 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/update/package-frame.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/update/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.0.8 Reference Package org.owasp.dependencycheck.data.update + Dependency-Check Core 1.1.0 Reference Package org.owasp.dependencycheck.data.update diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/update/package-summary.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/update/package-summary.html index 9fb8f380d..aa0f9affb 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/update/package-summary.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/update/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.0.8 Reference Package org.owasp.dependencycheck.data.update + Dependency-Check Core 1.1.0 Reference Package org.owasp.dependencycheck.data.update diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/update/task/CallableDownloadTask.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/update/task/CallableDownloadTask.html index 5440cca9e..0da9b9f9a 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/update/task/CallableDownloadTask.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/update/task/CallableDownloadTask.html @@ -9,223 +9,221 @@ 1 /* 2 * This file is part of dependency-check-core. 3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2013 Jeremy Long. All Rights Reserved. -18 */ -19 package org.owasp.dependencycheck.data.update.task; -20 -21 import java.io.File; -22 import java.io.IOException; -23 import java.net.URL; -24 import java.util.concurrent.Callable; -25 import java.util.concurrent.ExecutorService; -26 import java.util.concurrent.Future; -27 import java.util.logging.Level; -28 import java.util.logging.Logger; -29 import org.owasp.dependencycheck.data.nvdcve.CveDB; -30 import org.owasp.dependencycheck.data.update.NvdCveInfo; -31 import org.owasp.dependencycheck.utils.DownloadFailedException; -32 import org.owasp.dependencycheck.utils.Downloader; -33 -34 /** -35 * A callable object to download two files. -36 * -37 * @author Jeremy Long <jeremy.long@owasp.org> -38 */ -39 public class CallableDownloadTask implements Callable<Future<ProcessTask>> { -40 -41 /** -42 * Simple constructor for the callable download task. -43 * -44 * @param nvdCveInfo the NVD CVE info -45 * @param processor the processor service to submit the downloaded files to -46 * @param cveDB the CVE DB to use to store the vulnerability data -47 */ -48 public CallableDownloadTask(NvdCveInfo nvdCveInfo, ExecutorService processor, CveDB cveDB) { -49 this.nvdCveInfo = nvdCveInfo; -50 this.processorService = processor; -51 this.cveDB = cveDB; -52 -53 final File file1; -54 final File file2; -55 -56 -57 try { -58 file1 = File.createTempFile("cve" + nvdCveInfo.getId() + "_", ".xml"); -59 file2 = File.createTempFile("cve_1_2_" + nvdCveInfo.getId() + "_", ".xml"); -60 } catch (IOException ex) { -61 return; -62 } -63 this.first = file1; -64 this.second = file2; -65 -66 } -67 /** -68 * The CVE DB to use when processing the files. -69 */ -70 private CveDB cveDB; -71 /** -72 * The processor service to pass the results of the download to. -73 */ -74 private ExecutorService processorService; -75 /** -76 * The NVD CVE Meta Data. -77 */ -78 private NvdCveInfo nvdCveInfo; -79 -80 /** -81 * Get the value of nvdCveInfo. -82 * -83 * @return the value of nvdCveInfo -84 */ -85 public NvdCveInfo getNvdCveInfo() { -86 return nvdCveInfo; -87 } -88 -89 /** -90 * Set the value of nvdCveInfo. -91 * -92 * @param nvdCveInfo new value of nvdCveInfo -93 */ -94 public void setNvdCveInfo(NvdCveInfo nvdCveInfo) { -95 this.nvdCveInfo = nvdCveInfo; -96 } -97 /** -98 * a file. -99 */ -100 private File first; -101 -102 /** -103 * Get the value of first. -104 * -105 * @return the value of first -106 */ -107 public File getFirst() { -108 return first; -109 } -110 -111 /** -112 * Set the value of first. -113 * -114 * @param first new value of first -115 */ -116 public void setFirst(File first) { -117 this.first = first; -118 } -119 /** -120 * a file. -121 */ -122 private File second; -123 -124 /** -125 * Get the value of second. -126 * -127 * @return the value of second -128 */ -129 public File getSecond() { -130 return second; -131 } -132 -133 /** -134 * Set the value of second. -135 * -136 * @param second new value of second -137 */ -138 public void setSecond(File second) { -139 this.second = second; -140 } -141 /** -142 * A placeholder for an exception. -143 */ -144 private Exception exception = null; -145 -146 /** -147 * Get the value of exception. -148 * -149 * @return the value of exception -150 */ -151 public Exception getException() { -152 return exception; -153 } -154 -155 /** -156 * returns whether or not an exception occurred during download. -157 * -158 * @return whether or not an exception occurred during download -159 */ -160 public boolean hasException() { -161 return exception != null; -162 } -163 -164 @Override -165 public Future<ProcessTask> call() throws Exception { -166 try { -167 final URL url1 = new URL(nvdCveInfo.getUrl()); -168 final URL url2 = new URL(nvdCveInfo.getOldSchemaVersionUrl()); -169 String msg = String.format("Download Started for NVD CVE - %s", nvdCveInfo.getId()); -170 Logger.getLogger(CallableDownloadTask.class.getName()).log(Level.INFO, msg); -171 try { -172 Downloader.fetchFile(url1, first); -173 Downloader.fetchFile(url2, second); -174 } catch (DownloadFailedException ex) { -175 msg = String.format("Download Failed for NVD CVE - %s%nSome CVEs may not be reported.", nvdCveInfo.getId()); -176 Logger.getLogger(CallableDownloadTask.class.getName()).log(Level.WARNING, msg); -177 Logger.getLogger(CallableDownloadTask.class.getName()).log(Level.FINE, null, ex); -178 return null; -179 } -180 -181 msg = String.format("Download Complete for NVD CVE - %s", nvdCveInfo.getId()); -182 Logger.getLogger(CallableDownloadTask.class.getName()).log(Level.INFO, msg); -183 -184 final ProcessTask task = new ProcessTask(cveDB, this); -185 return this.processorService.submit(task); -186 -187 } catch (Throwable ex) { -188 final String msg = String.format("An exception occurred downloading NVD CVE - %s%nSome CVEs may not be reported.", nvdCveInfo.getId()); -189 Logger.getLogger(CallableDownloadTask.class.getName()).log(Level.WARNING, msg); -190 Logger.getLogger(CallableDownloadTask.class.getName()).log(Level.FINE, "Download Task Failed", ex); -191 } -192 return null; -193 } -194 -195 /** -196 * Attempts to delete the files that were downloaded. -197 */ -198 public void cleanup() { -199 boolean deleted = false; -200 try { -201 if (first != null && first.exists()) { -202 deleted = first.delete(); -203 } -204 } finally { -205 if (first != null && (first.exists() || !deleted)) { -206 first.deleteOnExit(); -207 } -208 } -209 try { -210 deleted = false; -211 if (second != null && second.exists()) { -212 deleted = second.delete(); -213 } -214 } finally { -215 if (second != null && (second.exists() || !deleted)) { -216 second.deleteOnExit(); -217 } -218 } -219 } -220 } +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2013 Jeremy Long. All Rights Reserved. +17 */ +18 package org.owasp.dependencycheck.data.update.task; +19 +20 import java.io.File; +21 import java.io.IOException; +22 import java.net.URL; +23 import java.util.concurrent.Callable; +24 import java.util.concurrent.ExecutorService; +25 import java.util.concurrent.Future; +26 import java.util.logging.Level; +27 import java.util.logging.Logger; +28 import org.owasp.dependencycheck.data.nvdcve.CveDB; +29 import org.owasp.dependencycheck.data.update.NvdCveInfo; +30 import org.owasp.dependencycheck.utils.DownloadFailedException; +31 import org.owasp.dependencycheck.utils.Downloader; +32 +33 /** +34 * A callable object to download two files. +35 * +36 * @author Jeremy Long <jeremy.long@owasp.org> +37 */ +38 public class CallableDownloadTask implements Callable<Future<ProcessTask>> { +39 +40 /** +41 * Simple constructor for the callable download task. +42 * +43 * @param nvdCveInfo the NVD CVE info +44 * @param processor the processor service to submit the downloaded files to +45 * @param cveDB the CVE DB to use to store the vulnerability data +46 */ +47 public CallableDownloadTask(NvdCveInfo nvdCveInfo, ExecutorService processor, CveDB cveDB) { +48 this.nvdCveInfo = nvdCveInfo; +49 this.processorService = processor; +50 this.cveDB = cveDB; +51 +52 final File file1; +53 final File file2; +54 +55 try { +56 file1 = File.createTempFile("cve" + nvdCveInfo.getId() + "_", ".xml"); +57 file2 = File.createTempFile("cve_1_2_" + nvdCveInfo.getId() + "_", ".xml"); +58 } catch (IOException ex) { +59 return; +60 } +61 this.first = file1; +62 this.second = file2; +63 +64 } +65 /** +66 * The CVE DB to use when processing the files. +67 */ +68 private CveDB cveDB; +69 /** +70 * The processor service to pass the results of the download to. +71 */ +72 private ExecutorService processorService; +73 /** +74 * The NVD CVE Meta Data. +75 */ +76 private NvdCveInfo nvdCveInfo; +77 +78 /** +79 * Get the value of nvdCveInfo. +80 * +81 * @return the value of nvdCveInfo +82 */ +83 public NvdCveInfo getNvdCveInfo() { +84 return nvdCveInfo; +85 } +86 +87 /** +88 * Set the value of nvdCveInfo. +89 * +90 * @param nvdCveInfo new value of nvdCveInfo +91 */ +92 public void setNvdCveInfo(NvdCveInfo nvdCveInfo) { +93 this.nvdCveInfo = nvdCveInfo; +94 } +95 /** +96 * a file. +97 */ +98 private File first; +99 +100 /** +101 * Get the value of first. +102 * +103 * @return the value of first +104 */ +105 public File getFirst() { +106 return first; +107 } +108 +109 /** +110 * Set the value of first. +111 * +112 * @param first new value of first +113 */ +114 public void setFirst(File first) { +115 this.first = first; +116 } +117 /** +118 * a file. +119 */ +120 private File second; +121 +122 /** +123 * Get the value of second. +124 * +125 * @return the value of second +126 */ +127 public File getSecond() { +128 return second; +129 } +130 +131 /** +132 * Set the value of second. +133 * +134 * @param second new value of second +135 */ +136 public void setSecond(File second) { +137 this.second = second; +138 } +139 /** +140 * A placeholder for an exception. +141 */ +142 private Exception exception = null; +143 +144 /** +145 * Get the value of exception. +146 * +147 * @return the value of exception +148 */ +149 public Exception getException() { +150 return exception; +151 } +152 +153 /** +154 * returns whether or not an exception occurred during download. +155 * +156 * @return whether or not an exception occurred during download +157 */ +158 public boolean hasException() { +159 return exception != null; +160 } +161 +162 @Override +163 public Future<ProcessTask> call() throws Exception { +164 try { +165 final URL url1 = new URL(nvdCveInfo.getUrl()); +166 final URL url2 = new URL(nvdCveInfo.getOldSchemaVersionUrl()); +167 String msg = String.format("Download Started for NVD CVE - %s", nvdCveInfo.getId()); +168 Logger.getLogger(CallableDownloadTask.class.getName()).log(Level.INFO, msg); +169 try { +170 Downloader.fetchFile(url1, first); +171 Downloader.fetchFile(url2, second); +172 } catch (DownloadFailedException ex) { +173 msg = String.format("Download Failed for NVD CVE - %s%nSome CVEs may not be reported.", nvdCveInfo.getId()); +174 Logger.getLogger(CallableDownloadTask.class.getName()).log(Level.WARNING, msg); +175 Logger.getLogger(CallableDownloadTask.class.getName()).log(Level.FINE, null, ex); +176 return null; +177 } +178 +179 msg = String.format("Download Complete for NVD CVE - %s", nvdCveInfo.getId()); +180 Logger.getLogger(CallableDownloadTask.class.getName()).log(Level.INFO, msg); +181 +182 final ProcessTask task = new ProcessTask(cveDB, this); +183 return this.processorService.submit(task); +184 +185 } catch (Throwable ex) { +186 final String msg = String.format("An exception occurred downloading NVD CVE - %s%nSome CVEs may not be reported.", nvdCveInfo.getId()); +187 Logger.getLogger(CallableDownloadTask.class.getName()).log(Level.WARNING, msg); +188 Logger.getLogger(CallableDownloadTask.class.getName()).log(Level.FINE, "Download Task Failed", ex); +189 } +190 return null; +191 } +192 +193 /** +194 * Attempts to delete the files that were downloaded. +195 */ +196 public void cleanup() { +197 boolean deleted = false; +198 try { +199 if (first != null && first.exists()) { +200 deleted = first.delete(); +201 } +202 } finally { +203 if (first != null && (first.exists() || !deleted)) { +204 first.deleteOnExit(); +205 } +206 } +207 try { +208 deleted = false; +209 if (second != null && second.exists()) { +210 deleted = second.delete(); +211 } +212 } finally { +213 if (second != null && (second.exists() || !deleted)) { +214 second.deleteOnExit(); +215 } +216 } +217 } +218 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/update/task/ProcessTask.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/update/task/ProcessTask.html index ab5cb2aa9..ec7c48bf2 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/update/task/ProcessTask.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/update/task/ProcessTask.html @@ -9,182 +9,176 @@ 1 /* 2 * This file is part of dependency-check-core. 3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2013 Jeremy Long. All Rights Reserved. -18 */ -19 package org.owasp.dependencycheck.data.update.task; -20 -21 import org.owasp.dependencycheck.data.update.xml.NvdCve20Handler; -22 import org.owasp.dependencycheck.data.update.xml.NvdCve12Handler; -23 import org.owasp.dependencycheck.data.update.exception.UpdateException; -24 import org.owasp.dependencycheck.data.nvdcve.DatabaseProperties; -25 import java.io.File; -26 import java.io.FileNotFoundException; -27 import java.io.IOException; -28 import java.sql.SQLException; -29 import java.util.List; -30 import java.util.Map; -31 import java.util.concurrent.Callable; -32 import java.util.logging.Level; -33 import java.util.logging.Logger; -34 import javax.xml.parsers.ParserConfigurationException; -35 import javax.xml.parsers.SAXParser; -36 import javax.xml.parsers.SAXParserFactory; -37 import org.owasp.dependencycheck.data.nvdcve.CveDB; -38 import org.owasp.dependencycheck.data.nvdcve.DatabaseException; -39 import org.owasp.dependencycheck.data.update.StandardUpdate; -40 import org.owasp.dependencycheck.dependency.VulnerableSoftware; -41 import org.xml.sax.SAXException; -42 -43 /** -44 * A callable task that will process a given set of NVD CVE xml files and update -45 * the Cve Database accordingly. -46 * -47 * @author Jeremy Long <jeremy.long@owasp.org> -48 */ -49 public class ProcessTask implements Callable<ProcessTask> { -50 -51 /** -52 * A field to store any update exceptions that occur during the "call". -53 */ -54 private UpdateException exception = null; -55 -56 /** -57 * Get the value of exception. -58 * -59 * @return the value of exception -60 */ -61 public UpdateException getException() { -62 return exception; -63 } -64 -65 /** -66 * Set the value of exception. -67 * -68 * @param exception new value of exception -69 */ -70 public void setException(UpdateException exception) { -71 this.exception = exception; -72 } -73 /** -74 * A reference to the CveDB. -75 */ -76 private final CveDB cveDB; -77 /** -78 * A reference to the callable download task. -79 */ -80 private final CallableDownloadTask filePair; -81 /** -82 * A reference to the properties. -83 */ -84 private final DatabaseProperties properties; -85 -86 /** -87 * Constructs a new ProcessTask used to process an NVD CVE update. -88 * -89 * @param cveDB the data store object -90 * @param filePair the download task that contains the URL references to -91 * download -92 */ -93 public ProcessTask(final CveDB cveDB, final CallableDownloadTask filePair) { -94 this.cveDB = cveDB; -95 this.filePair = filePair; -96 this.properties = cveDB.getDatabaseProperties(); -97 } -98 -99 /** -100 * Implements the callable interface. -101 * -102 * @return this object -103 * @throws Exception thrown if there is an exception; note that any -104 * UpdateExceptions are simply added to the tasks exception collection -105 */ -106 @Override -107 public ProcessTask call() throws Exception { -108 try { -109 processFiles(); -110 } catch (UpdateException ex) { -111 this.exception = ex; -112 } -113 return this; -114 } -115 -116 /** -117 * Imports the NVD CVE XML File into the Lucene Index. -118 * -119 * @param file the file containing the NVD CVE XML -120 * @param oldVersion contains the file containing the NVD CVE XML 1.2 -121 * @throws ParserConfigurationException is thrown if there is a parser -122 * configuration exception -123 * @throws SAXException is thrown if there is a SAXException -124 * @throws IOException is thrown if there is a IO Exception -125 * @throws SQLException is thrown if there is a SQL exception -126 * @throws DatabaseException is thrown if there is a database exception -127 * @throws ClassNotFoundException thrown if the h2 database driver cannot be -128 * loaded -129 */ -130 protected void importXML(File file, File oldVersion) throws ParserConfigurationException, -131 SAXException, IOException, SQLException, DatabaseException, ClassNotFoundException { -132 -133 final SAXParserFactory factory = SAXParserFactory.newInstance(); -134 final SAXParser saxParser = factory.newSAXParser(); -135 -136 final NvdCve12Handler cve12Handler = new NvdCve12Handler(); -137 saxParser.parse(oldVersion, cve12Handler); -138 final Map<String, List<VulnerableSoftware>> prevVersionVulnMap = cve12Handler.getVulnerabilities(); -139 -140 final NvdCve20Handler cve20Handler = new NvdCve20Handler(); -141 cve20Handler.setCveDB(cveDB); -142 cve20Handler.setPrevVersionVulnMap(prevVersionVulnMap); -143 saxParser.parse(file, cve20Handler); -144 } -145 -146 /** -147 * Processes the NVD CVE XML file and imports the data into the DB. -148 * -149 * @throws UpdateException thrown if there is an error loading the data into -150 * the database -151 */ -152 private void processFiles() throws UpdateException { -153 String msg = String.format("Processing Started for NVD CVE - %s", filePair.getNvdCveInfo().getId()); -154 Logger.getLogger(StandardUpdate.class.getName()).log(Level.INFO, msg); -155 try { -156 importXML(filePair.getFirst(), filePair.getSecond()); -157 cveDB.commit(); -158 properties.save(filePair.getNvdCveInfo()); -159 } catch (FileNotFoundException ex) { +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2013 Jeremy Long. All Rights Reserved. +17 */ +18 package org.owasp.dependencycheck.data.update.task; +19 +20 import java.io.File; +21 import java.io.FileNotFoundException; +22 import java.io.IOException; +23 import java.sql.SQLException; +24 import java.util.List; +25 import java.util.Map; +26 import java.util.concurrent.Callable; +27 import java.util.logging.Level; +28 import java.util.logging.Logger; +29 import javax.xml.parsers.ParserConfigurationException; +30 import javax.xml.parsers.SAXParser; +31 import javax.xml.parsers.SAXParserFactory; +32 import org.owasp.dependencycheck.data.nvdcve.CveDB; +33 import org.owasp.dependencycheck.data.nvdcve.DatabaseException; +34 import org.owasp.dependencycheck.data.nvdcve.DatabaseProperties; +35 import org.owasp.dependencycheck.data.update.StandardUpdate; +36 import org.owasp.dependencycheck.data.update.exception.UpdateException; +37 import org.owasp.dependencycheck.data.update.xml.NvdCve12Handler; +38 import org.owasp.dependencycheck.data.update.xml.NvdCve20Handler; +39 import org.owasp.dependencycheck.dependency.VulnerableSoftware; +40 import org.xml.sax.SAXException; +41 +42 /** +43 * A callable task that will process a given set of NVD CVE xml files and update the Cve Database accordingly. +44 * +45 * @author Jeremy Long <jeremy.long@owasp.org> +46 */ +47 public class ProcessTask implements Callable<ProcessTask> { +48 +49 /** +50 * A field to store any update exceptions that occur during the "call". +51 */ +52 private UpdateException exception = null; +53 +54 /** +55 * Get the value of exception. +56 * +57 * @return the value of exception +58 */ +59 public UpdateException getException() { +60 return exception; +61 } +62 +63 /** +64 * Set the value of exception. +65 * +66 * @param exception new value of exception +67 */ +68 public void setException(UpdateException exception) { +69 this.exception = exception; +70 } +71 /** +72 * A reference to the CveDB. +73 */ +74 private final CveDB cveDB; +75 /** +76 * A reference to the callable download task. +77 */ +78 private final CallableDownloadTask filePair; +79 /** +80 * A reference to the properties. +81 */ +82 private final DatabaseProperties properties; +83 +84 /** +85 * Constructs a new ProcessTask used to process an NVD CVE update. +86 * +87 * @param cveDB the data store object +88 * @param filePair the download task that contains the URL references to download +89 */ +90 public ProcessTask(final CveDB cveDB, final CallableDownloadTask filePair) { +91 this.cveDB = cveDB; +92 this.filePair = filePair; +93 this.properties = cveDB.getDatabaseProperties(); +94 } +95 +96 /** +97 * Implements the callable interface. +98 * +99 * @return this object +100 * @throws Exception thrown if there is an exception; note that any UpdateExceptions are simply added to the tasks +101 * exception collection +102 */ +103 @Override +104 public ProcessTask call() throws Exception { +105 try { +106 processFiles(); +107 } catch (UpdateException ex) { +108 this.exception = ex; +109 } +110 return this; +111 } +112 +113 /** +114 * Imports the NVD CVE XML File into the Lucene Index. +115 * +116 * @param file the file containing the NVD CVE XML +117 * @param oldVersion contains the file containing the NVD CVE XML 1.2 +118 * @throws ParserConfigurationException is thrown if there is a parser configuration exception +119 * @throws SAXException is thrown if there is a SAXException +120 * @throws IOException is thrown if there is a IO Exception +121 * @throws SQLException is thrown if there is a SQL exception +122 * @throws DatabaseException is thrown if there is a database exception +123 * @throws ClassNotFoundException thrown if the h2 database driver cannot be loaded +124 */ +125 protected void importXML(File file, File oldVersion) throws ParserConfigurationException, +126 SAXException, IOException, SQLException, DatabaseException, ClassNotFoundException { +127 +128 final SAXParserFactory factory = SAXParserFactory.newInstance(); +129 final SAXParser saxParser = factory.newSAXParser(); +130 +131 final NvdCve12Handler cve12Handler = new NvdCve12Handler(); +132 saxParser.parse(oldVersion, cve12Handler); +133 final Map<String, List<VulnerableSoftware>> prevVersionVulnMap = cve12Handler.getVulnerabilities(); +134 +135 final NvdCve20Handler cve20Handler = new NvdCve20Handler(); +136 cve20Handler.setCveDB(cveDB); +137 cve20Handler.setPrevVersionVulnMap(prevVersionVulnMap); +138 saxParser.parse(file, cve20Handler); +139 } +140 +141 /** +142 * Processes the NVD CVE XML file and imports the data into the DB. +143 * +144 * @throws UpdateException thrown if there is an error loading the data into the database +145 */ +146 private void processFiles() throws UpdateException { +147 String msg = String.format("Processing Started for NVD CVE - %s", filePair.getNvdCveInfo().getId()); +148 Logger.getLogger(StandardUpdate.class.getName()).log(Level.INFO, msg); +149 try { +150 importXML(filePair.getFirst(), filePair.getSecond()); +151 cveDB.commit(); +152 properties.save(filePair.getNvdCveInfo()); +153 } catch (FileNotFoundException ex) { +154 throw new UpdateException(ex); +155 } catch (ParserConfigurationException ex) { +156 throw new UpdateException(ex); +157 } catch (SAXException ex) { +158 throw new UpdateException(ex); +159 } catch (IOException ex) { 160 throw new UpdateException(ex); -161 } catch (ParserConfigurationException ex) { +161 } catch (SQLException ex) { 162 throw new UpdateException(ex); -163 } catch (SAXException ex) { +163 } catch (DatabaseException ex) { 164 throw new UpdateException(ex); -165 } catch (IOException ex) { +165 } catch (ClassNotFoundException ex) { 166 throw new UpdateException(ex); -167 } catch (SQLException ex) { -168 throw new UpdateException(ex); -169 } catch (DatabaseException ex) { -170 throw new UpdateException(ex); -171 } catch (ClassNotFoundException ex) { -172 throw new UpdateException(ex); -173 } finally { -174 filePair.cleanup(); -175 } -176 msg = String.format("Processing Complete for NVD CVE - %s", filePair.getNvdCveInfo().getId()); -177 Logger.getLogger(StandardUpdate.class.getName()).log(Level.INFO, msg); -178 } -179 } +167 } finally { +168 filePair.cleanup(); +169 } +170 msg = String.format("Processing Complete for NVD CVE - %s", filePair.getNvdCveInfo().getId()); +171 Logger.getLogger(StandardUpdate.class.getName()).log(Level.INFO, msg); +172 } +173 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/update/task/package-frame.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/update/task/package-frame.html index eb167efce..c7168dea8 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/update/task/package-frame.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/update/task/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.0.8 Reference Package org.owasp.dependencycheck.data.update.task + Dependency-Check Core 1.1.0 Reference Package org.owasp.dependencycheck.data.update.task diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/update/task/package-summary.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/update/task/package-summary.html index 9ef0362d2..e7eb7e77a 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/update/task/package-summary.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/update/task/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.0.8 Reference Package org.owasp.dependencycheck.data.update.task + Dependency-Check Core 1.1.0 Reference Package org.owasp.dependencycheck.data.update.task diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/update/xml/NvdCve12Handler.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/update/xml/NvdCve12Handler.html index b80e955b2..8114f5fc6 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/update/xml/NvdCve12Handler.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/update/xml/NvdCve12Handler.html @@ -9,250 +9,246 @@ 1 /* 2 * This file is part of dependency-check-core. 3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. -18 */ -19 package org.owasp.dependencycheck.data.update.xml; -20 -21 import java.util.ArrayList; -22 import java.util.HashMap; -23 import java.util.List; -24 import java.util.Map; -25 import org.owasp.dependencycheck.dependency.VulnerableSoftware; -26 import org.xml.sax.Attributes; -27 import org.xml.sax.SAXException; -28 import org.xml.sax.SAXNotSupportedException; -29 import org.xml.sax.helpers.DefaultHandler; -30 -31 /** -32 * A SAX Handler that will parse the NVD CVE XML (schema version 1.2). This -33 * parses the xml and retrieves a listing of CPEs that have previous versions -34 * specified. The previous version information is not in the 2.0 version of the -35 * schema and is useful to ensure accurate identification (or at least -36 * complete). -37 * -38 * @author Jeremy Long <jeremy.long@owasp.org> -39 */ -40 public class NvdCve12Handler extends DefaultHandler { -41 -42 /** -43 * the supported schema version. -44 */ -45 private static final String CURRENT_SCHEMA_VERSION = "1.2"; -46 /** -47 * the current vulnerability. -48 */ -49 private String vulnerability; -50 /** -51 * a list of vulnerable software. -52 */ -53 private List<VulnerableSoftware> software; -54 /** -55 * the vendor name. -56 */ -57 private String vendor; -58 /** -59 * the product name. -60 */ -61 private String product; -62 /** -63 * if the nvd cve should be skipped because it was rejected. -64 */ -65 private boolean skip = false; -66 /** -67 * flag indicating if there is a previous version. -68 */ -69 private boolean hasPreviousVersion = false; -70 /** -71 * The current element. -72 */ -73 private final Element current = new Element(); -74 /** -75 * a map of vulnerabilities. -76 */ -77 private Map<String, List<VulnerableSoftware>> vulnerabilities; -78 -79 /** -80 * Get the value of vulnerabilities. -81 * -82 * @return the value of vulnerabilities -83 */ -84 public Map<String, List<VulnerableSoftware>> getVulnerabilities() { -85 return vulnerabilities; -86 } -87 -88 @Override -89 public void startElement(String uri, String localName, String qName, Attributes attributes) throws SAXException { -90 current.setNode(qName); -91 if (current.isEntryNode()) { -92 vendor = null; -93 product = null; -94 hasPreviousVersion = false; -95 final String reject = attributes.getValue("reject"); -96 skip = "1".equals(reject); -97 if (!skip) { -98 vulnerability = attributes.getValue("name"); -99 software = new ArrayList<VulnerableSoftware>(); -100 } else { -101 vulnerability = null; -102 software = null; -103 } -104 } else if (!skip && current.isProdNode()) { -105 -106 vendor = attributes.getValue("vendor"); -107 product = attributes.getValue("name"); -108 } else if (!skip && current.isVersNode()) { -109 final String prev = attributes.getValue("prev"); -110 if (prev != null && "1".equals(prev)) { -111 hasPreviousVersion = true; -112 final String edition = attributes.getValue("edition"); -113 final String num = attributes.getValue("num"); -114 -115 /*yes yes, this may not actually be an "a" - it could be an OS, etc. but for our -116 purposes this is good enough as we won't use this if we don't find a corresponding "a" -117 in the nvd cve 2.0. */ -118 String cpe = "cpe:/a:" + vendor + ":" + product; -119 if (num != null) { -120 cpe += ":" + num; +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. +17 */ +18 package org.owasp.dependencycheck.data.update.xml; +19 +20 import java.util.ArrayList; +21 import java.util.HashMap; +22 import java.util.List; +23 import java.util.Map; +24 import org.owasp.dependencycheck.dependency.VulnerableSoftware; +25 import org.xml.sax.Attributes; +26 import org.xml.sax.SAXException; +27 import org.xml.sax.SAXNotSupportedException; +28 import org.xml.sax.helpers.DefaultHandler; +29 +30 /** +31 * A SAX Handler that will parse the NVD CVE XML (schema version 1.2). This parses the xml and retrieves a listing of +32 * CPEs that have previous versions specified. The previous version information is not in the 2.0 version of the schema +33 * and is useful to ensure accurate identification (or at least complete). +34 * +35 * @author Jeremy Long <jeremy.long@owasp.org> +36 */ +37 public class NvdCve12Handler extends DefaultHandler { +38 +39 /** +40 * the supported schema version. +41 */ +42 private static final String CURRENT_SCHEMA_VERSION = "1.2"; +43 /** +44 * the current vulnerability. +45 */ +46 private String vulnerability; +47 /** +48 * a list of vulnerable software. +49 */ +50 private List<VulnerableSoftware> software; +51 /** +52 * the vendor name. +53 */ +54 private String vendor; +55 /** +56 * the product name. +57 */ +58 private String product; +59 /** +60 * if the nvd cve should be skipped because it was rejected. +61 */ +62 private boolean skip = false; +63 /** +64 * flag indicating if there is a previous version. +65 */ +66 private boolean hasPreviousVersion = false; +67 /** +68 * The current element. +69 */ +70 private final Element current = new Element(); +71 /** +72 * a map of vulnerabilities. +73 */ +74 private Map<String, List<VulnerableSoftware>> vulnerabilities; +75 +76 /** +77 * Get the value of vulnerabilities. +78 * +79 * @return the value of vulnerabilities +80 */ +81 public Map<String, List<VulnerableSoftware>> getVulnerabilities() { +82 return vulnerabilities; +83 } +84 +85 @Override +86 public void startElement(String uri, String localName, String qName, Attributes attributes) throws SAXException { +87 current.setNode(qName); +88 if (current.isEntryNode()) { +89 vendor = null; +90 product = null; +91 hasPreviousVersion = false; +92 final String reject = attributes.getValue("reject"); +93 skip = "1".equals(reject); +94 if (!skip) { +95 vulnerability = attributes.getValue("name"); +96 software = new ArrayList<VulnerableSoftware>(); +97 } else { +98 vulnerability = null; +99 software = null; +100 } +101 } else if (!skip && current.isProdNode()) { +102 +103 vendor = attributes.getValue("vendor"); +104 product = attributes.getValue("name"); +105 } else if (!skip && current.isVersNode()) { +106 final String prev = attributes.getValue("prev"); +107 if (prev != null && "1".equals(prev)) { +108 hasPreviousVersion = true; +109 final String edition = attributes.getValue("edition"); +110 final String num = attributes.getValue("num"); +111 +112 /*yes yes, this may not actually be an "a" - it could be an OS, etc. but for our +113 purposes this is good enough as we won't use this if we don't find a corresponding "a" +114 in the nvd cve 2.0. */ +115 String cpe = "cpe:/a:" + vendor + ":" + product; +116 if (num != null) { +117 cpe += ":" + num; +118 } +119 if (edition != null) { +120 cpe += ":" + edition; 121 } -122 if (edition != null) { -123 cpe += ":" + edition; -124 } -125 final VulnerableSoftware vs = new VulnerableSoftware(); -126 vs.setCpe(cpe); -127 vs.setPreviousVersion(prev); -128 software.add(vs); -129 } -130 } else if (current.isNVDNode()) { -131 final String nvdVer = attributes.getValue("nvd_xml_version"); -132 if (!CURRENT_SCHEMA_VERSION.equals(nvdVer)) { -133 throw new SAXNotSupportedException("Schema version " + nvdVer + " is not supported"); -134 } -135 vulnerabilities = new HashMap<String, List<VulnerableSoftware>>(); -136 } -137 } -138 -139 @Override -140 public void endElement(String uri, String localName, String qName) throws SAXException { -141 current.setNode(qName); -142 if (current.isEntryNode()) { -143 if (!skip && hasPreviousVersion) { -144 vulnerabilities.put(vulnerability, software); -145 } -146 vulnerability = null; -147 software = null; -148 } -149 } -150 -151 // <editor-fold defaultstate="collapsed" desc="The Element Class that maintains state information about the current node"> -152 /** -153 * A simple class to maintain information about the current element while -154 * parsing the NVD CVE XML. -155 */ -156 protected static class Element { -157 +122 final VulnerableSoftware vs = new VulnerableSoftware(); +123 vs.setCpe(cpe); +124 vs.setPreviousVersion(prev); +125 software.add(vs); +126 } +127 } else if (current.isNVDNode()) { +128 final String nvdVer = attributes.getValue("nvd_xml_version"); +129 if (!CURRENT_SCHEMA_VERSION.equals(nvdVer)) { +130 throw new SAXNotSupportedException("Schema version " + nvdVer + " is not supported"); +131 } +132 vulnerabilities = new HashMap<String, List<VulnerableSoftware>>(); +133 } +134 } +135 +136 @Override +137 public void endElement(String uri, String localName, String qName) throws SAXException { +138 current.setNode(qName); +139 if (current.isEntryNode()) { +140 if (!skip && hasPreviousVersion) { +141 vulnerabilities.put(vulnerability, software); +142 } +143 vulnerability = null; +144 software = null; +145 } +146 } +147 +148 // <editor-fold defaultstate="collapsed" desc="The Element Class that maintains state information about the current node"> +149 /** +150 * A simple class to maintain information about the current element while parsing the NVD CVE XML. +151 */ +152 protected static class Element { +153 +154 /** +155 * A node type in the NVD CVE Schema 1.2. +156 */ +157 public static final String NVD = "nvd"; 158 /** 159 * A node type in the NVD CVE Schema 1.2. 160 */ -161 public static final String NVD = "nvd"; +161 public static final String ENTRY = "entry"; 162 /** 163 * A node type in the NVD CVE Schema 1.2. 164 */ -165 public static final String ENTRY = "entry"; +165 public static final String VULN_SOFTWARE = "vuln_soft"; 166 /** 167 * A node type in the NVD CVE Schema 1.2. 168 */ -169 public static final String VULN_SOFTWARE = "vuln_soft"; +169 public static final String PROD = "prod"; 170 /** 171 * A node type in the NVD CVE Schema 1.2. 172 */ -173 public static final String PROD = "prod"; +173 public static final String VERS = "vers"; 174 /** -175 * A node type in the NVD CVE Schema 1.2. +175 * The name of the current node. 176 */ -177 public static final String VERS = "vers"; -178 /** -179 * The name of the current node. -180 */ -181 private String node; -182 -183 /** -184 * Gets the value of node. -185 * -186 * @return the value of node -187 */ -188 public String getNode() { -189 return this.node; -190 } -191 -192 /** -193 * Sets the value of node. -194 * -195 * @param node new value of node -196 */ -197 public void setNode(String node) { -198 this.node = node; -199 } -200 -201 /** -202 * Checks if the handler is at the NVD node. -203 * -204 * @return true or false -205 */ -206 public boolean isNVDNode() { -207 return NVD.equals(node); -208 } -209 -210 /** -211 * Checks if the handler is at the ENTRY node. -212 * -213 * @return true or false -214 */ -215 public boolean isEntryNode() { -216 return ENTRY.equals(node); -217 } -218 -219 /** -220 * Checks if the handler is at the VULN_SOFTWARE node. -221 * -222 * @return true or false -223 */ -224 public boolean isVulnSoftwareNode() { -225 return VULN_SOFTWARE.equals(node); -226 } -227 -228 /** -229 * Checks if the handler is at the PROD node. -230 * -231 * @return true or false -232 */ -233 public boolean isProdNode() { -234 return PROD.equals(node); -235 } -236 -237 /** -238 * Checks if the handler is at the VERS node. -239 * -240 * @return true or false -241 */ -242 public boolean isVersNode() { -243 return VERS.equals(node); -244 } -245 } -246 // </editor-fold> -247 } +177 private String node; +178 +179 /** +180 * Gets the value of node. +181 * +182 * @return the value of node +183 */ +184 public String getNode() { +185 return this.node; +186 } +187 +188 /** +189 * Sets the value of node. +190 * +191 * @param node new value of node +192 */ +193 public void setNode(String node) { +194 this.node = node; +195 } +196 +197 /** +198 * Checks if the handler is at the NVD node. +199 * +200 * @return true or false +201 */ +202 public boolean isNVDNode() { +203 return NVD.equals(node); +204 } +205 +206 /** +207 * Checks if the handler is at the ENTRY node. +208 * +209 * @return true or false +210 */ +211 public boolean isEntryNode() { +212 return ENTRY.equals(node); +213 } +214 +215 /** +216 * Checks if the handler is at the VULN_SOFTWARE node. +217 * +218 * @return true or false +219 */ +220 public boolean isVulnSoftwareNode() { +221 return VULN_SOFTWARE.equals(node); +222 } +223 +224 /** +225 * Checks if the handler is at the PROD node. +226 * +227 * @return true or false +228 */ +229 public boolean isProdNode() { +230 return PROD.equals(node); +231 } +232 +233 /** +234 * Checks if the handler is at the VERS node. +235 * +236 * @return true or false +237 */ +238 public boolean isVersNode() { +239 return VERS.equals(node); +240 } +241 } +242 // </editor-fold> +243 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/update/xml/NvdCve20Handler.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/update/xml/NvdCve20Handler.html index 1ad87a252..fe761212b 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/update/xml/NvdCve20Handler.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/update/xml/NvdCve20Handler.html @@ -9,499 +9,494 @@ 1 /* 2 * This file is part of dependency-check-core. 3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. -18 */ -19 package org.owasp.dependencycheck.data.update.xml; -20 -21 import java.io.IOException; -22 import java.util.List; -23 import java.util.Map; -24 import java.util.logging.Level; -25 import java.util.logging.Logger; -26 import org.apache.lucene.index.CorruptIndexException; -27 import org.owasp.dependencycheck.data.nvdcve.CveDB; -28 import org.owasp.dependencycheck.data.nvdcve.DatabaseException; -29 import org.owasp.dependencycheck.dependency.Reference; -30 import org.owasp.dependencycheck.dependency.Vulnerability; -31 import org.owasp.dependencycheck.dependency.VulnerableSoftware; -32 import org.xml.sax.Attributes; -33 import org.xml.sax.SAXException; -34 import org.xml.sax.SAXNotSupportedException; -35 import org.xml.sax.helpers.DefaultHandler; -36 -37 /** -38 * A SAX Handler that will parse the NVD CVE XML (schema version 2.0). -39 * -40 * @author Jeremy Long <jeremy.long@owasp.org> -41 */ -42 public class NvdCve20Handler extends DefaultHandler { -43 -44 /** -45 * the current supported schema version. -46 */ -47 private static final String CURRENT_SCHEMA_VERSION = "2.0"; -48 /** -49 * the current element. -50 */ -51 private final Element current = new Element(); -52 /** -53 * the text of the node. -54 */ -55 private StringBuilder nodeText; -56 /** -57 * the vulnerability. -58 */ -59 private Vulnerability vulnerability; -60 /** -61 * a reference for the cve. -62 */ -63 private Reference reference; -64 /** -65 * flag indicating whether the application has a cpe. -66 */ -67 private boolean hasApplicationCpe = false; -68 /** -69 * The total number of entries parsed. -70 */ -71 private int totalNumberOfEntries; -72 -73 /** -74 * Get the value of totalNumberOfEntries. -75 * -76 * @return the value of totalNumberOfEntries -77 */ -78 public int getTotalNumberOfEntries() { -79 return totalNumberOfEntries; -80 } -81 /** -82 * The total number of application entries parsed. -83 */ -84 private int totalNumberOfApplicationEntries; -85 -86 /** -87 * Get the value of totalNumberOfApplicationEntries. -88 * -89 * @return the value of totalNumberOfApplicationEntries -90 */ -91 public int getTotalNumberOfApplicationEntries() { -92 return totalNumberOfApplicationEntries; -93 } -94 -95 @Override -96 public void startElement(String uri, String localName, String qName, Attributes attributes) throws SAXException { -97 current.setNode(qName); -98 if (current.isEntryNode()) { -99 hasApplicationCpe = false; -100 vulnerability = new Vulnerability(); -101 vulnerability.setName(attributes.getValue("id")); -102 } else if (current.isVulnProductNode()) { -103 nodeText = new StringBuilder(100); -104 } else if (current.isVulnReferencesNode()) { -105 final String lang = attributes.getValue("xml:lang"); -106 if ("en".equals(lang)) { -107 reference = new Reference(); -108 } else { -109 reference = null; -110 } -111 } else if (reference != null && current.isVulnReferenceNode()) { -112 reference.setUrl(attributes.getValue("href")); -113 nodeText = new StringBuilder(130); -114 } else if (reference != null && current.isVulnSourceNode()) { -115 nodeText = new StringBuilder(30); -116 } else if (current.isVulnSummaryNode()) { -117 nodeText = new StringBuilder(500); -118 } else if (current.isNVDNode()) { -119 final String nvdVer = attributes.getValue("nvd_xml_version"); -120 if (!CURRENT_SCHEMA_VERSION.equals(nvdVer)) { -121 throw new SAXNotSupportedException("Schema version " + nvdVer + " is not supported"); -122 } -123 } else if (current.isVulnCWENode()) { -124 vulnerability.setCwe(attributes.getValue("id")); -125 } else if (current.isCVSSScoreNode()) { -126 nodeText = new StringBuilder(5); -127 } else if (current.isCVSSAccessVectorNode()) { -128 nodeText = new StringBuilder(20); -129 } else if (current.isCVSSAccessComplexityNode()) { -130 nodeText = new StringBuilder(20); -131 } else if (current.isCVSSAuthenticationNode()) { -132 nodeText = new StringBuilder(20); -133 } else if (current.isCVSSAvailabilityImpactNode()) { -134 nodeText = new StringBuilder(20); -135 } else if (current.isCVSSConfidentialityImpactNode()) { -136 nodeText = new StringBuilder(20); -137 } else if (current.isCVSSIntegrityImpactNode()) { -138 nodeText = new StringBuilder(20); -139 } -140 } -141 -142 @Override -143 public void characters(char[] ch, int start, int length) throws SAXException { -144 if (nodeText != null) { -145 nodeText.append(ch, start, length); -146 } -147 } -148 -149 @Override -150 public void endElement(String uri, String localName, String qName) throws SAXException { -151 current.setNode(qName); -152 if (current.isEntryNode()) { -153 totalNumberOfEntries += 1; -154 if (hasApplicationCpe) { -155 totalNumberOfApplicationEntries += 1; -156 try { -157 saveEntry(vulnerability); -158 } catch (DatabaseException ex) { -159 throw new SAXException(ex); -160 } catch (CorruptIndexException ex) { -161 throw new SAXException(ex); -162 } catch (IOException ex) { -163 throw new SAXException(ex); -164 } -165 } -166 vulnerability = null; -167 } else if (current.isCVSSScoreNode()) { -168 try { -169 final float score = Float.parseFloat(nodeText.toString()); -170 vulnerability.setCvssScore(score); -171 } catch (NumberFormatException ex) { -172 Logger.getLogger(NvdCve20Handler.class.getName()).log(Level.SEVERE, "Error parsing CVSS Score."); -173 Logger.getLogger(NvdCve20Handler.class.getName()).log(Level.FINE, null, ex); -174 } -175 nodeText = null; -176 } else if (current.isCVSSAccessVectorNode()) { -177 vulnerability.setCvssAccessVector(nodeText.toString()); -178 nodeText = null; -179 } else if (current.isCVSSAccessComplexityNode()) { -180 vulnerability.setCvssAccessComplexity(nodeText.toString()); -181 nodeText = null; -182 } else if (current.isCVSSAuthenticationNode()) { -183 vulnerability.setCvssAuthentication(nodeText.toString()); -184 nodeText = null; -185 } else if (current.isCVSSAvailabilityImpactNode()) { -186 vulnerability.setCvssAvailabilityImpact(nodeText.toString()); -187 nodeText = null; -188 } else if (current.isCVSSConfidentialityImpactNode()) { -189 vulnerability.setCvssConfidentialityImpact(nodeText.toString()); -190 nodeText = null; -191 } else if (current.isCVSSIntegrityImpactNode()) { -192 vulnerability.setCvssIntegrityImpact(nodeText.toString()); -193 nodeText = null; -194 } else if (current.isVulnProductNode()) { -195 final String cpe = nodeText.toString(); -196 if (cpe.startsWith("cpe:/a:")) { -197 hasApplicationCpe = true; -198 vulnerability.addVulnerableSoftware(cpe); -199 } -200 nodeText = null; -201 } else if (reference != null && current.isVulnReferencesNode()) { -202 vulnerability.addReference(reference); -203 reference = null; -204 } else if (reference != null && current.isVulnReferenceNode()) { -205 reference.setName(nodeText.toString()); -206 nodeText = null; -207 } else if (reference != null && current.isVulnSourceNode()) { -208 reference.setSource(nodeText.toString()); -209 nodeText = null; -210 } else if (current.isVulnSummaryNode()) { -211 vulnerability.setDescription(nodeText.toString()); -212 if (nodeText.indexOf("** REJECT **") >= 0) { -213 hasApplicationCpe = true; //ensure we process this to delete the vuln -214 } -215 nodeText = null; -216 } -217 } -218 /** -219 * the cve database. -220 */ -221 private CveDB cveDB; -222 -223 /** -224 * Sets the cveDB. -225 * -226 * @param db a reference to the CveDB -227 */ -228 public void setCveDB(CveDB db) { -229 cveDB = db; -230 } -231 /** -232 * A list of CVE entries and associated VulnerableSoftware entries that -233 * contain previous entries. -234 */ -235 private Map<String, List<VulnerableSoftware>> prevVersionVulnMap; -236 -237 /** -238 * Sets the prevVersionVulnMap. -239 * -240 * @param map the map of vulnerable software with previous versions being -241 * vulnerable -242 */ -243 public void setPrevVersionVulnMap(Map<String, List<VulnerableSoftware>> map) { -244 prevVersionVulnMap = map; -245 } -246 -247 /** -248 * Saves a vulnerability to the CVE Database. -249 * -250 * @param vuln the vulnerability to store in the database -251 * @throws DatabaseException thrown if there is an error writing to the -252 * database -253 * @throws CorruptIndexException is thrown if the CPE Index is corrupt -254 * @throws IOException thrown if there is an IOException with the CPE Index -255 */ -256 private void saveEntry(Vulnerability vuln) throws DatabaseException, CorruptIndexException, IOException { -257 if (cveDB == null) { -258 return; -259 } -260 final String cveName = vuln.getName(); -261 if (prevVersionVulnMap.containsKey(cveName)) { -262 final List<VulnerableSoftware> vulnSoftware = prevVersionVulnMap.get(cveName); -263 for (VulnerableSoftware vs : vulnSoftware) { -264 vuln.updateVulnerableSoftware(vs); -265 } -266 } -267 cveDB.updateVulnerability(vuln); -268 } -269 -270 // <editor-fold defaultstate="collapsed" desc="The Element Class that maintains state information about the current node"> -271 /** -272 * A simple class to maintain information about the current element while -273 * parsing the NVD CVE XML. -274 */ -275 protected static class Element { -276 -277 /** -278 * A node type in the NVD CVE Schema 2.0 -279 */ -280 public static final String NVD = "nvd"; -281 /** -282 * A node type in the NVD CVE Schema 2.0 -283 */ -284 public static final String ENTRY = "entry"; -285 /** -286 * A node type in the NVD CVE Schema 2.0 -287 */ -288 public static final String VULN_PRODUCT = "vuln:product"; -289 /** -290 * A node type in the NVD CVE Schema 2.0 -291 */ -292 public static final String VULN_REFERENCES = "vuln:references"; -293 /** -294 * A node type in the NVD CVE Schema 2.0 -295 */ -296 public static final String VULN_SOURCE = "vuln:source"; -297 /** -298 * A node type in the NVD CVE Schema 2.0 -299 */ -300 public static final String VULN_REFERENCE = "vuln:reference"; -301 /** -302 * A node type in the NVD CVE Schema 2.0 -303 */ -304 public static final String VULN_SUMMARY = "vuln:summary"; -305 /** -306 * A node type in the NVD CVE Schema 2.0 -307 */ -308 public static final String VULN_CWE = "vuln:cwe"; -309 /** -310 * A node type in the NVD CVE Schema 2.0 -311 */ -312 public static final String CVSS_SCORE = "cvss:score"; -313 /** -314 * A node type in the NVD CVE Schema 2.0 -315 */ -316 public static final String CVSS_ACCESS_VECTOR = "cvss:access-vector"; -317 /** -318 * A node type in the NVD CVE Schema 2.0 -319 */ -320 public static final String CVSS_ACCESS_COMPLEXITY = "cvss:access-complexity"; -321 /** -322 * A node type in the NVD CVE Schema 2.0 -323 */ -324 public static final String CVSS_AUTHENTICATION = "cvss:authentication"; -325 /** -326 * A node type in the NVD CVE Schema 2.0 -327 */ -328 public static final String CVSS_CONFIDENTIALITY_IMPACT = "cvss:confidentiality-impact"; -329 /** -330 * A node type in the NVD CVE Schema 2.0 -331 */ -332 public static final String CVSS_INTEGRITY_IMPACT = "cvss:integrity-impact"; -333 /** -334 * A node type in the NVD CVE Schema 2.0 -335 */ -336 public static final String CVSS_AVAILABILITY_IMPACT = "cvss:availability-impact"; +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. +17 */ +18 package org.owasp.dependencycheck.data.update.xml; +19 +20 import java.io.IOException; +21 import java.util.List; +22 import java.util.Map; +23 import java.util.logging.Level; +24 import java.util.logging.Logger; +25 import org.apache.lucene.index.CorruptIndexException; +26 import org.owasp.dependencycheck.data.nvdcve.CveDB; +27 import org.owasp.dependencycheck.data.nvdcve.DatabaseException; +28 import org.owasp.dependencycheck.dependency.Reference; +29 import org.owasp.dependencycheck.dependency.Vulnerability; +30 import org.owasp.dependencycheck.dependency.VulnerableSoftware; +31 import org.xml.sax.Attributes; +32 import org.xml.sax.SAXException; +33 import org.xml.sax.SAXNotSupportedException; +34 import org.xml.sax.helpers.DefaultHandler; +35 +36 /** +37 * A SAX Handler that will parse the NVD CVE XML (schema version 2.0). +38 * +39 * @author Jeremy Long <jeremy.long@owasp.org> +40 */ +41 public class NvdCve20Handler extends DefaultHandler { +42 +43 /** +44 * the current supported schema version. +45 */ +46 private static final String CURRENT_SCHEMA_VERSION = "2.0"; +47 /** +48 * the current element. +49 */ +50 private final Element current = new Element(); +51 /** +52 * the text of the node. +53 */ +54 private StringBuilder nodeText; +55 /** +56 * the vulnerability. +57 */ +58 private Vulnerability vulnerability; +59 /** +60 * a reference for the cve. +61 */ +62 private Reference reference; +63 /** +64 * flag indicating whether the application has a cpe. +65 */ +66 private boolean hasApplicationCpe = false; +67 /** +68 * The total number of entries parsed. +69 */ +70 private int totalNumberOfEntries; +71 +72 /** +73 * Get the value of totalNumberOfEntries. +74 * +75 * @return the value of totalNumberOfEntries +76 */ +77 public int getTotalNumberOfEntries() { +78 return totalNumberOfEntries; +79 } +80 /** +81 * The total number of application entries parsed. +82 */ +83 private int totalNumberOfApplicationEntries; +84 +85 /** +86 * Get the value of totalNumberOfApplicationEntries. +87 * +88 * @return the value of totalNumberOfApplicationEntries +89 */ +90 public int getTotalNumberOfApplicationEntries() { +91 return totalNumberOfApplicationEntries; +92 } +93 +94 @Override +95 public void startElement(String uri, String localName, String qName, Attributes attributes) throws SAXException { +96 current.setNode(qName); +97 if (current.isEntryNode()) { +98 hasApplicationCpe = false; +99 vulnerability = new Vulnerability(); +100 vulnerability.setName(attributes.getValue("id")); +101 } else if (current.isVulnProductNode()) { +102 nodeText = new StringBuilder(100); +103 } else if (current.isVulnReferencesNode()) { +104 final String lang = attributes.getValue("xml:lang"); +105 if ("en".equals(lang)) { +106 reference = new Reference(); +107 } else { +108 reference = null; +109 } +110 } else if (reference != null && current.isVulnReferenceNode()) { +111 reference.setUrl(attributes.getValue("href")); +112 nodeText = new StringBuilder(130); +113 } else if (reference != null && current.isVulnSourceNode()) { +114 nodeText = new StringBuilder(30); +115 } else if (current.isVulnSummaryNode()) { +116 nodeText = new StringBuilder(500); +117 } else if (current.isNVDNode()) { +118 final String nvdVer = attributes.getValue("nvd_xml_version"); +119 if (!CURRENT_SCHEMA_VERSION.equals(nvdVer)) { +120 throw new SAXNotSupportedException("Schema version " + nvdVer + " is not supported"); +121 } +122 } else if (current.isVulnCWENode()) { +123 vulnerability.setCwe(attributes.getValue("id")); +124 } else if (current.isCVSSScoreNode()) { +125 nodeText = new StringBuilder(5); +126 } else if (current.isCVSSAccessVectorNode()) { +127 nodeText = new StringBuilder(20); +128 } else if (current.isCVSSAccessComplexityNode()) { +129 nodeText = new StringBuilder(20); +130 } else if (current.isCVSSAuthenticationNode()) { +131 nodeText = new StringBuilder(20); +132 } else if (current.isCVSSAvailabilityImpactNode()) { +133 nodeText = new StringBuilder(20); +134 } else if (current.isCVSSConfidentialityImpactNode()) { +135 nodeText = new StringBuilder(20); +136 } else if (current.isCVSSIntegrityImpactNode()) { +137 nodeText = new StringBuilder(20); +138 } +139 } +140 +141 @Override +142 public void characters(char[] ch, int start, int length) throws SAXException { +143 if (nodeText != null) { +144 nodeText.append(ch, start, length); +145 } +146 } +147 +148 @Override +149 public void endElement(String uri, String localName, String qName) throws SAXException { +150 current.setNode(qName); +151 if (current.isEntryNode()) { +152 totalNumberOfEntries += 1; +153 if (hasApplicationCpe) { +154 totalNumberOfApplicationEntries += 1; +155 try { +156 saveEntry(vulnerability); +157 } catch (DatabaseException ex) { +158 throw new SAXException(ex); +159 } catch (CorruptIndexException ex) { +160 throw new SAXException(ex); +161 } catch (IOException ex) { +162 throw new SAXException(ex); +163 } +164 } +165 vulnerability = null; +166 } else if (current.isCVSSScoreNode()) { +167 try { +168 final float score = Float.parseFloat(nodeText.toString()); +169 vulnerability.setCvssScore(score); +170 } catch (NumberFormatException ex) { +171 Logger.getLogger(NvdCve20Handler.class.getName()).log(Level.SEVERE, "Error parsing CVSS Score."); +172 Logger.getLogger(NvdCve20Handler.class.getName()).log(Level.FINE, null, ex); +173 } +174 nodeText = null; +175 } else if (current.isCVSSAccessVectorNode()) { +176 vulnerability.setCvssAccessVector(nodeText.toString()); +177 nodeText = null; +178 } else if (current.isCVSSAccessComplexityNode()) { +179 vulnerability.setCvssAccessComplexity(nodeText.toString()); +180 nodeText = null; +181 } else if (current.isCVSSAuthenticationNode()) { +182 vulnerability.setCvssAuthentication(nodeText.toString()); +183 nodeText = null; +184 } else if (current.isCVSSAvailabilityImpactNode()) { +185 vulnerability.setCvssAvailabilityImpact(nodeText.toString()); +186 nodeText = null; +187 } else if (current.isCVSSConfidentialityImpactNode()) { +188 vulnerability.setCvssConfidentialityImpact(nodeText.toString()); +189 nodeText = null; +190 } else if (current.isCVSSIntegrityImpactNode()) { +191 vulnerability.setCvssIntegrityImpact(nodeText.toString()); +192 nodeText = null; +193 } else if (current.isVulnProductNode()) { +194 final String cpe = nodeText.toString(); +195 if (cpe.startsWith("cpe:/a:")) { +196 hasApplicationCpe = true; +197 vulnerability.addVulnerableSoftware(cpe); +198 } +199 nodeText = null; +200 } else if (reference != null && current.isVulnReferencesNode()) { +201 vulnerability.addReference(reference); +202 reference = null; +203 } else if (reference != null && current.isVulnReferenceNode()) { +204 reference.setName(nodeText.toString()); +205 nodeText = null; +206 } else if (reference != null && current.isVulnSourceNode()) { +207 reference.setSource(nodeText.toString()); +208 nodeText = null; +209 } else if (current.isVulnSummaryNode()) { +210 vulnerability.setDescription(nodeText.toString()); +211 if (nodeText.indexOf("** REJECT **") >= 0) { +212 hasApplicationCpe = true; //ensure we process this to delete the vuln +213 } +214 nodeText = null; +215 } +216 } +217 /** +218 * the cve database. +219 */ +220 private CveDB cveDB; +221 +222 /** +223 * Sets the cveDB. +224 * +225 * @param db a reference to the CveDB +226 */ +227 public void setCveDB(CveDB db) { +228 cveDB = db; +229 } +230 /** +231 * A list of CVE entries and associated VulnerableSoftware entries that contain previous entries. +232 */ +233 private Map<String, List<VulnerableSoftware>> prevVersionVulnMap; +234 +235 /** +236 * Sets the prevVersionVulnMap. +237 * +238 * @param map the map of vulnerable software with previous versions being vulnerable +239 */ +240 public void setPrevVersionVulnMap(Map<String, List<VulnerableSoftware>> map) { +241 prevVersionVulnMap = map; +242 } +243 +244 /** +245 * Saves a vulnerability to the CVE Database. +246 * +247 * @param vuln the vulnerability to store in the database +248 * @throws DatabaseException thrown if there is an error writing to the database +249 * @throws CorruptIndexException is thrown if the CPE Index is corrupt +250 * @throws IOException thrown if there is an IOException with the CPE Index +251 */ +252 private void saveEntry(Vulnerability vuln) throws DatabaseException, CorruptIndexException, IOException { +253 if (cveDB == null) { +254 return; +255 } +256 final String cveName = vuln.getName(); +257 if (prevVersionVulnMap.containsKey(cveName)) { +258 final List<VulnerableSoftware> vulnSoftware = prevVersionVulnMap.get(cveName); +259 for (VulnerableSoftware vs : vulnSoftware) { +260 vuln.updateVulnerableSoftware(vs); +261 } +262 } +263 cveDB.updateVulnerability(vuln); +264 } +265 +266 // <editor-fold defaultstate="collapsed" desc="The Element Class that maintains state information about the current node"> +267 /** +268 * A simple class to maintain information about the current element while parsing the NVD CVE XML. +269 */ +270 protected static class Element { +271 +272 /** +273 * A node type in the NVD CVE Schema 2.0 +274 */ +275 public static final String NVD = "nvd"; +276 /** +277 * A node type in the NVD CVE Schema 2.0 +278 */ +279 public static final String ENTRY = "entry"; +280 /** +281 * A node type in the NVD CVE Schema 2.0 +282 */ +283 public static final String VULN_PRODUCT = "vuln:product"; +284 /** +285 * A node type in the NVD CVE Schema 2.0 +286 */ +287 public static final String VULN_REFERENCES = "vuln:references"; +288 /** +289 * A node type in the NVD CVE Schema 2.0 +290 */ +291 public static final String VULN_SOURCE = "vuln:source"; +292 /** +293 * A node type in the NVD CVE Schema 2.0 +294 */ +295 public static final String VULN_REFERENCE = "vuln:reference"; +296 /** +297 * A node type in the NVD CVE Schema 2.0 +298 */ +299 public static final String VULN_SUMMARY = "vuln:summary"; +300 /** +301 * A node type in the NVD CVE Schema 2.0 +302 */ +303 public static final String VULN_CWE = "vuln:cwe"; +304 /** +305 * A node type in the NVD CVE Schema 2.0 +306 */ +307 public static final String CVSS_SCORE = "cvss:score"; +308 /** +309 * A node type in the NVD CVE Schema 2.0 +310 */ +311 public static final String CVSS_ACCESS_VECTOR = "cvss:access-vector"; +312 /** +313 * A node type in the NVD CVE Schema 2.0 +314 */ +315 public static final String CVSS_ACCESS_COMPLEXITY = "cvss:access-complexity"; +316 /** +317 * A node type in the NVD CVE Schema 2.0 +318 */ +319 public static final String CVSS_AUTHENTICATION = "cvss:authentication"; +320 /** +321 * A node type in the NVD CVE Schema 2.0 +322 */ +323 public static final String CVSS_CONFIDENTIALITY_IMPACT = "cvss:confidentiality-impact"; +324 /** +325 * A node type in the NVD CVE Schema 2.0 +326 */ +327 public static final String CVSS_INTEGRITY_IMPACT = "cvss:integrity-impact"; +328 /** +329 * A node type in the NVD CVE Schema 2.0 +330 */ +331 public static final String CVSS_AVAILABILITY_IMPACT = "cvss:availability-impact"; +332 /** +333 * The current node. +334 */ +335 private String node; +336 337 /** -338 * The current node. -339 */ -340 private String node; -341 -342 /** -343 * Gets the value of node. -344 * -345 * @return the value of node -346 */ -347 public String getNode() { -348 return this.node; -349 } -350 -351 /** -352 * Sets the value of node. -353 * -354 * @param node new value of node -355 */ -356 public void setNode(String node) { -357 this.node = node; -358 } -359 -360 /** -361 * Checks if the handler is at the NVD node. -362 * -363 * @return true or false -364 */ -365 public boolean isNVDNode() { -366 return NVD.equals(node); -367 } -368 -369 /** -370 * Checks if the handler is at the ENTRY node. -371 * -372 * @return true or false -373 */ -374 public boolean isEntryNode() { -375 return ENTRY.equals(node); -376 } -377 -378 /** -379 * Checks if the handler is at the VULN_PRODUCT node. -380 * -381 * @return true or false -382 */ -383 public boolean isVulnProductNode() { -384 return VULN_PRODUCT.equals(node); -385 } -386 -387 /** -388 * Checks if the handler is at the REFERENCES node. -389 * -390 * @return true or false -391 */ -392 public boolean isVulnReferencesNode() { -393 return VULN_REFERENCES.equals(node); -394 } -395 -396 /** -397 * Checks if the handler is at the REFERENCE node. -398 * -399 * @return true or false -400 */ -401 public boolean isVulnReferenceNode() { -402 return VULN_REFERENCE.equals(node); -403 } -404 -405 /** -406 * Checks if the handler is at the VULN_SOURCE node. -407 * -408 * @return true or false -409 */ -410 public boolean isVulnSourceNode() { -411 return VULN_SOURCE.equals(node); -412 } -413 -414 /** -415 * Checks if the handler is at the VULN_SUMMARY node. -416 * -417 * @return true or false -418 */ -419 public boolean isVulnSummaryNode() { -420 return VULN_SUMMARY.equals(node); -421 } -422 -423 /** -424 * Checks if the handler is at the VULN_CWE node. -425 * -426 * @return true or false -427 */ -428 public boolean isVulnCWENode() { -429 return VULN_CWE.equals(node); -430 } -431 -432 /** -433 * Checks if the handler is at the CVSS_SCORE node. -434 * -435 * @return true or false -436 */ -437 public boolean isCVSSScoreNode() { -438 return CVSS_SCORE.equals(node); -439 } -440 -441 /** -442 * Checks if the handler is at the CVSS_ACCESS_VECTOR node. -443 * -444 * @return true or false -445 */ -446 public boolean isCVSSAccessVectorNode() { -447 return CVSS_ACCESS_VECTOR.equals(node); -448 } -449 -450 /** -451 * Checks if the handler is at the CVSS_ACCESS_COMPLEXITY node. -452 * -453 * @return true or false -454 */ -455 public boolean isCVSSAccessComplexityNode() { -456 return CVSS_ACCESS_COMPLEXITY.equals(node); -457 } -458 -459 /** -460 * Checks if the handler is at the CVSS_AUTHENTICATION node. -461 * -462 * @return true or false -463 */ -464 public boolean isCVSSAuthenticationNode() { -465 return CVSS_AUTHENTICATION.equals(node); -466 } -467 -468 /** -469 * Checks if the handler is at the CVSS_CONFIDENTIALITY_IMPACT node. -470 * -471 * @return true or false -472 */ -473 public boolean isCVSSConfidentialityImpactNode() { -474 return CVSS_CONFIDENTIALITY_IMPACT.equals(node); -475 } -476 -477 /** -478 * Checks if the handler is at the CVSS_INTEGRITY_IMPACT node. -479 * -480 * @return true or false -481 */ -482 public boolean isCVSSIntegrityImpactNode() { -483 return CVSS_INTEGRITY_IMPACT.equals(node); -484 } -485 -486 /** -487 * Checks if the handler is at the CVSS_AVAILABILITY_IMPACT node. -488 * -489 * @return true or false -490 */ -491 public boolean isCVSSAvailabilityImpactNode() { -492 return CVSS_AVAILABILITY_IMPACT.equals(node); -493 } -494 } -495 // </editor-fold> -496 } +338 * Gets the value of node. +339 * +340 * @return the value of node +341 */ +342 public String getNode() { +343 return this.node; +344 } +345 +346 /** +347 * Sets the value of node. +348 * +349 * @param node new value of node +350 */ +351 public void setNode(String node) { +352 this.node = node; +353 } +354 +355 /** +356 * Checks if the handler is at the NVD node. +357 * +358 * @return true or false +359 */ +360 public boolean isNVDNode() { +361 return NVD.equals(node); +362 } +363 +364 /** +365 * Checks if the handler is at the ENTRY node. +366 * +367 * @return true or false +368 */ +369 public boolean isEntryNode() { +370 return ENTRY.equals(node); +371 } +372 +373 /** +374 * Checks if the handler is at the VULN_PRODUCT node. +375 * +376 * @return true or false +377 */ +378 public boolean isVulnProductNode() { +379 return VULN_PRODUCT.equals(node); +380 } +381 +382 /** +383 * Checks if the handler is at the REFERENCES node. +384 * +385 * @return true or false +386 */ +387 public boolean isVulnReferencesNode() { +388 return VULN_REFERENCES.equals(node); +389 } +390 +391 /** +392 * Checks if the handler is at the REFERENCE node. +393 * +394 * @return true or false +395 */ +396 public boolean isVulnReferenceNode() { +397 return VULN_REFERENCE.equals(node); +398 } +399 +400 /** +401 * Checks if the handler is at the VULN_SOURCE node. +402 * +403 * @return true or false +404 */ +405 public boolean isVulnSourceNode() { +406 return VULN_SOURCE.equals(node); +407 } +408 +409 /** +410 * Checks if the handler is at the VULN_SUMMARY node. +411 * +412 * @return true or false +413 */ +414 public boolean isVulnSummaryNode() { +415 return VULN_SUMMARY.equals(node); +416 } +417 +418 /** +419 * Checks if the handler is at the VULN_CWE node. +420 * +421 * @return true or false +422 */ +423 public boolean isVulnCWENode() { +424 return VULN_CWE.equals(node); +425 } +426 +427 /** +428 * Checks if the handler is at the CVSS_SCORE node. +429 * +430 * @return true or false +431 */ +432 public boolean isCVSSScoreNode() { +433 return CVSS_SCORE.equals(node); +434 } +435 +436 /** +437 * Checks if the handler is at the CVSS_ACCESS_VECTOR node. +438 * +439 * @return true or false +440 */ +441 public boolean isCVSSAccessVectorNode() { +442 return CVSS_ACCESS_VECTOR.equals(node); +443 } +444 +445 /** +446 * Checks if the handler is at the CVSS_ACCESS_COMPLEXITY node. +447 * +448 * @return true or false +449 */ +450 public boolean isCVSSAccessComplexityNode() { +451 return CVSS_ACCESS_COMPLEXITY.equals(node); +452 } +453 +454 /** +455 * Checks if the handler is at the CVSS_AUTHENTICATION node. +456 * +457 * @return true or false +458 */ +459 public boolean isCVSSAuthenticationNode() { +460 return CVSS_AUTHENTICATION.equals(node); +461 } +462 +463 /** +464 * Checks if the handler is at the CVSS_CONFIDENTIALITY_IMPACT node. +465 * +466 * @return true or false +467 */ +468 public boolean isCVSSConfidentialityImpactNode() { +469 return CVSS_CONFIDENTIALITY_IMPACT.equals(node); +470 } +471 +472 /** +473 * Checks if the handler is at the CVSS_INTEGRITY_IMPACT node. +474 * +475 * @return true or false +476 */ +477 public boolean isCVSSIntegrityImpactNode() { +478 return CVSS_INTEGRITY_IMPACT.equals(node); +479 } +480 +481 /** +482 * Checks if the handler is at the CVSS_AVAILABILITY_IMPACT node. +483 * +484 * @return true or false +485 */ +486 public boolean isCVSSAvailabilityImpactNode() { +487 return CVSS_AVAILABILITY_IMPACT.equals(node); +488 } +489 } +490 // </editor-fold> +491 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/update/xml/package-frame.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/update/xml/package-frame.html index 80ddde3cb..759bff9b4 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/update/xml/package-frame.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/update/xml/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.0.8 Reference Package org.owasp.dependencycheck.data.update.xml + Dependency-Check Core 1.1.0 Reference Package org.owasp.dependencycheck.data.update.xml diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/data/update/xml/package-summary.html b/dependency-check-core/xref/org/owasp/dependencycheck/data/update/xml/package-summary.html index a8c5cf048..d86c8ea1e 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/data/update/xml/package-summary.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/data/update/xml/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.0.8 Reference Package org.owasp.dependencycheck.data.update.xml + Dependency-Check Core 1.1.0 Reference Package org.owasp.dependencycheck.data.update.xml diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/dependency/Confidence.html b/dependency-check-core/xref/org/owasp/dependencycheck/dependency/Confidence.html new file mode 100644 index 000000000..1b29aefd8 --- /dev/null +++ b/dependency-check-core/xref/org/owasp/dependencycheck/dependency/Confidence.html @@ -0,0 +1,56 @@ + + + +Confidence xref + + + +
