diff --git a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/RubyBundlerAnalyzer.java b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/RubyBundlerAnalyzer.java index 7ec6c9207..0725d8202 100644 --- a/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/RubyBundlerAnalyzer.java +++ b/dependency-check-core/src/main/java/org/owasp/dependencycheck/analyzer/RubyBundlerAnalyzer.java @@ -23,20 +23,24 @@ import java.io.FilenameFilter; import org.owasp.dependencycheck.Engine; import org.owasp.dependencycheck.analyzer.exception.AnalysisException; import org.owasp.dependencycheck.dependency.Dependency; +import org.owasp.dependencycheck.utils.Settings; /** * Used to leverage Ruby gems that are deployed or installed by Ruby bundler (http://bundler.io). - * The difference of scanning gems installed by the bundler is that "bundle install" creates - * a set of new .gemspec files under a folder called "specifications", in addition to the original - * .gemspec files from source. The advantage of bundler generated .gemspec files is that - * they contain fully resolved attributes, and original .gemspec from source often contain variable - * for attributes. + * Ruby bundler creates new .gemspec files under a folder called "specifications" at deploy time, + * in addition to the original .gemspec files from source. The advantage of bundler generated + * .gemspec files is that they contain fully resolved attributes thus provides more accurate + * evidences, whereas the original .gemspec from source often contain variables for attributes + * that can't be used for evidences. * - * This analyzer takes advantage of the fully resolved .gemspec installed by the bundler for - * better dependency identification results. It also tries to resolve the dependency packagePath + * This analyzer accepts the fully resolved .gemspec installed by the bundler for + * better evidence results. It also tries to resolve the dependency packagePath * to where the gem is actually installed. Then during AnalysisPhase.PRE_FINDING_ANALYSIS - * DependencyBundlingAnalyzer would merge the two dependencies together if they contain - * the same packagePath. + * DependencyBundlingAnalyzer would merge two .gemspec dependencies together if + * Dependency.getPackagePath() are the same. + * + * Note this analyzer share the same Settings.KEYS.ANALYZER_RUBY_GEMSPEC_ENABLED as + * RubyGemspecAnalyzer, so it will enabled/disabled with RubyGemspecAnalyzer. * * @author Bianca Jiang (biancajiang@gmail.com) */ @@ -49,7 +53,7 @@ public class RubyBundlerAnalyzer extends RubyGemspecAnalyzer { private static final String GEMS = "gems"; /** - * Only accept *.gemspec stubs generated by "bundle install --deployment" under "specifications" folder. + * Only accept *.gemspec files generated by "bundle install --deployment" under "specifications" folder. */ @Override public boolean accept(File pathname) {