diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/Engine.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/Engine.java
index 473ba3faf..c3d0f6584 100644
--- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/Engine.java
+++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/Engine.java
@@ -309,10 +309,22 @@ public class Engine implements FileFilter {
if (file.isFile()) {
if (accept(file)) {
dependency = new Dependency(file);
- dependencies.add(dependency);
+ String sha1 = dependency.getSha1sum();
+ boolean found = false;
+ if (sha1 != null) {
+ for (Dependency existing : dependencies) {
+ if (sha1.equals(existing.getSha1sum())) {
+ found = true;
+ dependency = existing;
+ }
+ }
+ }
+ if (!found) {
+ dependencies.add(dependency);
+ }
+ } else {
+ LOGGER.debug("Path passed to scanFile(File) is not a file: {}. Skipping the file.", file);
}
- } else {
- LOGGER.debug("Path passed to scanFile(File) is not a file: {}. Skipping the file.", file);
}
return dependency;
}
@@ -539,6 +551,16 @@ public class Engine implements FileFilter {
return this.fileTypeAnalyzers;
}
+ /**
+ * Adds a file type analyzer. This has been added solely to assist in unit
+ * testing the Engine.
+ *
+ * @param fta the file type analyzer to add
+ */
+ protected void addFileTypeAnalyzer(FileTypeAnalyzer fta) {
+ this.fileTypeAnalyzers.add(fta);
+ }
+
/**
* Checks the CPE Index to ensure documents exists. If none exist a
* NoDataException is thrown.
diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/RubyBundleAuditAnalyzer.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/RubyBundleAuditAnalyzer.java
index bca567fa5..2376e7d80 100644
--- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/RubyBundleAuditAnalyzer.java
+++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/RubyBundleAuditAnalyzer.java
@@ -286,7 +286,7 @@ public class RubyBundleAuditAnalyzer extends AbstractFileTypeAnalyzer {
} catch (InterruptedException ie) {
throw new AnalysisException("bundle-audit process interrupted", ie);
}
- if (exitValue != 0) {
+ if (exitValue < 0 || exitValue > 1) {
final String msg = String.format("Unexpected exit code from bundle-audit process; exit code: %s", exitValue);
throw new AnalysisException(msg);
}
diff --git a/dependency-check-core/src/main/resources/templates/HtmlReport.vsl b/dependency-check-core/src/main/resources/templates/HtmlReport.vsl
index 4bdc1ffba..b62cd39b4 100644
--- a/dependency-check-core/src/main/resources/templates/HtmlReport.vsl
+++ b/dependency-check-core/src/main/resources/templates/HtmlReport.vsl
@@ -122,8 +122,26 @@ Copyright (c) 2012 Jeremy Long. All Rights Reserved.
function setCopyText(name, matchType, matchValue, suppressType, suppressVal) {
xml = '\n';
xml += ' \n';
- xml += ' <'+matchType+'>' + matchValue + ''+matchType+'>\n';
- xml += ' <'+suppressType+'>' + suppressVal + ''+suppressType+'>\n';
+ if (matchType=='gav') {
+ v = matchValue.match(/^[^:]+:[^:]+:/);
+ if (v && v[0]) {
+ xml += ' <'+matchType+' regex="true">^' + v[0].replace(/\./g,'\\.') + '.*$'+matchType+'>\n';
+ } else {
+ xml += ' <'+matchType+'>' + matchValue + ''+matchType+'>\n';
+ }
+ } else {
+ xml += ' <'+matchType+'>' + matchValue + ''+matchType+'>\n';
+ }
+ if (suppressType=='cpe') {
+ v = suppressVal.match(/^cpe:\/a:[^:]+:[^:]+/);
+ if (v && v[0]) {
+ xml += ' <'+suppressType+'>' + v[0] + ''+suppressType+'>\n';
+ } else {
+ xml += ' <'+suppressType+'>' + suppressVal + ''+suppressType+'>\n';
+ }
+ } else {
+ xml += ' <'+suppressType+'>' + suppressVal + ''+suppressType+'>\n';
+ }
xml += '';
$('#modal-text').text(xml);
$('#modal-content,#modal-background').addClass('active');
diff --git a/dependency-check-core/src/test/java/org/owasp/dependencycheck/EngineTest.java b/dependency-check-core/src/test/java/org/owasp/dependencycheck/EngineTest.java
new file mode 100644
index 000000000..3f2e9cfec
--- /dev/null
+++ b/dependency-check-core/src/test/java/org/owasp/dependencycheck/EngineTest.java
@@ -0,0 +1,53 @@
+/*
+ * This file is part of dependency-check-core.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * Copyright (c) 2016 Jeremy Long. All Rights Reserved.