    +1   /*
+2    * This file is part of dependency-check-core.
+3    *
+4    * Licensed under the Apache License, Version 2.0 (the "License");
+5    * you may not use this file except in compliance with the License.
+6    * You may obtain a copy of the License at
+7    *
+8    *     http://www.apache.org/licenses/LICENSE-2.0
+9    *
+10   * Unless required by applicable law or agreed to in writing, software
+11   * distributed under the License is distributed on an "AS IS" BASIS,
+12   * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+13   * See the License for the specific language governing permissions and
+14   * limitations under the License.
+15   *
+16   * Copyright (c) 2012 Jeremy Long. All Rights Reserved.
+17   */
+18  package org.owasp.dependencycheck.dependency;
+19  
+20  /**
+21   * A confidence enumeration.
+22   *
+23   * @author Jeremy Long <jeremy.long@owasp.org>
+24   */
+25  public enum Confidence {
+26  
+27      /**
+28       * High confidence evidence.
+29       */
+30      HIGHEST,
+31      /**
+32       * High confidence evidence.
+33       */
+34      HIGH,
+35      /**
+36       * Medium confidence evidence.
+37       */
+38      MEDIUM,
+39      /**
+40       * Low confidence evidence.
+41       */
+42      LOW
+43  }
+
    +
    + + + diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/dependency/Dependency.html b/dependency-check-core/xref/org/owasp/dependencycheck/dependency/Dependency.html index 80206bd4c..8a7c7e89d 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/dependency/Dependency.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/dependency/Dependency.html @@ -9,582 +9,596 @@ 1 /* 2 * This file is part of dependency-check-core. 3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. -18 */ -19 package org.owasp.dependencycheck.dependency; -20 -21 import java.io.File; -22 import java.io.IOException; -23 import java.security.NoSuchAlgorithmException; -24 import java.util.ArrayList; -25 import java.util.List; -26 import java.util.Set; -27 import java.util.SortedSet; -28 import java.util.TreeSet; -29 import java.util.logging.Level; -30 import java.util.logging.Logger; -31 import org.owasp.dependencycheck.utils.Checksum; -32 import org.owasp.dependencycheck.utils.FileUtils; -33 -34 /** -35 * A program dependency. This object is one of the core components within -36 * DependencyCheck. It is used to collect information about the dependency in -37 * the form of evidence. The Evidence is then used to determine if there are any -38 * known, published, vulnerabilities associated with the program dependency. -39 * -40 * @author Jeremy Long <jeremy.long@owasp.org> -41 */ -42 public class Dependency implements Comparable<Dependency> { -43 -44 /** -45 * The actual file path of the dependency on disk. -46 */ -47 private String actualFilePath; -48 /** -49 * The file path to display. -50 */ -51 private String filePath; -52 /** -53 * The file name of the dependency. -54 */ -55 private String fileName; -56 /** -57 * The file extension of the dependency. -58 */ -59 private String fileExtension; -60 /** -61 * The md5 hash of the dependency. -62 */ -63 private String md5sum; -64 /** -65 * The SHA1 hash of the dependency. -66 */ -67 private String sha1sum; -68 /** -69 * A list of Identifiers. -70 */ -71 private Set<Identifier> identifiers; -72 /** -73 * A collection of vendor evidence. -74 */ -75 private final EvidenceCollection vendorEvidence; -76 /** -77 * A collection of product evidence. -78 */ -79 private final EvidenceCollection productEvidence; -80 /** -81 * A collection of version evidence. -82 */ -83 private final EvidenceCollection versionEvidence; -84 -85 /** -86 * Constructs a new Dependency object. -87 */ -88 public Dependency() { -89 vendorEvidence = new EvidenceCollection(); -90 productEvidence = new EvidenceCollection(); -91 versionEvidence = new EvidenceCollection(); -92 identifiers = new TreeSet<Identifier>(); -93 vulnerabilities = new TreeSet<Vulnerability>(new VulnerabilityComparator()); -94 } -95 -96 /** -97 * Constructs a new Dependency object. -98 * -99 * @param file the File to create the dependency object from. -100 */ -101 public Dependency(File file) { -102 this(); -103 this.actualFilePath = file.getPath(); -104 this.filePath = this.actualFilePath; -105 this.fileName = file.getName(); -106 this.fileExtension = FileUtils.getFileExtension(fileName); -107 determineHashes(file); -108 } -109 -110 /** -111 * Returns the file name of the dependency. -112 * -113 * @return the file name of the dependency. -114 */ -115 public String getFileName() { -116 return this.fileName; -117 } -118 -119 /** -120 * Sets the file name of the dependency. -121 * -122 * @param fileName the file name of the dependency. -123 */ -124 public void setFileName(String fileName) { -125 this.fileName = fileName; -126 } -127 -128 /** -129 * Sets the actual file path of the dependency on disk. -130 * -131 * @param actualFilePath the file path of the dependency. -132 */ -133 public void setActualFilePath(String actualFilePath) { -134 this.actualFilePath = actualFilePath; -135 } -136 -137 /** -138 * Gets the file path of the dependency. -139 * -140 * @return the file path of the dependency. -141 */ -142 public String getActualFilePath() { -143 return this.actualFilePath; -144 } -145 -146 /** -147 * Sets the file path of the dependency. -148 * -149 * @param filePath the file path of the dependency. -150 */ -151 public void setFilePath(String filePath) { -152 this.filePath = filePath; -153 } -154 -155 /** -156 * <p>Gets the file path of the dependency.</p> <p><b>NOTE:</b> This may not -157 * be the actual path of the file on disk. The actual path of the file on -158 * disk can be obtained via the getActualFilePath().</p> -159 * -160 * @return the file path of the dependency. -161 */ -162 public String getFilePath() { -163 return this.filePath; -164 } -165 -166 /** -167 * Sets the file name of the dependency. -168 * -169 * @param fileExtension the file name of the dependency. -170 */ -171 public void setFileExtension(String fileExtension) { -172 this.fileExtension = fileExtension; -173 } -174 -175 /** -176 * Gets the file extension of the dependency. -177 * -178 * @return the file extension of the dependency. -179 */ -180 public String getFileExtension() { -181 return this.fileExtension; -182 } -183 -184 /** -185 * Returns the MD5 Checksum of the dependency file. -186 * -187 * @return the MD5 Checksum -188 */ -189 public String getMd5sum() { -190 return this.md5sum; -191 } -192 -193 /** -194 * Sets the MD5 Checksum of the dependency. -195 * -196 * @param md5sum the MD5 Checksum -197 */ -198 public void setMd5sum(String md5sum) { -199 this.md5sum = md5sum; -200 } -201 -202 /** -203 * Returns the SHA1 Checksum of the dependency. -204 * -205 * @return the SHA1 Checksum -206 */ -207 public String getSha1sum() { -208 return this.sha1sum; -209 } -210 -211 /** -212 * Sets the SHA1 Checksum of the dependency. -213 * -214 * @param sha1sum the SHA1 Checksum -215 */ -216 public void setSha1sum(String sha1sum) { -217 this.sha1sum = sha1sum; -218 } -219 -220 /** -221 * Returns a List of Identifiers. -222 * -223 * @return an ArrayList of Identifiers. -224 */ -225 public Set<Identifier> getIdentifiers() { -226 return this.identifiers; -227 } -228 -229 /** -230 * Sets a List of Identifiers. -231 * -232 * @param identifiers A list of Identifiers. -233 */ -234 public void setIdentifiers(Set<Identifier> identifiers) { -235 this.identifiers = identifiers; -236 } -237 -238 /** -239 * Adds an entry to the list of detected Identifiers for the dependency -240 * file. -241 * -242 * @param type the type of identifier (such as CPE) -243 * @param value the value of the identifier -244 * @param url the URL of the identifier -245 */ -246 public void addIdentifier(String type, String value, String url) { -247 final Identifier i = new Identifier(type, value, url); -248 this.identifiers.add(i); -249 } -250 -251 /** -252 * Adds an entry to the list of detected Identifiers for the dependency -253 * file. -254 * -255 * @param identifier the identifier to add -256 */ -257 public void addIdentifier(Identifier identifier) { -258 this.identifiers.add(identifier); -259 } -260 -261 /** -262 * Returns the evidence used to identify this dependency. -263 * -264 * @return an EvidenceCollection. -265 */ -266 public EvidenceCollection getEvidence() { -267 return EvidenceCollection.merge(this.productEvidence, this.vendorEvidence, this.versionEvidence); -268 } -269 -270 /** -271 * Returns the evidence used to identify this dependency. -272 * -273 * @return an EvidenceCollection. -274 */ -275 public EvidenceCollection getEvidenceUsed() { -276 return EvidenceCollection.mergeUsed(this.productEvidence, this.vendorEvidence, this.versionEvidence); -277 } -278 -279 /** -280 * Gets the Vendor Evidence. -281 * -282 * @return an EvidenceCollection. -283 */ -284 public EvidenceCollection getVendorEvidence() { -285 return this.vendorEvidence; -286 } -287 -288 /** -289 * Gets the Product Evidence. -290 * -291 * @return an EvidenceCollection. -292 */ -293 public EvidenceCollection getProductEvidence() { -294 return this.productEvidence; -295 } -296 -297 /** -298 * Gets the Version Evidence. -299 * -300 * @return an EvidenceCollection. -301 */ -302 public EvidenceCollection getVersionEvidence() { -303 return this.versionEvidence; -304 } -305 /** -306 * A list of exceptions that occurred during analysis of this dependency. -307 */ -308 private List<Exception> analysisExceptions = new ArrayList<Exception>(); -309 -310 /** -311 * Get the value of analysisExceptions. -312 * -313 * @return the value of analysisExceptions -314 */ -315 public List<Exception> getAnalysisExceptions() { -316 return analysisExceptions; -317 } -318 -319 /** -320 * Set the value of analysisExceptions. -321 * -322 * @param analysisExceptions new value of analysisExceptions +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. +17 */ +18 package org.owasp.dependencycheck.dependency; +19 +20 import java.io.File; +21 import java.io.IOException; +22 import java.security.NoSuchAlgorithmException; +23 import java.util.ArrayList; +24 import java.util.List; +25 import java.util.Set; +26 import java.util.SortedSet; +27 import java.util.TreeSet; +28 import java.util.logging.Level; +29 import java.util.logging.Logger; +30 import org.owasp.dependencycheck.utils.Checksum; +31 import org.owasp.dependencycheck.utils.FileUtils; +32 +33 /** +34 * A program dependency. This object is one of the core components within DependencyCheck. It is used to collect +35 * information about the dependency in the form of evidence. The Evidence is then used to determine if there are any +36 * known, published, vulnerabilities associated with the program dependency. +37 * +38 * @author Jeremy Long <jeremy.long@owasp.org> +39 */ +40 public class Dependency implements Comparable<Dependency> { +41 +42 /** +43 * The actual file path of the dependency on disk. +44 */ +45 private String actualFilePath; +46 /** +47 * The file path to display. +48 */ +49 private String filePath; +50 /** +51 * The file name of the dependency. +52 */ +53 private String fileName; +54 /** +55 * The file extension of the dependency. +56 */ +57 private String fileExtension; +58 /** +59 * The md5 hash of the dependency. +60 */ +61 private String md5sum; +62 /** +63 * The SHA1 hash of the dependency. +64 */ +65 private String sha1sum; +66 /** +67 * A list of Identifiers. +68 */ +69 private Set<Identifier> identifiers; +70 /** +71 * A collection of vendor evidence. +72 */ +73 private final EvidenceCollection vendorEvidence; +74 /** +75 * A collection of product evidence. +76 */ +77 private final EvidenceCollection productEvidence; +78 /** +79 * A collection of version evidence. +80 */ +81 private final EvidenceCollection versionEvidence; +82 +83 /** +84 * Constructs a new Dependency object. +85 */ +86 public Dependency() { +87 vendorEvidence = new EvidenceCollection(); +88 productEvidence = new EvidenceCollection(); +89 versionEvidence = new EvidenceCollection(); +90 identifiers = new TreeSet<Identifier>(); +91 vulnerabilities = new TreeSet<Vulnerability>(new VulnerabilityComparator()); +92 } +93 +94 /** +95 * Constructs a new Dependency object. +96 * +97 * @param file the File to create the dependency object from. +98 */ +99 public Dependency(File file) { +100 this(); +101 this.actualFilePath = file.getPath(); +102 this.filePath = this.actualFilePath; +103 this.fileName = file.getName(); +104 this.fileExtension = FileUtils.getFileExtension(fileName); +105 determineHashes(file); +106 } +107 +108 /** +109 * Returns the file name of the dependency. +110 * +111 * @return the file name of the dependency. +112 */ +113 public String getFileName() { +114 return this.fileName; +115 } +116 +117 /** +118 * Sets the file name of the dependency. +119 * +120 * @param fileName the file name of the dependency. +121 */ +122 public void setFileName(String fileName) { +123 this.fileName = fileName; +124 } +125 +126 /** +127 * Sets the actual file path of the dependency on disk. +128 * +129 * @param actualFilePath the file path of the dependency. +130 */ +131 public void setActualFilePath(String actualFilePath) { +132 this.actualFilePath = actualFilePath; +133 if (this.sha1sum == null) { +134 final File file = new File(this.actualFilePath); +135 determineHashes(file); +136 } +137 } +138 +139 /** +140 * Gets the file path of the dependency. +141 * +142 * @return the file path of the dependency. +143 */ +144 public String getActualFilePath() { +145 return this.actualFilePath; +146 } +147 +148 /** +149 * Sets the file path of the dependency. +150 * +151 * @param filePath the file path of the dependency. +152 */ +153 public void setFilePath(String filePath) { +154 this.filePath = filePath; +155 } +156 +157 /** +158 * <p> +159 * Gets the file path of the dependency.</p> +160 * <p> +161 * <b>NOTE:</b> This may not be the actual path of the file on disk. The actual path of the file on disk can be +162 * obtained via the getActualFilePath().</p> +163 * +164 * @return the file path of the dependency. +165 */ +166 public String getFilePath() { +167 return this.filePath; +168 } +169 +170 /** +171 * Sets the file name of the dependency. +172 * +173 * @param fileExtension the file name of the dependency. +174 */ +175 public void setFileExtension(String fileExtension) { +176 this.fileExtension = fileExtension; +177 } +178 +179 /** +180 * Gets the file extension of the dependency. +181 * +182 * @return the file extension of the dependency. +183 */ +184 public String getFileExtension() { +185 return this.fileExtension; +186 } +187 +188 /** +189 * Returns the MD5 Checksum of the dependency file. +190 * +191 * @return the MD5 Checksum +192 */ +193 public String getMd5sum() { +194 return this.md5sum; +195 } +196 +197 /** +198 * Sets the MD5 Checksum of the dependency. +199 * +200 * @param md5sum the MD5 Checksum +201 */ +202 public void setMd5sum(String md5sum) { +203 this.md5sum = md5sum; +204 } +205 +206 /** +207 * Returns the SHA1 Checksum of the dependency. +208 * +209 * @return the SHA1 Checksum +210 */ +211 public String getSha1sum() { +212 return this.sha1sum; +213 } +214 +215 /** +216 * Sets the SHA1 Checksum of the dependency. +217 * +218 * @param sha1sum the SHA1 Checksum +219 */ +220 public void setSha1sum(String sha1sum) { +221 this.sha1sum = sha1sum; +222 } +223 +224 /** +225 * Returns a List of Identifiers. +226 * +227 * @return an ArrayList of Identifiers. +228 */ +229 public Set<Identifier> getIdentifiers() { +230 return this.identifiers; +231 } +232 +233 /** +234 * Sets a List of Identifiers. +235 * +236 * @param identifiers A list of Identifiers. +237 */ +238 public void setIdentifiers(Set<Identifier> identifiers) { +239 this.identifiers = identifiers; +240 } +241 +242 /** +243 * Adds an entry to the list of detected Identifiers for the dependency file. +244 * +245 * @param type the type of identifier (such as CPE) +246 * @param value the value of the identifier +247 * @param url the URL of the identifier +248 */ +249 public void addIdentifier(String type, String value, String url) { +250 final Identifier i = new Identifier(type, value, url); +251 this.identifiers.add(i); +252 } +253 +254 /** +255 * Adds an entry to the list of detected Identifiers for the dependency file. +256 * +257 * @param type the type of identifier (such as CPE) +258 * @param value the value of the identifier +259 * @param url the URL of the identifier +260 * @param confidence the confidence in the Identifier being accurate +261 */ +262 public void addIdentifier(String type, String value, String url, Confidence confidence) { +263 final Identifier i = new Identifier(type, value, url); +264 i.setConfidence(confidence); +265 this.identifiers.add(i); +266 } +267 +268 /** +269 * Adds an entry to the list of detected Identifiers for the dependency file. +270 * +271 * @param identifier the identifier to add +272 */ +273 public void addIdentifier(Identifier identifier) { +274 this.identifiers.add(identifier); +275 } +276 +277 /** +278 * Returns the evidence used to identify this dependency. +279 * +280 * @return an EvidenceCollection. +281 */ +282 public EvidenceCollection getEvidence() { +283 return EvidenceCollection.merge(this.productEvidence, this.vendorEvidence, this.versionEvidence); +284 } +285 +286 /** +287 * Returns the evidence used to identify this dependency. +288 * +289 * @return an EvidenceCollection. +290 */ +291 public EvidenceCollection getEvidenceUsed() { +292 return EvidenceCollection.mergeUsed(this.productEvidence, this.vendorEvidence, this.versionEvidence); +293 } +294 +295 /** +296 * Gets the Vendor Evidence. +297 * +298 * @return an EvidenceCollection. +299 */ +300 public EvidenceCollection getVendorEvidence() { +301 return this.vendorEvidence; +302 } +303 +304 /** +305 * Gets the Product Evidence. +306 * +307 * @return an EvidenceCollection. +308 */ +309 public EvidenceCollection getProductEvidence() { +310 return this.productEvidence; +311 } +312 +313 /** +314 * Gets the Version Evidence. +315 * +316 * @return an EvidenceCollection. +317 */ +318 public EvidenceCollection getVersionEvidence() { +319 return this.versionEvidence; +320 } +321 /** +322 * A list of exceptions that occurred during analysis of this dependency. 323 */ -324 public void setAnalysisExceptions(List<Exception> analysisExceptions) { -325 this.analysisExceptions = analysisExceptions; -326 } -327 -328 /** -329 * Adds an exception to the analysis exceptions collection. -330 * -331 * @param ex an exception. -332 */ -333 public void addAnalysisException(Exception ex) { -334 this.analysisExceptions.add(ex); -335 } -336 /** -337 * The description of the JAR file. -338 */ -339 private String description; -340 -341 /** -342 * Get the value of description. -343 * -344 * @return the value of description -345 */ -346 public String getDescription() { -347 return description; -348 } -349 -350 /** -351 * Set the value of description. -352 * -353 * @param description new value of description +324 private List<Exception> analysisExceptions = new ArrayList<Exception>(); +325 +326 /** +327 * Get the value of analysisExceptions. +328 * +329 * @return the value of analysisExceptions +330 */ +331 public List<Exception> getAnalysisExceptions() { +332 return analysisExceptions; +333 } +334 +335 /** +336 * Set the value of analysisExceptions. +337 * +338 * @param analysisExceptions new value of analysisExceptions +339 */ +340 public void setAnalysisExceptions(List<Exception> analysisExceptions) { +341 this.analysisExceptions = analysisExceptions; +342 } +343 +344 /** +345 * Adds an exception to the analysis exceptions collection. +346 * +347 * @param ex an exception. +348 */ +349 public void addAnalysisException(Exception ex) { +350 this.analysisExceptions.add(ex); +351 } +352 /** +353 * The description of the JAR file. 354 */ -355 public void setDescription(String description) { -356 this.description = description; -357 } -358 /** -359 * The license that this dependency uses. -360 */ -361 private String license; -362 -363 /** -364 * Get the value of license. -365 * -366 * @return the value of license -367 */ -368 public String getLicense() { -369 return license; -370 } -371 -372 /** -373 * Set the value of license. -374 * -375 * @param license new value of license +355 private String description; +356 +357 /** +358 * Get the value of description. +359 * +360 * @return the value of description +361 */ +362 public String getDescription() { +363 return description; +364 } +365 +366 /** +367 * Set the value of description. +368 * +369 * @param description new value of description +370 */ +371 public void setDescription(String description) { +372 this.description = description; +373 } +374 /** +375 * The license that this dependency uses. 376 */ -377 public void setLicense(String license) { -378 this.license = license; -379 } -380 /** -381 * A list of vulnerabilities for this dependency. -382 */ -383 private SortedSet<Vulnerability> vulnerabilities; -384 -385 /** -386 * Get the list of vulnerabilities. -387 * -388 * @return the list of vulnerabilities -389 */ -390 public SortedSet<Vulnerability> getVulnerabilities() { -391 return vulnerabilities; -392 } -393 -394 /** -395 * Set the value of vulnerabilities. -396 * -397 * @param vulnerabilities new value of vulnerabilities +377 private String license; +378 +379 /** +380 * Get the value of license. +381 * +382 * @return the value of license +383 */ +384 public String getLicense() { +385 return license; +386 } +387 +388 /** +389 * Set the value of license. +390 * +391 * @param license new value of license +392 */ +393 public void setLicense(String license) { +394 this.license = license; +395 } +396 /** +397 * A list of vulnerabilities for this dependency. 398 */ -399 public void setVulnerabilities(SortedSet<Vulnerability> vulnerabilities) { -400 this.vulnerabilities = vulnerabilities; -401 } -402 -403 /** -404 * Determines the sha1 and md5 sum for the given file. -405 * -406 * @param file the file to create checksums for -407 */ -408 private void determineHashes(File file) { -409 String md5 = null; -410 String sha1 = null; -411 try { -412 md5 = Checksum.getMD5Checksum(file); -413 sha1 = Checksum.getSHA1Checksum(file); -414 } catch (IOException ex) { -415 final String msg = String.format("Unable to read '%s' to determine hashes.", file.getName()); -416 Logger.getLogger(Dependency.class.getName()).log(Level.WARNING, msg); -417 Logger.getLogger(Dependency.class.getName()).log(Level.FINE, null, ex); -418 } catch (NoSuchAlgorithmException ex) { -419 final String msg = "Unable to use MD5 of SHA1 checksums."; -420 Logger.getLogger(Dependency.class.getName()).log(Level.WARNING, msg); -421 Logger.getLogger(Dependency.class.getName()).log(Level.FINE, null, ex); -422 } -423 this.setMd5sum(md5); -424 this.setSha1sum(sha1); -425 } -426 -427 /** -428 * Adds a vulnerability to the dependency. -429 * -430 * @param vulnerability a vulnerability outlining a vulnerability. -431 */ -432 public void addVulnerability(Vulnerability vulnerability) { -433 this.vulnerabilities.add(vulnerability); -434 } -435 /** -436 * A collection of related dependencies. -437 */ -438 private Set<Dependency> relatedDependencies = new TreeSet<Dependency>(); -439 -440 /** -441 * Get the value of relatedDependencies. -442 * -443 * @return the value of relatedDependencies -444 */ -445 public Set<Dependency> getRelatedDependencies() { -446 return relatedDependencies; -447 } -448 -449 /** -450 * Set the value of relatedDependencies. -451 * -452 * @param relatedDependencies new value of relatedDependencies +399 private SortedSet<Vulnerability> vulnerabilities; +400 +401 /** +402 * Get the list of vulnerabilities. +403 * +404 * @return the list of vulnerabilities +405 */ +406 public SortedSet<Vulnerability> getVulnerabilities() { +407 return vulnerabilities; +408 } +409 +410 /** +411 * Set the value of vulnerabilities. +412 * +413 * @param vulnerabilities new value of vulnerabilities +414 */ +415 public void setVulnerabilities(SortedSet<Vulnerability> vulnerabilities) { +416 this.vulnerabilities = vulnerabilities; +417 } +418 +419 /** +420 * Determines the sha1 and md5 sum for the given file. +421 * +422 * @param file the file to create checksums for +423 */ +424 private void determineHashes(File file) { +425 String md5 = null; +426 String sha1 = null; +427 try { +428 md5 = Checksum.getMD5Checksum(file); +429 sha1 = Checksum.getSHA1Checksum(file); +430 } catch (IOException ex) { +431 final String msg = String.format("Unable to read '%s' to determine hashes.", file.getName()); +432 Logger.getLogger(Dependency.class.getName()).log(Level.WARNING, msg); +433 Logger.getLogger(Dependency.class.getName()).log(Level.FINE, null, ex); +434 } catch (NoSuchAlgorithmException ex) { +435 final String msg = "Unable to use MD5 of SHA1 checksums."; +436 Logger.getLogger(Dependency.class.getName()).log(Level.WARNING, msg); +437 Logger.getLogger(Dependency.class.getName()).log(Level.FINE, null, ex); +438 } +439 this.setMd5sum(md5); +440 this.setSha1sum(sha1); +441 } +442 +443 /** +444 * Adds a vulnerability to the dependency. +445 * +446 * @param vulnerability a vulnerability outlining a vulnerability. +447 */ +448 public void addVulnerability(Vulnerability vulnerability) { +449 this.vulnerabilities.add(vulnerability); +450 } +451 /** +452 * A collection of related dependencies. 453 */ -454 public void setRelatedDependencies(Set<Dependency> relatedDependencies) { -455 this.relatedDependencies = relatedDependencies; -456 } -457 -458 /** -459 * Adds a related dependency. -460 * -461 * @param dependency a reference to the related dependency -462 */ -463 public void addRelatedDependency(Dependency dependency) { -464 relatedDependencies.add(dependency); -465 } -466 -467 /** -468 * Implementation of the Comparable<Dependency> interface. The comparison is -469 * solely based on the file name. -470 * -471 * @param o a dependency to compare -472 * @return an integer representing the natural ordering -473 */ -474 public int compareTo(Dependency o) { -475 return this.getFileName().compareToIgnoreCase(o.getFileName()); -476 } -477 -478 /** -479 * Implementation of the equals method. -480 * -481 * @param obj the object to compare -482 * @return true if the objects are equal, otherwise false -483 */ -484 @Override -485 public boolean equals(Object obj) { -486 if (obj == null) { -487 return false; -488 } -489 if (getClass() != obj.getClass()) { -490 return false; -491 } -492 final Dependency other = (Dependency) obj; -493 if ((this.actualFilePath == null) ? (other.actualFilePath != null) : !this.actualFilePath.equals(other.actualFilePath)) { -494 return false; -495 } -496 if ((this.filePath == null) ? (other.filePath != null) : !this.filePath.equals(other.filePath)) { -497 return false; -498 } -499 if ((this.fileName == null) ? (other.fileName != null) : !this.fileName.equals(other.fileName)) { -500 return false; -501 } -502 if ((this.fileExtension == null) ? (other.fileExtension != null) : !this.fileExtension.equals(other.fileExtension)) { -503 return false; -504 } -505 if ((this.md5sum == null) ? (other.md5sum != null) : !this.md5sum.equals(other.md5sum)) { -506 return false; -507 } -508 if ((this.sha1sum == null) ? (other.sha1sum != null) : !this.sha1sum.equals(other.sha1sum)) { +454 private Set<Dependency> relatedDependencies = new TreeSet<Dependency>(); +455 +456 /** +457 * Get the value of relatedDependencies. +458 * +459 * @return the value of relatedDependencies +460 */ +461 public Set<Dependency> getRelatedDependencies() { +462 return relatedDependencies; +463 } +464 +465 /** +466 * Set the value of relatedDependencies. +467 * +468 * @param relatedDependencies new value of relatedDependencies +469 */ +470 public void setRelatedDependencies(Set<Dependency> relatedDependencies) { +471 this.relatedDependencies = relatedDependencies; +472 } +473 +474 /** +475 * Adds a related dependency. +476 * +477 * @param dependency a reference to the related dependency +478 */ +479 public void addRelatedDependency(Dependency dependency) { +480 relatedDependencies.add(dependency); +481 } +482 +483 /** +484 * Implementation of the Comparable<Dependency> interface. The comparison is solely based on the file name. +485 * +486 * @param o a dependency to compare +487 * @return an integer representing the natural ordering +488 */ +489 public int compareTo(Dependency o) { +490 return this.getFileName().compareToIgnoreCase(o.getFileName()); +491 } +492 +493 /** +494 * Implementation of the equals method. +495 * +496 * @param obj the object to compare +497 * @return true if the objects are equal, otherwise false +498 */ +499 @Override +500 public boolean equals(Object obj) { +501 if (obj == null) { +502 return false; +503 } +504 if (getClass() != obj.getClass()) { +505 return false; +506 } +507 final Dependency other = (Dependency) obj; +508 if ((this.actualFilePath == null) ? (other.actualFilePath != null) : !this.actualFilePath.equals(other.actualFilePath)) { 509 return false; 510 } -511 if (this.identifiers != other.identifiers && (this.identifiers == null || !this.identifiers.equals(other.identifiers))) { +511 if ((this.filePath == null) ? (other.filePath != null) : !this.filePath.equals(other.filePath)) { 512 return false; 513 } -514 if (this.vendorEvidence != other.vendorEvidence && (this.vendorEvidence == null || !this.vendorEvidence.equals(other.vendorEvidence))) { +514 if ((this.fileName == null) ? (other.fileName != null) : !this.fileName.equals(other.fileName)) { 515 return false; 516 } -517 if (this.productEvidence != other.productEvidence && (this.productEvidence == null || !this.productEvidence.equals(other.productEvidence))) { +517 if ((this.fileExtension == null) ? (other.fileExtension != null) : !this.fileExtension.equals(other.fileExtension)) { 518 return false; 519 } -520 if (this.versionEvidence != other.versionEvidence && (this.versionEvidence == null || !this.versionEvidence.equals(other.versionEvidence))) { +520 if ((this.md5sum == null) ? (other.md5sum != null) : !this.md5sum.equals(other.md5sum)) { 521 return false; 522 } -523 if (this.analysisExceptions != other.analysisExceptions -524 && (this.analysisExceptions == null || !this.analysisExceptions.equals(other.analysisExceptions))) { -525 return false; -526 } -527 if ((this.description == null) ? (other.description != null) : !this.description.equals(other.description)) { -528 return false; -529 } -530 if ((this.license == null) ? (other.license != null) : !this.license.equals(other.license)) { -531 return false; -532 } -533 if (this.vulnerabilities != other.vulnerabilities && (this.vulnerabilities == null || !this.vulnerabilities.equals(other.vulnerabilities))) { -534 return false; -535 } -536 if (this.relatedDependencies != other.relatedDependencies -537 && (this.relatedDependencies == null || !this.relatedDependencies.equals(other.relatedDependencies))) { -538 return false; -539 } -540 return true; -541 } -542 -543 /** -544 * Generates the HashCode. -545 * -546 * @return the HashCode -547 */ -548 @Override -549 public int hashCode() { -550 int hash = 3; -551 hash = 47 * hash + (this.actualFilePath != null ? this.actualFilePath.hashCode() : 0); -552 hash = 47 * hash + (this.filePath != null ? this.filePath.hashCode() : 0); -553 hash = 47 * hash + (this.fileName != null ? this.fileName.hashCode() : 0); -554 hash = 47 * hash + (this.fileExtension != null ? this.fileExtension.hashCode() : 0); -555 hash = 47 * hash + (this.md5sum != null ? this.md5sum.hashCode() : 0); -556 hash = 47 * hash + (this.sha1sum != null ? this.sha1sum.hashCode() : 0); -557 hash = 47 * hash + (this.identifiers != null ? this.identifiers.hashCode() : 0); -558 hash = 47 * hash + (this.vendorEvidence != null ? this.vendorEvidence.hashCode() : 0); -559 hash = 47 * hash + (this.productEvidence != null ? this.productEvidence.hashCode() : 0); -560 hash = 47 * hash + (this.versionEvidence != null ? this.versionEvidence.hashCode() : 0); -561 hash = 47 * hash + (this.analysisExceptions != null ? this.analysisExceptions.hashCode() : 0); -562 hash = 47 * hash + (this.description != null ? this.description.hashCode() : 0); -563 hash = 47 * hash + (this.license != null ? this.license.hashCode() : 0); -564 hash = 47 * hash + (this.vulnerabilities != null ? this.vulnerabilities.hashCode() : 0); -565 hash = 47 * hash + (this.relatedDependencies != null ? this.relatedDependencies.hashCode() : 0); -566 return hash; -567 } -568 -569 /** -570 * Standard toString() implementation showing the filename, actualFilePath, -571 * and filePath. -572 * -573 * @return the string representation of the file -574 */ -575 @Override -576 public String toString() { -577 return "Dependency{ fileName='" + fileName + "', actualFilePath='" + actualFilePath + "', filePath='" + filePath + "'}"; -578 } -579 } +523 if ((this.sha1sum == null) ? (other.sha1sum != null) : !this.sha1sum.equals(other.sha1sum)) { +524 return false; +525 } +526 if (this.identifiers != other.identifiers && (this.identifiers == null || !this.identifiers.equals(other.identifiers))) { +527 return false; +528 } +529 if (this.vendorEvidence != other.vendorEvidence && (this.vendorEvidence == null || !this.vendorEvidence.equals(other.vendorEvidence))) { +530 return false; +531 } +532 if (this.productEvidence != other.productEvidence && (this.productEvidence == null || !this.productEvidence.equals(other.productEvidence))) { +533 return false; +534 } +535 if (this.versionEvidence != other.versionEvidence && (this.versionEvidence == null || !this.versionEvidence.equals(other.versionEvidence))) { +536 return false; +537 } +538 if (this.analysisExceptions != other.analysisExceptions +539 && (this.analysisExceptions == null || !this.analysisExceptions.equals(other.analysisExceptions))) { +540 return false; +541 } +542 if ((this.description == null) ? (other.description != null) : !this.description.equals(other.description)) { +543 return false; +544 } +545 if ((this.license == null) ? (other.license != null) : !this.license.equals(other.license)) { +546 return false; +547 } +548 if (this.vulnerabilities != other.vulnerabilities && (this.vulnerabilities == null || !this.vulnerabilities.equals(other.vulnerabilities))) { +549 return false; +550 } +551 if (this.relatedDependencies != other.relatedDependencies +552 && (this.relatedDependencies == null || !this.relatedDependencies.equals(other.relatedDependencies))) { +553 return false; +554 } +555 return true; +556 } +557 +558 /** +559 * Generates the HashCode. +560 * +561 * @return the HashCode +562 */ +563 @Override +564 public int hashCode() { +565 int hash = 3; +566 hash = 47 * hash + (this.actualFilePath != null ? this.actualFilePath.hashCode() : 0); +567 hash = 47 * hash + (this.filePath != null ? this.filePath.hashCode() : 0); +568 hash = 47 * hash + (this.fileName != null ? this.fileName.hashCode() : 0); +569 hash = 47 * hash + (this.fileExtension != null ? this.fileExtension.hashCode() : 0); +570 hash = 47 * hash + (this.md5sum != null ? this.md5sum.hashCode() : 0); +571 hash = 47 * hash + (this.sha1sum != null ? this.sha1sum.hashCode() : 0); +572 hash = 47 * hash + (this.identifiers != null ? this.identifiers.hashCode() : 0); +573 hash = 47 * hash + (this.vendorEvidence != null ? this.vendorEvidence.hashCode() : 0); +574 hash = 47 * hash + (this.productEvidence != null ? this.productEvidence.hashCode() : 0); +575 hash = 47 * hash + (this.versionEvidence != null ? this.versionEvidence.hashCode() : 0); +576 hash = 47 * hash + (this.analysisExceptions != null ? this.analysisExceptions.hashCode() : 0); +577 hash = 47 * hash + (this.description != null ? this.description.hashCode() : 0); +578 hash = 47 * hash + (this.license != null ? this.license.hashCode() : 0); +579 hash = 47 * hash + (this.vulnerabilities != null ? this.vulnerabilities.hashCode() : 0); +580 hash = 47 * hash + (this.relatedDependencies != null ? this.relatedDependencies.hashCode() : 0); +581 return hash; +582 } +583 +584 /** +585 * Standard toString() implementation showing the filename, actualFilePath, and filePath. +586 * +587 * @return the string representation of the file +588 */ +589 @Override +590 public String toString() { +591 return "Dependency{ fileName='" + fileName + "', actualFilePath='" + actualFilePath + "', filePath='" + filePath + "'}"; +592 } +593 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/dependency/Evidence.html b/dependency-check-core/xref/org/owasp/dependencycheck/dependency/Evidence.html index d5730797f..72d717487 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/dependency/Evidence.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/dependency/Evidence.html @@ -9,271 +9,244 @@ 1 /* 2 * This file is part of dependency-check-core. 3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. -18 */ -19 package org.owasp.dependencycheck.dependency; -20 -21 /** -22 * Evidence is a piece of information about a Dependency. -23 * -24 * @author Jeremy Long <jeremy.long@owasp.org> -25 */ -26 public class Evidence implements Comparable<Evidence> { -27 -28 /** -29 * The confidence that the evidence is "high" quality. -30 */ -31 public enum Confidence { +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. +17 */ +18 package org.owasp.dependencycheck.dependency; +19 +20 /** +21 * Evidence is a piece of information about a Dependency. +22 * +23 * @author Jeremy Long <jeremy.long@owasp.org> +24 */ +25 public class Evidence implements Comparable<Evidence> { +26 +27 /** +28 * Creates a new Evidence object. +29 */ +30 public Evidence() { +31 } 32 -33 /** -34 * High confidence evidence. -35 */ -36 HIGHEST, -37 /** -38 * High confidence evidence. -39 */ -40 HIGH, -41 /** -42 * Medium confidence evidence. -43 */ -44 MEDIUM, -45 /** -46 * Low confidence evidence. -47 */ -48 LOW -49 } -50 -51 /** -52 * Creates a new Evidence object. -53 */ -54 public Evidence() { -55 } -56 -57 /** -58 * Creates a new Evidence objects. -59 * -60 * @param source the source of the evidence. -61 * @param name the name of the evidence. -62 * @param value the value of the evidence. -63 * @param confidence the confidence of the evidence. -64 */ -65 public Evidence(String source, String name, String value, Confidence confidence) { -66 this.source = source; +33 /** +34 * Creates a new Evidence objects. +35 * +36 * @param source the source of the evidence. +37 * @param name the name of the evidence. +38 * @param value the value of the evidence. +39 * @param confidence the confidence of the evidence. +40 */ +41 public Evidence(String source, String name, String value, Confidence confidence) { +42 this.source = source; +43 this.name = name; +44 this.value = value; +45 this.confidence = confidence; +46 } +47 /** +48 * The name of the evidence. +49 */ +50 private String name; +51 +52 /** +53 * Get the value of name. +54 * +55 * @return the value of name +56 */ +57 public String getName() { +58 return name; +59 } +60 +61 /** +62 * Set the value of name. +63 * +64 * @param name new value of name +65 */ +66 public void setName(String name) { 67 this.name = name; -68 this.value = value; -69 this.confidence = confidence; -70 } -71 /** -72 * The name of the evidence. -73 */ -74 private String name; -75 -76 /** -77 * Get the value of name. -78 * -79 * @return the value of name -80 */ -81 public String getName() { -82 return name; -83 } -84 -85 /** -86 * Set the value of name. -87 * -88 * @param name new value of name -89 */ -90 public void setName(String name) { -91 this.name = name; -92 } -93 /** -94 * The source of the evidence. -95 */ -96 private String source; -97 -98 /** -99 * Get the value of source. -100 * -101 * @return the value of source -102 */ -103 public String getSource() { -104 return source; -105 } -106 -107 /** -108 * Set the value of source. -109 * -110 * @param source new value of source +68 } +69 /** +70 * The source of the evidence. +71 */ +72 private String source; +73 +74 /** +75 * Get the value of source. +76 * +77 * @return the value of source +78 */ +79 public String getSource() { +80 return source; +81 } +82 +83 /** +84 * Set the value of source. +85 * +86 * @param source new value of source +87 */ +88 public void setSource(String source) { +89 this.source = source; +90 } +91 /** +92 * The value of the evidence. +93 */ +94 private String value; +95 +96 /** +97 * Get the value of value. +98 * +99 * @return the value of value +100 */ +101 public String getValue() { +102 used = true; +103 return value; +104 } +105 +106 /** +107 * Get the value of value. If setUsed is set to false this call to get will not mark the evidence as used. +108 * +109 * @param setUsed whether or not this call to getValue should cause the used flag to be updated +110 * @return the value of value 111 */ -112 public void setSource(String source) { -113 this.source = source; -114 } -115 /** -116 * The value of the evidence. -117 */ -118 private String value; -119 -120 /** -121 * Get the value of value. -122 * -123 * @return the value of value -124 */ -125 public String getValue() { -126 used = true; -127 return value; -128 } +112 public String getValue(Boolean setUsed) { +113 used = used || setUsed; +114 return value; +115 } +116 +117 /** +118 * Set the value of value. +119 * +120 * @param value new value of value +121 */ +122 public void setValue(String value) { +123 this.value = value; +124 } +125 /** +126 * A value indicating if the Evidence has been "used" (aka read). +127 */ +128 private boolean used; 129 130 /** -131 * Get the value of value. If setUsed is set to false this call to get will -132 * not mark the evidence as used. -133 * -134 * @param setUsed whether or not this call to getValue should cause the used -135 * flag to be updated -136 * @return the value of value -137 */ -138 public String getValue(Boolean setUsed) { -139 used = used || setUsed; -140 return value; -141 } -142 -143 /** -144 * Set the value of value. -145 * -146 * @param value new value of value -147 */ -148 public void setValue(String value) { -149 this.value = value; -150 } -151 /** -152 * A value indicating if the Evidence has been "used" (aka read). -153 */ -154 private boolean used; -155 -156 /** -157 * Get the value of used. -158 * -159 * @return the value of used -160 */ -161 public boolean isUsed() { -162 return used; -163 } -164 -165 /** -166 * Set the value of used. -167 * -168 * @param used new value of used -169 */ -170 public void setUsed(boolean used) { -171 this.used = used; -172 } -173 /** -174 * The confidence level for the evidence. -175 */ -176 private Confidence confidence; -177 -178 /** -179 * Get the value of confidence. -180 * -181 * @return the value of confidence -182 */ -183 public Confidence getConfidence() { -184 return confidence; -185 } -186 -187 /** -188 * Set the value of confidence. -189 * -190 * @param confidence new value of confidence -191 */ -192 public void setConfidence(Confidence confidence) { -193 this.confidence = confidence; -194 } -195 -196 /** -197 * Implements the hashCode for Evidence. -198 * -199 * @return hash code. -200 */ -201 @Override -202 public int hashCode() { -203 int hash = 3; -204 hash = 67 * hash + (this.name != null ? this.name.hashCode() : 0); -205 hash = 67 * hash + (this.source != null ? this.source.hashCode() : 0); -206 hash = 67 * hash + (this.value != null ? this.value.hashCode() : 0); -207 hash = 67 * hash + (this.confidence != null ? this.confidence.hashCode() : 0); -208 return hash; -209 } -210 -211 /** -212 * Implements equals for Evidence. -213 * -214 * @param that an object to check the equality of. -215 * @return whether the two objects are equal. -216 */ -217 @Override -218 public boolean equals(Object that) { -219 if (this == that) { -220 return true; -221 } -222 if (!(that instanceof Evidence)) { -223 return false; -224 } -225 final Evidence e = (Evidence) that; -226 -227 return testEquality(name, e.name) && testEquality(source, e.source) && testEquality(value, e.value) -228 && (confidence == null ? e.confidence == null : confidence == e.confidence); -229 } -230 -231 /** -232 * Simple equality test for use within the equals method. This does a case -233 * insensitive compare. -234 * -235 * @param l a string to compare. -236 * @param r another string to compare. -237 * @return whether the two strings are the same. -238 */ -239 private boolean testEquality(String l, String r) { -240 return l == null ? r == null : l.equalsIgnoreCase(r); -241 } -242 -243 /** -244 * Implementation of the comparable interface. -245 * -246 * @param o the evidence being compared -247 * @return an integer indicating the ordering of the two objects -248 */ -249 public int compareTo(Evidence o) { -250 if (source.equals(o.source)) { -251 if (name.equals(o.name)) { -252 if (value.equals(o.value)) { -253 if (confidence.equals(o.confidence)) { -254 return 0; //they are equal -255 } else { -256 return confidence.compareTo(o.confidence); -257 } -258 } else { -259 return value.compareToIgnoreCase(o.value); -260 } -261 } else { -262 return name.compareToIgnoreCase(o.name); -263 } -264 } else { -265 return source.compareToIgnoreCase(o.source); -266 } -267 } -268 } +131 * Get the value of used. +132 * +133 * @return the value of used +134 */ +135 public boolean isUsed() { +136 return used; +137 } +138 +139 /** +140 * Set the value of used. +141 * +142 * @param used new value of used +143 */ +144 public void setUsed(boolean used) { +145 this.used = used; +146 } +147 /** +148 * The confidence level for the evidence. +149 */ +150 private Confidence confidence; +151 +152 /** +153 * Get the value of confidence. +154 * +155 * @return the value of confidence +156 */ +157 public Confidence getConfidence() { +158 return confidence; +159 } +160 +161 /** +162 * Set the value of confidence. +163 * +164 * @param confidence new value of confidence +165 */ +166 public void setConfidence(Confidence confidence) { +167 this.confidence = confidence; +168 } +169 +170 /** +171 * Implements the hashCode for Evidence. +172 * +173 * @return hash code. +174 */ +175 @Override +176 public int hashCode() { +177 int hash = 3; +178 hash = 67 * hash + (this.name != null ? this.name.hashCode() : 0); +179 hash = 67 * hash + (this.source != null ? this.source.hashCode() : 0); +180 hash = 67 * hash + (this.value != null ? this.value.hashCode() : 0); +181 hash = 67 * hash + (this.confidence != null ? this.confidence.hashCode() : 0); +182 return hash; +183 } +184 +185 /** +186 * Implements equals for Evidence. +187 * +188 * @param that an object to check the equality of. +189 * @return whether the two objects are equal. +190 */ +191 @Override +192 public boolean equals(Object that) { +193 if (this == that) { +194 return true; +195 } +196 if (!(that instanceof Evidence)) { +197 return false; +198 } +199 final Evidence e = (Evidence) that; +200 +201 return testEquality(name, e.name) && testEquality(source, e.source) && testEquality(value, e.value) +202 && (confidence == null ? e.confidence == null : confidence == e.confidence); +203 } +204 +205 /** +206 * Simple equality test for use within the equals method. This does a case insensitive compare. +207 * +208 * @param l a string to compare. +209 * @param r another string to compare. +210 * @return whether the two strings are the same. +211 */ +212 private boolean testEquality(String l, String r) { +213 return l == null ? r == null : l.equalsIgnoreCase(r); +214 } +215 +216 /** +217 * Implementation of the comparable interface. +218 * +219 * @param o the evidence being compared +220 * @return an integer indicating the ordering of the two objects +221 */ +222 public int compareTo(Evidence o) { +223 if (source.equals(o.source)) { +224 if (name.equals(o.name)) { +225 if (value.equals(o.value)) { +226 if (confidence.equals(o.confidence)) { +227 return 0; //they are equal +228 } else { +229 return confidence.compareTo(o.confidence); +230 } +231 } else { +232 return value.compareToIgnoreCase(o.value); +233 } +234 } else { +235 return name.compareToIgnoreCase(o.name); +236 } +237 } else { +238 return source.compareToIgnoreCase(o.source); +239 } +240 } +241 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/dependency/EvidenceCollection.html b/dependency-check-core/xref/org/owasp/dependencycheck/dependency/EvidenceCollection.html index 318fce49b..deab57c1e 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/dependency/EvidenceCollection.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/dependency/EvidenceCollection.html @@ -9,387 +9,375 @@ 1 /* 2 * This file is part of dependency-check-core. 3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. -18 */ -19 package org.owasp.dependencycheck.dependency; -20 -21 import java.net.MalformedURLException; -22 import java.util.HashSet; -23 import java.util.Iterator; -24 import java.util.List; -25 import java.util.Set; -26 import java.util.TreeSet; -27 import java.util.logging.Level; -28 import java.util.logging.Logger; -29 import org.apache.commons.lang.StringUtils; -30 import org.owasp.dependencycheck.utils.DependencyVersion; -31 import org.owasp.dependencycheck.utils.DependencyVersionUtil; -32 import org.owasp.dependencycheck.utils.Filter; -33 import org.owasp.dependencycheck.utils.UrlStringUtils; -34 -35 /** -36 * Used to maintain a collection of Evidence. -37 * -38 * @author Jeremy Long <jeremy.long@owasp.org> -39 */ -40 public class EvidenceCollection implements Iterable<Evidence> { -41 -42 /** -43 * Used to iterate over highest confidence evidence contained in the -44 * collection. -45 */ -46 private static final Filter<Evidence> HIGHEST_CONFIDENCE = new Filter<Evidence>() { -47 public boolean passes(Evidence evidence) { -48 return evidence.getConfidence() == Evidence.Confidence.HIGHEST; -49 } -50 }; -51 /** -52 * Used to iterate over high confidence evidence contained in the -53 * collection. -54 */ -55 private static final Filter<Evidence> HIGH_CONFIDENCE = new Filter<Evidence>() { -56 public boolean passes(Evidence evidence) { -57 return evidence.getConfidence() == Evidence.Confidence.HIGH; -58 } -59 }; -60 /** -61 * Used to iterate over medium confidence evidence contained in the -62 * collection. -63 */ -64 private static final Filter<Evidence> MEDIUM_CONFIDENCE = new Filter<Evidence>() { -65 public boolean passes(Evidence evidence) { -66 return evidence.getConfidence() == Evidence.Confidence.MEDIUM; -67 } -68 }; -69 /** -70 * Used to iterate over low confidence evidence contained in the collection. -71 */ -72 private static final Filter<Evidence> LOW_CONFIDENCE = new Filter<Evidence>() { -73 public boolean passes(Evidence evidence) { -74 return evidence.getConfidence() == Evidence.Confidence.LOW; -75 } -76 }; -77 /** -78 * Used to iterate over evidence that has was used (aka read) from the -79 * collection. -80 */ -81 private static final Filter<Evidence> EVIDENCE_USED = new Filter<Evidence>() { -82 public boolean passes(Evidence evidence) { -83 return evidence.isUsed(); -84 } -85 }; -86 -87 /** -88 * Used to iterate over evidence of the specified confidence. -89 * -90 * @param confidence the confidence level for the evidence to be iterated -91 * over. -92 * @return Iterable<Evidence> an iterable collection of evidence -93 */ -94 public final Iterable<Evidence> iterator(Evidence.Confidence confidence) { -95 if (confidence == Evidence.Confidence.HIGHEST) { -96 return EvidenceCollection.HIGHEST_CONFIDENCE.filter(this.list); -97 } else if (confidence == Evidence.Confidence.HIGH) { -98 return EvidenceCollection.HIGH_CONFIDENCE.filter(this.list); -99 } else if (confidence == Evidence.Confidence.MEDIUM) { -100 return EvidenceCollection.MEDIUM_CONFIDENCE.filter(this.list); -101 } else { -102 return EvidenceCollection.LOW_CONFIDENCE.filter(this.list); -103 } -104 } -105 /** -106 * A collection of evidence. -107 */ -108 private final Set<Evidence> list; -109 /** -110 * A collection of strings used to adjust Lucene's term weighting. -111 */ -112 private final Set<String> weightedStrings; -113 -114 /** -115 * Creates a new EvidenceCollection. -116 */ -117 public EvidenceCollection() { -118 list = new TreeSet<Evidence>(); -119 weightedStrings = new HashSet<String>(); -120 } -121 -122 /** -123 * Adds evidence to the collection. -124 * -125 * @param e Evidence. -126 */ -127 public void addEvidence(Evidence e) { -128 list.add(e); -129 } -130 -131 /** -132 * Creates an Evidence object from the parameters and adds the resulting -133 * object to the collection. -134 * -135 * @param source the source of the Evidence. -136 * @param name the name of the Evidence. -137 * @param value the value of the Evidence. -138 * @param confidence the confidence of the Evidence. -139 */ -140 public void addEvidence(String source, String name, String value, Evidence.Confidence confidence) { -141 final Evidence e = new Evidence(source, name, value, confidence); -142 addEvidence(e); -143 } -144 -145 /** -146 * Adds term to the weighting collection. The terms added here are used -147 * later to boost the score of other terms. This is a way of combining -148 * evidence from multiple sources to boost the confidence of the given -149 * evidence. -150 * -151 * Example: The term 'Apache' is found in the manifest of a JAR and is added -152 * to the Collection. When we parse the package names within the JAR file we -153 * may add these package names to the "weighted" strings collection to boost -154 * the score in the Lucene query. That way when we construct the Lucene -155 * query we find the term Apache in the collection AND in the weighted -156 * strings; as such, we will boost the confidence of the term Apache. -157 * -158 * @param str to add to the weighting collection. -159 */ -160 public void addWeighting(String str) { -161 weightedStrings.add(str); -162 } -163 -164 /** -165 * Returns a set of Weightings - a list of terms that are believed to be of -166 * higher confidence when also found in another location. -167 * -168 * @return Set<String> -169 */ -170 public Set<String> getWeighting() { -171 return weightedStrings; -172 } -173 -174 /** -175 * Returns the set of evidence. -176 * -177 * @return the set of evidence. -178 */ -179 public Set<Evidence> getEvidence() { -180 return list; -181 } -182 -183 /** -184 * Returns the set of evidence from a given source. -185 * -186 * @param source the source of the evidence -187 * @return the set of evidence. -188 */ -189 public Set<Evidence> getEvidence(String source) { -190 if (source == null) { -191 return null; -192 } -193 final Set<Evidence> ret = new HashSet<Evidence>(); -194 for (Evidence e : list) { -195 if (source.equals(e.getSource())) { -196 ret.add(e); -197 } -198 } -199 return ret; -200 } -201 -202 /** -203 * Returns the set of evidence from a given source and name. -204 * -205 * @param source the source of the evidence -206 * @param name the name of the evidence to return -207 * @return the set of evidence. -208 */ -209 public Set<Evidence> getEvidence(String source, String name) { -210 if (source == null || name == null) { -211 return null; -212 } -213 final Set<Evidence> ret = new HashSet<Evidence>(); -214 for (Evidence e : list) { -215 if (source.equals(e.getSource()) && name.equals(e.getName())) { -216 ret.add(e); -217 } -218 } -219 return ret; -220 } -221 -222 /** -223 * Implements the iterator interface for the Evidence Collection. -224 * -225 * @return an Iterator<Evidence>. -226 */ -227 public Iterator<Evidence> iterator() { -228 return list.iterator(); -229 } -230 -231 /** -232 * Used to determine if a given string was used (aka read). -233 * -234 * @param text the string to search for. -235 * @return whether or not the string was used. -236 */ -237 public boolean containsUsedString(String text) { -238 if (text == null) { -239 return false; -240 } -241 final String textToTest = text.toLowerCase(); -242 -243 for (Evidence e : EvidenceCollection.EVIDENCE_USED.filter(this)) { -244 //TODO consider changing the regex to only compare alpha-numeric (i.e. strip everything else) -245 final String value = urlCorrection(e.getValue().toLowerCase()).replaceAll("[\\s_-]", ""); -246 if (value.contains(textToTest)) { -247 return true; -248 } -249 } -250 return false; -251 } +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. +17 */ +18 package org.owasp.dependencycheck.dependency; +19 +20 import java.net.MalformedURLException; +21 import java.util.HashSet; +22 import java.util.Iterator; +23 import java.util.List; +24 import java.util.Set; +25 import java.util.TreeSet; +26 import java.util.logging.Level; +27 import java.util.logging.Logger; +28 import org.apache.commons.lang.StringUtils; +29 import org.owasp.dependencycheck.utils.DependencyVersion; +30 import org.owasp.dependencycheck.utils.DependencyVersionUtil; +31 import org.owasp.dependencycheck.utils.Filter; +32 import org.owasp.dependencycheck.utils.UrlStringUtils; +33 +34 /** +35 * Used to maintain a collection of Evidence. +36 * +37 * @author Jeremy Long <jeremy.long@owasp.org> +38 */ +39 public class EvidenceCollection implements Iterable<Evidence> { +40 +41 /** +42 * Used to iterate over highest confidence evidence contained in the collection. +43 */ +44 private static final Filter<Evidence> HIGHEST_CONFIDENCE = new Filter<Evidence>() { +45 public boolean passes(Evidence evidence) { +46 return evidence.getConfidence() == Confidence.HIGHEST; +47 } +48 }; +49 /** +50 * Used to iterate over high confidence evidence contained in the collection. +51 */ +52 private static final Filter<Evidence> HIGH_CONFIDENCE = new Filter<Evidence>() { +53 public boolean passes(Evidence evidence) { +54 return evidence.getConfidence() == Confidence.HIGH; +55 } +56 }; +57 /** +58 * Used to iterate over medium confidence evidence contained in the collection. +59 */ +60 private static final Filter<Evidence> MEDIUM_CONFIDENCE = new Filter<Evidence>() { +61 public boolean passes(Evidence evidence) { +62 return evidence.getConfidence() == Confidence.MEDIUM; +63 } +64 }; +65 /** +66 * Used to iterate over low confidence evidence contained in the collection. +67 */ +68 private static final Filter<Evidence> LOW_CONFIDENCE = new Filter<Evidence>() { +69 public boolean passes(Evidence evidence) { +70 return evidence.getConfidence() == Confidence.LOW; +71 } +72 }; +73 /** +74 * Used to iterate over evidence that has was used (aka read) from the collection. +75 */ +76 private static final Filter<Evidence> EVIDENCE_USED = new Filter<Evidence>() { +77 public boolean passes(Evidence evidence) { +78 return evidence.isUsed(); +79 } +80 }; +81 +82 /** +83 * Used to iterate over evidence of the specified confidence. +84 * +85 * @param confidence the confidence level for the evidence to be iterated over. +86 * @return Iterable<Evidence> an iterable collection of evidence +87 */ +88 public final Iterable<Evidence> iterator(Confidence confidence) { +89 if (confidence == Confidence.HIGHEST) { +90 return EvidenceCollection.HIGHEST_CONFIDENCE.filter(this.list); +91 } else if (confidence == Confidence.HIGH) { +92 return EvidenceCollection.HIGH_CONFIDENCE.filter(this.list); +93 } else if (confidence == Confidence.MEDIUM) { +94 return EvidenceCollection.MEDIUM_CONFIDENCE.filter(this.list); +95 } else { +96 return EvidenceCollection.LOW_CONFIDENCE.filter(this.list); +97 } +98 } +99 /** +100 * A collection of evidence. +101 */ +102 private final Set<Evidence> list; +103 /** +104 * A collection of strings used to adjust Lucene's term weighting. +105 */ +106 private final Set<String> weightedStrings; +107 +108 /** +109 * Creates a new EvidenceCollection. +110 */ +111 public EvidenceCollection() { +112 list = new TreeSet<Evidence>(); +113 weightedStrings = new HashSet<String>(); +114 } +115 +116 /** +117 * Adds evidence to the collection. +118 * +119 * @param e Evidence. +120 */ +121 public void addEvidence(Evidence e) { +122 list.add(e); +123 } +124 +125 /** +126 * Creates an Evidence object from the parameters and adds the resulting object to the collection. +127 * +128 * @param source the source of the Evidence. +129 * @param name the name of the Evidence. +130 * @param value the value of the Evidence. +131 * @param confidence the confidence of the Evidence. +132 */ +133 public void addEvidence(String source, String name, String value, Confidence confidence) { +134 final Evidence e = new Evidence(source, name, value, confidence); +135 addEvidence(e); +136 } +137 +138 /** +139 * Adds term to the weighting collection. The terms added here are used later to boost the score of other terms. +140 * This is a way of combining evidence from multiple sources to boost the confidence of the given evidence. +141 * +142 * Example: The term 'Apache' is found in the manifest of a JAR and is added to the Collection. When we parse the +143 * package names within the JAR file we may add these package names to the "weighted" strings collection to boost +144 * the score in the Lucene query. That way when we construct the Lucene query we find the term Apache in the +145 * collection AND in the weighted strings; as such, we will boost the confidence of the term Apache. +146 * +147 * @param str to add to the weighting collection. +148 */ +149 public void addWeighting(String str) { +150 weightedStrings.add(str); +151 } +152 +153 /** +154 * Returns a set of Weightings - a list of terms that are believed to be of higher confidence when also found in +155 * another location. +156 * +157 * @return Set<String> +158 */ +159 public Set<String> getWeighting() { +160 return weightedStrings; +161 } +162 +163 /** +164 * Returns the set of evidence. +165 * +166 * @return the set of evidence. +167 */ +168 public Set<Evidence> getEvidence() { +169 return list; +170 } +171 +172 /** +173 * Returns the set of evidence from a given source. +174 * +175 * @param source the source of the evidence +176 * @return the set of evidence. +177 */ +178 public Set<Evidence> getEvidence(String source) { +179 if (source == null) { +180 return null; +181 } +182 final Set<Evidence> ret = new HashSet<Evidence>(); +183 for (Evidence e : list) { +184 if (source.equals(e.getSource())) { +185 ret.add(e); +186 } +187 } +188 return ret; +189 } +190 +191 /** +192 * Returns the set of evidence from a given source and name. +193 * +194 * @param source the source of the evidence +195 * @param name the name of the evidence to return +196 * @return the set of evidence. +197 */ +198 public Set<Evidence> getEvidence(String source, String name) { +199 if (source == null || name == null) { +200 return null; +201 } +202 final Set<Evidence> ret = new HashSet<Evidence>(); +203 for (Evidence e : list) { +204 if (source.equals(e.getSource()) && name.equals(e.getName())) { +205 ret.add(e); +206 } +207 } +208 return ret; +209 } +210 +211 /** +212 * Implements the iterator interface for the Evidence Collection. +213 * +214 * @return an Iterator<Evidence>. +215 */ +216 public Iterator<Evidence> iterator() { +217 return list.iterator(); +218 } +219 +220 /** +221 * Used to determine if a given string was used (aka read). +222 * +223 * @param text the string to search for. +224 * @return whether or not the string was used. +225 */ +226 public boolean containsUsedString(String text) { +227 if (text == null) { +228 return false; +229 } +230 final String textToTest = text.toLowerCase(); +231 +232 for (Evidence e : EvidenceCollection.EVIDENCE_USED.filter(this)) { +233 //TODO consider changing the regex to only compare alpha-numeric (i.e. strip everything else) +234 final String value = urlCorrection(e.getValue().toLowerCase()).replaceAll("[\\s_-]", ""); +235 if (value.contains(textToTest)) { +236 return true; +237 } +238 } +239 return false; +240 } +241 +242 /** +243 * Used to determine if a given version was used (aka read) from the EvidenceCollection. +244 * +245 * @param version the version to search for within the collected evidence. +246 * @return whether or not the string was used. +247 */ +248 public boolean containsUsedVersion(DependencyVersion version) { +249 if (version == null) { +250 return false; +251 } 252 -253 /** -254 * Used to determine if a given version was used (aka read) from the -255 * EvidenceCollection. -256 * -257 * @param version the version to search for within the collected evidence. -258 * @return whether or not the string was used. -259 */ -260 public boolean containsUsedVersion(DependencyVersion version) { -261 if (version == null) { -262 return false; -263 } -264 -265 for (Evidence e : EvidenceCollection.EVIDENCE_USED.filter(this)) { -266 final DependencyVersion value = DependencyVersionUtil.parseVersion(e.getValue()); -267 if (value != null && value.matchesAtLeastThreeLevels(version)) { -268 return true; -269 } -270 } -271 return false; -272 } -273 -274 /** -275 * Returns whether or not the collection contains evidence of a specified -276 * Confidence. -277 * -278 * @param confidence A Confidence value. -279 * @return boolean. -280 */ -281 public boolean contains(Evidence.Confidence confidence) { -282 for (Evidence e : list) { -283 if (e.getConfidence().equals(confidence)) { -284 return true; -285 } -286 } -287 return false; -288 } -289 -290 /** -291 * Merges multiple EvidenceCollections together, only merging evidence that -292 * was used, into a new EvidenceCollection. -293 * -294 * @param ec One or more EvidenceCollections. -295 * @return a new EvidenceCollection containing the used evidence. -296 */ -297 public static EvidenceCollection mergeUsed(EvidenceCollection... ec) { -298 final EvidenceCollection ret = new EvidenceCollection(); -299 for (EvidenceCollection col : ec) { -300 for (Evidence e : col.list) { -301 if (e.isUsed()) { -302 ret.addEvidence(e); -303 } -304 } -305 } -306 return ret; -307 } -308 -309 /** -310 * Merges multiple EvidenceCollections together. -311 * -312 * @param ec One or more EvidenceCollections. -313 * @return a new EvidenceCollection. +253 for (Evidence e : EvidenceCollection.EVIDENCE_USED.filter(this)) { +254 final DependencyVersion value = DependencyVersionUtil.parseVersion(e.getValue()); +255 if (value != null && value.matchesAtLeastThreeLevels(version)) { +256 return true; +257 } +258 } +259 return false; +260 } +261 +262 /** +263 * Returns whether or not the collection contains evidence of a specified Confidence. +264 * +265 * @param confidence A Confidence value. +266 * @return boolean. +267 */ +268 public boolean contains(Confidence confidence) { +269 for (Evidence e : list) { +270 if (e.getConfidence().equals(confidence)) { +271 return true; +272 } +273 } +274 return false; +275 } +276 +277 /** +278 * Merges multiple EvidenceCollections together, only merging evidence that was used, into a new EvidenceCollection. +279 * +280 * @param ec One or more EvidenceCollections. +281 * @return a new EvidenceCollection containing the used evidence. +282 */ +283 public static EvidenceCollection mergeUsed(EvidenceCollection... ec) { +284 final EvidenceCollection ret = new EvidenceCollection(); +285 for (EvidenceCollection col : ec) { +286 for (Evidence e : col.list) { +287 if (e.isUsed()) { +288 ret.addEvidence(e); +289 } +290 } +291 } +292 return ret; +293 } +294 +295 /** +296 * Merges multiple EvidenceCollections together. +297 * +298 * @param ec One or more EvidenceCollections. +299 * @return a new EvidenceCollection. +300 */ +301 public static EvidenceCollection merge(EvidenceCollection... ec) { +302 final EvidenceCollection ret = new EvidenceCollection(); +303 for (EvidenceCollection col : ec) { +304 ret.list.addAll(col.list); +305 ret.weightedStrings.addAll(col.weightedStrings); +306 } +307 return ret; +308 } +309 +310 /** +311 * Returns a string of evidence 'values'. +312 * +313 * @return a string containing the evidence. 314 */ -315 public static EvidenceCollection merge(EvidenceCollection... ec) { -316 final EvidenceCollection ret = new EvidenceCollection(); -317 for (EvidenceCollection col : ec) { -318 ret.list.addAll(col.list); -319 ret.weightedStrings.addAll(col.weightedStrings); +315 @Override +316 public String toString() { +317 final StringBuilder sb = new StringBuilder(); +318 for (Evidence e : this.list) { +319 sb.append(e.getValue()).append(' '); 320 } -321 return ret; +321 return sb.toString(); 322 } 323 324 /** -325 * Returns a string of evidence 'values'. +325 * Returns the number of elements in the EvidenceCollection. 326 * -327 * @return a string containing the evidence. +327 * @return the number of elements in the collection. 328 */ -329 @Override -330 public String toString() { -331 final StringBuilder sb = new StringBuilder(); -332 for (Evidence e : this.list) { -333 sb.append(e.getValue()).append(' '); -334 } -335 return sb.toString(); -336 } -337 -338 /** -339 * Returns the number of elements in the EvidenceCollection. +329 public int size() { +330 return list.size(); +331 } +332 +333 /** +334 * <p> +335 * Takes a string that may contain a fully qualified domain and it will return the string having removed the query +336 * string, the protocol, the sub-domain of 'www', and the file extension of the path.</p> +337 * <p> +338 * This is useful for checking if the evidence contains a specific string. The presence of the protocol, file +339 * extension, etc. may produce false positives. 340 * -341 * @return the number of elements in the collection. -342 */ -343 public int size() { -344 return list.size(); -345 } -346 -347 /** -348 * <p>Takes a string that may contain a fully qualified domain and it will -349 * return the string having removed the query string, the protocol, the -350 * sub-domain of 'www', and the file extension of the path.</p> -351 * <p>This is useful for checking if the evidence contains a specific -352 * string. The presence of the protocol, file extension, etc. may produce -353 * false positives. -354 * -355 * <p>Example, given the following input:</p> -356 * <code>'Please visit https://www.somedomain.com/path1/path2/file.php?id=439'</code> -357 * <p>The function would return:</p> -358 * <code>'Please visit somedomain path1 path2 file'</code> -359 * -360 * @param value the value that may contain a url -361 * @return the modified string -362 */ -363 private String urlCorrection(String value) { -364 if (value == null || !UrlStringUtils.containsUrl(value)) { -365 return value; -366 } -367 final StringBuilder sb = new StringBuilder(value.length()); -368 final String[] parts = value.split("\\s"); -369 for (String part : parts) { -370 if (UrlStringUtils.isUrl(part)) { -371 try { -372 final List<String> data = UrlStringUtils.extractImportantUrlData(part); -373 sb.append(' ').append(StringUtils.join(data, ' ')); -374 } catch (MalformedURLException ex) { -375 Logger.getLogger(EvidenceCollection.class.getName()).log(Level.INFO, "error parsing " + part, ex); -376 sb.append(' ').append(part); -377 } -378 } else { -379 sb.append(' ').append(part); -380 } -381 } -382 return sb.toString().trim(); -383 } -384 } +341 * <p> +342 * Example, given the following input:</p> +343 * <code>'Please visit https://www.somedomain.com/path1/path2/file.php?id=439'</code> +344 * <p> +345 * The function would return:</p> +346 * <code>'Please visit somedomain path1 path2 file'</code> +347 * +348 * @param value the value that may contain a url +349 * @return the modified string +350 */ +351 private String urlCorrection(String value) { +352 if (value == null || !UrlStringUtils.containsUrl(value)) { +353 return value; +354 } +355 final StringBuilder sb = new StringBuilder(value.length()); +356 final String[] parts = value.split("\\s"); +357 for (String part : parts) { +358 if (UrlStringUtils.isUrl(part)) { +359 try { +360 final List<String> data = UrlStringUtils.extractImportantUrlData(part); +361 sb.append(' ').append(StringUtils.join(data, ' ')); +362 } catch (MalformedURLException ex) { +363 Logger.getLogger(EvidenceCollection.class.getName()).log(Level.INFO, "error parsing " + part, ex); +364 sb.append(' ').append(part); +365 } +366 } else { +367 sb.append(' ').append(part); +368 } +369 } +370 return sb.toString().trim(); +371 } +372 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/dependency/Identifier.html b/dependency-check-core/xref/org/owasp/dependencycheck/dependency/Identifier.html index 82bf8b6af..e34add7b7 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/dependency/Identifier.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/dependency/Identifier.html @@ -9,193 +9,217 @@ 1 /* 2 * This file is part of dependency-check-core. 3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. -18 */ -19 package org.owasp.dependencycheck.dependency; -20 -21 /** -22 * -23 * @author Jeremy Long <jeremy.long@owasp.org> -24 */ -25 public class Identifier implements Comparable<Identifier> { -26 -27 /** -28 * Constructs a new Identifier with the specified data. -29 * -30 * @param type the identifier type. -31 * @param value the identifier value. -32 * @param url the identifier url. -33 */ -34 public Identifier(String type, String value, String url) { -35 this.type = type; -36 this.value = value; -37 this.url = url; -38 } -39 -40 /** -41 * Constructs a new Identifier with the specified data. -42 * -43 * @param type the identifier type. -44 * @param value the identifier value. -45 * @param url the identifier url. -46 * @param description the description of the identifier. -47 */ -48 public Identifier(String type, String value, String url, String description) { -49 this(type, value, url); -50 this.description = description; -51 } +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. +17 */ +18 package org.owasp.dependencycheck.dependency; +19 +20 /** +21 * +22 * @author Jeremy Long <jeremy.long@owasp.org> +23 */ +24 public class Identifier implements Comparable<Identifier> { +25 +26 /** +27 * Constructs a new Identifier with the specified data. +28 * +29 * @param type the identifier type. +30 * @param value the identifier value. +31 * @param url the identifier url. +32 */ +33 public Identifier(String type, String value, String url) { +34 this.type = type; +35 this.value = value; +36 this.url = url; +37 } +38 +39 /** +40 * Constructs a new Identifier with the specified data. +41 * +42 * @param type the identifier type. +43 * @param value the identifier value. +44 * @param url the identifier url. +45 * @param description the description of the identifier. +46 */ +47 public Identifier(String type, String value, String url, String description) { +48 this(type, value, url); +49 this.description = description; +50 } +51 52 /** -53 * The value of the identifier +53 * The confidence that this is the correct identifier. 54 */ -55 private String value; +55 private Confidence confidence; 56 57 /** -58 * Get the value of value. +58 * Get the value of confidence. 59 * -60 * @return the value of value +60 * @return the value of confidence 61 */ -62 public String getValue() { -63 return value; +62 public Confidence getConfidence() { +63 return confidence; 64 } 65 66 /** -67 * Set the value of value. +67 * Set the value of confidence. 68 * -69 * @param value new value of value +69 * @param confidence new value of confidence 70 */ -71 public void setValue(String value) { -72 this.value = value; +71 public void setConfidence(Confidence confidence) { +72 this.confidence = confidence; 73 } -74 /** -75 * The url for the identifier. -76 */ -77 private String url; -78 -79 /** -80 * Get the value of url. -81 * -82 * @return the value of url -83 */ -84 public String getUrl() { -85 return url; -86 } -87 -88 /** -89 * Set the value of url. -90 * -91 * @param url new value of url -92 */ -93 public void setUrl(String url) { -94 this.url = url; -95 } -96 /** -97 * The type of the identifier. -98 */ -99 private String type; -100 -101 /** -102 * Get the value of type. -103 * -104 * @return the value of type -105 */ -106 public String getType() { -107 return type; -108 } -109 -110 /** -111 * <p>Set the value of type.</p><p>Example would be "CPE".</p> -112 * -113 * @param type new value of type -114 */ -115 public void setType(String type) { -116 this.type = type; -117 } -118 /** -119 * A description of the identifier. -120 */ -121 private String description; -122 -123 /** -124 * Get the value of description. -125 * -126 * @return the value of description -127 */ -128 public String getDescription() { -129 return description; -130 } -131 -132 /** -133 * Set the value of description. -134 * -135 * @param description new value of description -136 */ -137 public void setDescription(String description) { -138 this.description = description; -139 } -140 -141 @Override -142 public boolean equals(Object obj) { -143 if (obj == null) { -144 return false; -145 } -146 if (getClass() != obj.getClass()) { -147 return false; -148 } -149 final Identifier other = (Identifier) obj; -150 if ((this.value == null) ? (other.value != null) : !this.value.equals(other.value)) { -151 return false; -152 } -153 if ((this.type == null) ? (other.type != null) : !this.type.equals(other.type)) { -154 return false; -155 } -156 return true; -157 } -158 -159 @Override -160 public int hashCode() { -161 int hash = 5; -162 hash = 53 * hash + (this.value != null ? this.value.hashCode() : 0); -163 hash = 53 * hash + (this.type != null ? this.type.hashCode() : 0); -164 return hash; -165 } -166 -167 /** -168 * Standard implementation of toString; displays identifier value and type. -169 * -170 * @return a String representation of the object -171 */ -172 @Override -173 public String toString() { -174 return "Identifier{" + "value=" + value + ", type=" + type + '}'; -175 } -176 -177 /** -178 * Implementation of the comparator interface. This compares the value of -179 * the identifier only. -180 * -181 * @param o the object being compared -182 * @return an integer indicating the ordering -183 */ -184 public int compareTo(Identifier o) { -185 if (o == null) { -186 return -1; -187 } -188 return this.value.compareTo(o.value); -189 } -190 } +74 +75 /** +76 * The value of the identifier +77 */ +78 private String value; +79 +80 /** +81 * Get the value of value. +82 * +83 * @return the value of value +84 */ +85 public String getValue() { +86 return value; +87 } +88 +89 /** +90 * Set the value of value. +91 * +92 * @param value new value of value +93 */ +94 public void setValue(String value) { +95 this.value = value; +96 } +97 /** +98 * The url for the identifier. +99 */ +100 private String url; +101 +102 /** +103 * Get the value of url. +104 * +105 * @return the value of url +106 */ +107 public String getUrl() { +108 return url; +109 } +110 +111 /** +112 * Set the value of url. +113 * +114 * @param url new value of url +115 */ +116 public void setUrl(String url) { +117 this.url = url; +118 } +119 /** +120 * The type of the identifier. +121 */ +122 private String type; +123 +124 /** +125 * Get the value of type. +126 * +127 * @return the value of type +128 */ +129 public String getType() { +130 return type; +131 } +132 +133 /** +134 * <p> +135 * Set the value of type.</p><p> +136 * Example would be "CPE".</p> +137 * +138 * @param type new value of type +139 */ +140 public void setType(String type) { +141 this.type = type; +142 } +143 /** +144 * A description of the identifier. +145 */ +146 private String description; +147 +148 /** +149 * Get the value of description. +150 * +151 * @return the value of description +152 */ +153 public String getDescription() { +154 return description; +155 } +156 +157 /** +158 * Set the value of description. +159 * +160 * @param description new value of description +161 */ +162 public void setDescription(String description) { +163 this.description = description; +164 } +165 +166 @Override +167 public boolean equals(Object obj) { +168 if (obj == null) { +169 return false; +170 } +171 if (getClass() != obj.getClass()) { +172 return false; +173 } +174 final Identifier other = (Identifier) obj; +175 if ((this.value == null) ? (other.value != null) : !this.value.equals(other.value)) { +176 return false; +177 } +178 if ((this.type == null) ? (other.type != null) : !this.type.equals(other.type)) { +179 return false; +180 } +181 return true; +182 } +183 +184 @Override +185 public int hashCode() { +186 int hash = 5; +187 hash = 53 * hash + (this.value != null ? this.value.hashCode() : 0); +188 hash = 53 * hash + (this.type != null ? this.type.hashCode() : 0); +189 return hash; +190 } +191 +192 /** +193 * Standard implementation of toString; displays identifier value and type. +194 * +195 * @return a String representation of the object +196 */ +197 @Override +198 public String toString() { +199 return "Identifier{" + "value=" + value + ", type=" + type + '}'; +200 } +201 +202 /** +203 * Implementation of the comparator interface. This compares the value of the identifier only. +204 * +205 * @param o the object being compared +206 * @return an integer indicating the ordering +207 */ +208 public int compareTo(Identifier o) { +209 if (o == null) { +210 return -1; +211 } +212 return this.value.compareTo(o.value); +213 } +214 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/dependency/Reference.html b/dependency-check-core/xref/org/owasp/dependencycheck/dependency/Reference.html index 8c5528a0e..5196b34cc 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/dependency/Reference.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/dependency/Reference.html @@ -9,156 +9,154 @@ 1 /* 2 * This file is part of dependency-check-core. 3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. -18 */ -19 package org.owasp.dependencycheck.dependency; -20 -21 import java.io.Serializable; -22 -23 /** -24 * An external reference for a vulnerability. This contains a name, URL, and a -25 * source. -26 * -27 * @author Jeremy Long <jeremy.long@owasp.org> -28 */ -29 public class Reference implements Serializable, Comparable<Reference> { -30 -31 /** -32 * the serial version uid. -33 */ -34 private static final long serialVersionUID = -3444464824563008021L; -35 /** -36 * The name of the reference. -37 */ -38 private String name; -39 -40 /** -41 * Get the value of name. -42 * -43 * @return the value of name -44 */ -45 public String getName() { -46 return name; -47 } -48 -49 /** -50 * Set the value of name. -51 * -52 * @param name new value of name -53 */ -54 public void setName(String name) { -55 this.name = name; -56 } -57 /** -58 * the url for the reference. -59 */ -60 private String url; -61 -62 /** -63 * Get the value of url. -64 * -65 * @return the value of url -66 */ -67 public String getUrl() { -68 return url; -69 } -70 -71 /** -72 * Set the value of url. -73 * -74 * @param url new value of url -75 */ -76 public void setUrl(String url) { -77 this.url = url; -78 } -79 /** -80 * the source of the reference. -81 */ -82 private String source; -83 -84 /** -85 * Get the value of source. -86 * -87 * @return the value of source -88 */ -89 public String getSource() { -90 return source; -91 } -92 -93 /** -94 * Set the value of source. -95 * -96 * @param source new value of source -97 */ -98 public void setSource(String source) { -99 this.source = source; -100 } -101 -102 @Override -103 public boolean equals(Object obj) { -104 if (obj == null) { -105 return false; -106 } -107 if (getClass() != obj.getClass()) { -108 return false; -109 } -110 final Reference other = (Reference) obj; -111 if ((this.name == null) ? (other.name != null) : !this.name.equals(other.name)) { -112 return false; -113 } -114 if ((this.url == null) ? (other.url != null) : !this.url.equals(other.url)) { -115 return false; -116 } -117 if ((this.source == null) ? (other.source != null) : !this.source.equals(other.source)) { -118 return false; -119 } -120 return true; -121 } -122 -123 @Override -124 public int hashCode() { -125 int hash = 5; -126 hash = 67 * hash + (this.name != null ? this.name.hashCode() : 0); -127 hash = 67 * hash + (this.url != null ? this.url.hashCode() : 0); -128 hash = 67 * hash + (this.source != null ? this.source.hashCode() : 0); -129 return hash; -130 } -131 -132 /** -133 * Implementation of the comparable interface. -134 * -135 * @param o the Reference being compared -136 * @return an integer indicating the ordering of the two objects -137 */ -138 public int compareTo(Reference o) { -139 if (source.equals(o.source)) { -140 if (name.equals(o.name)) { -141 if (url.equals(o.url)) { -142 return 0; //they are equal -143 } else { -144 return url.compareTo(o.url); -145 } -146 } else { -147 return name.compareTo(o.name); -148 } -149 } else { -150 return source.compareTo(o.source); -151 } -152 } -153 } +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. +17 */ +18 package org.owasp.dependencycheck.dependency; +19 +20 import java.io.Serializable; +21 +22 /** +23 * An external reference for a vulnerability. This contains a name, URL, and a source. +24 * +25 * @author Jeremy Long <jeremy.long@owasp.org> +26 */ +27 public class Reference implements Serializable, Comparable<Reference> { +28 +29 /** +30 * the serial version uid. +31 */ +32 private static final long serialVersionUID = -3444464824563008021L; +33 /** +34 * The name of the reference. +35 */ +36 private String name; +37 +38 /** +39 * Get the value of name. +40 * +41 * @return the value of name +42 */ +43 public String getName() { +44 return name; +45 } +46 +47 /** +48 * Set the value of name. +49 * +50 * @param name new value of name +51 */ +52 public void setName(String name) { +53 this.name = name; +54 } +55 /** +56 * the url for the reference. +57 */ +58 private String url; +59 +60 /** +61 * Get the value of url. +62 * +63 * @return the value of url +64 */ +65 public String getUrl() { +66 return url; +67 } +68 +69 /** +70 * Set the value of url. +71 * +72 * @param url new value of url +73 */ +74 public void setUrl(String url) { +75 this.url = url; +76 } +77 /** +78 * the source of the reference. +79 */ +80 private String source; +81 +82 /** +83 * Get the value of source. +84 * +85 * @return the value of source +86 */ +87 public String getSource() { +88 return source; +89 } +90 +91 /** +92 * Set the value of source. +93 * +94 * @param source new value of source +95 */ +96 public void setSource(String source) { +97 this.source = source; +98 } +99 +100 @Override +101 public boolean equals(Object obj) { +102 if (obj == null) { +103 return false; +104 } +105 if (getClass() != obj.getClass()) { +106 return false; +107 } +108 final Reference other = (Reference) obj; +109 if ((this.name == null) ? (other.name != null) : !this.name.equals(other.name)) { +110 return false; +111 } +112 if ((this.url == null) ? (other.url != null) : !this.url.equals(other.url)) { +113 return false; +114 } +115 if ((this.source == null) ? (other.source != null) : !this.source.equals(other.source)) { +116 return false; +117 } +118 return true; +119 } +120 +121 @Override +122 public int hashCode() { +123 int hash = 5; +124 hash = 67 * hash + (this.name != null ? this.name.hashCode() : 0); +125 hash = 67 * hash + (this.url != null ? this.url.hashCode() : 0); +126 hash = 67 * hash + (this.source != null ? this.source.hashCode() : 0); +127 return hash; +128 } +129 +130 /** +131 * Implementation of the comparable interface. +132 * +133 * @param o the Reference being compared +134 * @return an integer indicating the ordering of the two objects +135 */ +136 public int compareTo(Reference o) { +137 if (source.equals(o.source)) { +138 if (name.equals(o.name)) { +139 if (url.equals(o.url)) { +140 return 0; //they are equal +141 } else { +142 return url.compareTo(o.url); +143 } +144 } else { +145 return name.compareTo(o.name); +146 } +147 } else { +148 return source.compareTo(o.source); +149 } +150 } +151 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/dependency/Vulnerability.html b/dependency-check-core/xref/org/owasp/dependencycheck/dependency/Vulnerability.html index 86ad26d0e..ac52ab64b 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/dependency/Vulnerability.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/dependency/Vulnerability.html @@ -9,401 +9,447 @@ 1 /* 2 * This file is part of dependency-check-core. 3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. -18 */ -19 package org.owasp.dependencycheck.dependency; -20 -21 import java.io.Serializable; -22 import java.util.Set; -23 import java.util.SortedSet; -24 import java.util.TreeSet; -25 -26 /** -27 * Contains the information about a vulnerability. -28 * -29 * @author Jeremy Long <jeremy.long@owasp.org> -30 */ -31 public class Vulnerability implements Serializable, Comparable<Vulnerability> { -32 -33 /** -34 * The serial version uid. -35 */ -36 private static final long serialVersionUID = 307319490326651052L; -37 /** -38 * The name of the vulnerability. -39 */ -40 private String name; -41 -42 /** -43 * Get the value of name. -44 * -45 * @return the value of name -46 */ -47 public String getName() { -48 return name; -49 } -50 -51 /** -52 * Set the value of name. -53 * -54 * @param name new value of name -55 */ -56 public void setName(String name) { -57 this.name = name; -58 } -59 /** -60 * the description of the vulnerability. -61 */ -62 private String description; -63 -64 /** -65 * Get the value of description. -66 * -67 * @return the value of description -68 */ -69 public String getDescription() { -70 return description; -71 } -72 -73 /** -74 * Set the value of description. -75 * -76 * @param description new value of description -77 */ -78 public void setDescription(String description) { -79 this.description = description; -80 } -81 /** -82 * References for this vulnerability. -83 */ -84 private SortedSet<Reference> references = new TreeSet<Reference>(); -85 -86 /** -87 * Get the value of references. -88 * -89 * @return the value of references -90 */ -91 public Set<Reference> getReferences() { -92 return references; -93 } -94 -95 /** -96 * Set the value of references. -97 * -98 * @param references new value of references -99 */ -100 public void setReferences(SortedSet<Reference> references) { -101 this.references = references; -102 } -103 -104 /** -105 * Adds a reference to the references collection. -106 * -107 * @param ref a reference for the vulnerability -108 */ -109 public void addReference(Reference ref) { -110 this.references.add(ref); -111 } -112 -113 /** -114 * Adds a reference. -115 * -116 * @param referenceSource the source of the reference -117 * @param referenceName the referenceName of the reference -118 * @param referenceUrl the url of the reference -119 */ -120 public void addReference(String referenceSource, String referenceName, String referenceUrl) { -121 final Reference ref = new Reference(); -122 ref.setSource(referenceSource); -123 ref.setName(referenceName); -124 ref.setUrl(referenceUrl); -125 this.references.add(ref); -126 } -127 /** -128 * A set of vulnerable software. -129 */ -130 private SortedSet<VulnerableSoftware> vulnerableSoftware = new TreeSet<VulnerableSoftware>(); -131 -132 /** -133 * Get the value of vulnerableSoftware. -134 * -135 * @return the value of vulnerableSoftware -136 */ -137 public Set<VulnerableSoftware> getVulnerableSoftware() { -138 return vulnerableSoftware; -139 } -140 -141 /** -142 * Set the value of vulnerableSoftware. -143 * -144 * @param vulnerableSoftware new value of vulnerableSoftware -145 */ -146 public void setVulnerableSoftware(SortedSet<VulnerableSoftware> vulnerableSoftware) { -147 this.vulnerableSoftware = vulnerableSoftware; -148 } -149 -150 /** -151 * Adds an entry for vulnerable software. -152 * -153 * @param cpe string representation of a CPE entry -154 * @return if the add succeeded -155 */ -156 public boolean addVulnerableSoftware(String cpe) { -157 return addVulnerableSoftware(cpe, null); -158 } -159 -160 /** -161 * Adds an entry for vulnerable software. -162 * -163 * @param cpe string representation of a cpe -164 * @param previousVersion the previous version (previousVersion - cpe would -165 * be considered vulnerable) -166 * @return if the add succeeded -167 */ -168 public boolean addVulnerableSoftware(String cpe, String previousVersion) { -169 final VulnerableSoftware vs = new VulnerableSoftware(); -170 vs.setCpe(cpe); -171 if (previousVersion != null) { -172 vs.setPreviousVersion(previousVersion); -173 } -174 return updateVulnerableSoftware(vs); -175 } -176 -177 /** -178 * Adds or updates a vulnerable software entry. -179 * -180 * @param vulnSoftware the vulnerable software -181 * @return if the update succeeded -182 */ -183 public boolean updateVulnerableSoftware(VulnerableSoftware vulnSoftware) { -184 if (vulnerableSoftware.contains(vulnSoftware)) { -185 vulnerableSoftware.remove(vulnSoftware); -186 } -187 return vulnerableSoftware.add(vulnSoftware); -188 } -189 /** -190 * The CWE for the vulnerability. -191 */ -192 private String cwe; -193 -194 /** -195 * Get the value of cwe. -196 * -197 * @return the value of cwe -198 */ -199 public String getCwe() { -200 return cwe; -201 } -202 -203 /** -204 * Set the value of cwe. -205 * -206 * @param cwe new value of cwe -207 */ -208 public void setCwe(String cwe) { -209 this.cwe = cwe; -210 } -211 /** -212 * CVSS Score. -213 */ -214 private float cvssScore; -215 -216 /** -217 * Get the value of cvssScore. -218 * -219 * @return the value of cvssScore -220 */ -221 public float getCvssScore() { -222 return cvssScore; -223 } -224 -225 /** -226 * Set the value of cvssScore. -227 * -228 * @param cvssScore new value of cvssScore -229 */ -230 public void setCvssScore(float cvssScore) { -231 this.cvssScore = cvssScore; -232 } -233 /** -234 * CVSS Access Vector. -235 */ -236 private String cvssAccessVector; -237 -238 /** -239 * Get the value of cvssAccessVector. -240 * -241 * @return the value of cvssAccessVector -242 */ -243 public String getCvssAccessVector() { -244 return cvssAccessVector; -245 } -246 -247 /** -248 * Set the value of cvssAccessVector. -249 * -250 * @param cvssAccessVector new value of cvssAccessVector -251 */ -252 public void setCvssAccessVector(String cvssAccessVector) { -253 this.cvssAccessVector = cvssAccessVector; -254 } -255 /** -256 * CVSS Access Complexity. -257 */ -258 private String cvssAccessComplexity; -259 -260 /** -261 * Get the value of cvssAccessComplexity. -262 * -263 * @return the value of cvssAccessComplexity -264 */ -265 public String getCvssAccessComplexity() { -266 return cvssAccessComplexity; -267 } -268 -269 /** -270 * Set the value of cvssAccessComplexity. -271 * -272 * @param cvssAccessComplexity new value of cvssAccessComplexity -273 */ -274 public void setCvssAccessComplexity(String cvssAccessComplexity) { -275 this.cvssAccessComplexity = cvssAccessComplexity; -276 } -277 /** -278 * CVSS Authentication. -279 */ -280 private String cvssAuthentication; -281 -282 /** -283 * Get the value of cvssAuthentication. -284 * -285 * @return the value of cvssAuthentication -286 */ -287 public String getCvssAuthentication() { -288 return cvssAuthentication; -289 } -290 -291 /** -292 * Set the value of cvssAuthentication. -293 * -294 * @param cvssAuthentication new value of cvssAuthentication -295 */ -296 public void setCvssAuthentication(String cvssAuthentication) { -297 this.cvssAuthentication = cvssAuthentication; -298 } -299 /** -300 * CVSS Confidentiality Impact. -301 */ -302 private String cvssConfidentialityImpact; -303 -304 /** -305 * Get the value of cvssConfidentialityImpact. -306 * -307 * @return the value of cvssConfidentialityImpact -308 */ -309 public String getCvssConfidentialityImpact() { -310 return cvssConfidentialityImpact; -311 } -312 -313 /** -314 * Set the value of cvssConfidentialityImpact. -315 * -316 * @param cvssConfidentialityImpact new value of cvssConfidentialityImpact -317 */ -318 public void setCvssConfidentialityImpact(String cvssConfidentialityImpact) { -319 this.cvssConfidentialityImpact = cvssConfidentialityImpact; -320 } -321 /** -322 * CVSS Integrity Impact. -323 */ -324 private String cvssIntegrityImpact; -325 -326 /** -327 * Get the value of cvssIntegrityImpact. -328 * -329 * @return the value of cvssIntegrityImpact -330 */ -331 public String getCvssIntegrityImpact() { -332 return cvssIntegrityImpact; -333 } -334 -335 /** -336 * Set the value of cvssIntegrityImpact. -337 * -338 * @param cvssIntegrityImpact new value of cvssIntegrityImpact -339 */ -340 public void setCvssIntegrityImpact(String cvssIntegrityImpact) { -341 this.cvssIntegrityImpact = cvssIntegrityImpact; -342 } -343 /** -344 * CVSS Availability Impact. -345 */ -346 private String cvssAvailabilityImpact; -347 -348 /** -349 * Get the value of cvssAvailabilityImpact. -350 * -351 * @return the value of cvssAvailabilityImpact -352 */ -353 public String getCvssAvailabilityImpact() { -354 return cvssAvailabilityImpact; -355 } -356 -357 /** -358 * Set the value of cvssAvailabilityImpact. -359 * -360 * @param cvssAvailabilityImpact new value of cvssAvailabilityImpact -361 */ -362 public void setCvssAvailabilityImpact(String cvssAvailabilityImpact) { -363 this.cvssAvailabilityImpact = cvssAvailabilityImpact; -364 } -365 -366 @Override -367 public boolean equals(Object obj) { -368 if (obj == null) { -369 return false; -370 } -371 if (getClass() != obj.getClass()) { -372 return false; -373 } -374 final Vulnerability other = (Vulnerability) obj; -375 if ((this.name == null) ? (other.name != null) : !this.name.equals(other.name)) { -376 return false; -377 } -378 return true; -379 } -380 -381 @Override -382 public int hashCode() { -383 int hash = 5; -384 hash = 41 * hash + (this.name != null ? this.name.hashCode() : 0); -385 return hash; -386 } -387 -388 /** -389 * Compares two vulnerabilities. -390 * -391 * @param v a vulnerability to be compared -392 * @return a negative integer, zero, or a positive integer as this object is -393 * less than, equal to, or greater than the specified vulnerability -394 */ -395 public int compareTo(Vulnerability v) { -396 return v.getName().compareTo(this.getName()); -397 } -398 } +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. +17 */ +18 package org.owasp.dependencycheck.dependency; +19 +20 import java.io.Serializable; +21 import java.util.Set; +22 import java.util.SortedSet; +23 import java.util.TreeSet; +24 +25 /** +26 * Contains the information about a vulnerability. +27 * +28 * @author Jeremy Long <jeremy.long@owasp.org> +29 */ +30 public class Vulnerability implements Serializable, Comparable<Vulnerability> { +31 +32 /** +33 * The serial version uid. +34 */ +35 private static final long serialVersionUID = 307319490326651052L; +36 /** +37 * The name of the vulnerability. +38 */ +39 private String name; +40 +41 /** +42 * Get the value of name. +43 * +44 * @return the value of name +45 */ +46 public String getName() { +47 return name; +48 } +49 +50 /** +51 * Set the value of name. +52 * +53 * @param name new value of name +54 */ +55 public void setName(String name) { +56 this.name = name; +57 } +58 /** +59 * the description of the vulnerability. +60 */ +61 private String description; +62 +63 /** +64 * Get the value of description. +65 * +66 * @return the value of description +67 */ +68 public String getDescription() { +69 return description; +70 } +71 +72 /** +73 * Set the value of description. +74 * +75 * @param description new value of description +76 */ +77 public void setDescription(String description) { +78 this.description = description; +79 } +80 /** +81 * References for this vulnerability. +82 */ +83 private SortedSet<Reference> references = new TreeSet<Reference>(); +84 +85 /** +86 * Get the value of references. +87 * +88 * @return the value of references +89 */ +90 public Set<Reference> getReferences() { +91 return references; +92 } +93 +94 /** +95 * Set the value of references. +96 * +97 * @param references new value of references +98 */ +99 public void setReferences(SortedSet<Reference> references) { +100 this.references = references; +101 } +102 +103 /** +104 * Adds a reference to the references collection. +105 * +106 * @param ref a reference for the vulnerability +107 */ +108 public void addReference(Reference ref) { +109 this.references.add(ref); +110 } +111 +112 /** +113 * Adds a reference. +114 * +115 * @param referenceSource the source of the reference +116 * @param referenceName the referenceName of the reference +117 * @param referenceUrl the url of the reference +118 */ +119 public void addReference(String referenceSource, String referenceName, String referenceUrl) { +120 final Reference ref = new Reference(); +121 ref.setSource(referenceSource); +122 ref.setName(referenceName); +123 ref.setUrl(referenceUrl); +124 this.references.add(ref); +125 } +126 /** +127 * A set of vulnerable software. +128 */ +129 private SortedSet<VulnerableSoftware> vulnerableSoftware = new TreeSet<VulnerableSoftware>(); +130 +131 /** +132 * Get the value of vulnerableSoftware. +133 * +134 * @return the value of vulnerableSoftware +135 */ +136 public Set<VulnerableSoftware> getVulnerableSoftware() { +137 return vulnerableSoftware; +138 } +139 +140 /** +141 * Set the value of vulnerableSoftware. +142 * +143 * @param vulnerableSoftware new value of vulnerableSoftware +144 */ +145 public void setVulnerableSoftware(SortedSet<VulnerableSoftware> vulnerableSoftware) { +146 this.vulnerableSoftware = vulnerableSoftware; +147 } +148 +149 /** +150 * Adds an entry for vulnerable software. +151 * +152 * @param cpe string representation of a CPE entry +153 * @return if the add succeeded +154 */ +155 public boolean addVulnerableSoftware(String cpe) { +156 return addVulnerableSoftware(cpe, null); +157 } +158 +159 /** +160 * Adds an entry for vulnerable software. +161 * +162 * @param cpe string representation of a cpe +163 * @param previousVersion the previous version (previousVersion - cpe would be considered vulnerable) +164 * @return if the add succeeded +165 */ +166 public boolean addVulnerableSoftware(String cpe, String previousVersion) { +167 final VulnerableSoftware vs = new VulnerableSoftware(); +168 vs.setCpe(cpe); +169 if (previousVersion != null) { +170 vs.setPreviousVersion(previousVersion); +171 } +172 return updateVulnerableSoftware(vs); +173 } +174 +175 /** +176 * Adds or updates a vulnerable software entry. +177 * +178 * @param vulnSoftware the vulnerable software +179 * @return if the update succeeded +180 */ +181 public boolean updateVulnerableSoftware(VulnerableSoftware vulnSoftware) { +182 if (vulnerableSoftware.contains(vulnSoftware)) { +183 vulnerableSoftware.remove(vulnSoftware); +184 } +185 return vulnerableSoftware.add(vulnSoftware); +186 } +187 /** +188 * The CWE for the vulnerability. +189 */ +190 private String cwe; +191 +192 /** +193 * Get the value of cwe. +194 * +195 * @return the value of cwe +196 */ +197 public String getCwe() { +198 return cwe; +199 } +200 +201 /** +202 * Set the value of cwe. +203 * +204 * @param cwe new value of cwe +205 */ +206 public void setCwe(String cwe) { +207 this.cwe = cwe; +208 } +209 /** +210 * CVSS Score. +211 */ +212 private float cvssScore; +213 +214 /** +215 * Get the value of cvssScore. +216 * +217 * @return the value of cvssScore +218 */ +219 public float getCvssScore() { +220 return cvssScore; +221 } +222 +223 /** +224 * Set the value of cvssScore. +225 * +226 * @param cvssScore new value of cvssScore +227 */ +228 public void setCvssScore(float cvssScore) { +229 this.cvssScore = cvssScore; +230 } +231 /** +232 * CVSS Access Vector. +233 */ +234 private String cvssAccessVector; +235 +236 /** +237 * Get the value of cvssAccessVector. +238 * +239 * @return the value of cvssAccessVector +240 */ +241 public String getCvssAccessVector() { +242 return cvssAccessVector; +243 } +244 +245 /** +246 * Set the value of cvssAccessVector. +247 * +248 * @param cvssAccessVector new value of cvssAccessVector +249 */ +250 public void setCvssAccessVector(String cvssAccessVector) { +251 this.cvssAccessVector = cvssAccessVector; +252 } +253 /** +254 * CVSS Access Complexity. +255 */ +256 private String cvssAccessComplexity; +257 +258 /** +259 * Get the value of cvssAccessComplexity. +260 * +261 * @return the value of cvssAccessComplexity +262 */ +263 public String getCvssAccessComplexity() { +264 return cvssAccessComplexity; +265 } +266 +267 /** +268 * Set the value of cvssAccessComplexity. +269 * +270 * @param cvssAccessComplexity new value of cvssAccessComplexity +271 */ +272 public void setCvssAccessComplexity(String cvssAccessComplexity) { +273 this.cvssAccessComplexity = cvssAccessComplexity; +274 } +275 /** +276 * CVSS Authentication. +277 */ +278 private String cvssAuthentication; +279 +280 /** +281 * Get the value of cvssAuthentication. +282 * +283 * @return the value of cvssAuthentication +284 */ +285 public String getCvssAuthentication() { +286 return cvssAuthentication; +287 } +288 +289 /** +290 * Set the value of cvssAuthentication. +291 * +292 * @param cvssAuthentication new value of cvssAuthentication +293 */ +294 public void setCvssAuthentication(String cvssAuthentication) { +295 this.cvssAuthentication = cvssAuthentication; +296 } +297 /** +298 * CVSS Confidentiality Impact. +299 */ +300 private String cvssConfidentialityImpact; +301 +302 /** +303 * Get the value of cvssConfidentialityImpact. +304 * +305 * @return the value of cvssConfidentialityImpact +306 */ +307 public String getCvssConfidentialityImpact() { +308 return cvssConfidentialityImpact; +309 } +310 +311 /** +312 * Set the value of cvssConfidentialityImpact. +313 * +314 * @param cvssConfidentialityImpact new value of cvssConfidentialityImpact +315 */ +316 public void setCvssConfidentialityImpact(String cvssConfidentialityImpact) { +317 this.cvssConfidentialityImpact = cvssConfidentialityImpact; +318 } +319 /** +320 * CVSS Integrity Impact. +321 */ +322 private String cvssIntegrityImpact; +323 +324 /** +325 * Get the value of cvssIntegrityImpact. +326 * +327 * @return the value of cvssIntegrityImpact +328 */ +329 public String getCvssIntegrityImpact() { +330 return cvssIntegrityImpact; +331 } +332 +333 /** +334 * Set the value of cvssIntegrityImpact. +335 * +336 * @param cvssIntegrityImpact new value of cvssIntegrityImpact +337 */ +338 public void setCvssIntegrityImpact(String cvssIntegrityImpact) { +339 this.cvssIntegrityImpact = cvssIntegrityImpact; +340 } +341 /** +342 * CVSS Availability Impact. +343 */ +344 private String cvssAvailabilityImpact; +345 +346 /** +347 * Get the value of cvssAvailabilityImpact. +348 * +349 * @return the value of cvssAvailabilityImpact +350 */ +351 public String getCvssAvailabilityImpact() { +352 return cvssAvailabilityImpact; +353 } +354 +355 /** +356 * Set the value of cvssAvailabilityImpact. +357 * +358 * @param cvssAvailabilityImpact new value of cvssAvailabilityImpact +359 */ +360 public void setCvssAvailabilityImpact(String cvssAvailabilityImpact) { +361 this.cvssAvailabilityImpact = cvssAvailabilityImpact; +362 } +363 +364 @Override +365 public boolean equals(Object obj) { +366 if (obj == null) { +367 return false; +368 } +369 if (getClass() != obj.getClass()) { +370 return false; +371 } +372 final Vulnerability other = (Vulnerability) obj; +373 if ((this.name == null) ? (other.name != null) : !this.name.equals(other.name)) { +374 return false; +375 } +376 return true; +377 } +378 +379 @Override +380 public int hashCode() { +381 int hash = 5; +382 hash = 41 * hash + (this.name != null ? this.name.hashCode() : 0); +383 return hash; +384 } +385 +386 /** +387 * Compares two vulnerabilities. +388 * +389 * @param v a vulnerability to be compared +390 * @return a negative integer, zero, or a positive integer as this object is less than, equal to, or greater than +391 * the specified vulnerability +392 */ +393 public int compareTo(Vulnerability v) { +394 return v.getName().compareTo(this.getName()); +395 } +396 +397 /** +398 * The CPE id that caused this vulnerability to be flagged. +399 */ +400 private String matchedCPE; +401 /** +402 * Whether or not all previous versions were affected. +403 */ +404 private String matchedAllPreviousCPE; +405 +406 /** +407 * Sets the CPE that caused this vulnerability to be flagged. +408 * +409 * @param cpeId a CPE identifier +410 * @param previous a flag indicating whether or not all previous versions were affected (any non-null value is +411 * considered true) +412 */ +413 public void setMatchedCPE(String cpeId, String previous) { +414 matchedCPE = cpeId; +415 matchedAllPreviousCPE = previous; +416 } +417 +418 /** +419 * Get the value of matchedCPE. +420 * +421 * @return the value of matchedCPE +422 */ +423 public String getMatchedCPE() { +424 return matchedCPE; +425 } +426 +427 /** +428 * Get the value of matchedAllPreviousCPE. +429 * +430 * @return the value of matchedAllPreviousCPE +431 */ +432 public String getMatchedAllPreviousCPE() { +433 return matchedAllPreviousCPE; +434 } +435 +436 /** +437 * Determines whether or not matchedAllPreviousCPE has been set. +438 * +439 * @return true if matchedAllPreviousCPE is not null; otherwise false +440 */ +441 public boolean hasMatchedAllPreviousCPE() { +442 return matchedAllPreviousCPE != null; +443 } +444 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/dependency/VulnerabilityComparator.html b/dependency-check-core/xref/org/owasp/dependencycheck/dependency/VulnerabilityComparator.html index 9cbe61316..066926a57 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/dependency/VulnerabilityComparator.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/dependency/VulnerabilityComparator.html @@ -9,49 +9,48 @@ 1 /* 2 * This file is part of dependency-check-core. 3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. -18 */ -19 package org.owasp.dependencycheck.dependency; -20 -21 import java.io.Serializable; -22 import java.util.Comparator; -23 -24 /** -25 * Comparator for Vulnerability objects. -26 * -27 * @author Jeremy Long <jeremy.long@owasp.org> -28 */ -29 public class VulnerabilityComparator implements Comparator<Vulnerability>, Serializable { -30 -31 /** -32 * The serial version UID. -33 */ -34 private static final long serialVersionUID = 1L; -35 -36 /** -37 * Implements the comparison of vulnerabilities. -38 * -39 * @param o1 a vulnerability -40 * @param o2 a second vulnerability -41 * @return the comparison -42 */ -43 public int compare(Vulnerability o1, Vulnerability o2) { -44 return o2.getName().compareTo(o1.getName()); -45 } -46 } +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. +17 */ +18 package org.owasp.dependencycheck.dependency; +19 +20 import java.io.Serializable; +21 import java.util.Comparator; +22 +23 /** +24 * Comparator for Vulnerability objects. +25 * +26 * @author Jeremy Long <jeremy.long@owasp.org> +27 */ +28 public class VulnerabilityComparator implements Comparator<Vulnerability>, Serializable { +29 +30 /** +31 * The serial version UID. +32 */ +33 private static final long serialVersionUID = 1L; +34 +35 /** +36 * Implements the comparison of vulnerabilities. +37 * +38 * @param o1 a vulnerability +39 * @param o2 a second vulnerability +40 * @return the comparison +41 */ +42 public int compare(Vulnerability o1, Vulnerability o2) { +43 return o2.getName().compareTo(o1.getName()); +44 } +45 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/dependency/VulnerableSoftware.html b/dependency-check-core/xref/org/owasp/dependencycheck/dependency/VulnerableSoftware.html index 5f2476833..e664d2529 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/dependency/VulnerableSoftware.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/dependency/VulnerableSoftware.html @@ -9,128 +9,128 @@ 1 /* 2 * This file is part of dependency-check-core. 3 * -4 * Dependency-check-core is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-core is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-core. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. -18 */ -19 package org.owasp.dependencycheck.dependency; -20 -21 import java.io.Serializable; -22 import java.io.UnsupportedEncodingException; -23 import java.net.URLDecoder; -24 import java.util.logging.Level; -25 import java.util.logging.Logger; -26 import org.owasp.dependencycheck.data.cpe.IndexEntry; -27 -28 /** -29 * A record containing information about vulnerable software. This is referenced -30 * from a vulnerability. -31 * -32 * @author Jeremy Long <jeremy.long@owasp.org> -33 */ -34 public class VulnerableSoftware extends IndexEntry implements Serializable, Comparable<VulnerableSoftware> { -35 -36 /** -37 * The serial version UID. -38 */ -39 private static final long serialVersionUID = 307319490326651052L; -40 -41 /** -42 * Parse a CPE entry from the cpe string representation. -43 * -44 * @param cpe a cpe entry (e.g. cpe:/a:vendor:software:version) -45 */ -46 public void setCpe(String cpe) { -47 try { -48 parseName(cpe); -49 } catch (UnsupportedEncodingException ex) { -50 final String msg = String.format("Character encoding is unsupported for CPE '%s'.", cpe); -51 Logger.getLogger(VulnerableSoftware.class.getName()).log(Level.WARNING, msg); -52 Logger.getLogger(VulnerableSoftware.class.getName()).log(Level.FINE, null, ex); -53 setName(cpe); -54 } -55 } -56 -57 /** -58 * <p>Parses a name attribute value, from the cpe.xml, into its -59 * corresponding parts: vendor, product, version, revision.</p> -60 * <p>Example:</p> +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2012 Jeremy Long. All Rights Reserved. +17 */ +18 package org.owasp.dependencycheck.dependency; +19 +20 import java.io.Serializable; +21 import java.io.UnsupportedEncodingException; +22 import java.net.URLDecoder; +23 import java.util.logging.Level; +24 import java.util.logging.Logger; +25 import org.owasp.dependencycheck.data.cpe.IndexEntry; +26 +27 /** +28 * A record containing information about vulnerable software. This is referenced from a vulnerability. +29 * +30 * @author Jeremy Long <jeremy.long@owasp.org> +31 */ +32 public class VulnerableSoftware extends IndexEntry implements Serializable, Comparable<VulnerableSoftware> { +33 +34 /** +35 * The serial version UID. +36 */ +37 private static final long serialVersionUID = 307319490326651052L; +38 +39 /** +40 * Parse a CPE entry from the cpe string representation. +41 * +42 * @param cpe a cpe entry (e.g. cpe:/a:vendor:software:version) +43 */ +44 public void setCpe(String cpe) { +45 try { +46 parseName(cpe); +47 } catch (UnsupportedEncodingException ex) { +48 final String msg = String.format("Character encoding is unsupported for CPE '%s'.", cpe); +49 Logger.getLogger(VulnerableSoftware.class.getName()).log(Level.WARNING, msg); +50 Logger.getLogger(VulnerableSoftware.class.getName()).log(Level.FINE, null, ex); +51 setName(cpe); +52 } +53 } +54 +55 /** +56 * <p> +57 * Parses a name attribute value, from the cpe.xml, into its corresponding parts: vendor, product, version, +58 * revision.</p> +59 * <p> +60 * Example:</p> 61 * <code>&nbsp;&nbsp;&nbsp;cpe:/a:apache:struts:1.1:rc2</code> 62 * -63 * <p>Results in:</p> <ul> <li>Vendor: apache</li> <li>Product: struts</li> -64 * <li>Version: 1.1</li> <li>Revision: rc2</li> </ul> -65 * -66 * @param cpeName the cpe name -67 * @throws UnsupportedEncodingException should never be thrown... -68 */ -69 @Override -70 public void parseName(String cpeName) throws UnsupportedEncodingException { -71 this.name = cpeName; -72 if (cpeName != null && cpeName.length() > 7) { -73 final String[] data = cpeName.substring(7).split(":"); -74 if (data.length >= 1) { -75 this.setVendor(URLDecoder.decode(data[0].replace("+", "%2B"), "UTF-8")); //.replaceAll("[_-]", " ") -76 if (data.length >= 2) { -77 this.setProduct(URLDecoder.decode(data[1].replace("+", "%2B"), "UTF-8")); //.replaceAll("[_-]", " ") -78 if (data.length >= 3) { -79 version = URLDecoder.decode(data[2].replace("+", "%2B"), "UTF-8"); -80 if (data.length >= 4) { -81 revision = URLDecoder.decode(data[3].replace("+", "%2B"), "UTF-8"); -82 if (data.length >= 5) { -83 edition = URLDecoder.decode(data[4].replace("+", "%2B"), "UTF-8"); -84 } -85 } -86 } -87 } -88 } -89 } -90 } -91 /** -92 * If present, indicates that previous version are vulnerable. -93 */ -94 private String previousVersion; -95 -96 /** -97 * Indicates if previous versions of this software are vulnerable. -98 * -99 * @return if previous versions of this software are vulnerable -100 */ -101 public boolean hasPreviousVersion() { -102 return previousVersion != null; -103 } -104 -105 /** -106 * Get the value of previousVersion. -107 * -108 * @return the value of previousVersion -109 */ -110 public String getPreviousVersion() { -111 return previousVersion; -112 } -113 -114 /** -115 * Set the value of previousVersion. -116 * -117 * @param previousVersion new value of previousVersion -118 */ -119 public void setPreviousVersion(String previousVersion) { -120 this.previousVersion = previousVersion; -121 } -122 -123 /** -124 * Standard equals implementation to compare this VulnerableSoftware to -125 * another object. +63 * <p> +64 * Results in:</p> <ul> <li>Vendor: apache</li> <li>Product: struts</li> +65 * <li>Version: 1.1</li> <li>Revision: rc2</li> </ul> +66 * +67 * @param cpeName the cpe name +68 * @throws UnsupportedEncodingException should never be thrown... +69 */ +70 @Override +71 public void parseName(String cpeName) throws UnsupportedEncodingException { +72 this.name = cpeName; +73 if (cpeName != null && cpeName.length() > 7) { +74 final String[] data = cpeName.substring(7).split(":"); +75 if (data.length >= 1) { +76 this.setVendor(URLDecoder.decode(data[0].replace("+", "%2B"), "UTF-8")); +77 } +78 if (data.length >= 2) { +79 this.setProduct(URLDecoder.decode(data[1].replace("+", "%2B"), "UTF-8")); +80 } +81 if (data.length >= 3) { +82 version = URLDecoder.decode(data[2].replace("+", "%2B"), "UTF-8"); +83 } +84 if (data.length >= 4) { +85 revision = URLDecoder.decode(data[3].replace("+", "%2B"), "UTF-8"); +86 } +87 if (data.length >= 5) { +88 edition = URLDecoder.decode(data[4].replace("+", "%2B"), "UTF-8"); +89 } +90 } +91 } +92 /** +93 * If present, indicates that previous version are vulnerable. +94 */ +95 private String previousVersion; +96 +97 /** +98 * Indicates if previous versions of this software are vulnerable. +99 * +100 * @return if previous versions of this software are vulnerable +101 */ +102 public boolean hasPreviousVersion() { +103 return previousVersion != null; +104 } +105 +106 /** +107 * Get the value of previousVersion. +108 * +109 * @return the value of previousVersion +110 */ +111 public String getPreviousVersion() { +112 return previousVersion; +113 } +114 +115 /** +116 * Set the value of previousVersion. +117 * +118 * @param previousVersion new value of previousVersion +119 */ +120 public void setPreviousVersion(String previousVersion) { +121 this.previousVersion = previousVersion; +122 } +123 +124 /** +125 * Standard equals implementation to compare this VulnerableSoftware to another object. 126 * 127 * @param obj the object to compare 128 * @return whether or not the objects are equal @@ -163,182 +163,181 @@ 155 } 156 157 /** -158 * Standard toString() implementation display the name and whether or not -159 * previous versions are also affected. -160 * -161 * @return a string representation of the object -162 */ -163 @Override -164 public String toString() { -165 return "VulnerableSoftware{ name=" + name + ", previousVersion=" + previousVersion + '}'; -166 } -167 -168 /** -169 * Implementation of the comparable interface. -170 * -171 * @param vs the VulnerableSoftware to compare -172 * @return an integer indicating the ordering of the two objects -173 */ -174 @Override -175 public int compareTo(VulnerableSoftware vs) { -176 int result = 0; -177 final String[] left = this.getName().split(":"); -178 final String[] right = vs.getName().split(":"); -179 final int max = (left.length <= right.length) ? left.length : right.length; -180 if (max > 0) { -181 for (int i = 0; result == 0 && i < max; i++) { -182 final String[] subLeft = left[i].split("\\."); -183 final String[] subRight = right[i].split("\\."); -184 final int subMax = (subLeft.length <= subRight.length) ? subLeft.length : subRight.length; -185 if (subMax > 0) { -186 for (int x = 0; result == 0 && x < subMax; x++) { -187 if (isPositiveInteger(subLeft[x]) && isPositiveInteger(subRight[x])) { -188 final int iLeft = Integer.parseInt(subLeft[x]); -189 final int iRight = Integer.parseInt(subRight[x]); -190 if (iLeft != iRight) { -191 if (iLeft > iRight) { -192 result = 2; -193 } else { -194 result = -2; -195 } -196 } -197 } else { -198 result = subLeft[x].compareToIgnoreCase(subRight[x]); -199 } -200 } -201 if (result == 0) { -202 if (subLeft.length > subRight.length) { -203 result = 2; -204 } -205 if (subRight.length > subLeft.length) { -206 result = -2; -207 } -208 } -209 } else { -210 result = left[i].compareToIgnoreCase(right[i]); -211 } -212 } -213 if (result == 0) { -214 if (left.length > right.length) { -215 result = 2; -216 } -217 if (right.length > left.length) { -218 result = -2; -219 } -220 } -221 } else { -222 result = this.getName().compareToIgnoreCase(vs.getName()); -223 } -224 return result; -225 } -226 -227 /** -228 * Determines if the string passed in is a positive integer. -229 * -230 * @param str the string to test -231 * @return true if the string only contains 0-9, otherwise false. -232 */ -233 private static boolean isPositiveInteger(final String str) { -234 if (str == null || str.isEmpty()) { -235 return false; -236 } -237 for (int i = 0; i < str.length(); i++) { -238 final char c = str.charAt(i); -239 if (c < '0' || c > '9') { -240 return false; -241 } -242 } -243 return true; -244 } -245 /** -246 * The name of the cpe. -247 */ -248 private String name; -249 -250 /** -251 * Get the value of name. -252 * -253 * @return the value of name -254 */ -255 public String getName() { -256 return name; -257 } -258 -259 /** -260 * Set the value of name. -261 * -262 * @param name new value of name -263 */ -264 public void setName(String name) { -265 this.name = name; -266 } -267 /** -268 * The product version number. -269 */ -270 private String version; -271 -272 /** -273 * Get the value of version. -274 * -275 * @return the value of version -276 */ -277 public String getVersion() { -278 return version; -279 } -280 -281 /** -282 * Set the value of version. -283 * -284 * @param version new value of version -285 */ -286 public void setVersion(String version) { -287 this.version = version; -288 } -289 /** -290 * The product revision version. -291 */ -292 private String revision; -293 -294 /** -295 * Get the value of revision. -296 * -297 * @return the value of revision -298 */ -299 public String getRevision() { -300 return revision; -301 } -302 -303 /** -304 * Set the value of revision. -305 * -306 * @param revision new value of revision -307 */ -308 public void setRevision(String revision) { -309 this.revision = revision; -310 } -311 /** -312 * The product edition. -313 */ -314 private String edition; -315 -316 /** -317 * Get the value of edition. -318 * -319 * @return the value of edition -320 */ -321 public String getEdition() { -322 return edition; -323 } -324 -325 /** -326 * Set the value of edition. -327 * -328 * @param edition new value of edition -329 */ -330 public void setEdition(String edition) { -331 this.edition = edition; -332 } -333 } +158 * Standard toString() implementation display the name and whether or not previous versions are also affected. +159 * +160 * @return a string representation of the object +161 */ +162 @Override +163 public String toString() { +164 return "VulnerableSoftware{ name=" + name + ", previousVersion=" + previousVersion + '}'; +165 } +166 +167 /** +168 * Implementation of the comparable interface. +169 * +170 * @param vs the VulnerableSoftware to compare +171 * @return an integer indicating the ordering of the two objects +172 */ +173 @Override +174 public int compareTo(VulnerableSoftware vs) { +175 int result = 0; +176 final String[] left = this.getName().split(":"); +177 final String[] right = vs.getName().split(":"); +178 final int max = (left.length <= right.length) ? left.length : right.length; +179 if (max > 0) { +180 for (int i = 0; result == 0 && i < max; i++) { +181 final String[] subLeft = left[i].split("\\."); +182 final String[] subRight = right[i].split("\\."); +183 final int subMax = (subLeft.length <= subRight.length) ? subLeft.length : subRight.length; +184 if (subMax > 0) { +185 for (int x = 0; result == 0 && x < subMax; x++) { +186 if (isPositiveInteger(subLeft[x]) && isPositiveInteger(subRight[x])) { +187 final int iLeft = Integer.parseInt(subLeft[x]); +188 final int iRight = Integer.parseInt(subRight[x]); +189 if (iLeft != iRight) { +190 if (iLeft > iRight) { +191 result = 2; +192 } else { +193 result = -2; +194 } +195 } +196 } else { +197 result = subLeft[x].compareToIgnoreCase(subRight[x]); +198 } +199 } +200 if (result == 0) { +201 if (subLeft.length > subRight.length) { +202 result = 2; +203 } +204 if (subRight.length > subLeft.length) { +205 result = -2; +206 } +207 } +208 } else { +209 result = left[i].compareToIgnoreCase(right[i]); +210 } +211 } +212 if (result == 0) { +213 if (left.length > right.length) { +214 result = 2; +215 } +216 if (right.length > left.length) { +217 result = -2; +218 } +219 } +220 } else { +221 result = this.getName().compareToIgnoreCase(vs.getName()); +222 } +223 return result; +224 } +225 +226 /** +227 * Determines if the string passed in is a positive integer. +228 * +229 * @param str the string to test +230 * @return true if the string only contains 0-9, otherwise false. +231 */ +232 private static boolean isPositiveInteger(final String str) { +233 if (str == null || str.isEmpty()) { +234 return false; +235 } +236 for (int i = 0; i < str.length(); i++) { +237 final char c = str.charAt(i); +238 if (c < '0' || c > '9') { +239 return false; +240 } +241 } +242 return true; +243 } +244 /** +245 * The name of the cpe. +246 */ +247 private String name; +248 +249 /** +250 * Get the value of name. +251 * +252 * @return the value of name +253 */ +254 public String getName() { +255 return name; +256 } +257 +258 /** +259 * Set the value of name. +260 * +261 * @param name new value of name +262 */ +263 public void setName(String name) { +264 this.name = name; +265 } +266 /** +267 * The product version number. +268 */ +269 private String version; +270 +271 /** +272 * Get the value of version. +273 * +274 * @return the value of version +275 */ +276 public String getVersion() { +277 return version; +278 } +279 +280 /** +281 * Set the value of version. +282 * +283 * @param version new value of version +284 */ +285 public void setVersion(String version) { +286 this.version = version; +287 } +288 /** +289 * The product revision version. +290 */ +291 private String revision; +292 +293 /** +294 * Get the value of revision. +295 * +296 * @return the value of revision +297 */ +298 public String getRevision() { +299 return revision; +300 } +301 +302 /** +303 * Set the value of revision. +304 * +305 * @param revision new value of revision +306 */ +307 public void setRevision(String revision) { +308 this.revision = revision; +309 } +310 /** +311 * The product edition. +312 */ +313 private String edition; +314 +315 /** +316 * Get the value of edition. +317 * +318 * @return the value of edition +319 */ +320 public String getEdition() { +321 return edition; +322 } +323 +324 /** +325 * Set the value of edition. +326 * +327 * @param edition new value of edition +328 */ +329 public void setEdition(String edition) { +330 this.edition = edition; +331 } +332 }
    diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/dependency/package-frame.html b/dependency-check-core/xref/org/owasp/dependencycheck/dependency/package-frame.html index d1e9b1e49..8bd91f84b 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/dependency/package-frame.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/dependency/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.0.8 Reference Package org.owasp.dependencycheck.dependency + Dependency-Check Core 1.1.0 Reference Package org.owasp.dependencycheck.dependency @@ -16,7 +16,7 @@
    • - Confidence + Confidence
    • Dependency diff --git a/dependency-check-core/xref/org/owasp/dependencycheck/dependency/package-summary.html b/dependency-check-core/xref/org/owasp/dependencycheck/dependency/package-summary.html index 304806a52..1f96de128 100644 --- a/dependency-check-core/xref/org/owasp/dependencycheck/dependency/package-summary.html +++ b/dependency-check-core/xref/org/owasp/dependencycheck/dependency/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Core 1.0.8 Reference Package org.owasp.dependencycheck.dependency + Dependency-Check Core 1.1.0 Reference Package org.owasp.dependencycheck.dependency @@ -37,7 +37,7 @@
    • - Confidence + Confidence
    @@ -34,11 +34,6 @@ - - - @@ -47,11 +42,6 @@ - - - - +
    - (default package) -
    org.owasp.dependencycheck org.owasp.dependencycheck.analyzer
    - org.owasp.dependencycheck.concurrency -
    diff --git a/dependency-check-jenkins/index.html b/dependency-check-jenkins/index.html index 3e8417c74..6392a7876 100644 --- a/dependency-check-jenkins/index.html +++ b/dependency-check-jenkins/index.html @@ -1,13 +1,13 @@ - + dependency-check-jenkins - @@ -54,7 +54,7 @@
  • - +
  • /
    • @@ -67,8 +67,8 @@ -
  • Last Published: 2014-01-16
  • |
    • -
  • Version: 1.0.8
    • +
  • Last Published: 2014-01-26
  • |
    • +
  • Version: 1.1.0
    • @@ -148,9 +148,8 @@