+ */
+package org.owasp.dependencycheck;
+
+import java.io.File;
+import org.junit.Test;
+import static org.junit.Assert.*;
+import org.owasp.dependencycheck.analyzer.JarAnalyzer;
+import org.owasp.dependencycheck.data.nvdcve.DatabaseException;
+import org.owasp.dependencycheck.dependency.Dependency;
+
+/**
+ *
+ * @author Jeremy Long
+ */
+public class EngineTest extends BaseDBTestCase {
+
+ /**
+ * Test of scanFile method, of class Engine.
+ */
+ @Test
+ public void testScanFile() throws DatabaseException {
+ Engine instance = new Engine();
+ instance.addFileTypeAnalyzer(new JarAnalyzer());
+ File file = BaseTest.getResourceAsFile(this, "dwr.jar");
+ Dependency dwr = instance.scanFile(file);
+ file = BaseTest.getResourceAsFile(this, "org.mortbay.jmx.jar");
+ Dependency jmx = instance.scanFile(file);
+ assertEquals(2, instance.getDependencies().size());
+
+ file = BaseTest.getResourceAsFile(this, "dwr.jar");
+ Dependency secondDwr = instance.scanFile(file);
+
+ assertEquals(2, instance.getDependencies().size());
+ assertTrue(dwr == secondDwr);
+
+ }
+}
diff --git a/dependency-check-maven/pom.xml b/dependency-check-maven/pom.xml
index fd7232551..c8d7a44f0 100644
--- a/dependency-check-maven/pom.xml
+++ b/dependency-check-maven/pom.xml
@@ -38,7 +38,7 @@ Copyright (c) 2013 Jeremy Long. All Rights Reserved.
- 3.4
+ 3.5
3.1
diff --git a/dependency-check-maven/src/main/java/org/owasp/dependencycheck/maven/CheckMojo.java b/dependency-check-maven/src/main/java/org/owasp/dependencycheck/maven/CheckMojo.java
index 4017a5d93..a707dcd36 100644
--- a/dependency-check-maven/src/main/java/org/owasp/dependencycheck/maven/CheckMojo.java
+++ b/dependency-check-maven/src/main/java/org/owasp/dependencycheck/maven/CheckMojo.java
@@ -112,7 +112,7 @@ public class CheckMojo extends BaseDependencyCheckMojo {
}
}
}
- writeDataFile(getProject(), null, engine.getDependencies());
+ //writeDataFile(getProject(), null, engine.getDependencies());
showSummary(getProject(), engine.getDependencies());
checkForFailure(engine.getDependencies());
if (exCol != null && this.isFailOnError()) {
diff --git a/pom.xml b/pom.xml
index ccdc75fc9..d2f28a046 100644
--- a/pom.xml
+++ b/pom.xml
@@ -222,7 +222,7 @@ Copyright (c) 2012 - Jeremy Long
org.apache.maven.plugins
maven-resources-plugin
- 3.0.0
+ 3.0.1
org.apache.maven.plugins
@@ -500,7 +500,7 @@ Copyright (c) 2012 - Jeremy Long
org.codehaus.mojo
findbugs-maven-plugin
- 3.0.3
+ 3.0.4
org.codehaus.mojo
@@ -529,7 +529,7 @@ Copyright (c) 2012 - Jeremy Long
org.codehaus.mojo
versions-maven-plugin
- 2.2
+ 2.3
@@ -572,7 +572,7 @@ Copyright (c) 2012 - Jeremy Long
com.sun.mail
mailapi
- 1.5.5
+ 1.5.6
ch.qos.logback
@@ -648,7 +648,7 @@ Copyright (c) 2012 - Jeremy Long
org.apache.maven.plugin-tools
maven-plugin-annotations
- 3.4
+ 3.5
org.apache.maven.reporting