    Subscribe: dependency-check+subscribe@googlegroups.com

    Post: dependency-check@googlegroups.com

    -

    Copyright & License

    -

    Dependency-Check Jenkins Plugin is Copyright (c) 2013 Steve Springett. All Rights Reserved.

    -

    Permission to modify and redistribute is granted under the terms of the GPLv3 license. See the LICENSE.txt file for the full license.

    +

    Copyright

    +

    Dependency-Check Jenkins Plugin is Copyright (c) 2013-2014 Steve Springett. All Rights Reserved.

    diff --git a/dependency-check-jenkins/license.html b/dependency-check-jenkins/license.html index 2c6ffd319..0f6b04141 100644 --- a/dependency-check-jenkins/license.html +++ b/dependency-check-jenkins/license.html @@ -1,13 +1,13 @@ - + dependency-check-jenkins - Project License @@ -54,7 +54,7 @@
  • - +
  • /
    • @@ -67,8 +67,8 @@ -
  • Last Published: 2014-01-16
  • |
    • -
  • Version: 1.0.8
    • +
  • Last Published: 2014-01-26
  • |
    • +
  • Version: 1.1.0
    • @@ -143,633 +143,211 @@

    Project License

    -

    GNU General Public License version 3

    [Original text] -

    Copy of the license follows.

    - - - - -
    -

    -English [en]   -العربية [ar]   -català [ca]   -Deutsch [de]   -ελληνικά [el]   -español [es]   -français [fr]   -italiano [it]   -日本語 [ja]   -Nederlands [nl]   -polski [pl]   -português do Brasil [pt-br]   -русский [ru]   -Shqip [sq]   -српски [sr]   -简体中文 [zh-cn]   -繁體中文 [zh-tw]   -

    -
    - - - - -
    - - - - - - - - - - - - - -
    - - -

    Licenses

    - -

    -Published software should be free -software. To make it free software, you need to release it -under a free software license. We normally use the GNU General Public License (GNU GPL), -but occasionally we use other -free software licenses. We use only licenses that are compatible -with the GNU GPL for GNU software. -

    - -

    -Documentation for free software should be -free documentation, so that -people can redistribute it and improve it along with the software -it describes. To make it free documentation, you need to release -it under a free documentation license. We normally use the -GNU Free Documentation License (GNU -FDL), but occasionally we use -other free -documentation licenses. -

    - -

    If you've started a new project and you're not sure what license to -use, “How to -choose a license for your own work” details our -recommendations in an easy-to-follow guide. If you just want a quick -list reference, we have a page that names -our recommended -copyleft licenses.

    - -

    We also have a page that discusses the BSD License Problem.

    - -

    -Our documentation licenses are currently being revised, and we welcome -your comments on the proposed texts. Please -visit our license update site to -read the current drafts and participate in the process. -

    - -

    Common Resources for our Software Licenses

    - -

    We have a number of resources to help people understand and use our -various licenses:

    - - - -

    The GNU General Public License

    - -

    -The GNU General Public License is often called the GNU GPL for short; -it is used by most GNU programs, and by more than half of all free -software packages. The latest version is version 3. -

    - - - -

    The GNU Lesser General Public License

    - -

    -The GNU Lesser General Public License is used by a few (not by any means -all) GNU libraries. The latest version is version 3. -

    - - - -

    The GNU Affero General Public License

    - -

    -The GNU Affero General Public License is based on the GNU GPL, but has an -additional term to allow users who interact with the licensed software over -a network to receive the source for that program. We recommend that people -consider using the GNU AGPL for any software which will commonly be run -over a network. The latest version is version 3. -

    - -
      -
    • The GNU Affero General Public License text is available in - these formats: - HTML, - plain text, - Docbook, - Texinfo, and - LaTeX. -These documents are not formatted for standalone publishing, and -are intended to be included in another document.
      • -
    • Why the Affero GPL
      • -
    - -

    The GNU Free Documentation License

    - -

    -The GNU Free Documentation License is a form of copyleft intended -for use on a manual, textbook or other document to assure everyone -the effective freedom to copy and redistribute it, with or without -modifications, either commercially or non-commercially. The latest version -is 1.3. -

    - - - -

    Exceptions to GNU Licenses

    - -

    Some GNU programs have additional permissions or special exceptions - to specific terms in one of the main licenses. Since some of those - are commonly used or inspire a lot of questions on their own, we've - started collecting them on - our exceptions page.

    - -

    License URLs

    - -

    When linking to our licenses, it's usually best to link to the latest -version; hence the standard URLs such as -http://www.gnu.org/licenses/gpl.html have no version number. -Occasionally, however, you may want to link to a specific version of a -given license. In those situations, you can use the following links -[skip links]:

    - -
    -
    GNU General Public License (GPL)
    - -
    GPLv3, -GPLv2, -GPLv1
    - -
    GNU Lesser General Public License (LGPL)
    -
    LGPLv3, -LGPLv2.1
    - -
    GNU Affero General Public License (AGPL)
    -
    GNU - AGPLv3 (The Affero General - Public License version 1 is not a GNU license, but it was - designed to serve a purpose much like the GNU AGPL's.)
    - -
    GNU Free Documentation License (FDL)
    -
    FDLv1.3, -FDLv1.2, -FDLv1.1
    -
    - -

    Stable links to each license's alternative - formats are available on its respective page. Not every version of - every license is available in every format. If you need one that is - missing, please email us.

    - -

    See also the old licenses page.

    - - -

    Unofficial Translations

    - -

    -Legally speaking, the original (English) version of the licenses is what -specifies the actual distribution terms for GNU programs and others that -use them. But to help people better understand the licenses, we give -permission to publish translations into other languages provided that -they follow our regulations for unofficial translations: -

    - - - -

    Verbatim Copying and Distribution

    - -

    The standard copyright terms for GNU web pages is now the Creative -Commons Attribution-NoDerivs 3.0 United States License. It used to -be (and for a few pages still is): Verbatim -copying and distribution of this entire article are permitted worldwide, -without royalty, in any medium, provided this notice is -preserved. Please note the following commentary about this -“verbatim license” by Eben Moglen:

    - -

    -“Our intention in using the phrase ‘verbatim copying in -any medium’ is not to require retention of page headings and -footers or other formatting features. Retention of weblinks in both -hyperlinked and non-hyperlinked media (as notes or some other form of -printed URL in non-HTML media) is required”. -

    - -

    List of Free Software Licenses

    - -
      -
    • - List of Free Software Licenses - -

      If you are contemplating writing a new license, please contact the -FSF by writing to <licensing@fsf.org>. The -proliferation of different free software licenses means increased work -for users in understanding the licenses; we may be able to help you -find an existing Free Software license that meets your needs. -

      - -

      -If that isn't possible, if you really need a new license, with our -help you can ensure that the license really is a Free Software license -and avoid various practical problems. -

      - -
      • -
    - - -

    What Is Copyleft?

    - -

    -Copyleft is a general -method for making a program free -software and requiring all modified and extended versions of the -program to be free software as well. -

    - -

    -The simplest way to make a program free is to put it in the -public -domain, uncopyrighted. This allows people to share the program -and their improvements, if they are so minded. But it also allows -uncooperative people to convert the program into -proprietary -software. They can make changes, many or few, and distribute the -result as a proprietary product. People who receive the program in -that modified form do not have the freedom that the original author -gave them; the middleman has stripped it away. -

    - -

    -In the GNU project, our aim is -to give all users the freedom to redistribute and change GNU -software. If middlemen could strip off the freedom, we might have -many users, but those users would not have freedom. So instead of -putting GNU software in the public domain, we “copyleft” -it. Copyleft says that anyone who redistributes the software, with or -without changes, must pass along the freedom to further copy and -change it. Copyleft guarantees that every user has freedom. -

    - -

    -Copyleft also provides an -incentive -for other programmers to add to free software. -Important free programs such as the GNU C++ compiler exist -only because of this. -

    - -

    -Copyleft also helps programmers who want to contribute -improvements to -free software get permission to -do that. These programmers often work for companies or universities -that would do almost anything to get more money. A programmer may -want to contribute her changes to the community, but her employer may -want to turn the changes into a proprietary software product. -

    - -

    -When we explain to the employer that it is illegal to distribute the -improved version except as free software, the employer usually decides -to release it as free software rather than throw it away. -

    - -

    -To copyleft a program, we first state that it is copyrighted; then -we add distribution terms, which are a legal instrument that gives -everyone the rights to use, modify, and redistribute the program's -code or any program derived from it but only if the -distribution terms are unchanged. Thus, the code and the freedoms -become legally inseparable. -

    - -

    -Proprietary software developers use copyright to take away the users' -freedom; we use copyright to guarantee their freedom. That's why we -reverse the name, changing “copyright” into -“copyleft”. -

    - -

    -Copyleft is a general concept; there are many ways to fill in the -details. In the GNU Project, the specific distribution terms that we -use are contained in the GNU General Public License, the GNU Lesser -General Public License and the GNU Free Documentation License. -

    - -

    -The appropriate license is included in many manuals and in each GNU -source code distribution. -

    - -

    -The GNU GPL is designed so that you can easily apply it to your own -program if you are the copyright holder. You don't have to modify the -GNU GPL to do this, just add notices to your program which refer -properly to the GNU GPL. Please note that you must use the -entire text of the GPL, if you use it. It is an integral whole, and -partial copies are not permitted. (Likewise for the LGPL, AGPL, and FDL.) -

    - -

    -Using the same distribution terms for many different programs makes it -easy to copy code between various different programs. Since they all -have the same distribution terms, there is no need to think about -whether the terms are compatible. The Lesser GPL includes a -provision that lets you alter the distribution terms to the ordinary -GPL, so that you can copy code into another program covered by the GPL. -

    - -

    Licenses for Other Types of Works

    - -

    -We believe that published software and documentation should be -free software and free documentation. -We recommend making all sorts of educational and reference works free -also, using free documentation licenses such as the -GNU Free Documentation License (GNU FDL). -

    - -

    For essays of opinion and scientific papers, we recommend -either the Creative -Commons Attribution-NoDerivs 3.0 United States License, or the -simple “verbatim copying only” license stated above.

    - -

    -We don't take the position that artistic or entertainment works must -be free, but if you want to make one free, we recommend -the Free Art -License.

    - -
    - - -
    - - - -
    - -

    The Free Software -Foundation is the principal organizational sponsor of the GNU Operating System. Our -mission is to preserve, protect and promote the freedom to use, study, -copy, modify, and redistribute computer software, and to defend the -rights of Free Software users. Support GNU and the FSF by buying manuals and gear, joining the FSF as an associate -member or by making a -donation, either directly to the FSF -or via Flattr.

    - -

    back to top

    - - - - -
    - - -
    - - - - -
    -
    +

    The Apache Software License, Version 2.0

    +
    +
    +                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+
    diff --git a/dependency-check-jenkins/project-info.html b/dependency-check-jenkins/project-info.html index 748c4c32a..37e50ef4c 100644 --- a/dependency-check-jenkins/project-info.html +++ b/dependency-check-jenkins/project-info.html @@ -1,13 +1,13 @@ - + dependency-check-jenkins - Project Information @@ -54,7 +54,7 @@
  • - +
  • /
    • @@ -67,8 +67,8 @@ -
  • Last Published: 2014-01-16
  • |
    • -
  • Version: 1.0.8
    • +
  • Last Published: 2014-01-26
  • |
    • +
  • Version: 1.1.0
    • diff --git a/dependency-check-jenkins/project-summary.html b/dependency-check-jenkins/project-summary.html index afc1f09c7..6c607323d 100644 --- a/dependency-check-jenkins/project-summary.html +++ b/dependency-check-jenkins/project-summary.html @@ -1,13 +1,13 @@ - + dependency-check-jenkins - Project Summary @@ -54,7 +54,7 @@
  • - +
  • /
    • @@ -67,8 +67,8 @@ -
  • Last Published: 2014-01-16
  • |
    • -
  • Version: 1.0.8
    • +
  • Last Published: 2014-01-26
  • |
    • +
  • Version: 1.1.0
    • @@ -181,7 +181,7 @@     		dependency-check-jenkins
    Version1.0.8
    1.1.0
    Type pom
    diff --git a/dependency-check-maven/apidocs/allclasses-frame.html b/dependency-check-maven/apidocs/allclasses-frame.html index 331eda965..27a59ecbf 100644 --- a/dependency-check-maven/apidocs/allclasses-frame.html +++ b/dependency-check-maven/apidocs/allclasses-frame.html @@ -2,10 +2,10 @@ - + -All Classes (Dependency-Check Maven Plugin 1.0.8 API) - +All Classes (Dependency-Check Maven Plugin 1.1.0 API) + diff --git a/dependency-check-maven/apidocs/allclasses-noframe.html b/dependency-check-maven/apidocs/allclasses-noframe.html index 507108140..a78ff4f27 100644 --- a/dependency-check-maven/apidocs/allclasses-noframe.html +++ b/dependency-check-maven/apidocs/allclasses-noframe.html @@ -2,10 +2,10 @@ - + -All Classes (Dependency-Check Maven Plugin 1.0.8 API) - +All Classes (Dependency-Check Maven Plugin 1.1.0 API) + diff --git a/dependency-check-maven/apidocs/constant-values.html b/dependency-check-maven/apidocs/constant-values.html index 04b2c1623..0c50c2a0a 100644 --- a/dependency-check-maven/apidocs/constant-values.html +++ b/dependency-check-maven/apidocs/constant-values.html @@ -2,16 +2,16 @@ - + -Constant Field Values (Dependency-Check Maven Plugin 1.0.8 API) - +Constant Field Values (Dependency-Check Maven Plugin 1.1.0 API) + diff --git a/dependency-check-maven/apidocs/deprecated-list.html b/dependency-check-maven/apidocs/deprecated-list.html index 9e2ffc50b..b2570e952 100644 --- a/dependency-check-maven/apidocs/deprecated-list.html +++ b/dependency-check-maven/apidocs/deprecated-list.html @@ -2,16 +2,16 @@ - + -Deprecated List (Dependency-Check Maven Plugin 1.0.8 API) - +Deprecated List (Dependency-Check Maven Plugin 1.1.0 API) + diff --git a/dependency-check-maven/apidocs/help-doc.html b/dependency-check-maven/apidocs/help-doc.html index 8776473c0..db2267917 100644 --- a/dependency-check-maven/apidocs/help-doc.html +++ b/dependency-check-maven/apidocs/help-doc.html @@ -2,16 +2,16 @@ - + -API Help (Dependency-Check Maven Plugin 1.0.8 API) - +API Help (Dependency-Check Maven Plugin 1.1.0 API) + diff --git a/dependency-check-maven/apidocs/index-all.html b/dependency-check-maven/apidocs/index-all.html index 1c1b82dc8..39caccfcd 100644 --- a/dependency-check-maven/apidocs/index-all.html +++ b/dependency-check-maven/apidocs/index-all.html @@ -2,16 +2,16 @@ - + -Index (Dependency-Check Maven Plugin 1.0.8 API) - +Index (Dependency-Check Maven Plugin 1.1.0 API) + @@ -79,8 +79,7 @@
    DependencyCheckMojo - Class in org.owasp.dependencycheck.maven
    -
    Maven Plugin that checks project dependencies to see if they have any known - published vulnerabilities.
    +
    Maven Plugin that checks project dependencies to see if they have any known published vulnerabilities.
    DependencyCheckMojo() - Constructor for class org.owasp.dependencycheck.maven.DependencyCheckMojo
     
    @@ -115,8 +114,7 @@
    getDescription(Locale) - Method in class org.owasp.dependencycheck.maven.DependencyCheckMojo
    -
    Gets the description of the Dependency-Check report to be displayed in - the Maven Generated Reports page.
    +
    Gets the description of the Dependency-Check report to be displayed in the Maven Generated Reports page.
    getName(Locale) - Method in class org.owasp.dependencycheck.maven.DependencyCheckMojo
    diff --git a/dependency-check-maven/apidocs/index.html b/dependency-check-maven/apidocs/index.html index 881714452..408bad6ed 100644 --- a/dependency-check-maven/apidocs/index.html +++ b/dependency-check-maven/apidocs/index.html @@ -2,9 +2,9 @@ - + -Dependency-Check Maven Plugin 1.0.8 API +Dependency-Check Maven Plugin 1.1.0 API @@ -113,8 +113,7 @@ public class DependencyCheckMojo extends org.apache.maven.plugin.AbstractMojo implements org.apache.maven.reporting.MavenMultiPageReport -
    Maven Plugin that checks project dependencies to see if they have any known - published vulnerabilities.
    +
    Maven Plugin that checks project dependencies to see if they have any known published vulnerabilities.
    Author:
    Jeremy Long
    • @@ -223,8 +222,7 @@ implements org.apache.maven.reporting.MavenMultiPageReport String getDescription(Locale locale) -
    Gets the description of the Dependency-Check report to be displayed in - the Maven Generated Reports page.
    +
    Gets the description of the Dependency-Check report to be displayed in the Maven Generated Reports page.
    @@ -337,8 +335,7 @@ implements org.apache.maven.reporting.MavenMultiPageReport
    execute in interface org.apache.maven.plugin.Mojo
    Throws:
    org.apache.maven.plugin.MojoExecutionException - if a maven exception occurs
    -
    org.apache.maven.plugin.MojoFailureException - thrown if a CVSS score is found that is - higher then the configured level
    +
    org.apache.maven.plugin.MojoFailureException - thrown if a CVSS score is found that is higher then the configured level
    @@ -456,8 +453,7 @@ implements org.apache.maven.reporting.MavenMultiPageReport

  • getDescription

    public String getDescription(Locale locale)
    -
    Gets the description of the Dependency-Check report to be displayed in - the Maven Generated Reports page.
    +
    Gets the description of the Dependency-Check report to be displayed in the Maven Generated Reports page.
    Specified by:
    getDescription in interface org.apache.maven.reporting.MavenReport
    diff --git a/dependency-check-maven/apidocs/org/owasp/dependencycheck/maven/HelpMojo.html b/dependency-check-maven/apidocs/org/owasp/dependencycheck/maven/HelpMojo.html index 9c9b2131c..8d1f654d2 100644 --- a/dependency-check-maven/apidocs/org/owasp/dependencycheck/maven/HelpMojo.html +++ b/dependency-check-maven/apidocs/org/owasp/dependencycheck/maven/HelpMojo.html @@ -2,16 +2,16 @@ - + -HelpMojo (Dependency-Check Maven Plugin 1.0.8 API) - +HelpMojo (Dependency-Check Maven Plugin 1.1.0 API) + diff --git a/dependency-check-maven/apidocs/org/owasp/dependencycheck/maven/class-use/DependencyCheckMojo.html b/dependency-check-maven/apidocs/org/owasp/dependencycheck/maven/class-use/DependencyCheckMojo.html index 506d8c9b8..8785d94fe 100644 --- a/dependency-check-maven/apidocs/org/owasp/dependencycheck/maven/class-use/DependencyCheckMojo.html +++ b/dependency-check-maven/apidocs/org/owasp/dependencycheck/maven/class-use/DependencyCheckMojo.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.maven.DependencyCheckMojo (Dependency-Check Maven Plugin 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.maven.DependencyCheckMojo (Dependency-Check Maven Plugin 1.1.0 API) + diff --git a/dependency-check-maven/apidocs/org/owasp/dependencycheck/maven/class-use/HelpMojo.html b/dependency-check-maven/apidocs/org/owasp/dependencycheck/maven/class-use/HelpMojo.html index 2daa74727..a8aa00e33 100644 --- a/dependency-check-maven/apidocs/org/owasp/dependencycheck/maven/class-use/HelpMojo.html +++ b/dependency-check-maven/apidocs/org/owasp/dependencycheck/maven/class-use/HelpMojo.html @@ -2,16 +2,16 @@ - + -Uses of Class org.owasp.dependencycheck.maven.HelpMojo (Dependency-Check Maven Plugin 1.0.8 API) - +Uses of Class org.owasp.dependencycheck.maven.HelpMojo (Dependency-Check Maven Plugin 1.1.0 API) + diff --git a/dependency-check-maven/apidocs/org/owasp/dependencycheck/maven/package-frame.html b/dependency-check-maven/apidocs/org/owasp/dependencycheck/maven/package-frame.html index 67609c65d..85b13bb76 100644 --- a/dependency-check-maven/apidocs/org/owasp/dependencycheck/maven/package-frame.html +++ b/dependency-check-maven/apidocs/org/owasp/dependencycheck/maven/package-frame.html @@ -2,10 +2,10 @@ - + -org.owasp.dependencycheck.maven (Dependency-Check Maven Plugin 1.0.8 API) - +org.owasp.dependencycheck.maven (Dependency-Check Maven Plugin 1.1.0 API) + diff --git a/dependency-check-maven/apidocs/org/owasp/dependencycheck/maven/package-summary.html b/dependency-check-maven/apidocs/org/owasp/dependencycheck/maven/package-summary.html index cc2830e29..443edca1d 100644 --- a/dependency-check-maven/apidocs/org/owasp/dependencycheck/maven/package-summary.html +++ b/dependency-check-maven/apidocs/org/owasp/dependencycheck/maven/package-summary.html @@ -2,16 +2,16 @@ - + -org.owasp.dependencycheck.maven (Dependency-Check Maven Plugin 1.0.8 API) - +org.owasp.dependencycheck.maven (Dependency-Check Maven Plugin 1.1.0 API) + @@ -87,8 +87,7 @@ DependencyCheckMojo -
    Maven Plugin that checks project dependencies to see if they have any known - published vulnerabilities.
    +
    Maven Plugin that checks project dependencies to see if they have any known published vulnerabilities.
    diff --git a/dependency-check-maven/apidocs/org/owasp/dependencycheck/maven/package-tree.html b/dependency-check-maven/apidocs/org/owasp/dependencycheck/maven/package-tree.html index a13506b73..e73c2c18a 100644 --- a/dependency-check-maven/apidocs/org/owasp/dependencycheck/maven/package-tree.html +++ b/dependency-check-maven/apidocs/org/owasp/dependencycheck/maven/package-tree.html @@ -2,16 +2,16 @@ - + -org.owasp.dependencycheck.maven Class Hierarchy (Dependency-Check Maven Plugin 1.0.8 API) - +org.owasp.dependencycheck.maven Class Hierarchy (Dependency-Check Maven Plugin 1.1.0 API) + diff --git a/dependency-check-maven/apidocs/org/owasp/dependencycheck/maven/package-use.html b/dependency-check-maven/apidocs/org/owasp/dependencycheck/maven/package-use.html index d25bc5254..d9f4196e3 100644 --- a/dependency-check-maven/apidocs/org/owasp/dependencycheck/maven/package-use.html +++ b/dependency-check-maven/apidocs/org/owasp/dependencycheck/maven/package-use.html @@ -2,16 +2,16 @@ - + -Uses of Package org.owasp.dependencycheck.maven (Dependency-Check Maven Plugin 1.0.8 API) - +Uses of Package org.owasp.dependencycheck.maven (Dependency-Check Maven Plugin 1.1.0 API) + diff --git a/dependency-check-maven/apidocs/overview-tree.html b/dependency-check-maven/apidocs/overview-tree.html index 75d289c98..d6d4556b0 100644 --- a/dependency-check-maven/apidocs/overview-tree.html +++ b/dependency-check-maven/apidocs/overview-tree.html @@ -2,16 +2,16 @@ - + -Class Hierarchy (Dependency-Check Maven Plugin 1.0.8 API) - +Class Hierarchy (Dependency-Check Maven Plugin 1.1.0 API) + diff --git a/dependency-check-maven/check-mojo.html b/dependency-check-maven/check-mojo.html index 46228145c..af8b96109 100644 --- a/dependency-check-maven/check-mojo.html +++ b/dependency-check-maven/check-mojo.html @@ -1,13 +1,13 @@ - + dependency-check-maven - dependency-check:check @@ -55,7 +55,7 @@
  • - +
  • /
    • @@ -69,8 +69,8 @@ -
  • Last Published: 2014-01-16
  • |
    • -
  • Version: 1.0.8
    • +
  • Last Published: 2014-01-26
  • |
    • +
  • Version: 1.1.0
    • @@ -150,7 +150,7 @@

    Full name:

    -

    org.owasp:dependency-check-maven:1.0.8:check

    +

    org.owasp:dependency-check-maven:1.1.0:check

    Description:

    @@ -280,6 +280,17 @@ Dependency-Check report.
    Default value is: ${project.reporting.o +connectionString + +String + +- + +The database connection string.
    User property is: nexusUrl. + + + + connectionTimeout String @@ -289,8 +300,52 @@ Dependency-Check report.
    Default value is: ${project.reporting.o The Connection Timeout.
    User property is: connectionTimeout. + + +databaseDriverName + +String + +- + +The database driver name. An example would be org.h2.Driver.
    User property is: databaseDriverName. + + +databaseDriverPath + +String + +- + +The path to the database driver if it is not on the class path.
    User property is: databaseDriverPath. + + + + +databasePassword + +String + +- + +The password to use when connecting to the database.
    User property is: databasePassword. + + + + +databaseUser + +String + +- + +The database user name.
    User property is: databaseUser. + + + + description String @@ -301,7 +356,7 @@ Dependency-Check report.
    Default value is: ${project.reporting.o the Maven Generated Reports page
    Default value is: A report providing details on any published vulnerabilities within project dependencies. This report is a best effort but may contain false positives and false negatives..
    User property is: description. - + logFile @@ -312,7 +367,7 @@ the Maven Generated Reports page
    Default value is: A report prov The path to the verbose log
    User property is: logfile. - + name @@ -324,8 +379,30 @@ the Maven Generated Reports page
    Default value is: A report prov Reports page
    Default value is: Dependency-Check.
    User property is: name. + + +nexusAnalyzerEnabled + +boolean + +- + +Whether or not the Nexus Analyzer is enabled.
    Default value is: true.
    User property is: nexusAnalyzerEnabled. + + +nexusUrl + +String + +- + +Whether or not the Nexus Analyzer is enabled.
    User property is: nexusUrl. + + + + proxyPassword String @@ -335,7 +412,7 @@ Reports page
    Default value is: Dependency-Check.
    Us The Proxy password.
    User property is: proxyPassword. - + proxyPort @@ -346,7 +423,7 @@ Reports page
    Default value is: Dependency-Check.
    Us The Proxy Port.
    User property is: proxyPort. - + proxyUrl @@ -357,7 +434,7 @@ Reports page
    Default value is: Dependency-Check.
    Us The Proxy URL.
    User property is: proxyUrl. - + proxyUsername @@ -368,7 +445,7 @@ Reports page
    Default value is: Dependency-Check.
    Us The Proxy username.
    User property is: proxyUsername. - + reportName @@ -379,7 +456,7 @@ Reports page
    Default value is: Dependency-Check.
    Us The name of the site report destination.
    Default value is: dependency-check-report.
    User property is: report-name. - + showSummary @@ -390,7 +467,7 @@ Reports page
    Default value is: Dependency-Check.
    Us Flag indicating whether or not to show a summary in the output.
    Default value is: true.
    User property is: showSummary. - + suppressionFile @@ -421,6 +498,18 @@ is not recommended that this be turned to false. Default is true.
  • Default: true
    • +

    connectionString:

    + +
    The database connection string.
    + +
      + +
    • Type: java.lang.String
      • + +
    • Required: No
      • + +
    • User Property: nexusUrl
      • +

    connectionTimeout:

    The Connection Timeout.
    @@ -433,6 +522,54 @@ is not recommended that this be turned to false. Default is true.
  • User Property: connectionTimeout
    • +

    databaseDriverName:

    + +
    The database driver name. An example would be org.h2.Driver.
    + +
      + +
    • Type: java.lang.String
      • + +
    • Required: No
      • + +
    • User Property: databaseDriverName
      • +
    +

    databaseDriverPath:

    + +
    The path to the database driver if it is not on the class path.
    + +
      + +
    • Type: java.lang.String
      • + +
    • Required: No
      • + +
    • User Property: databaseDriverPath
      • +
    +

    databasePassword:

    + +
    The password to use when connecting to the database.
    + +
      + +
    • Type: java.lang.String
      • + +
    • Required: No
      • + +
    • User Property: databasePassword
      • +
    +

    databaseUser:

    + +
    The database user name.
    + +
      + +
    • Type: java.lang.String
      • + +
    • Required: No
      • + +
    • User Property: databaseUser
      • +

    description:

    The description of the Dependency-Check report to be displayed in @@ -521,6 +658,32 @@ Reports page
  • Default: Dependency-Check
    • +

    nexusAnalyzerEnabled:

    + +
    Whether or not the Nexus Analyzer is enabled.
    + +
      + +
    • Type: boolean
      • + +
    • Required: No
      • + +
    • User Property: nexusAnalyzerEnabled
      • + +
    • Default: true
      • +
    +

    nexusUrl:

    + +
    Whether or not the Nexus Analyzer is enabled.
    + +
      + +
    • Type: java.lang.String
      • + +
    • Required: No
      • + +
    • User Property: nexusUrl
      • +

    outputDirectory:

    The output directory.
    diff --git a/dependency-check-maven/checkstyle.html b/dependency-check-maven/checkstyle.html index 218c9ea31..1c9dfdb28 100644 --- a/dependency-check-maven/checkstyle.html +++ b/dependency-check-maven/checkstyle.html @@ -1,13 +1,13 @@ - + dependency-check-maven - Checkstyle Results @@ -54,7 +54,7 @@
  • - +
  • /
    • @@ -67,8 +67,8 @@ -
  • Last Published: 2014-01-16
  • |
    • -
  • Version: 1.0.8
    • +
  • Last Published: 2014-01-26
  • |
    • +
  • Version: 1.1.0
    • @@ -245,7 +245,7 @@ 15 0 0 -12 +17

    Files

    @@ -258,7 +258,7 @@ -
    src/main/java/org/owasp/dependencycheck/maven/DependencyCheckMojo.java 0 012
    +17

    Details

    @@ -271,51 +271,71 @@ Errors '}' is not preceded with whitespace. -138 +135 Errors '}' is not preceded with whitespace. -146 +142 Errors '}' is not preceded with whitespace. -152 +148 Errors '}' is not preceded with whitespace. -158 +154 Errors '}' is not preceded with whitespace. -164 +160 Errors '}' is not preceded with whitespace. -170 +166 Errors '}' is not preceded with whitespace. -176 +172 Errors '}' is not preceded with whitespace. -182 +178 Errors '}' is not preceded with whitespace. -188 +184 Errors '}' is not preceded with whitespace. -194 +190 Errors -Line is longer than 150 characters (found 185). -231 +'}' is not preceded with whitespace. +196 Errors -Line is longer than 150 characters (found 185). -234
    +'}' is not preceded with whitespace. +202 + +Errors +'}' is not preceded with whitespace. +208 + +Errors +'}' is not preceded with whitespace. +214 + +Errors +'}' is not preceded with whitespace. +220 + +Errors +'}' is not preceded with whitespace. +226 + +Errors +'}' is not preceded with whitespace. +232 diff --git a/dependency-check-maven/checkstyle.rss b/dependency-check-maven/checkstyle.rss index 2337b7435..b22b78352 100644 --- a/dependency-check-maven/checkstyle.rss +++ b/dependency-check-maven/checkstyle.rss @@ -26,7 +26,7 @@ under the License. ©2013 - 2014 OWASP File: 15, - Errors: 12, + Errors: 17, Warnings: 0, Infos: 0 @@ -83,7 +83,7 @@ under the License. 0 - 12 + 17 diff --git a/dependency-check-maven/cobertura/frame-summary-org.owasp.dependencycheck.maven.html b/dependency-check-maven/cobertura/frame-summary-org.owasp.dependencycheck.maven.html index 7d7ba2010..ee742b274 100644 --- a/dependency-check-maven/cobertura/frame-summary-org.owasp.dependencycheck.maven.html +++ b/dependency-check-maven/cobertura/frame-summary-org.owasp.dependencycheck.maven.html @@ -16,7 +16,7 @@ - +
    Package # Classes Line Coverage Branch Coverage Complexity
    org.owasp.dependencycheck.maven2
    0%
    0/516
    0%
    0/248
    		4.302
    org.owasp.dependencycheck.maven2
    0%
    0/539
    0%
    0/274
    		4.628
    -
    Report generated by Cobertura 1.9.4.1 on 1/16/14 7:32 AM.
    +
    Report generated by Cobertura 1.9.4.1 on 1/26/14 11:15 AM.
    diff --git a/dependency-check-maven/cobertura/frame-summary.html b/dependency-check-maven/cobertura/frame-summary.html index b186366da..8428da0f5 100644 --- a/dependency-check-maven/cobertura/frame-summary.html +++ b/dependency-check-maven/cobertura/frame-summary.html @@ -16,8 +16,8 @@ - - + +
    Package # Classes Line Coverage Branch Coverage Complexity
    All Packages2
    0%
    0/516
    0%
    0/248
    		4.302
    org.owasp.dependencycheck.maven2
    0%
    0/516
    0%
    0/248
    		4.302
    All Packages2
    0%
    0/539
    0%
    0/274
    		4.628
    org.owasp.dependencycheck.maven2
    0%
    0/539
    0%
    0/274
    		4.628
    -
    Report generated by Cobertura 1.9.4.1 on 1/16/14 7:32 AM.
    +
    Report generated by Cobertura 1.9.4.1 on 1/26/14 11:15 AM.
    diff --git a/dependency-check-maven/cobertura/org.owasp.dependencycheck.maven.DependencyCheckMojo.html b/dependency-check-maven/cobertura/org.owasp.dependencycheck.maven.DependencyCheckMojo.html index 0a53c80eb..c0ea9eb91 100644 --- a/dependency-check-maven/cobertura/org.owasp.dependencycheck.maven.DependencyCheckMojo.html +++ b/dependency-check-maven/cobertura/org.owasp.dependencycheck.maven.DependencyCheckMojo.html @@ -12,7 +12,7 @@
     
    - +
    Classes in this File Line Coverage Branch Coverage Complexity
    DependencyCheckMojo
    0%
    0/365
    0%
    0/142
    		3.786
    DependencyCheckMojo
    0%
    0/388
    0%
    0/168
    		4.286
     
    @@ -24,73 +24,73 @@  3   
      *
     4   - 
      * Dependency-check-maven is free software: you can redistribute it and/or modify it
    + 
      * Licensed under the Apache License, Version 2.0 (the "License");
     5   - 
      * under the terms of the GNU General Public License as published by the Free
    + 
      * you may not use this file except in compliance with the License.
     6   - 
      * Software Foundation, either version 3 of the License, or (at your option) any
    + 
      * You may obtain a copy of the License at
     7   - 
      * later version.
    + 
      *
     8   - 
      *
    + 
      *     http://www.apache.org/licenses/LICENSE-2.0
     9   - 
      * Dependency-check-maven is distributed in the hope that it will be useful, but
    + 
      *
     10   - 
      * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
    + 
      * Unless required by applicable law or agreed to in writing, software
     11   - 
      * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more
    + 
      * distributed under the License is distributed on an "AS IS" BASIS,
     12   - 
      * details.
    + 
      * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
     13   - 
      *
    + 
      * See the License for the specific language governing permissions and
     14   - 
      * You should have received a copy of the GNU General Public License along with
    + 
      * limitations under the License.
     15   - 
      * dependency-check-maven. If not, see http://www.gnu.org/licenses/.
    -  16   
      *
    -  17   +  16   
      * Copyright (c) 2013 Jeremy Long. All Rights Reserved.
    -  18   +  17   
      */
    -  19   +  18   
     package org.owasp.dependencycheck.maven;
    -  20   +  19   
     
    -  21   +  20   
     import java.io.File;
    -  22   +  21   
     import java.io.IOException;
    -  23   +  22   
     import java.io.InputStream;
    -  24   +  23   
     import java.io.UnsupportedEncodingException;
    -  25   +  24   
     import java.net.URLEncoder;
    -  26   +  25   
     import java.text.DateFormat;
    -  27   +  26   
     import java.util.Date;
    -  28   +  27   
     import java.util.List;
    -  29   +  28   
     import java.util.Locale;
    +  29   + 
     import java.util.Set;
     30   
     import java.util.logging.Level;
     31   
     import java.util.logging.Logger;
     32   - 
     import org.apache.maven.doxia.sink.SinkFactory;
    -  33   - 
     import org.apache.maven.plugin.AbstractMojo;
    -  34   - 
     import org.apache.maven.plugin.MojoExecutionException;
    -  35   - 
     import org.apache.maven.project.MavenProject;
    -  36   - 
     import java.util.Set;
    -  37   
     import org.apache.maven.artifact.Artifact;
    +  33   + 
     import org.apache.maven.doxia.sink.Sink;
    +  34   + 
     import org.apache.maven.doxia.sink.SinkFactory;
    +  35   + 
     import org.apache.maven.plugin.AbstractMojo;
    +  36   + 
     import org.apache.maven.plugin.MojoExecutionException;
    +  37   + 
     import org.apache.maven.plugin.MojoFailureException;
     38   
     import org.apache.maven.plugins.annotations.Component;
     39   @@ -102,127 +102,127 @@  42   
     import org.apache.maven.plugins.annotations.ResolutionScope;
     43   - 
     import org.apache.maven.reporting.MavenMultiPageReport;
    + 
     import org.apache.maven.project.MavenProject;
     44   - 
     import org.apache.maven.reporting.MavenReport;
    + 
     import org.apache.maven.reporting.MavenMultiPageReport;
     45   - 
     import org.apache.maven.reporting.MavenReportException;
    + 
     import org.apache.maven.reporting.MavenReport;
     46   - 
     import org.apache.maven.doxia.sink.Sink;
    + 
     import org.apache.maven.reporting.MavenReportException;
     47   - 
     import org.apache.maven.plugin.MojoFailureException;
    -  48   
     import org.owasp.dependencycheck.Engine;
    +  48   + 
     import org.owasp.dependencycheck.data.nvdcve.CveDB;
     49   - 
     import org.owasp.dependencycheck.dependency.Dependency;
    + 
     import org.owasp.dependencycheck.data.nvdcve.DatabaseException;
     50   - 
     import org.owasp.dependencycheck.dependency.Evidence;
    + 
     import org.owasp.dependencycheck.data.nvdcve.DatabaseProperties;
     51   - 
     import org.owasp.dependencycheck.dependency.Identifier;
    + 
     import org.owasp.dependencycheck.dependency.Dependency;
     52   - 
     import org.owasp.dependencycheck.dependency.Reference;
    + 
     import org.owasp.dependencycheck.dependency.Evidence;
     53   - 
     import org.owasp.dependencycheck.dependency.Vulnerability;
    + 
     import org.owasp.dependencycheck.dependency.Identifier;
     54   - 
     import org.owasp.dependencycheck.dependency.VulnerableSoftware;
    + 
     import org.owasp.dependencycheck.dependency.Reference;
     55   - 
     import org.owasp.dependencycheck.reporting.ReportGenerator;
    + 
     import org.owasp.dependencycheck.dependency.Vulnerability;
     56   - 
     import org.owasp.dependencycheck.utils.LogUtils;
    + 
     import org.owasp.dependencycheck.dependency.VulnerableSoftware;
     57   - 
     import org.owasp.dependencycheck.utils.Settings;
    + 
     import org.owasp.dependencycheck.reporting.ReportGenerator;
     58   - 
     
    + 
     import org.owasp.dependencycheck.utils.LogUtils;
     59   - 
     /**
    + 
     import org.owasp.dependencycheck.utils.Settings;
     60   - 
      * Maven Plugin that checks project dependencies to see if they have any known
    -  61   - 
      * published vulnerabilities.
    -  62   - 
      *
    -  63   - 
      * @author Jeremy Long <jeremy.long@owasp.org>
    -  64   - 
      */
    -  65   - 
     @Mojo(name = "check", defaultPhase = LifecyclePhase.COMPILE, threadSafe = true,
    -  66   - 
             requiresDependencyResolution = ResolutionScope.RUNTIME_PLUS_SYSTEM,
    -  67   - 
             requiresOnline = true)
    -  68  0 
     public class DependencyCheckMojo extends AbstractMojo implements MavenMultiPageReport {
    -  69   
     
    +  61   + 
     /**
    +  62   + 
      * Maven Plugin that checks project dependencies to see if they have any known published vulnerabilities.
    +  63   + 
      *
    +  64   + 
      * @author Jeremy Long <jeremy.long@owasp.org>
    +  65   + 
      */
    +  66   + 
     @Mojo(name = "check", defaultPhase = LifecyclePhase.COMPILE, threadSafe = true,
    +  67   + 
             requiresDependencyResolution = ResolutionScope.RUNTIME_PLUS_SYSTEM,
    +  68   + 
             requiresOnline = true)
    +  69  0 
     public class DependencyCheckMojo extends AbstractMojo implements MavenMultiPageReport {
     70   - 
         /**
    + 
     
     71   - 
          * The properties file location.
    + 
         /**
     72   - 
          */
    + 
          * The properties file location.
     73   - 
         private static final String PROPERTIES_FILE = "mojo.properties";
    + 
          */
     74   - 
         /**
    + 
         private static final String PROPERTIES_FILE = "mojo.properties";
     75   - 
          * Name of the logging properties file.
    + 
         /**
     76   - 
          */
    + 
          * Name of the logging properties file.
     77   - 
         private static final String LOG_PROPERTIES_FILE = "log.properties";
    + 
          */
     78   - 
         /**
    + 
         private static final String LOG_PROPERTIES_FILE = "log.properties";
     79   - 
          * The name of the test scope.
    + 
         /**
     80   - 
          */
    + 
          * The name of the test scope.
     81   - 
         public static final String TEST_SCOPE = "test";
    + 
          */
     82   - 
         /**
    + 
         public static final String TEST_SCOPE = "test";
     83   - 
          * System specific new line character.
    + 
         /**
     84   + 
          * System specific new line character.
    +  85   
          */
    -  85  0 
         private static final String NEW_LINE = System.getProperty("line.separator", "\n").intern();
    -  86   - 
         // <editor-fold defaultstate="collapsed" desc="Maven bound parameters and components">
    +  86  0 
         private static final String NEW_LINE = System.getProperty("line.separator", "\n").intern();
     87   - 
         /**
    + 
         // <editor-fold defaultstate="collapsed" desc="Maven bound parameters and components">
     88   - 
          * The Maven Project Object.
    + 
         /**
     89   - 
          */
    + 
          * The Maven Project Object.
     90   - 
         @Component
    + 
          */
     91   - 
         private MavenProject project;
    + 
         @Component
     92   - 
         /**
    + 
         private MavenProject project;
     93   - 
          * The name of the site report destination.
    + 
         /**
     94   - 
          */
    + 
          * The name of the site report destination.
     95   - 
         @Parameter(property = "report-name", defaultValue = "dependency-check-report")
    -  96   - 
         private String reportName;
    -  97   - 
         /**
    -  98   - 
          * The path to the verbose log
    -  99   
          */
    -  100   - 
         @Parameter(property = "logfile", defaultValue = "")
    -  101   - 
         private String logFile;
    -  102   +  96   + 
         @Parameter(property = "report-name", defaultValue = "dependency-check-report")
    +  97   + 
         private String reportName;
    +  98   
         /**
    +  99   + 
          * The path to the verbose log
    +  100   + 
          */
    +  101   + 
         @Parameter(property = "logfile", defaultValue = "")
    +  102   + 
         private String logFile;
     103   - 
          * The name of the report to be displayed in the Maven Generated Reports
    + 
         /**
     104   - 
          * page
    + 
          * The name of the report to be displayed in the Maven Generated Reports page
     105   
          */
     106   @@ -232,1150 +232,1259 @@  108   
         /**
     109   - 
          * The description of the Dependency-Check report to be displayed in the
    + 
          * The description of the Dependency-Check report to be displayed in the Maven Generated Reports page
     110   - 
          * Maven Generated Reports page
    + 
          */
     111   - 
          */
    -  112   
         @Parameter(property = "description", defaultValue = "A report providing details on any published "
    -  113   +  112   
                 + "vulnerabilities within project dependencies. This report is a best effort but may contain "
    -  114   +  113   
                 + "false positives and false negatives.")
    -  115   +  114   
         private String description;
    +  115   + 
         /**
     116   - 
         /**
    + 
          * Specifies the destination directory for the generated Dependency-Check report.
     117   - 
          * Specifies the destination directory for the generated Dependency-Check
    + 
          */
     118   - 
          * report.
    -  119   - 
          */
    -  120   
         @Parameter(property = "reportOutputDirectory", defaultValue = "${project.reporting.outputDirectory}", required = true)
    -  121   +  119   
         private File reportOutputDirectory;
    +  120   + 
         /**
    +  121   + 
          * Specifies if the build should be failed if a CVSS score above a specified level is identified. The default is 11
     122   - 
         /**
    + 
          * which means since the CVSS scores are 0-10, by default the build will never fail.
     123   - 
          * Specifies if the build should be failed if a CVSS score above a specified
    -  124   - 
          * level is identified. The default is 11 which means since the CVSS scores
    + 
          */
    +  124  0 
         @Parameter(property = "failBuildOnCVSS", defaultValue = "11", required = true)
     125   - 
          * are 0-10, by default the build will never fail.
    -  126   - 
          */
    -  127  0 
         @Parameter(property = "failBuildOnCVSS", defaultValue = "11", required = true)
    -  128   
         private float failBuildOnCVSS = 11;
    -  129   +  126   
         /**
    -  130   +  127   
          * The output directory.
    -  131   +  128   
          */
    -  132   +  129   
         @Parameter(defaultValue = "${project.build.directory}", required = true)
    -  133   +  130   
         private File outputDirectory;
    +  131   + 
         /**
    +  132   + 
          * Sets whether auto-updating of the NVD CVE/CPE data is enabled. It is not recommended that this be turned to
    +  133   + 
          * false. Default is true.
     134   - 
         /**
    -  135   - 
          * Sets whether auto-updating of the NVD CVE/CPE data is enabled. It is not
    + 
          */
    +  135  0 
         @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"})
     136   - 
          * recommended that this be turned to false. Default is true.
    -  137   - 
          */
    -  138  0 
         @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"})
    -  139   
         @Parameter(property = "autoupdate", defaultValue = "true", required = true)
    -  140   +  137   
         private boolean autoUpdate = true;
    +  138   + 
         /**
    +  139   + 
          * The report format to be generated (HTML, XML, VULN, ALL). This configuration option has no affect if using this
    +  140   + 
          * within the Site plugin unless the externalReport is set to true. Default is HTML.
     141   - 
         /**
    -  142   - 
          * The report format to be generated (HTML, XML, VULN, ALL). This
    + 
          */
    +  142  0 
         @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"})
     143   - 
          * configuration option has no affect if using this within the Site plugin
    -  144   - 
          * unless the externalReport is set to true. Default is HTML.
    -  145   - 
          */
    -  146  0 
         @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"})
    -  147   
         @Parameter(property = "format", defaultValue = "HTML", required = true)
    -  148   +  144   
         private String format = "HTML";
    -  149   +  145   
         /**
    -  150   +  146   
          * Sets whether or not the external report format should be used.
    -  151   +  147   
          */
    -  152  0 
         @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"})
    -  153   +  148  0 
         @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"})
    +  149   
         @Parameter(property = "externalReport", defaultValue = "false", required = true)
    -  154   +  150   
         private boolean externalReport = false;
    -  155   +  151   
         /**
    -  156   +  152   
          * The Proxy URL.
    -  157   +  153   
          */
    -  158  0 
         @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"})
    -  159   +  154  0 
         @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"})
    +  155   
         @Parameter(property = "proxyUrl", defaultValue = "", required = false)
    -  160   +  156   
         private String proxyUrl = null;
    -  161   +  157   
         /**
    -  162   +  158   
          * The Proxy Port.
    -  163   +  159   
          */
    -  164  0 
         @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"})
    -  165   +  160  0 
         @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"})
    +  161   
         @Parameter(property = "proxyPort", defaultValue = "", required = false)
    -  166   +  162   
         private String proxyPort = null;
    -  167   +  163   
         /**
    -  168   +  164   
          * The Proxy username.
    -  169   +  165   
          */
    -  170  0 
         @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"})
    -  171   +  166  0 
         @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"})
    +  167   
         @Parameter(property = "proxyUsername", defaultValue = "", required = false)
    -  172   +  168   
         private String proxyUsername = null;
    -  173   +  169   
         /**
    -  174   +  170   
          * The Proxy password.
    -  175   +  171   
          */
    -  176  0 
         @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"})
    -  177   +  172  0 
         @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"})
    +  173   
         @Parameter(property = "proxyPassword", defaultValue = "", required = false)
    -  178   +  174   
         private String proxyPassword = null;
    +  175   + 
         /**
    +  176   + 
          * The Connection Timeout.
    +  177   + 
          */
    +  178  0 
         @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"})
     179   - 
         /**
    -  180   - 
          * The Connection Timeout.
    -  181   - 
          */
    -  182  0 
         @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"})
    -  183   
         @Parameter(property = "connectionTimeout", defaultValue = "", required = false)
    -  184   +  180   
         private String connectionTimeout = null;
    -  185   +  181   
         /**
    -  186   +  182   
          * The Connection Timeout.
    -  187   +  183   
          */
    -  188  0 
         @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"})
    -  189   +  184  0 
         @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"})
    +  185   
         @Parameter(property = "suppressionFile", defaultValue = "", required = false)
    -  190   +  186   
         private String suppressionFile = null;
    -  191   +  187   
         /**
    -  192   +  188   
          * Flag indicating whether or not to show a summary in the output.
    -  193   +  189   
          */
    -  194  0 
         @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"})
    -  195   +  190  0 
         @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"})
    +  191   
         @Parameter(property = "showSummary", defaultValue = "true", required = false)
    -  196   +  192   
         private boolean showSummary = true;
    +  193   + 
         /**
    +  194   + 
          * Whether or not the Nexus Analyzer is enabled.
    +  195   + 
          */
    +  196  0 
         @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"})
     197   - 
         // </editor-fold>
    + 
         @Parameter(property = "nexusAnalyzerEnabled", defaultValue = "true", required = false)
     198   - 
     
    + 
         private boolean nexusAnalyzerEnabled = true;
     199   
         /**
     200   - 
          * Executes the Dependency-Check on the dependent libraries.
    + 
          * Whether or not the Nexus Analyzer is enabled.
     201   - 
          *
    -  202   - 
          * @return the Engine used to scan the dependencies.
    -  203   
          */
    +  202   + 
         @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"})
    +  203   + 
         @Parameter(property = "nexusUrl", defaultValue = "", required = false)
     204   - 
         private Engine executeDependencyCheck() {
    + 
         private String nexusUrl;
     205   - 
     
    -  206  0 
             final InputStream in = DependencyCheckMojo.class.getClassLoader().getResourceAsStream(LOG_PROPERTIES_FILE);
    -  207  0 
             LogUtils.prepareLogger(in, logFile);
    -  208   - 
     
    -  209  0 
             populateSettings();
    -  210  0 
             final Engine engine = new Engine();
    -  211  0 
             final Set<Artifact> artifacts = project.getArtifacts();
    -  212  0 
             for (Artifact a : artifacts) {
    -  213  0 
                 if (!TEST_SCOPE.equals(a.getScope())) {
    -  214  0 
                     engine.scan(a.getFile().getAbsolutePath());
    -  215   - 
                 }
    -  216  0 
             }
    -  217  0 
             engine.analyzeDependencies();
    -  218  0 
             return engine;
    -  219   - 
         }
    -  220   - 
     
    -  221   
         /**
    +  206   + 
          * The database connection string.
    +  207   + 
          */
    +  208   + 
         @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"})
    +  209   + 
         @Parameter(property = "nexusUrl", defaultValue = "", required = false)
    +  210   + 
         private String connectionString;
    +  211   + 
         /**
    +  212   + 
          * The database driver name. An example would be org.h2.Driver.
    +  213   + 
          */
    +  214   + 
         @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"})
    +  215   + 
         @Parameter(property = "databaseDriverName", defaultValue = "", required = false)
    +  216   + 
         private String databaseDriverName;
    +  217   + 
         /**
    +  218   + 
          * The path to the database driver if it is not on the class path.
    +  219   + 
          */
    +  220   + 
         @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"})
    +  221   + 
         @Parameter(property = "databaseDriverPath", defaultValue = "", required = false)
     222   - 
          * Generates the reports for a given dependency-check engine.
    + 
         private String databaseDriverPath;
     223   - 
          *
    + 
         /**
     224   - 
          * @param engine a dependency-check engine
    + 
          * The database user name.
     225   
          */
     226   - 
         private void generateExternalReports(Engine engine) {
    -  227  0 
             final ReportGenerator r = new ReportGenerator(project.getName(), engine.getDependencies(), engine.getAnalyzers());
    + 
         @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"})
    +  227   + 
         @Parameter(property = "databaseUser", defaultValue = "", required = false)
     228   - 
             try {
    -  229  0 
                 r.generateReports(outputDirectory.getCanonicalPath(), format);
    -  230  0 
             } catch (IOException ex) {
    -  231  0 
                 Logger.getLogger(DependencyCheckMojo.class.getName()).log(Level.SEVERE, "Unexpected exception occurred during analysis; please see the verbose error log for more details.");
    -  232  0 
                 Logger.getLogger(DependencyCheckMojo.class.getName()).log(Level.FINE, null, ex);
    -  233  0 
             } catch (Exception ex) {
    -  234  0 
                 Logger.getLogger(DependencyCheckMojo.class.getName()).log(Level.SEVERE, "Unexpected exception occurred during analysis; please see the verbose error log for more details.");
    -  235  0 
                 Logger.getLogger(DependencyCheckMojo.class.getName()).log(Level.FINE, null, ex);
    -  236  0 
             }
    -  237  0 
         }
    + 
         private String databaseUser;
    +  229   + 
         /**
    +  230   + 
          * The password to use when connecting to the database.
    +  231   + 
          */
    +  232   + 
         @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"})
    +  233   + 
         @Parameter(property = "databasePassword", defaultValue = "", required = false)
    +  234   + 
         private String databasePassword;
    +  235   + 
         // </editor-fold>
    +  236   + 
     
    +  237   + 
         /**
     238   - 
     
    + 
          * Executes the Dependency-Check on the dependent libraries.
     239   - 
         /**
    + 
          *
     240   - 
          * Generates a dependency-check report using the Maven Site format.
    + 
          * @return the Engine used to scan the dependencies.
     241   - 
          *
    + 
          */
     242   - 
          * @param engine the engine used to scan the dependencies
    + 
         private Engine executeDependencyCheck() {
     243   - 
          * @param sink the sink to write the data to
    -  244   - 
          */
    -  245   - 
         private void generateMavenSiteReport(final Engine engine, Sink sink) {
    -  246  0 
             final List<Dependency> dependencies = engine.getDependencies();
    -  247   
     
    -  248  0 
             writeSiteReportHeader(sink, project.getName());
    -  249  0 
             writeSiteReportTOC(sink, dependencies);
    -  250   +  244  0 
             final InputStream in = DependencyCheckMojo.class.getClassLoader().getResourceAsStream(LOG_PROPERTIES_FILE);
    +  245  0 
             LogUtils.prepareLogger(in, logFile);
    +  246   
     
    -  251  0 
             int cnt = 0;
    -  252  0 
             for (Dependency d : dependencies) {
    -  253  0 
                 writeSiteReportDependencyHeader(sink, d);
    -  254  0 
                 cnt = writeSiteReportDependencyAnalysisExceptions(d, cnt, sink);
    -  255  0 
                 cnt = writeSiteReportDependencyEvidenceUsed(d, cnt, sink);
    -  256  0 
                 cnt = writeSiteReportDependencyRelatedDependencies(d, cnt, sink);
    -  257  0 
                 writeSiteReportDependencyIdentifiers(d, sink);
    -  258  0 
                 writeSiteReportDependencyVulnerabilities(d, sink, cnt);
    -  259  0 
             }
    -  260  0 
             sink.body_();
    -  261  0 
         }
    +  247  0 
             populateSettings();
    +  248  0 
             final Engine engine = new Engine();
    +  249  0 
             final Set<Artifact> artifacts = project.getArtifacts();
    +  250  0 
             for (Artifact a : artifacts) {
    +  251  0 
                 if (!TEST_SCOPE.equals(a.getScope())) {
    +  252  0 
                     engine.scan(a.getFile().getAbsolutePath());
    +  253   + 
                 }
    +  254  0 
             }
    +  255  0 
             engine.analyzeDependencies();
    +  256  0 
             return engine;
    +  257   + 
         }
    +  258   + 
     
    +  259   + 
         /**
    +  260   + 
          * Generates the reports for a given dependency-check engine.
    +  261   + 
          *
     262   - 
     
    + 
          * @param engine a dependency-check engine
     263   - 
         // <editor-fold defaultstate="collapsed" desc="various writeXXXXX methods to generate the Site Report">
    + 
          */
     264   - 
         /**
    -  265   - 
          * Writes the vulnerabilities to the site report.
    -  266   - 
          *
    + 
         private void generateExternalReports(Engine engine) {
    +  265  0 
             DatabaseProperties prop = null;
    +  266  0 
             CveDB cve = null;
     267   - 
          * @param d the dependency
    -  268   - 
          * @param sink the sink to write the data to
    -  269   - 
          * @param collapsibleHeaderCount the collapsible header count
    -  270   - 
          */
    -  271   - 
         private void writeSiteReportDependencyVulnerabilities(Dependency d, Sink sink, int collapsibleHeaderCount) {
    -  272  0 
             int cnt = collapsibleHeaderCount;
    -  273  0 
             if (d.getVulnerabilities() != null && !d.getVulnerabilities().isEmpty()) {
    -  274  0 
                 for (Vulnerability v : d.getVulnerabilities()) {
    -  275   + 
             try {
    +  268  0 
                 cve = new CveDB();
    +  269  0 
                 cve.open();
    +  270  0 
                 prop = cve.getDatabaseProperties();
    +  271  0 
             } catch (DatabaseException ex) {
    +  272  0 
                 Logger.getLogger(DependencyCheckMojo.class.getName()).log(Level.FINE, "Unable to retrieve DB Properties", ex);
    +  273   + 
             } finally {
    +  274  0 
                 if (cve != null) {
    +  275  0 
                     cve.close();
    +  276   + 
                 }
    +  277   + 
             }
    +  278  0 
             final ReportGenerator r = new ReportGenerator(project.getName(), engine.getDependencies(), engine.getAnalyzers(), prop);
    +  279   + 
             try {
    +  280  0 
                 r.generateReports(outputDirectory.getCanonicalPath(), format);
    +  281  0 
             } catch (IOException ex) {
    +  282  0 
                 Logger.getLogger(DependencyCheckMojo.class.getName()).log(Level.SEVERE,
    +  283   + 
                         "Unexpected exception occurred during analysis; please see the verbose error log for more details.");
    +  284  0 
                 Logger.getLogger(DependencyCheckMojo.class.getName()).log(Level.FINE, null, ex);
    +  285  0 
             } catch (Exception ex) {
    +  286  0 
                 Logger.getLogger(DependencyCheckMojo.class.getName()).log(Level.SEVERE,
    +  287   + 
                         "Unexpected exception occurred during analysis; please see the verbose error log for more details.");
    +  288  0 
                 Logger.getLogger(DependencyCheckMojo.class.getName()).log(Level.FINE, null, ex);
    +  289  0 
             }
    +  290  0 
         }
    +  291   
     
    -  276  0 
                     sink.paragraph();
    -  277  0 
                     sink.bold();
    -  278   - 
                     try {
    -  279  0 
                         sink.link("http://web.nvd.nist.gov/view/vuln/detail?vulnId=" + URLEncoder.encode(v.getName(), "US-ASCII"));
    -  280  0 
                         sink.text(v.getName());
    -  281  0 
                         sink.link_();
    -  282  0 
                         sink.bold_();
    -  283  0 
                     } catch (UnsupportedEncodingException ex) {
    -  284  0 
                         sink.text(v.getName());
    -  285  0 
                         sink.bold_();
    -  286  0 
                         sink.lineBreak();
    -  287  0 
                         sink.text("http://web.nvd.nist.gov/view/vuln/detail?vulnId=" + v.getName());
    -  288  0 
                     }
    -  289  0 
                     sink.paragraph_();
    -  290  0 
                     sink.paragraph();
    -  291  0 
                     sink.text("Severity: ");
    -  292  0 
                     if (v.getCvssScore() < 4.0) {
    -  293  0 
                         sink.text("Low");
    +  292   + 
         /**
    +  293   + 
          * Generates a dependency-check report using the Maven Site format.
     294   - 
                     } else {
    -  295  0 
                         if (v.getCvssScore() >= 7.0) {
    -  296  0 
                             sink.text("High");
    + 
          *
    +  295   + 
          * @param engine the engine used to scan the dependencies
    +  296   + 
          * @param sink the sink to write the data to
     297   - 
                         } else {
    -  298  0 
                             sink.text("Medium");
    -  299   - 
                         }
    + 
          */
    +  298   + 
         private void generateMavenSiteReport(final Engine engine, Sink sink) {
    +  299  0 
             final List<Dependency> dependencies = engine.getDependencies();
     300   - 
                     }
    -  301  0 
                     sink.lineBreak();
    -  302  0 
                     sink.text("CVSS Score: " + v.getCvssScore());
    -  303  0 
                     if (v.getCwe() != null && !v.getCwe().isEmpty()) {
    -  304  0 
                         sink.lineBreak();
    -  305  0 
                         sink.text("CWE: ");
    -  306  0 
                         sink.text(v.getCwe());
    -  307   - 
                     }
    -  308  0 
                     sink.paragraph_();
    -  309  0 
                     sink.paragraph();
    -  310  0 
                     sink.text(v.getDescription());
    -  311  0 
                     if (v.getReferences() != null && !v.getReferences().isEmpty()) {
    -  312  0 
                         sink.list();
    -  313  0 
                         for (Reference ref : v.getReferences()) {
    -  314  0 
                             sink.listItem();
    -  315  0 
                             sink.text(ref.getSource());
    -  316  0 
                             sink.text(" - ");
    -  317  0 
                             sink.link(ref.getUrl());
    -  318  0 
                             sink.text(ref.getName());
    -  319  0 
                             sink.link_();
    -  320  0 
                             sink.listItem_();
    -  321  0 
                         }
    -  322  0 
                         sink.list_();
    + 
     
    +  301  0 
             writeSiteReportHeader(sink, project.getName());
    +  302  0 
             writeSiteReportTOC(sink, dependencies);
    +  303   + 
     
    +  304  0 
             int cnt = 0;
    +  305  0 
             for (Dependency d : dependencies) {
    +  306  0 
                 writeSiteReportDependencyHeader(sink, d);
    +  307  0 
                 cnt = writeSiteReportDependencyAnalysisExceptions(d, cnt, sink);
    +  308  0 
                 cnt = writeSiteReportDependencyEvidenceUsed(d, cnt, sink);
    +  309  0 
                 cnt = writeSiteReportDependencyRelatedDependencies(d, cnt, sink);
    +  310  0 
                 writeSiteReportDependencyIdentifiers(d, sink);
    +  311  0 
                 writeSiteReportDependencyVulnerabilities(d, sink, cnt);
    +  312  0 
             }
    +  313  0 
             sink.body_();
    +  314  0 
         }
    +  315   + 
     
    +  316   + 
         // <editor-fold defaultstate="collapsed" desc="various writeXXXXX methods to generate the Site Report">
    +  317   + 
         /**
    +  318   + 
          * Writes the vulnerabilities to the site report.
    +  319   + 
          *
    +  320   + 
          * @param d the dependency
    +  321   + 
          * @param sink the sink to write the data to
    +  322   + 
          * @param collapsibleHeaderCount the collapsible header count
     323   - 
                     }
    -  324  0 
                     sink.paragraph_();
    -  325  0 
                     if (v.getVulnerableSoftware() != null && !v.getVulnerableSoftware().isEmpty()) {
    -  326  0 
                         sink.paragraph();
    -  327   - 
     
    -  328  0 
                         cnt += 1;
    -  329  0 
                         sink.rawText("Vulnerable Software <a href=\"javascript:toggleElement(this, 'vulnSoft" + cnt + "')\">[-]</a>");
    -  330  0 
                         sink.rawText("<div id=\"vulnSoft" + cnt + "\" style=\"display:block\">");
    -  331  0 
                         sink.list();
    -  332  0 
                         for (VulnerableSoftware vs : v.getVulnerableSoftware()) {
    -  333  0 
                             sink.listItem();
    -  334   - 
                             try {
    -  335  0 
                                 sink.link("http://web.nvd.nist.gov/view/vuln/search-results?cpe=" + URLEncoder.encode(vs.getName(), "US-ASCII"));
    -  336  0 
                                 sink.text(vs.getName());
    -  337  0 
                                 sink.link_();
    -  338  0 
                                 if (vs.hasPreviousVersion()) {
    -  339  0 
                                     sink.text(" and all previous versions.");
    -  340   - 
                                 }
    -  341  0 
                             } catch (UnsupportedEncodingException ex) {
    -  342  0 
                                 sink.text(vs.getName());
    -  343  0 
                                 if (vs.hasPreviousVersion()) {
    -  344  0 
                                     sink.text(" and all previous versions.");
    -  345   - 
                                 }
    -  346  0 
                                 sink.text(" (http://web.nvd.nist.gov/view/vuln/search-results?cpe=" + vs.getName() + ")");
    -  347  0 
                             }
    -  348   - 
     
    -  349  0 
                             sink.listItem_();
    -  350  0 
                         }
    -  351  0 
                         sink.list_();
    -  352  0 
                         sink.rawText("</div>");
    -  353  0 
                         sink.paragraph_();
    -  354   - 
                     }
    -  355  0 
                 }
    -  356   - 
             }
    -  357  0 
         }
    -  358   - 
     
    -  359   - 
         /**
    -  360   - 
          * Writes the identifiers to the site report.
    -  361   - 
          *
    -  362   - 
          * @param d the dependency
    -  363   - 
          * @param sink the sink to write the data to
    -  364   
          */
    -  365   - 
         private void writeSiteReportDependencyIdentifiers(Dependency d, Sink sink) {
    -  366  0 
             if (d.getIdentifiers() != null && !d.getIdentifiers().isEmpty()) {
    -  367  0 
                 sink.sectionTitle4();
    -  368  0 
                 sink.text("Identifiers");
    -  369  0 
                 sink.sectionTitle4_();
    -  370  0 
                 sink.list();
    -  371  0 
                 for (Identifier i : d.getIdentifiers()) {
    -  372  0 
                     sink.listItem();
    -  373  0 
                     sink.text(i.getType());
    -  374  0 
                     sink.text(": ");
    -  375  0 
                     if (i.getUrl() != null && i.getUrl().length() > 0) {
    -  376  0 
                         sink.link(i.getUrl());
    -  377  0 
                         sink.text(i.getValue());
    -  378  0 
                         sink.link_();
    -  379   +  324   + 
         private void writeSiteReportDependencyVulnerabilities(Dependency d, Sink sink, int collapsibleHeaderCount) {
    +  325  0 
             int cnt = collapsibleHeaderCount;
    +  326  0 
             if (d.getVulnerabilities() != null && !d.getVulnerabilities().isEmpty()) {
    +  327  0 
                 for (Vulnerability v : d.getVulnerabilities()) {
    +  328   + 
     
    +  329  0 
                     sink.paragraph();
    +  330  0 
                     sink.bold();
    +  331   + 
                     try {
    +  332  0 
                         sink.link("http://web.nvd.nist.gov/view/vuln/detail?vulnId=" + URLEncoder.encode(v.getName(), "US-ASCII"));
    +  333  0 
                         sink.text(v.getName());
    +  334  0 
                         sink.link_();
    +  335  0 
                         sink.bold_();
    +  336  0 
                     } catch (UnsupportedEncodingException ex) {
    +  337  0 
                         sink.text(v.getName());
    +  338  0 
                         sink.bold_();
    +  339  0 
                         sink.lineBreak();
    +  340  0 
                         sink.text("http://web.nvd.nist.gov/view/vuln/detail?vulnId=" + v.getName());
    +  341  0 
                     }
    +  342  0 
                     sink.paragraph_();
    +  343  0 
                     sink.paragraph();
    +  344  0 
                     sink.text("Severity: ");
    +  345  0 
                     if (v.getCvssScore() < 4.0) {
    +  346  0 
                         sink.text("Low");
    +  347   
                     } else {
    -  380  0 
                         sink.text(i.getValue());
    -  381   +  348  0 
                         if (v.getCvssScore() >= 7.0) {
    +  349  0 
                             sink.text("High");
    +  350   + 
                         } else {
    +  351  0 
                             sink.text("Medium");
    +  352   + 
                         }
    +  353   
                     }
    -  382  0 
                     if (i.getDescription() != null && i.getDescription().length() > 0) {
    -  383  0 
                         sink.lineBreak();
    -  384  0 
                         sink.text(i.getDescription());
    -  385   +  354  0 
                     sink.lineBreak();
    +  355  0 
                     sink.text("CVSS Score: " + v.getCvssScore());
    +  356  0 
                     if (v.getCwe() != null && !v.getCwe().isEmpty()) {
    +  357  0 
                         sink.lineBreak();
    +  358  0 
                         sink.text("CWE: ");
    +  359  0 
                         sink.text(v.getCwe());
    +  360   
                     }
    -  386  0 
                     sink.listItem_();
    -  387  0 
                 }
    -  388  0 
                 sink.list_();
    -  389   - 
             }
    -  390  0 
         }
    -  391   +  361  0 
                     sink.paragraph_();
    +  362  0 
                     sink.paragraph();
    +  363  0 
                     sink.text(v.getDescription());
    +  364  0 
                     if (v.getReferences() != null && !v.getReferences().isEmpty()) {
    +  365  0 
                         sink.list();
    +  366  0 
                         for (Reference ref : v.getReferences()) {
    +  367  0 
                             sink.listItem();
    +  368  0 
                             sink.text(ref.getSource());
    +  369  0 
                             sink.text(" - ");
    +  370  0 
                             sink.link(ref.getUrl());
    +  371  0 
                             sink.text(ref.getName());
    +  372  0 
                             sink.link_();
    +  373  0 
                             sink.listItem_();
    +  374  0 
                         }
    +  375  0 
                         sink.list_();
    +  376   + 
                     }
    +  377  0 
                     sink.paragraph_();
    +  378  0 
                     if (v.getVulnerableSoftware() != null && !v.getVulnerableSoftware().isEmpty()) {
    +  379  0 
                         sink.paragraph();
    +  380   
     
    -  392   - 
         /**
    +  381  0 
                         cnt += 1;
    +  382  0 
                         sink.rawText("Vulnerable Software <a href=\"javascript:toggleElement(this, 'vulnSoft" + cnt + "')\">[-]</a>");
    +  383  0 
                         sink.rawText("<div id=\"vulnSoft" + cnt + "\" style=\"display:block\">");
    +  384  0 
                         sink.list();
    +  385  0 
                         for (VulnerableSoftware vs : v.getVulnerableSoftware()) {
    +  386  0 
                             sink.listItem();
    +  387   + 
                             try {
    +  388  0 
                                 sink.link("http://web.nvd.nist.gov/view/vuln/search-results?cpe=" + URLEncoder.encode(vs.getName(), "US-ASCII"));
    +  389  0 
                                 sink.text(vs.getName());
    +  390  0 
                                 sink.link_();
    +  391  0 
                                 if (vs.hasPreviousVersion()) {
    +  392  0 
                                     sink.text(" and all previous versions.");
     393   - 
          * Writes the related dependencies to the site report.
    -  394   - 
          *
    -  395   - 
          * @param d the dependency
    -  396   - 
          * @param sink the sink to write the data to
    -  397   - 
          * @param collapsibleHeaderCount the collapsible header count
    + 
                                 }
    +  394  0 
                             } catch (UnsupportedEncodingException ex) {
    +  395  0 
                                 sink.text(vs.getName());
    +  396  0 
                                 if (vs.hasPreviousVersion()) {
    +  397  0 
                                     sink.text(" and all previous versions.");
     398   - 
          * @return the collapsible header count
    -  399   - 
          */
    -  400   - 
         private int writeSiteReportDependencyRelatedDependencies(Dependency d, int collapsibleHeaderCount, Sink sink) {
    -  401  0 
             int cnt = collapsibleHeaderCount;
    -  402  0 
             if (d.getRelatedDependencies() != null && !d.getRelatedDependencies().isEmpty()) {
    -  403  0 
                 cnt += 1;
    -  404  0 
                 sink.sectionTitle4();
    -  405  0 
                 sink.rawText("Related Dependencies <a href=\"javascript:toggleElement(this, 'related" + cnt + "')\">[+]</a>");
    -  406  0 
                 sink.sectionTitle4_();
    -  407  0 
                 sink.rawText("<div id=\"related" + cnt + "\" style=\"display:none\">");
    -  408  0 
                 sink.list();
    -  409  0 
                 for (Dependency r : d.getRelatedDependencies()) {
    -  410  0 
                     sink.listItem();
    -  411  0 
                     sink.text(r.getFileName());
    -  412  0 
                     sink.list();
    -  413  0 
                     writeListItem(sink, "File Path: " + r.getFilePath());
    -  414  0 
                     writeListItem(sink, "SHA1: " + r.getSha1sum());
    -  415  0 
                     writeListItem(sink, "MD5: " + r.getMd5sum());
    -  416  0 
                     sink.list_();
    -  417  0 
                     sink.listItem_();
    -  418  0 
                 }
    -  419  0 
                 sink.list_();
    -  420  0 
                 sink.rawText("</div>");
    -  421   - 
             }
    -  422  0 
             return cnt;
    -  423   - 
         }
    -  424   + 
                                 }
    +  399  0 
                                 sink.text(" (http://web.nvd.nist.gov/view/vuln/search-results?cpe=" + vs.getName() + ")");
    +  400  0 
                             }
    +  401   
     
    -  425   +  402  0 
                             sink.listItem_();
    +  403  0 
                         }
    +  404  0 
                         sink.list_();
    +  405  0 
                         sink.rawText("</div>");
    +  406  0 
                         sink.paragraph_();
    +  407   + 
                     }
    +  408  0 
                 }
    +  409   + 
             }
    +  410  0 
         }
    +  411   + 
     
    +  412   
         /**
    -  426   - 
          * Writes the evidence used to the site report.
    -  427   +  413   + 
          * Writes the identifiers to the site report.
    +  414   
          *
    -  428   +  415   
          * @param d the dependency
    -  429   +  416   
          * @param sink the sink to write the data to
    -  430   - 
          * @param collapsibleHeaderCount the collapsible header count
    -  431   - 
          * @return the collapsible header count
    +  417   + 
          */
    +  418   + 
         private void writeSiteReportDependencyIdentifiers(Dependency d, Sink sink) {
    +  419  0 
             if (d.getIdentifiers() != null && !d.getIdentifiers().isEmpty()) {
    +  420  0 
                 sink.sectionTitle4();
    +  421  0 
                 sink.text("Identifiers");
    +  422  0 
                 sink.sectionTitle4_();
    +  423  0 
                 sink.list();
    +  424  0 
                 for (Identifier i : d.getIdentifiers()) {
    +  425  0 
                     sink.listItem();
    +  426  0 
                     sink.text(i.getType());
    +  427  0 
                     sink.text(": ");
    +  428  0 
                     if (i.getUrl() != null && i.getUrl().length() > 0) {
    +  429  0 
                         sink.link(i.getUrl());
    +  430  0 
                         sink.text(i.getValue());
    +  431  0 
                         sink.link_();
     432   - 
          */
    -  433   - 
         private int writeSiteReportDependencyEvidenceUsed(Dependency d, int collapsibleHeaderCount, Sink sink) {
    -  434  0 
             int cnt = collapsibleHeaderCount;
    -  435  0 
             if (d.getEvidenceUsed() != null && d.getEvidenceUsed().size() > 0) {
    -  436  0 
                 cnt += 1;
    -  437  0 
                 sink.sectionTitle4();
    -  438  0 
                 sink.rawText("Evidence Collected <a href=\"javascript:toggleElement(this, 'evidence" + cnt + "')\">[+]</a>");
    -  439  0 
                 sink.sectionTitle4_();
    -  440  0 
                 sink.rawText("<div id=\"evidence" + cnt + "\" style=\"display:none\">");
    -  441  0 
                 sink.table();
    -  442  0 
                 sink.tableRow();
    -  443  0 
                 writeTableHeaderCell(sink, "Source");
    -  444  0 
                 writeTableHeaderCell(sink, "Name");
    -  445  0 
                 writeTableHeaderCell(sink, "Value");
    -  446  0 
                 sink.tableRow_();
    -  447  0 
                 for (Evidence e : d.getEvidenceUsed()) {
    -  448  0 
                     sink.tableRow();
    -  449  0 
                     writeTableCell(sink, e.getSource());
    -  450  0 
                     writeTableCell(sink, e.getName());
    -  451  0 
                     writeTableCell(sink, e.getValue());
    -  452  0 
                     sink.tableRow_();
    -  453  0 
                 }
    -  454  0 
                 sink.table_();
    -  455  0 
                 sink.rawText("</div>");
    -  456   + 
                     } else {
    +  433  0 
                         sink.text(i.getValue());
    +  434   + 
                     }
    +  435  0 
                     if (i.getDescription() != null && i.getDescription().length() > 0) {
    +  436  0 
                         sink.lineBreak();
    +  437  0 
                         sink.text(i.getDescription());
    +  438   + 
                     }
    +  439  0 
                     sink.listItem_();
    +  440  0 
                 }
    +  441  0 
                 sink.list_();
    +  442   
             }
    -  457  0 
             return cnt;
    -  458   - 
         }
    -  459   +  443  0 
         }
    +  444   
     
    -  460   +  445   
         /**
    -  461   - 
          * Writes the analysis exceptions generated during analysis to the site
    -  462   - 
          * report.
    -  463   +  446   + 
          * Writes the related dependencies to the site report.
    +  447   
          *
    -  464   +  448   
          * @param d the dependency
    -  465   +  449   
          * @param sink the sink to write the data to
    -  466   +  450   
          * @param collapsibleHeaderCount the collapsible header count
    -  467   +  451   
          * @return the collapsible header count
    -  468   +  452   
          */
    -  469   - 
         private int writeSiteReportDependencyAnalysisExceptions(Dependency d, int collapsibleHeaderCount, Sink sink) {
    -  470  0 
             int cnt = collapsibleHeaderCount;
    -  471  0 
             if (d.getAnalysisExceptions() != null && !d.getAnalysisExceptions().isEmpty()) {
    -  472  0 
                 cnt += 1;
    -  473  0 
                 sink.sectionTitle4();
    -  474  0 
                 sink.rawText("<font style=\"color:red\">Errors occurred during analysis:</font> <a href=\"javascript:toggleElement(this, 'errors"
    -  475   - 
                         + cnt + "')\">[+]</a>");
    -  476  0 
                 sink.sectionTitle4_();
    -  477  0 
                 sink.rawText("<div id=\"errors" + cnt + "\">");
    -  478  0 
                 sink.list();
    -  479  0 
                 for (Exception e : d.getAnalysisExceptions()) {
    -  480  0 
                     sink.listItem();
    -  481  0 
                     sink.text(e.getMessage());
    -  482  0 
                     sink.listItem_();
    -  483  0 
                 }
    -  484  0 
                 sink.list_();
    -  485  0 
                 sink.rawText("</div>");
    -  486   +  453   + 
         private int writeSiteReportDependencyRelatedDependencies(Dependency d, int collapsibleHeaderCount, Sink sink) {
    +  454  0 
             int cnt = collapsibleHeaderCount;
    +  455  0 
             if (d.getRelatedDependencies() != null && !d.getRelatedDependencies().isEmpty()) {
    +  456  0 
                 cnt += 1;
    +  457  0 
                 sink.sectionTitle4();
    +  458  0 
                 sink.rawText("Related Dependencies <a href=\"javascript:toggleElement(this, 'related" + cnt + "')\">[+]</a>");
    +  459  0 
                 sink.sectionTitle4_();
    +  460  0 
                 sink.rawText("<div id=\"related" + cnt + "\" style=\"display:none\">");
    +  461  0 
                 sink.list();
    +  462  0 
                 for (Dependency r : d.getRelatedDependencies()) {
    +  463  0 
                     sink.listItem();
    +  464  0 
                     sink.text(r.getFileName());
    +  465  0 
                     sink.list();
    +  466  0 
                     writeListItem(sink, "File Path: " + r.getFilePath());
    +  467  0 
                     writeListItem(sink, "SHA1: " + r.getSha1sum());
    +  468  0 
                     writeListItem(sink, "MD5: " + r.getMd5sum());
    +  469  0 
                     sink.list_();
    +  470  0 
                     sink.listItem_();
    +  471  0 
                 }
    +  472  0 
                 sink.list_();
    +  473  0 
                 sink.rawText("</div>");
    +  474   
             }
    -  487  0 
             return cnt;
    -  488   +  475  0 
             return cnt;
    +  476   
         }
    -  489   +  477   
     
    -  490   +  478   
         /**
    -  491   - 
          * Writes the dependency header to the site report.
    -  492   +  479   + 
          * Writes the evidence used to the site report.
    +  480   
          *
    -  493   +  481   
          * @param d the dependency
    -  494   +  482   
          * @param sink the sink to write the data to
    -  495   +  483   + 
          * @param collapsibleHeaderCount the collapsible header count
    +  484   + 
          * @return the collapsible header count
    +  485   
          */
    -  496   - 
         private void writeSiteReportDependencyHeader(Sink sink, Dependency d) {
    -  497  0 
             sink.sectionTitle2();
    -  498  0 
             sink.anchor("sha1" + d.getSha1sum());
    -  499  0 
             sink.text(d.getFileName());
    -  500  0 
             sink.anchor_();
    -  501  0 
             sink.sectionTitle2_();
    -  502  0 
             if (d.getDescription() != null && d.getDescription().length() > 0) {
    -  503  0 
                 sink.paragraph();
    -  504  0 
                 sink.bold();
    -  505  0 
                 sink.text("Description: ");
    -  506  0 
                 sink.bold_();
    -  507  0 
                 sink.text(d.getDescription());
    -  508  0 
                 sink.paragraph_();
    +  486   + 
         private int writeSiteReportDependencyEvidenceUsed(Dependency d, int collapsibleHeaderCount, Sink sink) {
    +  487  0 
             int cnt = collapsibleHeaderCount;
    +  488  0 
             if (d.getEvidenceUsed() != null && d.getEvidenceUsed().size() > 0) {
    +  489  0 
                 cnt += 1;
    +  490  0 
                 sink.sectionTitle4();
    +  491  0 
                 sink.rawText("Evidence Collected <a href=\"javascript:toggleElement(this, 'evidence" + cnt + "')\">[+]</a>");
    +  492  0 
                 sink.sectionTitle4_();
    +  493  0 
                 sink.rawText("<div id=\"evidence" + cnt + "\" style=\"display:none\">");
    +  494  0 
                 sink.table();
    +  495  0 
                 sink.tableRow();
    +  496  0 
                 writeTableHeaderCell(sink, "Source");
    +  497  0 
                 writeTableHeaderCell(sink, "Name");
    +  498  0 
                 writeTableHeaderCell(sink, "Value");
    +  499  0 
                 sink.tableRow_();
    +  500  0 
                 for (Evidence e : d.getEvidenceUsed()) {
    +  501  0 
                     sink.tableRow();
    +  502  0 
                     writeTableCell(sink, e.getSource());
    +  503  0 
                     writeTableCell(sink, e.getName());
    +  504  0 
                     writeTableCell(sink, e.getValue());
    +  505  0 
                     sink.tableRow_();
    +  506  0 
                 }
    +  507  0 
                 sink.table_();
    +  508  0 
                 sink.rawText("</div>");
     509   
             }
    -  510  0 
             if (d.getLicense() != null && d.getLicense().length() > 0) {
    -  511  0 
                 sink.paragraph();
    -  512  0 
                 sink.bold();
    -  513  0 
                 sink.text("License: ");
    -  514  0 
                 sink.bold_();
    -  515  0 
                 if (d.getLicense().startsWith("http://") && !d.getLicense().contains(" ")) {
    -  516  0 
                     sink.link(d.getLicense());
    -  517  0 
                     sink.text(d.getLicense());
    -  518  0 
                     sink.link_();
    +  510  0 
             return cnt;
    +  511   + 
         }
    +  512   + 
     
    +  513   + 
         /**
    +  514   + 
          * Writes the analysis exceptions generated during analysis to the site report.
    +  515   + 
          *
    +  516   + 
          * @param d the dependency
    +  517   + 
          * @param sink the sink to write the data to
    +  518   + 
          * @param collapsibleHeaderCount the collapsible header count
     519   - 
                 } else {
    -  520  0 
                     sink.text(d.getLicense());
    + 
          * @return the collapsible header count
    +  520   + 
          */
     521   - 
                 }
    -  522  0 
                 sink.paragraph_();
    -  523   - 
             }
    -  524  0 
         }
    -  525   - 
     
    -  526   - 
         /**
    + 
         private int writeSiteReportDependencyAnalysisExceptions(Dependency d, int collapsibleHeaderCount, Sink sink) {
    +  522  0 
             int cnt = collapsibleHeaderCount;
    +  523  0 
             if (d.getAnalysisExceptions() != null && !d.getAnalysisExceptions().isEmpty()) {
    +  524  0 
                 cnt += 1;
    +  525  0 
                 sink.sectionTitle4();
    +  526  0 
                 sink.rawText("<font style=\"color:red\">Errors occurred during analysis:</font> <a href=\"javascript:toggleElement(this, 'errors"
     527   - 
          * Adds a list item to the site report.
    -  528   - 
          *
    -  529   - 
          * @param sink the sink to write the data to
    -  530   - 
          * @param text the text to write
    -  531   - 
          */
    -  532   - 
         private void writeListItem(Sink sink, String text) {
    -  533  0 
             sink.listItem();
    -  534  0 
             sink.text(text);
    -  535  0 
             sink.listItem_();
    -  536  0 
         }
    -  537   - 
     
    + 
                         + cnt + "')\">[+]</a>");
    +  528  0 
                 sink.sectionTitle4_();
    +  529  0 
                 sink.rawText("<div id=\"errors" + cnt + "\">");
    +  530  0 
                 sink.list();
    +  531  0 
                 for (Exception e : d.getAnalysisExceptions()) {
    +  532  0 
                     sink.listItem();
    +  533  0 
                     sink.text(e.getMessage());
    +  534  0 
                     sink.listItem_();
    +  535  0 
                 }
    +  536  0 
                 sink.list_();
    +  537  0 
                 sink.rawText("</div>");
     538   - 
         /**
    -  539   - 
          * Adds a table cell to the site report.
    + 
             }
    +  539  0 
             return cnt;
     540   - 
          *
    + 
         }
     541   - 
          * @param sink the sink to write the data to
    + 
     
     542   - 
          * @param text the text to write
    + 
         /**
     543   - 
          */
    + 
          * Writes the dependency header to the site report.
     544   - 
         private void writeTableCell(Sink sink, String text) {
    -  545  0 
             sink.tableCell();
    -  546  0 
             sink.text(text);
    -  547  0 
             sink.tableCell_();
    -  548  0 
         }
    -  549   - 
     
    -  550   - 
         /**
    -  551   - 
          * Adds a table header cell to the site report.
    -  552   
          *
    -  553   +  545   + 
          * @param d the dependency
    +  546   
          * @param sink the sink to write the data to
    -  554   - 
          * @param text the text to write
    -  555   +  547   
          */
    -  556   - 
         private void writeTableHeaderCell(Sink sink, String text) {
    -  557  0 
             sink.tableHeaderCell();
    -  558  0 
             sink.text(text);
    -  559  0 
             sink.tableHeaderCell_();
    -  560  0 
         }
    +  548   + 
         private void writeSiteReportDependencyHeader(Sink sink, Dependency d) {
    +  549  0 
             sink.sectionTitle2();
    +  550  0 
             sink.anchor("sha1" + d.getSha1sum());
    +  551  0 
             sink.text(d.getFileName());
    +  552  0 
             sink.anchor_();
    +  553  0 
             sink.sectionTitle2_();
    +  554  0 
             if (d.getDescription() != null && d.getDescription().length() > 0) {
    +  555  0 
                 sink.paragraph();
    +  556  0 
                 sink.bold();
    +  557  0 
                 sink.text("Description: ");
    +  558  0 
                 sink.bold_();
    +  559  0 
                 sink.text(d.getDescription());
    +  560  0 
                 sink.paragraph_();
     561   - 
     
    -  562   - 
         /**
    -  563   - 
          * Writes the TOC for the site report.
    -  564   - 
          *
    -  565   - 
          * @param sink the sink to write the data to
    -  566   - 
          * @param dependencies the dependencies that are being reported on
    -  567   - 
          */
    -  568   - 
         private void writeSiteReportTOC(Sink sink, final List<Dependency> dependencies) {
    -  569  0 
             sink.list();
    -  570  0 
             for (Dependency d : dependencies) {
    -  571  0 
                 sink.listItem();
    -  572  0 
                 sink.link("#sha1" + d.getSha1sum());
    -  573  0 
                 sink.text(d.getFileName());
    -  574  0 
                 sink.link_();
    -  575  0 
                 if (!d.getVulnerabilities().isEmpty()) {
    -  576  0 
                     sink.rawText(" <font style=\"color:red\">•</font>");
    + 
             }
    +  562  0 
             if (d.getLicense() != null && d.getLicense().length() > 0) {
    +  563  0 
                 sink.paragraph();
    +  564  0 
                 sink.bold();
    +  565  0 
                 sink.text("License: ");
    +  566  0 
                 sink.bold_();
    +  567  0 
                 if (d.getLicense().startsWith("http://") && !d.getLicense().contains(" ")) {
    +  568  0 
                     sink.link(d.getLicense());
    +  569  0 
                     sink.text(d.getLicense());
    +  570  0 
                     sink.link_();
    +  571   + 
                 } else {
    +  572  0 
                     sink.text(d.getLicense());
    +  573   + 
                 }
    +  574  0 
                 sink.paragraph_();
    +  575   + 
             }
    +  576  0 
         }
     577   - 
                 }
    -  578  0 
                 if (!d.getRelatedDependencies().isEmpty()) {
    -  579  0 
                     sink.list();
    -  580  0 
                     for (Dependency r : d.getRelatedDependencies()) {
    -  581  0 
                         writeListItem(sink, r.getFileName());
    -  582  0 
                     }
    -  583  0 
                     sink.list_();
    + 
     
    +  578   + 
         /**
    +  579   + 
          * Adds a list item to the site report.
    +  580   + 
          *
    +  581   + 
          * @param sink the sink to write the data to
    +  582   + 
          * @param text the text to write
    +  583   + 
          */
     584   - 
                 }
    -  585  0 
                 sink.listItem_();
    -  586  0 
             }
    -  587  0 
             sink.list_();
    + 
         private void writeListItem(Sink sink, String text) {
    +  585  0 
             sink.listItem();
    +  586  0 
             sink.text(text);
    +  587  0 
             sink.listItem_();
     588  0 
         }
     589   
     
     590   
         /**
     591   - 
          * Writes the site report header.
    + 
          * Adds a table cell to the site report.
     592   
          *
     593   
          * @param sink the sink to write the data to
     594   - 
          * @param projectName the name of the project
    + 
          * @param text the text to write
     595   
          */
     596   - 
         private void writeSiteReportHeader(Sink sink, String projectName) {
    -  597  0 
             sink.head();
    -  598  0 
             sink.title();
    -  599  0 
             sink.text("Dependency-Check Report: " + projectName);
    -  600  0 
             sink.title_();
    -  601  0 
             sink.head_();
    -  602  0 
             sink.body();
    -  603  0 
             sink.rawText("<script type=\"text/javascript\">");
    -  604  0 
             sink.rawText("function toggleElement(el, targetId) {");
    -  605  0 
             sink.rawText("if (el.innerText == '[+]') {");
    -  606  0 
             sink.rawText("    el.innerText = '[-]';");
    -  607  0 
             sink.rawText("    document.getElementById(targetId).style.display='block';");
    -  608  0 
             sink.rawText("} else {");
    -  609  0 
             sink.rawText("    el.innerText = '[+]';");
    -  610  0 
             sink.rawText("    document.getElementById(targetId).style.display='none';");
    -  611  0 
             sink.rawText("}");
    -  612   + 
         private void writeTableCell(Sink sink, String text) {
    +  597  0 
             sink.tableCell();
    +  598  0 
             sink.text(text);
    +  599  0 
             sink.tableCell_();
    +  600  0 
         }
    +  601   
     
    -  613  0 
             sink.rawText("}");
    -  614  0 
             sink.rawText("</script>");
    -  615  0 
             sink.section1();
    -  616  0 
             sink.sectionTitle1();
    -  617  0 
             sink.text("Project: " + projectName);
    -  618  0 
             sink.sectionTitle1_();
    -  619  0 
             sink.date();
    -  620  0 
             final Date now = new Date();
    -  621  0 
             sink.text(DateFormat.getDateTimeInstance().format(now));
    -  622  0 
             sink.date_();
    -  623  0 
             sink.section1_();
    -  624  0 
         }
    -  625   - 
         // </editor-fold>
    -  626   - 
     
    -  627   +  602   
         /**
    -  628   - 
          * Takes the properties supplied and updates the dependency-check settings.
    +  603   + 
          * Adds a table header cell to the site report.
    +  604   + 
          *
    +  605   + 
          * @param sink the sink to write the data to
    +  606   + 
          * @param text the text to write
    +  607   + 
          */
    +  608   + 
         private void writeTableHeaderCell(Sink sink, String text) {
    +  609  0 
             sink.tableHeaderCell();
    +  610  0 
             sink.text(text);
    +  611  0 
             sink.tableHeaderCell_();
    +  612  0 
         }
    +  613   + 
     
    +  614   + 
         /**
    +  615   + 
          * Writes the TOC for the site report.
    +  616   + 
          *
    +  617   + 
          * @param sink the sink to write the data to
    +  618   + 
          * @param dependencies the dependencies that are being reported on
    +  619   + 
          */
    +  620   + 
         private void writeSiteReportTOC(Sink sink, final List<Dependency> dependencies) {
    +  621  0 
             sink.list();
    +  622  0 
             for (Dependency d : dependencies) {
    +  623  0 
                 sink.listItem();
    +  624  0 
                 sink.link("#sha1" + d.getSha1sum());
    +  625  0 
                 sink.text(d.getFileName());
    +  626  0 
                 sink.link_();
    +  627  0 
                 if (!d.getVulnerabilities().isEmpty()) {
    +  628  0 
                     sink.rawText(" <font style=\"color:red\">•</font>");
     629   - 
          * Additionally, this sets the system properties required to change the
    -  630   - 
          * proxy url, port, and connection timeout.
    -  631   - 
          */
    -  632   - 
         private void populateSettings() {
    -  633  0 
             InputStream mojoProperties = null;
    -  634   - 
             try {
    -  635  0 
                 mojoProperties = this.getClass().getClassLoader().getResourceAsStream(PROPERTIES_FILE);
    -  636  0 
                 Settings.mergeProperties(mojoProperties);
    -  637  0 
             } catch (IOException ex) {
    -  638  0 
                 Logger.getLogger(DependencyCheckMojo.class.getName()).log(Level.WARNING, "Unable to load the dependency-check ant task.properties file.");
    -  639  0 
                 Logger.getLogger(DependencyCheckMojo.class.getName()).log(Level.FINE, null, ex);
    -  640   - 
             } finally {
    -  641  0 
                 if (mojoProperties != null) {
    -  642   - 
                     try {
    -  643  0 
                         mojoProperties.close();
    -  644  0 
                     } catch (IOException ex) {
    -  645  0 
                         Logger.getLogger(DependencyCheckMojo.class.getName()).log(Level.FINEST, null, ex);
    -  646  0 
                     }
    -  647   
                 }
    +  630  0 
                 if (!d.getRelatedDependencies().isEmpty()) {
    +  631  0 
                     sink.list();
    +  632  0 
                     for (Dependency r : d.getRelatedDependencies()) {
    +  633  0 
                         writeListItem(sink, r.getFileName());
    +  634  0 
                     }
    +  635  0 
                     sink.list_();
    +  636   + 
                 }
    +  637  0 
                 sink.listItem_();
    +  638  0 
             }
    +  639  0 
             sink.list_();
    +  640  0 
         }
    +  641   + 
     
    +  642   + 
         /**
    +  643   + 
          * Writes the site report header.
    +  644   + 
          *
    +  645   + 
          * @param sink the sink to write the data to
    +  646   + 
          * @param projectName the name of the project
    +  647   + 
          */
     648   - 
             }
    -  649   + 
         private void writeSiteReportHeader(Sink sink, String projectName) {
    +  649  0 
             sink.head();
    +  650  0 
             sink.title();
    +  651  0 
             sink.text("Dependency-Check Report: " + projectName);
    +  652  0 
             sink.title_();
    +  653  0 
             sink.head_();
    +  654  0 
             sink.body();
    +  655  0 
             sink.rawText("<script type=\"text/javascript\">");
    +  656  0 
             sink.rawText("function toggleElement(el, targetId) {");
    +  657  0 
             sink.rawText("if (el.innerText == '[+]') {");
    +  658  0 
             sink.rawText("    el.innerText = '[-]';");
    +  659  0 
             sink.rawText("    document.getElementById(targetId).style.display='block';");
    +  660  0 
             sink.rawText("} else {");
    +  661  0 
             sink.rawText("    el.innerText = '[+]';");
    +  662  0 
             sink.rawText("    document.getElementById(targetId).style.display='none';");
    +  663  0 
             sink.rawText("}");
    +  664   
     
    -  650  0 
             Settings.setBoolean(Settings.KEYS.AUTO_UPDATE, autoUpdate);
    -  651   - 
     
    -  652  0 
             if (proxyUrl != null && !proxyUrl.isEmpty()) {
    -  653  0 
                 Settings.setString(Settings.KEYS.PROXY_URL, proxyUrl);
    -  654   - 
             }
    -  655  0 
             if (proxyPort != null && !proxyPort.isEmpty()) {
    -  656  0 
                 Settings.setString(Settings.KEYS.PROXY_PORT, proxyPort);
    -  657   - 
             }
    -  658  0 
             if (proxyUsername != null && !proxyUsername.isEmpty()) {
    -  659  0 
                 Settings.setString(Settings.KEYS.PROXY_USERNAME, proxyUsername);
    -  660   - 
             }
    -  661  0 
             if (proxyPassword != null && !proxyPassword.isEmpty()) {
    -  662  0 
                 Settings.setString(Settings.KEYS.PROXY_PASSWORD, proxyPassword);
    -  663   - 
             }
    -  664  0 
             if (connectionTimeout != null && !connectionTimeout.isEmpty()) {
    -  665  0 
                 Settings.setString(Settings.KEYS.CONNECTION_TIMEOUT, connectionTimeout);
    -  666   - 
             }
    -  667  0 
             if (suppressionFile != null && !suppressionFile.isEmpty()) {
    -  668  0 
                 Settings.setString(Settings.KEYS.SUPPRESSION_FILE, suppressionFile);
    -  669   - 
             }
    -  670  0 
         }
    -  671   - 
     
    -  672   - 
         /**
    -  673   - 
          * Executes the dependency-check and generates the report.
    -  674   - 
          *
    -  675   - 
          * @throws MojoExecutionException if a maven exception occurs
    -  676   - 
          * @throws MojoFailureException thrown if a CVSS score is found that is
    +  665  0 
             sink.rawText("}");
    +  666  0 
             sink.rawText("</script>");
    +  667  0 
             sink.section1();
    +  668  0 
             sink.sectionTitle1();
    +  669  0 
             sink.text("Project: " + projectName);
    +  670  0 
             sink.sectionTitle1_();
    +  671  0 
             sink.date();
    +  672  0 
             final Date now = new Date();
    +  673  0 
             sink.text(DateFormat.getDateTimeInstance().format(now));
    +  674  0 
             sink.date_();
    +  675  0 
             sink.section1_();
    +  676  0 
         }
     677   - 
          * higher then the configured level
    -  678   - 
          */
    -  679   - 
         public void execute() throws MojoExecutionException, MojoFailureException {
    -  680  0 
             final Engine engine = executeDependencyCheck();
    -  681  0 
             generateExternalReports(engine);
    -  682  0 
             if (this.failBuildOnCVSS <= 10) {
    -  683  0 
                 checkForFailure(engine.getDependencies());
    -  684   - 
             }
    -  685  0 
             if (this.showSummary) {
    -  686  0 
                 showSummary(engine.getDependencies());
    -  687   - 
             }
    -  688  0 
         }
    -  689   - 
     
    -  690   - 
         /**
    -  691   - 
          * Generates the Dependency-Check Site Report.
    -  692   - 
          *
    -  693   - 
          * @param sink the sink to write the report to
    -  694   - 
          * @param locale the locale to use when generating the report
    -  695   - 
          * @throws MavenReportException if a Maven report exception occurs
    -  696   - 
          */
    -  697   - 
         public void generate(@SuppressWarnings("deprecation") org.codehaus.doxia.sink.Sink sink,
    -  698   - 
                 Locale locale) throws MavenReportException {
    -  699  0 
             generate((Sink) sink, null, locale);
    -  700  0 
         }
    -  701   - 
     
    -  702   - 
         /**
    -  703   - 
          * Generates the Dependency-Check Site Report.
    -  704   - 
          *
    -  705   - 
          * @param sink the sink to write the report to
    -  706   - 
          * @param sinkFactory the sink factory
    -  707   - 
          * @param locale the locale to use when generating the report
    -  708   - 
          * @throws MavenReportException if a maven report exception occurs
    -  709   - 
          */
    -  710   - 
         public void generate(Sink sink, SinkFactory sinkFactory, Locale locale) throws MavenReportException {
    -  711  0 
             final Engine engine = executeDependencyCheck();
    -  712  0 
             generateMavenSiteReport(engine, sink);
    -  713  0 
         }
    -  714   - 
     
    -  715   - 
         // <editor-fold defaultstate="collapsed" desc="required setter/getter methods">
    -  716   - 
         /**
    -  717   - 
          * Returns the output name.
    -  718   - 
          *
    -  719   - 
          * @return the output name
    -  720   - 
          */
    -  721   - 
         public String getOutputName() {
    -  722  0 
             return reportName;
    -  723   - 
         }
    -  724   - 
     
    -  725   - 
         /**
    -  726   - 
          * Returns the category name.
    -  727   - 
          *
    -  728   - 
          * @return the category name
    -  729   - 
          */
    -  730   - 
         public String getCategoryName() {
    -  731  0 
             return MavenReport.CATEGORY_PROJECT_REPORTS;
    -  732   - 
         }
    -  733   - 
     
    -  734   - 
         /**
    -  735   - 
          * Returns the report name.
    -  736   - 
          *
    -  737   - 
          * @param locale the location
    -  738   - 
          * @return the report name
    -  739   - 
          */
    -  740   - 
         public String getName(Locale locale) {
    -  741  0 
             return name;
    -  742   - 
         }
    -  743   - 
     
    -  744   - 
         /**
    -  745   - 
          * Sets the Reporting output directory.
    -  746   - 
          *
    -  747   - 
          * @param directory the output directory
    -  748   - 
          */
    -  749   - 
         public void setReportOutputDirectory(File directory) {
    -  750  0 
             reportOutputDirectory = directory;
    -  751  0 
         }
    -  752   - 
     
    -  753   - 
         /**
    -  754   - 
          * Returns the output directory.
    -  755   - 
          *
    -  756   - 
          * @return the output directory
    -  757   - 
          */
    -  758   - 
         public File getReportOutputDirectory() {
    -  759  0 
             return reportOutputDirectory;
    -  760   - 
         }
    -  761   - 
     
    -  762   - 
         /**
    -  763   - 
          * Gets the description of the Dependency-Check report to be displayed in
    -  764   - 
          * the Maven Generated Reports page.
    -  765   - 
          *
    -  766   - 
          * @param locale The Locale to get the description for
    -  767   - 
          * @return the description
    -  768   - 
          */
    -  769   - 
         public String getDescription(Locale locale) {
    -  770  0 
             return description;
    -  771   - 
         }
    -  772   - 
     
    -  773   - 
         /**
    -  774   - 
          * Returns whether this is an external report.
    -  775   - 
          *
    -  776   - 
          * @return true or false;
    -  777   - 
          */
    -  778   - 
         public boolean isExternalReport() {
    -  779  0 
             return externalReport;
    -  780   - 
         }
    -  781   - 
     
    -  782   - 
         /**
    -  783   - 
          * Returns whether or not the plugin can generate a report.
    -  784   - 
          *
    -  785   - 
          * @return true
    -  786   - 
          */
    -  787   - 
         public boolean canGenerateReport() {
    -  788  0 
             return true;
    -  789   - 
         }
    -  790   
         // </editor-fold>
    -  791   +  678   
     
    -  792   +  679   
         /**
    -  793   - 
          * Checks to see if a vulnerability has been identified with a CVSS score
    -  794   - 
          * that is above the threshold set in the configuration.
    -  795   - 
          *
    -  796   - 
          * @param dependencies the list of dependency objects
    -  797   - 
          * @throws MojoFailureException thrown if a CVSS score is found that is
    -  798   - 
          * higher then the threshold set
    -  799   +  680   + 
          * Takes the properties supplied and updates the dependency-check settings. Additionally, this sets the system
    +  681   + 
          * properties required to change the proxy url, port, and connection timeout.
    +  682   
          */
    -  800   - 
         private void checkForFailure(List<Dependency> dependencies) throws MojoFailureException {
    -  801  0 
             final StringBuilder ids = new StringBuilder();
    -  802  0 
             for (Dependency d : dependencies) {
    -  803  0 
                 for (Vulnerability v : d.getVulnerabilities()) {
    -  804  0 
                     if (v.getCvssScore() >= failBuildOnCVSS) {
    -  805  0 
                         if (ids.length() == 0) {
    -  806  0 
                             ids.append(v.getName());
    -  807   - 
                         } else {
    -  808  0 
                             ids.append(", ").append(v.getName());
    -  809   - 
                         }
    -  810   - 
                     }
    -  811  0 
                 }
    -  812  0 
             }
    -  813  0 
             if (ids.length() > 0) {
    -  814  0 
                 final String msg = String.format("%n%nDependency-Check Failure:%n"
    -  815   - 
                         + "One or more dependencies were identified with vulnerabilities that have a CVSS score greater then '%.1f': %s%n"
    -  816   - 
                         + "See the dependency-check report for more details.%n%n", failBuildOnCVSS, ids.toString());
    -  817  0 
                 throw new MojoFailureException(msg);
    -  818   +  683   + 
         private void populateSettings() {
    +  684  0 
             InputStream mojoProperties = null;
    +  685   + 
             try {
    +  686  0 
                 mojoProperties = this.getClass().getClassLoader().getResourceAsStream(PROPERTIES_FILE);
    +  687  0 
                 Settings.mergeProperties(mojoProperties);
    +  688  0 
             } catch (IOException ex) {
    +  689  0 
                 Logger.getLogger(DependencyCheckMojo.class.getName()).log(Level.WARNING, "Unable to load the dependency-check ant task.properties file.");
    +  690  0 
                 Logger.getLogger(DependencyCheckMojo.class.getName()).log(Level.FINE, null, ex);
    +  691   + 
             } finally {
    +  692  0 
                 if (mojoProperties != null) {
    +  693   + 
                     try {
    +  694  0 
                         mojoProperties.close();
    +  695  0 
                     } catch (IOException ex) {
    +  696  0 
                         Logger.getLogger(DependencyCheckMojo.class.getName()).log(Level.FINEST, null, ex);
    +  697  0 
                     }
    +  698   + 
                 }
    +  699   
             }
    -  819  0 
         }
    -  820   +  700   
     
    -  821   +  701  0 
             Settings.setBoolean(Settings.KEYS.AUTO_UPDATE, autoUpdate);
    +  702   + 
     
    +  703  0 
             if (proxyUrl != null && !proxyUrl.isEmpty()) {
    +  704  0 
                 Settings.setString(Settings.KEYS.PROXY_URL, proxyUrl);
    +  705   + 
             }
    +  706  0 
             if (proxyPort != null && !proxyPort.isEmpty()) {
    +  707  0 
                 Settings.setString(Settings.KEYS.PROXY_PORT, proxyPort);
    +  708   + 
             }
    +  709  0 
             if (proxyUsername != null && !proxyUsername.isEmpty()) {
    +  710  0 
                 Settings.setString(Settings.KEYS.PROXY_USERNAME, proxyUsername);
    +  711   + 
             }
    +  712  0 
             if (proxyPassword != null && !proxyPassword.isEmpty()) {
    +  713  0 
                 Settings.setString(Settings.KEYS.PROXY_PASSWORD, proxyPassword);
    +  714   + 
             }
    +  715  0 
             if (connectionTimeout != null && !connectionTimeout.isEmpty()) {
    +  716  0 
                 Settings.setString(Settings.KEYS.CONNECTION_TIMEOUT, connectionTimeout);
    +  717   + 
             }
    +  718  0 
             if (suppressionFile != null && !suppressionFile.isEmpty()) {
    +  719  0 
                 Settings.setString(Settings.KEYS.SUPPRESSION_FILE, suppressionFile);
    +  720   + 
             }
    +  721  0 
             Settings.setBoolean(Settings.KEYS.ANALYZER_NEXUS_ENABLED, nexusAnalyzerEnabled);
    +  722  0 
             if (nexusUrl != null && !nexusUrl.isEmpty()) {
    +  723  0 
                 Settings.setString(Settings.KEYS.ANALYZER_NEXUS_URL, nexusUrl);
    +  724   + 
             }
    +  725  0 
             if (databaseDriverName != null && !databaseDriverName.isEmpty()) {
    +  726  0 
                 Settings.setString(Settings.KEYS.DB_DRIVER_NAME, databaseDriverName);
    +  727   + 
             }
    +  728  0 
             if (databaseDriverPath != null && !databaseDriverPath.isEmpty()) {
    +  729  0 
                 Settings.setString(Settings.KEYS.DB_DRIVER_PATH, databaseDriverPath);
    +  730   + 
             }
    +  731  0 
             if (connectionString != null && !connectionString.isEmpty()) {
    +  732  0 
                 Settings.setString(Settings.KEYS.DB_CONNECTION_STRING, connectionString);
    +  733   + 
             }
    +  734  0 
             if (databaseUser != null && !databaseUser.isEmpty()) {
    +  735  0 
                 Settings.setString(Settings.KEYS.DB_USER, databaseUser);
    +  736   + 
             }
    +  737  0 
             if (databasePassword != null && !databasePassword.isEmpty()) {
    +  738  0 
                 Settings.setString(Settings.KEYS.DB_PASSWORD, databasePassword);
    +  739   + 
             }
    +  740  0 
         }
    +  741   + 
     
    +  742   
         /**
    +  743   + 
          * Executes the dependency-check and generates the report.
    +  744   + 
          *
    +  745   + 
          * @throws MojoExecutionException if a maven exception occurs
    +  746   + 
          * @throws MojoFailureException thrown if a CVSS score is found that is higher then the configured level
    +  747   + 
          */
    +  748   + 
         public void execute() throws MojoExecutionException, MojoFailureException {
    +  749  0 
             final Engine engine = executeDependencyCheck();
    +  750  0 
             generateExternalReports(engine);
    +  751  0 
             if (this.failBuildOnCVSS <= 10) {
    +  752  0 
                 checkForFailure(engine.getDependencies());
    +  753   + 
             }
    +  754  0 
             if (this.showSummary) {
    +  755  0 
                 showSummary(engine.getDependencies());
    +  756   + 
             }
    +  757  0 
         }
    +  758   + 
     
    +  759   + 
         /**
    +  760   + 
          * Generates the Dependency-Check Site Report.
    +  761   + 
          *
    +  762   + 
          * @param sink the sink to write the report to
    +  763   + 
          * @param locale the locale to use when generating the report
    +  764   + 
          * @throws MavenReportException if a Maven report exception occurs
    +  765   + 
          */
    +  766   + 
         public void generate(@SuppressWarnings("deprecation") org.codehaus.doxia.sink.Sink sink,
    +  767   + 
                 Locale locale) throws MavenReportException {
    +  768  0 
             generate((Sink) sink, null, locale);
    +  769  0 
         }
    +  770   + 
     
    +  771   + 
         /**
    +  772   + 
          * Generates the Dependency-Check Site Report.
    +  773   + 
          *
    +  774   + 
          * @param sink the sink to write the report to
    +  775   + 
          * @param sinkFactory the sink factory
    +  776   + 
          * @param locale the locale to use when generating the report
    +  777   + 
          * @throws MavenReportException if a maven report exception occurs
    +  778   + 
          */
    +  779   + 
         public void generate(Sink sink, SinkFactory sinkFactory, Locale locale) throws MavenReportException {
    +  780  0 
             final Engine engine = executeDependencyCheck();
    +  781  0 
             generateMavenSiteReport(engine, sink);
    +  782  0 
         }
    +  783   + 
     
    +  784   + 
         // <editor-fold defaultstate="collapsed" desc="required setter/getter methods">
    +  785   + 
         /**
    +  786   + 
          * Returns the output name.
    +  787   + 
          *
    +  788   + 
          * @return the output name
    +  789   + 
          */
    +  790   + 
         public String getOutputName() {
    +  791  0 
             return reportName;
    +  792   + 
         }
    +  793   + 
     
    +  794   + 
         /**
    +  795   + 
          * Returns the category name.
    +  796   + 
          *
    +  797   + 
          * @return the category name
    +  798   + 
          */
    +  799   + 
         public String getCategoryName() {
    +  800  0 
             return MavenReport.CATEGORY_PROJECT_REPORTS;
    +  801   + 
         }
    +  802   + 
     
    +  803   + 
         /**
    +  804   + 
          * Returns the report name.
    +  805   + 
          *
    +  806   + 
          * @param locale the location
    +  807   + 
          * @return the report name
    +  808   + 
          */
    +  809   + 
         public String getName(Locale locale) {
    +  810  0 
             return name;
    +  811   + 
         }
    +  812   + 
     
    +  813   + 
         /**
    +  814   + 
          * Sets the Reporting output directory.
    +  815   + 
          *
    +  816   + 
          * @param directory the output directory
    +  817   + 
          */
    +  818   + 
         public void setReportOutputDirectory(File directory) {
    +  819  0 
             reportOutputDirectory = directory;
    +  820  0 
         }
    +  821   + 
     
     822   - 
          * Generates a warning message listing a summary of dependencies and their
    + 
         /**
     823   - 
          * associated CPE and CVE entries.
    + 
          * Returns the output directory.
     824   
          *
     825   - 
          * @param dependencies a list of dependency objects
    + 
          * @return the output directory
     826   
          */
     827   - 
         private void showSummary(List<Dependency> dependencies) {
    -  828  0 
             final StringBuilder summary = new StringBuilder();
    -  829  0 
             for (Dependency d : dependencies) {
    -  830  0 
                 boolean firstEntry = true;
    -  831  0 
                 final StringBuilder ids = new StringBuilder();
    -  832  0 
                 for (Vulnerability v : d.getVulnerabilities()) {
    -  833  0 
                     if (firstEntry) {
    -  834  0 
                         firstEntry = false;
    + 
         public File getReportOutputDirectory() {
    +  828  0 
             return reportOutputDirectory;
    +  829   + 
         }
    +  830   + 
     
    +  831   + 
         /**
    +  832   + 
          * Gets the description of the Dependency-Check report to be displayed in the Maven Generated Reports page.
    +  833   + 
          *
    +  834   + 
          * @param locale The Locale to get the description for
     835   - 
                     } else {
    -  836  0 
                         ids.append(", ");
    + 
          * @return the description
    +  836   + 
          */
     837   - 
                     }
    -  838  0 
                     ids.append(v.getName());
    -  839  0 
                 }
    -  840  0 
                 if (ids.length() > 0) {
    -  841  0 
                     summary.append(d.getFileName()).append(" (");
    -  842  0 
                     firstEntry = true;
    -  843  0 
                     for (Identifier id : d.getIdentifiers()) {
    -  844  0 
                         if (firstEntry) {
    -  845  0 
                             firstEntry = false;
    + 
         public String getDescription(Locale locale) {
    +  838  0 
             return description;
    +  839   + 
         }
    +  840   + 
     
    +  841   + 
         /**
    +  842   + 
          * Returns whether this is an external report.
    +  843   + 
          *
    +  844   + 
          * @return true or false;
    +  845   + 
          */
     846   - 
                         } else {
    -  847  0 
                             summary.append(", ");
    + 
         public boolean isExternalReport() {
    +  847  0 
             return externalReport;
     848   - 
                         }
    -  849  0 
                         summary.append(id.getValue());
    -  850  0 
                     }
    -  851  0 
                     summary.append(") : ").append(ids).append(NEW_LINE);
    + 
         }
    +  849   + 
     
    +  850   + 
         /**
    +  851   + 
          * Returns whether or not the plugin can generate a report.
     852   - 
                 }
    -  853  0 
             }
    -  854  0 
             if (summary.length() > 0) {
    -  855  0 
                 final String msg = String.format("%n%n"
    -  856   - 
                         + "One or more dependencies were identified with known vulnerabilities:%n%n%s"
    + 
          *
    +  853   + 
          * @return true
    +  854   + 
          */
    +  855   + 
         public boolean canGenerateReport() {
    +  856  0 
             return true;
     857   - 
                         + "%n%nSee the dependency-check report for more details.%n%n", summary.toString());
    -  858  0 
                 Logger.getLogger(DependencyCheckMojo.class.getName()).log(Level.WARNING, msg);
    + 
         }
    +  858   + 
         // </editor-fold>
     859   - 
             }
    -  860  0 
         }
    + 
     
    +  860   + 
         /**
     861   + 
          * Checks to see if a vulnerability has been identified with a CVSS score that is above the threshold set in the
    +  862   + 
          * configuration.
    +  863   + 
          *
    +  864   + 
          * @param dependencies the list of dependency objects
    +  865   + 
          * @throws MojoFailureException thrown if a CVSS score is found that is higher then the threshold set
    +  866   + 
          */
    +  867   + 
         private void checkForFailure(List<Dependency> dependencies) throws MojoFailureException {
    +  868  0 
             final StringBuilder ids = new StringBuilder();
    +  869  0 
             for (Dependency d : dependencies) {
    +  870  0 
                 for (Vulnerability v : d.getVulnerabilities()) {
    +  871  0 
                     if (v.getCvssScore() >= failBuildOnCVSS) {
    +  872  0 
                         if (ids.length() == 0) {
    +  873  0 
                             ids.append(v.getName());
    +  874   + 
                         } else {
    +  875  0 
                             ids.append(", ").append(v.getName());
    +  876   + 
                         }
    +  877   + 
                     }
    +  878  0 
                 }
    +  879  0 
             }
    +  880  0 
             if (ids.length() > 0) {
    +  881  0 
                 final String msg = String.format("%n%nDependency-Check Failure:%n"
    +  882   + 
                         + "One or more dependencies were identified with vulnerabilities that have a CVSS score greater then '%.1f': %s%n"
    +  883   + 
                         + "See the dependency-check report for more details.%n%n", failBuildOnCVSS, ids.toString());
    +  884  0 
                 throw new MojoFailureException(msg);
    +  885   + 
             }
    +  886  0 
         }
    +  887   + 
     
    +  888   + 
         /**
    +  889   + 
          * Generates a warning message listing a summary of dependencies and their associated CPE and CVE entries.
    +  890   + 
          *
    +  891   + 
          * @param dependencies a list of dependency objects
    +  892   + 
          */
    +  893   + 
         private void showSummary(List<Dependency> dependencies) {
    +  894  0 
             final StringBuilder summary = new StringBuilder();
    +  895  0 
             for (Dependency d : dependencies) {
    +  896  0 
                 boolean firstEntry = true;
    +  897  0 
                 final StringBuilder ids = new StringBuilder();
    +  898  0 
                 for (Vulnerability v : d.getVulnerabilities()) {
    +  899  0 
                     if (firstEntry) {
    +  900  0 
                         firstEntry = false;
    +  901   + 
                     } else {
    +  902  0 
                         ids.append(", ");
    +  903   + 
                     }
    +  904  0 
                     ids.append(v.getName());
    +  905  0 
                 }
    +  906  0 
                 if (ids.length() > 0) {
    +  907  0 
                     summary.append(d.getFileName()).append(" (");
    +  908  0 
                     firstEntry = true;
    +  909  0 
                     for (Identifier id : d.getIdentifiers()) {
    +  910  0 
                         if (firstEntry) {
    +  911  0 
                             firstEntry = false;
    +  912   + 
                         } else {
    +  913  0 
                             summary.append(", ");
    +  914   + 
                         }
    +  915  0 
                         summary.append(id.getValue());
    +  916  0 
                     }
    +  917  0 
                     summary.append(") : ").append(ids).append(NEW_LINE);
    +  918   + 
                 }
    +  919  0 
             }
    +  920  0 
             if (summary.length() > 0) {
    +  921  0 
                 final String msg = String.format("%n%n"
    +  922   + 
                         + "One or more dependencies were identified with known vulnerabilities:%n%n%s"
    +  923   + 
                         + "%n%nSee the dependency-check report for more details.%n%n", summary.toString());
    +  924  0 
                 Logger.getLogger(DependencyCheckMojo.class.getName()).log(Level.WARNING, msg);
    +  925   + 
             }
    +  926  0 
         }
    +  927   
     }
    -
    Report generated by Cobertura 1.9.4.1 on 1/16/14 7:32 AM.
    +
    Report generated by Cobertura 1.9.4.1 on 1/26/14 11:15 AM.
    diff --git a/dependency-check-maven/cobertura/org.owasp.dependencycheck.maven.HelpMojo.html b/dependency-check-maven/cobertura/org.owasp.dependencycheck.maven.HelpMojo.html index 947876daf..0c6bf3972 100644 --- a/dependency-check-maven/cobertura/org.owasp.dependencycheck.maven.HelpMojo.html +++ b/dependency-check-maven/cobertura/org.owasp.dependencycheck.maven.HelpMojo.html @@ -744,6 +744,6 @@ 
     }
    -
    Report generated by Cobertura 1.9.4.1 on 1/16/14 7:32 AM.
    +
    Report generated by Cobertura 1.9.4.1 on 1/26/14 11:15 AM.
    diff --git a/dependency-check-maven/configuration.html b/dependency-check-maven/configuration.html index 930de22e9..ad15d26b2 100644 --- a/dependency-check-maven/configuration.html +++ b/dependency-check-maven/configuration.html @@ -1,13 +1,13 @@ - + dependency-check-maven - Configuration @@ -54,7 +54,7 @@
  • - +
  • /
    • @@ -67,8 +67,8 @@ -
  • Last Published: 2014-01-16
  • |
    • -
  • Version: 1.0.8
    • +
  • Last Published: 2014-01-26
  • |
    • +
  • Version: 1.1.0
    • @@ -238,6 +238,55 @@ Defines the proxy password. + + + +nexusAnalyzerEnabled + +The connection timeout used when downloading data files from the Internet. + + + + +nexusUrl + +The connection timeout used when downloading data files from the Internet. + + + + +databaseDriverName + +The name of the database driver. Example: org.h2.Driver. + + + + +databaseDriverPath + +The path to the database driver JAR file; only used if the driver is not in the class path. + + + + +connectionString + +The connection string used to connect to the database. + + + + +databaseUser + +The username used when connecting to the database. + + + + +databasePassword + +The password used when connecting to the database. + diff --git a/dependency-check-maven/cpd.html b/dependency-check-maven/cpd.html index ef77e6eca..78b7d347d 100644 --- a/dependency-check-maven/cpd.html +++ b/dependency-check-maven/cpd.html @@ -1,13 +1,13 @@ - + dependency-check-maven - CPD Results @@ -54,7 +54,7 @@
  • - +
  • /
    • @@ -67,8 +67,8 @@ -
  • Last Published: 2014-01-16
  • |
    • -
  • Version: 1.0.8
    • +
  • Last Published: 2014-01-26
  • |
    • +
  • Version: 1.1.0
    • diff --git a/dependency-check-maven/dependency-updates-report.html b/dependency-check-maven/dependency-updates-report.html index deba7e615..1759b8171 100644 --- a/dependency-check-maven/dependency-updates-report.html +++ b/dependency-check-maven/dependency-updates-report.html @@ -1,13 +1,13 @@ - + dependency-check-maven - Dependency Updates Report @@ -54,7 +54,7 @@
  • - +
  • /
    • @@ -67,8 +67,8 @@ -
  • Last Published: 2014-01-16
  • |
    • -
  • Version: 1.0.8
    • +
  • Last Published: 2014-01-26
  • |
    • +
  • Version: 1.1.0
    • @@ -360,7 +360,7 @@ org.owasp dependency-check-core -1.0.8 +1.1.0 compile jar @@ -580,7 +580,7 @@ dependency-check-core Current Version -1.0.8 +1.1.0 Scope compile diff --git a/dependency-check-maven/findbugs.html b/dependency-check-maven/findbugs.html index b5034bf7c..78e3b8c5f 100644 --- a/dependency-check-maven/findbugs.html +++ b/dependency-check-maven/findbugs.html @@ -1,13 +1,13 @@ - + dependency-check-maven - FindBugs Bug Detector Report @@ -54,7 +54,7 @@
  • - +
  • /
    • @@ -67,8 +67,8 @@ -
  • Last Published: 2014-01-16
  • |
    • -
  • Version: 1.0.8
    • +
  • Last Published: 2014-01-26
  • |
    • +
  • Version: 1.1.0
    • diff --git a/dependency-check-maven/help-mojo.html b/dependency-check-maven/help-mojo.html index f2d4fc7e0..987669536 100644 --- a/dependency-check-maven/help-mojo.html +++ b/dependency-check-maven/help-mojo.html @@ -1,13 +1,13 @@ - + dependency-check-maven - dependency-check:help @@ -55,7 +55,7 @@
  • - +
  • /
    • @@ -69,8 +69,8 @@ -
  • Last Published: 2014-01-16
  • |
    • -
  • Version: 1.0.8
    • +
  • Last Published: 2014-01-26
  • |
    • +
  • Version: 1.1.0
    • @@ -148,7 +148,7 @@

    Full name:

    -

    org.owasp:dependency-check-maven:1.0.8:help

    +

    org.owasp:dependency-check-maven:1.1.0:help

    Description:

    diff --git a/dependency-check-maven/index.html b/dependency-check-maven/index.html index 3e8417c74..6392a7876 100644 --- a/dependency-check-maven/index.html +++ b/dependency-check-maven/index.html @@ -1,13 +1,13 @@ - + dependency-check-jenkins - @@ -54,7 +54,7 @@
  • - +
  • /
    • @@ -67,8 +67,8 @@ -
  • Last Published: 2014-01-16
  • |
    • -
  • Version: 1.0.8
    • +
  • Last Published: 2014-01-26
  • |
    • +
  • Version: 1.1.0
    • @@ -148,9 +148,8 @@

    Subscribe: dependency-check+subscribe@googlegroups.com

    Post: dependency-check@googlegroups.com

    -

    Copyright & License

    -

    Dependency-Check Jenkins Plugin is Copyright (c) 2013 Steve Springett. All Rights Reserved.

    -

    Permission to modify and redistribute is granted under the terms of the GPLv3 license. See the LICENSE.txt file for the full license.

    +

    Copyright

    +

    Dependency-Check Jenkins Plugin is Copyright (c) 2013-2014 Steve Springett. All Rights Reserved.

    diff --git a/dependency-check-maven/license.html b/dependency-check-maven/license.html index 2c6ffd319..0f6b04141 100644 --- a/dependency-check-maven/license.html +++ b/dependency-check-maven/license.html @@ -1,13 +1,13 @@ - + dependency-check-jenkins - Project License @@ -54,7 +54,7 @@
  • - +
  • /
    • @@ -67,8 +67,8 @@ -
  • Last Published: 2014-01-16
  • |
    • -
  • Version: 1.0.8
    • +
  • Last Published: 2014-01-26
  • |
    • +
  • Version: 1.1.0
    • @@ -143,633 +143,211 @@

    Project License

    -

    GNU General Public License version 3

    [Original text] -

    Copy of the license follows.

    - - - - -
    -

    -English [en]   -العربية [ar]   -català [ca]   -Deutsch [de]   -ελληνικά [el]   -español [es]   -français [fr]   -italiano [it]   -日本語 [ja]   -Nederlands [nl]   -polski [pl]   -português do Brasil [pt-br]   -русский [ru]   -Shqip [sq]   -српски [sr]   -简体中文 [zh-cn]   -繁體中文 [zh-tw]   -

    -
    - - - - -
    - - - - - - - - - - - - - -
    - - -

    Licenses

    - -

    -Published software should be free -software. To make it free software, you need to release it -under a free software license. We normally use the GNU General Public License (GNU GPL), -but occasionally we use other -free software licenses. We use only licenses that are compatible -with the GNU GPL for GNU software. -

    - -

    -Documentation for free software should be -free documentation, so that -people can redistribute it and improve it along with the software -it describes. To make it free documentation, you need to release -it under a free documentation license. We normally use the -GNU Free Documentation License (GNU -FDL), but occasionally we use -other free -documentation licenses. -

    - -

    If you've started a new project and you're not sure what license to -use, “How to -choose a license for your own work” details our -recommendations in an easy-to-follow guide. If you just want a quick -list reference, we have a page that names -our recommended -copyleft licenses.

    - -

    We also have a page that discusses the BSD License Problem.

    - -

    -Our documentation licenses are currently being revised, and we welcome -your comments on the proposed texts. Please -visit our license update site to -read the current drafts and participate in the process. -

    - -

    Common Resources for our Software Licenses

    - -

    We have a number of resources to help people understand and use our -various licenses:

    - - - -

    The GNU General Public License

    - -

    -The GNU General Public License is often called the GNU GPL for short; -it is used by most GNU programs, and by more than half of all free -software packages. The latest version is version 3. -

    - - - -

    The GNU Lesser General Public License

    - -

    -The GNU Lesser General Public License is used by a few (not by any means -all) GNU libraries. The latest version is version 3. -

    - - - -

    The GNU Affero General Public License

    - -

    -The GNU Affero General Public License is based on the GNU GPL, but has an -additional term to allow users who interact with the licensed software over -a network to receive the source for that program. We recommend that people -consider using the GNU AGPL for any software which will commonly be run -over a network. The latest version is version 3. -

    - -
      -
    • The GNU Affero General Public License text is available in - these formats: - HTML, - plain text, - Docbook, - Texinfo, and - LaTeX. -These documents are not formatted for standalone publishing, and -are intended to be included in another document.
      • -
    • Why the Affero GPL
      • -
    - -

    The GNU Free Documentation License

    - -

    -The GNU Free Documentation License is a form of copyleft intended -for use on a manual, textbook or other document to assure everyone -the effective freedom to copy and redistribute it, with or without -modifications, either commercially or non-commercially. The latest version -is 1.3. -

    - - - -

    Exceptions to GNU Licenses

    - -

    Some GNU programs have additional permissions or special exceptions - to specific terms in one of the main licenses. Since some of those - are commonly used or inspire a lot of questions on their own, we've - started collecting them on - our exceptions page.

    - -

    License URLs

    - -

    When linking to our licenses, it's usually best to link to the latest -version; hence the standard URLs such as -http://www.gnu.org/licenses/gpl.html have no version number. -Occasionally, however, you may want to link to a specific version of a -given license. In those situations, you can use the following links -[skip links]:

    - -
    -
    GNU General Public License (GPL)
    - -
    GPLv3, -GPLv2, -GPLv1
    - -
    GNU Lesser General Public License (LGPL)
    -
    LGPLv3, -LGPLv2.1
    - -
    GNU Affero General Public License (AGPL)
    -
    GNU - AGPLv3 (The Affero General - Public License version 1 is not a GNU license, but it was - designed to serve a purpose much like the GNU AGPL's.)
    - -
    GNU Free Documentation License (FDL)
    -
    FDLv1.3, -FDLv1.2, -FDLv1.1
    -
    - -

    Stable links to each license's alternative - formats are available on its respective page. Not every version of - every license is available in every format. If you need one that is - missing, please email us.

    - -

    See also the old licenses page.

    - - -

    Unofficial Translations

    - -

    -Legally speaking, the original (English) version of the licenses is what -specifies the actual distribution terms for GNU programs and others that -use them. But to help people better understand the licenses, we give -permission to publish translations into other languages provided that -they follow our regulations for unofficial translations: -

    - - - -

    Verbatim Copying and Distribution

    - -

    The standard copyright terms for GNU web pages is now the Creative -Commons Attribution-NoDerivs 3.0 United States License. It used to -be (and for a few pages still is): Verbatim -copying and distribution of this entire article are permitted worldwide, -without royalty, in any medium, provided this notice is -preserved. Please note the following commentary about this -“verbatim license” by Eben Moglen:

    - -

    -“Our intention in using the phrase ‘verbatim copying in -any medium’ is not to require retention of page headings and -footers or other formatting features. Retention of weblinks in both -hyperlinked and non-hyperlinked media (as notes or some other form of -printed URL in non-HTML media) is required”. -

    - -

    List of Free Software Licenses

    - -
      -
    • - List of Free Software Licenses - -

      If you are contemplating writing a new license, please contact the -FSF by writing to <licensing@fsf.org>. The -proliferation of different free software licenses means increased work -for users in understanding the licenses; we may be able to help you -find an existing Free Software license that meets your needs. -

      - -

      -If that isn't possible, if you really need a new license, with our -help you can ensure that the license really is a Free Software license -and avoid various practical problems. -

      - -
      • -
    - - -

    What Is Copyleft?

    - -

    -Copyleft is a general -method for making a program free -software and requiring all modified and extended versions of the -program to be free software as well. -

    - -

    -The simplest way to make a program free is to put it in the -public -domain, uncopyrighted. This allows people to share the program -and their improvements, if they are so minded. But it also allows -uncooperative people to convert the program into -proprietary -software. They can make changes, many or few, and distribute the -result as a proprietary product. People who receive the program in -that modified form do not have the freedom that the original author -gave them; the middleman has stripped it away. -

    - -

    -In the GNU project, our aim is -to give all users the freedom to redistribute and change GNU -software. If middlemen could strip off the freedom, we might have -many users, but those users would not have freedom. So instead of -putting GNU software in the public domain, we “copyleft” -it. Copyleft says that anyone who redistributes the software, with or -without changes, must pass along the freedom to further copy and -change it. Copyleft guarantees that every user has freedom. -

    - -

    -Copyleft also provides an -incentive -for other programmers to add to free software. -Important free programs such as the GNU C++ compiler exist -only because of this. -

    - -

    -Copyleft also helps programmers who want to contribute -improvements to -free software get permission to -do that. These programmers often work for companies or universities -that would do almost anything to get more money. A programmer may -want to contribute her changes to the community, but her employer may -want to turn the changes into a proprietary software product. -

    - -

    -When we explain to the employer that it is illegal to distribute the -improved version except as free software, the employer usually decides -to release it as free software rather than throw it away. -

    - -

    -To copyleft a program, we first state that it is copyrighted; then -we add distribution terms, which are a legal instrument that gives -everyone the rights to use, modify, and redistribute the program's -code or any program derived from it but only if the -distribution terms are unchanged. Thus, the code and the freedoms -become legally inseparable. -

    - -

    -Proprietary software developers use copyright to take away the users' -freedom; we use copyright to guarantee their freedom. That's why we -reverse the name, changing “copyright” into -“copyleft”. -

    - -

    -Copyleft is a general concept; there are many ways to fill in the -details. In the GNU Project, the specific distribution terms that we -use are contained in the GNU General Public License, the GNU Lesser -General Public License and the GNU Free Documentation License. -

    - -

    -The appropriate license is included in many manuals and in each GNU -source code distribution. -

    - -

    -The GNU GPL is designed so that you can easily apply it to your own -program if you are the copyright holder. You don't have to modify the -GNU GPL to do this, just add notices to your program which refer -properly to the GNU GPL. Please note that you must use the -entire text of the GPL, if you use it. It is an integral whole, and -partial copies are not permitted. (Likewise for the LGPL, AGPL, and FDL.) -

    - -

    -Using the same distribution terms for many different programs makes it -easy to copy code between various different programs. Since they all -have the same distribution terms, there is no need to think about -whether the terms are compatible. The Lesser GPL includes a -provision that lets you alter the distribution terms to the ordinary -GPL, so that you can copy code into another program covered by the GPL. -

    - -

    Licenses for Other Types of Works

    - -

    -We believe that published software and documentation should be -free software and free documentation. -We recommend making all sorts of educational and reference works free -also, using free documentation licenses such as the -GNU Free Documentation License (GNU FDL). -

    - -

    For essays of opinion and scientific papers, we recommend -either the Creative -Commons Attribution-NoDerivs 3.0 United States License, or the -simple “verbatim copying only” license stated above.

    - -

    -We don't take the position that artistic or entertainment works must -be free, but if you want to make one free, we recommend -the Free Art -License.

    - -
    - - -
    - - - -
    - -

    The Free Software -Foundation is the principal organizational sponsor of the GNU Operating System. Our -mission is to preserve, protect and promote the freedom to use, study, -copy, modify, and redistribute computer software, and to defend the -rights of Free Software users. Support GNU and the FSF by buying manuals and gear, joining the FSF as an associate -member or by making a -donation, either directly to the FSF -or via Flattr.

    - -

    back to top

    - - - - -
    - - -
    - - - - -
    -
    +

    The Apache Software License, Version 2.0

    +
    +
    +                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+
    diff --git a/dependency-check-maven/plugin-info.html b/dependency-check-maven/plugin-info.html index 6ff2e639e..30b45c651 100644 --- a/dependency-check-maven/plugin-info.html +++ b/dependency-check-maven/plugin-info.html @@ -1,13 +1,13 @@ - + dependency-check-maven - Plugin Documentation @@ -54,7 +54,7 @@
  • - +
  • /
    • @@ -67,8 +67,8 @@ -
  • Last Published: 2014-01-16
  • |
    • -
  • Version: 1.0.8
    • +
  • Last Published: 2014-01-26
  • |
    • +
  • Version: 1.1.0
    • @@ -278,7 +278,7 @@ Call mvn dependency-check:help -Ddetail=true <plugin> <groupId>org.owasp</groupId> <artifactId>dependency-check-maven</artifactId> - <version>1.0.8</version> + <version>1.1.0</version> </plugin> ... </plugins> @@ -288,7 +288,7 @@ Call mvn dependency-check:help -Ddetail=true <plugin> <groupId>org.owasp</groupId> <artifactId>dependency-check-maven</artifactId> - <version>1.0.8</version> + <version>1.1.0</version> </plugin> ... </plugins> @@ -300,7 +300,7 @@ Call mvn dependency-check:help -Ddetail=true <plugin> <groupId>org.owasp</groupId> <artifactId>dependency-check-maven</artifactId> - <version>1.0.8</version> + <version>1.1.0</version> </plugin> ... </plugins> diff --git a/dependency-check-maven/plugin-updates-report.html b/dependency-check-maven/plugin-updates-report.html index dab89acad..b0e0372a4 100644 --- a/dependency-check-maven/plugin-updates-report.html +++ b/dependency-check-maven/plugin-updates-report.html @@ -1,13 +1,13 @@ - + dependency-check-maven - Plugin Updates Report @@ -54,7 +54,7 @@
  • - +
  • /
    • @@ -67,8 +67,8 @@ -
  • Last Published: 2014-01-16
  • |
    • -
  • Version: 1.0.8
    • +
  • Last Published: 2014-01-26
  • |
    • +
  • Version: 1.1.0
    • diff --git a/dependency-check-maven/pmd.html b/dependency-check-maven/pmd.html index 0074a0c67..9f4cfc82b 100644 --- a/dependency-check-maven/pmd.html +++ b/dependency-check-maven/pmd.html @@ -1,13 +1,13 @@ - + dependency-check-maven - PMD Results @@ -54,7 +54,7 @@
  • - +
  • /
    • @@ -67,8 +67,8 @@ -
  • Last Published: 2014-01-16
  • |
    • -
  • Version: 1.0.8
    • +
  • Last Published: 2014-01-26
  • |
    • +
  • Version: 1.1.0
    • diff --git a/dependency-check-maven/project-info.html b/dependency-check-maven/project-info.html index 748c4c32a..37e50ef4c 100644 --- a/dependency-check-maven/project-info.html +++ b/dependency-check-maven/project-info.html @@ -1,13 +1,13 @@ - + dependency-check-jenkins - Project Information @@ -54,7 +54,7 @@
  • - +
  • /
    • @@ -67,8 +67,8 @@ -
  • Last Published: 2014-01-16
  • |
    • -
  • Version: 1.0.8
    • +
  • Last Published: 2014-01-26
  • |
    • +
  • Version: 1.1.0
    • diff --git a/dependency-check-maven/project-reports.html b/dependency-check-maven/project-reports.html index 618b9f4ef..c1f1299f0 100644 --- a/dependency-check-maven/project-reports.html +++ b/dependency-check-maven/project-reports.html @@ -1,13 +1,13 @@ - + dependency-check-maven - Generated Reports @@ -54,7 +54,7 @@
  • - +
  • /
    • @@ -67,8 +67,8 @@ -
  • Last Published: 2014-01-16
  • |
    • -
  • Version: 1.0.8
    • +
  • Last Published: 2014-01-26
  • |
    • +
  • Version: 1.1.0
    • diff --git a/dependency-check-maven/project-summary.html b/dependency-check-maven/project-summary.html index afc1f09c7..6c607323d 100644 --- a/dependency-check-maven/project-summary.html +++ b/dependency-check-maven/project-summary.html @@ -1,13 +1,13 @@ - + dependency-check-jenkins - Project Summary @@ -54,7 +54,7 @@
  • - +
  • /
    • @@ -67,8 +67,8 @@ -
  • Last Published: 2014-01-16
  • |
    • -
  • Version: 1.0.8
    • +
  • Last Published: 2014-01-26
  • |
    • +
  • Version: 1.1.0
    • @@ -181,7 +181,7 @@ dependency-check-jenkins Version -1.0.8 +1.1.0 Type pom diff --git a/dependency-check-maven/surefire-report.html b/dependency-check-maven/surefire-report.html index 994dacbde..a0fe40e45 100644 --- a/dependency-check-maven/surefire-report.html +++ b/dependency-check-maven/surefire-report.html @@ -1,13 +1,13 @@ - + dependency-check-maven - Surefire Report @@ -54,7 +54,7 @@
  • - +
  • /
    • @@ -67,8 +67,8 @@ -
  • Last Published: 2014-01-16
  • |
    • -
  • Version: 1.0.8
    • +
  • Last Published: 2014-01-26
  • |
    • +
  • Version: 1.1.0
    • @@ -266,7 +266,7 @@ function toggleDisplay(elementId) { 0 0 100% -0.104
    +0.093

    Note: failures are anticipated and checked for with assertions while errors are unanticipated.


    Package List

    @@ -287,7 +287,7 @@ function toggleDisplay(elementId) { 0 0 100% -0.104
    +0.093

    Note: package statistics are not computed recursively, they only sum up all of its testsuites numbers.

    org.owasp.dependencycheck.maven

    @@ -309,7 +309,7 @@ function toggleDisplay(elementId) { 0 0 100% -0.104

    +0.093

    Test Cases

    [Summary] [Package List] [Test Cases]

    @@ -319,7 +319,7 @@ function toggleDisplay(elementId) { testGenerate_Sink_SinkFactory_Locale -0

    +0.002
    diff --git a/dependency-check-maven/taglist.html b/dependency-check-maven/taglist.html index 1f12102bd..e9f14b1d2 100644 --- a/dependency-check-maven/taglist.html +++ b/dependency-check-maven/taglist.html @@ -1,13 +1,13 @@ - + dependency-check-maven - Tag List report @@ -54,7 +54,7 @@
  • - +
  • /
    • @@ -67,8 +67,8 @@ -
  • Last Published: 2014-01-16
  • |
    • -
  • Version: 1.0.8
    • +
  • Last Published: 2014-01-26
  • |
    • +
  • Version: 1.1.0
    • @@ -252,43 +252,43 @@ Line - figure out how to get the test harness to work. ATM no tests are running. -34 +28 review the generated test code and remove the default call to fail. fail("The test case is a prototype."); } -68 +61 review the generated test code and remove the default call to fail. fail("The test case is a prototype."); } -82 +75 review the generated test code and remove the default call to fail. fail("The test case is a prototype."); } -115 +108 review the generated test code and remove the default call to fail. fail("The test case is a prototype."); } -129 +122 review the generated test code and remove the default call to fail. fail("The test case is a prototype."); } -144 +137 review the generated test code and remove the default call to fail. fail("The test case is a prototype."); } -157 +150 review the generated test code and remove the default call to fail. fail("The test case is a prototype."); } -171 +164 review the generated test code and remove the default call to fail. fail("The test case is a prototype."); } -186 +179 review the generated test code and remove the default call to fail. fail("The test case is a prototype."); } -200 +193 review the generated test code and remove the default call to fail. fail("The test case is a prototype."); } -214 +207 org.owasp.dependencycheck.maven.MySink Line add HTML Encoding - or figure out how to get the doxia xhtmlsink to work. -394 +393 diff --git a/dependency-check-maven/usage.html b/dependency-check-maven/usage.html index 30910a179..3c2865d4f 100644 --- a/dependency-check-maven/usage.html +++ b/dependency-check-maven/usage.html @@ -1,13 +1,13 @@ - + dependency-check-maven - Usage @@ -54,7 +54,7 @@
  • - +
  • /
    • @@ -67,8 +67,8 @@ -
  • Last Published: 2014-01-16
  • |
    • -
  • Version: 1.0.8
    • +
  • Last Published: 2014-01-26
  • |
    • +
  • Version: 1.1.0
    • @@ -142,6 +142,10 @@

    It is important to understand that the first time this task is executed it may take 20 minutes or more as it downloads and processes the data from the National Vulnerability Database (NVD) hosted by NIST: https://nvd.nist.gov

    After the first batch download, as long as the plugin is executed at least once every seven days the update will only take a few seconds.

    +
    +
    +

    Create the DependencyCheck-report.html in the target directory

    + 
    <project>
     <build>
@@ -150,7 +154,7 @@
             <plugin>
               <groupId>org.owasp</groupId>
               <artifactId>dependency-check-maven</artifactId>
-              <version>1.0.8</version>
+              <version>1.1.0</version>
               <executions>
                   <execution>
                       <goals>
@@ -166,6 +170,9 @@
     ...
 </project>
    +
    +
    +

    Create the DependencyCheck-report.html and fail the build for CVSS greater then 8

    <project>
@@ -175,7 +182,7 @@
             <plugin>
               <groupId>org.owasp</groupId>
               <artifactId>dependency-check-maven</artifactId>
-              <version>1.0.8</version>
+              <version>1.1.0</version>
               <configuration>
                   <failBuildOnCVSS>8</failBuildOnCVSS>
               </configuration>
@@ -194,6 +201,9 @@
     ...
 </project>
    +
    +
    +

    Create the dependency-check report within the site

    <project>
@@ -208,7 +218,7 @@
                         <plugin>
                             <groupId>org.owasp</groupId>
                             <artifactId>dependency-check-maven</artifactId>
-                            <version>1.0.8</version>
+                            <version>1.1.0</version>
                             <configuration>
                                 <externalReport>false</externalReport>
                             </configuration>
@@ -222,7 +232,7 @@
     </build>
     ...
 </project>
-
    +
    diff --git a/dependency-check-maven/xref-test/index.html b/dependency-check-maven/xref-test/index.html index ed8d46a6e..e8a74de8a 100644 --- a/dependency-check-maven/xref-test/index.html +++ b/dependency-check-maven/xref-test/index.html @@ -4,7 +4,7 @@ - Dependency-Check Maven Plugin 1.0.8 Reference + Dependency-Check Maven Plugin 1.1.0 Reference diff --git a/dependency-check-maven/xref-test/org/owasp/dependencycheck/maven/DependencyCheckMojoTest.html b/dependency-check-maven/xref-test/org/owasp/dependencycheck/maven/DependencyCheckMojoTest.html index a573f37fa..ea91b32cb 100644 --- a/dependency-check-maven/xref-test/org/owasp/dependencycheck/maven/DependencyCheckMojoTest.html +++ b/dependency-check-maven/xref-test/org/owasp/dependencycheck/maven/DependencyCheckMojoTest.html @@ -9,220 +9,213 @@ 1 /* 2 * This file is part of dependency-check-maven. 3 * -4 * Dependency-check-maven is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-maven is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-maven. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2013 Jeremy Long. All Rights Reserved. -18 */ -19 package org.owasp.dependencycheck.maven; -20 -21 import org.apache.maven.plugin.testing.AbstractMojoTestCase; -22 import java.io.FileOutputStream; -23 import java.io.OutputStream; -24 import java.io.File; -25 import java.util.Locale; -26 import org.junit.After; -27 import org.junit.AfterClass; -28 import org.junit.Before; -29 import org.junit.BeforeClass; -30 import org.junit.Test; -31 import static org.junit.Assert.*; -32 -33 /** -34 * TODO - figure out how to get the test harness to work. ATM no tests are -35 * running. -36 * -37 * @author Jeremy Long <jeremy.long@owasp.org> -38 */ -39 public class DependencyCheckMojoTest extends AbstractMojoTestCase { +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2013 Jeremy Long. All Rights Reserved. +17 */ +18 package org.owasp.dependencycheck.maven; +19 +20 import org.apache.maven.plugin.testing.AbstractMojoTestCase; +21 import org.junit.After; +22 import org.junit.AfterClass; +23 import org.junit.Before; +24 import org.junit.BeforeClass; +25 import org.junit.Test; +26 +27 /** +28 * TODO - figure out how to get the test harness to work. ATM no tests are running. +29 * +30 * @author Jeremy Long <jeremy.long@owasp.org> +31 */ +32 public class DependencyCheckMojoTest extends AbstractMojoTestCase { +33 +34 public DependencyCheckMojoTest() { +35 } +36 +37 @BeforeClass +38 public static void setUpClass() throws Exception { +39 } 40 -41 public DependencyCheckMojoTest() { -42 } -43 -44 @BeforeClass -45 public static void setUpClass() throws Exception { -46 } -47 -48 @AfterClass -49 public static void tearDownClass() throws Exception { -50 } -51 -52 @Before -53 public void setUp() { -54 } -55 -56 @After -57 public void tearDown() { -58 } -59 // -60 // /** -61 // * Test of execute method, of class DependencyCheckMojo. -62 // */ -63 // @Test -64 // public void testExecute() throws Exception { -65 // System.out.println("execute"); -66 // DependencyCheckMojo instance = new DependencyCheckMojo(); -67 // instance.execute(); -68 // // TODO review the generated test code and remove the default call to fail. -69 // fail("The test case is a prototype."); -70 // } -71 // -72 // /** -73 // * Test of generate method, of class DependencyCheckMojo. -74 // */ -75 // @Test -76 // public void testGenerate_Sink_Locale() throws Exception { -77 // System.out.println("generate"); -78 // org.codehaus.doxia.sink.Sink sink = null; -79 // Locale locale = null; -80 // DependencyCheckMojo instance = new DependencyCheckMojo(); -81 // instance.generate(sink, locale); -82 // // TODO review the generated test code and remove the default call to fail. -83 // fail("The test case is a prototype."); -84 // } -85 -86 /** -87 * Test of generate method, of class DependencyCheckMojo. -88 */ -89 @Test -90 public void testGenerate_Sink_SinkFactory_Locale() throws Exception { -91 //can't get the test-harness to work. -92 // File samplePom = new File(this.getClass().getClassLoader().getResource("sample.xml").toURI()); -93 // DependencyCheckMojo mojo = (DependencyCheckMojo) lookupMojo("check", samplePom); -94 // assertNotNull("Unable to load mojo", mojo); -95 // -96 // File out = mojo.getReportOutputDirectory(); -97 // OutputStream os = new FileOutputStream(out); -98 // MySink sink = new MySink(os); -99 // Locale locale = new Locale("en"); -100 // -101 // -102 // mojo.generate(sink, null, locale); -103 // sink.close(); -104 } -105 // /** -106 // * Test of getOutputName method, of class DependencyCheckMojo. -107 // */ -108 // @Test -109 // public void testGetOutputName() { -110 // System.out.println("getOutputName"); -111 // DependencyCheckMojo instance = new DependencyCheckMojo(); -112 // String expResult = ""; -113 // String result = instance.getOutputName(); -114 // assertEquals(expResult, result); -115 // // TODO review the generated test code and remove the default call to fail. -116 // fail("The test case is a prototype."); -117 // } -118 // -119 // /** -120 // * Test of getCategoryName method, of class DependencyCheckMojo. -121 // */ -122 // @Test -123 // public void testGetCategoryName() { -124 // System.out.println("getCategoryName"); -125 // DependencyCheckMojo instance = new DependencyCheckMojo(); -126 // String expResult = ""; -127 // String result = instance.getCategoryName(); -128 // assertEquals(expResult, result); -129 // // TODO review the generated test code and remove the default call to fail. -130 // fail("The test case is a prototype."); -131 // } -132 // -133 // /** -134 // * Test of getName method, of class DependencyCheckMojo. -135 // */ -136 // @Test -137 // public void testGetName() { -138 // System.out.println("getName"); -139 // Locale locale = null; -140 // DependencyCheckMojo instance = new DependencyCheckMojo(); -141 // String expResult = ""; -142 // String result = instance.getName(locale); -143 // assertEquals(expResult, result); -144 // // TODO review the generated test code and remove the default call to fail. -145 // fail("The test case is a prototype."); -146 // } -147 // -148 // /** -149 // * Test of setReportOutputDirectory method, of class DependencyCheckMojo. -150 // */ -151 // @Test -152 // public void testSetReportOutputDirectory() { -153 // System.out.println("setReportOutputDirectory"); -154 // File directory = null; -155 // DependencyCheckMojo instance = new DependencyCheckMojo(); -156 // instance.setReportOutputDirectory(directory); -157 // // TODO review the generated test code and remove the default call to fail. -158 // fail("The test case is a prototype."); -159 // } -160 // -161 // /** -162 // * Test of getReportOutputDirectory method, of class DependencyCheckMojo. -163 // */ -164 // @Test -165 // public void testGetReportOutputDirectory() { -166 // System.out.println("getReportOutputDirectory"); -167 // DependencyCheckMojo instance = new DependencyCheckMojo(); -168 // File expResult = null; -169 // File result = instance.getReportOutputDirectory(); -170 // assertEquals(expResult, result); -171 // // TODO review the generated test code and remove the default call to fail. -172 // fail("The test case is a prototype."); -173 // } -174 // -175 // /** -176 // * Test of getDescription method, of class DependencyCheckMojo. -177 // */ -178 // @Test -179 // public void testGetDescription() { -180 // System.out.println("getDescription"); -181 // Locale locale = null; -182 // DependencyCheckMojo instance = new DependencyCheckMojo(); -183 // String expResult = ""; -184 // String result = instance.getDescription(locale); -185 // assertEquals(expResult, result); -186 // // TODO review the generated test code and remove the default call to fail. -187 // fail("The test case is a prototype."); -188 // } -189 // -190 // /** -191 // * Test of isExternalReport method, of class DependencyCheckMojo. -192 // */ -193 // @Test -194 // public void testIsExternalReport() { -195 // System.out.println("isExternalReport"); -196 // DependencyCheckMojo instance = new DependencyCheckMojo(); -197 // boolean expResult = false; -198 // boolean result = instance.isExternalReport(); -199 // assertEquals(expResult, result); -200 // // TODO review the generated test code and remove the default call to fail. -201 // fail("The test case is a prototype."); -202 // } -203 // -204 // /** -205 // * Test of canGenerateReport method, of class DependencyCheckMojo. -206 // */ -207 // @Test -208 // public void testCanGenerateReport() { -209 // System.out.println("canGenerateReport"); -210 // DependencyCheckMojo instance = new DependencyCheckMojo(); -211 // boolean expResult = false; -212 // boolean result = instance.canGenerateReport(); -213 // assertEquals(expResult, result); -214 // // TODO review the generated test code and remove the default call to fail. -215 // fail("The test case is a prototype."); -216 // } -217 } +41 @AfterClass +42 public static void tearDownClass() throws Exception { +43 } +44 +45 @Before +46 public void setUp() { +47 } +48 +49 @After +50 public void tearDown() { +51 } +52 // +53 // /** +54 // * Test of execute method, of class DependencyCheckMojo. +55 // */ +56 // @Test +57 // public void testExecute() throws Exception { +58 // System.out.println("execute"); +59 // DependencyCheckMojo instance = new DependencyCheckMojo(); +60 // instance.execute(); +61 // // TODO review the generated test code and remove the default call to fail. +62 // fail("The test case is a prototype."); +63 // } +64 // +65 // /** +66 // * Test of generate method, of class DependencyCheckMojo. +67 // */ +68 // @Test +69 // public void testGenerate_Sink_Locale() throws Exception { +70 // System.out.println("generate"); +71 // org.codehaus.doxia.sink.Sink sink = null; +72 // Locale locale = null; +73 // DependencyCheckMojo instance = new DependencyCheckMojo(); +74 // instance.generate(sink, locale); +75 // // TODO review the generated test code and remove the default call to fail. +76 // fail("The test case is a prototype."); +77 // } +78 +79 /** +80 * Test of generate method, of class DependencyCheckMojo. +81 */ +82 @Test +83 public void testGenerate_Sink_SinkFactory_Locale() throws Exception { +84 //can't get the test-harness to work. +85 // File samplePom = new File(this.getClass().getClassLoader().getResource("sample.xml").toURI()); +86 // DependencyCheckMojo mojo = (DependencyCheckMojo) lookupMojo("check", samplePom); +87 // assertNotNull("Unable to load mojo", mojo); +88 // +89 // File out = mojo.getReportOutputDirectory(); +90 // OutputStream os = new FileOutputStream(out); +91 // MySink sink = new MySink(os); +92 // Locale locale = new Locale("en"); +93 // +94 // +95 // mojo.generate(sink, null, locale); +96 // sink.close(); +97 } +98 // /** +99 // * Test of getOutputName method, of class DependencyCheckMojo. +100 // */ +101 // @Test +102 // public void testGetOutputName() { +103 // System.out.println("getOutputName"); +104 // DependencyCheckMojo instance = new DependencyCheckMojo(); +105 // String expResult = ""; +106 // String result = instance.getOutputName(); +107 // assertEquals(expResult, result); +108 // // TODO review the generated test code and remove the default call to fail. +109 // fail("The test case is a prototype."); +110 // } +111 // +112 // /** +113 // * Test of getCategoryName method, of class DependencyCheckMojo. +114 // */ +115 // @Test +116 // public void testGetCategoryName() { +117 // System.out.println("getCategoryName"); +118 // DependencyCheckMojo instance = new DependencyCheckMojo(); +119 // String expResult = ""; +120 // String result = instance.getCategoryName(); +121 // assertEquals(expResult, result); +122 // // TODO review the generated test code and remove the default call to fail. +123 // fail("The test case is a prototype."); +124 // } +125 // +126 // /** +127 // * Test of getName method, of class DependencyCheckMojo. +128 // */ +129 // @Test +130 // public void testGetName() { +131 // System.out.println("getName"); +132 // Locale locale = null; +133 // DependencyCheckMojo instance = new DependencyCheckMojo(); +134 // String expResult = ""; +135 // String result = instance.getName(locale); +136 // assertEquals(expResult, result); +137 // // TODO review the generated test code and remove the default call to fail. +138 // fail("The test case is a prototype."); +139 // } +140 // +141 // /** +142 // * Test of setReportOutputDirectory method, of class DependencyCheckMojo. +143 // */ +144 // @Test +145 // public void testSetReportOutputDirectory() { +146 // System.out.println("setReportOutputDirectory"); +147 // File directory = null; +148 // DependencyCheckMojo instance = new DependencyCheckMojo(); +149 // instance.setReportOutputDirectory(directory); +150 // // TODO review the generated test code and remove the default call to fail. +151 // fail("The test case is a prototype."); +152 // } +153 // +154 // /** +155 // * Test of getReportOutputDirectory method, of class DependencyCheckMojo. +156 // */ +157 // @Test +158 // public void testGetReportOutputDirectory() { +159 // System.out.println("getReportOutputDirectory"); +160 // DependencyCheckMojo instance = new DependencyCheckMojo(); +161 // File expResult = null; +162 // File result = instance.getReportOutputDirectory(); +163 // assertEquals(expResult, result); +164 // // TODO review the generated test code and remove the default call to fail. +165 // fail("The test case is a prototype."); +166 // } +167 // +168 // /** +169 // * Test of getDescription method, of class DependencyCheckMojo. +170 // */ +171 // @Test +172 // public void testGetDescription() { +173 // System.out.println("getDescription"); +174 // Locale locale = null; +175 // DependencyCheckMojo instance = new DependencyCheckMojo(); +176 // String expResult = ""; +177 // String result = instance.getDescription(locale); +178 // assertEquals(expResult, result); +179 // // TODO review the generated test code and remove the default call to fail. +180 // fail("The test case is a prototype."); +181 // } +182 // +183 // /** +184 // * Test of isExternalReport method, of class DependencyCheckMojo. +185 // */ +186 // @Test +187 // public void testIsExternalReport() { +188 // System.out.println("isExternalReport"); +189 // DependencyCheckMojo instance = new DependencyCheckMojo(); +190 // boolean expResult = false; +191 // boolean result = instance.isExternalReport(); +192 // assertEquals(expResult, result); +193 // // TODO review the generated test code and remove the default call to fail. +194 // fail("The test case is a prototype."); +195 // } +196 // +197 // /** +198 // * Test of canGenerateReport method, of class DependencyCheckMojo. +199 // */ +200 // @Test +201 // public void testCanGenerateReport() { +202 // System.out.println("canGenerateReport"); +203 // DependencyCheckMojo instance = new DependencyCheckMojo(); +204 // boolean expResult = false; +205 // boolean result = instance.canGenerateReport(); +206 // assertEquals(expResult, result); +207 // // TODO review the generated test code and remove the default call to fail. +208 // fail("The test case is a prototype."); +209 // } +210 }
    diff --git a/dependency-check-maven/xref-test/org/owasp/dependencycheck/maven/MySink.html b/dependency-check-maven/xref-test/org/owasp/dependencycheck/maven/MySink.html index d10db47b1..d66e583f5 100644 --- a/dependency-check-maven/xref-test/org/owasp/dependencycheck/maven/MySink.html +++ b/dependency-check-maven/xref-test/org/owasp/dependencycheck/maven/MySink.html @@ -9,605 +9,604 @@ 1 /* 2 * This file is part of dependency-check-maven. 3 * -4 * Dependency-check-maven is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-maven is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-maven. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2013 Jeremy Long. All Rights Reserved. -18 */ -19 package org.owasp.dependencycheck.maven; -20 -21 import java.io.IOException; -22 import java.io.OutputStream; -23 import java.io.OutputStreamWriter; -24 import java.util.logging.Level; -25 import java.util.logging.Logger; -26 import org.apache.maven.doxia.logging.Log; -27 import org.apache.maven.doxia.sink.Sink; -28 import org.apache.maven.doxia.sink.SinkEventAttributes; -29 -30 /** -31 * -32 * @author Jeremy Long <jeremy.long@owasp.org> -33 */ -34 public class MySink implements Sink { -35 -36 private OutputStreamWriter out = null; -37 -38 public MySink(OutputStream os) { -39 out = new OutputStreamWriter(os); -40 -41 } -42 -43 private void writeTag(String tag) { -44 try { -45 out.write(tag); -46 } catch (IOException ex) { -47 Logger.getLogger(MySink.class.getName()).log(Level.SEVERE, "Error writing a tag; unable to generate the report"); -48 Logger.getLogger(MySink.class.getName()).log(Level.FINE, null, ex); -49 } -50 } -51 -52 public void head() { -53 writeTag("<head>"); -54 } -55 -56 public void head_() { -57 writeTag("</head>"); -58 } -59 -60 public void title() { -61 writeTag("<title>"); -62 } -63 -64 public void title_() { -65 writeTag("</title>"); -66 } -67 -68 public void author() { -69 writeTag("<author>"); -70 } -71 -72 public void author_() { -73 writeTag("</author>"); -74 } -75 -76 public void date() { -77 writeTag("<time>"); -78 } -79 -80 public void date_() { -81 writeTag("</time>"); -82 } -83 -84 public void body() { -85 writeTag("<body>"); -86 } -87 -88 public void body_() { -89 writeTag("</body>"); -90 } -91 -92 public void sectionTitle() { -93 writeTag("<h1>"); -94 } -95 -96 public void sectionTitle_() { -97 writeTag("</h1>"); -98 } -99 -100 public void section1() { -101 writeTag("<div>"); -102 } -103 -104 public void section1_() { -105 writeTag("</div>"); -106 } -107 -108 public void sectionTitle1() { -109 writeTag("<h2>"); -110 } -111 -112 public void sectionTitle1_() { -113 writeTag("</h2>"); -114 } -115 -116 public void section2() { -117 writeTag("<div>"); -118 } -119 -120 public void section2_() { -121 writeTag("</div>"); -122 } -123 -124 public void sectionTitle2() { -125 writeTag("<h3>"); -126 } -127 -128 public void sectionTitle2_() { -129 writeTag("</h3>"); -130 } -131 -132 public void section3() { -133 writeTag("<div>"); -134 } -135 -136 public void section3_() { -137 writeTag("</div>"); -138 } -139 -140 public void sectionTitle3() { -141 writeTag("<h4>"); -142 } -143 -144 public void sectionTitle3_() { -145 writeTag("</h4>"); -146 } -147 -148 public void section4() { -149 writeTag("<div>"); -150 } -151 -152 public void section4_() { -153 writeTag("</div>"); -154 } -155 -156 public void sectionTitle4() { -157 writeTag("<h5>"); -158 } -159 -160 public void sectionTitle4_() { -161 writeTag("</h5>"); -162 } -163 -164 public void section5() { -165 writeTag("<div>"); -166 } -167 -168 public void section5_() { -169 writeTag("</div>"); -170 } -171 -172 public void sectionTitle5() { -173 writeTag("<h6>"); -174 } -175 -176 public void sectionTitle5_() { -177 writeTag("</h6>"); -178 } -179 -180 public void list() { -181 writeTag("<ul>"); -182 } -183 -184 public void list_() { -185 writeTag("</ul>"); -186 } -187 -188 public void listItem() { -189 writeTag("<li>"); -190 } -191 -192 public void listItem_() { -193 writeTag("</li>"); -194 } -195 -196 public void numberedList(int numbering) { -197 writeTag("<ol>"); -198 } -199 -200 public void numberedList_() { -201 writeTag("</ol>"); -202 } -203 -204 public void numberedListItem() { -205 writeTag("<li>"); -206 } -207 -208 public void numberedListItem_() { -209 writeTag("</li>"); -210 } -211 -212 public void definitionList() { -213 writeTag("<dl>"); -214 } -215 -216 public void definitionList_() { -217 writeTag("</dl>"); -218 } -219 -220 public void definitionListItem() { -221 writeTag("<dt>"); -222 } -223 -224 public void definitionListItem_() { -225 writeTag("</dt>"); -226 } -227 -228 public void definition() { -229 writeTag("<dd>"); -230 } -231 -232 public void definition_() { -233 writeTag("</dd>"); -234 } -235 -236 public void definedTerm() { -237 writeTag("<dt>"); -238 } -239 -240 public void definedTerm_() { -241 writeTag("</dt>"); -242 } -243 -244 public void figure() { -245 throw new UnsupportedOperationException("Not supported yet."); -246 } -247 -248 public void figure_() { -249 throw new UnsupportedOperationException("Not supported yet."); -250 } -251 -252 public void figureCaption() { -253 throw new UnsupportedOperationException("Not supported yet."); -254 } -255 -256 public void figureCaption_() { -257 throw new UnsupportedOperationException("Not supported yet."); -258 } -259 -260 public void figureGraphics(String name) { -261 throw new UnsupportedOperationException("Not supported yet."); -262 } -263 -264 public void table() { -265 writeTag("<table>"); -266 } -267 -268 public void table_() { -269 writeTag("</table>"); -270 } -271 -272 public void tableRows(int[] justification, boolean grid) { -273 writeTag("<tr>"); -274 } -275 -276 public void tableRows_() { -277 writeTag("</tr>"); -278 } -279 -280 public void tableRow() { -281 writeTag("<tr>"); -282 } -283 -284 public void tableRow_() { -285 writeTag("</tr>"); -286 } -287 -288 public void tableCell() { -289 writeTag("<td>"); -290 } -291 -292 public void tableCell(String width) { -293 writeTag("<td>"); -294 } -295 -296 public void tableCell_() { -297 writeTag("</td>"); -298 } -299 -300 public void tableHeaderCell() { -301 writeTag("<th>"); -302 } -303 -304 public void tableHeaderCell(String width) { -305 writeTag("<th>"); -306 } -307 -308 public void tableHeaderCell_() { -309 writeTag("</th>"); -310 } -311 -312 public void tableCaption() { -313 writeTag("<caption>"); -314 } -315 -316 public void tableCaption_() { -317 writeTag("</caption>"); -318 } -319 -320 public void paragraph() { -321 writeTag("<p>"); -322 } -323 -324 public void paragraph_() { -325 writeTag("</p>"); -326 } -327 -328 public void verbatim(boolean boxed) { -329 writeTag("<pre>"); -330 } -331 -332 public void verbatim_() { -333 writeTag("</pre>"); -334 } -335 -336 public void horizontalRule() { -337 writeTag("<hr/>"); -338 } -339 -340 public void pageBreak() { -341 writeTag("<br/>"); -342 } -343 -344 public void anchor(String name) { -345 writeTag("<a href=\"" + name + "\">"); -346 } -347 -348 public void anchor_() { -349 writeTag("</a>"); -350 } -351 -352 public void link(String name) { -353 writeTag("<link href=\"" + name + "\">"); -354 } -355 -356 public void link_() { -357 writeTag("</link>"); -358 } -359 -360 public void italic() { -361 writeTag("<i>"); -362 } -363 -364 public void italic_() { -365 writeTag("</i>"); -366 } -367 -368 public void bold() { -369 writeTag("<b>"); -370 } -371 -372 public void bold_() { -373 writeTag("</b>"); -374 } -375 -376 public void monospaced() { -377 writeTag("<pre>"); -378 } -379 -380 public void monospaced_() { -381 writeTag("</pre>"); -382 } -383 -384 public void lineBreak() { -385 writeTag("<br>"); -386 } -387 -388 public void nonBreakingSpace() { -389 writeTag("&nbsp;"); -390 } -391 -392 public void text(String text) { -393 try { -394 //TODO add HTML Encoding - or figure out how to get the doxia xhtmlsink to work. -395 out.write(text); -396 } catch (IOException ex) { -397 Logger.getLogger(MySink.class.getName()).log(Level.SEVERE, "Error writing a text; unable to generate the report"); -398 Logger.getLogger(MySink.class.getName()).log(Level.FINE, null, ex); -399 } -400 } -401 -402 public void rawText(String text) { -403 try { -404 out.write(text); -405 } catch (IOException ex) { -406 Logger.getLogger(MySink.class.getName()).log(Level.SEVERE, "Error writing raw text; unable to generate the report"); -407 Logger.getLogger(MySink.class.getName()).log(Level.FINE, null, ex); -408 } -409 } -410 -411 public void flush() { -412 try { -413 out.flush(); -414 } catch (IOException ex) { -415 Logger.getLogger(MySink.class.getName()).log(Level.FINEST, null, ex); -416 } -417 } -418 -419 public void close() { -420 flush(); -421 try { -422 out.close(); -423 } catch (IOException ex) { -424 Logger.getLogger(MySink.class.getName()).log(Level.FINEST, null, ex); -425 } -426 } -427 -428 @Override -429 public void head(SinkEventAttributes sea) { -430 throw new UnsupportedOperationException("Not supported yet."); //To change body of generated methods, choose Tools | Templates. -431 } -432 -433 @Override -434 public void title(SinkEventAttributes sea) { -435 throw new UnsupportedOperationException("Not supported yet."); //To change body of generated methods, choose Tools | Templates. -436 } -437 -438 @Override -439 public void author(SinkEventAttributes sea) { -440 throw new UnsupportedOperationException("Not supported yet."); //To change body of generated methods, choose Tools | Templates. -441 } -442 -443 @Override -444 public void date(SinkEventAttributes sea) { -445 throw new UnsupportedOperationException("Not supported yet."); //To change body of generated methods, choose Tools | Templates. -446 } -447 -448 @Override -449 public void body(SinkEventAttributes sea) { -450 throw new UnsupportedOperationException("Not supported yet."); //To change body of generated methods, choose Tools | Templates. -451 } -452 -453 @Override -454 public void section(int i, SinkEventAttributes sea) { -455 throw new UnsupportedOperationException("Not supported yet."); //To change body of generated methods, choose Tools | Templates. -456 } -457 -458 @Override -459 public void section_(int i) { -460 throw new UnsupportedOperationException("Not supported yet."); //To change body of generated methods, choose Tools | Templates. -461 } -462 -463 @Override -464 public void sectionTitle(int i, SinkEventAttributes sea) { -465 throw new UnsupportedOperationException("Not supported yet."); //To change body of generated methods, choose Tools | Templates. -466 } -467 -468 @Override -469 public void sectionTitle_(int i) { -470 throw new UnsupportedOperationException("Not supported yet."); //To change body of generated methods, choose Tools | Templates. -471 } -472 -473 @Override -474 public void list(SinkEventAttributes sea) { -475 throw new UnsupportedOperationException("Not supported yet."); //To change body of generated methods, choose Tools | Templates. -476 } -477 -478 @Override -479 public void listItem(SinkEventAttributes sea) { -480 throw new UnsupportedOperationException("Not supported yet."); //To change body of generated methods, choose Tools | Templates. -481 } -482 -483 @Override -484 public void numberedList(int i, SinkEventAttributes sea) { -485 throw new UnsupportedOperationException("Not supported yet."); //To change body of generated methods, choose Tools | Templates. -486 } -487 -488 @Override -489 public void numberedListItem(SinkEventAttributes sea) { -490 throw new UnsupportedOperationException("Not supported yet."); //To change body of generated methods, choose Tools | Templates. -491 } -492 -493 @Override -494 public void definitionList(SinkEventAttributes sea) { -495 throw new UnsupportedOperationException("Not supported yet."); //To change body of generated methods, choose Tools | Templates. -496 } -497 -498 @Override -499 public void definitionListItem(SinkEventAttributes sea) { -500 throw new UnsupportedOperationException("Not supported yet."); //To change body of generated methods, choose Tools | Templates. -501 } -502 -503 @Override -504 public void definition(SinkEventAttributes sea) { -505 throw new UnsupportedOperationException("Not supported yet."); //To change body of generated methods, choose Tools | Templates. -506 } -507 -508 @Override -509 public void definedTerm(SinkEventAttributes sea) { -510 throw new UnsupportedOperationException("Not supported yet."); //To change body of generated methods, choose Tools | Templates. -511 } -512 -513 @Override -514 public void figure(SinkEventAttributes sea) { -515 throw new UnsupportedOperationException("Not supported yet."); //To change body of generated methods, choose Tools | Templates. -516 } -517 -518 @Override -519 public void figureCaption(SinkEventAttributes sea) { -520 throw new UnsupportedOperationException("Not supported yet."); //To change body of generated methods, choose Tools | Templates. -521 } -522 -523 @Override -524 public void figureGraphics(String string, SinkEventAttributes sea) { -525 throw new UnsupportedOperationException("Not supported yet."); //To change body of generated methods, choose Tools | Templates. -526 } -527 -528 @Override -529 public void table(SinkEventAttributes sea) { -530 throw new UnsupportedOperationException("Not supported yet."); //To change body of generated methods, choose Tools | Templates. -531 } -532 -533 @Override -534 public void tableRow(SinkEventAttributes sea) { -535 throw new UnsupportedOperationException("Not supported yet."); //To change body of generated methods, choose Tools | Templates. -536 } -537 -538 @Override -539 public void tableCell(SinkEventAttributes sea) { -540 throw new UnsupportedOperationException("Not supported yet."); //To change body of generated methods, choose Tools | Templates. -541 } -542 -543 @Override -544 public void tableHeaderCell(SinkEventAttributes sea) { -545 throw new UnsupportedOperationException("Not supported yet."); //To change body of generated methods, choose Tools | Templates. -546 } -547 -548 @Override -549 public void tableCaption(SinkEventAttributes sea) { -550 throw new UnsupportedOperationException("Not supported yet."); //To change body of generated methods, choose Tools | Templates. -551 } -552 -553 @Override -554 public void paragraph(SinkEventAttributes sea) { -555 throw new UnsupportedOperationException("Not supported yet."); //To change body of generated methods, choose Tools | Templates. -556 } -557 -558 @Override -559 public void verbatim(SinkEventAttributes sea) { -560 throw new UnsupportedOperationException("Not supported yet."); //To change body of generated methods, choose Tools | Templates. -561 } -562 -563 @Override -564 public void horizontalRule(SinkEventAttributes sea) { -565 throw new UnsupportedOperationException("Not supported yet."); //To change body of generated methods, choose Tools | Templates. -566 } -567 -568 @Override -569 public void anchor(String string, SinkEventAttributes sea) { -570 throw new UnsupportedOperationException("Not supported yet."); //To change body of generated methods, choose Tools | Templates. -571 } -572 -573 @Override -574 public void link(String string, SinkEventAttributes sea) { -575 throw new UnsupportedOperationException("Not supported yet."); //To change body of generated methods, choose Tools | Templates. -576 } -577 -578 @Override -579 public void lineBreak(SinkEventAttributes sea) { -580 throw new UnsupportedOperationException("Not supported yet."); //To change body of generated methods, choose Tools | Templates. -581 } -582 -583 @Override -584 public void text(String string, SinkEventAttributes sea) { -585 throw new UnsupportedOperationException("Not supported yet."); //To change body of generated methods, choose Tools | Templates. -586 } -587 -588 @Override -589 public void comment(String string) { -590 throw new UnsupportedOperationException("Not supported yet."); //To change body of generated methods, choose Tools | Templates. -591 } -592 -593 @Override -594 public void unknown(String string, Object[] os, SinkEventAttributes sea) { -595 throw new UnsupportedOperationException("Not supported yet."); //To change body of generated methods, choose Tools | Templates. -596 } -597 -598 @Override -599 public void enableLogging(Log log) { -600 throw new UnsupportedOperationException("Not supported yet."); //To change body of generated methods, choose Tools | Templates. -601 } -602 } +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2013 Jeremy Long. All Rights Reserved. +17 */ +18 package org.owasp.dependencycheck.maven; +19 +20 import java.io.IOException; +21 import java.io.OutputStream; +22 import java.io.OutputStreamWriter; +23 import java.util.logging.Level; +24 import java.util.logging.Logger; +25 import org.apache.maven.doxia.logging.Log; +26 import org.apache.maven.doxia.sink.Sink; +27 import org.apache.maven.doxia.sink.SinkEventAttributes; +28 +29 /** +30 * +31 * @author Jeremy Long <jeremy.long@owasp.org> +32 */ +33 public class MySink implements Sink { +34 +35 private OutputStreamWriter out = null; +36 +37 public MySink(OutputStream os) { +38 out = new OutputStreamWriter(os); +39 +40 } +41 +42 private void writeTag(String tag) { +43 try { +44 out.write(tag); +45 } catch (IOException ex) { +46 Logger.getLogger(MySink.class.getName()).log(Level.SEVERE, "Error writing a tag; unable to generate the report"); +47 Logger.getLogger(MySink.class.getName()).log(Level.FINE, null, ex); +48 } +49 } +50 +51 public void head() { +52 writeTag("<head>"); +53 } +54 +55 public void head_() { +56 writeTag("</head>"); +57 } +58 +59 public void title() { +60 writeTag("<title>"); +61 } +62 +63 public void title_() { +64 writeTag("</title>"); +65 } +66 +67 public void author() { +68 writeTag("<author>"); +69 } +70 +71 public void author_() { +72 writeTag("</author>"); +73 } +74 +75 public void date() { +76 writeTag("<time>"); +77 } +78 +79 public void date_() { +80 writeTag("</time>"); +81 } +82 +83 public void body() { +84 writeTag("<body>"); +85 } +86 +87 public void body_() { +88 writeTag("</body>"); +89 } +90 +91 public void sectionTitle() { +92 writeTag("<h1>"); +93 } +94 +95 public void sectionTitle_() { +96 writeTag("</h1>"); +97 } +98 +99 public void section1() { +100 writeTag("<div>"); +101 } +102 +103 public void section1_() { +104 writeTag("</div>"); +105 } +106 +107 public void sectionTitle1() { +108 writeTag("<h2>"); +109 } +110 +111 public void sectionTitle1_() { +112 writeTag("</h2>"); +113 } +114 +115 public void section2() { +116 writeTag("<div>"); +117 } +118 +119 public void section2_() { +120 writeTag("</div>"); +121 } +122 +123 public void sectionTitle2() { +124 writeTag("<h3>"); +125 } +126 +127 public void sectionTitle2_() { +128 writeTag("</h3>"); +129 } +130 +131 public void section3() { +132 writeTag("<div>"); +133 } +134 +135 public void section3_() { +136 writeTag("</div>"); +137 } +138 +139 public void sectionTitle3() { +140 writeTag("<h4>"); +141 } +142 +143 public void sectionTitle3_() { +144 writeTag("</h4>"); +145 } +146 +147 public void section4() { +148 writeTag("<div>"); +149 } +150 +151 public void section4_() { +152 writeTag("</div>"); +153 } +154 +155 public void sectionTitle4() { +156 writeTag("<h5>"); +157 } +158 +159 public void sectionTitle4_() { +160 writeTag("</h5>"); +161 } +162 +163 public void section5() { +164 writeTag("<div>"); +165 } +166 +167 public void section5_() { +168 writeTag("</div>"); +169 } +170 +171 public void sectionTitle5() { +172 writeTag("<h6>"); +173 } +174 +175 public void sectionTitle5_() { +176 writeTag("</h6>"); +177 } +178 +179 public void list() { +180 writeTag("<ul>"); +181 } +182 +183 public void list_() { +184 writeTag("</ul>"); +185 } +186 +187 public void listItem() { +188 writeTag("<li>"); +189 } +190 +191 public void listItem_() { +192 writeTag("</li>"); +193 } +194 +195 public void numberedList(int numbering) { +196 writeTag("<ol>"); +197 } +198 +199 public void numberedList_() { +200 writeTag("</ol>"); +201 } +202 +203 public void numberedListItem() { +204 writeTag("<li>"); +205 } +206 +207 public void numberedListItem_() { +208 writeTag("</li>"); +209 } +210 +211 public void definitionList() { +212 writeTag("<dl>"); +213 } +214 +215 public void definitionList_() { +216 writeTag("</dl>"); +217 } +218 +219 public void definitionListItem() { +220 writeTag("<dt>"); +221 } +222 +223 public void definitionListItem_() { +224 writeTag("</dt>"); +225 } +226 +227 public void definition() { +228 writeTag("<dd>"); +229 } +230 +231 public void definition_() { +232 writeTag("</dd>"); +233 } +234 +235 public void definedTerm() { +236 writeTag("<dt>"); +237 } +238 +239 public void definedTerm_() { +240 writeTag("</dt>"); +241 } +242 +243 public void figure() { +244 throw new UnsupportedOperationException("Not supported yet."); +245 } +246 +247 public void figure_() { +248 throw new UnsupportedOperationException("Not supported yet."); +249 } +250 +251 public void figureCaption() { +252 throw new UnsupportedOperationException("Not supported yet."); +253 } +254 +255 public void figureCaption_() { +256 throw new UnsupportedOperationException("Not supported yet."); +257 } +258 +259 public void figureGraphics(String name) { +260 throw new UnsupportedOperationException("Not supported yet."); +261 } +262 +263 public void table() { +264 writeTag("<table>"); +265 } +266 +267 public void table_() { +268 writeTag("</table>"); +269 } +270 +271 public void tableRows(int[] justification, boolean grid) { +272 writeTag("<tr>"); +273 } +274 +275 public void tableRows_() { +276 writeTag("</tr>"); +277 } +278 +279 public void tableRow() { +280 writeTag("<tr>"); +281 } +282 +283 public void tableRow_() { +284 writeTag("</tr>"); +285 } +286 +287 public void tableCell() { +288 writeTag("<td>"); +289 } +290 +291 public void tableCell(String width) { +292 writeTag("<td>"); +293 } +294 +295 public void tableCell_() { +296 writeTag("</td>"); +297 } +298 +299 public void tableHeaderCell() { +300 writeTag("<th>"); +301 } +302 +303 public void tableHeaderCell(String width) { +304 writeTag("<th>"); +305 } +306 +307 public void tableHeaderCell_() { +308 writeTag("</th>"); +309 } +310 +311 public void tableCaption() { +312 writeTag("<caption>"); +313 } +314 +315 public void tableCaption_() { +316 writeTag("</caption>"); +317 } +318 +319 public void paragraph() { +320 writeTag("<p>"); +321 } +322 +323 public void paragraph_() { +324 writeTag("</p>"); +325 } +326 +327 public void verbatim(boolean boxed) { +328 writeTag("<pre>"); +329 } +330 +331 public void verbatim_() { +332 writeTag("</pre>"); +333 } +334 +335 public void horizontalRule() { +336 writeTag("<hr/>"); +337 } +338 +339 public void pageBreak() { +340 writeTag("<br/>"); +341 } +342 +343 public void anchor(String name) { +344 writeTag("<a href=\"" + name + "\">"); +345 } +346 +347 public void anchor_() { +348 writeTag("</a>"); +349 } +350 +351 public void link(String name) { +352 writeTag("<link href=\"" + name + "\">"); +353 } +354 +355 public void link_() { +356 writeTag("</link>"); +357 } +358 +359 public void italic() { +360 writeTag("<i>"); +361 } +362 +363 public void italic_() { +364 writeTag("</i>"); +365 } +366 +367 public void bold() { +368 writeTag("<b>"); +369 } +370 +371 public void bold_() { +372 writeTag("</b>"); +373 } +374 +375 public void monospaced() { +376 writeTag("<pre>"); +377 } +378 +379 public void monospaced_() { +380 writeTag("</pre>"); +381 } +382 +383 public void lineBreak() { +384 writeTag("<br>"); +385 } +386 +387 public void nonBreakingSpace() { +388 writeTag("&nbsp;"); +389 } +390 +391 public void text(String text) { +392 try { +393 //TODO add HTML Encoding - or figure out how to get the doxia xhtmlsink to work. +394 out.write(text); +395 } catch (IOException ex) { +396 Logger.getLogger(MySink.class.getName()).log(Level.SEVERE, "Error writing a text; unable to generate the report"); +397 Logger.getLogger(MySink.class.getName()).log(Level.FINE, null, ex); +398 } +399 } +400 +401 public void rawText(String text) { +402 try { +403 out.write(text); +404 } catch (IOException ex) { +405 Logger.getLogger(MySink.class.getName()).log(Level.SEVERE, "Error writing raw text; unable to generate the report"); +406 Logger.getLogger(MySink.class.getName()).log(Level.FINE, null, ex); +407 } +408 } +409 +410 public void flush() { +411 try { +412 out.flush(); +413 } catch (IOException ex) { +414 Logger.getLogger(MySink.class.getName()).log(Level.FINEST, null, ex); +415 } +416 } +417 +418 public void close() { +419 flush(); +420 try { +421 out.close(); +422 } catch (IOException ex) { +423 Logger.getLogger(MySink.class.getName()).log(Level.FINEST, null, ex); +424 } +425 } +426 +427 @Override +428 public void head(SinkEventAttributes sea) { +429 throw new UnsupportedOperationException("Not supported yet."); //To change body of generated methods, choose Tools | Templates. +430 } +431 +432 @Override +433 public void title(SinkEventAttributes sea) { +434 throw new UnsupportedOperationException("Not supported yet."); //To change body of generated methods, choose Tools | Templates. +435 } +436 +437 @Override +438 public void author(SinkEventAttributes sea) { +439 throw new UnsupportedOperationException("Not supported yet."); //To change body of generated methods, choose Tools | Templates. +440 } +441 +442 @Override +443 public void date(SinkEventAttributes sea) { +444 throw new UnsupportedOperationException("Not supported yet."); //To change body of generated methods, choose Tools | Templates. +445 } +446 +447 @Override +448 public void body(SinkEventAttributes sea) { +449 throw new UnsupportedOperationException("Not supported yet."); //To change body of generated methods, choose Tools | Templates. +450 } +451 +452 @Override +453 public void section(int i, SinkEventAttributes sea) { +454 throw new UnsupportedOperationException("Not supported yet."); //To change body of generated methods, choose Tools | Templates. +455 } +456 +457 @Override +458 public void section_(int i) { +459 throw new UnsupportedOperationException("Not supported yet."); //To change body of generated methods, choose Tools | Templates. +460 } +461 +462 @Override +463 public void sectionTitle(int i, SinkEventAttributes sea) { +464 throw new UnsupportedOperationException("Not supported yet."); //To change body of generated methods, choose Tools | Templates. +465 } +466 +467 @Override +468 public void sectionTitle_(int i) { +469 throw new UnsupportedOperationException("Not supported yet."); //To change body of generated methods, choose Tools | Templates. +470 } +471 +472 @Override +473 public void list(SinkEventAttributes sea) { +474 throw new UnsupportedOperationException("Not supported yet."); //To change body of generated methods, choose Tools | Templates. +475 } +476 +477 @Override +478 public void listItem(SinkEventAttributes sea) { +479 throw new UnsupportedOperationException("Not supported yet."); //To change body of generated methods, choose Tools | Templates. +480 } +481 +482 @Override +483 public void numberedList(int i, SinkEventAttributes sea) { +484 throw new UnsupportedOperationException("Not supported yet."); //To change body of generated methods, choose Tools | Templates. +485 } +486 +487 @Override +488 public void numberedListItem(SinkEventAttributes sea) { +489 throw new UnsupportedOperationException("Not supported yet."); //To change body of generated methods, choose Tools | Templates. +490 } +491 +492 @Override +493 public void definitionList(SinkEventAttributes sea) { +494 throw new UnsupportedOperationException("Not supported yet."); //To change body of generated methods, choose Tools | Templates. +495 } +496 +497 @Override +498 public void definitionListItem(SinkEventAttributes sea) { +499 throw new UnsupportedOperationException("Not supported yet."); //To change body of generated methods, choose Tools | Templates. +500 } +501 +502 @Override +503 public void definition(SinkEventAttributes sea) { +504 throw new UnsupportedOperationException("Not supported yet."); //To change body of generated methods, choose Tools | Templates. +505 } +506 +507 @Override +508 public void definedTerm(SinkEventAttributes sea) { +509 throw new UnsupportedOperationException("Not supported yet."); //To change body of generated methods, choose Tools | Templates. +510 } +511 +512 @Override +513 public void figure(SinkEventAttributes sea) { +514 throw new UnsupportedOperationException("Not supported yet."); //To change body of generated methods, choose Tools | Templates. +515 } +516 +517 @Override +518 public void figureCaption(SinkEventAttributes sea) { +519 throw new UnsupportedOperationException("Not supported yet."); //To change body of generated methods, choose Tools | Templates. +520 } +521 +522 @Override +523 public void figureGraphics(String string, SinkEventAttributes sea) { +524 throw new UnsupportedOperationException("Not supported yet."); //To change body of generated methods, choose Tools | Templates. +525 } +526 +527 @Override +528 public void table(SinkEventAttributes sea) { +529 throw new UnsupportedOperationException("Not supported yet."); //To change body of generated methods, choose Tools | Templates. +530 } +531 +532 @Override +533 public void tableRow(SinkEventAttributes sea) { +534 throw new UnsupportedOperationException("Not supported yet."); //To change body of generated methods, choose Tools | Templates. +535 } +536 +537 @Override +538 public void tableCell(SinkEventAttributes sea) { +539 throw new UnsupportedOperationException("Not supported yet."); //To change body of generated methods, choose Tools | Templates. +540 } +541 +542 @Override +543 public void tableHeaderCell(SinkEventAttributes sea) { +544 throw new UnsupportedOperationException("Not supported yet."); //To change body of generated methods, choose Tools | Templates. +545 } +546 +547 @Override +548 public void tableCaption(SinkEventAttributes sea) { +549 throw new UnsupportedOperationException("Not supported yet."); //To change body of generated methods, choose Tools | Templates. +550 } +551 +552 @Override +553 public void paragraph(SinkEventAttributes sea) { +554 throw new UnsupportedOperationException("Not supported yet."); //To change body of generated methods, choose Tools | Templates. +555 } +556 +557 @Override +558 public void verbatim(SinkEventAttributes sea) { +559 throw new UnsupportedOperationException("Not supported yet."); //To change body of generated methods, choose Tools | Templates. +560 } +561 +562 @Override +563 public void horizontalRule(SinkEventAttributes sea) { +564 throw new UnsupportedOperationException("Not supported yet."); //To change body of generated methods, choose Tools | Templates. +565 } +566 +567 @Override +568 public void anchor(String string, SinkEventAttributes sea) { +569 throw new UnsupportedOperationException("Not supported yet."); //To change body of generated methods, choose Tools | Templates. +570 } +571 +572 @Override +573 public void link(String string, SinkEventAttributes sea) { +574 throw new UnsupportedOperationException("Not supported yet."); //To change body of generated methods, choose Tools | Templates. +575 } +576 +577 @Override +578 public void lineBreak(SinkEventAttributes sea) { +579 throw new UnsupportedOperationException("Not supported yet."); //To change body of generated methods, choose Tools | Templates. +580 } +581 +582 @Override +583 public void text(String string, SinkEventAttributes sea) { +584 throw new UnsupportedOperationException("Not supported yet."); //To change body of generated methods, choose Tools | Templates. +585 } +586 +587 @Override +588 public void comment(String string) { +589 throw new UnsupportedOperationException("Not supported yet."); //To change body of generated methods, choose Tools | Templates. +590 } +591 +592 @Override +593 public void unknown(String string, Object[] os, SinkEventAttributes sea) { +594 throw new UnsupportedOperationException("Not supported yet."); //To change body of generated methods, choose Tools | Templates. +595 } +596 +597 @Override +598 public void enableLogging(Log log) { +599 throw new UnsupportedOperationException("Not supported yet."); //To change body of generated methods, choose Tools | Templates. +600 } +601 }
    diff --git a/dependency-check-maven/xref-test/org/owasp/dependencycheck/maven/package-frame.html b/dependency-check-maven/xref-test/org/owasp/dependencycheck/maven/package-frame.html index ee2505893..f8fc782b3 100644 --- a/dependency-check-maven/xref-test/org/owasp/dependencycheck/maven/package-frame.html +++ b/dependency-check-maven/xref-test/org/owasp/dependencycheck/maven/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Maven Plugin 1.0.8 Reference Package org.owasp.dependencycheck.maven + Dependency-Check Maven Plugin 1.1.0 Reference Package org.owasp.dependencycheck.maven diff --git a/dependency-check-maven/xref-test/org/owasp/dependencycheck/maven/package-summary.html b/dependency-check-maven/xref-test/org/owasp/dependencycheck/maven/package-summary.html index e21303ccd..97d114644 100644 --- a/dependency-check-maven/xref-test/org/owasp/dependencycheck/maven/package-summary.html +++ b/dependency-check-maven/xref-test/org/owasp/dependencycheck/maven/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Maven Plugin 1.0.8 Reference Package org.owasp.dependencycheck.maven + Dependency-Check Maven Plugin 1.1.0 Reference Package org.owasp.dependencycheck.maven diff --git a/dependency-check-maven/xref-test/overview-frame.html b/dependency-check-maven/xref-test/overview-frame.html index 5dc90ee2a..735ee4fd5 100644 --- a/dependency-check-maven/xref-test/overview-frame.html +++ b/dependency-check-maven/xref-test/overview-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Maven Plugin 1.0.8 Reference + Dependency-Check Maven Plugin 1.1.0 Reference diff --git a/dependency-check-maven/xref-test/overview-summary.html b/dependency-check-maven/xref-test/overview-summary.html index 40e8fdafc..8e9cdcba3 100644 --- a/dependency-check-maven/xref-test/overview-summary.html +++ b/dependency-check-maven/xref-test/overview-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Maven Plugin 1.0.8 Reference + Dependency-Check Maven Plugin 1.1.0 Reference @@ -24,7 +24,7 @@ -

    Dependency-Check Maven Plugin 1.0.8 Reference

    +

    Dependency-Check Maven Plugin 1.1.0 Reference

    diff --git a/dependency-check-maven/xref/index.html b/dependency-check-maven/xref/index.html index ed8d46a6e..e8a74de8a 100644 --- a/dependency-check-maven/xref/index.html +++ b/dependency-check-maven/xref/index.html @@ -4,7 +4,7 @@ - Dependency-Check Maven Plugin 1.0.8 Reference + Dependency-Check Maven Plugin 1.1.0 Reference diff --git a/dependency-check-maven/xref/org/owasp/dependencycheck/maven/DependencyCheckMojo.html b/dependency-check-maven/xref/org/owasp/dependencycheck/maven/DependencyCheckMojo.html index 0061b6759..de1d4e54b 100644 --- a/dependency-check-maven/xref/org/owasp/dependencycheck/maven/DependencyCheckMojo.html +++ b/dependency-check-maven/xref/org/owasp/dependencycheck/maven/DependencyCheckMojo.html @@ -9,864 +9,930 @@ 1/*2 * This file is part of dependency-check-maven.3 * -4 * Dependency-check-maven is free software: you can redistribute it and/or modify it -5 * under the terms of the GNU General Public License as published by the Free -6 * Software Foundation, either version 3 of the License, or (at your option) any -7 * later version. -8 * -9 * Dependency-check-maven is distributed in the hope that it will be useful, but -10 * WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or -11 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more -12 * details. -13 * -14 * You should have received a copy of the GNU General Public License along with -15 * dependency-check-maven. If not, see http://www.gnu.org/licenses/. -16 * -17 * Copyright (c) 2013 Jeremy Long. All Rights Reserved. -18 */ -19package org.owasp.dependencycheck.maven; -20 -21import java.io.File; -22import java.io.IOException; -23import java.io.InputStream; -24import java.io.UnsupportedEncodingException; -25import java.net.URLEncoder; -26import java.text.DateFormat; -27import java.util.Date; -28import java.util.List; -29import java.util.Locale; +4 * Licensed under the Apache License, Version 2.0 (the "License"); +5 * you may not use this file except in compliance with the License. +6 * You may obtain a copy of the License at +7 * +8 * http://www.apache.org/licenses/LICENSE-2.0 +9 * +10 * Unless required by applicable law or agreed to in writing, software +11 * distributed under the License is distributed on an "AS IS" BASIS, +12 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +13 * See the License for the specific language governing permissions and +14 * limitations under the License. +15 * +16 * Copyright (c) 2013 Jeremy Long. All Rights Reserved. +17 */ +18package org.owasp.dependencycheck.maven; +19 +20import java.io.File; +21import java.io.IOException; +22import java.io.InputStream; +23import java.io.UnsupportedEncodingException; +24import java.net.URLEncoder; +25import java.text.DateFormat; +26import java.util.Date; +27import java.util.List; +28import java.util.Locale; +29import java.util.Set; 30import java.util.logging.Level; 31import java.util.logging.Logger; -32import org.apache.maven.doxia.sink.SinkFactory; -33import org.apache.maven.plugin.AbstractMojo; -34import org.apache.maven.plugin.MojoExecutionException; -35import org.apache.maven.project.MavenProject; -36import java.util.Set; -37import org.apache.maven.artifact.Artifact; +32import org.apache.maven.artifact.Artifact; +33import org.apache.maven.doxia.sink.Sink; +34import org.apache.maven.doxia.sink.SinkFactory; +35import org.apache.maven.plugin.AbstractMojo; +36import org.apache.maven.plugin.MojoExecutionException; +37import org.apache.maven.plugin.MojoFailureException; 38import org.apache.maven.plugins.annotations.Component; 39import org.apache.maven.plugins.annotations.LifecyclePhase; 40import org.apache.maven.plugins.annotations.Mojo; 41import org.apache.maven.plugins.annotations.Parameter; 42import org.apache.maven.plugins.annotations.ResolutionScope; -43import org.apache.maven.reporting.MavenMultiPageReport; -44import org.apache.maven.reporting.MavenReport; -45import org.apache.maven.reporting.MavenReportException; -46import org.apache.maven.doxia.sink.Sink; -47import org.apache.maven.plugin.MojoFailureException; -48import org.owasp.dependencycheck.Engine; -49import org.owasp.dependencycheck.dependency.Dependency; -50import org.owasp.dependencycheck.dependency.Evidence; -51import org.owasp.dependencycheck.dependency.Identifier; -52import org.owasp.dependencycheck.dependency.Reference; -53import org.owasp.dependencycheck.dependency.Vulnerability; -54import org.owasp.dependencycheck.dependency.VulnerableSoftware; -55import org.owasp.dependencycheck.reporting.ReportGenerator; -56import org.owasp.dependencycheck.utils.LogUtils; -57import org.owasp.dependencycheck.utils.Settings; -58 -59/** -60 * Maven Plugin that checks project dependencies to see if they have any known -61 * published vulnerabilities. -62 * -63 * @author Jeremy Long <jeremy.long@owasp.org> -64 */ -65 @Mojo(name = "check", defaultPhase = LifecyclePhase.COMPILE, threadSafe = true, -66 requiresDependencyResolution = ResolutionScope.RUNTIME_PLUS_SYSTEM, -67 requiresOnline = true) -68publicclassDependencyCheckMojoextends AbstractMojo implements MavenMultiPageReport { -69 -70/** -71 * The properties file location. -72 */ -73privatestaticfinal String PROPERTIES_FILE = "mojo.properties"; -74/** -75 * Name of the logging properties file. -76 */ -77privatestaticfinal String LOG_PROPERTIES_FILE = "log.properties"; -78/** -79 * The name of the test scope. -80 */ -81publicstaticfinal String TEST_SCOPE = "test"; -82/** -83 * System specific new line character. -84 */ -85privatestaticfinal String NEW_LINE = System.getProperty("line.separator", "\n").intern(); -86// <editor-fold defaultstate="collapsed" desc="Maven bound parameters and components"> -87/** -88 * The Maven Project Object. -89 */ -90 @Component -91private MavenProject project; -92/** -93 * The name of the site report destination. -94 */ -95 @Parameter(property = "report-name", defaultValue = "dependency-check-report") -96private String reportName; -97/** -98 * The path to the verbose log -99 */ -100 @Parameter(property = "logfile", defaultValue = "") -101private String logFile; -102/** -103 * The name of the report to be displayed in the Maven Generated Reports -104 * page +43import org.apache.maven.project.MavenProject; +44import org.apache.maven.reporting.MavenMultiPageReport; +45import org.apache.maven.reporting.MavenReport; +46import org.apache.maven.reporting.MavenReportException; +47import org.owasp.dependencycheck.Engine; +48import org.owasp.dependencycheck.data.nvdcve.CveDB; +49import org.owasp.dependencycheck.data.nvdcve.DatabaseException; +50import org.owasp.dependencycheck.data.nvdcve.DatabaseProperties; +51import org.owasp.dependencycheck.dependency.Dependency; +52import org.owasp.dependencycheck.dependency.Evidence; +53import org.owasp.dependencycheck.dependency.Identifier; +54import org.owasp.dependencycheck.dependency.Reference; +55import org.owasp.dependencycheck.dependency.Vulnerability; +56import org.owasp.dependencycheck.dependency.VulnerableSoftware; +57import org.owasp.dependencycheck.reporting.ReportGenerator; +58import org.owasp.dependencycheck.utils.LogUtils; +59import org.owasp.dependencycheck.utils.Settings; +60 +61/** +62 * Maven Plugin that checks project dependencies to see if they have any known published vulnerabilities. +63 * +64 * @author Jeremy Long <jeremy.long@owasp.org> +65 */ +66 @Mojo(name = "check", defaultPhase = LifecyclePhase.COMPILE, threadSafe = true, +67 requiresDependencyResolution = ResolutionScope.RUNTIME_PLUS_SYSTEM, +68 requiresOnline = true) +69publicclassDependencyCheckMojoextends AbstractMojo implements MavenMultiPageReport { +70 +71/** +72 * The properties file location. +73 */ +74privatestaticfinal String PROPERTIES_FILE = "mojo.properties"; +75/** +76 * Name of the logging properties file. +77 */ +78privatestaticfinal String LOG_PROPERTIES_FILE = "log.properties"; +79/** +80 * The name of the test scope. +81 */ +82publicstaticfinal String TEST_SCOPE = "test"; +83/** +84 * System specific new line character. +85 */ +86privatestaticfinal String NEW_LINE = System.getProperty("line.separator", "\n").intern(); +87// <editor-fold defaultstate="collapsed" desc="Maven bound parameters and components"> +88/** +89 * The Maven Project Object. +90 */ +91 @Component +92private MavenProject project; +93/** +94 * The name of the site report destination. +95 */ +96 @Parameter(property = "report-name", defaultValue = "dependency-check-report") +97private String reportName; +98/** +99 * The path to the verbose log +100 */ +101 @Parameter(property = "logfile", defaultValue = "") +102private String logFile; +103/** +104 * The name of the report to be displayed in the Maven Generated Reports page105 */106 @Parameter(property = "name", defaultValue = "Dependency-Check") 107private String name; 108/** -109 * The description of the Dependency-Check report to be displayed in the -110 * Maven Generated Reports page -111 */ -112 @Parameter(property = "description", defaultValue = "A report providing details on any published " -113 + "vulnerabilities within project dependencies. This report is a best effort but may contain " -114 + "false positives and false negatives.") -115private String description; -116/** -117 * Specifies the destination directory for the generated Dependency-Check -118 * report. -119 */ -120 @Parameter(property = "reportOutputDirectory", defaultValue = "${project.reporting.outputDirectory}", required = true) -121private File reportOutputDirectory; -122/** -123 * Specifies if the build should be failed if a CVSS score above a specified -124 * level is identified. The default is 11 which means since the CVSS scores -125 * are 0-10, by default the build will never fail. -126 */ -127 @Parameter(property = "failBuildOnCVSS", defaultValue = "11", required = true) -128privatefloat failBuildOnCVSS = 11; -129/** -130 * The output directory. -131 */ -132 @Parameter(defaultValue = "${project.build.directory}", required = true) -133private File outputDirectory; -134/** -135 * Sets whether auto-updating of the NVD CVE/CPE data is enabled. It is not -136 * recommended that this be turned to false. Default is true. -137 */ -138 @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"}) -139 @Parameter(property = "autoupdate", defaultValue = "true", required = true) -140privateboolean autoUpdate = true; -141/** -142 * The report format to be generated (HTML, XML, VULN, ALL). This -143 * configuration option has no affect if using this within the Site plugin -144 * unless the externalReport is set to true. Default is HTML. -145 */ -146 @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"}) -147 @Parameter(property = "format", defaultValue = "HTML", required = true) -148private String format = "HTML"; -149/** -150 * Sets whether or not the external report format should be used. -151 */ -152 @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"}) -153 @Parameter(property = "externalReport", defaultValue = "false", required = true) -154privateboolean externalReport = false; -155/** -156 * The Proxy URL. -157 */ -158 @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"}) -159 @Parameter(property = "proxyUrl", defaultValue = "", required = false) -160private String proxyUrl = null; -161/** -162 * The Proxy Port. -163 */ -164 @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"}) -165 @Parameter(property = "proxyPort", defaultValue = "", required = false) -166private String proxyPort = null; -167/** -168 * The Proxy username. -169 */ -170 @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"}) -171 @Parameter(property = "proxyUsername", defaultValue = "", required = false) -172private String proxyUsername = null; -173/** -174 * The Proxy password. -175 */ -176 @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"}) -177 @Parameter(property = "proxyPassword", defaultValue = "", required = false) -178private String proxyPassword = null; -179/** -180 * The Connection Timeout. -181 */ -182 @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"}) -183 @Parameter(property = "connectionTimeout", defaultValue = "", required = false) -184private String connectionTimeout = null; -185/** -186 * The Connection Timeout. -187 */ -188 @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"}) -189 @Parameter(property = "suppressionFile", defaultValue = "", required = false) -190private String suppressionFile = null; -191/** -192 * Flag indicating whether or not to show a summary in the output. -193 */ -194 @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"}) -195 @Parameter(property = "showSummary", defaultValue = "true", required = false) -196privateboolean showSummary = true; -197// </editor-fold> -198 +109 * The description of the Dependency-Check report to be displayed in the Maven Generated Reports page +110 */ +111 @Parameter(property = "description", defaultValue = "A report providing details on any published " +112 + "vulnerabilities within project dependencies. This report is a best effort but may contain " +113 + "false positives and false negatives.") +114private String description; +115/** +116 * Specifies the destination directory for the generated Dependency-Check report. +117 */ +118 @Parameter(property = "reportOutputDirectory", defaultValue = "${project.reporting.outputDirectory}", required = true) +119private File reportOutputDirectory; +120/** +121 * Specifies if the build should be failed if a CVSS score above a specified level is identified. The default is 11 +122 * which means since the CVSS scores are 0-10, by default the build will never fail. +123 */ +124 @Parameter(property = "failBuildOnCVSS", defaultValue = "11", required = true) +125privatefloat failBuildOnCVSS = 11; +126/** +127 * The output directory. +128 */ +129 @Parameter(defaultValue = "${project.build.directory}", required = true) +130private File outputDirectory; +131/** +132 * Sets whether auto-updating of the NVD CVE/CPE data is enabled. It is not recommended that this be turned to +133 * false. Default is true. +134 */ +135 @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"}) +136 @Parameter(property = "autoupdate", defaultValue = "true", required = true) +137privateboolean autoUpdate = true; +138/** +139 * The report format to be generated (HTML, XML, VULN, ALL). This configuration option has no affect if using this +140 * within the Site plugin unless the externalReport is set to true. Default is HTML. +141 */ +142 @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"}) +143 @Parameter(property = "format", defaultValue = "HTML", required = true) +144private String format = "HTML"; +145/** +146 * Sets whether or not the external report format should be used. +147 */ +148 @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"}) +149 @Parameter(property = "externalReport", defaultValue = "false", required = true) +150privateboolean externalReport = false; +151/** +152 * The Proxy URL. +153 */ +154 @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"}) +155 @Parameter(property = "proxyUrl", defaultValue = "", required = false) +156private String proxyUrl = null; +157/** +158 * The Proxy Port. +159 */ +160 @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"}) +161 @Parameter(property = "proxyPort", defaultValue = "", required = false) +162private String proxyPort = null; +163/** +164 * The Proxy username. +165 */ +166 @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"}) +167 @Parameter(property = "proxyUsername", defaultValue = "", required = false) +168private String proxyUsername = null; +169/** +170 * The Proxy password. +171 */ +172 @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"}) +173 @Parameter(property = "proxyPassword", defaultValue = "", required = false) +174private String proxyPassword = null; +175/** +176 * The Connection Timeout. +177 */ +178 @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"}) +179 @Parameter(property = "connectionTimeout", defaultValue = "", required = false) +180private String connectionTimeout = null; +181/** +182 * The Connection Timeout. +183 */ +184 @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"}) +185 @Parameter(property = "suppressionFile", defaultValue = "", required = false) +186private String suppressionFile = null; +187/** +188 * Flag indicating whether or not to show a summary in the output. +189 */ +190 @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"}) +191 @Parameter(property = "showSummary", defaultValue = "true", required = false) +192privateboolean showSummary = true; +193/** +194 * Whether or not the Nexus Analyzer is enabled. +195 */ +196 @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"}) +197 @Parameter(property = "nexusAnalyzerEnabled", defaultValue = "true", required = false) +198privateboolean nexusAnalyzerEnabled = true; 199/** -200 * Executes the Dependency-Check on the dependent libraries. -201 * -202 * @return the Engine used to scan the dependencies. -203 */ -204private Engine executeDependencyCheck() { -205 -206final InputStream in = DependencyCheckMojo.class.getClassLoader().getResourceAsStream(LOG_PROPERTIES_FILE); -207 LogUtils.prepareLogger(in, logFile); -208 -209 populateSettings(); -210final Engine engine = new Engine(); -211final Set<Artifact> artifacts = project.getArtifacts(); -212for (Artifact a : artifacts) { -213if (!TEST_SCOPE.equals(a.getScope())) { -214 engine.scan(a.getFile().getAbsolutePath()); -215 } -216 } -217 engine.analyzeDependencies(); -218return engine; -219 } -220 -221/** -222 * Generates the reports for a given dependency-check engine. -223 * -224 * @param engine a dependency-check engine +200 * Whether or not the Nexus Analyzer is enabled. +201 */ +202 @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"}) +203 @Parameter(property = "nexusUrl", defaultValue = "", required = false) +204private String nexusUrl; +205/** +206 * The database connection string. +207 */ +208 @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"}) +209 @Parameter(property = "nexusUrl", defaultValue = "", required = false) +210private String connectionString; +211/** +212 * The database driver name. An example would be org.h2.Driver. +213 */ +214 @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"}) +215 @Parameter(property = "databaseDriverName", defaultValue = "", required = false) +216private String databaseDriverName; +217/** +218 * The path to the database driver if it is not on the class path. +219 */ +220 @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"}) +221 @Parameter(property = "databaseDriverPath", defaultValue = "", required = false) +222private String databaseDriverPath; +223/** +224 * The database user name.225 */ -226privatevoid generateExternalReports(Engine engine) { -227final ReportGenerator r = new ReportGenerator(project.getName(), engine.getDependencies(), engine.getAnalyzers()); -228try { -229 r.generateReports(outputDirectory.getCanonicalPath(), format); -230 } catch (IOException ex) { -231 Logger.getLogger(DependencyCheckMojo.class.getName()).log(Level.SEVERE, "Unexpected exception occurred during analysis; please see the verbose error log for more details."); -232 Logger.getLogger(DependencyCheckMojo.class.getName()).log(Level.FINE, null, ex); -233 } catch (Exception ex) { -234 Logger.getLogger(DependencyCheckMojo.class.getName()).log(Level.SEVERE, "Unexpected exception occurred during analysis; please see the verbose error log for more details."); -235 Logger.getLogger(DependencyCheckMojo.class.getName()).log(Level.FINE, null, ex); -236 } -237 } -238 -239/** -240 * Generates a dependency-check report using the Maven Site format. -241 * -242 * @param engine the engine used to scan the dependencies -243 * @param sink the sink to write the data to -244 */ -245privatevoid generateMavenSiteReport(final Engine engine, Sink sink) { -246final List<Dependency> dependencies = engine.getDependencies(); -247 -248 writeSiteReportHeader(sink, project.getName()); -249 writeSiteReportTOC(sink, dependencies); -250 -251int cnt = 0; -252for (Dependency d : dependencies) { -253 writeSiteReportDependencyHeader(sink, d); -254 cnt = writeSiteReportDependencyAnalysisExceptions(d, cnt, sink); -255 cnt = writeSiteReportDependencyEvidenceUsed(d, cnt, sink); -256 cnt = writeSiteReportDependencyRelatedDependencies(d, cnt, sink); -257 writeSiteReportDependencyIdentifiers(d, sink); -258 writeSiteReportDependencyVulnerabilities(d, sink, cnt); -259 } -260 sink.body_(); -261 } -262 -263// <editor-fold defaultstate="collapsed" desc="various writeXXXXX methods to generate the Site Report"> -264/** -265 * Writes the vulnerabilities to the site report. -266 * -267 * @param d the dependency -268 * @param sink the sink to write the data to -269 * @param collapsibleHeaderCount the collapsible header count -270 */ -271privatevoid writeSiteReportDependencyVulnerabilities(Dependency d, Sink sink, int collapsibleHeaderCount) { -272int cnt = collapsibleHeaderCount; -273if (d.getVulnerabilities() != null && !d.getVulnerabilities().isEmpty()) { -274for (Vulnerability v : d.getVulnerabilities()) { -275 -276 sink.paragraph(); -277 sink.bold(); -278try { -279 sink.link("http://web.nvd.nist.gov/view/vuln/detail?vulnId=" + URLEncoder.encode(v.getName(), "US-ASCII")); -280 sink.text(v.getName()); -281 sink.link_(); -282 sink.bold_(); -283 } catch (UnsupportedEncodingException ex) { -284 sink.text(v.getName()); -285 sink.bold_(); -286 sink.lineBreak(); -287 sink.text("http://web.nvd.nist.gov/view/vuln/detail?vulnId=" + v.getName()); -288 } -289 sink.paragraph_(); -290 sink.paragraph(); -291 sink.text("Severity: "); -292if (v.getCvssScore() < 4.0) { -293 sink.text("Low"); -294 } else { -295if (v.getCvssScore() >= 7.0) { -296 sink.text("High"); -297 } else { -298 sink.text("Medium"); -299 } -300 } -301 sink.lineBreak(); -302 sink.text("CVSS Score: " + v.getCvssScore()); -303if (v.getCwe() != null && !v.getCwe().isEmpty()) { -304 sink.lineBreak(); -305 sink.text("CWE: "); -306 sink.text(v.getCwe()); -307 } -308 sink.paragraph_(); -309 sink.paragraph(); -310 sink.text(v.getDescription()); -311if (v.getReferences() != null && !v.getReferences().isEmpty()) { -312 sink.list(); -313for (Reference ref : v.getReferences()) { -314 sink.listItem(); -315 sink.text(ref.getSource()); -316 sink.text(" - "); -317 sink.link(ref.getUrl()); -318 sink.text(ref.getName()); -319 sink.link_(); -320 sink.listItem_(); -321 } -322 sink.list_(); -323 } -324 sink.paragraph_(); -325if (v.getVulnerableSoftware() != null && !v.getVulnerableSoftware().isEmpty()) { -326 sink.paragraph(); -327 -328 cnt += 1; -329 sink.rawText("Vulnerable Software <a href=\"javascript:toggleElement(this, 'vulnSoft" + cnt + "')\">[-]</a>"); -330 sink.rawText("<div id=\"vulnSoft" + cnt + "\" style=\"display:block\">"); -331 sink.list(); -332for (VulnerableSoftware vs : v.getVulnerableSoftware()) { -333 sink.listItem(); -334try { -335 sink.link("http://web.nvd.nist.gov/view/vuln/search-results?cpe=" + URLEncoder.encode(vs.getName(), "US-ASCII")); -336 sink.text(vs.getName()); -337 sink.link_(); -338if (vs.hasPreviousVersion()) { -339 sink.text(" and all previous versions."); -340 } -341 } catch (UnsupportedEncodingException ex) { -342 sink.text(vs.getName()); -343if (vs.hasPreviousVersion()) { -344 sink.text(" and all previous versions."); -345 } -346 sink.text(" (http://web.nvd.nist.gov/view/vuln/search-results?cpe=" + vs.getName() + ")"); -347 } -348 -349 sink.listItem_(); -350 } -351 sink.list_(); -352 sink.rawText("</div>"); -353 sink.paragraph_(); -354 } -355 } -356 } -357 } -358 -359/** -360 * Writes the identifiers to the site report. -361 * -362 * @param d the dependency -363 * @param sink the sink to write the data to -364 */ -365privatevoid writeSiteReportDependencyIdentifiers(Dependency d, Sink sink) { -366if (d.getIdentifiers() != null && !d.getIdentifiers().isEmpty()) { -367 sink.sectionTitle4(); -368 sink.text("Identifiers"); -369 sink.sectionTitle4_(); -370 sink.list(); -371for (Identifier i : d.getIdentifiers()) { -372 sink.listItem(); -373 sink.text(i.getType()); -374 sink.text(": "); -375if (i.getUrl() != null && i.getUrl().length() > 0) { -376 sink.link(i.getUrl()); -377 sink.text(i.getValue()); -378 sink.link_(); -379 } else { -380 sink.text(i.getValue()); -381 } -382if (i.getDescription() != null && i.getDescription().length() > 0) { -383 sink.lineBreak(); -384 sink.text(i.getDescription()); -385 } -386 sink.listItem_(); -387 } -388 sink.list_(); -389 } -390 } -391 -392/** -393 * Writes the related dependencies to the site report. -394 * -395 * @param d the dependency -396 * @param sink the sink to write the data to -397 * @param collapsibleHeaderCount the collapsible header count -398 * @return the collapsible header count -399 */ -400privateint writeSiteReportDependencyRelatedDependencies(Dependency d, int collapsibleHeaderCount, Sink sink) { -401int cnt = collapsibleHeaderCount; -402if (d.getRelatedDependencies() != null && !d.getRelatedDependencies().isEmpty()) { -403 cnt += 1; -404 sink.sectionTitle4(); -405 sink.rawText("Related Dependencies <a href=\"javascript:toggleElement(this, 'related" + cnt + "')\">[+]</a>"); -406 sink.sectionTitle4_(); -407 sink.rawText("<div id=\"related" + cnt + "\" style=\"display:none\">"); -408 sink.list(); -409for (Dependency r : d.getRelatedDependencies()) { -410 sink.listItem(); -411 sink.text(r.getFileName()); -412 sink.list(); -413 writeListItem(sink, "File Path: " + r.getFilePath()); -414 writeListItem(sink, "SHA1: " + r.getSha1sum()); -415 writeListItem(sink, "MD5: " + r.getMd5sum()); -416 sink.list_(); -417 sink.listItem_(); -418 } -419 sink.list_(); -420 sink.rawText("</div>"); -421 } -422return cnt; -423 } -424 -425/** -426 * Writes the evidence used to the site report. -427 * -428 * @param d the dependency -429 * @param sink the sink to write the data to -430 * @param collapsibleHeaderCount the collapsible header count -431 * @return the collapsible header count -432 */ -433privateint writeSiteReportDependencyEvidenceUsed(Dependency d, int collapsibleHeaderCount, Sink sink) { -434int cnt = collapsibleHeaderCount; -435if (d.getEvidenceUsed() != null && d.getEvidenceUsed().size() > 0) { -436 cnt += 1; -437 sink.sectionTitle4(); -438 sink.rawText("Evidence Collected <a href=\"javascript:toggleElement(this, 'evidence" + cnt + "')\">[+]</a>"); -439 sink.sectionTitle4_(); -440 sink.rawText("<div id=\"evidence" + cnt + "\" style=\"display:none\">"); -441 sink.table(); -442 sink.tableRow(); -443 writeTableHeaderCell(sink, "Source"); -444 writeTableHeaderCell(sink, "Name"); -445 writeTableHeaderCell(sink, "Value"); -446 sink.tableRow_(); -447for (Evidence e : d.getEvidenceUsed()) { -448 sink.tableRow(); -449 writeTableCell(sink, e.getSource()); -450 writeTableCell(sink, e.getName()); -451 writeTableCell(sink, e.getValue()); -452 sink.tableRow_(); -453 } -454 sink.table_(); -455 sink.rawText("</div>"); -456 } -457return cnt; -458 } -459 -460/** -461 * Writes the analysis exceptions generated during analysis to the site -462 * report. -463 * -464 * @param d the dependency -465 * @param sink the sink to write the data to -466 * @param collapsibleHeaderCount the collapsible header count -467 * @return the collapsible header count -468 */ -469privateint writeSiteReportDependencyAnalysisExceptions(Dependency d, int collapsibleHeaderCount, Sink sink) { -470int cnt = collapsibleHeaderCount; -471if (d.getAnalysisExceptions() != null && !d.getAnalysisExceptions().isEmpty()) { -472 cnt += 1; -473 sink.sectionTitle4(); -474 sink.rawText("<font style=\"color:red\">Errors occurred during analysis:</font> <a href=\"javascript:toggleElement(this, 'errors" -475 + cnt + "')\">[+]</a>"); -476 sink.sectionTitle4_(); -477 sink.rawText("<div id=\"errors" + cnt + "\">"); -478 sink.list(); -479for (Exception e : d.getAnalysisExceptions()) { -480 sink.listItem(); -481 sink.text(e.getMessage()); -482 sink.listItem_(); -483 } -484 sink.list_(); -485 sink.rawText("</div>"); -486 } -487return cnt; -488 } -489 -490/** -491 * Writes the dependency header to the site report. -492 * -493 * @param d the dependency -494 * @param sink the sink to write the data to -495 */ -496privatevoid writeSiteReportDependencyHeader(Sink sink, Dependency d) { -497 sink.sectionTitle2(); -498 sink.anchor("sha1" + d.getSha1sum()); -499 sink.text(d.getFileName()); -500 sink.anchor_(); -501 sink.sectionTitle2_(); -502if (d.getDescription() != null && d.getDescription().length() > 0) { -503 sink.paragraph(); -504 sink.bold(); -505 sink.text("Description: "); -506 sink.bold_(); -507 sink.text(d.getDescription()); -508 sink.paragraph_(); +226 @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"}) +227 @Parameter(property = "databaseUser", defaultValue = "", required = false) +228private String databaseUser; +229/** +230 * The password to use when connecting to the database. +231 */ +232 @SuppressWarnings({"CanBeFinal", "FieldCanBeLocal"}) +233 @Parameter(property = "databasePassword", defaultValue = "", required = false) +234private String databasePassword; +235// </editor-fold> +236 +237/** +238 * Executes the Dependency-Check on the dependent libraries. +239 * +240 * @return the Engine used to scan the dependencies. +241 */ +242private Engine executeDependencyCheck() { +243 +244final InputStream in = DependencyCheckMojo.class.getClassLoader().getResourceAsStream(LOG_PROPERTIES_FILE); +245 LogUtils.prepareLogger(in, logFile); +246 +247 populateSettings(); +248final Engine engine = new Engine(); +249final Set<Artifact> artifacts = project.getArtifacts(); +250for (Artifact a : artifacts) { +251if (!TEST_SCOPE.equals(a.getScope())) { +252 engine.scan(a.getFile().getAbsolutePath()); +253 } +254 } +255 engine.analyzeDependencies(); +256return engine; +257 } +258 +259/** +260 * Generates the reports for a given dependency-check engine. +261 * +262 * @param engine a dependency-check engine +263 */ +264privatevoid generateExternalReports(Engine engine) { +265 DatabaseProperties prop = null; +266 CveDB cve = null; +267try { +268 cve = new CveDB(); +269 cve.open(); +270 prop = cve.getDatabaseProperties(); +271 } catch (DatabaseException ex) { +272 Logger.getLogger(DependencyCheckMojo.class.getName()).log(Level.FINE, "Unable to retrieve DB Properties", ex); +273 } finally { +274if (cve != null) { +275 cve.close(); +276 } +277 } +278final ReportGenerator r = new ReportGenerator(project.getName(), engine.getDependencies(), engine.getAnalyzers(), prop); +279try { +280 r.generateReports(outputDirectory.getCanonicalPath(), format); +281 } catch (IOException ex) { +282 Logger.getLogger(DependencyCheckMojo.class.getName()).log(Level.SEVERE, +283"Unexpected exception occurred during analysis; please see the verbose error log for more details."); +284 Logger.getLogger(DependencyCheckMojo.class.getName()).log(Level.FINE, null, ex); +285 } catch (Exception ex) { +286 Logger.getLogger(DependencyCheckMojo.class.getName()).log(Level.SEVERE, +287"Unexpected exception occurred during analysis; please see the verbose error log for more details."); +288 Logger.getLogger(DependencyCheckMojo.class.getName()).log(Level.FINE, null, ex); +289 } +290 } +291 +292/** +293 * Generates a dependency-check report using the Maven Site format. +294 * +295 * @param engine the engine used to scan the dependencies +296 * @param sink the sink to write the data to +297 */ +298privatevoid generateMavenSiteReport(final Engine engine, Sink sink) { +299final List<Dependency> dependencies = engine.getDependencies(); +300 +301 writeSiteReportHeader(sink, project.getName()); +302 writeSiteReportTOC(sink, dependencies); +303 +304int cnt = 0; +305for (Dependency d : dependencies) { +306 writeSiteReportDependencyHeader(sink, d); +307 cnt = writeSiteReportDependencyAnalysisExceptions(d, cnt, sink); +308 cnt = writeSiteReportDependencyEvidenceUsed(d, cnt, sink); +309 cnt = writeSiteReportDependencyRelatedDependencies(d, cnt, sink); +310 writeSiteReportDependencyIdentifiers(d, sink); +311 writeSiteReportDependencyVulnerabilities(d, sink, cnt); +312 } +313 sink.body_(); +314 } +315 +316// <editor-fold defaultstate="collapsed" desc="various writeXXXXX methods to generate the Site Report"> +317/** +318 * Writes the vulnerabilities to the site report. +319 * +320 * @param d the dependency +321 * @param sink the sink to write the data to +322 * @param collapsibleHeaderCount the collapsible header count +323 */ +324privatevoid writeSiteReportDependencyVulnerabilities(Dependency d, Sink sink, int collapsibleHeaderCount) { +325int cnt = collapsibleHeaderCount; +326if (d.getVulnerabilities() != null && !d.getVulnerabilities().isEmpty()) { +327for (Vulnerability v : d.getVulnerabilities()) { +328 +329 sink.paragraph(); +330 sink.bold(); +331try { +332 sink.link("http://web.nvd.nist.gov/view/vuln/detail?vulnId=" + URLEncoder.encode(v.getName(), "US-ASCII")); +333 sink.text(v.getName()); +334 sink.link_(); +335 sink.bold_(); +336 } catch (UnsupportedEncodingException ex) { +337 sink.text(v.getName()); +338 sink.bold_(); +339 sink.lineBreak(); +340 sink.text("http://web.nvd.nist.gov/view/vuln/detail?vulnId=" + v.getName()); +341 } +342 sink.paragraph_(); +343 sink.paragraph(); +344 sink.text("Severity: "); +345if (v.getCvssScore() < 4.0) { +346 sink.text("Low"); +347 } else { +348if (v.getCvssScore() >= 7.0) { +349 sink.text("High"); +350 } else { +351 sink.text("Medium"); +352 } +353 } +354 sink.lineBreak(); +355 sink.text("CVSS Score: " + v.getCvssScore()); +356if (v.getCwe() != null && !v.getCwe().isEmpty()) { +357 sink.lineBreak(); +358 sink.text("CWE: "); +359 sink.text(v.getCwe()); +360 } +361 sink.paragraph_(); +362 sink.paragraph(); +363 sink.text(v.getDescription()); +364if (v.getReferences() != null && !v.getReferences().isEmpty()) { +365 sink.list(); +366for (Reference ref : v.getReferences()) { +367 sink.listItem(); +368 sink.text(ref.getSource()); +369 sink.text(" - "); +370 sink.link(ref.getUrl()); +371 sink.text(ref.getName()); +372 sink.link_(); +373 sink.listItem_(); +374 } +375 sink.list_(); +376 } +377 sink.paragraph_(); +378if (v.getVulnerableSoftware() != null && !v.getVulnerableSoftware().isEmpty()) { +379 sink.paragraph(); +380 +381 cnt += 1; +382 sink.rawText("Vulnerable Software <a href=\"javascript:toggleElement(this, 'vulnSoft" + cnt + "')\">[-]</a>"); +383 sink.rawText("<div id=\"vulnSoft" + cnt + "\" style=\"display:block\">"); +384 sink.list(); +385for (VulnerableSoftware vs : v.getVulnerableSoftware()) { +386 sink.listItem(); +387try { +388 sink.link("http://web.nvd.nist.gov/view/vuln/search-results?cpe=" + URLEncoder.encode(vs.getName(), "US-ASCII")); +389 sink.text(vs.getName()); +390 sink.link_(); +391if (vs.hasPreviousVersion()) { +392 sink.text(" and all previous versions."); +393 } +394 } catch (UnsupportedEncodingException ex) { +395 sink.text(vs.getName()); +396if (vs.hasPreviousVersion()) { +397 sink.text(" and all previous versions."); +398 } +399 sink.text(" (http://web.nvd.nist.gov/view/vuln/search-results?cpe=" + vs.getName() + ")"); +400 } +401 +402 sink.listItem_(); +403 } +404 sink.list_(); +405 sink.rawText("</div>"); +406 sink.paragraph_(); +407 } +408 } +409 } +410 } +411 +412/** +413 * Writes the identifiers to the site report. +414 * +415 * @param d the dependency +416 * @param sink the sink to write the data to +417 */ +418privatevoid writeSiteReportDependencyIdentifiers(Dependency d, Sink sink) { +419if (d.getIdentifiers() != null && !d.getIdentifiers().isEmpty()) { +420 sink.sectionTitle4(); +421 sink.text("Identifiers"); +422 sink.sectionTitle4_(); +423 sink.list(); +424for (Identifier i : d.getIdentifiers()) { +425 sink.listItem(); +426 sink.text(i.getType()); +427 sink.text(": "); +428if (i.getUrl() != null && i.getUrl().length() > 0) { +429 sink.link(i.getUrl()); +430 sink.text(i.getValue()); +431 sink.link_(); +432 } else { +433 sink.text(i.getValue()); +434 } +435if (i.getDescription() != null && i.getDescription().length() > 0) { +436 sink.lineBreak(); +437 sink.text(i.getDescription()); +438 } +439 sink.listItem_(); +440 } +441 sink.list_(); +442 } +443 } +444 +445/** +446 * Writes the related dependencies to the site report. +447 * +448 * @param d the dependency +449 * @param sink the sink to write the data to +450 * @param collapsibleHeaderCount the collapsible header count +451 * @return the collapsible header count +452 */ +453privateint writeSiteReportDependencyRelatedDependencies(Dependency d, int collapsibleHeaderCount, Sink sink) { +454int cnt = collapsibleHeaderCount; +455if (d.getRelatedDependencies() != null && !d.getRelatedDependencies().isEmpty()) { +456 cnt += 1; +457 sink.sectionTitle4(); +458 sink.rawText("Related Dependencies <a href=\"javascript:toggleElement(this, 'related" + cnt + "')\">[+]</a>"); +459 sink.sectionTitle4_(); +460 sink.rawText("<div id=\"related" + cnt + "\" style=\"display:none\">"); +461 sink.list(); +462for (Dependency r : d.getRelatedDependencies()) { +463 sink.listItem(); +464 sink.text(r.getFileName()); +465 sink.list(); +466 writeListItem(sink, "File Path: " + r.getFilePath()); +467 writeListItem(sink, "SHA1: " + r.getSha1sum()); +468 writeListItem(sink, "MD5: " + r.getMd5sum()); +469 sink.list_(); +470 sink.listItem_(); +471 } +472 sink.list_(); +473 sink.rawText("</div>"); +474 } +475return cnt; +476 } +477 +478/** +479 * Writes the evidence used to the site report. +480 * +481 * @param d the dependency +482 * @param sink the sink to write the data to +483 * @param collapsibleHeaderCount the collapsible header count +484 * @return the collapsible header count +485 */ +486privateint writeSiteReportDependencyEvidenceUsed(Dependency d, int collapsibleHeaderCount, Sink sink) { +487int cnt = collapsibleHeaderCount; +488if (d.getEvidenceUsed() != null && d.getEvidenceUsed().size() > 0) { +489 cnt += 1; +490 sink.sectionTitle4(); +491 sink.rawText("Evidence Collected <a href=\"javascript:toggleElement(this, 'evidence" + cnt + "')\">[+]</a>"); +492 sink.sectionTitle4_(); +493 sink.rawText("<div id=\"evidence" + cnt + "\" style=\"display:none\">"); +494 sink.table(); +495 sink.tableRow(); +496 writeTableHeaderCell(sink, "Source"); +497 writeTableHeaderCell(sink, "Name"); +498 writeTableHeaderCell(sink, "Value"); +499 sink.tableRow_(); +500for (Evidence e : d.getEvidenceUsed()) { +501 sink.tableRow(); +502 writeTableCell(sink, e.getSource()); +503 writeTableCell(sink, e.getName()); +504 writeTableCell(sink, e.getValue()); +505 sink.tableRow_(); +506 } +507 sink.table_(); +508 sink.rawText("</div>"); 509 } -510if (d.getLicense() != null && d.getLicense().length() > 0) { -511 sink.paragraph(); -512 sink.bold(); -513 sink.text("License: "); -514 sink.bold_(); -515if (d.getLicense().startsWith("http://") && !d.getLicense().contains(" ")) { -516 sink.link(d.getLicense()); -517 sink.text(d.getLicense()); -518 sink.link_(); -519 } else { -520 sink.text(d.getLicense()); -521 } -522 sink.paragraph_(); -523 } -524 } -525 -526/** -527 * Adds a list item to the site report. -528 * -529 * @param sink the sink to write the data to -530 * @param text the text to write -531 */ -532privatevoid writeListItem(Sink sink, String text) { -533 sink.listItem(); -534 sink.text(text); -535 sink.listItem_(); -536 } -537 -538/** -539 * Adds a table cell to the site report. -540 * -541 * @param sink the sink to write the data to -542 * @param text the text to write -543 */ -544privatevoid writeTableCell(Sink sink, String text) { -545 sink.tableCell(); -546 sink.text(text); -547 sink.tableCell_(); -548 } -549 -550/** -551 * Adds a table header cell to the site report. -552 * -553 * @param sink the sink to write the data to -554 * @param text the text to write -555 */ -556privatevoid writeTableHeaderCell(Sink sink, String text) { -557 sink.tableHeaderCell(); -558 sink.text(text); -559 sink.tableHeaderCell_(); -560 } -561 -562/** -563 * Writes the TOC for the site report. -564 * -565 * @param sink the sink to write the data to -566 * @param dependencies the dependencies that are being reported on -567 */ -568privatevoid writeSiteReportTOC(Sink sink, final List<Dependency> dependencies) { -569 sink.list(); -570for (Dependency d : dependencies) { -571 sink.listItem(); -572 sink.link("#sha1" + d.getSha1sum()); -573 sink.text(d.getFileName()); -574 sink.link_(); -575if (!d.getVulnerabilities().isEmpty()) { -576 sink.rawText(" <font style=\"color:red\">•</font>"); -577 } -578if (!d.getRelatedDependencies().isEmpty()) { -579 sink.list(); -580for (Dependency r : d.getRelatedDependencies()) { -581 writeListItem(sink, r.getFileName()); -582 } -583 sink.list_(); -584 } -585 sink.listItem_(); -586 } -587 sink.list_(); +510return cnt; +511 } +512 +513/** +514 * Writes the analysis exceptions generated during analysis to the site report. +515 * +516 * @param d the dependency +517 * @param sink the sink to write the data to +518 * @param collapsibleHeaderCount the collapsible header count +519 * @return the collapsible header count +520 */ +521privateint writeSiteReportDependencyAnalysisExceptions(Dependency d, int collapsibleHeaderCount, Sink sink) { +522int cnt = collapsibleHeaderCount; +523if (d.getAnalysisExceptions() != null && !d.getAnalysisExceptions().isEmpty()) { +524 cnt += 1; +525 sink.sectionTitle4(); +526 sink.rawText("<font style=\"color:red\">Errors occurred during analysis:</font> <a href=\"javascript:toggleElement(this, 'errors" +527 + cnt + "')\">[+]</a>"); +528 sink.sectionTitle4_(); +529 sink.rawText("<div id=\"errors" + cnt + "\">"); +530 sink.list(); +531for (Exception e : d.getAnalysisExceptions()) { +532 sink.listItem(); +533 sink.text(e.getMessage()); +534 sink.listItem_(); +535 } +536 sink.list_(); +537 sink.rawText("</div>"); +538 } +539return cnt; +540 } +541 +542/** +543 * Writes the dependency header to the site report. +544 * +545 * @param d the dependency +546 * @param sink the sink to write the data to +547 */ +548privatevoid writeSiteReportDependencyHeader(Sink sink, Dependency d) { +549 sink.sectionTitle2(); +550 sink.anchor("sha1" + d.getSha1sum()); +551 sink.text(d.getFileName()); +552 sink.anchor_(); +553 sink.sectionTitle2_(); +554if (d.getDescription() != null && d.getDescription().length() > 0) { +555 sink.paragraph(); +556 sink.bold(); +557 sink.text("Description: "); +558 sink.bold_(); +559 sink.text(d.getDescription()); +560 sink.paragraph_(); +561 } +562if (d.getLicense() != null && d.getLicense().length() > 0) { +563 sink.paragraph(); +564 sink.bold(); +565 sink.text("License: "); +566 sink.bold_(); +567if (d.getLicense().startsWith("http://") && !d.getLicense().contains(" ")) { +568 sink.link(d.getLicense()); +569 sink.text(d.getLicense()); +570 sink.link_(); +571 } else { +572 sink.text(d.getLicense()); +573 } +574 sink.paragraph_(); +575 } +576 } +577 +578/** +579 * Adds a list item to the site report. +580 * +581 * @param sink the sink to write the data to +582 * @param text the text to write +583 */ +584privatevoid writeListItem(Sink sink, String text) { +585 sink.listItem(); +586 sink.text(text); +587 sink.listItem_(); 588 } 589590/** -591 * Writes the site report header. +591 * Adds a table cell to the site report.592 *593 * @param sink the sink to write the data to -594 * @param projectName the name of the project +594 * @param text the text to write595 */ -596privatevoid writeSiteReportHeader(Sink sink, String projectName) { -597 sink.head(); -598 sink.title(); -599 sink.text("Dependency-Check Report: " + projectName); -600 sink.title_(); -601 sink.head_(); -602 sink.body(); -603 sink.rawText("<script type=\"text/javascript\">"); -604 sink.rawText("function toggleElement(el, targetId) {"); -605 sink.rawText("if (el.innerText == '[+]') {"); -606 sink.rawText(" el.innerText = '[-]';"); -607 sink.rawText(" document.getElementById(targetId).style.display='block';"); -608 sink.rawText("} else {"); -609 sink.rawText(" el.innerText = '[+]';"); -610 sink.rawText(" document.getElementById(targetId).style.display='none';"); -611 sink.rawText("}"); -612 -613 sink.rawText("}"); -614 sink.rawText("</script>"); -615 sink.section1(); -616 sink.sectionTitle1(); -617 sink.text("Project: " + projectName); -618 sink.sectionTitle1_(); -619 sink.date(); -620final Date now = new Date(); -621 sink.text(DateFormat.getDateTimeInstance().format(now)); -622 sink.date_(); -623 sink.section1_(); -624 } -625// </editor-fold> -626 -627/** -628 * Takes the properties supplied and updates the dependency-check settings. -629 * Additionally, this sets the system properties required to change the -630 * proxy url, port, and connection timeout. -631 */ -632privatevoid populateSettings() { -633 InputStream mojoProperties = null; -634try { -635 mojoProperties = this.getClass().getClassLoader().getResourceAsStream(PROPERTIES_FILE); -636 Settings.mergeProperties(mojoProperties); -637 } catch (IOException ex) { -638 Logger.getLogger(DependencyCheckMojo.class.getName()).log(Level.WARNING, "Unable to load the dependency-check ant task.properties file."); -639 Logger.getLogger(DependencyCheckMojo.class.getName()).log(Level.FINE, null, ex); -640 } finally { -641if (mojoProperties != null) { -642try { -643 mojoProperties.close(); -644 } catch (IOException ex) { -645 Logger.getLogger(DependencyCheckMojo.class.getName()).log(Level.FINEST, null, ex); -646 } -647 } -648 } -649 -650 Settings.setBoolean(Settings.KEYS.AUTO_UPDATE, autoUpdate); -651 -652if (proxyUrl != null && !proxyUrl.isEmpty()) { -653 Settings.setString(Settings.KEYS.PROXY_URL, proxyUrl); -654 } -655if (proxyPort != null && !proxyPort.isEmpty()) { -656 Settings.setString(Settings.KEYS.PROXY_PORT, proxyPort); -657 } -658if (proxyUsername != null && !proxyUsername.isEmpty()) { -659 Settings.setString(Settings.KEYS.PROXY_USERNAME, proxyUsername); -660 } -661if (proxyPassword != null && !proxyPassword.isEmpty()) { -662 Settings.setString(Settings.KEYS.PROXY_PASSWORD, proxyPassword); -663 } -664if (connectionTimeout != null && !connectionTimeout.isEmpty()) { -665 Settings.setString(Settings.KEYS.CONNECTION_TIMEOUT, connectionTimeout); -666 } -667if (suppressionFile != null && !suppressionFile.isEmpty()) { -668 Settings.setString(Settings.KEYS.SUPPRESSION_FILE, suppressionFile); -669 } -670 } -671 -672/** -673 * Executes the dependency-check and generates the report. -674 * -675 * @throws MojoExecutionException if a maven exception occurs -676 * @throws MojoFailureException thrown if a CVSS score is found that is -677 * higher then the configured level -678 */ -679publicvoid execute() throws MojoExecutionException, MojoFailureException { -680final Engine engine = executeDependencyCheck(); -681 generateExternalReports(engine); -682if (this.failBuildOnCVSS <= 10) { -683 checkForFailure(engine.getDependencies()); -684 } -685if (this.showSummary) { -686 showSummary(engine.getDependencies()); -687 } -688 } -689 -690/** -691 * Generates the Dependency-Check Site Report. -692 * -693 * @param sink the sink to write the report to -694 * @param locale the locale to use when generating the report -695 * @throws MavenReportException if a Maven report exception occurs -696 */ -697publicvoid generate(@SuppressWarnings("deprecation") org.codehaus.doxia.sink.Sink sink, -698 Locale locale) throws MavenReportException { -699 generate((Sink) sink, null, locale); -700 } -701 -702/** -703 * Generates the Dependency-Check Site Report. -704 * -705 * @param sink the sink to write the report to -706 * @param sinkFactory the sink factory -707 * @param locale the locale to use when generating the report -708 * @throws MavenReportException if a maven report exception occurs -709 */ -710publicvoid generate(Sink sink, SinkFactory sinkFactory, Locale locale) throws MavenReportException { -711final Engine engine = executeDependencyCheck(); -712 generateMavenSiteReport(engine, sink); -713 } -714 -715// <editor-fold defaultstate="collapsed" desc="required setter/getter methods"> -716/** -717 * Returns the output name. -718 * -719 * @return the output name -720 */ -721public String getOutputName() { -722return reportName; -723 } -724 -725/** -726 * Returns the category name. -727 * -728 * @return the category name -729 */ -730public String getCategoryName() { -731return MavenReport.CATEGORY_PROJECT_REPORTS; -732 } -733 -734/** -735 * Returns the report name. -736 * -737 * @param locale the location -738 * @return the report name -739 */ -740public String getName(Locale locale) { -741return name; -742 } -743 -744/** -745 * Sets the Reporting output directory. -746 * -747 * @param directory the output directory -748 */ -749publicvoid setReportOutputDirectory(File directory) { -750 reportOutputDirectory = directory; -751 } -752 -753/** -754 * Returns the output directory. -755 * -756 * @return the output directory -757 */ -758public File getReportOutputDirectory() { -759return reportOutputDirectory; -760 } -761 -762/** -763 * Gets the description of the Dependency-Check report to be displayed in -764 * the Maven Generated Reports page. -765 * -766 * @param locale The Locale to get the description for -767 * @return the description -768 */ -769public String getDescription(Locale locale) { -770return description; -771 } -772 -773/** -774 * Returns whether this is an external report. -775 * -776 * @return true or false; -777 */ -778publicboolean isExternalReport() { -779return externalReport; -780 } -781 -782/** -783 * Returns whether or not the plugin can generate a report. -784 * -785 * @return true -786 */ -787publicboolean canGenerateReport() { -788returntrue; -789 } -790// </editor-fold> -791 -792/** -793 * Checks to see if a vulnerability has been identified with a CVSS score -794 * that is above the threshold set in the configuration. -795 * -796 * @param dependencies the list of dependency objects -797 * @throws MojoFailureException thrown if a CVSS score is found that is -798 * higher then the threshold set -799 */ -800privatevoid checkForFailure(List<Dependency> dependencies) throws MojoFailureException { -801final StringBuilder ids = new StringBuilder(); -802for (Dependency d : dependencies) { -803for (Vulnerability v : d.getVulnerabilities()) { -804if (v.getCvssScore() >= failBuildOnCVSS) { -805if (ids.length() == 0) { -806 ids.append(v.getName()); -807 } else { -808 ids.append(", ").append(v.getName()); -809 } -810 } -811 } -812 } -813if (ids.length() > 0) { -814final String msg = String.format("%n%nDependency-Check Failure:%n" -815 + "One or more dependencies were identified with vulnerabilities that have a CVSS score greater then '%.1f': %s%n" -816 + "See the dependency-check report for more details.%n%n", failBuildOnCVSS, ids.toString()); -817thrownew MojoFailureException(msg); -818 } -819 } -820 -821/** -822 * Generates a warning message listing a summary of dependencies and their -823 * associated CPE and CVE entries. +596privatevoid writeTableCell(Sink sink, String text) { +597 sink.tableCell(); +598 sink.text(text); +599 sink.tableCell_(); +600 } +601 +602/** +603 * Adds a table header cell to the site report. +604 * +605 * @param sink the sink to write the data to +606 * @param text the text to write +607 */ +608privatevoid writeTableHeaderCell(Sink sink, String text) { +609 sink.tableHeaderCell(); +610 sink.text(text); +611 sink.tableHeaderCell_(); +612 } +613 +614/** +615 * Writes the TOC for the site report. +616 * +617 * @param sink the sink to write the data to +618 * @param dependencies the dependencies that are being reported on +619 */ +620privatevoid writeSiteReportTOC(Sink sink, final List<Dependency> dependencies) { +621 sink.list(); +622for (Dependency d : dependencies) { +623 sink.listItem(); +624 sink.link("#sha1" + d.getSha1sum()); +625 sink.text(d.getFileName()); +626 sink.link_(); +627if (!d.getVulnerabilities().isEmpty()) { +628 sink.rawText(" <font style=\"color:red\">•</font>"); +629 } +630if (!d.getRelatedDependencies().isEmpty()) { +631 sink.list(); +632for (Dependency r : d.getRelatedDependencies()) { +633 writeListItem(sink, r.getFileName()); +634 } +635 sink.list_(); +636 } +637 sink.listItem_(); +638 } +639 sink.list_(); +640 } +641 +642/** +643 * Writes the site report header. +644 * +645 * @param sink the sink to write the data to +646 * @param projectName the name of the project +647 */ +648privatevoid writeSiteReportHeader(Sink sink, String projectName) { +649 sink.head(); +650 sink.title(); +651 sink.text("Dependency-Check Report: " + projectName); +652 sink.title_(); +653 sink.head_(); +654 sink.body(); +655 sink.rawText("<script type=\"text/javascript\">"); +656 sink.rawText("function toggleElement(el, targetId) {"); +657 sink.rawText("if (el.innerText == '[+]') {"); +658 sink.rawText(" el.innerText = '[-]';"); +659 sink.rawText(" document.getElementById(targetId).style.display='block';"); +660 sink.rawText("} else {"); +661 sink.rawText(" el.innerText = '[+]';"); +662 sink.rawText(" document.getElementById(targetId).style.display='none';"); +663 sink.rawText("}"); +664 +665 sink.rawText("}"); +666 sink.rawText("</script>"); +667 sink.section1(); +668 sink.sectionTitle1(); +669 sink.text("Project: " + projectName); +670 sink.sectionTitle1_(); +671 sink.date(); +672final Date now = new Date(); +673 sink.text(DateFormat.getDateTimeInstance().format(now)); +674 sink.date_(); +675 sink.section1_(); +676 } +677// </editor-fold> +678 +679/** +680 * Takes the properties supplied and updates the dependency-check settings. Additionally, this sets the system +681 * properties required to change the proxy url, port, and connection timeout. +682 */ +683privatevoid populateSettings() { +684 InputStream mojoProperties = null; +685try { +686 mojoProperties = this.getClass().getClassLoader().getResourceAsStream(PROPERTIES_FILE); +687 Settings.mergeProperties(mojoProperties); +688 } catch (IOException ex) { +689 Logger.getLogger(DependencyCheckMojo.class.getName()).log(Level.WARNING, "Unable to load the dependency-check ant task.properties file."); +690 Logger.getLogger(DependencyCheckMojo.class.getName()).log(Level.FINE, null, ex); +691 } finally { +692if (mojoProperties != null) { +693try { +694 mojoProperties.close(); +695 } catch (IOException ex) { +696 Logger.getLogger(DependencyCheckMojo.class.getName()).log(Level.FINEST, null, ex); +697 } +698 } +699 } +700 +701 Settings.setBoolean(Settings.KEYS.AUTO_UPDATE, autoUpdate); +702 +703if (proxyUrl != null && !proxyUrl.isEmpty()) { +704 Settings.setString(Settings.KEYS.PROXY_URL, proxyUrl); +705 } +706if (proxyPort != null && !proxyPort.isEmpty()) { +707 Settings.setString(Settings.KEYS.PROXY_PORT, proxyPort); +708 } +709if (proxyUsername != null && !proxyUsername.isEmpty()) { +710 Settings.setString(Settings.KEYS.PROXY_USERNAME, proxyUsername); +711 } +712if (proxyPassword != null && !proxyPassword.isEmpty()) { +713 Settings.setString(Settings.KEYS.PROXY_PASSWORD, proxyPassword); +714 } +715if (connectionTimeout != null && !connectionTimeout.isEmpty()) { +716 Settings.setString(Settings.KEYS.CONNECTION_TIMEOUT, connectionTimeout); +717 } +718if (suppressionFile != null && !suppressionFile.isEmpty()) { +719 Settings.setString(Settings.KEYS.SUPPRESSION_FILE, suppressionFile); +720 } +721 Settings.setBoolean(Settings.KEYS.ANALYZER_NEXUS_ENABLED, nexusAnalyzerEnabled); +722if (nexusUrl != null && !nexusUrl.isEmpty()) { +723 Settings.setString(Settings.KEYS.ANALYZER_NEXUS_URL, nexusUrl); +724 } +725if (databaseDriverName != null && !databaseDriverName.isEmpty()) { +726 Settings.setString(Settings.KEYS.DB_DRIVER_NAME, databaseDriverName); +727 } +728if (databaseDriverPath != null && !databaseDriverPath.isEmpty()) { +729 Settings.setString(Settings.KEYS.DB_DRIVER_PATH, databaseDriverPath); +730 } +731if (connectionString != null && !connectionString.isEmpty()) { +732 Settings.setString(Settings.KEYS.DB_CONNECTION_STRING, connectionString); +733 } +734if (databaseUser != null && !databaseUser.isEmpty()) { +735 Settings.setString(Settings.KEYS.DB_USER, databaseUser); +736 } +737if (databasePassword != null && !databasePassword.isEmpty()) { +738 Settings.setString(Settings.KEYS.DB_PASSWORD, databasePassword); +739 } +740 } +741 +742/** +743 * Executes the dependency-check and generates the report. +744 * +745 * @throws MojoExecutionException if a maven exception occurs +746 * @throws MojoFailureException thrown if a CVSS score is found that is higher then the configured level +747 */ +748publicvoid execute() throws MojoExecutionException, MojoFailureException { +749final Engine engine = executeDependencyCheck(); +750 generateExternalReports(engine); +751if (this.failBuildOnCVSS <= 10) { +752 checkForFailure(engine.getDependencies()); +753 } +754if (this.showSummary) { +755 showSummary(engine.getDependencies()); +756 } +757 } +758 +759/** +760 * Generates the Dependency-Check Site Report. +761 * +762 * @param sink the sink to write the report to +763 * @param locale the locale to use when generating the report +764 * @throws MavenReportException if a Maven report exception occurs +765 */ +766publicvoid generate(@SuppressWarnings("deprecation") org.codehaus.doxia.sink.Sink sink, +767 Locale locale) throws MavenReportException { +768 generate((Sink) sink, null, locale); +769 } +770 +771/** +772 * Generates the Dependency-Check Site Report. +773 * +774 * @param sink the sink to write the report to +775 * @param sinkFactory the sink factory +776 * @param locale the locale to use when generating the report +777 * @throws MavenReportException if a maven report exception occurs +778 */ +779publicvoid generate(Sink sink, SinkFactory sinkFactory, Locale locale) throws MavenReportException { +780final Engine engine = executeDependencyCheck(); +781 generateMavenSiteReport(engine, sink); +782 } +783 +784// <editor-fold defaultstate="collapsed" desc="required setter/getter methods"> +785/** +786 * Returns the output name. +787 * +788 * @return the output name +789 */ +790public String getOutputName() { +791return reportName; +792 } +793 +794/** +795 * Returns the category name. +796 * +797 * @return the category name +798 */ +799public String getCategoryName() { +800return MavenReport.CATEGORY_PROJECT_REPORTS; +801 } +802 +803/** +804 * Returns the report name. +805 * +806 * @param locale the location +807 * @return the report name +808 */ +809public String getName(Locale locale) { +810return name; +811 } +812 +813/** +814 * Sets the Reporting output directory. +815 * +816 * @param directory the output directory +817 */ +818publicvoid setReportOutputDirectory(File directory) { +819 reportOutputDirectory = directory; +820 } +821 +822/** +823 * Returns the output directory.824 * -825 * @param dependencies a list of dependency objects +825 * @return the output directory826 */ -827privatevoid showSummary(List<Dependency> dependencies) { -828final StringBuilder summary = new StringBuilder(); -829for (Dependency d : dependencies) { -830boolean firstEntry = true; -831final StringBuilder ids = new StringBuilder(); -832for (Vulnerability v : d.getVulnerabilities()) { -833if (firstEntry) { -834 firstEntry = false; -835 } else { -836 ids.append(", "); -837 } -838 ids.append(v.getName()); -839 } -840if (ids.length() > 0) { -841 summary.append(d.getFileName()).append(" ("); -842 firstEntry = true; -843for (Identifier id : d.getIdentifiers()) { -844if (firstEntry) { -845 firstEntry = false; -846 } else { -847 summary.append(", "); -848 } -849 summary.append(id.getValue()); -850 } -851 summary.append(") : ").append(ids).append(NEW_LINE); -852 } -853 } -854if (summary.length() > 0) { -855final String msg = String.format("%n%n" -856 + "One or more dependencies were identified with known vulnerabilities:%n%n%s" -857 + "%n%nSee the dependency-check report for more details.%n%n", summary.toString()); -858 Logger.getLogger(DependencyCheckMojo.class.getName()).log(Level.WARNING, msg); -859 } -860 } -861 } +827public File getReportOutputDirectory() { +828return reportOutputDirectory; +829 } +830 +831/** +832 * Gets the description of the Dependency-Check report to be displayed in the Maven Generated Reports page. +833 * +834 * @param locale The Locale to get the description for +835 * @return the description +836 */ +837public String getDescription(Locale locale) { +838return description; +839 } +840 +841/** +842 * Returns whether this is an external report. +843 * +844 * @return true or false; +845 */ +846publicboolean isExternalReport() { +847return externalReport; +848 } +849 +850/** +851 * Returns whether or not the plugin can generate a report. +852 * +853 * @return true +854 */ +855publicboolean canGenerateReport() { +856returntrue; +857 } +858// </editor-fold> +859 +860/** +861 * Checks to see if a vulnerability has been identified with a CVSS score that is above the threshold set in the +862 * configuration. +863 * +864 * @param dependencies the list of dependency objects +865 * @throws MojoFailureException thrown if a CVSS score is found that is higher then the threshold set +866 */ +867privatevoid checkForFailure(List<Dependency> dependencies) throws MojoFailureException { +868final StringBuilder ids = new StringBuilder(); +869for (Dependency d : dependencies) { +870for (Vulnerability v : d.getVulnerabilities()) { +871if (v.getCvssScore() >= failBuildOnCVSS) { +872if (ids.length() == 0) { +873 ids.append(v.getName()); +874 } else { +875 ids.append(", ").append(v.getName()); +876 } +877 } +878 } +879 } +880if (ids.length() > 0) { +881final String msg = String.format("%n%nDependency-Check Failure:%n" +882 + "One or more dependencies were identified with vulnerabilities that have a CVSS score greater then '%.1f': %s%n" +883 + "See the dependency-check report for more details.%n%n", failBuildOnCVSS, ids.toString()); +884thrownew MojoFailureException(msg); +885 } +886 } +887 +888/** +889 * Generates a warning message listing a summary of dependencies and their associated CPE and CVE entries. +890 * +891 * @param dependencies a list of dependency objects +892 */ +893privatevoid showSummary(List<Dependency> dependencies) { +894final StringBuilder summary = new StringBuilder(); +895for (Dependency d : dependencies) { +896boolean firstEntry = true; +897final StringBuilder ids = new StringBuilder(); +898for (Vulnerability v : d.getVulnerabilities()) { +899if (firstEntry) { +900 firstEntry = false; +901 } else { +902 ids.append(", "); +903 } +904 ids.append(v.getName()); +905 } +906if (ids.length() > 0) { +907 summary.append(d.getFileName()).append(" ("); +908 firstEntry = true; +909for (Identifier id : d.getIdentifiers()) { +910if (firstEntry) { +911 firstEntry = false; +912 } else { +913 summary.append(", "); +914 } +915 summary.append(id.getValue()); +916 } +917 summary.append(") : ").append(ids).append(NEW_LINE); +918 } +919 } +920if (summary.length() > 0) { +921final String msg = String.format("%n%n" +922 + "One or more dependencies were identified with known vulnerabilities:%n%n%s" +923 + "%n%nSee the dependency-check report for more details.%n%n", summary.toString()); +924 Logger.getLogger(DependencyCheckMojo.class.getName()).log(Level.WARNING, msg); +925 } +926 } +927 }
    diff --git a/dependency-check-maven/xref/org/owasp/dependencycheck/maven/package-frame.html b/dependency-check-maven/xref/org/owasp/dependencycheck/maven/package-frame.html index 640a7059e..8e673cd31 100644 --- a/dependency-check-maven/xref/org/owasp/dependencycheck/maven/package-frame.html +++ b/dependency-check-maven/xref/org/owasp/dependencycheck/maven/package-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Maven Plugin 1.0.8 Reference Package org.owasp.dependencycheck.maven + Dependency-Check Maven Plugin 1.1.0 Reference Package org.owasp.dependencycheck.maven diff --git a/dependency-check-maven/xref/org/owasp/dependencycheck/maven/package-summary.html b/dependency-check-maven/xref/org/owasp/dependencycheck/maven/package-summary.html index 3643b2f1a..14b00f4b8 100644 --- a/dependency-check-maven/xref/org/owasp/dependencycheck/maven/package-summary.html +++ b/dependency-check-maven/xref/org/owasp/dependencycheck/maven/package-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Maven Plugin 1.0.8 Reference Package org.owasp.dependencycheck.maven + Dependency-Check Maven Plugin 1.1.0 Reference Package org.owasp.dependencycheck.maven diff --git a/dependency-check-maven/xref/overview-frame.html b/dependency-check-maven/xref/overview-frame.html index 5dc90ee2a..735ee4fd5 100644 --- a/dependency-check-maven/xref/overview-frame.html +++ b/dependency-check-maven/xref/overview-frame.html @@ -3,7 +3,7 @@ - Dependency-Check Maven Plugin 1.0.8 Reference + Dependency-Check Maven Plugin 1.1.0 Reference diff --git a/dependency-check-maven/xref/overview-summary.html b/dependency-check-maven/xref/overview-summary.html index 40e8fdafc..8e9cdcba3 100644 --- a/dependency-check-maven/xref/overview-summary.html +++ b/dependency-check-maven/xref/overview-summary.html @@ -3,7 +3,7 @@ - Dependency-Check Maven Plugin 1.0.8 Reference + Dependency-Check Maven Plugin 1.1.0 Reference @@ -24,7 +24,7 @@ -

    Dependency-Check Maven Plugin 1.0.8 Reference

    +

    Dependency-Check Maven Plugin 1.1.0 Reference

    diff --git a/index.html b/index.html index 883ac5640..ba41e7012 100644 --- a/index.html +++ b/index.html @@ -1,13 +1,13 @@ - + dependency-check - About @@ -62,8 +62,8 @@ -
  • Last Published: 2014-01-16
  • |
    • -
  • Version: 1.0.8
    • +
  • Last Published: 2014-01-26
  • |
    • +
  • Version: 1.1.0
    • @@ -146,6 +146,27 @@ False Positives + + +
  • + + + + Project Presentation (pptx) +
    • + +
  • + + + + Project Presentation (pdf) +
    • + +
  • + + + + Sample Report
  • Modules
    • diff --git a/issue-tracking.html b/issue-tracking.html index 665a04838..c4ccc5367 100644 --- a/issue-tracking.html +++ b/issue-tracking.html @@ -1,13 +1,13 @@ - + dependency-check - Issue Tracking @@ -62,8 +62,8 @@ -
  • Last Published: 2014-01-16
  • |
    • -
  • Version: 1.0.8
    • +
  • Last Published: 2014-01-26
  • |
    • +
  • Version: 1.1.0
    • @@ -146,6 +146,27 @@ False Positives + + +
  • + + + + Project Presentation (pptx) +
    • + +
  • + + + + Project Presentation (pdf) +
    • + +
  • + + + + Sample Report
  • Modules
    • diff --git a/license.html b/license.html index 6b5aecf55..1aef376d4 100644 --- a/license.html +++ b/license.html @@ -1,13 +1,13 @@ - + dependency-check - Project License @@ -62,8 +62,8 @@ -
  • Last Published: 2014-01-16
  • |
    • -
  • Version: 1.0.8
    • +
  • Last Published: 2014-01-26
  • |
    • +
  • Version: 1.1.0
    • @@ -146,6 +146,27 @@ False Positives + + +
  • + + + + Project Presentation (pptx) +
    • + +
  • + + + + Project Presentation (pdf) +
    • + +
  • + + + + Sample Report
  • Modules
    • @@ -217,682 +238,210 @@

    Project License

    -

    GNU General Public License version 3

    +

    The Apache Software License, Version 2.0

    -
                        GNU GENERAL PUBLIC LICENSE 
-                       Version 3, 29 June 2007
-
- Copyright (C) 2007 Free Software Foundation, Inc. <http://fsf.org/>
- Everyone is permitted to copy and distribute verbatim copies
- of this license document, but changing it is not allowed.
-
-                            Preamble
-
-  The GNU General Public License is a free, copyleft license for
-software and other kinds of works.
-
-  The licenses for most software and other practical works are designed
-to take away your freedom to share and change the works.  By contrast,
-the GNU General Public License is intended to guarantee your freedom to
-share and change all versions of a program--to make sure it remains free
-software for all its users.  We, the Free Software Foundation, use the
-GNU General Public License for most of our software; it applies also to
-any other work released this way by its authors.  You can apply it to
-your programs, too.
-
-  When we speak of free software, we are referring to freedom, not
-price.  Our General Public Licenses are designed to make sure that you
-have the freedom to distribute copies of free software (and charge for
-them if you wish), that you receive source code or can get it if you
-want it, that you can change the software or use pieces of it in new
-free programs, and that you know you can do these things.
-
-  To protect your rights, we need to prevent others from denying you
-these rights or asking you to surrender the rights.  Therefore, you have
-certain responsibilities if you distribute copies of the software, or if
-you modify it: responsibilities to respect the freedom of others.
-
-  For example, if you distribute copies of such a program, whether
-gratis or for a fee, you must pass on to the recipients the same
-freedoms that you received.  You must make sure that they, too, receive
-or can get the source code.  And you must show them these terms so they
-know their rights.
-
-  Developers that use the GNU GPL protect your rights with two steps:
-(1) assert copyright on the software, and (2) offer you this License
-giving you legal permission to copy, distribute and/or modify it.
-
-  For the developers' and authors' protection, the GPL clearly explains
-that there is no warranty for this free software.  For both users' and
-authors' sake, the GPL requires that modified versions be marked as
-changed, so that their problems will not be attributed erroneously to
-authors of previous versions.
-
-  Some devices are designed to deny users access to install or run
-modified versions of the software inside them, although the manufacturer
-can do so.  This is fundamentally incompatible with the aim of
-protecting users' freedom to change the software.  The systematic
-pattern of such abuse occurs in the area of products for individuals to
-use, which is precisely where it is most unacceptable.  Therefore, we
-have designed this version of the GPL to prohibit the practice for those
-products.  If such problems arise substantially in other domains, we
-stand ready to extend this provision to those domains in future versions
-of the GPL, as needed to protect the freedom of users.
-
-  Finally, every program is threatened constantly by software patents.
-States should not allow patents to restrict development and use of
-software on general-purpose computers, but in those that do, we wish to
-avoid the special danger that patents applied to a free program could
-make it effectively proprietary.  To prevent this, the GPL assures that
-patents cannot be used to render the program non-free.
-
-  The precise terms and conditions for copying, distribution and
-modification follow.
-
-                       TERMS AND CONDITIONS
-
-  0. Definitions.
-
-  "This License" refers to version 3 of the GNU General Public License.
-
-  "Copyright" also means copyright-like laws that apply to other kinds of
-works, such as semiconductor masks.
-
-  "The Program" refers to any copyrightable work licensed under this
-License.  Each licensee is addressed as "you".  "Licensees" and
-"recipients" may be individuals or organizations.
-
-  To "modify" a work means to copy from or adapt all or part of the work
-in a fashion requiring copyright permission, other than the making of an
-exact copy.  The resulting work is called a "modified version" of the
-earlier work or a work "based on" the earlier work.
-
-  A "covered work" means either the unmodified Program or a work based
-on the Program.
-
-  To "propagate" a work means to do anything with it that, without
-permission, would make you directly or secondarily liable for
-infringement under applicable copyright law, except executing it on a
-computer or modifying a private copy.  Propagation includes copying,
-distribution (with or without modification), making available to the
-public, and in some countries other activities as well.
-
-  To "convey" a work means any kind of propagation that enables other
-parties to make or receive copies.  Mere interaction with a user through
-a computer network, with no transfer of a copy, is not conveying.
-
-  An interactive user interface displays "Appropriate Legal Notices"
-to the extent that it includes a convenient and prominently visible
-feature that (1) displays an appropriate copyright notice, and (2)
-tells the user that there is no warranty for the work (except to the
-extent that warranties are provided), that licensees may convey the
-work under this License, and how to view a copy of this License.  If
-the interface presents a list of user commands or options, such as a
-menu, a prominent item in the list meets this criterion.
-
-  1. Source Code.
-
-  The "source code" for a work means the preferred form of the work
-for making modifications to it.  "Object code" means any non-source
-form of a work.
-
-  A "Standard Interface" means an interface that either is an official
-standard defined by a recognized standards body, or, in the case of
-interfaces specified for a particular programming language, one that
-is widely used among developers working in that language.
-
-  The "System Libraries" of an executable work include anything, other
-than the work as a whole, that (a) is included in the normal form of
-packaging a Major Component, but which is not part of that Major
-Component, and (b) serves only to enable use of the work with that
-Major Component, or to implement a Standard Interface for which an
-implementation is available to the public in source code form.  A
-"Major Component", in this context, means a major essential component
-(kernel, window system, and so on) of the specific operating system
-(if any) on which the executable work runs, or a compiler used to
-produce the work, or an object code interpreter used to run it.
-
-  The "Corresponding Source" for a work in object code form means all
-the source code needed to generate, install, and (for an executable
-work) run the object code and to modify the work, including scripts to
-control those activities.  However, it does not include the work's
-System Libraries, or general-purpose tools or generally available free
-programs which are used unmodified in performing those activities but
-which are not part of the work.  For example, Corresponding Source
-includes interface definition files associated with source files for
-the work, and the source code for shared libraries and dynamically
-linked subprograms that the work is specifically designed to require,
-such as by intimate data communication or control flow between those
-subprograms and other parts of the work.
-
-  The Corresponding Source need not include anything that users
-can regenerate automatically from other parts of the Corresponding
-Source.
-
-  The Corresponding Source for a work in source code form is that
-same work.
-
-  2. Basic Permissions.
-
-  All rights granted under this License are granted for the term of
-copyright on the Program, and are irrevocable provided the stated
-conditions are met.  This License explicitly affirms your unlimited
-permission to run the unmodified Program.  The output from running a
-covered work is covered by this License only if the output, given its
-content, constitutes a covered work.  This License acknowledges your
-rights of fair use or other equivalent, as provided by copyright law.
-
-  You may make, run and propagate covered works that you do not
-convey, without conditions so long as your license otherwise remains
-in force.  You may convey covered works to others for the sole purpose
-of having them make modifications exclusively for you, or provide you
-with facilities for running those works, provided that you comply with
-the terms of this License in conveying all material for which you do
-not control copyright.  Those thus making or running the covered works
-for you must do so exclusively on your behalf, under your direction
-and control, on terms that prohibit them from making any copies of
-your copyrighted material outside their relationship with you.
-
-  Conveying under any other circumstances is permitted solely under
-the conditions stated below.  Sublicensing is not allowed; section 10
-makes it unnecessary.
-
-  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
-
-  No covered work shall be deemed part of an effective technological
-measure under any applicable law fulfilling obligations under article
-11 of the WIPO copyright treaty adopted on 20 December 1996, or
-similar laws prohibiting or restricting circumvention of such
-measures.
-
-  When you convey a covered work, you waive any legal power to forbid
-circumvention of technological measures to the extent such circumvention
-is effected by exercising rights under this License with respect to
-the covered work, and you disclaim any intention to limit operation or
-modification of the work as a means of enforcing, against the work's
-users, your or third parties' legal rights to forbid circumvention of
-technological measures.
-
-  4. Conveying Verbatim Copies.
-
-  You may convey verbatim copies of the Program's source code as you
-receive it, in any medium, provided that you conspicuously and
-appropriately publish on each copy an appropriate copyright notice;
-keep intact all notices stating that this License and any
-non-permissive terms added in accord with section 7 apply to the code;
-keep intact all notices of the absence of any warranty; and give all
-recipients a copy of this License along with the Program.
-
-  You may charge any price or no price for each copy that you convey,
-and you may offer support or warranty protection for a fee.
-
-  5. Conveying Modified Source Versions.
-
-  You may convey a work based on the Program, or the modifications to
-produce it from the Program, in the form of source code under the
-terms of section 4, provided that you also meet all of these conditions:
-
-    a) The work must carry prominent notices stating that you modified
-    it, and giving a relevant date.
-
-    b) The work must carry prominent notices stating that it is
-    released under this License and any conditions added under section
-    7.  This requirement modifies the requirement in section 4 to
-    "keep intact all notices".
-
-    c) You must license the entire work, as a whole, under this
-    License to anyone who comes into possession of a copy.  This
-    License will therefore apply, along with any applicable section 7
-    additional terms, to the whole of the work, and all its parts,
-    regardless of how they are packaged.  This License gives no
-    permission to license the work in any other way, but it does not
-    invalidate such permission if you have separately received it.
-
-    d) If the work has interactive user interfaces, each must display
-    Appropriate Legal Notices; however, if the Program has interactive
-    interfaces that do not display Appropriate Legal Notices, your
-    work need not make them do so.
-
-  A compilation of a covered work with other separate and independent
-works, which are not by their nature extensions of the covered work,
-and which are not combined with it such as to form a larger program,
-in or on a volume of a storage or distribution medium, is called an
-"aggregate" if the compilation and its resulting copyright are not
-used to limit the access or legal rights of the compilation's users
-beyond what the individual works permit.  Inclusion of a covered work
-in an aggregate does not cause this License to apply to the other
-parts of the aggregate.
-
-  6. Conveying Non-Source Forms.
-
-  You may convey a covered work in object code form under the terms
-of sections 4 and 5, provided that you also convey the
-machine-readable Corresponding Source under the terms of this License,
-in one of these ways:
-
-    a) Convey the object code in, or embodied in, a physical product
-    (including a physical distribution medium), accompanied by the
-    Corresponding Source fixed on a durable physical medium
-    customarily used for software interchange.
-
-    b) Convey the object code in, or embodied in, a physical product
-    (including a physical distribution medium), accompanied by a
-    written offer, valid for at least three years and valid for as
-    long as you offer spare parts or customer support for that product
-    model, to give anyone who possesses the object code either (1) a
-    copy of the Corresponding Source for all the software in the
-    product that is covered by this License, on a durable physical
-    medium customarily used for software interchange, for a price no
-    more than your reasonable cost of physically performing this
-    conveying of source, or (2) access to copy the
-    Corresponding Source from a network server at no charge.
-
-    c) Convey individual copies of the object code with a copy of the
-    written offer to provide the Corresponding Source.  This
-    alternative is allowed only occasionally and noncommercially, and
-    only if you received the object code with such an offer, in accord
-    with subsection 6b.
-
-    d) Convey the object code by offering access from a designated
-    place (gratis or for a charge), and offer equivalent access to the
-    Corresponding Source in the same way through the same place at no
-    further charge.  You need not require recipients to copy the
-    Corresponding Source along with the object code.  If the place to
-    copy the object code is a network server, the Corresponding Source
-    may be on a different server (operated by you or a third party)
-    that supports equivalent copying facilities, provided you maintain
-    clear directions next to the object code saying where to find the
-    Corresponding Source.  Regardless of what server hosts the
-    Corresponding Source, you remain obligated to ensure that it is
-    available for as long as needed to satisfy these requirements.
-
-    e) Convey the object code using peer-to-peer transmission, provided
-    you inform other peers where the object code and Corresponding
-    Source of the work are being offered to the general public at no
-    charge under subsection 6d.
-
-  A separable portion of the object code, whose source code is excluded
-from the Corresponding Source as a System Library, need not be
-included in conveying the object code work.
-
-  A "User Product" is either (1) a "consumer product", which means any
-tangible personal property which is normally used for personal, family,
-or household purposes, or (2) anything designed or sold for incorporation
-into a dwelling.  In determining whether a product is a consumer product,
-doubtful cases shall be resolved in favor of coverage.  For a particular
-product received by a particular user, "normally used" refers to a
-typical or common use of that class of product, regardless of the status
-of the particular user or of the way in which the particular user
-actually uses, or expects or is expected to use, the product.  A product
-is a consumer product regardless of whether the product has substantial
-commercial, industrial or non-consumer uses, unless such uses represent
-the only significant mode of use of the product.
-
-  "Installation Information" for a User Product means any methods,
-procedures, authorization keys, or other information required to install
-and execute modified versions of a covered work in that User Product from
-a modified version of its Corresponding Source.  The information must
-suffice to ensure that the continued functioning of the modified object
-code is in no case prevented or interfered with solely because
-modification has been made.
-
-  If you convey an object code work under this section in, or with, or
-specifically for use in, a User Product, and the conveying occurs as
-part of a transaction in which the right of possession and use of the
-User Product is transferred to the recipient in perpetuity or for a
-fixed term (regardless of how the transaction is characterized), the
-Corresponding Source conveyed under this section must be accompanied
-by the Installation Information.  But this requirement does not apply
-if neither you nor any third party retains the ability to install
-modified object code on the User Product (for example, the work has
-been installed in ROM).
-
-  The requirement to provide Installation Information does not include a
-requirement to continue to provide support service, warranty, or updates
-for a work that has been modified or installed by the recipient, or for
-the User Product in which it has been modified or installed.  Access to a
-network may be denied when the modification itself materially and
-adversely affects the operation of the network or violates the rules and
-protocols for communication across the network.
-
-  Corresponding Source conveyed, and Installation Information provided,
-in accord with this section must be in a format that is publicly
-documented (and with an implementation available to the public in
-source code form), and must require no special password or key for
-unpacking, reading or copying.
-
-  7. Additional Terms.
-
-  "Additional permissions" are terms that supplement the terms of this
-License by making exceptions from one or more of its conditions.
-Additional permissions that are applicable to the entire Program shall
-be treated as though they were included in this License, to the extent
-that they are valid under applicable law.  If additional permissions
-apply only to part of the Program, that part may be used separately
-under those permissions, but the entire Program remains governed by
-this License without regard to the additional permissions.
-
-  When you convey a copy of a covered work, you may at your option
-remove any additional permissions from that copy, or from any part of
-it.  (Additional permissions may be written to require their own
-removal in certain cases when you modify the work.)  You may place
-additional permissions on material, added by you to a covered work,
-for which you have or can give appropriate copyright permission.
-
-  Notwithstanding any other provision of this License, for material you
-add to a covered work, you may (if authorized by the copyright holders of
-that material) supplement the terms of this License with terms:
-
-    a) Disclaiming warranty or limiting liability differently from the
-    terms of sections 15 and 16 of this License; or
-
-    b) Requiring preservation of specified reasonable legal notices or
-    author attributions in that material or in the Appropriate Legal
-    Notices displayed by works containing it; or
-
-    c) Prohibiting misrepresentation of the origin of that material, or
-    requiring that modified versions of such material be marked in
-    reasonable ways as different from the original version; or
-
-    d) Limiting the use for publicity purposes of names of licensors or
-    authors of the material; or
-
-    e) Declining to grant rights under trademark law for use of some
-    trade names, trademarks, or service marks; or
-
-    f) Requiring indemnification of licensors and authors of that
-    material by anyone who conveys the material (or modified versions of
-    it) with contractual assumptions of liability to the recipient, for
-    any liability that these contractual assumptions directly impose on
-    those licensors and authors.
-
-  All other non-permissive additional terms are considered "further
-restrictions" within the meaning of section 10.  If the Program as you
-received it, or any part of it, contains a notice stating that it is
-governed by this License along with a term that is a further
-restriction, you may remove that term.  If a license document contains
-a further restriction but permits relicensing or conveying under this
-License, you may add to a covered work material governed by the terms
-of that license document, provided that the further restriction does
-not survive such relicensing or conveying.
-
-  If you add terms to a covered work in accord with this section, you
-must place, in the relevant source files, a statement of the
-additional terms that apply to those files, or a notice indicating
-where to find the applicable terms.
-
-  Additional terms, permissive or non-permissive, may be stated in the
-form of a separately written license, or stated as exceptions;
-the above requirements apply either way.
-
-  8. Termination.
-
-  You may not propagate or modify a covered work except as expressly
-provided under this License.  Any attempt otherwise to propagate or
-modify it is void, and will automatically terminate your rights under
-this License (including any patent licenses granted under the third
-paragraph of section 11).
-
-  However, if you cease all violation of this License, then your
-license from a particular copyright holder is reinstated (a)
-provisionally, unless and until the copyright holder explicitly and
-finally terminates your license, and (b) permanently, if the copyright
-holder fails to notify you of the violation by some reasonable means
-prior to 60 days after the cessation.
-
-  Moreover, your license from a particular copyright holder is
-reinstated permanently if the copyright holder notifies you of the
-violation by some reasonable means, this is the first time you have
-received notice of violation of this License (for any work) from that
-copyright holder, and you cure the violation prior to 30 days after
-your receipt of the notice.
-
-  Termination of your rights under this section does not terminate the
-licenses of parties who have received copies or rights from you under
-this License.  If your rights have been terminated and not permanently
-reinstated, you do not qualify to receive new licenses for the same
-material under section 10.
-
-  9. Acceptance Not Required for Having Copies.
-
-  You are not required to accept this License in order to receive or
-run a copy of the Program.  Ancillary propagation of a covered work
-occurring solely as a consequence of using peer-to-peer transmission
-to receive a copy likewise does not require acceptance.  However,
-nothing other than this License grants you permission to propagate or
-modify any covered work.  These actions infringe copyright if you do
-not accept this License.  Therefore, by modifying or propagating a
-covered work, you indicate your acceptance of this License to do so.
-
-  10. Automatic Licensing of Downstream Recipients.
-
-  Each time you convey a covered work, the recipient automatically
-receives a license from the original licensors, to run, modify and
-propagate that work, subject to this License.  You are not responsible
-for enforcing compliance by third parties with this License.
-
-  An "entity transaction" is a transaction transferring control of an
-organization, or substantially all assets of one, or subdividing an
-organization, or merging organizations.  If propagation of a covered
-work results from an entity transaction, each party to that
-transaction who receives a copy of the work also receives whatever
-licenses to the work the party's predecessor in interest had or could
-give under the previous paragraph, plus a right to possession of the
-Corresponding Source of the work from the predecessor in interest, if
-the predecessor has it or can get it with reasonable efforts.
-
-  You may not impose any further restrictions on the exercise of the
-rights granted or affirmed under this License.  For example, you may
-not impose a license fee, royalty, or other charge for exercise of
-rights granted under this License, and you may not initiate litigation
-(including a cross-claim or counterclaim in a lawsuit) alleging that
-any patent claim is infringed by making, using, selling, offering for
-sale, or importing the Program or any portion of it.
-
-  11. Patents.
-
-  A "contributor" is a copyright holder who authorizes use under this
-License of the Program or a work on which the Program is based.  The
-work thus licensed is called the contributor's "contributor version".
-
-  A contributor's "essential patent claims" are all patent claims
-owned or controlled by the contributor, whether already acquired or
-hereafter acquired, that would be infringed by some manner, permitted
-by this License, of making, using, or selling its contributor version,
-but do not include claims that would be infringed only as a
-consequence of further modification of the contributor version.  For
-purposes of this definition, "control" includes the right to grant
-patent sublicenses in a manner consistent with the requirements of
-this License.
-
-  Each contributor grants you a non-exclusive, worldwide, royalty-free
-patent license under the contributor's essential patent claims, to
-make, use, sell, offer for sale, import and otherwise run, modify and
-propagate the contents of its contributor version.
-
-  In the following three paragraphs, a "patent license" is any express
-agreement or commitment, however denominated, not to enforce a patent
-(such as an express permission to practice a patent or covenant not to
-sue for patent infringement).  To "grant" such a patent license to a
-party means to make such an agreement or commitment not to enforce a
-patent against the party.
-
-  If you convey a covered work, knowingly relying on a patent license,
-and the Corresponding Source of the work is not available for anyone
-to copy, free of charge and under the terms of this License, through a
-publicly available network server or other readily accessible means,
-then you must either (1) cause the Corresponding Source to be so
-available, or (2) arrange to deprive yourself of the benefit of the
-patent license for this particular work, or (3) arrange, in a manner
-consistent with the requirements of this License, to extend the patent
-license to downstream recipients.  "Knowingly relying" means you have
-actual knowledge that, but for the patent license, your conveying the
-covered work in a country, or your recipient's use of the covered work
-in a country, would infringe one or more identifiable patents in that
-country that you have reason to believe are valid.
-
-  If, pursuant to or in connection with a single transaction or
-arrangement, you convey, or propagate by procuring conveyance of, a
-covered work, and grant a patent license to some of the parties
-receiving the covered work authorizing them to use, propagate, modify
-or convey a specific copy of the covered work, then the patent license
-you grant is automatically extended to all recipients of the covered
-work and works based on it.
-
-  A patent license is "discriminatory" if it does not include within
-the scope of its coverage, prohibits the exercise of, or is
-conditioned on the non-exercise of one or more of the rights that are
-specifically granted under this License.  You may not convey a covered
-work if you are a party to an arrangement with a third party that is
-in the business of distributing software, under which you make payment
-to the third party based on the extent of your activity of conveying
-the work, and under which the third party grants, to any of the
-parties who would receive the covered work from you, a discriminatory
-patent license (a) in connection with copies of the covered work
-conveyed by you (or copies made from those copies), or (b) primarily
-for and in connection with specific products or compilations that
-contain the covered work, unless you entered into that arrangement,
-or that patent license was granted, prior to 28 March 2007.
-
-  Nothing in this License shall be construed as excluding or limiting
-any implied license or other defenses to infringement that may
-otherwise be available to you under applicable patent law.
-
-  12. No Surrender of Others' Freedom.
-
-  If conditions are imposed on you (whether by court order, agreement or
-otherwise) that contradict the conditions of this License, they do not
-excuse you from the conditions of this License.  If you cannot convey a
-covered work so as to satisfy simultaneously your obligations under this
-License and any other pertinent obligations, then as a consequence you may
-not convey it at all.  For example, if you agree to terms that obligate you
-to collect a royalty for further conveying from those to whom you convey
-the Program, the only way you could satisfy both those terms and this
-License would be to refrain entirely from conveying the Program.
-
-  13. Use with the GNU Affero General Public License.
-
-  Notwithstanding any other provision of this License, you have
-permission to link or combine any covered work with a work licensed
-under version 3 of the GNU Affero General Public License into a single
-combined work, and to convey the resulting work.  The terms of this
-License will continue to apply to the part which is the covered work,
-but the special requirements of the GNU Affero General Public License,
-section 13, concerning interaction through a network will apply to the
-combination as such.
-
-  14. Revised Versions of this License.
-
-  The Free Software Foundation may publish revised and/or new versions of
-the GNU General Public License from time to time.  Such new versions will
-be similar in spirit to the present version, but may differ in detail to
-address new problems or concerns.
-
-  Each version is given a distinguishing version number.  If the
-Program specifies that a certain numbered version of the GNU General
-Public License "or any later version" applies to it, you have the
-option of following the terms and conditions either of that numbered
-version or of any later version published by the Free Software
-Foundation.  If the Program does not specify a version number of the
-GNU General Public License, you may choose any version ever published
-by the Free Software Foundation.
-
-  If the Program specifies that a proxy can decide which future
-versions of the GNU General Public License can be used, that proxy's
-public statement of acceptance of a version permanently authorizes you
-to choose that version for the Program.
-
-  Later license versions may give you additional or different
-permissions.  However, no additional obligations are imposed on any
-author or copyright holder as a result of your choosing to follow a
-later version.
-
-  15. Disclaimer of Warranty.
-
-  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
-APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
-HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
-OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
-THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
-PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
-IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
-ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
-
-  16. Limitation of Liability.
-
-  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
-WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
-THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
-GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
-USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
-DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
-PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
-EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
-SUCH DAMAGES.
-
-  17. Interpretation of Sections 15 and 16.
-
-  If the disclaimer of warranty and limitation of liability provided
-above cannot be given local legal effect according to their terms,
-reviewing courts shall apply local law that most closely approximates
-an absolute waiver of all civil liability in connection with the
-Program, unless a warranty or assumption of liability accompanies a
-copy of the Program in return for a fee.
-
-                     END OF TERMS AND CONDITIONS
-
-            How to Apply These Terms to Your New Programs
-
-  If you develop a new program, and you want it to be of the greatest
-possible use to the public, the best way to achieve this is to make it
-free software which everyone can redistribute and change under these terms.
-
-  To do so, attach the following notices to the program.  It is safest
-to attach them to the start of each source file to most effectively
-state the exclusion of warranty; and each file should have at least
-the "copyright" line and a pointer to where the full notice is found.
-
-    <one line to give the program's name and a brief idea of what it does.>
-    Copyright (C) <year>  <name of author>
-
-    This program is free software: you can redistribute it and/or modify
-    it under the terms of the GNU General Public License as published by
-    the Free Software Foundation, either version 3 of the License, or
-    (at your option) any later version.
-
-    This program is distributed in the hope that it will be useful,
-    but WITHOUT ANY WARRANTY; without even the implied warranty of
-    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-    GNU General Public License for more details.
-
-    You should have received a copy of the GNU General Public License
-    along with this program.  If not, see <http://www.gnu.org/licenses/>.
-
-Also add information on how to contact you by electronic and paper mail.
-
-  If the program does terminal interaction, make it output a short
-notice like this when it starts in an interactive mode:
-
-    <program>  Copyright (C) <year>  <name of author>
-    This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
-    This is free software, and you are welcome to redistribute it
-    under certain conditions; type `show c' for details.
-
-The hypothetical commands `show w' and `show c' should show the appropriate
-parts of the General Public License.  Of course, your program's commands
-might be different; for a GUI interface, you would use an "about box".
-
-  You should also get your employer (if you work as a programmer) or school,
-if any, to sign a "copyright disclaimer" for the program, if necessary.
-For more information on this, and how to apply and follow the GNU GPL, see
-<http://www.gnu.org/licenses/>.
-
-  The GNU General Public License does not permit incorporating your program
-into proprietary programs.  If your program is a subroutine library, you
-may consider it more useful to permit linking proprietary applications with
-the library.  If this is what you want to do, use the GNU Lesser General
-Public License instead of this License.  But first, please read
-<http://www.gnu.org/philosophy/why-not-lgpl.html>.
+
    +                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
    diff --git a/mail-lists.html b/mail-lists.html index 897cb48df..e4e3cb20a 100644 --- a/mail-lists.html +++ b/mail-lists.html @@ -1,13 +1,13 @@ - + dependency-check - Project Mailing Lists @@ -62,8 +62,8 @@ -
  • Last Published: 2014-01-16
  • |
    • -
  • Version: 1.0.8
    • +
  • Last Published: 2014-01-26
  • |
    • +
  • Version: 1.1.0
    • @@ -146,6 +146,27 @@ False Positives + + +
  • + + + + Project Presentation (pptx) +
    • + +
  • + + + + Project Presentation (pdf) +
    • + +
  • + + + + Sample Report
  • Modules
    • diff --git a/modules.html b/modules.html index bd3bc327a..2e9c47b40 100644 --- a/modules.html +++ b/modules.html @@ -1,13 +1,13 @@ - + dependency-check - Project Modules @@ -62,8 +62,8 @@ -
  • Last Published: 2014-01-16
  • |
    • -
  • Version: 1.0.8
    • +
  • Last Published: 2014-01-26
  • |
    • +
  • Version: 1.1.0
    • @@ -146,6 +146,27 @@ False Positives + + +
  • + + + + Project Presentation (pptx) +
    • + +
  • + + + + Project Presentation (pdf) +
    • + +
  • + + + + Sample Report
  • Modules
    • @@ -221,7 +242,7 @@ - + diff --git a/project-info.html b/project-info.html index 2f14c8453..987c331cf 100644 --- a/project-info.html +++ b/project-info.html @@ -1,13 +1,13 @@ - + dependency-check - Project Information @@ -62,8 +62,8 @@ -
  • Last Published: 2014-01-16
  • |
    • -
  • Version: 1.0.8
    • +
  • Last Published: 2014-01-26
  • |
    • +
  • Version: 1.1.0
    • @@ -146,6 +146,27 @@ False Positives + + +
  • + + + + Project Presentation (pptx) +
    • + +
  • + + + + Project Presentation (pdf) +
    • + +
  • + + + + Sample Report
  • Modules
    • @@ -223,7 +244,7 @@ - + diff --git a/project-summary.html b/project-summary.html index 93bfad345..7949f1ed4 100644 --- a/project-summary.html +++ b/project-summary.html @@ -1,13 +1,13 @@ - + dependency-check - Project Summary @@ -62,8 +62,8 @@ -
  • Last Published: 2014-01-16
  • |
    • -
  • Version: 1.0.8
    • +
  • Last Published: 2014-01-26
  • |
    • +
  • Version: 1.1.0
    • @@ -146,6 +146,27 @@ False Positives + + +
  • + + + + Project Presentation (pptx) +
    • + +
  • + + + + Project Presentation (pdf) +
    • + +
  • + + + + Sample Report
  • Modules
    • @@ -225,7 +246,7 @@ - +
    Description
    Dependency-Check CoreDependency-check is a utility that attempts to detect publicly disclosed vulnerabilities contained within project dependencies. It does this by determining if there is a Common Platform Enumeration (CPE) identifier for a given dependency. If found, it will generate a report linking to the associated CVE entries.
    dependency-check is a utility that identifies project dependencies and checks if there are any known, publicly disclosed, vulnerabilities. This tool can be part of the solution to the OWASP Top 10 2013: A9 - Using Components with Known Vulnerabilities.
    Dependency-Check Command Line Dependency-Check-Maven is a Maven Plugin that attempts to detect publicly disclosed vulnerabilities contained within project dependencies. It does this by determining if there is a Common Platform Enumeration (CPE) identifier for a given dependency. If found, it will generate a report linking to the associated CVE entries.
    Description
    AboutDependency-check is a utility that attempts to detect publicly disclosed vulnerabilities contained within project dependencies. It does this by determining if there is a Common Platform Enumeration (CPE) identifier for a given dependency. If found, it will generate a report linking to the associated CVE entries.
    dependency-check is a utility that identifies project dependencies and checks if there are any known, publicly disclosed, vulnerabilities. This tool can be part of the solution to the OWASP Top 10 2013: A9 - Using Components with Known Vulnerabilities.
    Project Summary This document lists other related information of this project
    Dependency-Check
    DescriptionDependency-check is a utility that attempts to detect publicly disclosed vulnerabilities contained within project dependencies. It does this by determining if there is a Common Platform Enumeration (CPE) identifier for a given dependency. If found, it will generate a report linking to the associated CVE entries.
    dependency-check is a utility that identifies project dependencies and checks if there are any known, publicly disclosed, vulnerabilities. This tool can be part of the solution to the OWASP Top 10 2013: A9 - Using Components with Known Vulnerabilities.
    Homepage https://github.com/jeremylong/DependencyCheck.git
    @@ -255,7 +276,7 @@ dependency-check-parent Version -1.0.8 +1.1.0 Type pom diff --git a/source-repository.html b/source-repository.html index 992e712b5..55fa8a1d1 100644 --- a/source-repository.html +++ b/source-repository.html @@ -1,13 +1,13 @@ - + dependency-check - Source Repository @@ -62,8 +62,8 @@ -
  • Last Published: 2014-01-16
  • |
    • -
  • Version: 1.0.8
    • +
  • Last Published: 2014-01-26
  • |
    • +
  • Version: 1.1.0
    • @@ -146,6 +146,27 @@ False Positives +
    • + +
  • + + + + Project Presentation (pptx) +
    • + +
  • + + + + Project Presentation (pdf) +
    • + +
  • + + + + Sample Report
  • Modules
    • diff --git a/suppression.html b/suppression.html index 668e7db9d..80a3972c1 100644 --- a/suppression.html +++ b/suppression.html @@ -1,13 +1,13 @@ - + dependency-check - Suppressing False Positives @@ -62,8 +62,8 @@ -
  • Last Published: 2014-01-16
  • |
    • -
  • Version: 1.0.8
    • +
  • Last Published: 2014-01-26
  • |
    • +
  • Version: 1.1.0
    • @@ -89,6 +89,27 @@ False Positives + +
  • + + + + Project Presentation (pptx) +
    • + +
  • + + + + Project Presentation (pdf) +
    • + +
  • + + + + Sample Report +
  • Modules
  • diff --git a/team-list.html b/team-list.html index 01eb89412..43ea65a88 100644 --- a/team-list.html +++ b/team-list.html @@ -1,13 +1,13 @@ - + dependency-check - Team list @@ -62,8 +62,8 @@ -
  • Last Published: 2014-01-16
  • |
    • -
  • Version: 1.0.8
    • +
  • Last Published: 2014-01-26
  • |
    • +
  • Version: 1.1.0
    • @@ -146,6 +146,27 @@ False Positives + + +
  • + + + + Project Presentation (pptx) +
    • + +
  • + + + + Project Presentation (pdf) +
    • + +
  • + + + + Sample Report
  • Modules
    • @@ -242,7 +263,7 @@ Steve.Springett@owasp.org OWASP https://www.owasp.org/index.php/OWASP_Dependency_Check -contributor +developer -

    Contributors